eventstats
Description
Performs statistical operations on the data. Stores the results in a new field.
Performs statistical operations on data. Saves the results in a new field of each event. Unlike stats, the command does not reduce the number of rows in the result - all original events are preserved, and the aggregated value is added to each of them as a new field.
Syntax
eventstats <functions-expression> ["," <functions-expression>] [<by_expression>]
Arguments
See the stats command for a description.
Query Examples
The following examples use the auth_sessions index:
| @timestamp | user | host | action | bytes |
|---|---|---|---|---|
| 2026-06-24T08:00:00Z | admin | dc-01 | logged-in | 1500 |
| 2026-06-24T08:15:00Z | admin | dc-01 | file-access | 3200 |
| 2026-06-24T08:30:00Z | admin | srv-01 | logged-in | 800 |
| 2026-06-24T09:00:00Z | john.doe | workstation-01 | logged-in | 1200 |
| 2026-06-24T09:10:00Z | john.doe | workstation-01 | file-access | 4500 |
| 2026-06-24T09:20:00Z | john.doe | workstation-02 | logged-in | 950 |
| 2026-06-24T10:00:00Z | guest | kiosk-01 | logged-in | 300 |
Example 1
In this example, eventstats adds the number of user sessions to each event. All 7 original events are preserved - unlike stats, the rows are not collapsed.
source auth_sessions
| eventstats count by user
| @timestamp | user | host | action | bytes | count |
|---|---|---|---|---|---|
| 2026-06-24T08:00:00Z | admin | dc-01 | logged-in | 1500 | 3 |
| 2026-06-24T08:15:00Z | admin | dc-01 | file-access | 3200 | 3 |
| 2026-06-24T08:30:00Z | admin | srv-01 | logged-in | 800 | 3 |
| 2026-06-24T09:00:00Z | john.doe | workstation-01 | logged-in | 1200 | 3 |
| 2026-06-24T09:10:00Z | john.doe | workstation-01 | file-access | 4500 | 3 |
| 2026-06-24T09:20:00Z | john.doe | workstation-02 | logged-in | 950 | 3 |
| 2026-06-24T10:00:00Z | guest | kiosk-01 | logged-in | 300 | 1 |
Example 2
In this example, the average traffic avg(bytes) is first calculated for each user, then where leaves only events where the traffic exceeds the group average. This allows identifying anomalously high sessions relative to a specific user's behavior.
source auth_sessions
| eventstats avg(bytes) by user
| where bytes > 'avg(bytes)'
Average for admin - 1833.33, for john.doe - 2216.67. The result retains only events where traffic exceeds this value:
| @timestamp | user | host | action | bytes | avg(bytes) |
|---|---|---|---|---|---|
| 2026-06-24T08:15:00Z | admin | dc-01 | file-access | 3200 | 1833.333333 |
| 2026-06-24T09:10:00Z | john.doe | workstation-01 | file-access | 4500 | 2216.666667 |
Example 3
In this example, eventstats collects all unique user hosts into a multivalue array values(host). The field is added to each row, allowing you to see the full list of hosts directly in the context of each event.
source auth_sessions
| eventstats values(host) by user
| @timestamp | user | host | action | bytes | values(host) |
|---|---|---|---|---|---|
| 2026-06-24T08:00:00Z | admin | dc-01 | logged-in | 1500 | ["dc-01", "srv-01"] |
| 2026-06-24T08:15:00Z | admin | dc-01 | file-access | 3200 | ["dc-01", "srv-01"] |
| 2026-06-24T08:30:00Z | admin | srv-01 | logged-in | 800 | ["dc-01", "srv-01"] |
| 2026-06-24T09:00:00Z | john.doe | workstation-01 | logged-in | 1200 | ["workstation-01", "workstation-02"] |
| 2026-06-24T09:10:00Z | john.doe | workstation-01 | file-access | 4500 | ["workstation-01", "workstation-02"] |
| 2026-06-24T09:20:00Z | john.doe | workstation-02 | logged-in | 950 | ["workstation-01", "workstation-02"] |
| 2026-06-24T10:00:00Z | guest | kiosk-01 | logged-in | 300 | ["kiosk-01"] |