Virtual fields

Columns computed at query time, so old data gains new columns without a rewrite.

A virtual field is computed when the query runs, not when the event was written. That means data you ingested last year gains the column too — no backfill, no reprocessing.

Deriving a column that was never sent

read top to bottom

1['api-gateway-prod']
2| extend bucket = case(latency < 100, "fast", latency < 1000, "ok", "slow")
3| summarize requests = count() by bucket, service
4| order by requests desc

Saving one to a dataset

An extend written into a query is ad hoc. Save it against the dataset and it becomes available to every query, dashboard and monitor as if it had been ingested — still computed at read time.

cURL

curl -X POST https://api.logstreem.com/v1/datasets/api-gateway-prod/virtual-fields \
  -H "Authorization: Bearer $LOGSTREEM_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "is_error",
    "expression": "status >= 500"
  }'

The migration you do not have to run

This is the practical answer to "we should have been logging that". Add a virtual field derived from what you did log, and every historical dashboard picks it up on the next refresh.

PreviousFields NextRetention