order_by

Description

Specify the ordering when processing data. This is used by ordered windowing functions (like lag and last) as well as ordered aggregation functions (like array_agg).

Ordering is specified by alternating fields and a literal boolean for whether the field is in ascending (false) or descending (true) order. Because of backwards compatibility, the function will default to ascending if you omit specifying a boolean value, however, doing so makes for sometimes ambiguous expressions, and is not recommended.

If you have a table with columns timestamp, hostname and username, you can get a list of all users for each host, in order of timestamp within each host, by doing:

statsby list:array_agg(username, order_by(timestamp, false)), group_by(hostname)

If instead you want a list of times and hosts a user has been on, ordered by host alphabetically and reverse chronologically, you could instead do:

statsby list:array_agg(make_object(time:timestamp, host:hostname), order_by(hostname, false, timestamp, true)), group_by(username)

Return type

ordering

Domain

This is a scalar function (calculates a single output value for a single input row.)

Categories

• Misc

Usage

order_by( [ columnname, descending ] ... [ , columnname ] ... [ , descending ] )

Argument	Type	Required	Multiple	Constant
columnname	fieldref	Optional	Can be multiple groups	Variable
descending	bool	Optional	Can be multiple groups	Constant
columnname	fieldref	Optional	Can be multiple	Variable
descending	bool	Optional	Only one	Constant

order_by( ordering ... )

Argument	Type	Required	Multiple	Constant
ordering	ordering	Required	Can be multiple	Variable

Aliases

orderby (deprecated)