ever

Type of operation: Filter

Description

Select data for resources that at some point matched the predicate

Usage

ever predicate [ , frame ]

Argument

Type

Required

Multiple

predicate

bool

Required

Only one

frame

frame

Optional

Only one

Accelerable

ever is accelerable if there is a frame() argument. A dataset that only uses accelerable verbs, can be accelerated, making queries on the dataset respond faster.

Examples

ever string(status_code) ~ /^5.*/

Select only resources where the status_code column, converted to string, starts with 5, at any point of the query time window. This formulation is not accelerable.

ever string(status_code) ~ /^5.*/, frame(back:30m)

Select only resources where the status_code column, converted to string, starts with 5, within the last half hour. This formulation is accelerable because the frame(back:30m) argument specifies a relative time range to check.