base/bif/cardinality-counter.bif.bro

Functions to create and manipulate probabilistic cardinality counters.

Namespace:	GLOBAL
Source File:	`/scripts/base/bif/cardinality-counter.bif.bro`

Summary

`hll_cardinality_add`: `function`	Adds an element to a HyperLogLog cardinality counter.
`hll_cardinality_copy`: `function`	Copy a HLL cardinality counter.
`hll_cardinality_estimate`: `function`	Estimate the current cardinality of an HLL cardinality counter.
`hll_cardinality_init`: `function`	Initializes a probabilistic cardinality counter that uses the HyperLogLog algorithm.
`hll_cardinality_merge_into`: `function`	Merges a HLL cardinality counter into another.

hll_cardinality_add

Type:	`function` (handle: `opaque` of cardinality, elem: `any`) : `bool`

Adds an element to a HyperLogLog cardinality counter.

hll_cardinality_copy

Type:	`function` (handle: `opaque` of cardinality) : `opaque` of cardinality

Copy a HLL cardinality counter.

Handle:	cardinality counter to copy.
Returns:	copy of handle.

hll_cardinality_estimate

Type:	`function` (handle: `opaque` of cardinality) : `double`

Estimate the current cardinality of an HLL cardinality counter.

Handle:	the HLL handle.
Returns:	the cardinality estimate. Returns -1.0 if the counter is empty.

hll_cardinality_init

Type:	`function` (err: `double`, confidence: `double`) : `opaque` of cardinality

Initializes a probabilistic cardinality counter that uses the HyperLogLog algorithm.

Err:	the desired error rate (e.g. 0.01).
Confidence:	the desired confidence for the error rate (e.g., 0.95).
Returns:	a HLL cardinality handle.

hll_cardinality_merge_into

Type:	`function` (handle1: `opaque` of cardinality, handle2: `opaque` of cardinality) : `bool`

Merges a HLL cardinality counter into another.

Note

The same restrictions as for Bloom filter merging apply, see bloomfilter_merge.

Handle1:	the first HLL handle, which will contain the merged result.
Handle2:	the second HLL handle, which will be merged into the first.
Returns:	true on success.