Reduce Transform

The reduce transform groups similar events and flushes them as a single event with a count. When an error storm sends 10,000 identical messages in a minute, reduce collapses them into one event with _reduced_count: 10000 — cutting storage costs without losing information.

Quick start

[[routing.rules.transformers]]
type = "reduce"
group_by = ["error_code"]
window_ms = 5000

This groups events by error_code and flushes each group after 5 seconds.

How it works

Events are grouped by the fields you specify in group_by
When a group reaches max_events or the time window expires, it flushes
The first event in each group is emitted with metadata fields added:
- _reduced_count — how many events were consolidated
- _reduced_span_ms — time span from first to last event in the group

Groups with fewer than min_events pass through unchanged — no metadata is added.

Grouping

The group_by field controls what counts as “similar.” Events with the same values for these fields land in the same group.

# Group by a single field
group_by = ["error_code"]

# Group by multiple fields
group_by = ["error_code", "host", "severity"]

# Nested JSON paths work too
group_by = ["error.code", "request.user_id"]

If group_by is empty, events are grouped by their entire content — only exact duplicates are consolidated.

Examples

Collapse error storms:

[[routing.rules.transformers]]
type = "reduce"
group_by = ["error_code", "service"]
window_ms = 10000
max_events = 500
min_events = 5

Only groups with 5+ events are reduced. Smaller groups pass through unchanged. Deduplicate health checks:

[[routing.rules.transformers]]
type = "reduce"
group_by = ["path"]
window_ms = 60000
min_events = 1

Aggressive cost reduction:

[[routing.rules.transformers]]
type = "reduce"
group_by = ["error_type"]
window_ms = 1000
max_events = 50
min_events = 1

Reference

Field	Default	Description
`type`	—	`"reduce"`
`group_by`	`[]`	Fields to group by (empty = exact content match)
`window_ms`	`5000`	Time window in milliseconds before flushing a group
`max_events`	`1000`	Maximum events per group before forced flush
`min_events`	`2`	Minimum events to apply reduction (below this, events pass through unchanged)
`enabled`	`true`	Set to `false` to disable

Getting Started

Tracking

Pipeline

Analytics

Installing

Reduce Transform

Quick start

How it works

Grouping

Examples

Reference

​Quick start

​How it works

​Grouping

​Examples

​Reference

Quick start

How it works

Grouping

Examples

Reference