make_list
This page explains how to use the make_list aggregation function in APL.
The make_list aggregation function in Axiom Processing Language (APL) collects all values from a specified column into a dynamic array for each group of rows in a dataset. This aggregation is particularly useful when you want to consolidate multiple values from distinct rows into a single grouped result.
For example, if you have multiple log entries for a particular user, you can use make_list to gather all request URIs accessed by that user into a single list. You can also apply make_list to various contexts, such as trace aggregation, log analysis, or security monitoring, where collating related events into a compact form is needed.
Key uses of make_list:
- Consolidating values from multiple rows into a list per group.
- Summarizing activity (for example, list all HTTP requests by a user).
- Generating traces or timelines from distributed logs.
Usage
Syntax
Parameters
column: The name of the column to collect into a list.
Returns
The make_list function returns a dynamic array that contains all values of the specified column for each group of rows.
Use case examples
In log analysis, make_list is useful for collecting all URIs a user has accessed in a session. This can help in identifying browsing patterns or tracking user activity.
Query
Output
| id | uris |
|---|---|
| user123 | [‘/home’, ‘/profile’, ‘/cart’] |
| user456 | [‘/search’, ‘/checkout’, ‘/pay’] |
This query collects all URIs accessed by each user, providing a compact view of user activity in the logs.
In OpenTelemetry traces, make_list can help in gathering the list of services involved in a trace by consolidating all service names related to a trace ID.
Query
Output
| trace_id | services |
|---|---|
| trace_a | [‘frontend’, ‘cartservice’, ‘checkoutservice’] |
| trace_b | [‘productcatalogservice’, ‘loadgenerator’] |
This query aggregates all service names associated with a particular trace, helping trace spans across different services.
In security logs, make_list is useful for collecting all IPs or cities from where a user has initiated requests, aiding in detecting anomalies or patterns.
Query
Output
| id | cities |
|---|---|
| user123 | [‘New York’, ‘Los Angeles’] |
| user456 | [‘Berlin’, ‘London’] |
This query collects the cities from which each user has made HTTP requests, useful for geographical analysis or anomaly detection.
List of related aggregations
- make_set: Similar to
make_list, but only unique values are collected in the set. Usemake_setwhen duplicates aren’t relevant. - count: Returns the count of rows in each group. Use this instead of
make_listwhen you’re interested in row totals rather than individual values. - max: Aggregates values by returning the maximum value from each group. Useful for numeric comparison across rows.
- dcount: Returns the distinct count of values for each group. Use this when you need unique value counts instead of listing them.