> ## Documentation Index
> Fetch the complete documentation index at: https://docs.tell.rs/llms.txt
> Use this file to discover all available pages before exploring further.

# Reduce Transform

> Consolidate duplicate events into single events with count metadata.

The reduce transform groups similar events and flushes them as a single event with a count. When an error storm sends 10,000 identical messages in a minute, reduce collapses them into one event with `_reduced_count: 10000` — cutting storage costs without losing information.

## Quick start

```toml theme={null}
[[routing.rules.transformers]]
type = "reduce"
group_by = ["error_code"]
window_ms = 5000
```

This groups events by `error_code` and flushes each group after 5 seconds.

## How it works

1. Events are grouped by the fields you specify in `group_by`
2. When a group reaches `max_events` or the time window expires, it flushes
3. The first event in each group is emitted with metadata fields added:
   * `_reduced_count` — how many events were consolidated
   * `_reduced_span_ms` — time span from first to last event in the group

Groups with fewer than `min_events` pass through unchanged — no metadata is added.

## Grouping

The `group_by` field controls what counts as "similar." Events with the same values for these fields land in the same group.

```toml theme={null}
# Group by a single field
group_by = ["error_code"]

# Group by multiple fields
group_by = ["error_code", "host", "severity"]

# Nested JSON paths work too
group_by = ["error.code", "request.user_id"]
```

If `group_by` is empty, events are grouped by their entire content — only exact duplicates are consolidated.

## Examples

**Collapse error storms:**

```toml theme={null}
[[routing.rules.transformers]]
type = "reduce"
group_by = ["error_code", "service"]
window_ms = 10000
max_events = 500
min_events = 5
```

Only groups with 5+ events are reduced. Smaller groups pass through unchanged.

**Deduplicate health checks:**

```toml theme={null}
[[routing.rules.transformers]]
type = "reduce"
group_by = ["path"]
window_ms = 60000
min_events = 1
```

**Aggressive cost reduction:**

```toml theme={null}
[[routing.rules.transformers]]
type = "reduce"
group_by = ["error_type"]
window_ms = 1000
max_events = 50
min_events = 1
```

## Reference

| Field        | Default | Description                                                                   |
| ------------ | ------- | ----------------------------------------------------------------------------- |
| `type`       | —       | `"reduce"`                                                                    |
| `group_by`   | `[]`    | Fields to group by (empty = exact content match)                              |
| `window_ms`  | `5000`  | Time window in milliseconds before flushing a group                           |
| `max_events` | `1000`  | Maximum events per group before forced flush                                  |
| `min_events` | `2`     | Minimum events to apply reduction (below this, events pass through unchanged) |
| `enabled`    | `true`  | Set to `false` to disable                                                     |