topk
This page explains how to use the topk aggregation function in APL.
The topk aggregation in Axiom Processing Language (APL) allows you to identify the top k results based on a specified field. This is especially useful when you want to quickly analyze large datasets and extract the most significant values, such as the top-performing queries, most frequent errors, or highest latency requests.
Use topk to find the most common or relevant entries in datasets, especially in log analysis, telemetry data, and monitoring systems. This aggregation helps you focus on the most important data points, filtering out the noise.
Usage
Syntax
topk(Field, k)Parameters
Field: The field or expression to rank the results by.k: The number of top results to return.
Returns
A subset of the original dataset with the top k values based on the specified field.
Use case examples
When analyzing HTTP logs, you can use the topk function to find the top 5 most frequent HTTP status codes.
Query
Output
| status | count_ |
|---|---|
| 200 | 1500 |
| 404 | 400 |
| 500 | 200 |
| 301 | 150 |
| 302 | 100 |
This query groups the logs by HTTP status and returns the 5 most frequent statuses.
In OpenTelemetry traces, you can use topk to find the top five status codes by service.
Query
Output
| service.name | attributes.http.status_code | _count |
|---|---|---|
| frontendproxy | 200 | 34,862,088 |
| 203 | 3,095,223 | |
| 404 | 154,417 | |
| 500 | 153,823 | |
| 504 | 3,497 |
This query shows the top five status codes by service.
You can use topk in security log analysis to find the top 5 cities generating the most HTTP requests.
Query
Output
| geo.city | count_ |
|---|---|
| New York | 500 |
| London | 400 |
| Paris | 350 |
| Tokyo | 300 |
| Berlin | 250 |
This query returns the top 5 cities based on the number of HTTP requests.
List of related aggregations
- top: Returns the top values based on a field without requiring a specific number of results (
k), making it useful when you’re unsure how many top values to retrieve. - topkif: Returns the top
kresults without filtering. Use topk when you don’t need to restrict your analysis to a subset. - sort: Orders the dataset based on one or more fields, which is useful if you need a complete ordered list rather than the top
kvalues. - extend: Adds calculated fields to your dataset, which can be useful in combination with
topkto create custom rankings. - count: Aggregates the dataset by counting occurrences, often used in conjunction with
topkto find the most common values.