From 900d74a560c93181e9f3f7506c563fc91b9ffcda Mon Sep 17 00:00:00 2001 From: Aliaksandr Valialkin Date: Fri, 17 May 2024 04:32:47 +0200 Subject: [PATCH] wip --- docs/VictoriaLogs/CHANGELOG.md | 1 + docs/VictoriaLogs/LogsQL.md | 15 +++++++++++++++ 2 files changed, 16 insertions(+) diff --git a/docs/VictoriaLogs/CHANGELOG.md b/docs/VictoriaLogs/CHANGELOG.md index 12e6731eb..fa9fbe236 100644 --- a/docs/VictoriaLogs/CHANGELOG.md +++ b/docs/VictoriaLogs/CHANGELOG.md @@ -19,6 +19,7 @@ according to [these docs](https://docs.victoriametrics.com/VictoriaLogs/QuickSta ## tip +* FEATURE: allow applying individual [filters](https://docs.victoriametrics.com/victorialogs/logsql/#filters) per each [stats function](https://docs.victoriametrics.com/victorialogs/logsql/#stats-pipe-functions). See [these docs](https://docs.victoriametrics.com/victorialogs/logsql/#stats-with-additional-filters). * FEATURE: allow passing string values to [`min`](https://docs.victoriametrics.com/victorialogs/logsql/#min-stats) and [`max`](https://docs.victoriametrics.com/victorialogs/logsql/#max-stats) functions. Previously only numeric values could be passed to them. * BUGFIX: properly take into account `offset` [`sort` pipe](https://docs.victoriametrics.com/victorialogs/logsql/#sort-pipe) when it already has `limit`. For example, `_time:5m | sort by (foo) offset 20 limit 10`. diff --git a/docs/VictoriaLogs/LogsQL.md b/docs/VictoriaLogs/LogsQL.md index 700cb130b..d3f76a738 100644 --- a/docs/VictoriaLogs/LogsQL.md +++ b/docs/VictoriaLogs/LogsQL.md @@ -1402,6 +1402,21 @@ extracted from the `ip` [log field](https://docs.victoriametrics.com/victorialog _time:5m | stats by (ip:/24) count() requests_per_subnet ``` +#### Stats with additional filters + +Sometimes it is needed to calculate stats on different subsets of matching logs. This can be done by inserting `if ()` condition +between [stats function](#stats-pipe-functions) and `result_name`, where `any_filter` can contain arbitrary [filters](#filters). +For example, the following query calculates individually the number of [logs messages](https://docs.victoriametrics.com/victorialogs/keyconcepts/#message-field) +with `GET`, `POST` and `PUT` [words](#word), additionally to the total number of logs over the last 5 minutes: + +```logsql +_time:5m | stats + count() if (GET) gets, + count() if (POST) posts, + count() if (PUT) puts, + count() total +``` + ## stats pipe functions LogsQL supports the following functions for [`stats` pipe](#stats-pipe):