|
if we had nested extracts, we could replicate the existing functionality of aggregate-event-counts by using the group-by operator with a query like this:
curl -X GET http://localhost:8080/v4/events -d 'query=["extract", [["function","count"],"status"], ["extract", [["function","count"],"status", "containing_class"], ["~","certname",".*], ["group_by", "status", "containing_class"]], ["group_by", "status"]]
which would translate into something like:
select status,count(1) from (select status,containing_class,count(1) from resource_events group by status,containing_class) ec group by status
this would be more or less equalivalent to an aggregate-event-counts call with summarize_by=containing_class.
|
