order_by

Description

Specify the ordering when processing data. This is used by ordered windowing functions (like lag and last) as well as ordered aggregation functions (like array_agg).

Ordering is specified by alternating fields and a literal boolean for whether the field is in ascending (false) or descending (true) order. Because of backwards compatibility, the function will default to ascending if you omit specifying a boolean value, however, doing so makes for sometimes ambiguous expressions, and is not recommended.

If you have a table with columns timestamp, hostname and username, you can get a list of all users for each host, in order of timestamp within each host, by doing:

statsby list:array_agg(username, order_by(timestamp, false)), group_by(hostname)

If instead you want a list of times and hosts a user has been on, ordered by host alphabetically and reverse chronologically, you could instead do:

statsby list:array_agg(make_object(time:timestamp, host:hostname), order_by(hostname, false, timestamp, true)), group_by(username)

Return type

ordering

Domain

This is a scalar function (calculates a single output value for a single input row.)

Categories

Usage

order_by( [ columnname, descending ] ... [ , columnname ] ... [ , descending ] )

Argument

Type

Required

Multiple

Constant

columnname

fieldref

Optional

Can be multiple groups

Variable

descending

bool

Optional

Can be multiple groups

Constant

columnname

fieldref

Optional

Can be multiple

Variable

descending

bool

Optional

Only one

Constant

order_by( ordering ... )

Argument

Type

Required

Multiple

Constant

ordering

ordering

Required

Can be multiple

Variable

Aliases

orderby (deprecated)