### Decompress and Run log-store Binary

Source: https://docs.log-store.com/install

This snippet shows how to decompress the log-store binary using gzip and then execute it. This method requires no external dependencies.

```bash
gzip -d log-store.gz
./log-store

```

--------------------------------

### Example Log Data

Source: https://docs.log-store.com/alerting

Provides sample log entries in JSON lines format, which would be processed and included in the alert payload.

```json
{ "t":1672365312,"ip":"60.219.148.3","method":"POST","path":"/clients/zip=13560","req_id":"a38fdb2e-3f2c-43cb-b5f2-11c2640ae3e1","resp_code":200,"response_time":357,"size":96,"tier":"web"} { "t":1672365013,"lookup_by":"zip","req_id":"a38fdb2e-3f2c-43cb-b5f2-11c2640ae3e1","response_time":334,"sql":"SELECT * FROM clients WHERE zip = ?","tier":"app"}
```

--------------------------------

### Display log-store Command Line Options

Source: https://docs.log-store.com/install

This command displays all available command-line options for log-store, which can be used to temporarily alter its behavior. These options can often be made persistent by adding them to the configuration file.

```bash
log-store -h

```

--------------------------------

### Combined JSON Payload Example

Source: https://docs.log-store.com/alerting

Illustrates the final JSON object sent to the webhook URL, combining a user-defined template with the actual log data.

```json
{
  "message": "Alert from log-store!",
  "auth-token": "hpZU7pArZq5yqW51CXQ6Ix1DWJ9KvmA+HAe8VlSzz1rbomIt8aozCf9jAWWq/7aKRFisb2kEJ+6j",
  "logs": [
    {"t":1672365312,"ip":"60.219.148.3","method":"POST","path":"/clients/zip=13560","req_id":"a38fdb2e-3f2c-43cb-b5f2-11c2640ae3e1","resp_code":200,"response_time":357,"size":96,"tier":"web"},
    {"t":1672365013,"lookup_by":"zip","req_id":"a38fdb2e-3f2c-43cb-b5f2-11c2640ae3e1","response_time":334,"sql":"SELECT * FROM clients WHERE zip = ?","tier":"app"},
    {"t":1672364817,"req_id":"a38fdb2e-3f2c-43cb-b5f2-11c2640ae3e1","response_time":280,"rows":1,"sql":"SELECT * FROM clients WHERE zip = '13560'","tier":"db"}
  ]
}
```

--------------------------------

### Run log-store using Docker Image

Source: https://docs.log-store.com/install

This command demonstrates how to run the log-store Docker image in detached mode. It maps host directories for data storage, exposes necessary ports for log ingestion and the web server, and assigns a name to the container. The container uses the latest version of the log-store image.

```bash
docker run -d --stop-timeout 120 -v /path/to/data:/log_store_data -p 1234:1234 -p 8181:8181 --name log-store logstore/log-store:latest

```

--------------------------------

### Advanced Search Query Example

Source: https://docs.log-store.com/alerting

Demonstrates an advanced log-store search query using the 'where' command to filter results based on aggregated data, specifically alerting when the average response time exceeds 500ms.

```log-store-query
5m | agg mean(response_time) | where response_time:mean > 500
```

--------------------------------

### Sample Log Store TOML Configuration

Source: https://docs.log-store.com/config_file

This is a comprehensive sample TOML configuration file for log-store. It includes settings for logging, license file, web address, various input handlers, retention policies, hot storage, and warm storage.

```toml
log_file = "/var/log/log-store.log"  # you can use logrotate to rotate this log
license_file = "/etc/log-store/log-store.license"

# defaults to (t) for the timestamp field, and EPOCH for the format
# timestamp_field = 't'
# timestamp_format = 'EPOCH'

save_location = "server"  # searches and dashboards are saved on the server for all to use/see
web_address = "0.0.0.0:8181"  # bind to all interfaces on port 8181

# receive_handlers = 2  # defaults to 2 threads
# page_pool_gbs = 2  # defaults to 75% of the total memory on the system

# WAL settings
# use_wal = True  # defaults to True
# wal_flush_count = 100000  # defaults to 100,000

# Inputs
#unix_socket = ="/var/run/log-store.socket"
tcp_input_address = "0.0.0.0:1234"
#syslog_address = "127.0.0.1:1501"
#syslog_protocol="udp"

# retention settings
[retention]
hot_days = 7  # keep 7 days of logs on-disk
warm_days = 400  # then keep ~13 months of logs in S3 

# on-disk settings
[hot_storage]
data_dir = "/var/lib/log-store"  # location to store logs, saved searches, and dashboards

# settings for S3 storage
[warm_storage]
access_key_id = "MY_ACCESS_KEY"
secret_access_key = "MY_SECRET_ACCESS_KEY"
region = "us-east-1"
bucket = "log-store-archive"

```

--------------------------------

### Chart Logs with Various Types and Parameters

Source: https://docs.log-store.com/commands

The `chart` command visualizes log data, supporting types like line, bar, stack, and pie. It allows specifying fields, constants, aggregation functions, and grouping by other fields. Not all parameters are applicable to all chart types (e.g., `by` is not used with `pie`).

```logql
1h | chart line "response_time"
1h | method != null | chart line "response_time" by=method
1h | chart line response_time min(response_time) max(response_time) avg(response_time)
1h | chart bar "size"
1h size != null | chart bar size 1000
1h | bucket t 1m | agg sum(response_time) by=[t,tier] | chart stack "response_time:sum" by=tier
1h | histo "tier" | chart pie
```

--------------------------------

### Dashboards API

Source: https://docs.log-store.com/api

APIs for retrieving and saving dashboard configurations.

```APIDOC
## Dashboards API

### Description
Provides endpoints to retrieve existing dashboard configurations and to save new or updated dashboard configurations.

### Method
RPC

### Endpoint
- `rpc GetDashboards(GetDashboardsRequest) returns (GetDashboardsResponse) {}`
- `rpc SetDashboards(SetDashboardsRequest) returns (SetDashboardsResponse) {}`

### Parameters
#### GetDashboards
- **GetDashboardsRequest** (object) - Optional - Request for retrieving dashboards.

#### SetDashboards
- **SetDashboardsRequest** (object) - Required - Request for saving dashboard configurations.
  - **dashboards** (array) - Required - An array of dashboard configuration objects.
    - **name** (string) - Required - The name of the dashboard.
    - **widgets** (array) - Required - A list of widgets in the dashboard.

### Request Example (SetDashboards)
```json
{
  "dashboards": [
    {
      "name": "Web Server Overview",
      "widgets": [
        {
          "type": "lineChart",
          "title": "Requests per Second",
          "query": "status:2xx"
        }
      ]
    }
  ]
}
```

### Response
#### GetDashboards Response
- **GetDashboardsResponse** (object) - Response containing a list of dashboard configurations.
  - **dashboards** (array) - List of saved dashboard objects.

#### SetDashboards Response
- **SetDashboardsResponse** (object) - Confirmation of the save operation.

#### Response Example (GetDashboards)
```json
{
  "dashboards": [
    {
      "name": "Web Server Overview",
      "widgets": [
        {
          "type": "lineChart",
          "title": "Requests per Second",
          "query": "status:2xx"
        }
      ]
    }
  ]
}
```
```

--------------------------------

### Debugging Python Commands with Standard Input/Output

Source: https://docs.log-store.com/python

Provides a Python script structure for debugging custom log-store commands. This script reads logs from standard input (one JSON object per line), processes them using the `process` function, and writes the results to standard output. This allows for development and testing outside the log-store environment.

```python
import sys
import json
from typing import Optional

def process(log: dict) -> Optional[dict]:
  # Write your code here
  return log

if __name__ == '__main__':
  for line in sys.stdin:
    in_log = json.loads(line.strip())
    ret_log = process(in_log)

    if ret_log is not None:
      print(json.dumps(ret_log))

```

--------------------------------

### Log Store gRPC Dashboards Endpoints

Source: https://docs.log-store.com/api

Defines the gRPC RPC endpoints for managing dashboards. This includes endpoints to retrieve existing dashboards (GetDashboards) and to save new or updated dashboards (SetDashboards).

```proto
rpc GetDashboards(GetDashboardsRequest) returns (GetDashboardsResponse) { }
```

```proto
rpc SetDashboards(SetDashboardsRequest) returns (SetDashboardsResponse) { }
```

--------------------------------

### Log Store Basic Search Query Syntax

Source: https://docs.log-store.com/search_syntax

This is the fundamental syntax for constructing a search query in log-store. It specifies a time range, an optional limit on results, optional field-value conditions, and commands to process the results.

```plaintext
[0-9][mhd] [limit] [field (=|~|!=|!~|<|≤|>|≥) value] | command
```

--------------------------------

### TOML Configuration for Warm Storage (S3)

Source: https://docs.log-store.com/config_file

This snippet illustrates the TOML configuration for 'warm_storage', used for storing logs in an S3-compatible object store. It includes necessary credentials and bucket details. This section is optional but required if 'warm_days' is greater than zero.

```toml
[warm_storage]
access_key_id = "MY_ACCESS_KEY"
secret_access_key = "MY_SECRET_ACCESS_KEY"
region = "us-east-1"
bucket = "log-store-archive"
```

--------------------------------

### Cluster Logs by Field with Optional Method

Source: https://docs.log-store.com/commands

The `cluster` command groups logs based on a specified field using machine learning. An optional `method` parameter can be provided; `auto` determines clusters automatically, while `equal` performs clustering similar to SQL's group-by. The default method is `auto`.

```logql
cluster field <method=>
1h | cluster path
```

--------------------------------

### Search API

Source: https://docs.log-store.com/api

Endpoint for performing searches. The web frontend proxies this request to the backend.

```APIDOC
## Search API

### Description
Performs a search query and returns the search results. This endpoint is proxied from the web frontend to the backend.

### Method
RPC

### Endpoint
`/log-store.LogStore/Search`

### Parameters
#### Request Body
- **SearchQuery** (object) - Required - The query object used to perform the search.

### Request Example
```json
{
  "query": "example search query",
  "startTime": "2023-01-01T00:00:00Z",
  "endTime": "2023-01-01T23:59:59Z"
}
```

### Response
#### Success Response (200)
- **SearchResponse** (object) - The response containing the search results.

#### Response Example
```json
{
  "logs": [
    {
      "timestamp": "2023-01-01T10:00:00Z",
      "message": "Log message content"
    }
  ],
  "totalHits": 100
}
```
```

--------------------------------

### TOML Configuration for Hot Storage

Source: https://docs.log-store.com/config_file

This snippet defines the TOML configuration for 'hot_storage', specifying the local directory where log-store will store its data. This is a required setting.

```toml
[hot_storage]
data_dir = "/var/lib/log-store"  # location to store logs, saved searches, and dashboards
```

--------------------------------

### Records Display Command in Log Store

Source: https://docs.log-store.com/commands

The 'records' command displays log entries similar to records in a file. Missing fields are not shown directly but appear when an entry is expanded. It supports include, exclude, and order parameters.

```log-store
records <include=[]> <exclude=[]> <order=[]>
```

--------------------------------

### Overlay Logs on Charts

Source: https://docs.log-store.com/commands

The 'overlay' command is used in conjunction with the 'chart' command to display logs matching specific criteria on line, bar, or stacked charts. It requires a field, a comparison operator, and a value for filtering. This command is intended for visualization purposes and is applied after charting.

```text
overlay field (=|~|!=|!~|<|≤|>|≥) value <field (=|~|!=|!~|<|≤|>|≥) value>...
```

--------------------------------

### Chart Command

Source: https://docs.log-store.com/commands

The chart command is used to visualize log data. It supports various chart types like line, bar, stack, and pie, and can be configured with fields, constants, statistical functions, and grouping.

```APIDOC
## Chart Command

### Description
Visualizes log data with different chart types.

### Method
Not Applicable (Command-line interface)

### Endpoint
Not Applicable (Command-line interface)

### Parameters
#### Query Parameters
- **type** (string) - Required - One of the chart types: `line`, `bar`, `stack`, or `pie`.
- **field** (string) - Optional - The field(s) to chart; only required for `line`, `bar`, or `stack`. Multiple fields can be specified.
- **N** (constant) - Optional - A constant value to chart.
- **func(field)** (string) - Optional - A simple stats function (`min`, `max`, `avg`, `mean`, or `pNN` where `NN` is a percentile) to chart for the field.
- **by** (string) - Optional - An optional field or fields to further generate charts by separating data. Not used with `pie`.

### Request Example
```
1h | chart line "response_time"
1h | method != null | chart line "response_time" by=method
1h | chart line response_time min(response_time) max(response_time) avg(response_time)
1h | chart bar "size"
1h size != null | chart bar size 1000
1h | bucket t 1m | agg sum(response_time) by=[t,tier] | chart stack "response_time:sum" by=tier
1h | histo "tier" | chart pie
```

### Response
#### Success Response (200)
- **chart_data** (object) - The visualized data.

#### Response Example
{ "chart_data": { "type": "line", "labels": ["timestamp1", "timestamp2"], "datasets": [{"label": "response_time", "data": [100, 200]}] } }
```

--------------------------------

### Log Store gRPC Search Endpoint

Source: https://docs.log-store.com/api

Defines the gRPC RPC endpoint for performing searches. This is used for web-based searches that are proxied to the backend. It takes a SearchQuery and returns a SearchResponse.

```proto
rpc Search(SearchQuery) returns (SearchResponse) { }
```

--------------------------------

### Triggered Alert Log Formats

Source: https://docs.log-store.com/alerting

Shows the JSON line formats used to record triggered alerts in log-store. One format indicates a successful or failed HTTP POST, while the other captures specific error messages during the sending process.

```json
{ "source": "log-store", "alert": "${name}", "logs": [], "http_status": 200 }
```

```json
{ "source": "log-store", "alert": "${name}", "logs": [], "error_message": "" }
```

--------------------------------

### Aggregate Log Data with Various Methods and Grouping

Source: https://docs.log-store.com/commands

The `agg` command aggregates log fields using specified methods and can optionally group results by other fields. Supported methods include count, sum, mean (avg, average), median, min, max, and percentiles (p*). Aggregations often generate new fields, which may require quoting if they contain special characters like colons.

```logql
agg method1(field1, <field2, ...>) <method2(field3, field4, ...)> <by=[]>
1h | agg mean(response_time)
1h | agg p95(response_time) by=resp_code
```

--------------------------------

### Table Display Command in Log Store

Source: https://docs.log-store.com/commands

The 'table' command displays log entries in a tabular format. It allows for inclusion, exclusion, and ordering of fields. Missing fields are shown as blank, and headers include all returned fields.

```log-store
table <include=[]> <exclude=[]> <order=[]>
```

--------------------------------

### TOML Configuration for Log Retention

Source: https://docs.log-store.com/config_file

This snippet shows the TOML structure for configuring log retention policies. It includes settings for 'hot_days' (logs kept on local disk) and 'warm_days' (logs kept in warm storage like S3).

```toml
[retention]
hot_days = 7  # keep 7 days of logs on-disk
warm_days = 400  # then keep ~13 months of logs in S3
```

--------------------------------

### Parse Search API

Source: https://docs.log-store.com/api

Parses a search query and returns its structured representation.

```APIDOC
## Parse Search API

### Description
Parses a given search query string into a structured format.

### Method
RPC

### Endpoint
`/log-store.LogStore/ParseSearch`

### Parameters
#### Request Body
- **SearchQuery** (object) - Required - The query string to be parsed.

### Request Example
```json
{
  "query": "level:error AND message:failed"
}
```

### Response
#### Success Response (200)
- **query_parser_pb.ParsedSearch** (object) - The parsed representation of the search query.

#### Response Example
```json
{
  "parsedQuery": {
    "term": "AND",
    "clauses": [
      {
        "field": "level",
        "operator": "=",
        "value": "error"
      },
      {
        "field": "message",
        "operator": ":",
        "value": "failed"
      }
    ]
  }
}
```
```

--------------------------------

### Saved Searches API

Source: https://docs.log-store.com/api

APIs for retrieving and saving search queries.

```APIDOC
## Saved Searches API

### Description
Provides endpoints to retrieve existing saved searches and to save new searches.

### Method
RPC

### Endpoint
- `rpc GetSavedSearches(GetSavedSearchRequest) returns (GetSavedSearchResponse) {}`
- `rpc SetSavedSearches(SetSavedSearchRequest) returns (SetSavedSearchResponse) {}`

### Parameters
#### GetSavedSearches
- **GetSavedSearchRequest** (object) - Optional - Request for retrieving saved searches.

#### SetSavedSearches
- **SetSavedSearchRequest** (object) - Required - Request for saving a search.
  - **name** (string) - Required - The name of the search to save.
  - **query** (object) - Required - The search query object.

### Request Example (SetSavedSearches)
```json
{
  "name": "High Error Rate",
  "query": {
    "query": "level:error",
    "startTime": "2023-01-01T00:00:00Z"
  }
}
```

### Response
#### GetSavedSearches Response
- **GetSavedSearchResponse** (object) - Response containing a list of saved searches.
  - **searches** (array) - List of saved search objects.
    - **name** (string) - Name of the saved search.
    - **query** (object) - The saved search query object.

#### SetSavedSearches Response
- **SetSavedSearchResponse** (object) - Confirmation of the save operation.

#### Response Example (GetSavedSearches)
```json
{
  "searches": [
    {
      "name": "High Error Rate",
      "query": {
        "query": "level:error"
      }
    }
  ]
}
```
```

--------------------------------

### Log Store gRPC Parse Search Endpoint

Source: https://docs.log-store.com/api

Defines the gRPC RPC endpoint for parsing search queries. This endpoint takes a SearchQuery and returns a ParsedSearch object, which represents the parsed version of the query.

```proto
rpc ParseSearch(SearchQuery) returns (query_parser_pb.ParsedSearch) { }
```

--------------------------------

### Run Python Functions for Log Processing

Source: https://docs.log-store.com/commands

The 'python' command executes a user-defined Python function to modify or filter log entries. The function is identified by its name. Note that Python commands cannot be saved on the demo site, and their effectiveness depends on the associated Python code.

```text
python name
```

--------------------------------

### Chart Display Command in Log Store

Source: https://docs.log-store.com/commands

The 'chart' command graphically visualizes query results. It requires a chart type ('line', 'bar', 'stack', 'pie') and can operate on time series or single entries, often in conjunction with the 'histo' command for pie charts.

```log-store
chart type field <field ...> <N> <func(field)> <by=>
```

--------------------------------

### JSON Display Command in Log Store

Source: https://docs.log-store.com/commands

The 'json' command outputs each log entry on a new line as a JSON object. Entries can be expanded for pretty-printing by clicking the date. This command accepts 'include' and 'exclude' parameters for field selection.

```log-store
json <include=[]> <exclude=[]>
```

--------------------------------

### Concat: Combine Fields

Source: https://docs.log-store.com/commands

The `concat` command merges values from multiple fields into a new field. It supports custom separators and an option to skip entries where fields are missing.

```log-store
concat fields[] new_field <sep=> <skip_missing=>
```

--------------------------------

### JSON Template for Log Store Alerts

Source: https://docs.log-store.com/alerting

Defines a JSON template to customize the payload sent to a webhook endpoint when an alert is triggered. It allows adding custom fields and values, but warns against overwriting the 'logs' field.

```json
{
  "message": "Alert from log-store!",
  "auth-token": "hpZU7pArZq5yqW51CXQ6Ix1DWJ9KvmA+HAe8VlSzz1rbomIt8aozCf9jAWWq/7aKRFisb2kEJ+6j"
}
```

--------------------------------

### Basic Python Command Structure for Log Processing

Source: https://docs.log-store.com/python

Defines the fundamental structure for a Python command to be processed by log-store. The `process` function must accept a dictionary representing a log and return either a modified dictionary or None to filter the log. It highlights the importance of maintaining the timestamp format and checking for field existence before modification.

```python
from typing import Optional

def process(log: dict) -> Optional[dict]:
  return log

```

--------------------------------

### Log Store gRPC Hit Count Endpoint

Source: https://docs.log-store.com/api

Defines the gRPC RPC endpoint for retrieving the number of hits for a given search query. It accepts a SearchQuery and returns a HitCountResponse.

```proto
rpc HitCount(SearchQuery) returns (HitCountResponse) { }
```

--------------------------------

### Filter Logs with Conditions

Source: https://docs.log-store.com/commands

The 'where' command filters log entries, retaining only those that satisfy a given comparison. It is recommended to use this command after other processing commands, as it is less performant than initial search criteria filtering. It requires a field, a comparison operator, and a value.

```text
where field (=|~|!=|!~|<|≤|>|≥) value
```

--------------------------------

### Lift: Parse JSON from Fields

Source: https://docs.log-store.com/commands

The `lift` command parses a field's value as JSON, promoting its nested fields to the top level. Options include error filtering, prefixing new fields, and retaining original fields.

```log-store
lift field <filter_on_error=true> <prefix=false> <keep_existing=false>
```

--------------------------------

### Extract: Parse Fields using Regex

Source: https://docs.log-store.com/commands

The `extract` command uses regular expressions to parse specific parts of a field's value and create new fields from the matches. It supports capture groups to define the new fields precisely.

```log-store
extract field regex new_fields[]
```

--------------------------------

### Pivot Fields for Values

Source: https://docs.log-store.com/commands

The 'pivot' command swaps fields for values within the log results. Be aware that this operation can generate 'impossible' JSON entries if duplicate values exist. It is often used after aggregation commands like 'histo'.

```text
pivot
```

--------------------------------

### Cluster Command

Source: https://docs.log-store.com/commands

The cluster command groups logs by a specified field using a Machine Learning algorithm to determine the number of clusters and which logs belong to each.

```APIDOC
## Cluster Command

### Description
Groups logs by a specified field using a Machine Learning algorithm.

### Method
Not Applicable (Command-line interface)

### Endpoint
Not Applicable (Command-line interface)

### Parameters
#### Query Parameters
- **field** (string) - Required - The field to use when clustering logs.
- **method** (string) - Optional - The method for clustering. `auto` (default) determines the number of clusters and log assignments. `equal` uses equality, similar to SQL's GROUP BY.

### Request Example
```
1h | cluster path
```

### Response
#### Success Response (200)
- **clusters** (array) - An array of cluster objects, each containing logs belonging to that cluster.

#### Response Example
{ "clusters": [ { "cluster_id": 0, "logs": [ { "timestamp": "...", "path": "/api/v1/users", ... } ] }, { "cluster_id": 1, "logs": [ { "timestamp": "...", "path": "/api/v1/products", ... } ] } ] }
```

--------------------------------

### Log Store gRPC Saved Searches Endpoints

Source: https://docs.log-store.com/api

Defines the gRPC RPC endpoints for managing saved searches. This includes endpoints to retrieve saved searches (GetSavedSearches) and to save new searches (SetSavedSearches).

```proto
rpc GetSavedSearches(GetSavedSearchRequest) returns (GetSavedSearchResponse) { }
```

```proto
rpc SetSavedSearches(SetSavedSearchRequest) returns (SetSavedSearchResponse) { }
```

--------------------------------

### Agg Command

Source: https://docs.log-store.com/commands

The agg command aggregates fields by a given method, optionally by another field. It generates new fields based on the aggregation method and fields used.

```APIDOC
## Agg Command

### Description
Aggregates fields by a specified method, with optional grouping by another field.

### Method
Not Applicable (Command-line interface)

### Endpoint
Not Applicable (Command-line interface)

### Parameters
#### Query Parameters
- **method1(field1, <field2, ...>)** (string) - Required - The aggregation method and the field(s) to aggregate. Methods include `min`, `max`, `count`, `mean`, `median`, `pnn` (percentile).
- **method2(...)** (string) - Optional - Another aggregation method and field(s).
- **by=[]** (array) - Optional - A field or fields to group the aggregations by.

#### Methods
- `count`: Counts the number of logs. Ignores any field arguments.
- `sum`: Sums the values of a numeric field.
- `mean`, `avg`, `average`: Computes the arithmetic mean (average) of a numeric field.
- `median`: Computes the approximate median value of a numeric field.
- `min`: Returns the smallest value of a numeric field.
- `max`: Returns the largest value of a numeric field.
- `p*`: Returns the specified percentile (e.g., `p95`) for a numeric field.

### Request Example
```
1h | agg mean(response_time)
1h | agg p95(response_time) by=resp_code
```

### Response
#### Success Response (200)
- **aggregation_results** (object) - An object containing the aggregated results.

#### Response Example
{ "aggregation_results": { "mean_response_time": 150.75 } }
```

--------------------------------

### Bucket: Round or Group Timestamps

Source: https://docs.log-store.com/commands

The `bucket` command modifies log timestamps by either rounding them down to a specified interval or grouping them based on another field's value. It's useful for aggregating logs over time or by category.

```log-store
bucket duration OR field
```

--------------------------------

### Hit Count API

Source: https://docs.log-store.com/api

Retrieves the total number of hits for a given search query.

```APIDOC
## Hit Count API

### Description
Calculates and returns the total number of log entries that match a given search query.

### Method
RPC

### Endpoint
`/log-store.LogStore/HitCount`

### Parameters
#### Request Body
- **SearchQuery** (object) - Required - The query object for which to count hits.

### Request Example
```json
{
  "query": "status:500",
  "startTime": "2023-01-01T00:00:00Z",
  "endTime": "2023-01-01T23:59:59Z"
}
```

### Response
#### Success Response (200)
- **HitCountResponse** (object) - An object containing the total hit count.

#### Response Example
```json
{
  "count": 50
}
```
```

--------------------------------

### Split Log Fields

Source: https://docs.log-store.com/commands

The 'split' command divides a specified field into multiple new fields based on a separator character or a regular expression. It can accept either a 'sep' for a single character or a 'regex' for more complex patterns. If neither is provided, it defaults to splitting by whitespace. This is useful for parsing delimited data within a field.

```text
split field <sep=> <regex=>
```

--------------------------------

### Rename Log Fields

Source: https://docs.log-store.com/commands

The 'rename' command changes the name of an existing field to a new one. A warning is issued if the new field name already exists, as it will be overwritten. This is useful for standardizing field names or preparing data for further analysis.

```text
rename old_field new_field
```

--------------------------------

### Histo: Count Unique Field Values

Source: https://docs.log-store.com/commands

The `histo` command counts the occurrences of unique values within a specified field. It serves as a shorthand for `agg count(field)` and is useful for understanding the distribution of categorical data.

```log-store
histo field
```

=== COMPLETE CONTENT === This response contains all available snippets from this library. No additional content exists. Do not make further requests.