{
"expression": "sum(request).group(host)",
"start": "2011-09-10T12:37:12Z",
"stop": "2011-09-13T04:00:02Z",
"step": 300000
}
Then you'll get back individual results for each host + time, rather
than just a single value:
{"time": "2011-09-10T12:40:00Z", "group": "web11", "value": 5023}
{"time": "2011-09-10T12:40:00Z", "group": "web12", "value": 492}
{"time": "2011-09-10T12:40:00Z", "group": "web13", "value": 1401}
I think in a subsequent release, we may need to combine the results
for each time, so that you can tell when all the results have been
returned and when results are missing. That might look like this:
{"time": "2011-09-10T12:40:00Z", "value": {"web11": 5023, "web12":
492, "web13", "value": 1401}}
This might not perform as well with very high-cardinality groups,
though; I'd like to add a top N or bottom N to the group-by as well to
solve that problem.
Mike
If you had multiple times, they'd have to be indexed separately, so
there would be some overhead regardless.
At any rate, no, Cube does not currently support indexing by multiple
times—you'd need to send those as separate events. In general, you're
expected to denormalize data when you send events to Cube (since the
query language, like most NoSQL stores, doesn't support joins). So
duplicating that data for a start and end event isn't typically
consider expensive relative to all the other denormalization.
It would be possible to override the name of the time attribute to
allow you to index by multiple time fields, although that would
complicate the code somewhat.
Mike
"data": { "duration_ms": 241 }