Grouping Field Aliases

You can rename the grouping field element in the query results by using an alias. The alias name follows the grouping expression prefixed with the keyword AS. For example:

GET /LogDepot/AppLogs/_aggregate?m=COUNT(*)&q=UserSID='S-1-5-18'&f=EventID AS ErrorNo

The alias ErrorNo replaces the grouping field EventID in the output:

{"results": {

"aggregate": {

"metric": "COUNT(*)",

"query": "UserSID='S-1-5-18'",

"group": "EventID AS ErrorNo"

},

"totalobjects": "172274",

"summary": "172274",

"totalgroups": "19",

"groups": [

{"group": {

"metric": "1",

"field": {"ErrorNo": "512"}

}},

{"group": {

"metric": "7",

"field": {"ErrorNo": "514"}

}},

...

{"group": {

"metric": "1",

"field": {"ErrorNo": "806"}

}}

]

}}