Malloy Documentation
search

Malloy Quickstart

VSCode document

This guide introduces the basics of querying data and building a semantic model with the Malloy language. By the end of this tutorial, you will understand how to use Malloy to run queries, build re-usable data models, and do analysis on your data that is nearly impossible in SQL.

The easiest way to follow along is by going to the interactive notebook version of this tutorial. The link will launch a browser-based VSCode environment and ask you to install the Malloy extension. Once installed, navigate back to the quickstart notebook file, and dive in.

If you'd like to run Malloy locally on your laptop instead, follow the setup instructions to install the VSCode extension and connect to a database.

A Simple Select Statement

The following query is equivalent to SELECT id, code, city FROM airports LIMIT 10 in SQL:

document
run: duckdb.table('../data/airports.parquet') -> {
  select:
    id
    code
    city
  limit: 10
}
QUERY RESULTS 
[
  {
    "id": 19783,
    "code": "1Q9",
    "city": "MILI ISLAND"
  },
  {
    "id": 19777,
    "code": "Q51",
    "city": "KILI ISLAND"
  },
  {
    "id": 19787,
    "code": "3N1",
    "city": "TAORA IS  MALOELAP ATOLL"
  },
  {
    "id": 19789,
    "code": "03N",
    "city": "UTIRIK ISLAND"
  },
  {
    "id": 19774,
    "code": "ANG",
    "city": "ANGAUR ISLAND"
  }
]
SELECT 
   base."id" as "id",
   base."code" as "code",
   base."city" as "city"
FROM '../data/airports.parquet' as base
LIMIT 10

Let's break down each part of this query.

  • run: is the opening statement that indicates we're starting to write a query

  • duckdb.table('../data/airports.parquet') defines the source for the query. The table() method creates a source from a table or view in the database.

    • A source is similar to a table or view in SQL, but Malloy sources can include additional information like joins and measures. We'll cover this in depth later on.

  • The -> operator begins the query. Queries take the form source -> { ... }, with the query logic specified inside of the curly braces.

  • select: is equivalent to SELECT in SQL. In this clause, we select the id, code, and city columns from the table.

  • limit: 10 limits the result set of the query to the first 10 items.

Query Operators

In SQL, the SELECT command does two very different things. A SELECT with a GROUP BY aggregates data according to the GROUP BY clause and produces aggregate calculation against every calculation not in the GROUP BY. In Malloy, the query operator for this is group_by:. Calculations involving data in the group are made using aggregate:.

The second type of SELECT in SQL does not perform any aggregation; All rows in the input table, unless filtered in some way, show up in the output table. In Malloy, this command is select:.

Aggregate

In the query below, the data will be grouped by state and county, and will produce an aggregate calculation for airport_count and average_elevation.

document
run: duckdb.table('../data/airports.parquet') -> {
  group_by:
    state
    county
  aggregate:
    airport_count is count()
    average_elevation is avg(elevation)
}
QUERY RESULTS 
[
  {
    "state": "CA",
    "county": "LOS ANGELES",
    "airport_count": 176,
    "average_elevation": 689.1647727272727
  },
  {
    "state": "TX",
    "county": "HARRIS",
    "airport_count": 135,
    "average_elevation": 106.46666666666667
  },
  {
    "state": "AZ",
    "county": "MARICOPA",
    "airport_count": 117,
    "average_elevation": 1395.6666666666667
  },
  {
    "state": "CA",
    "county": "SAN BERNARDINO",
    "airport_count": 71,
    "average_elevation": 2376.056338028169
  },
  {
    "state": "TX",
    "county": "TARRANT",
    "airport_count": 63,
    "average_elevation": 646.7936507936508
  }
]
SELECT 
   base."state" as "state",
   base."county" as "county",
   COUNT(1) as "airport_count",
   AVG(base."elevation") as "average_elevation"
FROM '../data/airports.parquet' as base
GROUP BY 1,2
ORDER BY 3 desc NULLS LAST

Select

A select: statement produces a list of fields. For every row in the input table, there is a row in the output table. This is similar to a simple SELECT statement in SQL with no aggregations.

document
run: duckdb.table('../data/airports.parquet') -> {
  select: code, full_name, city, county
  where: county = 'SANTA CRUZ'
  limit: 10
}
QUERY RESULTS 
[
  {
    "code": "2AZ8",
    "full_name": "TUBAC ULTRALIGHT FLIGHTPARK",
    "city": "TUBAC",
    "county": "SANTA CRUZ"
  },
  {
    "code": "OLS",
    "full_name": "NOGALES INTL",
    "city": "NOGALES",
    "county": "SANTA CRUZ"
  },
  {
    "code": "NSI",
    "full_name": "SAN NICOLAS ISLAND NOLF",
    "city": "SAN NICOLAS ISLAND",
    "county": "SANTA CRUZ"
  },
  {
    "code": "CL77",
    "full_name": "BONNY DOON VILLAGE",
    "city": "SANTA CRUZ",
    "county": "SANTA CRUZ"
  },
  {
    "code": "CA37",
    "full_name": "DOMINICAN SANTA CRUZ HOSPITAL",
    "city": "SANTA CRUZ",
    "county": "SANTA CRUZ"
  }
]
SELECT 
   base."code" as "code",
   base."full_name" as "full_name",
   base."city" as "city",
   base."county" as "county"
FROM '../data/airports.parquet' as base
WHERE base."county"='SANTA CRUZ'
LIMIT 10

For the most part, operations can be placed in any order within a query. A where can come before or after a project, and limit can be placed anywhere as well. The above query could also be written:

document
run: duckdb.table('../data/airports.parquet') -> {
  limit: 10
  where: county = 'SANTA CRUZ'
  select: code, full_name, city, county
}
QUERY RESULTS 
[
  {
    "code": "2AZ8",
    "full_name": "TUBAC ULTRALIGHT FLIGHTPARK",
    "city": "TUBAC",
    "county": "SANTA CRUZ"
  },
  {
    "code": "OLS",
    "full_name": "NOGALES INTL",
    "city": "NOGALES",
    "county": "SANTA CRUZ"
  },
  {
    "code": "NSI",
    "full_name": "SAN NICOLAS ISLAND NOLF",
    "city": "SAN NICOLAS ISLAND",
    "county": "SANTA CRUZ"
  },
  {
    "code": "CL77",
    "full_name": "BONNY DOON VILLAGE",
    "city": "SANTA CRUZ",
    "county": "SANTA CRUZ"
  },
  {
    "code": "CA37",
    "full_name": "DOMINICAN SANTA CRUZ HOSPITAL",
    "city": "SANTA CRUZ",
    "county": "SANTA CRUZ"
  }
]
SELECT 
   base."code" as "code",
   base."full_name" as "full_name",
   base."city" as "city",
   base."county" as "county"
FROM '../data/airports.parquet' as base
WHERE base."county"='SANTA CRUZ'
LIMIT 10

Everything has a Name

In Malloy, all output fields have names. This means that any time a query includes a field with a calculated value, like a scalar or aggregate function, it must be named (unlike SQL, which allows un-named expressions).

document
run: duckdb.table('../data/airports.parquet') -> {
  aggregate: max_elevation is max(elevation)
}
QUERY RESULTS 
[
  {
    "max_elevation": 12442
  }
]
SELECT 
   max(base."elevation") as "max_elevation"
FROM '../data/airports.parquet' as base

Notice that Malloy uses the form name is value instead of SQL's value AS name. Having the output column name written first makes it easier for someone reading the code to visualize the resulting query structure.

Named objects, like columns from a table or fields defined in a source, can be included in field lists without an is:

document
run: duckdb.table('../data/airports.parquet') -> {
  select:
    full_name
    elevation
}
QUERY RESULTS 
[
  {
    "full_name": "MILI",
    "elevation": 4
  },
  {
    "full_name": "KILI",
    "elevation": 5
  },
  {
    "full_name": "MALOELAP",
    "elevation": 4
  },
  {
    "full_name": "UTIRIK",
    "elevation": 4
  },
  {
    "full_name": "ANGAUR AIRSTRIP",
    "elevation": 20
  }
]
SELECT 
   base."full_name" as "full_name",
   base."elevation" as "elevation"
FROM '../data/airports.parquet' as base

Expressions

Many SQL expressions will work unchanged in Malloy, and many functions available in Standard SQL are usable in Malloy as well. This makes expressions fairly straightforward to understand, given a knowledge of SQL.

document
run: duckdb.table('../data/airports.parquet') -> {
  group_by: county_and_state is concat(county, ', ', state)
  aggregate:
    airport_count is count()
    max_elevation is max(elevation)
    min_elevation is min(elevation)
    avg_elevation is avg(elevation)
}
QUERY RESULTS 
[
  {
    "county_and_state": "LOS ANGELES, CA",
    "airport_count": 176,
    "max_elevation": 3420,
    "min_elevation": 0,
    "avg_elevation": 689.1647727272727
  },
  {
    "county_and_state": "HARRIS, TX",
    "airport_count": 135,
    "max_elevation": 774,
    "min_elevation": 9,
    "avg_elevation": 106.46666666666667
  },
  {
    "county_and_state": "MARICOPA, AZ",
    "airport_count": 117,
    "max_elevation": 3995,
    "min_elevation": 737,
    "avg_elevation": 1395.6666666666667
  },
  {
    "county_and_state": "SAN BERNARDINO, CA",
    "airport_count": 71,
    "max_elevation": 6748,
    "min_elevation": 631,
    "avg_elevation": 2376.056338028169
  },
  {
    "county_and_state": "TARRANT, TX",
    "airport_count": 63,
    "max_elevation": 895,
    "min_elevation": 472,
    "avg_elevation": 646.7936507936508
  }
]
SELECT 
   CONCAT(base."county",', ',base."state") as "county_and_state",
   COUNT(1) as "airport_count",
   max(base."elevation") as "max_elevation",
   min(base."elevation") as "min_elevation",
   AVG(base."elevation") as "avg_elevation"
FROM '../data/airports.parquet' as base
GROUP BY 1
ORDER BY 2 desc NULLS LAST

The basic types of Malloy expressions are string, number, boolean, date, and timestamp.

Sources: the Basic Structure for Modeling and Reuse

One of the main benefits of Malloy is the ability to save common calculations into a data model. The data model is made of sources, which can be thought of as tables or views, but with additional information, such as joins, dimensions and measures.

In the example below, we create a source object named airports and add a dimension calculation for county_and_state and measure calculation for airport_count. Dimensions can be used in group_by, project and where. Measures can be used in aggregate and having.

document
source: airports is duckdb.table('../data/airports.parquet') extend {
  dimension: county_and_state is concat(county, ', ', state)
  measure: airport_count is count()
  measure: average_elevation is avg(elevation)
}

malloy run: airports -> { group_by: county_and_state aggregate: airport_count }

Sources that are defined in one file can be imported into another using import "path/to/some/file.malloy". For example, if the airports source above were defined in a file called flights.malloy, you could create a new file that imports it and immediately start using the airports source:

import "airports.malloy" 

run: airports -> {
  group_by: county_and_state
  aggregate: average_elevation
}

Sources can also contain named views. These views are useful for building nested queries (covered later) or for saving a query operation so it can re-used again and again without having to rewrite it.

document
source: airports_with_named_query is duckdb.table('../data/airports.parquet') extend {
  dimension: county_and_state is concat(county, ', ', state)
  measure: airport_count is count()
  measure: average_elevation is avg(elevation)

  view: top_county_and_state is {
    group_by: county_and_state
    aggregate: airport_count
    limit:10
  }
}

// The view can now be referenced by name 
// and run without having to rewrite the logic:
run: airports_with_named_query -> top_county_and_state
QUERY RESULTS 
[
  {
    "county_and_state": "LOS ANGELES, CA",
    "airport_count": 176
  },
  {
    "county_and_state": "HARRIS, TX",
    "airport_count": 135
  },
  {
    "county_and_state": "MARICOPA, AZ",
    "airport_count": 117
  },
  {
    "county_and_state": "SAN BERNARDINO, CA",
    "airport_count": 71
  },
  {
    "county_and_state": "TARRANT, TX",
    "airport_count": 63
  }
]
SELECT 
   CONCAT(base."county",', ',base."state") as "county_and_state",
   COUNT(1) as "airport_count"
FROM '../data/airports.parquet' as base
GROUP BY 1
ORDER BY 2 desc NULLS LAST
LIMIT 10

Joins

Joins are declared as part of a source. When joining a source to another, it brings with it all child joins.

document
source: aircraft_models is duckdb.table('../data/aircraft_models.parquet') extend {
  primary_key: aircraft_model_code
}

source: aircraft is duckdb.table('../data/aircraft.parquet') extend {
  primary_key: tail_num
  join_one: aircraft_models 
    on aircraft_model_code = aircraft_models.aircraft_model_code
}

source: flights is duckdb.table('../data/flights.parquet') extend {
  join_one: aircraft on tail_num = aircraft.tail_num
}

run: flights -> {
  where: dep_time ? @2003-01
  group_by: aircraft.aircraft_models.manufacturer
  aggregate:
    flight_count is count()
    aircraft_count is aircraft.count()
    average_seats_per_model is aircraft.aircraft_models.seats.avg()
}
QUERY RESULTS 
[
  {
    "manufacturer": "BOEING",
    "flight_count": 2432,
    "aircraft_count": 20,
    "average_seats_per_model": 193.25
  },
  {
    "manufacturer": "AIRBUS INDUSTRIE",
    "flight_count": 877,
    "aircraft_count": 8,
    "average_seats_per_model": 177
  },
  {
    "manufacturer": "MCDONNELL DOUGLAS",
    "flight_count": 486,
    "aircraft_count": 5,
    "average_seats_per_model": 172
  },
  {
    "manufacturer": "EMBRAER",
    "flight_count": 388,
    "aircraft_count": 4,
    "average_seats_per_model": 41.333333333333336
  },
  {
    "manufacturer": "AEROSPATIALE/ALENIA",
    "flight_count": 225,
    "aircraft_count": 1,
    "average_seats_per_model": 76
  }
]
SELECT 
   aircraft_models_0."manufacturer" as "manufacturer",
   COUNT(1) as "flight_count",
   COUNT(DISTINCT aircraft_0."tail_num") as "aircraft_count",
   (
        SELECT AVG(a.val) as value
        FROM (
          SELECT UNNEST(list(distinct {key:aircraft_models_0."aircraft_model_code", val: aircraft_models_0."seats"})) a
        )
      ) as "average_seats_per_model"
FROM '../data/flights.parquet' as base
 LEFT JOIN '../data/aircraft.parquet' AS aircraft_0
  ON base."tail_num"=aircraft_0."tail_num"
 LEFT JOIN '../data/aircraft_models.parquet' AS aircraft_models_0
  ON aircraft_0."aircraft_model_code"=aircraft_models_0."aircraft_model_code"
WHERE (base."dep_time">=TIMESTAMP '2003-01-01 00:00:00') and (base."dep_time"<TIMESTAMP '2003-02-01 00:00:00')
GROUP BY 1
ORDER BY 2 desc NULLS LAST

In this example, the aircraft source is joined to flights, and aircraft_models is joined via aircraft. These examples explicitly name both keys—this same syntax can be used to write more complex joins.

Now, any query that uses the flights source has access to fields in both aircraft and aircraft_models without having to explicitly specify the join condition. The joins are specified once in the source, and usable by any query on flights.

An ad hoc join can also be specified in a query block. In the query below, we join in the airports table using the destination column as a join key, then compute the top 5 destination airports by flight count.

document
source: airports2 is duckdb.table('../data/airports.parquet')

source: flights2 is duckdb.table('../data/flights.parquet') extend {
  join_one: airports2 on destination = airports2.code
}

run: flights2 -> {
  group_by: airports2.full_name
  aggregate: flight_count is count()
  limit: 5
}
QUERY RESULTS 
[
  {
    "full_name": "THE WILLIAM B HARTSFIELD ATLANTA INTL",
    "flight_count": 17832
  },
  {
    "full_name": "DALLAS/FORT WORTH INTERNATIONAL",
    "flight_count": 17776
  },
  {
    "full_name": "CHICAGO O'HARE INTL",
    "flight_count": 14213
  },
  {
    "full_name": "PHOENIX SKY HARBOR INTL",
    "flight_count": 12477
  },
  {
    "full_name": "MC CARRAN INTL",
    "flight_count": 11092
  }
]
SELECT 
   airports2_0."full_name" as "full_name",
   COUNT(1) as "flight_count"
FROM '../data/flights.parquet' as base
 LEFT JOIN '../data/airports.parquet' AS airports2_0
  ON base."destination"=airports2_0."code"
GROUP BY 1
ORDER BY 2 desc NULLS LAST
LIMIT 5

Filtering

When working with data, filtering is something you do in almost every query. Malloy provides consistent syntax for filtering everywhere within a query. The most basic type of filter is applied using a where: clause, very similar to a WHERE clause in SQL.

The following query grabs the top 5 counties in California with the highest airport count:

document
run: duckdb.table('../data/airports.parquet') -> {
  where: state = 'CA'
  limit: 5
  group_by: county
  aggregate: airport_count is count()
}
QUERY RESULTS 
[
  {
    "county": "LOS ANGELES",
    "airport_count": 176
  },
  {
    "county": "SAN BERNARDINO",
    "airport_count": 71
  },
  {
    "county": "ORANGE",
    "airport_count": 53
  },
  {
    "county": "KERN",
    "airport_count": 49
  },
  {
    "county": "SAN DIEGO",
    "airport_count": 49
  }
]
SELECT 
   base."county" as "county",
   COUNT(1) as "airport_count"
FROM '../data/airports.parquet' as base
WHERE base."state"='CA'
GROUP BY 1
ORDER BY 2 desc NULLS LAST
LIMIT 5

Filters can also be applied to sources:

document
source: airports_in_california is duckdb.table('../data/airports.parquet') extend {
  where: state = 'CA'
}

run: airports_in_california -> {
  limit: 5
  group_by: county
  aggregate: airport_count is count()
}
QUERY RESULTS 
[
  {
    "county": "LOS ANGELES",
    "airport_count": 176
  },
  {
    "county": "SAN BERNARDINO",
    "airport_count": 71
  },
  {
    "county": "ORANGE",
    "airport_count": 53
  },
  {
    "county": "SAN DIEGO",
    "airport_count": 49
  },
  {
    "county": "KERN",
    "airport_count": 49
  }
]
SELECT 
   base."county" as "county",
   COUNT(1) as "airport_count"
FROM '../data/airports.parquet' as base
WHERE base."state"='CA'
GROUP BY 1
ORDER BY 2 desc NULLS LAST
LIMIT 5

Any query run on the airports_in_california source will run against the airports table, and always include the filter in state = 'CA'.

Filtering Measures

A filter on an aggregate calculation (a measure) narrows down the data used in that specific calculation. In the example below, the calculations for airports and heliports are filtered separately.

document
run: duckdb.table('../data/airports.parquet') -> {
  group_by: state
  aggregate:
    airports is count() { where: fac_type = 'AIRPORT' }
    heliports is count() { where: fac_type = 'HELIPORT' }
    total is count()
}
QUERY RESULTS 
[
  {
    "state": "TX",
    "airports": 1389,
    "heliports": 435,
    "total": 1845
  },
  {
    "state": "IL",
    "airports": 625,
    "heliports": 245,
    "total": 890
  },
  {
    "state": "CA",
    "airports": 569,
    "heliports": 396,
    "total": 984
  },
  {
    "state": "OH",
    "airports": 537,
    "heliports": 201,
    "total": 749
  },
  {
    "state": "FL",
    "airports": 511,
    "heliports": 280,
    "total": 856
  }
]
SELECT 
   base."state" as "state",
   COUNT(CASE WHEN base."fac_type"='AIRPORT' THEN 1 END) as "airports",
   COUNT(CASE WHEN base."fac_type"='HELIPORT' THEN 1 END) as "heliports",
   COUNT(1) as "total"
FROM '../data/airports.parquet' as base
GROUP BY 1
ORDER BY 2 desc NULLS LAST

In SQL, this same calculation is often done using CASE statements inside of the aggregates, which is verbose and difficult to read. A query like the above would look like:

SELECT
   state
   , SUM(CASE WHEN fac_type = 'AIRPORT' THEN 1 ELSE 0 END) AS airports
   , SUM(CASE WHEN fac_type = 'HELIPORT' THEN 1 ELSE 0 END) AS heliports
   , COUNT(*) AS total
FROM `malloy-data.faa.airports`
GROUP BY state

Nested Queries

The next several examples will use this simple source definition:

source: airports is duckdb.table('../data/airports.parquet') extend {
  measure: airport_count is count()
};

Nested Views

In Malloy, views can be nested to produce a nested query with subtables on each output row.

document
run: airports -> {
  group_by: state
  aggregate: airport_count
  nest: by_facility is  {
    group_by: fac_type
    aggregate: airport_count
    limit: 3
  }
}
QUERY RESULTS 
[
  {
    "state": "TX",
    "airport_count": 1845,
    "by_facility": [
      {
        "fac_type": "AIRPORT",
        "airport_count": 1389
      },
      {
        "fac_type": "HELIPORT",
        "airport_count": 435
      },
      {
        "fac_type": "ULTRALIGHT",
        "airport_count": 8
      }
    ]
  },
  {
    "state": "CA",
    "airport_count": 984,
    "by_facility": [
      {
        "fac_type": "AIRPORT",
        "airport_count": 569
      },
      {
        "fac_type": "HELIPORT",
        "airport_count": 396
      },
      {
        "fac_type": "SEAPLANE BASE",
        "airport_count": 12
      }
    ]
  },
  {
    "state": "IL",
    "airport_count": 890,
    "by_facility": [
      {
        "fac_type": "AIRPORT",
        "airport_count": 625
      },
      {
        "fac_type": "HELIPORT",
        "airport_count": 245
      },
      {
        "fac_type": "SEAPLANE BASE",
        "airport_count": 8
      }
    ]
  },
  {
    "state": "FL",
    "airport_count": 856,
    "by_facility": [
      {
        "fac_type": "AIRPORT",
        "airport_count": 511
      },
      {
        "fac_type": "HELIPORT",
        "airport_count": 280
      },
      {
        "fac_type": "SEAPLANE BASE",
        "airport_count": 43
      }
    ]
  },
  {
    "state": "PA",
    "airport_count": 804,
    "by_facility": [
      {
        "fac_type": "AIRPORT",
        "airport_count": 468
      },
      {
        "fac_type": "HELIPORT",
        "airport_count": 307
      },
      {
        "fac_type": "ULTRALIGHT",
        "airport_count": 13
      }
    ]
  }
]
WITH __stage0 AS (
  SELECT
    group_set,
    base."state" as "state__0",
    CASE WHEN group_set=0 THEN
      COUNT(1)
      END as "airport_count__0",
    CASE WHEN group_set=1 THEN
      base."fac_type"
      END as "fac_type__1",
    CASE WHEN group_set=1 THEN
      COUNT(1)
      END as "airport_count__1"
  FROM '../data/airports.parquet' as base
  CROSS JOIN (SELECT UNNEST(GENERATE_SERIES(0,1,1)) as group_set  ) as group_set
  GROUP BY 1,2,4
)
SELECT
  "state__0" as "state",
  MAX(CASE WHEN group_set=0 THEN "airport_count__0" END) as "airport_count",
  COALESCE(LIST({
    "fac_type": "fac_type__1", 
    "airport_count": "airport_count__1"}  ORDER BY  "airport_count__1" desc NULLS LAST) FILTER (WHERE group_set=1)[1:3],[]) as "by_facility"
FROM __stage0
GROUP BY 1
ORDER BY 2 desc NULLS LAST

Here we can see that the by_facility column of the output table contains a nested subtable on each row. by_facility contains the counts for the top 3 facility types for each state, i.e., the number of airports, heliports, and stolports in Texas, the number of airports, heliports, and seaplane bases in California, etc.

When a view is nested inside another view, each output row of the outer view will have a nested table for the inner view which only includes data limited to that row.

Views can be nested infinitely, allowing for rich, complex output structures. A view may always include another nested view, regardless of depth.

document
run: airports -> {
  group_by: state
  aggregate: airport_count
  nest: top_5_counties is  {
    limit: 5
    group_by: county
    aggregate: airport_count
    nest: by_facility is  {
      group_by: fac_type
      aggregate: airport_count
    }
  }
}
QUERY RESULTS 
[
  {
    "state": "TX",
    "airport_count": 1845,
    "top_5_counties": [
      {
        "county": "HARRIS",
        "airport_count": 135,
        "by_facility": [
          {
            "fac_type": "HELIPORT",
            "airport_count": 110
          },
          {
            "fac_type": "AIRPORT",
            "airport_count": 25
          }
        ]
      },
      {
        "county": "TARRANT",
        "airport_count": 63,
        "by_facility": [
          {
            "fac_type": "HELIPORT",
            "airport_count": 35
          },
          {
            "fac_type": "AIRPORT",
            "airport_count": 26
          },
          {
            "fac_type": "ULTRALIGHT",
            "airport_count": 1
          },
          {
            "fac_type": "STOLPORT",
            "airport_count": 1
          }
        ]
      },
      {
        "county": "DENTON",
        "airport_count": 53,
        "by_facility": [
          {
            "fac_type": "AIRPORT",
            "airport_count": 47
          },
          {
            "fac_type": "HELIPORT",
            "airport_count": 6
          }
        ]
      },
      {
        "county": "DALLAS",
        "airport_count": 42,
        "by_facility": [
          {
            "fac_type": "HELIPORT",
            "airport_count": 32
          },
          {
            "fac_type": "AIRPORT",
            "airport_count": 9
          },
          {
            "fac_type": "STOLPORT",
            "airport_count": 1
          }
        ]
      },
      {
        "county": "BEXAR",
        "airport_count": 40,
        "by_facility": [
          {
            "fac_type": "AIRPORT",
            "airport_count": 24
          },
          {
            "fac_type": "HELIPORT",
            "airport_count": 16
          }
        ]
      }
    ]
  },
  {
    "state": "CA",
    "airport_count": 984,
    "top_5_counties": [
      {
        "county": "LOS ANGELES",
        "airport_count": 176,
        "by_facility": [
          {
            "fac_type": "HELIPORT",
            "airport_count": 151
          },
          {
            "fac_type": "AIRPORT",
            "airport_count": 23
          },
          {
            "fac_type": "SEAPLANE BASE",
            "airport_count": 2
          }
        ]
      },
      {
        "county": "SAN BERNARDINO",
        "airport_count": 71,
        "by_facility": [
          {
            "fac_type": "AIRPORT",
            "airport_count": 47
          },
          {
            "fac_type": "HELIPORT",
            "airport_count": 24
          }
        ]
      },
      {
        "county": "ORANGE",
        "airport_count": 53,
        "by_facility": [
          {
            "fac_type": "HELIPORT",
            "airport_count": 47
          },
          {
            "fac_type": "AIRPORT",
            "airport_count": 6
          }
        ]
      },
      {
        "county": "SAN DIEGO",
        "airport_count": 49,
        "by_facility": [
          {
            "fac_type": "AIRPORT",
            "airport_count": 30
          },
          {
            "fac_type": "HELIPORT",
            "airport_count": 17
          },
          {
            "fac_type": "GLIDERPORT",
            "airport_count": 2
          }
        ]
      },
      {
        "county": "KERN",
        "airport_count": 49,
        "by_facility": [
          {
            "fac_type": "AIRPORT",
            "airport_count": 41
          },
          {
            "fac_type": "HELIPORT",
            "airport_count": 7
          },
          {
            "fac_type": "ULTRALIGHT",
            "airport_count": 1
          }
        ]
      }
    ]
  },
  {
    "state": "IL",
    "airport_count": 890,
    "top_5_counties": [
      {
        "county": "COOK",
        "airport_count": 51,
        "by_facility": [
          {
            "fac_type": "HELIPORT",
            "airport_count": 44
          },
          {
            "fac_type": "AIRPORT",
            "airport_count": 7
          }
        ]
      },
      {
        "county": "LA SALLE",
        "airport_count": 39,
        "by_facility": [
          {
            "fac_type": "AIRPORT",
            "airport_count": 35
          },
          {
            "fac_type": "HELIPORT",
            "airport_count": 4
          }
        ]
      },
      {
        "county": "MC HENRY",
        "airport_count": 29,
        "by_facility": [
          {
            "fac_type": "AIRPORT",
            "airport_count": 20
          },
          {
            "fac_type": "HELIPORT",
            "airport_count": 7
          },
          {
            "fac_type": "SEAPLANE BASE",
            "airport_count": 2
          }
        ]
      },
      {
        "county": "DE KALB",
        "airport_count": 27,
        "by_facility": [
          {
            "fac_type": "AIRPORT",
            "airport_count": 24
          },
          {
            "fac_type": "HELIPORT",
            "airport_count": 3
          }
        ]
      },
      {
        "county": "LEE",
        "airport_count": 24,
        "by_facility": [
          {
            "fac_type": "AIRPORT",
            "airport_count": 18
          },
          {
            "fac_type": "HELIPORT",
            "airport_count": 5
          },
          {
            "fac_type": "ULTRALIGHT",
            "airport_count": 1
          }
        ]
      }
    ]
  },
  {
    "state": "FL",
    "airport_count": 856,
    "top_5_counties": [
      {
        "county": "PALM BEACH",
        "airport_count": 45,
        "by_facility": [
          {
            "fac_type": "HELIPORT",
            "airport_count": 30
          },
          {
            "fac_type": "AIRPORT",
            "airport_count": 14
          },
          {
            "fac_type": "GLIDERPORT",
            "airport_count": 1
          }
        ]
      },
      {
        "county": "DADE",
        "airport_count": 44,
        "by_facility": [
          {
            "fac_type": "HELIPORT",
            "airport_count": 27
          },
          {
            "fac_type": "AIRPORT",
            "airport_count": 12
          },
          {
            "fac_type": "SEAPLANE BASE",
            "airport_count": 2
          },
          {
            "fac_type": "GLIDERPORT",
            "airport_count": 2
          },
          {
            "fac_type": "STOLPORT",
            "airport_count": 1
          }
        ]
      },
      {
        "county": "POLK",
        "airport_count": 43,
        "by_facility": [
          {
            "fac_type": "AIRPORT",
            "airport_count": 18
          },
          {
            "fac_type": "HELIPORT",
            "airport_count": 16
          },
          {
            "fac_type": "SEAPLANE BASE",
            "airport_count": 9
          }
        ]
      },
      {
        "county": "MARION",
        "airport_count": 37,
        "by_facility": [
          {
            "fac_type": "AIRPORT",
            "airport_count": 27
          },
          {
            "fac_type": "HELIPORT",
            "airport_count": 7
          },
          {
            "fac_type": "SEAPLANE BASE",
            "airport_count": 2
          },
          {
            "fac_type": "STOLPORT",
            "airport_count": 1
          }
        ]
      },
      {
        "county": "ORANGE",
        "airport_count": 36,
        "by_facility": [
          {
            "fac_type": "HELIPORT",
            "airport_count": 24
          },
          {
            "fac_type": "AIRPORT",
            "airport_count": 8
          },
          {
            "fac_type": "SEAPLANE BASE",
            "airport_count": 4
          }
        ]
      }
    ]
  },
  {
    "state": "PA",
    "airport_count": 804,
    "top_5_counties": [
      {
        "county": "BUCKS",
        "airport_count": 55,
        "by_facility": [
          {
            "fac_type": "AIRPORT",
            "airport_count": 32
          },
          {
            "fac_type": "HELIPORT",
            "airport_count": 19
          },
          {
            "fac_type": "ULTRALIGHT",
            "airport_count": 2
          },
          {
            "fac_type": "STOLPORT",
            "airport_count": 1
          },
          {
            "fac_type": "GLIDERPORT",
            "airport_count": 1
          }
        ]
      },
      {
        "county": "MONTGOMERY",
        "airport_count": 44,
        "by_facility": [
          {
            "fac_type": "HELIPORT",
            "airport_count": 29
          },
          {
            "fac_type": "AIRPORT",
            "airport_count": 14
          },
          {
            "fac_type": "SEAPLANE BASE",
            "airport_count": 1
          }
        ]
      },
      {
        "county": "ALLEGHENY",
        "airport_count": 31,
        "by_facility": [
          {
            "fac_type": "HELIPORT",
            "airport_count": 22
          },
          {
            "fac_type": "AIRPORT",
            "airport_count": 8
          },
          {
            "fac_type": "SEAPLANE BASE",
            "airport_count": 1
          }
        ]
      },
      {
        "county": "CHESTER",
        "airport_count": 27,
        "by_facility": [
          {
            "fac_type": "HELIPORT",
            "airport_count": 16
          },
          {
            "fac_type": "AIRPORT",
            "airport_count": 11
          }
        ]
      },
      {
        "county": "PHILADELPHIA",
        "airport_count": 26,
        "by_facility": [
          {
            "fac_type": "HELIPORT",
            "airport_count": 22
          },
          {
            "fac_type": "AIRPORT",
            "airport_count": 4
          }
        ]
      }
    ]
  }
]
WITH __stage0 AS (
  SELECT
    group_set,
    base."state" as "state__0",
    CASE WHEN group_set=0 THEN
      COUNT(1)
      END as "airport_count__0",
    CASE WHEN group_set IN (1,2) THEN
      base."county"
      END as "county__1",
    CASE WHEN group_set=1 THEN
      COUNT(1)
      END as "airport_count__1",
    CASE WHEN group_set=2 THEN
      base."fac_type"
      END as "fac_type__2",
    CASE WHEN group_set=2 THEN
      COUNT(1)
      END as "airport_count__2"
  FROM '../data/airports.parquet' as base
  CROSS JOIN (SELECT UNNEST(GENERATE_SERIES(0,2,1)) as group_set  ) as group_set
  GROUP BY 1,2,4,6
)
, __stage1 AS (
  SELECT 
    CASE WHEN group_set=2 THEN 1  ELSE group_set END as group_set,
    "state__0" as "state__0",
    FIRST("airport_count__0") FILTER (WHERE "airport_count__0" IS NOT NULL) as "airport_count__0",
    CASE WHEN group_set IN (1,2) THEN
      "county__1"
      END as "county__1",
    FIRST("airport_count__1") FILTER (WHERE "airport_count__1" IS NOT NULL) as "airport_count__1",
    COALESCE(LIST({
      "fac_type": "fac_type__2", 
      "airport_count": "airport_count__2"}  ORDER BY  "airport_count__2" desc NULLS LAST) FILTER (WHERE group_set=2),[]) as "by_facility__1"
  FROM __stage0
  GROUP BY 1,2,4
)
SELECT
  "state__0" as "state",
  MAX(CASE WHEN group_set=0 THEN "airport_count__0" END) as "airport_count",
  COALESCE(LIST({
    "county": "county__1", 
    "airport_count": "airport_count__1", 
    "by_facility": "by_facility__1"}  ORDER BY  "airport_count__1" desc NULLS LAST) FILTER (WHERE group_set=1)[1:5],[]) as "top_5_counties"
FROM __stage1
GROUP BY 1
ORDER BY 2 desc NULLS LAST

Filtering Nested Views

Filters can be isolated to any level of nesting. In the following example, we limit the major_facilities view to only airports where major is 'Y'. This particular filter applies only to major_facilities, and not to other parts of the outer query.

document
run: airports -> {
  where: state = 'CA'
  group_by: county
  aggregate: airport_count
  nest: major_facilities is  {
    where: major = 'Y'
    group_by: name is concat(code, ' (', full_name, ')')
  }
  nest: by_facility is  {
    group_by: fac_type
    aggregate: airport_count
  }
}
QUERY RESULTS 
[
  {
    "county": "LOS ANGELES",
    "airport_count": 176,
    "major_facilities": [
      {
        "name": "BUR (BURBANK-GLENDALE-PASADENA)"
      },
      {
        "name": "LAX (LOS ANGELES INTL)"
      },
      {
        "name": "LGB (LONG BEACH /DAUGHERTY FIELD/)"
      }
    ],
    "by_facility": [
      {
        "fac_type": "HELIPORT",
        "airport_count": 151
      },
      {
        "fac_type": "AIRPORT",
        "airport_count": 23
      },
      {
        "fac_type": "SEAPLANE BASE",
        "airport_count": 2
      }
    ]
  },
  {
    "county": "SAN BERNARDINO",
    "airport_count": 71,
    "major_facilities": [
      {
        "name": "ONT (ONTARIO INTL)"
      }
    ],
    "by_facility": [
      {
        "fac_type": "AIRPORT",
        "airport_count": 47
      },
      {
        "fac_type": "HELIPORT",
        "airport_count": 24
      }
    ]
  },
  {
    "county": "ORANGE",
    "airport_count": 53,
    "major_facilities": [
      {
        "name": "SNA (JOHN WAYNE AIRPORT-ORANGE COUNTY)"
      }
    ],
    "by_facility": [
      {
        "fac_type": "HELIPORT",
        "airport_count": 47
      },
      {
        "fac_type": "AIRPORT",
        "airport_count": 6
      }
    ]
  },
  {
    "county": "KERN",
    "airport_count": 49,
    "major_facilities": [
      {
        "name": "BFL (MEADOWS FIELD)"
      },
      {
        "name": "IYK (INYOKERN)"
      }
    ],
    "by_facility": [
      {
        "fac_type": "AIRPORT",
        "airport_count": 41
      },
      {
        "fac_type": "HELIPORT",
        "airport_count": 7
      },
      {
        "fac_type": "ULTRALIGHT",
        "airport_count": 1
      }
    ]
  },
  {
    "county": "SAN DIEGO",
    "airport_count": 49,
    "major_facilities": [
      {
        "name": "SAN (SAN DIEGO INTL-LINDBERGH FLD)"
      }
    ],
    "by_facility": [
      {
        "fac_type": "AIRPORT",
        "airport_count": 30
      },
      {
        "fac_type": "HELIPORT",
        "airport_count": 17
      },
      {
        "fac_type": "GLIDERPORT",
        "airport_count": 2
      }
    ]
  }
]
WITH __stage0 AS (
  SELECT
    group_set,
    base."county" as "county__0",
    CASE WHEN group_set=0 THEN
      COUNT(1)
      END as "airport_count__0",
    CASE WHEN group_set=1 THEN
      CONCAT(base."code",' (',base."full_name",')')
      END as "name__1",
    CASE WHEN group_set=2 THEN
      base."fac_type"
      END as "fac_type__2",
    CASE WHEN group_set=2 THEN
      COUNT(1)
      END as "airport_count__2"
  FROM '../data/airports.parquet' as base
  CROSS JOIN (SELECT UNNEST(GENERATE_SERIES(0,2,1)) as group_set  ) as group_set
  WHERE (base."state"='CA')
  AND ((group_set NOT IN (1) OR (group_set IN (1) AND base."major"='Y')))
  GROUP BY 1,2,4,5
)
SELECT
  "county__0" as "county",
  MAX(CASE WHEN group_set=0 THEN "airport_count__0" END) as "airport_count",
  COALESCE(LIST({
    "name": "name__1"}  ORDER BY  "name__1" asc NULLS LAST) FILTER (WHERE group_set=1),[]) as "major_facilities",
  COALESCE(LIST({
    "fac_type": "fac_type__2", 
    "airport_count": "airport_count__2"}  ORDER BY  "airport_count__2" desc NULLS LAST) FILTER (WHERE group_set=2),[]) as "by_facility"
FROM __stage0
GROUP BY 1
ORDER BY 2 desc NULLS LAST

Dates and Timestamps

Working with time in data is often needlessly complex; Malloy has built in constructs to simplify many time-related operations. This section gives a brief introduction to some of these tools, but for more details see the Time Ranges section.

Time Literals

Literals of type date and timestamp are notated with an @, e.g. @2003-03-29 or @1994-07-14 10:23:59. Similarly, years (@2021), quarters (@2020-Q1), months (@2019-03), weeks (@WK2021-08-01), and minutes (@2017-01-01 10:53) can be expressed.

Time literals can be used as values, but are more often useful in filters. For example, the following query shows the number of flights in 2003.

document
run: duckdb.table('../data/flights.parquet') -> {
  where: dep_time ? @2003 
  aggregate: flight_count is count()
}
QUERY RESULTS