get_field_aggregation
Aggregate Graylog log messages by field values to compute counts, sums, averages, min, and max. Use filters, queries, and time ranges for targeted analysis.
Instructions
Aggregate log messages by field values with statistics. Get counts, sums, averages, etc. for field values.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| to | No | End time for absolute range (ISO string or timestamp) | |
| from | No | Start time for absolute range (ISO string or timestamp) | |
| field | Yes | Field to aggregate on (e.g., 'source', 'env', 'logger_name', 'level') | |
| limit | No | Maximum number of field values to return. Default: 20 | |
| query | No | Query to filter messages | |
| filters | No | Field filters (e.g. {"env": "production"}) | |
| metrics | No | Metrics to calculate. Default: ['count'] | |
| streamIds | No | Optional stream IDs to scope the search. Use 'list_streams' to get available stream IDs. | |
| timeRange | No | Time range (e.g., '1h', '2d', '30m') or use from/to for absolute range | |
| exactMatch | No | If true (default), wraps the query in quotes for exact match. | |
| valueField | No | Numeric field for sum/avg/min/max calculations (required for non-count metrics) |