{
  "name": "aggregate_count_honours_key_fields",
  "description": "With key_fields, each key gets its own window and its own aggregate. Emission order at end of stream follows the order the windows were opened.",
  "rules": [
    {
      "match": [],
      "actions": [
        {
          "action": "aggregate_count",
          "window_ms": 5000,
          "key_fields": [
            "host",
            "message"
          ]
        }
      ]
    }
  ],
  "inputs": [
    {
      "timestamp_unix_nano": 0,
      "host": "h1",
      "service": "s1",
      "severity": "SEVERITY_INFO",
      "message": "z",
      "attributes": {}
    },
    {
      "timestamp_unix_nano": 100000000,
      "host": "h2",
      "service": "s1",
      "severity": "SEVERITY_INFO",
      "message": "z",
      "attributes": {}
    },
    {
      "timestamp_unix_nano": 200000000,
      "host": "h1",
      "service": "s1",
      "severity": "SEVERITY_INFO",
      "message": "z",
      "attributes": {}
    }
  ],
  "expect": [
    {
      "timestamp_unix_nano": 0,
      "host": "h1",
      "service": "s1",
      "severity": "SEVERITY_INFO",
      "message": "z",
      "attributes": {
        "cairnobs.aggregated": "true",
        "cairnobs.count": "2",
        "cairnobs.window_start_unix_nano": "0",
        "cairnobs.window_last_unix_nano": "200000000"
      }
    },
    {
      "timestamp_unix_nano": 100000000,
      "host": "h2",
      "service": "s1",
      "severity": "SEVERITY_INFO",
      "message": "z",
      "attributes": {
        "cairnobs.aggregated": "true",
        "cairnobs.count": "1",
        "cairnobs.window_start_unix_nano": "100000000",
        "cairnobs.window_last_unix_nano": "100000000"
      }
    }
  ]
}