render

Specifies a visualization type for the query results. When present, the frontend renders the results using the specified chart type instead of the default table grid.

Spec

... | render <chart_type> [with (<property> = <value> [, ...])]

Parameters

chart_type - The visualization type (see Chart Types below).
property   - Optional rendering properties.

Return Value

The same data as the input, annotated with visualization metadata.

Render Options

All chart types accept optional with (...) properties to control visualization behavior. Options are passed as key-value pairs.

Universal Options

These options apply to all chart types.

metrics
| summarize avg(cpu) by bin(timestamp, 1m), host
| render timechart with (title = "CPU by Host", legend = true, legendPosition = "top")

legendPosition places the legend above ("top"), below ("bottom", default) or beside ("left", "right") the chart area. Legends wrap onto multiple lines above or below the chart and stack vertically beside it; long legends scroll.

metrics
| summarize avg(cpu) by bin(timestamp, 1m), host
| render timechart with (theme = "dark")

Axis Unit Options

These options apply to timechart, linechart, and barchart. They control how numeric values are formatted on axis tick labels.

Supported Units

When a column has a timespan type, axis ticks are automatically formatted as durations. An explicit yUnit or xUnit always takes precedence over this auto-detection.

On a timechart the x-axis tick format adapts to the visible range: under two seconds shows milliseconds, under two minutes shows seconds, within a day hh:mm, up to a week MMM d, hh:mm, longer ranges MMM d, and ranges spanning years include the year. An explicit xUnit overrides this.

logship.backend.executor.local.schemas.size_bytes
| summarize max = agg_max(max) by bin(timestamp, 1m), account
| render timechart with (title = "Disk Usage", yUnit = "bytes")

metrics
| summarize avg(cpu_fraction) by bin(timestamp, 1m)
| render timechart with (yUnit = "percentunit")

sensors
| summarize avg(temp) by bin(timestamp, 1m), location
| render linechart with (yUnit = "celsius")

Line / Time Chart Options

These options apply to timechart and linechart.

Non-numeric values are ignored. Without minY/maxY the y-axis adds 10% headroom above the data.

metrics
| summarize avg(cpu) by bin(timestamp, 1m), host
| render timechart with (fill = false, tension = 0.4, lineWidth = 2, pointSize = 3)

// Auto-detect interval and break lines at large gaps
metrics
| summarize avg(cpu) by bin(timestamp, 1m), host
| render timechart with (spanGaps = "auto")

// Break lines when data gaps exceed 5 minutes
metrics
| summarize avg(cpu) by bin(timestamp, 1m), host
| render timechart with (spanGaps = 300000)

metrics
| summarize sum(bytes) by bin(timestamp, 1m), service
| render timechart with (stacked = true, yScale = "log", grid = false)

// Pin the y-axis to 0–100 regardless of the data
metrics
| summarize avg(cpu_percent) by bin(timestamp, 1m), host
| render timechart with (minY = 0, maxY = 100, yUnit = "percent")

Bar Chart Options

These options apply to barchart.

requests
| summarize count() by region
| render barchart with (horizontal = true, maxY = 1000)

Any columns beyond the value and category columns group the result into one series per unique combination of their values, labelled (column: value). Series are drawn side by side per category, or on top of each other with stacked = true.

requests
| summarize count() by statusCode, region
| render barchart with (stacked = true)

Pie Chart Options

These options apply to piechart.

requests
| summarize count() by method
| render piechart with (kind = "doughnut")

Map Chart Options

These options apply to map2d. Option names are case-sensitive.

Columns read from each row:

locations
| project latitude, longitude, label = name
| render map2d

events
| project latitude, longitude, weight = severity / 10.0
| render map2d with (MapType = "heatmap", Radius = 8, BlurRadius = 15)

Gantt Chart Options

These options apply to gantt.

tasks
| project name, start, end, group
| render gantt with (rowHeight = 48)

Trace Chart Options

These options apply to trace. The timestamp, traceid, parentid, and spanid columns are resolved by the query engine. The remaining columns are resolved by the frontend: an explicit option wins, then the first column whose name (ignoring case, _, -, . and spaces) matches a well-known name.

A span needs either an end column or a duration column. The duration column may be a timespan, or a number whose unit is inferred from the column name: nano/ns = nanoseconds, micro/us = microseconds, sec = seconds, otherwise milliseconds.

spans
| where traceid == "abc123"
| project timestamp, traceid, parentid, spanid, op, svc, elapsed_us
| render trace with (nameColumn = "op", serviceColumn = "svc", durationColumn = "elapsed_us")

Stat Chart Options

These options apply to stat.

metrics
| where timestamp > ago(5m)
| summarize avg(cpu)
| render stat with (title = "CPU", unit = "%", forground = "#ffffff", background = "#1e40af")

logship.backend.executor.local.schemas.size_bytes
| summarize sum(max)
| render stat with (yUnit = "bytes")

Chart Types

timechart

Time series visualization. The x-axis is the first datetime column and the y-axis is the first numeric column (or, failing that, the first timespan column); every other column becomes a series key, so summarize ... by bin(timestamp, 1m), host draws one line per host.

metrics
| where timestamp > ago(1h)
| summarize avg(cpu) by bin(timestamp, 1m)
| render timechart

linechart

Line chart. The x-axis is the first numeric (or timespan) column and the y-axis is the next numeric column; every other column becomes a series key.

range x from 0 to 100 step 1
| extend y = sin(x * pi() / 50)
| render linechart

barchart

Bar chart for comparing values across categories. The value is the first numeric (int, uint, or float) column and the category label is the first non-numeric column, in any order; when every column is numeric the first two are used positionally.

requests
| where timestamp > ago(1d)
| summarize count() by statusCode
| render barchart

piechart

Pie chart showing proportional distribution. The value is the first numeric (int, uint, or float) column and the slice label is the first non-numeric column, in any order.

requests
| where timestamp > ago(1h)
| summarize count() by method
| render piechart

map2d

2D geographic map visualization. Requires latitude and longitude columns of type float64. See Map Chart Options for optional columns.

locations
| project latitude, longitude, label = name
| render map2d

gantt

Gantt chart for scheduling and timeline visualization. Requires name, start, and end columns. Optionally supports color and group columns.

tasks
| project name, start, end, group
| render gantt

trace

Distributed trace visualization for viewing spans in a trace tree. Requires timestamp (datetime), traceid, parentid, and spanid (string) columns, plus an end or duration column. See Trace Chart Options for column detection.

spans
| where traceid == "abc123"
| project timestamp, traceid, parentid, spanid, operationName, duration
| render trace

stat

Statistical card display showing key metrics. Shows one card per column of the first row. Requires at least one column.

metrics
| where timestamp > ago(5m)
| summarize avg(cpu), avg(memory), count()
| render stat

table

Default table grid display. This is the default when no render operator is specified.

logs
| take 100
| render table