Aggregation operators

Aggregation operators compute a value over the spans each trace matched — a count or a duration statistic — and compare it against a threshold. Traces failing the comparison are dropped from the result.

avg

Averages a numeric field over the matching spans of each trace, then compares the result against a threshold. Traces that fail the comparison are dropped — this filters at the trace level, using evidence from all matching spans.

Syntax

{ <conditions> } | avg(<field>) <op> <value>
none

Parameters

Parameter Required Description

<field>

count(): none; others: Required

A numeric field or intrinsic, typically duration.

<op> <value>

Required

Comparison against the aggregate: >, >=, <, ⇐, =, !=.

Example

Keep traces whose matching spans average more than 10 ms.

{.service_name =~ "demo.*"} | avg(duration) > 10ms
Expected output
Root service Root span Duration

demo-java-service

database

50 ms

demo-python-service

database

50 ms

demo-go-service

database

50 ms

The aggregate runs per trace, over the spans matched by the spanset filter; the comparison decides whether the whole trace is returned.

count

Counts the matching spans in each trace, then compares the result against a threshold. Traces that fail the comparison are dropped — this filters at the trace level, using evidence from all matching spans.

Syntax

{ <conditions> } | count() <op> <value>
none

Parameters

Parameter Required Description

count()

Required

Takes no argument.

<op> <value>

Required

Comparison against the aggregate: >, >=, <, ⇐, =, !=.

Example

Keep only traces that contain more than one matching span — both demo spans qualify.

{.service_name = "demo-python-service"} | count() > 1
Expected output
Root service Root span Duration

demo-python-service

database

50 ms

demo-python-service

database

50 ms

demo-python-service

database

50 ms

The aggregate runs per trace, over the spans matched by the spanset filter; the comparison decides whether the whole trace is returned.

count() takes no argument.

max

Takes the maximum of a field over the matching spans of each trace, then compares the result against a threshold. Traces that fail the comparison are dropped — this filters at the trace level, using evidence from all matching spans.

Syntax

{ <conditions> } | max(<field>) <op> <value>
none

Parameters

Parameter Required Description

<field>

count(): none; others: Required

A numeric field or intrinsic, typically duration.

<op> <value>

Required

Comparison against the aggregate: >, >=, <, ⇐, =, !=.

Example

Keep traces whose slowest matching span exceeds 10 ms.

{.service_name =~ "demo.*"} | max(duration) > 10ms
Expected output
Root service Root span Duration

demo-go-service

database

51 ms

demo-java-service

database

50 ms

demo-python-service

database

51 ms

The aggregate runs per trace, over the spans matched by the spanset filter; the comparison decides whether the whole trace is returned.

min

Takes the minimum of a field over the matching spans of each trace, then compares the result against a threshold. Traces that fail the comparison are dropped — this filters at the trace level, using evidence from all matching spans.

Syntax

{ <conditions> } | min(<field>) <op> <value>
none

Parameters

Parameter Required Description

<field>

count(): none; others: Required

A numeric field or intrinsic, typically duration.

<op> <value>

Required

Comparison against the aggregate: >, >=, <, ⇐, =, !=.

Example

Keep traces whose fastest matching span is under one second.

{.service_name =~ "demo.*"} | min(duration) < 1s
Expected output
Root service Root span Duration

demo-java-service

database

50 ms

demo-java-service

database

50 ms

demo-go-service

database

50 ms

The aggregate runs per trace, over the spans matched by the spanset filter; the comparison decides whether the whole trace is returned.

sum

Sums a field over the matching spans of each trace, then compares the result against a threshold. Traces that fail the comparison are dropped — this filters at the trace level, using evidence from all matching spans.

Syntax

{ <conditions> } | sum(<field>) <op> <value>
none

Parameters

Parameter Required Description

<field>

count(): none; others: Required

A numeric field or intrinsic, typically duration.

<op> <value>

Required

Comparison against the aggregate: >, >=, <, ⇐, =, !=.

Example

Keep traces whose matching spans add up to more than 50 ms.

{.service_name =~ "demo.*"} | sum(duration) > 50ms
Expected output
Root service Root span Duration

demo-java-service

database

50 ms

demo-python-service

database

50 ms

demo-java-service

database

50 ms

The aggregate runs per trace, over the spans matched by the spanset filter; the comparison decides whether the whole trace is returned.