Aggregation operators

avg aggregates over every log line that matches the query within the selected time window (for example, the last 1 hour). A single returned row represents the mean across all matching events in that window. After extracting fields with parse, FuseQL coerces the string values to numbers automatically — no explicit conversion is needed.

count_unique works on string, UUID, and IP address typed facets. Fields extracted by parse are treated as strings, so they work directly with count_unique without any conversion.

count counts every matched log line, including lines where a particular field is null. To count only lines where a specific field has a value, use count_unique on that field, or add a where filter before counting.

first is determined by log ingestion order within the query window, which reflects the timestamp on each log line. It is most useful for baselining or detecting cold-start behaviour. Compare first against last to see whether values changed significantly over the window.

last is the counterpart of first — together they let you compare the earliest and most recent observations within a window to detect trends or state changes. last is most useful for capturing the final outcome of a process or the steady-state value after a warm-up period.

max surfaces worst-case conditions. A single outlier can cause max to spike even when avg looks healthy — pair max with p99 to distinguish rare extreme outliers from the general tail. After extracting fields with parse, FuseQL coerces string values to numbers automatically.

min is useful for establishing a lower bound. A result of 0 bytes does not mean the response failed — status codes like 204 No Content and 304 Not Modified legitimately send no body. Combine min and max in a single query to see the full response size range in one result set. After extracting fields with parse, FuseQL coerces string values to numbers automatically.

Use p95 or p99 for SLO threshold checks and p50 (the median) for a robust measure of typical behaviour that is not skewed by outliers. A large gap between p50 and p99 indicates a long-tail distribution — common for endpoints that serve both small API responses and large file downloads. After extracting fields with parse, FuseQL coerces string values to numbers automatically.

stddev is expressed in the same unit as the input field (bytes, in this case), making it easy to interpret alongside avg. A high stddev relative to avg signals a wide mix of response sizes — this is normal for GET endpoints that serve both small API responses and large file downloads. Prefer stddev over stdvar when you need a human-readable measure of spread. After extracting fields with parse, FuseQL coerces string values to numbers automatically.

Because variance squares the unit of the input field (bytes², in this case), the result is difficult to interpret directly. Use stdvar when you need to mathematically combine variance across groups (for example, pooled variance calculations). For dashboards and alerts where you want a spread figure in the original unit (bytes), use stddev instead. After extracting fields with parse, FuseQL coerces string values to numbers automatically.

sum is most meaningful for fields that represent quantities that accumulate, such as bytes transferred, processing time, or event counts. The values above are totals across all log lines in the selected time window. After extracting fields with parse, FuseQL coerces string values to numbers automatically.