`objectSize`

Description

Return the size, in bytes, of an object in a record, measured as the object serialized to compact UTF-8 JSON.

Use it to find out how much of your data a record, or one part of a record, takes up. Sum objectSize over a time range to see how much volume a field contributes before you decide to drop it, block it, or route it to a cheaper tier.

Call objectSize() with no argument to measure the record's user data ($d). Pass any object-typed field, such as $d.kubernetes, $l, or $m, to measure just that part. Scalar fields such as strings or numbers, and fields whose type can be either an object or a scalar, aren't accepted. When the object is null or missing, objectSize returns null, and aggregations such as sum skip it.

Note

Works only on data stored in your cloud storage (archive). A query on Frequent Search data that calls objectSize fails to compile.

Measuring $d, $l, or $m as stored is fast, because the size is read from a value written alongside the record. Commands that don't change the record, such as filter, orderby, limit, and dedupeby, keep this fast path. Measuring a nested object, or a root after a command that rewrites it (such as create, remove, replace, move, convert, choose, groupby, join, or union), computes the size while the query runs. The same happens for data written before the stored size was introduced: on 15 Oct 2026 in EU2, on 18 Oct 2026 in AP1, and on 19 Oct 2026 in all other regions. It also happens for any earlier period in which the stored size wasn't written. This is slower on large time ranges and can reach query scan limits.

Syntax

objectSize(value?: object): number

Arguments

Name	Type	Required	Description
`value`	`object`	false	The object to measure. Defaults to `$d`, the record's user data.

Example 1

Use case: Find which subsystems send the most data

Sum the size of every log's user data per subsystem to see where your volume comes from. Run it over the last week to size a cleanup or a TCO policy change.

Example query

source logs
| groupby $l.subsystemname agg sum(objectSize()) as total_bytes
| orderby total_bytes desc

Example output

subsystemname	total_bytes
checkout	48211873
payments	19504112
frontend	6611027

Example 2

Use case: Measure how much one object would free up

Before you drop an object from your logs, measure it. This query shows how many bytes the kubernetes object takes up per application, and what share of each application's volume that is. Logs without a kubernetes object add nothing to kubernetes_bytes but still count toward total_bytes.

Measuring a nested object such as $d.kubernetes computes the size while the query runs, so start with a short time range.

Example query

source logs
| groupby $l.applicationname
  agg sum(objectSize($d.kubernetes)) as kubernetes_bytes,
      sum(objectSize($d)) as total_bytes
| create kubernetes_share from round(kubernetes_bytes / total_bytes, 3)

Example output

applicationname	kubernetes_bytes	total_bytes	kubernetes_share
shop	9862310	61402215	0.161
billing	2208419	17550093	0.126

Example 3

Use case: Check the size of a single record

Return the size of one record's user data next to the dataset it came from.

Example query

source logs
| limit 1
| choose dataset() as dataset, objectSize($d) as record_size

Example output

{
    "dataset": "logs",
    "record_size": 1843
}

Last updated on October 18, 2026