aggregate_logs
Aggregate OpenObserve log streams using SQL aggregation queries (COUNT, AVG, SUM, GROUP BY). Pass 'stream' as the table name, and the tool substitutes the actual stream.
Instructions
Run an aggregation query (COUNT, AVG, SUM, GROUP BY). Write the table name as stream and it is substituted with the real stream.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| sql | Yes | Full SQL using the literal token `stream` as the table, e.g. "SELECT level, COUNT(*) AS c FROM stream GROUP BY level" | |
| stream | Yes | Stream name | |
| end_time | No | ISO timestamp. Defaults to now. | |
| start_time | Yes | ISO timestamp, or relative shorthand like '15m', '2h', '7d' | |
| stream_type | No | Which store to search. Trace streams are not searchable as logs. | logs |