32.3 Statistics
Entries are the record; statistics are what the graphs are drawn from. They are aggregated as entries arrive and kept per second, minute, hour, day, week and month, so a graph of the last five minutes and one of the last year are both instant. Every log counts its entries, and each column adds the statistics you choose:
| Statistic | What it answers | Column types |
|---|---|---|
| Count | How many entries had a value in the column | All |
Total (Sum) |
The values added up | Numbers |
Average, min, max (AvgMinMax) |
The average, lowest and highest value | Numbers |
Count, total, average, min, max (CountSumAvgMinMax) |
All of the above in one statistic | Numbers |
Count per value (UniqueCountWithValues) |
How often each value occurred, such as a status code or a country | All but bytes |
Unique count (UniqueCountHashedValues) |
How many different values there were, exactly | All but bytes |
Unique count, estimated (UniqueCountEstimate) |
How many different values there were, within about one percent | All but bytes |
Count per value suits columns with few distinct values, under a hundred or so: it keeps up to 5,000 values per interval, and only the 50 most common once an interval is over. Unique count keeps up to 50,000 distinct values per interval. Unique count, estimated uses fixed memory however many values there are (§32.4). Columns of positions have six more (§32.8).
The level of statistical detail sets how far back statistics reach. Level 1 keeps 60 seconds, 60 minutes, 48 hours, 60 days, 52 weeks and 60 months, and higher levels multiply these. Level 3, the default, keeps seconds for 3 minutes, minutes for 3 hours, hours for 6 days, days for 6 months, weeks for 3 years and months for 15 years. More detail costs memory and disk. A fine interval further back than that shows only what is kept, so draw a long range with a coarser interval.
The Logs page sets one level for the whole log. In a definition file and in code, each statistic has
its own level (Resolution, 3 unless given), and so does the entry count (ResolutionRowStats, 10
unless set).
Because statistics are aggregated as entries arrive:
- A new statistic covers entries from then on. To include older ones, rebuild the statistics. The Logs page offers this when you save, and on the log's Data view (Rebuild the statistics).
- Late entries count only while their interval is kept. An entry with an older timestamp goes into its own interval if the statistic still keeps it. A unique count keeps only its number once its interval is over, so a late value reaches it only through a rebuild.
- With statistics off, nothing is aggregated. Switched back on, they continue with a gap.