Aggregation operators

Aggregation operators enable you to create log-based metrics. Log-based metrics help you cut through the noise of high-volume logs to identify trends and patterns in your application activity.

Here is the comprehensive list of aggregation operators:

avg

Computes the average of numeric values.

Syntax

| avg(<field>) [as <alias>] [by <field1>, <field2>, ...]

Example

Calculate the average query duration grouped by alert name and PromQL query:

source="query-service" and org_id="pisco-shared"
| @AlertName as AlertName, @duration as duration
| toDuration(duration) as durationMs
| parse "query:[*] start:[" as PromQL
| where durationMs > 1000
| fields - duration
| avg(durationMs) by AlertName, PromQL

count

Counts the total number of log lines.

Syntax

| count [by <field1>, <field2>, ...]

Example

Count the number of slow queries grouped by alert name and PromQL query:

source="query-service" and org_id="pisco-shared"
| @AlertName as AlertName, @duration as duration
| toDuration(duration) as durationMs
| parse "query:[*] start:[" as PromQL
| where durationMs > 1000
| fields - duration
| count by AlertName, PromQL

count_unique

Counts only unique or distinct occurrences of the field. This operator can be applied on fingerprints, labels or string valued facets (facet value can be of string/UUID/IP address datatype).

Syntax

| count_unique(<field>) [as <alias>] [by <field1>, <field2>, ...]

Example

Count the number of unique alert names for slow queries:

source="query-service" and org_id="pisco-shared"
| @AlertName as AlertName, @duration as duration
| toDuration(duration) as durationMs
| parse "query:[*] start:[" as PromQL
| where durationMs > 1000
| fields - duration
| count_unique(AlertName)

first

Computes the first of numeric values.

Syntax

| first(<field>) [as <alias>] [by <field1>, <field2>, ...]

Example

Get the first query duration value for each alert name:

source="query-service" and org_id="pisco-shared"
| @AlertName as AlertName, @duration as duration
| toDuration(duration) as durationMs
| parse "query:[*] start:[" as PromQL
| where durationMs > 1000
| fields - duration
| first(durationMs) by AlertName

last

Computes the last of numeric values.

Syntax

| last(<field>) [as <alias>] [by <field1>, <field2>, ...]

Example

Get the last query duration value for each alert name:

source="query-service" and org_id="pisco-shared"
| @AlertName as AlertName, @duration as duration
| toDuration(duration) as durationMs
| parse "query:[*] start:[" as PromQL
| where durationMs > 1000
| fields - duration
| last(durationMs) by AlertName

max

Computes the maximum of numeric values.

Syntax

| max(<field>) [as <alias>] [by <field1>, <field2>, ...]

Example

Find the maximum query duration for each alert name:

source="query-service" and org_id="pisco-shared"
| @AlertName as AlertName, @duration as duration
| toDuration(duration) as durationMs
| parse "query:[*] start:[" as PromQL
| where durationMs > 1000
| fields - duration
| max(durationMs) by AlertName

min

Computes the minimum of numeric values.

Syntax

| min(<field>) [as <alias>] [by <field1>, <field2>, ...]

Example

Find the minimum query duration for each alert name:

source="query-service" and org_id="pisco-shared"
| @AlertName as AlertName, @duration as duration
| toDuration(duration) as durationMs
| parse "query:[*] start:[" as PromQL
| where durationMs > 1000
| fields - duration
| min(durationMs) by AlertName

percentiles

Computes the percentiles (p50, p75, p90, p95 or p99) of numeric values.

Syntax

| p50(<field>) [as <alias>] [by <field1>, <field2>, ...]
| p75(<field>) [as <alias>] [by <field1>, <field2>, ...]
| p90(<field>) [as <alias>] [by <field1>, <field2>, ...]
| p95(<field>) [as <alias>] [by <field1>, <field2>, ...]
| p99(<field>) [as <alias>] [by <field1>, <field2>, ...]
| p84(<field>) [as <alias>] [by <field1>, <field2>, ...]
| p16(<field>) [as <alias>] [by <field1>, <field2>, ...]

Example

Calculate the 95th percentile of query duration for each alert name:

source="query-service" and org_id="pisco-shared"
| @AlertName as AlertName, @duration as duration
| toDuration(duration) as durationMs
| parse "query:[*] start:[" as PromQL
| where durationMs > 1000
| fields - duration
| p95(durationMs) by AlertName

stddev

Computes the standard deviation of numeric or duration-valued facets.

Syntax

| stddev(<field>) [as <alias>] [by <field1>, <field2>, ...]

Example

Calculate the standard deviation of query duration for each alert name:

source="query-service" and org_id="pisco-shared"
| @AlertName as AlertName, @duration as duration
| toDuration(duration) as durationMs
| parse "query:[*] start:[" as PromQL
| where durationMs > 1000
| fields - duration
| stddev(durationMs) by AlertName

stdvar

Computes the standard variance of numeric or duration-valued facets.

Syntax

| stdvar(<field>) [as <alias>] [by <field1>, <field2>, ...]

Example

Calculate the standard variance of query duration for each alert name:

source="query-service" and org_id="pisco-shared"
| @AlertName as AlertName, @duration as duration
| toDuration(duration) as durationMs
| parse "query:[*] start:[" as PromQL
| where durationMs > 1000
| fields - duration
| stdvar(durationMs) by AlertName

sum

Computes the sum of numeric or duration-valued facets.

Syntax

| sum(<field>) [as <alias>] [by <field1>, <field2>, ...]

Example

Calculate the total query duration for each alert name:

source="query-service" and org_id="pisco-shared"
| @AlertName as AlertName, @duration as duration
| toDuration(duration) as durationMs
| parse "query:[*] start:[" as PromQL
| where durationMs > 1000
| fields - duration
| sum(durationMs) by AlertName