log

log is one of the most commonly used mathematical functions in observability. Log-transforming latency, error counts, or request rates compresses wide value ranges into a more manageable scale, reduces the influence of extreme outliers, and can reveal patterns that are linear on a log scale. It's also the basis for computing geometric means with exp(avg(log(x))).

Usage#

Syntax#

log(x)

Parameters#

Name	Type	Required	Description
`x`	real	Yes	A positive real number (x > 0).

Returns#

The natural logarithm of x.
null if x is negative, zero, or can't be converted to a real value.

Example#

Use log to compress request durations onto a natural log scale.

Query

['sample-http-logs']
| where req_duration_ms > 0
| extend log_duration = log(req_duration_ms)
| project _time, id, req_duration_ms, log_duration

Run in Playground

Output

_time	id	req_duration_ms	log_duration
2024-11-14 10:00:00	user-1	1.0	0.0000
2024-11-14 10:01:00	user-2	100.0	4.6052
2024-11-14 10:02:00	user-3	10000.0	9.2103

exp: Returns e^x. Use it as the inverse of log to return to the original scale.
log2: Returns the base-2 logarithm. Use it for binary-scale analysis such as bit depth or memory sizing.
log10: Returns the base-10 logarithm. Use it for order-of-magnitude analysis or decibel calculations.
loggamma: Returns the log of the absolute value of the gamma function. Use it to avoid overflow when computing gamma on large inputs.
sqrt: Returns the square root. Use it as a lighter alternative to log for compressing small value ranges.

Other query languages#

Splunk SPL users

In Splunk SPL, the natural logarithm is called ln() rather than log(). The SPL log() function computes the base-10 logarithm by default. In APL, log() always means the natural logarithm.

Splunk example

| eval ln_duration = ln(req_duration_ms)

APL equivalent

['sample-http-logs']
| extend ln_duration = log(req_duration_ms)

ANSI SQL users

In ANSI SQL, LN() computes the natural logarithm and LOG() computes the base-10 logarithm in most dialects. In APL, log() means the natural logarithm, matching SQL's LN().

SQL example

SELECT LN(req_duration_ms) AS ln_duration FROM logs