我有一个非常简单的查询:
fields @timestamp, req.url, msg
| sort @timestamp desc
| filter msg = "request completed"
| stats count() by req.url
它展示了我的应用程序服务的所有请求按URL聚合的结果,但我还想按聚合count()
值对结果进行排序 - 但是| sort count desc
和| sort "count()" desc
都不起作用。我该如何实现?
我有一个非常简单的查询:
fields @timestamp, req.url, msg
| sort @timestamp desc
| filter msg = "request completed"
| stats count() by req.url
它展示了我的应用程序服务的所有请求按URL聚合的结果,但我还想按聚合count()
值对结果进行排序 - 但是| sort count desc
和| sort "count()" desc
都不起作用。我该如何实现?
事实证明,我所要做的就是使用别名进行排序:
fields @timestamp, msg, req.url
| filter msg="request completed"
| stats count() as count by req.url
| sort count desc