Query Language Overview

WireLog queries use a pipe-composed DSL. A source selects the data; stages transform it.

source | stage | stage | ...

Every query starts with a source (what data), then zero or more stages separated by | (how to filter, aggregate, sort).

Event names are project-specific. signup, page_view, purchase are examples only. Always run a discovery query before writing event-specific queries:

* | last 30d | count by event_type | top 20

Full inventory:

* | last 90d | count by event_type | sort event_type asc | limit 10000

Sources

Source	Syntax	Description
Event	`<event_name>` or `"<event_name>"`	Filter by `event_type`
All events	`*`	All event types (leading `\|` also works)
Funnel	`funnel a -> b -> c`	Multi-step conversion analysis
Retention	`retention <event>`	Cohort retention over time
Paths	`paths from <event>`	User flow analysis
Sessions	`sessions`	Session-level analytics
Lifecycle	`lifecycle <event>`	New/returning/resurrected/dormant status
Stickiness	`stickiness <event>`	Active-days distribution
User timeline	`user "<id>"`	Single user’s events (quoted)
Users directory	`users`	Query user profiles table
Formula	`formula count(a) / count(b)`	Computed metrics across event types
Fields	`fields`	Discover available fields (system + dynamic property keys)

See Sources for full reference.

Stages

Stage	Syntax	Description
Filter	`\| where field = "value"`	Filter rows by condition
Time range	`\| last 7d`, `\| from ... to ...`, `\| today`, `\| this month`	Restrict time window
Count	`\| count`, `\| count by day`	Count events, optionally grouped
Unique	`\| unique distinct_id`	Count unique values
Sum / Avg	`\| sum event_properties.amount`	Numeric aggregations
Min / Max	`\| min field`, `\| max field`	Extremes
Median / Percentiles	`\| median field`, `\| p90 field`, `\| p95 field`, `\| p99 field`	Distribution
Group by	`\| count by day, field`	Group aggregation by time or field
List	`\| list`	Return raw event rows
Window	`\| window 7d`	Funnel/path completion window
Depth	`\| depth 8`	Path depth limit
Sort	`\| sort field desc`	Order results
Limit / Top	`\| limit 100`, `\| top 20`	Cap result count

See Stages for full reference.

If you only installed the Script Tag, start with page_view queries and session attribution queries:

page_view | last 7d | count by day
page_view | last 30d | count by _path | top 20
page_view | where _path in ["/","/pricing","/docs"] | last 7d | count
sessions | last 30d | count by session.utm_source

Request format

Send queries via POST /query with a secret key (sk_) or access token (aat_ with query scope):

{
  "q": "signup | last 7d | count by day",
  "format": "llm",
  "limit": 100,
  "offset": 0
}

Field	Required	Default	Description
`q`	Yes		Query DSL string
`format`	No	`llm`	Output format: `llm` (Markdown), `json`, `csv`
`limit`	No	`100`	Max rows returned (max 10,000)
`offset`	No	`0`	Pagination offset

Auth header: X-API-Key: sk_... or X-API-Key: aat_...

Quick examples

# Daily signups this week
signup | last 7d | count by day

# Special-character event source
landing:cta_click | last 7d | count
"landing:cta_click" | last 7d | count

# Conversion funnel
funnel signup -> activate -> purchase exclude support_ticket | last 30d | window 7d

# Weekly retention cohorts
retention signup | last 90d

# Session attribution trend
sessions | last 30d | count by session.utm_source

# Path allowlist (JSON-style list literal)
page_view | where _path in ["/","/pricing","/docs"] | last 7d | count

# All events from a specific company
* | where user.email_domain = "acme.org" | last 30d | count by event_type

# Backend spend by latest browser-region context
ai_usage_charged | where user_last_session.region = "DE" | last 30d | sum event_properties.amount

# Single user timeline
user "alice@acme.org" | last 90d | list

# Conversion rate as a ratio
formula count(purchase) / count(signup) | last 30d

Output formats

llm (default) — Markdown table. Designed for LLM consumption. Includes column headers and aligned rows.

json — Array of objects. Each row is a JSON object with column names as keys.

For aggregate-style rows in JSON, use:

value as the canonical numeric metric output
metric as the metric identifier (count, unique, sum, avg, etc.)

Legacy metric keys (count, unique_count, total, …) are retained for compatibility.

csv — Comma-separated values with header row.

Sources — event, funnel, retention, paths, sessions, lifecycle, stickiness, user, users, formula, fields
Stages — where, time ranges, aggregations, sort, limit
Fields — core, system, properties, profile fields, identity
Examples — 15+ annotated real-world queries