`entityType`

Description

Return the entity type of a record, such as logs, spans, or jsonData.

An entity type is the specific kind of data a record holds. It is narrower than a pillar: several entity types can sit under the same pillar, so logs, engineQueries, and auditEvents all belong to the logs pillar. An entity type's schema is a superset of its pillar's: it includes every field the pillar guarantees, plus fields specific to that entity type. Knowing a record's entity type tells you which fields you can rely on. See Entity types.

This is especially useful when a query reads more than one source, for example with `union` or a multi-dataset `source`, and records with different entity types end up in the same result set.

entityType() works on Archive data and on Frequent Search data. Like `pillar`, it returns null after an aggregation such as groupby, countby, or aggregate, and when the source of a record can't be resolved. To keep the value, compute it before you aggregate, or group by it.

Syntax

entityType(): string

Example 1

Use case: Break a multi-source result down by origin

Group a query that reads several datasets by all four origin functions to see, in one result, what each dataset holds and how many records it contributed. This is useful when the list of datasets comes from somewhere else, such as a saved query or an AI agent, and you need to confirm what kind of data is in each one before you aggregate across them.

Example query

source logs, spans, system/engine.queries
| groupby dataspace() as dataspace,
          dataset() as dataset,
          pillar() as pillar,
          entityType() as entityType
  agg count() as count

Example output

dataspace	dataset	pillar	entityType	count
default	logs	logs	logs	277318
default	spans	spans	spans	41207
system	engine.queries	logs	engineQueries	364

Example 2

Use case: Keep only one entity type from a mixed result

Application logs and audit events both belong to the logs pillar, so `pillar` can't separate them. Because entityType() is an expression, you can filter on it in the same query. Only the audit events remain.

Example data

{
    "action": "login",
    "user": "[email protected]"
}

Example query

source logs, system/aaa.audit_events
| filter entityType() == 'auditEvents'

Example output

{
    "action": "login",
    "user": "[email protected]"
}

Example 3

Use case: Tag each record with its entity type

Add the entity type to every record so it travels with the data into a dashboard, an export, or a downstream query.

Example data

{
    "service": "backend-service",
    "status_code": 500
}

Example query

source logs
| limit 1
| create entity_type from entityType()

Example output

{
    "service": "backend-service",
    "status_code": 500,
    "entity_type": "logs"
}

Last updated on October 20, 2026