Arithmetic operators

FuseQL supports the following arithmetic functions for performing mathematical operations in queries.

abs

Returns the absolute value of a number. Negative values become positive; non-negative values are unchanged. Use abs to normalize signed fields — such as latency deltas or signed error margins — before computing aggregations.

Syntax

| abs(<number>) as <alias>
none

Parameters

Parameter Required Description

<number>

Required

A numeric field name or literal value.

as <alias>

Required

Output column name for the result.

Example

Count nginx requests per 1-minute bucket and compute the absolute value of each bucket’s count. Because counts are always non-negative, the result equals the count itself — this pattern is most useful when the input field can be negative, such as a latency deviation.

source="nginx"
| timeslice 1m
| count as requests by _timeslice
| abs(requests) as abs_requests
Expected output
_timeslice requests abs_requests

2026-06-27 18:53:00 UTC

61,441

61,441

2026-06-27 18:54:00 UTC

650,712

650,712

abs is most useful when applied to fields that may hold negative values, such as differences between two metrics (actual - expected). Applying it to a count or sum that is always positive is safe but has no practical effect.

cbrt

Returns the cube root of a number. Use cbrt when you need to reverse a cubic scale — for example, when working with volume measurements or when normalising data across an order-of-magnitude range where a square root would under-compress.

Syntax

| cbrt(<number>) as <alias>
none

Parameters

Parameter Required Description

<number>

Required

A numeric field name or literal value. Negative inputs return a negative cube root.

as <alias>

Required

Output column name for the result.

Example

Compute the cube root of nginx request counts per 1-minute bucket to compress the wide range of traffic volumes into a more manageable scale.

source="nginx"
| timeslice 1m
| count as requests by _timeslice
| cbrt(requests) as cbrt_requests
Expected output
_timeslice requests cbrt_requests

2026-06-27 18:53:00 UTC

61,441

39.47

2026-06-27 18:54:00 UTC

650,712

86.65

cbrt(27) returns 3.0. For very large request volumes (hundreds of thousands), the cube root compresses values into the tens-to-hundreds range, making traffic spikes easier to visualize on a single chart axis.

ceil

Rounds a number up to the nearest integer (ceiling function). Use ceil to ensure values never fall below a threshold when converting fractional counts or rates to discrete integers.

Syntax

| ceil(<number>) as <alias>
none

Parameters

Parameter Required Description

<number>

Required

A numeric field name or literal value.

as <alias>

Required

Output column name for the result.

Example

Compute the error rate per minute and round it up to the nearest whole number of errors per minute, ensuring fractional rates are never under-reported.

source="nginx"
| timeslice 1m
| count as requests by _timeslice
| ceil(requests / 60) as ceil_rps
Expected output
_timeslice requests ceil_rps

2026-06-27 18:53:00 UTC

61,441

1,024

2026-06-27 18:54:00 UTC

650,712

10,846

ceil(3.14) returns 4. ceil always rounds away from zero for positive numbers, so even ceil(3.001) returns 4. For rounding toward zero, use floor.

exp

Returns Euler’s number e (~2.71828) raised to the power of a number. Use exp to reverse a natural logarithm transformation — for example, to convert log-scaled metrics back to their original linear scale.

Syntax

| exp(<number>) as <alias>
none

Parameters

Parameter Required Description

<number>

Required

A numeric field name or literal value. Large inputs (above ~700) will overflow to infinity.

as <alias>

Required

Output column name for the result.

Example

Apply exp to a small constant to illustrate the result. In practice, pair exp with log to round-trip a transformed metric back to its original scale.

source="nginx"
| timeslice 5m
| count as requests by _timeslice
| log(requests) as log_requests
| exp(log_requests) as recovered_requests
Expected output
_timeslice log_requests recovered_requests

2026-06-27 18:50:00 UTC

13.01

449,628.0

2026-06-27 18:55:00 UTC

13.39

652,847.0

exp(1) returns 2.71828 (Euler’s number). exp(3) returns 20.09. Applying exp directly to raw request counts (which can be in the hundreds of thousands) will overflow — always apply it to log-transformed or small-valued fields.

expm1

Returns exp(<number>) − 1 with higher numerical precision than computing exp(x) - 1 directly. When <number> is very close to zero, the standard exp function loses precision due to floating-point cancellation; expm1 avoids this by using a mathematically equivalent but numerically stable computation.

Syntax

| expm1(<number>) as <alias>
none

Parameters

Parameter Required Description

<number>

Required

A numeric field name or literal value. For inputs near zero, expm1 is significantly more accurate than exp(x) - 1.

as <alias>

Required

Output column name for the result.

Example

Compute expm1 of a small normalized rate to illustrate precision-safe exponential growth. This pattern is useful when converting a per-second fractional growth rate back to an absolute multiplier.

source="nginx"
| timeslice 1m
| count as requests by _timeslice
| expm1(requests / 1000000) as growth_factor
Expected output
_timeslice requests growth_factor

2026-06-27 18:53:00 UTC

61,441

0.0634

2026-06-27 18:54:00 UTC

650,712

0.9164

expm1(1) returns 1.71828 (i.e., e − 1). For x = 0.000001, expm1(x) returns 1.0000005e-6 exactly, whereas exp(x) - 1 may return 0 or a very inaccurate value on some platforms. Use expm1 when your input values are rates or probabilities close to zero.

floor

Rounds a number down to the nearest integer (floor function). Use floor to truncate fractional values — for example, to bucket a continuous metric into discrete integer bins.

Syntax

| floor(<number>) as <alias>
none

Parameters

Parameter Required Description

<number>

Required

A numeric field name or literal value.

as <alias>

Required

Output column name for the result.

Example

Divide nginx request counts by 1000 and floor the result to express traffic in thousands of requests per minute, rounded down.

source="nginx"
| timeslice 1m
| count as requests by _timeslice
| floor(requests / 1000) as krequests
Expected output
_timeslice requests krequests

2026-06-27 18:53:00 UTC

61,441

61

2026-06-27 18:54:00 UTC

650,712

650

floor(3.99) returns 3. For negative numbers, floor(-3.2) returns -4 (toward negative infinity). To round toward zero for negative numbers, use explicit sign handling. To round up instead, use ceil.

log

Returns the natural logarithm (base e) of a number. Use log to compress wide-ranging metrics — such as request counts that span several orders of magnitude — into a scale that is easier to visualize and compare.

Syntax

| log(<number>) as <alias>
none

Parameters

Parameter Required Description

<number>

Required

A positive numeric field name or literal value. Inputs of zero or negative values are undefined and return NaN or -Infinity.

as <alias>

Required

Output column name for the result.

Example

Compute the natural log of nginx request counts per 1-minute bucket to compress the traffic volume onto a log scale for trend analysis.

source="nginx"
| timeslice 1m
| count as requests by _timeslice
| log(requests) as log_requests
Expected output
_timeslice requests log_requests

2026-06-27 18:53:00 UTC

61,441

11.03

2026-06-27 18:54:00 UTC

650,712

13.39

2026-06-27 18:55:00 UTC

474,040

13.07

log(10) returns 2.30258 (not 1 — that is the base-10 logarithm). To reverse the transformation, apply exp. For base-10 logarithms use log10.

log10

Returns the base-10 logarithm of a number. Use log10 when you need human-readable scale compression — the result corresponds directly to the number of decimal digits in the original value, making it intuitive for metrics like request counts or byte sizes.

Syntax

| log10(<number>) as <alias>
none

Parameters

Parameter Required Description

<number>

Required

A positive numeric field name or literal value. Inputs of zero or negative values are undefined and return NaN or -Infinity.

as <alias>

Required

Output column name for the result.

Example

Compute the base-10 logarithm of nginx request counts per 1-minute bucket. A result of 5.8 means the count is approximately 10^5.8 ≈ 630,000.

source="nginx"
| timeslice 1m
| count as requests by _timeslice
| log10(requests) as log10_requests
Expected output
_timeslice requests log10_requests

2026-06-27 18:53:00 UTC

61,441

4.79

2026-06-27 18:54:00 UTC

650,712

5.81

2026-06-27 18:55:00 UTC

474,040

5.68

log10(10) returns 1.0. log10(100) returns 2.0. log10(600000) returns approximately 5.78. For the natural logarithm (base e), use log. The two are related by log10(x) = log(x) / log(10).

round

Rounds a number to the nearest integer using half-up rounding (0.5 rounds up). Use round to convert fractional averages or rates into clean integer values for display or downstream grouping.

Syntax

| round(<number>) as <alias>
none

Parameters

Parameter Required Description

<number>

Required

A numeric field name or literal value.

as <alias>

Required

Output column name for the result.

Example

Compute the average nginx request count per second (dividing the per-minute count by 60) and round to the nearest whole request-per-second value.

source="nginx"
| timeslice 1m
| count as requests by _timeslice
| round(requests / 60) as rps
Expected output
_timeslice requests rps

2026-06-27 18:53:00 UTC

61,441

1,024

2026-06-27 18:54:00 UTC

650,712

10,845

2026-06-27 18:55:00 UTC

474,040

7,901

round(3.5) returns 4; round(3.4) returns 3. To always round up, use ceil; to always round down, use floor.

sqrt

Returns the square root of a number. Use sqrt to compress wide-ranging metrics — such as request counts spanning five orders of magnitude — into a more uniform scale that is easier to visualize without collapsing low-traffic buckets.

Syntax

| sqrt(<number>) as <alias>
none

Parameters

Parameter Required Description

<number>

Required

A non-negative numeric field name or literal value. Negative inputs return NaN.

as <alias>

Required

Output column name for the result.

Example

Compute the square root of nginx request counts per 1-minute bucket to normalize traffic volumes before plotting. A count of 61,441 becomes ~248; a count of 650,712 becomes ~807, keeping both values on the same chart axis.

source="nginx"
| timeslice 1m
| count as requests by _timeslice
| sqrt(requests) as sqrt_requests
Expected output
_timeslice requests sqrt_requests

2026-06-27 18:53:00 UTC

61,441

247.87

2026-06-27 18:54:00 UTC

650,712

806.67

2026-06-27 18:55:00 UTC

474,040

688.51

sqrt(16) returns 4.0. For cube root compression use cbrt; for logarithmic compression use log or log10. sqrt is a good middle ground when you want less compression than a logarithm but more than a cube root.