Logstreem
Virtual fields in the console

Virtual fields in the console

Adding a computed column that every query, dashboard and monitor can use.

The concept is covered in virtual fields. This page is the console workflow.

  1. 1

    Write the extend in Explore

    Get the expression right against real data first. It is much easier to debug as a query line than as a saved definition.

  2. 2

    Promote it

    With the cursor on the extend line, hit Save as field. The name defaults to the alias you used.

  3. 3

    Use it everywhere

    It appears in the fields rail with a small ƒ marker, and completes in the editor like any other field.

The expression, before promoting it
read top to bottom
1['api-gateway-prod']
2| extend is_slow = latency > 1000
3| summarize slow = countif(is_slow), total = count() by service
4| extend slow_pct = round(100.0 * slow / total, 1)
5| order by slow_pct desc

Computed at read, so it costs at read

A virtual field over an expensive expression is evaluated on every row the query touches. Filter before you rely on one, and prefer simple comparisons over regex where you can.