Clarification on group_by setting in reduce transform

[jblang]

I wanted to ask about this line from the docs:

Each group is combined independently, allowing you to keep independent events separate.

This is a bit confusing--does "each group" consist of all the fields in a single group_by, or is each field listed in the group_by section an independent group? And if the latter interpretation is correct, how would I accomplish grouping by a combination of fields? Could I combine the desired fields into an array and group by that, or would I need to concatenate them into a string?

[jszwedko]

Hi @jblang !

The group_by forms a "composite key" by which incoming events are grouped before the reduce is applied. So if you have group_by = ["host", "region"], all incoming lines with host = X and region = Y will be grouped together.

[jblang]

OK, that's what I would have expected but then that line in the doc made me second guess.

[jszwedko]

I opened #13330 to update the docs. Does that read any clearer to you? I agree the original was a bit ambiguous.

[jblang]

Yes, that is clearer. I really appreciate how responsive you all are to feedback. Vector is a great project.