# Aggregation operators

Aggregation operators enable you to create log-based metrics. Log-based metrics help you cut through the noise of high-volume logs to identify trends and patterns in your application activity.

Here is the comprehensive list of aggregation operators:

## avg

Computes the average of numeric values.

### _Syntax_
```none
| avg(<field>) [as <alias>] [by <field1>, <field2>, ...]
```

### _Example_
Calculate the average query duration grouped by alert name and PromQL query:
```none
source="query-service" and org_id="pisco-shared"
| @AlertName as AlertName, @duration as duration
| toDuration(duration) as durationMs
| parse "query:[*] start:[" as PromQL
| where durationMs > 1000
| fields - duration
| avg(durationMs) by AlertName, PromQL
```

## count

Counts the total number of log lines.

### _Syntax_
```none
| count [by <field1>, <field2>, ...]
```

### _Example_
Count the number of slow queries grouped by alert name and PromQL query:
```none
source="query-service" and org_id="pisco-shared"
| @AlertName as AlertName, @duration as duration
| toDuration(duration) as durationMs
| parse "query:[*] start:[" as PromQL
| where durationMs > 1000
| fields - duration
| count by AlertName, PromQL
```

## count_unique

Counts only unique or distinct occurrences of the field. This operator can be applied on fingerprints, labels or string valued facets (facet value can be of string/UUID/IP address datatype).

### _Syntax_
```none
| count_unique(<field>) [as <alias>] [by <field1>, <field2>, ...]
```

### _Example_
Count the number of unique alert names for slow queries:
```none
source="query-service" and org_id="pisco-shared"
| @AlertName as AlertName, @duration as duration
| toDuration(duration) as durationMs
| parse "query:[*] start:[" as PromQL
| where durationMs > 1000
| fields - duration
| count_unique(AlertName)
```

## first

Computes the first of numeric values.

### _Syntax_
```none
| first(<field>) [as <alias>] [by <field1>, <field2>, ...]
```

### _Example_
Get the first query duration value for each alert name:
```none
source="query-service" and org_id="pisco-shared"
| @AlertName as AlertName, @duration as duration
| toDuration(duration) as durationMs
| parse "query:[*] start:[" as PromQL
| where durationMs > 1000
| fields - duration
| first(durationMs) by AlertName
```

## last

Computes the last of numeric values.

### _Syntax_
```none
| last(<field>) [as <alias>] [by <field1>, <field2>, ...]
```

### _Example_
Get the last query duration value for each alert name:
```none
source="query-service" and org_id="pisco-shared"
| @AlertName as AlertName, @duration as duration
| toDuration(duration) as durationMs
| parse "query:[*] start:[" as PromQL
| where durationMs > 1000
| fields - duration
| last(durationMs) by AlertName
```

## max

Computes the maximum of numeric values.

### _Syntax_
```none
| max(<field>) [as <alias>] [by <field1>, <field2>, ...]
```

### _Example_
Find the maximum query duration for each alert name:
```none
source="query-service" and org_id="pisco-shared"
| @AlertName as AlertName, @duration as duration
| toDuration(duration) as durationMs
| parse "query:[*] start:[" as PromQL
| where durationMs > 1000
| fields - duration
| max(durationMs) by AlertName
```

## min

Computes the minimum of numeric values.

### _Syntax_
```none
| min(<field>) [as <alias>] [by <field1>, <field2>, ...]
```

### _Example_
Find the minimum query duration for each alert name:
```none
source="query-service" and org_id="pisco-shared"
| @AlertName as AlertName, @duration as duration
| toDuration(duration) as durationMs
| parse "query:[*] start:[" as PromQL
| where durationMs > 1000
| fields - duration
| min(durationMs) by AlertName
```

## percentiles

Computes the percentiles (p50, p75, p90, p95 or p99) of numeric values.

### _Syntax_
```none
| p50(<field>) [as <alias>] [by <field1>, <field2>, ...]
| p75(<field>) [as <alias>] [by <field1>, <field2>, ...]
| p90(<field>) [as <alias>] [by <field1>, <field2>, ...]
| p95(<field>) [as <alias>] [by <field1>, <field2>, ...]
| p99(<field>) [as <alias>] [by <field1>, <field2>, ...]
| p84(<field>) [as <alias>] [by <field1>, <field2>, ...]
| p16(<field>) [as <alias>] [by <field1>, <field2>, ...]
```

### _Example_
Calculate the 95th percentile of query duration for each alert name:
```none
source="query-service" and org_id="pisco-shared"
| @AlertName as AlertName, @duration as duration
| toDuration(duration) as durationMs
| parse "query:[*] start:[" as PromQL
| where durationMs > 1000
| fields - duration
| p95(durationMs) by AlertName
```

## stddev

Computes the standard deviation of numeric or duration-valued facets.

### _Syntax_
```none
| stddev(<field>) [as <alias>] [by <field1>, <field2>, ...]
```

### _Example_
Calculate the standard deviation of query duration for each alert name:
```none
source="query-service" and org_id="pisco-shared"
| @AlertName as AlertName, @duration as duration
| toDuration(duration) as durationMs
| parse "query:[*] start:[" as PromQL
| where durationMs > 1000
| fields - duration
| stddev(durationMs) by AlertName
```

## stdvar

Computes the standard variance of numeric or duration-valued facets.

### _Syntax_
```none
| stdvar(<field>) [as <alias>] [by <field1>, <field2>, ...]
```

### _Example_
Calculate the standard variance of query duration for each alert name:
```none
source="query-service" and org_id="pisco-shared"
| @AlertName as AlertName, @duration as duration
| toDuration(duration) as durationMs
| parse "query:[*] start:[" as PromQL
| where durationMs > 1000
| fields - duration
| stdvar(durationMs) by AlertName
```

## sum

Computes the sum of numeric or duration-valued facets.

### _Syntax_
```none
| sum(<field>) [as <alias>] [by <field1>, <field2>, ...]
```

### _Example_
Calculate the total query duration for each alert name:
```none
source="query-service" and org_id="pisco-shared"
| @AlertName as AlertName, @duration as duration
| toDuration(duration) as durationMs
| parse "query:[*] start:[" as PromQL
| where durationMs > 1000
| fields - duration
| sum(durationMs) by AlertName
```