format_bytes
This page explains how to use the format_bytes function in APL.
The format_bytes function formats a numeric value as a human-readable string representing data size in bytes with appropriate units (KB, MB, GB, etc.). Use this function to make byte values more readable in reports, dashboards, and log analysis.
Usage
Syntax
format_bytes(value, precision, units, base)Parameters
| Name | Type | Required | Description |
|---|---|---|---|
| value | number | Yes | The numeric value representing bytes to format. |
| precision | number | No | Number of decimal places (default: 0). |
| units | string | No | Target units. If omitted, units are auto-selected. Base 2 suffixes: Bytes, KiB, KB, MiB, MB, GiB, GB, TiB, TB, PiB, EiB, ZiB, YiB. Base 10 suffixes: kB, MB, GB, TB, PB, EB, ZB, YB. |
| base | number | No | Either 2 (default, 1024-based) or 10 (1000-based) for unit calculations. |
Returns
Returns a formatted string representing the byte value with appropriate units.
Use case examples
Format response header sizes as human-readable values for better analysis of payload patterns.
Query
['sample-http-logs']
| extend formatted_size = format_bytes(resp_header_size_bytes, 2)
| summarize avg_size = avg(resp_header_size_bytes), formatted_avg = format_bytes(toint(avg(resp_header_size_bytes)), 2) by status
| sort by avg_size desc
| limit 10Output
| status | avg_size | formatted_avg |
|---|---|---|
| 500 | 8765432 | 8.36 MB |
| 200 | 3456789 | 3.30 MB |
| 404 | 1234567 | 1.18 MB |
| 301 | 456789 | 446.08 KB |
This query formats average response header sizes by HTTP status code, making it easier to identify which status codes are associated with larger data transfers.
Format response header sizes for failed authentication attempts to identify potential data exfiltration or unusual payload patterns.
Query
['sample-http-logs']
| where status == '403' or status == '401'
| extend formatted_size = format_bytes(resp_header_size_bytes, 1)
| summarize failed_attempts = count(), avg_size = format_bytes(toint(avg(resp_header_size_bytes)), 1) by status
| sort by failed_attempts descOutput
| status | failed_attempts | avg_size |
|---|---|---|
| 401 | 1234 | 850.0 KB |
| 403 | 987 | 720.0 KB |
This query formats average response header sizes, helping identify unusual payload patterns that might indicate security issues.
List of related functions
- parse_bytes: Parses a formatted byte string back to a numeric value. Use this to reverse the formatting operation.
- strlen: Returns the length of a string in characters. Use this when you need character count rather than byte formatting.