Query and aggregates

You will learn how search, counts, and numeric aggregates work.

Query is free-form exploration on learned fields. By default it uses the sidebar’s active stream; on the Query page you can also select multiple streams for one investigation. Results keep the source stream on every row. You do not map JSON paths yourself — pick fields from the catalog (common to all selected streams), filter them, and either search events or run an aggregate. When you do not know the field, search the complete stored event JSON with Event text.

Search vs aggregate

Mode	Result
Search	Matching event rows for the time window (projected learned fields)
Aggregate	Counts or numeric summaries, optionally bucketed over time

Run with Run search or Run query, then optionally Save as view.

Receipt vs event time

Period still picks the lookback window. Time basis chooses which clock that window uses:

Basis	Clock
Receipt (default)	When Cordo ingested the event (`ingested_at`)
Event time	Producer time derived at ingest (OTLP log time or a recognised ISO timestamp field)

Delayed or backfilled logs can appear under Receipt now but under Event time in the past. Event-time queries skip rows without a trustworthy producer time and may show how many such rows were in the overlapping ingest window. Charts and saved views use the same basis once you save them.

Query reads the analytics projection, so results can lag raw ingest by a short window. Events still shows Postgres-backed recent payloads immediately.

Empty Query/Views results are not all the same: Cordo tells you when analytics is still catching up, when a page was truncated (size or row cap), when a request failed, and when the window really matched nothing. A healthy Count of 0 is distinct from lag.

Filters

Filters are combined with AND. Operators include equality and comparisons (=, ≠, >, ≥, <, ≤), contains / not contains, in / not in, exists, is null, starts with / ends with, and regex / not regex.

Use in when any of several values should match. regex / not regex take an RE2 pattern (case-sensitive unless the pattern opts in).

Cordo also binds common semantics across mixed producers: a filter on level also matches compatible catalog paths such as severity or log.level. Query chips show also … when extra paths are included. Fields lists the same bindings under Common semantics.

Full operator list: Query filters.

Complete event text

Event text searches nested keys, values, and JSON scalars without choosing a learned field. Contains is a Unicode case-insensitive substring; Regex uses RE2 and is case-sensitive unless your pattern opts in. The text term and all learned-field filters combine with AND.

The same search is available in event and aggregate Query modes, saved views (including live tails), the REST API as raw_search, and MCP query / sample_events. Search terms are bounded and are not written to query-shape logs, but results follow the stream’s normal access controls because complete event text can contain sensitive values.

Time windows

Relative periods (for example Last 15 minutes, Last 24 hours, Last 7 days) or a fixed absolute range. The same relative tokens appear as Lookback on views.

Lookup table: Relative lookbacks.

Aggregates and charts

Aggregate functions: Count, Sum, Average, Max, P50, P95, P99. Numeric functions need a numeric Field.

Optional Interval buckets the series (1 minute through 1 day) for charts. With no interval, you get a table-only summary.

Details: Aggregates.

Group by and Normalize URI paths

When you Group by a field, you can enable Normalize URI paths. Cordo collapses UUID and numeric path segments to {id} so high-cardinality URLs group usefully (for example /v1/workspaces/{id}/search).

Compare to the prior period

On Aggregate, Compare offers Off or Prior period. Prior period runs the same aggregate over the equal-length window immediately before your selected range. Table rows show the prior value, delta, and percent change; charts overlay the prior series.

Compare is not available in Search / events mode. Saving the aggregate as a view keeps Prior period. REST and MCP use compare=prior_period.

Download events

Search results (Query) and saved event views can Download CSV or Download NDJSON. The server exports a bounded page of matching events with identity columns; a notice appears when the export was truncated. Aggregate charts are not downloaded this way.