Transform operators

Table of Contents

by
select

Transform operators follow a spanset filter after a pipe (|) and reshape what the search returns — extra attributes with select, grouping with by.

by

Groups the matching spans by the value of an attribute, returning one span set per distinct value — a quick way to see which services or operations contribute matches.

Syntax

{ <conditions> } | by(<field>)

none

Parameters

Parameter Required Description

Parameter	Required	Description
`<field>`	Required	The attribute or intrinsic to group by.

<field>

Required

The attribute or intrinsic to group by.

Example

Group the demo spans by their service name — one group per demo service.

{.service_name =~ "demo.*"} | by(.service_name)

Expected output
Root service	Root span	Duration
demo-java-service	database	50 ms
demo-go-service	database	50 ms
demo-python-service	database	50 ms

select

Requests additional attributes or intrinsics in the returned span sets, so the values appear in the search results without opening each trace.