Docs
DocumentationQuery ReferenceAPI Reference
Open Console→→
DocumentationQuery ReferenceAPI Reference

Introduction

Query reference overview

APL

IntroductionSample queriesAll features
Functions
Scalar functions
Array functions
Overview
array_concat
array_extract
array_iff
array_index_of
array_length
array_reverse
array_rotate_left
array_rotate_right
array_select_dict
array_shift_left
array_shift_right
array_slice
array_sort_asc
array_sort_desc
array_split
array_sum
bag_has_key
bag_keys
bag_pack
bag_zip
isarray
len
pack_array
pack_dictionary
strcat_array
Conditional functions
Overview
case
iff
Conversion functions
Overview
dynamic_to_json
ensure_field
isbool
toarray
tobool
todatetime
todouble, toreal
todynamic
tohex
toint, tolong
tostring
totimespan
Datetime functions
Overview
ago
datetime_add
datetime_diff
datetime_part
dayofmonth
dayofweek
dayofyear
endofday
endofmonth
endofweek
endofyear
getmonth
getyear
hourofday
monthofyear
now
startofday
startofmonth
startofweek
startofyear
unixtime_microseconds_todatetime
unixtime_milliseconds_todatetime
unixtime_nanoseconds_todatetime
unixtime_seconds_todatetime
week_of_year
GenAI functions
Overview
genai_concat_contents
genai_conversation_turns
genai_cost
genai_estimate_tokens
genai_extract_assistant_response
genai_extract_function_results
genai_extract_system_prompt
genai_extract_tool_calls
genai_extract_user_prompt
genai_get_content_by_index
genai_get_content_by_role
genai_get_pricing
genai_get_role
genai_has_tool_calls
genai_input_cost
genai_is_truncated
genai_message_roles
genai_output_cost
Hash functions
Overview
hash
hash_md5
hash_sha1
hash_sha256
hash_sha512
IP functions
Overview
format_ipv4
format_ipv4_mask
geo_info_from_ip_address
has_any_ipv4
has_any_ipv4_prefix
has_ipv4
has_ipv4_prefix
ipv4_compare
ipv4_is_in_range
ipv4_is_in_any_range
ipv4_is_match
ipv4_is_private
ipv4_netmask_suffix
ipv6_compare
ipv6_is_in_any_range
ipv6_is_in_range
ipv6_is_match
parse_ipv4
parse_ipv4_mask
Mathematical functions
Overview
abs
acos
asin
atan
atan2
cos
cot
degrees
exp
exp2
exp10
gamma
isfinite
isinf
isint
isnan
log
log2
log10
loggamma
max_of
min_of
not
pi
pow
radians
rand
range
round
set_difference
set_has_element
set_intersect
set_union
sign
sin
sqrt
tan
Metadata functions
Overview
column_ifexists
cursor_current
ingestion_time
Pair functions
Overview
find_pair
pair
parse_pair
Rounding functions
Overview
bin
bin_auto
ceiling
floor
String functions
Overview
base64_decode_toarray
base64_decode_tostring
base64_encode_fromarray
base64_encode_tostring
coalesce
countof
countof_regex
extract
extract_all
format_bytes
format_url
gettype
indexof
indexof_regex
isascii
isempty
isnotempty
isnotnull
isnull
parse_bytes
parse_csv
parse_json
parse_path
parse_url
parse_urlquery
quote
regex_quote
replace
replace_regex
replace_string
reverse
split
strcat
strcat_delim
strcmp
string_size
strlen
strrep
strip_ansi_escapes
substring
tolower
totitle
toupper
translate
trim
trim_end
trim_end_regex
trim_regex
trim_space
trim_start
trim_start_regex
unicode_codepoints_from_string
unicode_codepoints_to_string
url_decode
url_encode
SQL functions
Overview
parse_sql
format_sql
Time series functions
Overview
series_abs
series_acos
series_add
series_asin
series_atan
series_ceiling
series_cos
series_cosine_similarity
series_divide
series_dot_product
series_equals
series_exp
series_fft
series_fill_backward
series_fill_const
series_fill_forward
series_fill_linear
series_fir
series_floor
series_greater
series_greater_equals
series_ifft
series_iir
series_less
series_less_equals
series_log
series_magnitude
series_max
series_min
series_multiply
series_not_equals
series_pearson_correlation
series_pow
series_sign
series_sin
series_stats
series_stats_dynamic
series_subtract
series_sum
series_tan
Type functions
Overview
isimei
ismap
isreal
iscc
isstring
isutf8
Aggregation functions
Overview
arg_min
arg_max
avg
avgif
count
countif
dcount
dcountif
histogram
histogramif
make_list
make_list_if
make_set
make_set_if
max
maxif
min
minif
percentile
percentileif
percentiles_array
percentiles_arrayif
phrases
rate
spotlight
stdev
stdevif
sum
sumif
topk
topkif
variance
varianceif
Operators
Tabular operators
Overview
count
distinct
extend
extend-valid
externaldata
getschema
join
limit
lookup
make-series
mv-expand
order
parse
parse-kv
parse-where
project
project-away
project-keep
project-rename
project-reorder
redact
sample
search
sort
summarize
take
top
union
where
Scalar operators
Set membership operators
Overview
in
!in
in~
!in~
Logical
Numerical
String
Reference
Entity names
Map fields
Null values
Scalar data types
Set statement
Special field attributes
Migrate
Splunk SPL
SQL
Sumo Logic

MPL

Language featuresSample queriesMigrate
APL/Functions

series_log

This page explains how to use the series_log function in APL.

The series_log function computes the natural logarithm (base e) of each element in a numeric dynamic array (series). This performs element-wise logarithmic transformation across the entire series.

You can use series_log when you need to apply logarithmic transformations to time-series data. This is particularly useful for normalizing exponentially distributed data, linearizing exponential growth patterns, compressing wide value ranges, or preparing data for analysis that assumes log-normal distributions.

Usage

Syntax

APL
series_log(array)

Parameters

ParameterTypeDescription
arraydynamicA dynamic array of numeric values. Values must be positive.

Returns

A dynamic array where each element is the natural logarithm of the corresponding input element. Returns null for non-positive values.

Use case examples

In log analysis, you can use series_log to normalize request durations that follow an exponential distribution, making patterns easier to visualize and analyze.

Query

APLRun in Playground
['sample-http-logs']
| summarize durations = make_list(req_duration_ms) by id
| extend log_durations = series_log(durations)
| take 5

Output

iddurationslog_durations
u123[50, 100, 500, 1000][3.91, 4.61, 6.21, 6.91]
u456[25, 75, 200, 800][3.22, 4.32, 5.30, 6.68]

This query applies logarithmic transformation to request durations, compressing the range and making it easier to compare values across different scales.

In OpenTelemetry traces, you can use series_log to linearize exponentially growing span durations, making trends more apparent in visualization.

Query

APLRun in Playground
['otel-demo-traces']
| extend duration_ms = duration / 1ms
| summarize durations = make_list(duration_ms) by ['service.name']
| extend log_durations = series_log(durations)
| take 5

Output

service.namedurationslog_durations
frontend[10, 50, 250, 1000][2.30, 3.91, 5.52, 6.91]
checkout[20, 100, 500, 2000][3.00, 4.61, 6.21, 7.60]

This query applies logarithmic transformation to span durations, making exponential growth patterns appear linear for easier analysis.

In security logs, you can use series_log to normalize request volumes that follow exponential patterns, making anomaly detection more effective.

Query

APLRun in Playground
['sample-http-logs']
| summarize request_counts = make_list(req_duration_ms) by status
| extend log_counts = series_log(request_counts)
| take 5

Output

statusrequest_countslog_counts
200[100, 500, 1000, 5000][4.61, 6.21, 6.91, 8.52]
401[10, 50, 100, 500][2.30, 3.91, 4.61, 6.21]

This query applies logarithmic transformation to request counts, making it easier to detect unusual patterns in security events across different scales.

List of related functions

  • series_pow: Raises series elements to a power. Use as the inverse operation to logarithms when working with exponentials.
  • series_abs: Returns the absolute value of each element. Use before series_log to ensure positive values.
  • series_magnitude: Computes the magnitude of a series. Use when you need Euclidean norm instead of logarithmic transformation.
  • log: Scalar function for single values. Use for individual calculations instead of array operations.

Other query languages

Was this page helpful?
Suggest edits on GitHub
Previousseries_less_equalsNextseries_magnitude
On this page
UsageSyntaxParametersReturnsUse case examplesList of related functionsOther query languages