timeslice_1.toml

query = """* | json | timeslice(parseDate(ts)) 5m | count by _timeslice"""
input = """
{"ts": "2013-09-06T20:00:48.124817Z", "lvl": "TRACE", "msg": "trace test"}
{"ts": "2013-09-06T20:00:49.124817Z", "lvl": "INFO", "msg": "Starting up service"}
{"ts": "2013-09-06T22:00:49.124817Z", "lvl": "INFO", "msg": "Shutting down service", "user": "steve@example.com"}
{"ts": "2013-09-06T22:00:59.124817Z", "lvl": "DEBUG5", "msg": "Details..."}
{"ts": "2013-09-06T22:00:59.124817Z", "lvl": "DEBUG4", "msg": "Details..."}
{"ts": "2013-09-06T22:00:59.124817Z", "lvl": "DEBUG3", "msg": "Details..."}
{"ts": "2013-09-06T22:00:59.124817Z", "lvl": "DEBUG2", "msg": "Details..."}
{"ts": "2013-09-06T22:00:59.124817Z", "lvl": "DEBUG", "msg": "Details..."}
{"ts": "2013-09-06T22:01:49.124817Z", "lvl": "STATS", "msg": "1 beat per second"}
{"ts": "2013-09-06T22:05:49.124817Z", "lvl": "WARNING", "msg": "not looking good"}
{"ts": "2013-09-06T22:05:49.124817Z", "lvl": "ERROR", "msg": "looking bad"}
{"ts": "2013-09-06T22:10:49.124817Z", "lvl": "CRITICAL", "msg": "sooo bad"}
{"ts": "2013-09-06T23:05:49.124817Z", "lvl": "FATAL", "msg": "shoot", "obj": { "field1" : "hi", "field2": 2 }, "arr" : ["hi", {"sub1": true}]}
"""
output = """
_timeslice                     _count
---------------------------------------------
2013-09-06 20:00:00 UTC        2
2013-09-06 22:00:00 UTC        7
2013-09-06 22:05:00 UTC        2
2013-09-06 22:10:00 UTC        1
2013-09-06 23:05:00 UTC        1
"""