# Aggregation operators

Aggregation operators enable you to create log-based metrics. Log-based metrics help you cut through the noise of high-volume logs to identify trends and patterns in your application activity.

FuseQL groups aggregations by time buckets, and supports additional grouping dimensions.

Here is the comprehensive list of aggregation operators:

### [avg](https://docs.kloudfuse.com/platform/3.5.0/fuseql-aggregation-operators/#avg)

Computes the average of numeric values.

### [count](https://docs.kloudfuse.com/platform/3.5.0/fuseql-aggregation-operators/#count)

Counts the total number of log lines.

### [count_unique](https://docs.kloudfuse.com/platform/3.5.0/fuseql-aggregation-operators/#count-unique)

Counts only unique or distinct occurrences of the field.

### [first](https://docs.kloudfuse.com/platform/3.5.0/fuseql-aggregation-operators/#first)

Computes the first of numeric values.

### [last](https://docs.kloudfuse.com/platform/3.5.0/fuseql-aggregation-operators/#last)

Computes the last of numeric values.

### [max](https://docs.kloudfuse.com/platform/3.5.0/fuseql-aggregation-operators/#max)

Computes the maximum of numeric values.

### [min](https://docs.kloudfuse.com/platform/3.5.0/fuseql-aggregation-operators/#min)

Computes the minimum of numeric values.

### [percentiles](https://docs.kloudfuse.com/platform/3.5.0/fuseql-aggregation-operators/#percentiles)

Computes the percentiles (p50, p75, p90, p95 or p99) of numeric values.

### [stddev](https://docs.kloudfuse.com/platform/3.5.0/fuseql-aggregation-operators/#stddev)

Computes the standard deviation of numeric or duration-valued facets.

### [stdvar](https://docs.kloudfuse.com/platform/3.5.0/fuseql-aggregation-operators/#stdvar)

Computes the standard variance of numeric or duration-valued facets.

### [sum](https://docs.kloudfuse.com/platform/3.5.0/fuseql-aggregation-operators/#sum)

Computes the sum of numeric or duration-valued facets.

## Example Scenario

The examples below analyze log events from a query service that tracks alert query performance:

```none
time="2025-12-16T18:06:04.267Z" level=info msg=Finished AlertName="High Memory Usage" request="map[end:[1765908360] query:[avg(kubernetes_memory_usage)] start:[1765908060]]" duration=1.085s
```

## avg

Computes the average of numeric values.

### _Syntax_

```none
| avg(<field>) [as <alias>] [by <field1>, <field2>, ...]
```

### _Example_

Calculate the average query duration grouped by alert name and PromQL query:

```none
source="query-service" and org_id="pisco-shared"
| @AlertName as AlertName, @duration as duration
| toDuration(duration) as durationMs
| parse "query:[*] start:[" as PromQL\n| where durationMs > 1000\n| fields - duration\n| avg(durationMs) by AlertName, PromQL\n```

## count

Counts the total number of log lines.

### _Syntax_

```none
| count [by <field1>, <field2>, ...]
```

### _Example_

Count the number of slow queries grouped by alert name and PromQL query:

```none
source="query-service" and org_id="pisco-shared"
| @AlertName as AlertName, @duration as duration
| toDuration(duration) as durationMs
| parse "query:[*] start:[" as PromQL
| where durationMs > 1000
| fields - duration
| count by AlertName, PromQL
```

## count_unique

Counts only unique or distinct occurrences of the field. This operator can be applied on fingerprints, labels or string valued facets (facet value can be of string/UUID/IP address datatype).

### _Syntax_

```none
| count_unique(<field>) [as <alias>] [by <field1>, <field2>, ...]
```

### _Example_

Count the number of unique alert names for slow queries:

```none
source="query-service" and org_id="pisco-shared"
| @AlertName as AlertName, @duration as duration
| toDuration(duration) as durationMs
| parse "query:[*] start:[" as PromQL
| where durationMs > 1000
| fields - duration
| count_unique(AlertName)
```

## first

Computes the first of numeric values.

### _Syntax_

```none
| first(<field>) [as <alias>] [by <field1>, <field2>, ...]
```

### _Example_

Get the first query duration value for each alert name:

```none
source="query-service" and org_id="pisco-shared"
| @AlertName as AlertName, @duration as duration
| toDuration(duration) as durationMs
| parse "query:[*] start:[" as PromQL
| where durationMs > 1000
| fields - duration
| first(durationMs) by AlertName
```

## last

Computes the last of numeric values.

### _Syntax_

```none
| last(<field>) [as <alias>] [by <field1>, <field2>, ...]
```

### _Example_

Get the last query duration value for each alert name:

```none
source="query-service" and org_id="pisco-shared"
| @AlertName as AlertName, @duration as duration
| toDuration(duration) as durationMs
| parse "query:[*] start:[" as PromQL
| where durationMs > 1000
| fields - duration
| last(durationMs) by AlertName
```

## max

Computes the maximum of numeric values.

### _Syntax_

```none
| max(<field>) [as <alias>] [by <field1>, <field2>, ...]
```

### _Example_

Find the maximum query duration for each alert name:

```none
source="query-service" and org_id="pisco-shared"
| @AlertName as AlertName, @duration as duration
| toDuration(duration) as durationMs
| parse "query:[*] start:[" as PromQL
| where durationMs > 1000
| fields - duration
| max(durationMs) by AlertName
```

## min

Computes the minimum of numeric values.

### _Syntax_

```none
| min(<field>) [as <alias>] [by <field1>, <field2>, ...]
```

### _Example_

Find the minimum query duration for each alert name:

```none
source="query-service" and org_id="pisco-shared"
| @AlertName as AlertName, @duration as duration
| toDuration(duration) as durationMs
| parse "query:[*] start:[" as PromQL
| where durationMs > 1000
| fields - duration
| min(durationMs) by AlertName
```

## percentiles

Computes the percentiles (p50, p75, p90, p95 or p99) of numeric values.

### _Syntax_

```none
| p50(<field>) [as <alias>] [by <field1>, <field2>, ...]
| p75(<field>) [as <alias>] [by <field1>, <field2>, ...]
| p90(<field>) [as <alias>] [by <field1>, <field2>, ...]
| p95(<field>) [as <alias>] [by <field1>, <field2>, ...]
| p99(<field>) [as <alias>] [by <field1>, <field2>, ...]
| p84(<field>) [as <alias>] [by <field1>, <field2>, ...]
| p16(<field>) [as <alias>] [by <field1>, <field2>, ...]
```

### _Example_

Calculate the 95th percentile of query duration for each alert name:

```none
source="query-service" and org_id="pisco-shared"
| @AlertName as AlertName, @duration as duration
| toDuration(duration) as durationMs
| parse "query:[*] start:[" as PromQL
| where durationMs > 1000
| fields - duration
| p95(durationMs) by AlertName
```

## stddev

Computes the standard deviation of numeric or duration-valued facets.

### _Syntax_

```none
| stddev(<field>) [as <alias>] [by <field1>, <field2>, ...]
```

### _Example_

Calculate the standard deviation of query duration for each alert name:

```none
source="query-service" and org_id="pisco-shared"
| @AlertName as AlertName, @duration as duration
| toDuration(duration) as durationMs
| parse "query:[*] start:[" as PromQL
| where durationMs > 1000
| fields - duration
| stddev(durationMs) by AlertName
```

## stdvar

Computes the standard variance of numeric or duration-valued facets.

### _Syntax_

```none
| stdvar(<field>) [as <alias>] [by <field1>, <field2>, ...]
```

### _Example_

Calculate the standard variance of query duration for each alert name:

```none
source="query-service" and org_id="pisco-shared"
| @AlertName as AlertName, @duration as duration
| toDuration(duration) as durationMs
| parse "query:[*] start:[" as PromQL
| where durationMs > 1000
| fields - duration
| stdvar(durationMs) by AlertName
```

## sum

Computes the sum of numeric or duration-valued facets.

### _Syntax_

```none
| sum(<field>) [as <alias>] [by <field1>, <field2>, ...]
```

### _Example_

Calculate the total query duration for each alert name:

```none
source="query-service" and org_id="pisco-shared"
| @AlertName as AlertName, @duration as duration
| toDuration(duration) as durationMs
| parse "query:[*] start:[" as PromQL
| where durationMs > 1000
| fields - duration
| sum(durationMs) by AlertName
```