make-streams

The make-streams operator splits the input stream into multiple named output streams based on the distinct values of one or more expressions.

Use it when later stages need to process each group independently instead of keeping all rows in a single stream.

Spec

... | make-streams <expression> [, ...]

Parameters

• <expression>: One or more column references or named expressions. Each unique combination of evaluated values becomes a separate stream key.

Return Value

Multiple output streams, one per unique combination of the specified expression values.

The row schema is unchanged. The operator changes how rows are partitioned into streams, not which columns are returned.

Notes

• Multiple expressions are separated with commas.
• Expressions can be named with the standard name = expression form.
• High-cardinality keys can create many streams. Reduce or aggregate the input first when the key could contain many unique values.

Example

Split rows into one stream per service:

datatable(Service:string, Level:string, Message:string)
[
    "web", "info", "request started",
    "web", "error", "timeout",
    "api", "info", "healthy"
]
| make-streams Service

Split rows by a computed key:

datatable(Service:string, Status:int64)
[
    "web", 200,
    "web", 500,
    "api", 503
]
| make-streams Service, IsError = Status >= 500