log_aggregate
Read-onlyIdempotent
Aggregate log events into a time series and detect spikes to identify when log volume bursts, enabling targeted follow-up searches on the spike window.
Instructions
[READ] Aggregate matching events into a time series and detect spikes.
WHEN: to find when/whether log volume burst without pulling raw events. Follow up with log_search on the spike window.
RETURNS: {aggregation, bin_width_ms, constraints, bins:[{timestamp_ms, value}], spikes:[{timestamp_ms, value, zscore}]}. A bin is flagged as a spike when it sits at least 2 standard deviations above the mean; a series of fewer than 3 bins, or a flat one, reports no spikes rather than calling everything a spike — so an empty 'spikes' list is not evidence of calm when the window is short. Read-only.
Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| last | No | Relative window ending now — "30m", "2h", "7d" (units s/m/h/d) or a bare number of seconds. Cannot be combined with begin_ms/end_ms. Omit all three and the window defaults to the last hour. | |
| text | No | Free-text substring matched with CONTAINS, exactly as in log_search. Omit to aggregate every event in the window. | |
| end_ms | No | Absolute window end as epoch milliseconds. Usable on its own; cannot be combined with last. | |
| target | No | Log Insight target name as spelled in ~/.vmware-log-insight/config.yaml. Omit to use that file's default_target — with no default configured, omitting it is an error that lists the configured names. | |
| begin_ms | No | Absolute window start as epoch milliseconds. Usable on its own; cannot be combined with last. | |
| aggregation | No | The function applied within each bin — exactly one of COUNT, UCOUNT, AVG, MIN, MAX, SUM, STDDEV, VARIANCE, SAMPLE (lower case is accepted and upper-cased). Anything else raises a ValueError listing the nine. Default COUNT, which answers "how many events per bin" and is what spike detection is normally run on. | COUNT |
| bin_width_ms | No | Width of each time bin in milliseconds, must be positive (default 60000 = one minute). It sets the resolution of both the series and the spike test: bins much wider than the burst average it away, bins much narrower make every quiet minute look like noise. |