make_graph_by
Builds a **collapsed** `{nodes, edges}` graph directly from parent-linked rows: one node per distinct `key` value, and an edge from each row's nearest ancestor whose `key` differs.
A span graph collapsed by service name is a service dependency map; by process name, a process graph.
After id, parent_id, time, and key, pass inline "<agg>:<attr>", value
pairs. Each names an output attribute and the per-row expression to aggregate
into it, with agg one of sum, avg, min, max, countif, set, any,
first. The intrinsic count is summed and time min-merged; a null key
collapses into "unknown"; null values are skipped rather than folded.
The result is identical to
summarize_graph(make_graph(id, parent_id, time, "<attr>", value, …), key, "<agg>:<attr>", …),
but the collapse happens as rows arrive, so the aggregate retains a small stub
per row instead of the row itself. Prefer it whenever the collapsed graph is
what you want — the two-step form only pays off when you also need the raw
per-id graph, or want to collapse the same graph by several different keys.
(bzrk extension)
Syntax
make_graph_by(id, parent_id, time, key)Parameters
Prop
Type
Returns: dynamic
Syntax
make_graph_by(id, parent_id, time, key, agg)Parameters
Prop
Type
Returns: dynamic
Examples
Example 1
spans
| summarize map = make_graph_by(
span_id,
parent_span_id,
start_time,
tostring(resource["service.name"]),
"countif:errors",
status_code == "ERROR",
"max:duration",
duration
)| map (dynamic) |
|---|
| {"edges":[],"nodes":[{"attrs":{"duration":00:00:00.2000000,"errors":0},"count":9,"id":"","time":1704103200000000000}]} |