topic Re: Is it possible to multiply 2 arrays in DQL

Is it possible to multiply 2 arrays

AndersB — Mon, 17 Nov 2025 11:29:48 GMT

I‘m trying to build a timeseries which can be used to trigger an alert if too many emails are bouncing.

I’m able to create both a bounce rate timeseries, and also a timeseries with number of mails delivered – based on 15 minutes intervals.

But as I don’t want the alert to go off for a single bounced email – so I need a “weighted” value to alert on - eg

Interval a) 15% bounced mails – 100 mails send = weight = 15

Interval b) 100% bounced mails – 1 mail send = weight = 1

Interval 3) 2% bounced mails – 1000 mails send = weight = 20

So in principle “just” a way to multiple the two timeseries.

timeseries `Bounce Rate`= avg(log. EmailBounced),`Count`= count(log. EmailBounced), filter:Incoming == false, interval:15m

| fieldsAdd Weight=`Bounce Rate`*Count (is failing because it’s not allowed to multiple arrays)

Is this possible at all – or do I need to look in a different direction?

Re: Is it possible to multiply 2 arrays

tracegazer — Thu, 13 Nov 2025 12:22:22 GMT

Hi! By any chance, have you tried it this way?

| fieldsAdd Weight = `Bounce Rate`[] * rate[]

Re: Is it possible to multiply 2 arrays

t_pawlak — Thu, 13 Nov 2025 12:25:39 GMT

Hi,
In DQL, timeseries and makeTimeseries produce array-like series, so multiplying two series directly (BounceRate * Count) isn’t supported – that’s why you see the “not allowed to multiply arrays” error.

But for this use case IMO you don’t really need to multiply two series. If EmailBounced is 1 for a bounced email and 0 otherwise, then:

BounceRate = bounced / sent
Count = sent
Weight = BounceRate * Count = bounced.

You can compute everything with a simple summarize over 15-minute buckets, for example:

fetch logs | filter Incoming == false | summarize Sent = count(), Bounced = sum(log.EmailBounced), by: { interval_start = bin(timestamp, 15m) } | fieldsAdd BounceRate = Bounced * 1.0 / Sent, Weight = Bounced | sort interval_start asc

This gives you one row per 15-minute interval with Sent, Bounced, BounceRate, and your “weighted” value (Weight). You can then base your alert on Weight (for example, fire only if the number of bounced emails in a 15-minute interval exceeds a certain threshold

Re: Is it possible to multiply 2 arrays

AndersB — Thu, 13 Nov 2025 14:05:51 GMT

Thanks for the help on this - I was focused on using the metric for it - but it makes sense to use the log entries instead!

(and just for the record - the Weight variable should IMHO be calculated like this - but that's just a minor detail)
Weight = BounceRate * Sent /100

Re: Is it possible to multiply 2 arrays

AndersB — Thu, 13 Nov 2025 14:11:45 GMT

This actually also worked - so I think I will prefer this solution, as I then can keep working with my metric 🙂