Skip to main content
The reduce transform groups similar events and flushes them as a single event with a count. When an error storm sends 10,000 identical messages in a minute, reduce collapses them into one event with _reduced_count: 10000 — cutting storage costs without losing information.

​
Quick start

[[routing.rules.transformers]]
type = "reduce"
group_by = ["error_code"]
window_ms = 5000
This groups events by error_code and flushes each group after 5 seconds.

​
How it works

  1. Events are grouped by the fields you specify in group_by
  2. When a group reaches max_events or the time window expires, it flushes
  3. The first event in each group is emitted with metadata fields added:
    • _reduced_count — how many events were consolidated
    • _reduced_span_ms — time span from first to last event in the group
Groups with fewer than min_events pass through unchanged — no metadata is added.

​
Grouping

The group_by field controls what counts as “similar.” Events with the same values for these fields land in the same group. 
# Group by a single field
group_by = ["error_code"]

# Group by multiple fields
group_by = ["error_code", "host", "severity"]

# Nested JSON paths work too
group_by = ["error.code", "request.user_id"]
If group_by is empty, events are grouped by their entire content — only exact duplicates are consolidated.

​
Examples

Collapse error storms: 
[[routing.rules.transformers]]
type = "reduce"
group_by = ["error_code", "service"]
window_ms = 10000
max_events = 500
min_events = 5
Only groups with 5+ events are reduced. Smaller groups pass through unchanged. Deduplicate health checks: 
[[routing.rules.transformers]]
type = "reduce"
group_by = ["path"]
window_ms = 60000
min_events = 1
Aggressive cost reduction: 
[[routing.rules.transformers]]
type = "reduce"
group_by = ["error_type"]
window_ms = 1000
max_events = 50
min_events = 1

​
Reference

FieldDefaultDescription
type—"reduce"
group_by[]Fields to group by (empty = exact content match)
window_ms5000Time window in milliseconds before flushing a group
max_events1000Maximum events per group before forced flush
min_events2Minimum events to apply reduction (below this, events pass through unchanged)
enabledtrueSet to false to disable