Skip to main content

SUPPRESS

Collapse rows that fall into the same aligned time bucket so the pipeline outputs at most one row per bucket (or per bucket and optional BY keys). The survivor is always a real input row: the default timestamp column and all other columns are passed through unchanged.

Syntax​

SUPPRESS interval [BY groupClause (, groupClause)* [,]?]

Parameters​

  • interval — Required. A positive interval literal only (for example 5m, 1h). It defines the width of each aligned bucket on the default timestamp field (same field as WITHIN). Millisecond buckets, ranges, and non-literal expressions are not allowed.
  • BY — Optional. One or more grouping expressions (same forms as AGG / DISTINCT). When present, deduplication is done separately for each combination of BY values within each time bucket. When omitted, the partition is bucket only: at most one survivor per bucket over the whole stream.

Behavior​

  • Bucket alignment — Buckets are aligned the same way as the @ time-truncation operator for that interval (see the time truncation docs). All timestamps in [bucket_start, bucket_start + interval) map to the same bucket.
  • Survivor — For each partition (BY keys, bucket) the command keeps the row that sorts first by default timestamp ascending. When the input schema includes event.id, ordering also uses event.id ascending so ties on timestamp pick a stable survivor (assuming unique event IDs). Without event.id, timestamp ties still collapse to one row per partition but which tied row wins is undefined (engine-dependent). A SORT earlier in the pipe does not define tie-breaking for this command.
  • No BY — Partition is aligned bucket only (at most one survivor per bucket over the whole stream), as if grouping by timestamp @ interval without aggregating.
  • Schema — Every top-level column from the stream before SUPPRESS stays, with the same types. BY controls how columns are ordered in the result: anything named in BY appears first, in the order those clauses are written; columns that are not the output name of a BY clause keep their relative order from the input and come after those partition keys. A clause like BY prefix = expr adds a prefix column with the partition expressions. This differs from DISTINCT, which keeps only the key expressions and drops the rest of the schema.
  • DISTINCT — Distinct combinations of expressions; output is key columns only.
  • WITHIN — Filter by time window on the same default timestamp field.