get_field_time_aggregation
Aggregate field values over time intervals to see how they change. Use this to analyze trends in your Graylog logs.
Instructions
Two-dimensional aggregation: field values over time. Shows how field values change over time intervals.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| to | No | End time for absolute range (ISO string or timestamp) | |
| from | No | Start time for absolute range (ISO string or timestamp) | |
| field | Yes | Field to aggregate on (e.g., 'source', 'env', 'level') | |
| limit | No | Maximum number of field values to return. Default: 10 | |
| query | No | Query to filter messages | |
| filters | No | Field filters (e.g. {"env": "production"}) | |
| interval | No | Time interval for buckets (e.g., '1m', '5m', '1h', 'auto'). Default: 'auto' | |
| streamIds | No | Optional stream IDs to scope the search. Use 'list_streams' to get available stream IDs. | |
| timeRange | No | Time range (e.g., '1h', '2d', '30m') or use from/to for absolute range | |
| exactMatch | No | If true (default), wraps the query in quotes for exact match. |