analyze
Aggregate log messages by top field values to reveal failures, count repeats, and spot volume spikes. Use substring matching to discover exact field values for precise filtering.
Instructions
Aggregate matching messages by the top values of a field instead of returning raw lines. Optionally add a time histogram of match volume. Three main uses: (1) WHAT IS FAILING — aggregate on a message field (msg, or whatever short summary field list_fields reveals) to collapse a thousand repetitions of one error into one row with a count; on name/container_name/source to see who is emitting them. This is far cheaper and more informative than reading the same lines via search. (2) WHEN — set histogramInterval to see whether volume spiked. (3) DISCOVER A VALUE you are about to filter on — set valueContains to find the real name of a namespace/pod/service rather than guessing it (Elasticsearch rejects a leading wildcard, so field:*foo* is an error and this is the only way to substring-match a value). Pass streams:"*" to aggregate across every readable stream in one request — cheap here, and the reliable way to see a service whose stream removes its matches from the Default Stream.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| to | No | Absolute window end, ISO-8601 UTC. Requires `from`. | |
| from | No | Absolute window start, ISO-8601 UTC (e.g. "2026-07-11 14:00:00"). Requires `to`. Overrides the relative range. | |
| size | No | Number of top values to return. Default: 20. | |
| field | Yes | Field to break down by, e.g. "source", "namespace_name", "container_name", "level". Confirm it exists with list_fields if you have not seen it in a result. | |
| query | No | Lucene query, e.g. "level:ERROR", "error OR exception", "source:api-*". Use "*" for everything. Default: "*". | |
| streams | Yes | Comma-separated Graylog stream IDs (from list_streams), or "*" for every stream the token can read. Required. Prefer "*" unless you already know the stream: the Default Stream ("000000000000000000000001") is NOT "everything" — most clusters route each service to its own stream that REMOVES its matches from the Default Stream, so searching only the Default Stream silently misses those services. | |
| instance | No | Graylog instance to query. Active: "instance_1". Default: "instance_1". | |
| valueContains | No | Case-insensitive substring filter on the returned VALUES, applied locally over a wide bucket scan. Use to find a value you only half-know, e.g. field:"namespace_name" valueContains:"catalogue" to learn the exact namespace before filtering on it. | |
| histogramInterval | No | If set, also return a time histogram of total match counts at this bucket size. | |
| searchTimeRangeInSeconds | No | Relative time range in seconds, ending now. Default: 900 (15 min). Ignored if from/to are set. |