# Aggregation operators

Aggregation operators enable you to create log-based metrics. Log-based metrics help you cut through the noise of high-volume logs to identify trends and patterns in your application activity.

FuseQL groups aggregations by time buckets, and supports additional grouping dimensions.

Here is the comprehensive list of aggregation operators:

[avg](https://docs.kloudfuse.com/platform/4.0.2/query-languages/fuseql/aggregation-operators/#avg)  
Computes the average of numeric values.

[count](https://docs.kloudfuse.com/platform/4.0.2/query-languages/fuseql/aggregation-operators/#count)  
Counts the total number of log lines.

[count_unique](https://docs.kloudfuse.com/platform/4.0.2/query-languages/fuseql/aggregation-operators/#count-unique)  
Counts only unique or distinct occurrences of the field.

[first](https://docs.kloudfuse.com/platform/4.0.2/query-languages/fuseql/aggregation-operators/#first)  
Computes the first of numeric values.

[last](https://docs.kloudfuse.com/platform/4.0.2/query-languages/fuseql/aggregation-operators/#last)  
Computes the last of numeric values.

[max](https://docs.kloudfuse.com/platform/4.0.2/query-languages/fuseql/aggregation-operators/#max)  
Computes the maximum of numeric values.

[min](https://docs.kloudfuse.com/platform/4.0.2/query-languages/fuseql/aggregation-operators/#min)  
Computes the minimum of numeric values.

[percentiles](https://docs.kloudfuse.com/platform/4.0.2/query-languages/fuseql/aggregation-operators/#percentiles)  
Computes the percentiles (p50, p75, p90, p95 or p99) of numeric values.

[stddev](https://docs.kloudfuse.com/platform/4.0.2/query-languages/fuseql/aggregation-operators/#stddev)  
Computes the standard deviation of numeric or duration-valued facets.

[stdvar](https://docs.kloudfuse.com/platform/4.0.2/query-languages/fuseql/aggregation-operators/#stdvar)  
Computes the standard variance of numeric or duration-valued facets.

[sum](https://docs.kloudfuse.com/platform/4.0.2/query-languages/fuseql/aggregation-operators/#sum)  
Computes the sum of numeric or duration-valued facets.

## Example Scenario

The examples below analyze log events from a query service that tracks alert query performance:

```none
time="2025-12-16T18:06:04.267Z" level=info msg=Finished AlertName="High Memory Usage" request="map[end:[1765908360] query:[avg(kubernetes_memory_usage)] start:[1765908060]]" duration=1.085s
```

## avg

Computes the average of numeric values.

### _Syntax_
```none
| avg(<field>) [as <alias>] [by <field1>, <field2>, ...]
```

### _Example_
Calculate the average query duration grouped by alert name and PromQL query:

```none
source="query-service" and org_id="pisco-shared"
| @AlertName as AlertName, @duration as duration
| toDuration(duration) as durationMs
| parse "query:[*] start:[" as PromQL\
| where durationMs > 1000\
| fields - duration\
| avg(durationMs) by AlertName, PromQL\
```

## count

Counts the total number of log lines.

### _Syntax_
```none
| count [by <field1>, <field2>, ...]
```

### _Example_
Count the number of slow queries grouped by alert name and PromQL query:

```none
source="query-service" and org_id="pisco-shared"
| @AlertName as AlertName, @duration as duration
| toDuration(duration) as durationMs
| parse "query:[*] start:[" as PromQL\
| where durationMs > 1000\
| fields - duration\
| count by AlertName, PromQL\
```

## count_unique

Counts only unique or distinct occurrences of the field.

This operator can be applied on fingerprints, labels or string valued facets (facet value can be of string/UUID/IP address datatype).

### _Syntax_
```none
| count_unique(<field>) [as <alias>] [by <field1>, <field2>, ...]
```

### _Example_
Count the number of unique alert names for slow queries:

```none
source="query-service" and org_id="pisco-shared"
| @AlertName as AlertName, @duration as duration
| toDuration(duration) as durationMs
| parse "query:[*] start:[" as PromQL\
| where durationMs > 1000\
| fields - duration\
| count_unique(AlertName)\
```

## first

Computes the first of numeric values.

### _Syntax_
```none
| first(<field>) [as <alias>] [by <field1>, <field2>, ...]
```

### _Example_
Get the first query duration value for each alert name:

```none
source="query-service" and org_id="pisco-shared"
| @AlertName as AlertName, @duration as duration
| toDuration(duration) as durationMs
| parse "query:[*] start:[" as PromQL\
| where durationMs > 1000\
| fields - duration\
| first(durationMs) by AlertName\
```

## last

Computes the last of numeric values.

### _Syntax_
```none
| last(<field>) [as <alias>] [by <field1>, <field2>, ...]
```

### _Example_
Get the last query duration value for each alert name:

```none
source="query-service" and org_id="pisco-shared"
| @AlertName as AlertName, @duration as duration
| toDuration(duration) as durationMs
| parse "query:[*] start:[" as PromQL\
| where durationMs > 1000\
| fields - duration\
| last(durationMs) by AlertName\
```

## max

Computes the maximum of numeric values.

### _Syntax_
```none
| max(<field>) [as <alias>] [by <field1>, <field2>, ...]
```

### _Example_
Find the maximum query duration for each alert name:

```none
source="query-service" and org_id="pisco-shared"
| @AlertName as AlertName, @duration as duration
| toDuration(duration) as durationMs
| parse "query:[*] start:[" as PromQL\
| where durationMs > 1000\
| fields - duration\
| max(durationMs) by AlertName\
```

## min

Computes the minimum of numeric values.

### _Syntax_
```none
| min(<field>) [as <alias>] [by <field1>, <field2>, ...]
```

### _Example_
Find the minimum query duration for each alert name:

```none
source="query-service" and org_id="pisco-shared"
| @AlertName as AlertName, @duration as duration
| toDuration(duration) as durationMs
| parse "query:[*] start:[" as PromQL\
| where durationMs > 1000\
| fields - duration\
| min(durationMs) by AlertName\
```

## percentiles

Computes the percentiles (p50, p75, p90, p95 or p99) of numeric values.

### _Syntax_
```none
| p50(<field>) [as <alias>] [by <field1>, <field2>, ...]
| p75(<field>) [as <alias>] [by <field1>, <field2>, ...]
| p90(<field>) [as <alias>] [by <field1>, <field2>, ...]
| p95(<field>) [as <alias>] [by <field1>, <field2>, ...]
| p99(<field>) [as <alias>] [by <field1>, <field2>, ...]
| p84(<field>) [as <alias>] [by <field1>, <field2>, ...]
| p16(<field>) [as <alias>] [by <field1>, <field2>, ...]
```

### _Example_
Calculate the 95th percentile of query duration for each alert name:

```none
source="query-service" and org_id="pisco-shared"
| @AlertName as AlertName, @duration as duration
| toDuration(duration) as durationMs
| parse "query:[*] start:[" as PromQL\
| where durationMs > 1000\
| fields - duration\
| p95(durationMs) by AlertName\
```

## stddev

Computes the standard deviation of numeric or duration-valued facets.

### _Syntax_
```none
| stddev(<field>) [as <alias>] [by <field1>, <field2>, ...]
```

### _Example_
Calculate the standard deviation of query duration for each alert name:

```none
source="query-service" and org_id="pisco-shared"
| @AlertName as AlertName, @duration as duration
| toDuration(duration) as durationMs
| parse "query:[*] start:[" as PromQL\
| where durationMs > 1000\
| fields - duration\
| stddev(durationMs) by AlertName\
```

## stdvar

Computes the standard variance of numeric or duration-valued facets.

### _Syntax_
```none
| stdvar(<field>) [as <alias>] [by <field1>, <field2>, ...]
```

### _Example_
Calculate the standard variance of query duration for each alert name:

```none
source="query-service" and org_id="pisco-shared"
| @AlertName as AlertName, @duration as duration
| toDuration(duration) as durationMs
| parse "query:[*] start:[" as PromQL\
| where durationMs > 1000\
| fields - duration\
| stdvar(durationMs) by AlertName\
```

## sum

Computes the sum of numeric or duration-valued facets.

### _Syntax_
```none
| sum(<field>) [as <alias>] [by <field1>, <field2>, ...]
```

### _Example_
Calculate the total query duration for each alert name:

```none
source="query-service" and org_id="pisco-shared"
| @AlertName as AlertName, @duration as duration
| toDuration(duration) as durationMs
| parse "query:[*] start:[" as PromQL\
| where durationMs > 1000\
| fields - duration\
| sum(durationMs) by AlertName\
```