Logs Analytics

A single log line is rarely the whole story — a spike in errors, a slow endpoint, or a noisy pod is a pattern across thousands of lines. The analytics views turn a filtered log search into an aggregated metric or a cluster of similar lines, so you can see the pattern instead of scrolling through it. This page covers building an aggregation and reading each view; for the search itself, see Logs Search Syntax and Logs Explorer.

The analytics views

The tab strip above the query (Timeseries · Table · Top List · Pie Chart · Stat) re-renders the same aggregation as a different shape:

Timeseries

A chart of the aggregated value over time — the default, and the one to reach for when the question is "when did this change." Render it as a Line (default), Area (stacked), Bar (stacked), or Points chart.

Table

One row per group, with the aggregated value as a column — use it when you want exact numbers next to each other rather than a shape.

Top List

A ranked table sorted by the aggregated value — the fastest way to answer "which N groups have the most/least of this."

Pie Chart

Each group as a segment sized by its share of the total — use it to see relative proportions rather than absolute counts.

Stat

A single aggregated number for the current filter and time range, with no grouping — use it for an at-a-glance total (for example, total error count in the last hour).

All five share one query builder, described below. Switching tabs keeps your query and just changes how it’s rendered.

Fingerprints view

Rather than aggregating a numeric value, the Fingerprints tab clusters the filtered logs by their message template. See Log Fingerprints for how fingerprints are generated and how to read this view.

Building a query

Each analytics view has a Queries panel with + Query and + Formula controls, and each query row has its own Builder/Code toggle (Builder for the structured controls below; Code to write the aggregation directly).

In Builder mode, a query is: Show count of [what to aggregate] by [how to group it] roll up every [time step] Limit [how many groups to keep]:

Show count of

What you’re aggregating — All Logs, or a specific facet/label. Selecting a facet or label also lets you pick the aggregation function; see Default aggregations for what Kloudfuse picks automatically based on its data type.

by

The grouping — everything (a single series/row/segment), or a facet or label to break the result out by. Group by source to compare services, by kube_pod_name to compare pods, and so on.

roll up every

The time-bucket width for a Timeseries chart (auto by default) — this is what determines the width of each bar or point.

Limit

Top (default) or Bottom N groups by aggregated value, to keep a high-cardinality grouping readable. Default is 10.

A search box above these controls accepts the same filter syntax as the Logs view — see Logs Search Syntax — so you can scope the aggregation to level=error, a namespace, or any other filter before it’s computed.

Default aggregations

Kloudfuse picks a sensible default aggregation based on what you’re aggregating, so you don’t have to choose one for a first look:

Count

Applied when examining raw logs or Fingerprints — appears as count of in the query.

Distinct count

Applied to facets or labels with a STRING or IP_ADDRESS data type — appears as count unique of. Use this to answer "how many distinct values" rather than "how many occurrences."

Average

Applied to facets with a NUMBER or DURATION data type — appears as average of. Switch to sum, min, max, or another function from the same dropdown when average isn’t what you want.

Multiple queries and formulas

Click + Query to add a second, independently-configured query (its own filter, aggregation, and grouping) to the same chart — useful for comparing two different searches side by side, for example one pod against another. By default multiple queries render as separate series on one combined chart; toggle to separate charts when you want each on its own axis (useful when the two queries are on very different scales).

Click + Formula to combine existing queries mathematically — label them (A, B, …​) and write an expression like A - B to, for example, see how far one service’s event count exceeds another’s, or divide an error-count query by a total-count query to derive an error rate. The formula renders as its own series alongside the queries it references.

Remove a query or formula from its row; when only one query remains, replace it rather than removing it — the interface always needs at least one.

FuseQL functions

Beyond the default aggregation, toggle Use FuseQL on a query to add a function to it — an algorithm (for example anomaly detection, with a choice of algorithm and sensitivity), a rollup, or another transform from the FuseQL function library. See Algorithmic operators for the full list of available functions and what each one does. Remove a function the same way you’d remove any other part of the query — it reverts to the default aggregation above.

Alerting from an analytics view

Any query built in the Timeseries view can become an alert directly — the Create alert control opens the alert wizard pre-filled with the current query, filters, and grouping. See Create a Logs Alert for the full alert configuration reference.