buckets | objectRequired | — |
└series | object[] | — |
└endTime | string<date-time>Required | — |
└groups | object[] | — |
└aggregations | object[] | — |
└data | object | — |
└op | stringRequired | — |
└value | objectRequired | — |
└group | objectRequired | — |
└id | integer<uint64>Required | — |
└startTime | string<date-time>Required | — |
└totals | object[] | — |
└aggregations | object[] | — |
└data | object | — |
└op | stringRequired | — |
└value | objectRequired | — |
└group | objectRequired | — |
└id | integer<uint64>Required | — |
fieldsMeta | object[] | FieldsMeta contains the unit information (if we have it) for each field |
└description | string | — |
└hidden | booleanRequired | — |
└name | stringRequired | — |
└type | stringRequired | — |
└unit | stringRequired | — |
format | stringRequired | Format specifies the result set format. Either "legacy" (default) or "tabular". |
matches | object[] | Matches hold the matching events of a filter query in the "legacy" result format |
└_rowId | stringRequired | — |
└_sysTime | string<date-time>Required | — |
└_time | string<date-time>Required | — |
└data | objectRequired | — |
status | objectRequired | — |
└blocksExamined | integer<uint64>Required | — |
└cacheStatus | integer<uint8>Required | — |
└continuationToken | string | — |
└elapsedTime | integer<int64>Required | — |
└isEstimate | boolean | — |
└isPartial | booleanRequired | — |
└maxBlockTime | string<date-time>Required | — |
└maxCursor | string | Row id of the newest row, as seen server side.
May be higher than what the results include if the server scanned more data than included in the results.
Can be used to efficiently resume time-sorted non-aggregating queries (ie filtering only). |
└messages | object[] | — |
└code | string | — |
└count | integer<int64>Required | — |
└msg | stringRequired | — |
└priority | stringRequired | — |
└minBlockTime | string<date-time>Required | — |
└minCursor | string | Row id of the oldest row, as seen server side.
May be lower than what the results include if the server scanned more data than included in the results.
Can be used to efficiently resume time-sorted non-aggregating queries (ie filtering only). |
└numGroups | integer<uint32>Required | — |
└rowsExamined | integer<uint64>Required | — |
└rowsMatched | integer<uint64>Required | — |
tables | object[] | Tables hold the result tables in the "tabular" result format |
└buckets | object | The standard mode of operation is to create buckets on the _time column, |
└field | stringRequired | Field specifies the field used to create buckets on. Normally this would be _time. |
└size | objectRequired | An integer or float representing the fixed bucket size.
When the bucket field is _time this value is in nanoseconds. |
└columns | object[][] | Columns contain a series of arrays with the raw result data.
The columns here line up with the fields in the Fields array. |
└fields | object[]Required | Fields contain information about the fields included in these results.
The order of the fields match up with the order of the data in Columns. |
└agg | object | AggInfo captures information about an aggregation |
└args | object[] | Args specifies any non-field arguments for the aggregation. Fx. [10] for topk(players, 10). |
└fields | string[] | Fields specifies the names of the fields this aggregation is computed on.
Fx ["players"] for topk(players, 10) |
└name | stringRequired | Name is the system name of the aggregation, which is the string form of aggregation.Type.
If the aggregation is aliased, the alias is stored in the parent FieldInfo |
└name | stringRequired | — |
└type | stringRequired | — |
└groups | object[]Required | Groups specifies which grouping operations has been performed on the results. |
└name | string | — |
└name | stringRequired | Name is the name assigned to this table. Defaults to "0". The name "_totals" is reserved for system use. |
└order | object[]Required | Order echoes the ordering clauses that was used to sort the results. |
└desc | booleanRequired | — |
└field | stringRequired | — |
└range | object | — |
└end | string<date-time>Required | End is the ending time the query is limited by.
Queries are restricted to the interval [start,end). |
└field | stringRequired | Field specifies the field name on which the query range was restricted. Normally _time |
└start | string<date-time>Required | Start is the starting time the query is limited by.
Queries are restricted to the interval [start,end). |
└sources | object[]Required | Sources contain the names of the datasets that contributed data to these results. |
└name | stringRequired | — |