Query Language Overview
WireLog queries use a pipe-composed DSL. A source selects the data; stages transform it.
source | stage | stage | ...Every query starts with a source (what data), then zero or more stages separated by | (how to filter, aggregate, sort).
Sources
| Source | Syntax | Description |
|---|---|---|
| Event | <event_name> | Filter by event_type |
| All events | * | All event types (leading | also works) |
| Funnel | funnel a -> b -> c | Multi-step conversion analysis |
| Retention | retention <event> | Cohort retention over time |
| Paths | paths from <event> | User flow analysis |
| Sessions | sessions | Session-level analytics |
| User timeline | user "<id>" | Single user’s events (quoted) |
| Users directory | users | Query user profiles table |
| Formula | formula count(a) / count(b) | Computed metrics across event types |
See Sources for full reference.
Stages
| Stage | Syntax | Description |
|---|---|---|
| Filter | | where field = "value" | Filter rows by condition |
| Time range | | last 7d, | from ... to ..., | today, | this month | Restrict time window |
| Count | | count, | count by day | Count events, optionally grouped |
| Unique | | unique distinct_id | Count unique values |
| Sum / Avg | | sum event_properties.amount | Numeric aggregations |
| Min / Max | | min field, | max field | Extremes |
| Median / Percentiles | | median field, | p90 field, | p95 field, | p99 field | Distribution |
| Group by | | count by day, field | Group aggregation by time or field |
| List | | list | Return raw event rows |
| Sort | | sort field desc | Order results |
| Limit / Top | | limit 100, | top 20 | Cap result count |
See Stages for full reference.
Request format
Send queries via POST /query with a secret key (sk_) or access token (aat_ with query scope):
{ "q": "signup | last 7d | count by day", "format": "llm", "limit": 100, "offset": 0}| Field | Required | Default | Description |
|---|---|---|---|
q | Yes | Query DSL string | |
format | No | llm | Output format: llm (Markdown), json, csv |
limit | No | 100 | Max rows returned (max 10,000) |
offset | No | 0 | Pagination offset |
Auth header: X-API-Key: sk_... or X-API-Key: aat_...
Quick examples
# Daily signups this weeksignup | last 7d | count by day
# Conversion funnelfunnel signup -> activate -> purchase | last 30d
# Weekly retention cohortsretention signup | last 90d
# All events from a specific company* | where user.email_domain = "acme.org" | last 30d | count by event_type
# Single user timelineuser "alice@acme.org" | last 90d | list
# Conversion rate as a ratioformula count(purchase) / count(signup) | last 30dOutput formats
llm (default) — Markdown table. Designed for LLM consumption. Includes column headers and aligned rows.
json — Array of objects. Each row is a JSON object with column names as keys.
csv — Comma-separated values with header row.