Skip to content

Aggregate

Aggregate events by key and emit summary statistics.

Stateful Transform json

actions:
- aggregate: {}
JSON
{
"actions": [
{
"aggregate": {}
}
]
}

A ✓ marks a field that accepts a context variable such as {{ VARIABLE }}.

Field Type Required Description
aggregations Aggregations[] Aggregations to compute for each group.
Behaviour
Field Type Required Description
reset-on-document boolean (bool) Reset aggregation state on document boundaries.
Default: false
General
Field Type Required Description
description string describe this step.
condition string Only run this action if the condition is met.
Grouping
Field Type Required Description
group-by string[] Fields used to compute the grouping key (optional).
Output
Field Type Required Description
output Output Output configuration (per-window record or expand).
Allowed values: per-window-record, expand-records
Resources
Field Type Required Description
max-groups number (integer) Maximum distinct groups tracked in-memory (new groups beyond this limit are dropped).
Examples: 42, 1.2e-10
State
Field Type Required Description
state State State configuration (in-memory or spill-to-disk).
Allowed values: in-memory, spill-to-disk
Trigger
Field Type Required Description
aggregate-trigger Aggregate Trigger Trigger policy controlling emission cadence.
Windowing
Field Type Required Description
time-field field (string) Field containing the event timestamp (ISO 8601).
Examples: data_field
window Window Optional window definition for tumbling windows.
allowed-lateness string Allow events to arrive up to this duration late (e.g. “30s”).
Option Name Type Description
in-memory In Memory map
spill-to-disk Spill To Disk object Persist state to disk under the job data directory configured for the runtime.
Field Type Required Description
field string Source field for aggregation.
op Op Aggregation operation.
Allowed values: count, sum, mean, min, max, first, last, stddev, variance, z-score
r-as string Alias for the output field (defaults to op_field).
Field Type Required Description
dir string Subdirectory (or relative path) within the job data directory to store spill files.
Field Type Required Description
count number (integer) Emit after this many events per group.
Examples: 42, 1.2e-10
interval string Emit periodically based on processing time (e.g. “30s”).
on-window-close boolean (bool) Emit when a window closes.
Default: false
Field Type Required Description
size string Window size (e.g. “1m”).
offset string Optional offset applied to the window (e.g. “10s”).
Value Aliases Name Description
count count
sum sum
mean avg, average mean
min min
max max
first first
last last
stddev std, std_dev, stdev stddev
variance var variance
z-score z_score z-score
Value Aliases Name Description
per-window-record per-window-record Emit a single record summarising the window/group
expand-records expand-records Expand aggregated results into individual events per source event