Data Retrieval¶

Toby AI TruePilot can help users write query statements, and also convert natural language into explorer filter conditions. The goals of these two capabilities are different: DQL / PromQL Assistant delivers readable and reusable query statements; the explorer natural language search is used to filter data on the current page.

DQL / PromQL Assistant¶

DQL / PromQL Assistant is used to generate, explain, fix, and review query statements, and can also rewrite suitable DQL into platform PromQL. When generating DQL, Toby AI TruePilot will first check the actual data sources, fields, and tags in the current workspace, and perform syntax checks on the final DQL.

This capability will not return DQL by default just because the user says "view recent logs". It only enters the query language flow when explicitly asked to write, explain, fix, review, or convert DQL / PromQL.

Suitable for handling the following query tasks:

• Not familiar with DQL or PromQL syntax, need to generate queries based on goals;
• Existing queries cannot pass, result caliber is unclear, or need to check risks;
• Want to understand the filtering, aggregation, grouping, and time window of an existing query;
• Need to convert metric DQL to platform PromQL;
• Want to get queries based on actual fields in the current workspace, rather than generic examples.

Writing or Checking Queries¶

Directly describe the query goal in Toby AI TruePilot, and try to provide the following information:

• Data Domain: Metrics, logs, events, traces, RUM, or other data types;
• Data Object: Known measurement, source, service, or fields;
• Time Range: For example, the last 30 minutes or the past 7 days;
• Statistical Caliber: Total, rate, average, percentile, TopN, or grouping dimensions;
• Output Type: DQL, platform PromQL, or standard Prometheus query.

Example:

Please generate a DQL for the current workspace: count the number of error logs per service in the last 30 minutes, and return the top 10 services in descending order of count.

If you need to fix or explain a query, please paste the original statement directly and describe the expected result. When there is ambiguity in data domain, time range, or statistical caliber, Toby AI TruePilot will first ask for supplementary information, rather than guessing the data source and fields.

Query Results and Verification¶

When generating DQL, Toby AI TruePilot will by default return a query that best meets the requirements and has completed syntax checking, and briefly explain the data source, filter conditions, aggregation, and time range. When fields or data sources cannot be confirmed from the current workspace, it will explain the limitations and ask the user to choose, and will not describe unconfirmed fields as actually existing.

When generating PromQL, the platform-supported measurement:field metric caliber is used by default. PromQL will not actually run in this flow; please execute it on the target query page and confirm the data results. DQL syntax checking also only verifies the statement structure, and does not mean that the query will definitely have data within the selected time range.

Explorer Natural Language Search¶

Explorer natural language search converts user descriptions into query conditions that the current explorer can recognize, and delivers them together with existing queries and time ranges to the page for execution. It is suitable for users who are not familiar with explorer syntax but already know which objects, statuses, or value ranges to filter.

This capability is currently applicable to explorers that have integrated natural language search, including logs, traces, RUM, basic objects, resource catalog, events, synthetic tests, security, cloud bills, backup logs, Agent monitoring, and LLM.

Setting Filter Conditions¶

In explorers that support this capability, describe the filter target in natural language. For example:

Find data where service is checkout, status is abnormal, and duration is greater than 2 seconds, only look at the last 3 hours.

You can express equal, not equal, contains, wildcard, regex, numeric comparison, range, field existence, and combined conditions such as AND, OR, NOT. The actual available operations depend on the current field type.

By default, Toby AI TruePilot will retain the existing conditions in the query box and append new conditions. If you want to replace existing conditions, please explicitly use expressions such as "re-query", "clear original conditions", "only search", or "replace with".

Condition Conversion Rules¶

Toby AI TruePilot will generate query conditions based on the field list provided by the current explorer:

• Content that can clearly correspond to current fields or field aliases will be converted to structured filter conditions;
• Keywords that cannot be confirmed as fields will be retained as plain text search, and will not be forcibly mapped to similar fields;
• Business values such as service names, resource names, IDs, URLs, paths, and error texts will be kept as original as possible;
• Time expressions explicitly given by the user will be handed over to the explorer time widget for processing.

The generated results are used for filtering in the current explorer; no DQL is created, and data is not modified. When a field does not appear in the available fields of the current page, even if other explorers have fields with the same name, it will not be used as a structured condition.