—top

Returns the top N most frequent values for any log field. Works on level, message, and any context.* key.

Syntax

--top:<field>

Examples

--top:level
--top:context.status
--top:context.gateway
--top:context.userId
--top:context.region

Combine with filters to narrow the scope:

level:error --top:context.errorCode
context.gateway:stripe @last-7d --top:context.status

Notes

• Field must exist in at least some logs — unknown fields return empty results
• Use dot notation for nested context keys: context.nested.key
• For context keys that contain dots, use bracket notation: context.svc["k.with.dot"]