make_graph_by
Builds a **collapsed** `{nodes, edges}` graph directly from parent-linked rows: one node per distinct `key` value, and an edge for each row whose immediate parent carries a different `key`.
A node's count covers every row
merged into it; an edge's count covers the parent-child pairs that cross
that boundary, one per hand-off. A span graph collapsed by service name is a
service dependency map; by process name, a process graph.
After id, parent_id, time, and key, pass inline "<agg>:<attr>", value
pairs. Each names an output attribute and the per-row expression to aggregate
into it, with agg one of sum, avg, min, max, countif, set, any,
first, or p<N> for a percentile (p95, p99.9; the same sketch as
percentile()). An edge aggregates only the child row of each crossing. The
intrinsic count is summed and time min-merged; a null key collapses into
"unknown"; null values are skipped rather than folded. An id that appears
on more than one row raises an AggregateDegraded warning quoting a few such
ids, which points at the instrumentation or at a double ingest.
The result is identical to
summarize_graph(make_graph(id, parent_id, time, "<attr>", value, …), key, "<agg>:<attr>", …),
but the collapse happens as rows arrive, so the aggregate retains a small stub
per row instead of the row itself. Prefer it whenever the collapsed graph is
what you want — the two-step form only pays off when you also need the raw
per-id graph, or want to collapse the same graph by several different keys.
(bzrk extension)
Syntax
make_graph_by(id, parent_id, time, key)Parameters
Prop
Type
Returns: dynamic
Syntax
make_graph_by(id, parent_id, time, key, agg)Parameters
Prop
Type
Returns: dynamic
Examples
Example 1
spans
| summarize map = make_graph_by(
span_id,
parent_span_id,
start_time,
tostring(resource["service.name"]),
"countif:errors",
status_code == "ERROR",
"max:duration",
duration
)| map (dynamic) |
|---|
| {"edges":[],"nodes":[{"attrs":{"duration":00:00:00.2000000,"errors":0},"count":9,"id":"","time":1704103200000000000}]} |