Group

Groups a stream of records by one or more field(s) and returns a grouped stream. Because Group outputs a GroupedBy stream, this function must be used in conjunction with Merge Events. This function does not show metrics in the UI.

Function Input

collection<record<R>>

This function takes in collections of records with schema R.

Function Output

GroupedStream<record<K>, record<V>>

This function outputs a grouped stream of records with a given schema, K.

Arguments

Argument	Input	Description	UI example
by	collection<expression<any>>	Choose field values to group events.	get("source_type"); get("source");

Full DSL example

This example groups events by source_type, source, and host:

grouped-events = group(events, by: (as(get("source_type"), "source_type"), as(get("source"), "source"), as(get("host"), "host")));