Aggregation Operators

Aggregation operators help aggregate log messages into groups. These groups can be user-defined or by default, they’re grouped over time. At a high level, FuseQL supports the following aggregation groups:

count all log lines
count_unique of labels or string-valued facets or fingerprints
statistical operations (min, max, avg, sum, stddev, stdvar and percentiles) on numeric or duration facet values
misc aggregation operations (first and last).

Facet values can be duration datatype if they follow go duration format. While applying any aggregation operators on these values, they are normalized to nanosecond float value.

All aggregation operators are applied after applying filters, if any, in the log search bar, and in a time range selected by the user in the time picker.

count

Counts the total number of log lines in a given time range, along with any filters applied in log search.

count_unique

Counts only unique or distinct occurrences of the field. This operator can be applied on fingerprints, labels or string valued facets (facet value can be of string/UUID/IP address datatype).