Transform elements
Transform elements take atimevector, and produce a timevector.
Vectorized math functions
Vectorized math function elements modify eachvalue inside the timevector with the specified
mathematical function. They are applied point-by-point and they produce a one-to-one mapping from
the input to output timevector. Each point in the input has a corresponding point in the output,
with its value transformed by the mathematical function specified.
Elements are always applied left to right, so the order of operations is not taken into account
even in the presence of explicit parentheses. This means for a timevector row
('2020-01-01 00:00:00+00', 20.0), this pipeline works:
('2020-01-01 00:00:00+00', 31.0).
If multiple arithmetic operations are needed and precedence is important, consider using a Lambda
instead.
Unary mathematical functions
Unary mathematical function elements apply the corresponding mathematical function to each datapoint in thetimevector, leaving the timestamp and ordering the same. The available elements
are:
Even if an element logically computes an integer,
timevectors only deal with double precision
floating point values, so the computed value is the floating point representation of the integer.
For example:
Binary mathematical functions
Binary mathematical function elements run the corresponding mathematical function on thevalue in
each point in the timevector, using the supplied number as the second argument of the function.
The available elements are:
These elements calculate
vector -> power(2) by squaring all of the values, and
vector -> logn(3) gives the log-base-3 of each value. For example:
Compound transforms
Mathematical transforms are applied only to thevalue in each point in a timevector and always
produce one-to-one output timevectors. Compound transforms can involve both the time and
value parts of the points in the timevector, and they are not necessarily one-to-one. One or
more points in the input can be used to produce zero or more points in the output. So, where
mathematical transforms always produce timevectors of the same length, compound transforms can
produce larger or smaller timevectors as an output.
Delta transforms
Adelta() transform calculates the difference between consecutive values in the timevector.
The first point in the timevector is omitted as there is no previous value and it cannot have a
delta(). Data should be sorted using the sort() element before passing into delta(). For
example:
The first row of the output is missing, as there is no way to compute a delta without a previous
value.
Fill method transform
Thefill_to() transform ensures that there is a point at least every interval, if there is not
a point, it fills in the point using the method provided. The timevector must be sorted before
calling fill_to(). The available fill methods are:
For example:
Largest triangle three buckets (LTTB) transform
The largest triangle three buckets (LTTB) transform uses the LTTB graphical downsampling algorithm to downsample atimevector to the specified resolution while maintaining visual acuity.
Sort transform
Thesort() transform sorts the timevector by time, in ascending order. This transform is
ignored if the timevector is already sorted. For example:
Lambda elements
The Lambda element functions use the Toolkit’s experimental Lambda syntax to transform atimevector. A Lambda is an expression that is applied to the elements of a timevector. It is
written as a string, usually $$-quoted, containing the expression to run. For example:
- Variable declarations such as
let $foo = 3; $foo * $foo. Variable declarations end with a semicolon. All Lambdas must end with an expression, this does not have a semicolon. Multiple variable declarations can follow one another, for example:let $foo = 3; let $bar = $foo * $foo; $bar * 10 - Variable names such as
$foo. They must start with a$symbol. The variables$timeand$valueare reserved; they refer to the time and value of the point in the vector the Lambda expression is being called on. - Function calls such as
abs($foo). Most mathematical functions are supported. - Binary operations containing the arithmetic binary operators
and,or,=,!=,<,<=,>,>=,^,*,/,+, and-are supported. - Interval literals are expressed with a trailing
i. For example,'1 day'i. Except for the trailingi, these follow theINTERVALinput format. - Time literals such as
'2021-01-02 03:00:00'texpressed with a trailingt. Except for the trailingtthese follow theTIMESTAMPTZinput format. - Number literals such as
42,0.0,-7, or1e2.
Map Lambda
Themap() Lambda maps each element of the timevector. This Lambda must return either a
DOUBLE PRECISION, where only the values of each point in the timevector is altered, or a
(TIMESTAMPTZ, DOUBLE PRECISION), where both the times and values are changed. An example of the
map() Lambda with a DOUBLE PRECISION return:
map() Lambda with a (TIMESTAMPTZ, DOUBLE PRECISION) return:
Filter Lambda
Thefilter() Lambda filters a timevector based on a Lambda expression that returns true for
every point that should stay in the timevector timeseries, and false for every point that
should be removed. For example:
Finalizer elements
Finalizer elements complete the function pipeline, and output a value or an aggregate.Output element
You can finalize a pipeline with atimevector output element. These are used at the end of a
pipeline to return a timevector. This can be useful if you need to use them in another pipeline
later on. The two types of output are:
unnest(), which returns a set of(TimestampTZ, DOUBLE PRECISION)pairs.materialize(), which forces the pipeline to materialize atimevector. This blocks any optimizations that lazily materialize atimevector.
Aggregate output elements
These elements take atimevector and run the corresponding aggregate over it to produce a
result. The possible elements are:
average()integral()counter_agg()hyperloglog()stats_agg()sum()num_vals()
num_vals():
stats_agg():
Aggregate accessors and mutators
Aggregate accessors and mutators work in function pipelines in the same way as they do in other aggregates. You can use them to get a value from the aggregate part of a function pipeline. For example:-> operator instead looks like this:
Counter aggregates
Counter aggregates handle resetting counters. Counters are a common type of metric in application performance monitoring and metrics. All values have resets accounted for. These elements must have aCounterSummary to their left when used in a pipeline, from a counter_agg()
aggregate or pipeline element. The available counter aggregate functions are:
Percentile approximation
Percentile approximation aggregate accessors are used to approximate percentiles. Currently, only accessors are implemented forpercentile_agg and uddsketch
based aggregates. We have not yet implemented the pipeline aggregate for percentile approximation
with tdigest.
Statistical aggregates
Statistical aggregate accessors add support for common statistical aggregates. These allow you to compute androllup() common statistical aggregates like average and
stddev, more advanced aggregates like skewness, and two-dimensional
aggregates like slope and covariance. Because there are both
single-dimensional and two-dimensional versions of these, the accessors can have multiple forms.
For example, average() calculates the average on a single-dimension aggregate, while
average_y() and average_x() calculate the average on each of two dimensions. The available
statistical aggregates are:
Time-weighted averages aggregates
Theaverage() accessor can be called on the output of a
time_weight(). For example:
Approximate count distinct aggregates
This is an approximation for distinct counts. Thedistinct_count() accessor can
be called on the output of a hyperloglog(). For example:
Formatting timevectors
You can turn a timevector into a formatted text representation. There are two functions for turning a timevector to text:to_text, which allows you to specify the templateto_plotly, which outputs a format suitable for use with the Plotly JSON chart schema
to_text
format_string. The
format string can use any valid Tera template syntax, and it can include any of the built-in
variables:
TIMES: All the times in the timevector, as an arrayVALUES: All the values in the timevector, as an arrayTIMEVALS: All the time-value pairs in the timevector, formatted as{"time": $TIME, "val": $VAL}, as an array
TIMEVALS to produce the following text:
TIMES and VALUES to produce the following text: