LogQL Vector Aggregations: topk, bottomk, sort, sort_desc

[frisbeeman]

Overview

Implement the remaining LogQL vector aggregation functions: topk, bottomk, sort, and sort_desc.

Parent Issue

Part of #6 (Query Service Implementation), delegated from #8 (LogQL Query Compiler).

Context

Basic vector aggregations (sum, avg, min, max, count, stddev, stdvar) are implemented. The ranking and sorting functions are missing and return NotImplemented error.

Requirements

Functions to Implement

Function	Description
topk(k, vector)	Returns top k elements by value
bottomk(k, vector)	Returns bottom k elements by value
sort(vector)	Sorts elements ascending by value
sort_desc(vector)	Sorts elements descending by value

Example Queries

topk(10, sum by (service) (rate({job="app"}[5m])))
bottomk(5, avg by (pod) (count_over_time({job="app"}[1h])))
sort(sum by (level) (count_over_time({job="app"}[5m])))
sort_desc(rate({job="app"}[5m]))

Implementation Approach

1. topk/bottomk in planner.rs:

   • Add ORDER BY value DESC/ASC LIMIT k to the aggregation plan
   • Apply per time bucket for matrix results

2. sort/sort_desc in planner.rs:

   • Add ORDER BY value ASC/DESC to the aggregation plan
   • Preserve all results, just reorder

3. Translation to DataFusion:

// topk(10, expr)
LogicalPlanBuilder::from(expr_plan)
    .sort(vec![col("value").sort(false, false)])? // DESC
    .limit(0, Some(10))?
    .build()

// sort(expr)
LogicalPlanBuilder::from(expr_plan)
    .sort(vec![col("value").sort(true, false)])? // ASC
    .build()

Acceptance Criteria

• topk(k, vector) returns exactly k highest values
• bottomk(k, vector) returns exactly k lowest values
• sort(vector) returns all values in ascending order
• sort_desc(vector) returns all values in descending order
• Works correctly with by() and without() grouping
• Handles ties consistently
• Unit tests for each function
• Integration tests with grouped aggregations

Technical References

• LogQL Aggregation Operators
• Current implementation: src/query/logql/datafusion/planner.rs:plan_vector_aggregation()
• Technical spec: src/query/logql/TECHNICAL_SPEC.md Section 5.1