The Search/Analytics feature of Log Service supports the HAVING syntax of standard SQL statements. The HAVING syntax is used together with the GROUP BY syntax to filter GROUP BY results.

method :PostLogstoreLogs |select avg(latency),projectName group by projectName  HAVING avg(latency) > 100

Differences between HAVING and WHERE

HAVING filters the aggregated results after they have been grouped using GROUP BY. WHERE filters raw data during data aggregation.


Calculate the average rainfall of each province where temperature is higher than 10°C, and only display the provinces with average rainfall greater than 100 mL in the final results:

* | select avg(rain) ,province where temperature > 10 group by province having avg(rain) > 100