Plots events on an pie chart.
chart_pie x|label=field, y|value=any, [group=any]Description
Section titled “Description”Visualizes events with an pie chart on the Tenzir Platform.
x|label = field
Section titled “x|label = field”Name of each slice on the chart.
String, IP, subnet, and null labels use the order in which they first appear
in the input. Use sort before chart_pie to control the order
of categorical slices.
Numeric, duration, and timestamp labels are sorted by value.
y|value = any
Section titled “y|value = any”Value of each slice on the chart. Multiple data points for the same group can be be aggregated using an aggregation function.
Multiple y values and their labels can be specified by using the record
syntax: {name: value, ...}.
For example, y = {"Avg. Load": mean(load)} calculates the
mean of the load field and labels it as Avg. Load.
group = any (optional)
Section titled “group = any (optional)”Optional expression to group the aggregations with.
Examples
Section titled “Examples”Chart count of events imported for every unique schema
Section titled “Chart count of events imported for every unique schema”metrics "import"where timestamp > now() - 1dchart_pie label=schema, value=sum(events)