log2

log2 is useful when working with data measured on a binary scale, such as memory sizes, network packet lengths, or binary tree structures. Because each unit increase in log2(x) corresponds to a doubling of x, log2 is a natural choice for analyzing values that grow or shrink by factors of two. You can also use it to compute geometric means in base-2 space.

Usage#

Syntax#

log2(x)

Parameters#

Name	Type	Required	Description
`x`	real	Yes	A positive real number (x > 0).

Returns#

The base-2 logarithm of x.
null if x is negative, zero, or can't be converted to a real value.

Example#

Use log2 to express request durations on a binary log scale where each unit represents a doubling.

Query

['sample-http-logs']
| where req_duration_ms > 0
| extend log2_duration = log2(req_duration_ms)
| project _time, id, req_duration_ms, log2_duration

Run in Playground

Output

_time	id	req_duration_ms	log2_duration
2024-11-14 10:00:00	user-1	1.0	0.000
2024-11-14 10:01:00	user-2	64.0	6.000
2024-11-14 10:02:00	user-3	1024.0	10.000

exp2: Returns 2^x. Use it as the inverse of log2.
log: Returns the natural logarithm. Use it when you prefer the natural base rather than base-2.
log10: Returns the base-10 logarithm. Use it for order-of-magnitude analysis instead of binary analysis.
pow: Raises a value to a power. Use it to compute powers of two directly as an alternative to exp2.
round: Rounds a value. Use it after log2 to bucket data into binary power groups.

Other query languages#

Splunk SPL users

Splunk SPL doesn't include a built-in log2() function. You compute it as ln(x) / ln(2) or log(x) / log(2).

Splunk example

| eval log2_duration = ln(req_duration_ms) / ln(2)

APL equivalent

['sample-http-logs']
| extend log2_duration = log2(req_duration_ms)

ANSI SQL users

Standard SQL does not define a LOG2() function. In SQL Server you compute it as LOG(x) / LOG(2). PostgreSQL offers LOG(2, x) for base-2 logarithms.

SQL example

SELECT LOG(req_duration_ms) / LOG(2) AS log2_duration FROM logs