Cartesian Product

A query operation that produces all possible combinations of events from two or more subqueries. When multiple subqueries each return multiple events, a cartesian product results in every event from one subquery being paired with every event from another subquery, producing quadratic output growth or worse. For example, if one subquery returns 100 events and another returns 200 events, the cartesian product produces 20,000 result events (100 x 200 combinations). This quadratic growth can cause performance issues and excessive resource consumption. Certain query functions can potentially produce cartesian products. For example, stats() and the [ ] subquery syntax can produce a cartesian product, as can collect() when used on multiple fields with multival=false. Cartesian products are not allowed in persisted aggregations.

Related ContentRelated Terms
  • aggregation

  • groupby

  • join