Retaining fields from current event or group during stream aggregation

A system comprising:

• a data processing system that includes one or more processors and non-transitory machine readable storage medium having instructions stored thereon that when executed by the one or more processors cause the one or more processors to perform a process comprising:
• receiving, at the data processing system, a stream of events having an input shape comprising a plurality of attributes;
• executing, by the data processing system, a query on the stream of events, and the executing comprises:
• summarizing data of a first attribute of the plurality of attributes based on an aggregate function to generate values of data for a result-set,
• collecting data of events with values that are identical for a second attribute of the plurality of attributes based on a group by function to group the result-set by the second attribute, and
• preserving data of a third attribute of the plurality of attributes based on a current function;
• outputting, by the data processing system, events having an output shape comprising the first attribute, the second attribute, and the third attribute, wherein the events include the values of the data for the result set, the values of the data for the second attribute, and values of the data for the third attribute.

A non-transitory machine readable storage medium having instructions stored thereon that when executed by one or more processors cause the one or more processors to perform a method comprising:

• receiving a stream of events having an input shape comprising a plurality of attributes;
• executing a query on the stream of events, the executing comprises:
• summarizing data of a first attribute of the plurality of attributes based on an aggregate function to generate values of data for a result-set,
• collecting data of events with values that are identical for a second attribute of the plurality of attributes based on a group by function to group the result-set by the second attribute, and
• preserving data of a third attribute of the plurality of attributes based on a current function;
• outputting events having an output shape comprising the first attribute, the second attribute, and the third attribute, wherein the events include the values of the data for the result set, the values of the data for the second attribute, and values of the data for the third attribute.