Aggregation operators :: Kloudfuse Docs
Aggregation operators
avg
Averages a numeric field over the matching spans of each trace, then compares the result against a threshold. Traces that fail the comparison are dropped — this filters at the trace level, using evidence from all matching spans.
Syntax
{
Parameters
| Parameter | Required | Description |
|---|---|---|
<field> |
count(): none; others: Required | A numeric field or intrinsic, typically duration. |
<op> <value> |
Required | Comparison against the aggregate: >, >=, <, ⇐, =, !=. |
Example
Keep traces whose matching spans average more than 10 ms.
{.service_name =~ "demo.*"} | avg(duration) > 10ms
| Root service | Root span | Duration |
|---|---|---|
| demo-java-service | database | 50 ms |
| demo-python-service | database | 50 ms |
| demo-go-service | database | 50 ms |
Expected output
| The aggregate runs per trace, over the spans matched by the spanset filter; the comparison decides whether the whole trace is returned. |
count
Counts the matching spans in each trace, then compares the result against a threshold. Traces that fail the comparison are dropped — this filters at the trace level, using evidence from all matching spans.
Syntax
{
Parameters
| Parameter | Required | Description |
|---|---|---|
count() |
Required | Takes no argument. |
<op> <value> |
Required | Comparison against the aggregate: >, >=, <, ⇐, =, !=. |
Example
Keep only traces that contain more than one matching span — both demo spans qualify.
{.service_name = "demo-python-service"} | count() > 1
| Root service | Root span | Duration |
|---|---|---|
| demo-python-service | database | 50 ms |
| demo-python-service | database | 50 ms |
| demo-python-service | database | 50 ms |
Expected output
| The aggregate runs per trace, over the spans matched by the spanset filter; the comparison decides whether the whole trace is returned. count() takes no argument. |
max
Takes the maximum of a field over the matching spans of each trace, then compares the result against a threshold. Traces that fail the comparison are dropped — this filters at the trace level, using evidence from all matching spans.
Syntax
{
Example
Keep traces whose slowest matching span exceeds 10 ms.
{.service_name =~ "demo.*"} | max(duration) > 10ms
| Root service | Root span | Duration |
|---|---|---|
| demo-go-service | database | 51 ms |
| demo-java-service | database | 50 ms |
| demo-python-service | database | 51 ms |
Expected output
min
Takes the minimum of a field over the matching spans of each trace, then compares the result against a threshold. Traces that fail the comparison are dropped — this filters at the trace level, using evidence from all matching spans.
Syntax
{
Example
Keep traces whose fastest matching span is under one second.
{.service_name =~ "demo.*"} | min(duration) < 1s
| Root service | Root span | Duration |
|---|---|---|
| demo-java-service | database | 50 ms |
| demo-java-service | database | 50 ms |
| demo-go-service | database | 50 ms |
Expected output
sum
Sums a field over the matching spans of each trace, then compares the result against a threshold. Traces that fail the comparison are dropped — this filters at the trace level, using evidence from all matching spans.
Syntax
{
Example
Keep traces whose matching spans add up to more than 50 ms.
{.service_name =~ "demo.*"} | sum(duration) > 50ms
| Root service | Root span | Duration |
|---|---|---|
| demo-java-service | database | 50 ms |
| demo-python-service | database | 50 ms |
| demo-java-service | database | 50 ms |
Expected output