Search around

Endpoint: GET /api/{organization}/{stream}/_values?fields={fields}&start_time={start_time}&end_time={end_time}&size=10&keyword=&no_count=false

Request

Description

Field name	Data type	Default value	Description
stream	string	-	stream name
fields	string	-	the fields you want to get values, field1,field2
size	int64	0	how many values do you want to response, order by values num
start_time	int64	0	Only list the values in the time range
end_time	int64	0	Only list the values in the time range
keyword	string	-	search for the values
no_count	bool	false	set to true will not response count and order by the value

Response

{
    "took": 155,
    "hits": [
        {
            "field": "field name",
            "values": [
                {
                    "zo_sql_key": "value1",
                    "zo_sql_num": 2070
                }
            ]
        }
    ],
    "total": 10,
    "from": 0,
    "size": 0,
    "scan_size": 28943
}

Response description:

Description

Field name	Data type	Default value	Description
took	int64	-	unit: milliseconds, query execute time
total	int64	0	it will response zero if query.track_total_hits is false or there is no aggregations or it will response the total record the query.sql can matched.
from	int64	0	value from query.from
size	int64	0	value from query.size
scan_size	int64	0	unit: MB, it response the data size scale when execute the query.
hits	array	-	records for query, each record is a log row what you ingested.