You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: content/en/logs/explorer/_index.md
+2-3Lines changed: 2 additions & 3 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -57,15 +57,15 @@ Logs can be valuable as individual events, but sometimes valuable information li
57
57
58
58
### Fields
59
59
60
-
With the field aggregation, all logs matching the query filter are aggregated into groups based on the value of a log facet. On top of these aggregates, you can extract the following measures:
60
+
With fields aggregation, all logs matching the query filter are aggregated into groups based on the value of one or multiple log facets. On top of these aggregates, you can extract the following measures:
61
61
62
62
-**count of logs** per group
63
63
-**unique count** of coded values for a facet per group
64
64
-**statistical operations** (`min`, `max`, `avg`, and `percentiles`) on numerical values of a facet per group
65
65
66
66
**Note**: Individual logs having multiple values for a single facet belong to that many aggregates. For instance, a log having the `team:sre` and the `team:marketplace` tags are counted once in the `team:sre` aggregate and once in the `team:marketplace` aggregate.
67
67
68
-
Groups support the [Timeseries](#timeseries), [Toplist](#toplist) and [Table](#table) visualizations.
68
+
Fields aggregation supports one dimension for the [Table](#table) visualization, and up to three dimensions for the [Timeseries](#timeseries) and [Toplist](#toplist) visualizations. When there are multiple dimensions, the top values are determined according to the first dimension, then according to the second dimension within the top values of the first dimension, then according to the third dimension within the top values of the second dimension.
69
69
70
70
### Patterns
71
71
@@ -159,7 +159,6 @@ For example, the following Toplist shows the **top 15 Customers** on a merchant
159
159
160
160
Visualize the top values from a [facet][2] according to a chosen [measure][2] (the first measure you choose in the list), and display the value of additional measures for elements appearing in this top. Update a search query or drill through logs corresponding to either dimension.
161
161
162
-
- When there are multiple dimensions, the top values are determined according to the first dimension, then according to the second dimension within the top values of the first dimension, then according to the third dimension within the top values of the second dimension.
163
162
- When there are multiple measures, the top or bottom list is determined according to the first measure.
164
163
- The subtotal may differ from the actual sum of values in a group, since only a subset (top or bottom) is displayed. Events with a null or empty value for this dimension are not displayed as a sub-group.
0 commit comments