v1

latestOpenAPI 3.0.02026-07-141,4077,1665.2 MB

Logs

Aggregate events

The API endpoint to aggregate events into buckets and compute metrics and timeseries.

post/api/v2/logs/analytics/aggregate

Request body

Example request

{
  "compute": [
    {
      "aggregation": "pc90",
      "interval": "5m",
      "metric": "@duration"
    }
  ],
  "filter": {
    "from": "now-15m",
    "indexes": [
      "main",
      "web"
    ],
    "query": "service:web* AND @http.status_code:[200 TO 299]",
    "storage_tier": "indexes",
    "to": "now"
  },
  "group_by": [
    {
      "facet": "host",
      "histogram": {
        "interval": 10,
        "max": 100,
        "min": 50
      },
      "sort": {
        "aggregation": "count",
        "order": "asc"
      }
    }
  ],
  "options": {
    "timezone": "GMT"
  },
  "page": {
    "cursor": "eyJzdGFydEF0IjoiQVFBQUFYS2tMS3pPbm40NGV3QUFBQUJCV0V0clRFdDZVbG8zY3pCRmNsbHJiVmxDWlEifQ=="
  }
}

Response

Example response

{
  "data": {
    "buckets": [
      {
        "by": {
          "@state": "success",
          "@version": "abc"
        }
      }
    ]
  },
  "meta": {
    "elapsed": 132,
    "page": {
      "after": "eyJzdGFydEF0IjoiQVFBQUFYS2tMS3pPbm40NGV3QUFBQUJCV0V0clRFdDZVbG8zY3pCRmNsbHJiVmxDWlEifQ=="
    },
    "request_id": "MWlFUjVaWGZTTTZPYzM0VXp1OXU2d3xLSVpEMjZKQ0VKUTI0dEYtM3RSOFVR",
    "status": "done",
    "warnings": [
      {
        "code": "unknown_index",
        "detail": "indexes: foo, bar",
        "title": "One or several indexes are missing or invalid, results hold data from the other indexes"
      }
    ]
  }
}