|indexRoot||The root name of the index to hit, the format is expected to be |
|keyString||Creates groups (like tagsets) and can also filter those groups. It is the format of |
|filterString||An Elastic regexp query that can be applied to any field. It is in the same format as the keystring argument.|
|field||The field in ElasticSearch to perform the operation on. Must be a numeric field.|
|rStat||Can be one of |
|bucketDuration||The same format is an opentsdb duration, and is the size of buckets returned (i.e. counts for every 10 minutes)|
|startDuration||set the time window from now - see the OpenTSDB |
|endDuration||set the time window from now - see the OpenTSDB |
The LogStash query functions are deprecated, and only for use with v1.x of ElasticSearch. If you are running v2 or above of ElasticSearch, then you should refer to the Elastic Query functions.
lsstat returns various summary stats per bucket for the specified field. The field must be numeric in elastic.
rStat can be one of
The rest of the fields behave the same as
lscount, except that there is no division based on bucketDuration (since these are summary stats)
$max_querytime_by_minute = lsstat("logstash", "", "env:prod", "querytime", "max", "1m", "1h", "")
lsstat in this queries the
logstash indexes, filters on a field
env with the value
prod, and gives the
max value of
querytime for the last hour, in one minute buckets.