Logstreem
LSQL

LSQL

The piped query language: start with a dataset, pipe through operators, read it top to bottom.

LSQL is a piped language. A query starts with a dataset and every | takes the rows from the line above as its input. It reads in the order it executes, which is the order you debug in — narrow, enrich, aggregate, sort, cut.

The shape of every query
read top to bottom
1['api-gateway-prod']
2| where status >= 500 and ['geo.region'] == "us-east-1"
3| extend route = tostring(attributes['http.route'])
4| summarize errors = count(), p95 = percentile(latency, 95) by route
5| order by errors desc
6| take 6

Reading it

LineDoes
['api-gateway-prod']Names the dataset. Always first, always in brackets
| where …Drops rows. Put it first — everything downstream gets cheaper
| extend …Adds a computed column
| summarize … by …Collapses rows into groups
| order by …Sorts what is left
| take 6Cuts to the first N rows

Try it

This panel is a real evaluator running over 240 sandbox events. Edit any line and the result changes.

LSQL playground
sandbox
⌘↵ to run

Referring to fields

  • A simple name needs no decoration: status, latency, service.
  • Anything with a dot, a space or a reserved word goes in brackets: ['trace.id'], ['http.route'].
  • Nested JSON flattens to dot paths, so { "trace": { "id": … } } is ['trace.id'].
  • Strings are double-quoted. Field names in brackets take single quotes inside.

Reference

Tabular operators

where, extend, project, summarize, join.

Scalar functions

Casts, strings, maths, conditionals.

Aggregations

count, dcount, percentile, sum.

Time and bins

ago, bin, make-series.

Strings and regex

contains, extract, parse.

Worked examples

Queries that answer real questions.

Filter before you enrich

where before extend is not a style preference. Extend runs per surviving row, so filtering first is the difference between computing a column 68 times and 14 billion times.
PreviousElasticsearch bulkNextTabular operators