collect

Description

Returns an array collecting all values of an expression for each group. Supports optional deduplication, null filtering, and element limits.

Syntax

collect(expression: T, distinct: bool?, limit: number?, ignoreNulls: bool?): array<T>

Arguments

argument	type	description
expression	T	The value to collect in the array
distinct	bool	Optional. If `true`, collects only unique values. Literal only. Defaults to `false`
limit	number	Optional. The maximum number of values to collect. Must be a positive literal
ignoreNulls	bool	Optional. If `true`, skips `null` values. Literal only. Defaults to `false`

Examples

Use case: Collect all distinct containers per application

groupby $l.applicationname aggregate collect(kubernetes.container_name, distinct = true)

This gathers a unique list of container names per application.

Use case: Collect up to 100 pod names per application

groupby $l.applicationname aggregate collect(kubernetes.pod_name, limit = 100)

This limits each array to at most 100 collected pod names per application.

Use case: Collect all log IDs in a file

groupby recordLocation() aggregate collect($m.logid)

This builds a list of all log IDs associated with the same file.

This filters out null error messages from the collected results for each transaction.

Let me know if you'd like this added to your function reference index or connected with related aggregation functions like any_value or arrayConcat.

Previous avg

Next count_if