Simple Query¶

Query data from different sources, and display it in charts by selecting aggregation functions, grouping tags, Labels, and filter conditions.

Data Sources¶

Includes a series of data combinations from Metrics, Logs, Basic Objects, Resource Catalog, Events, APM, RUM, Network, Profile, and Cloud Billing.

Source	Description
Metrics	Requires selecting a Measurement and a Metric. One Measurement can contain multiple Metrics.
Other Types	Basic Objects, Resource Catalog: Requires selecting a Class and Attributes/Tags; Logs, Events, APM, RUM: Requires selecting a Source and Attributes/Tags.

When Logs are the Data Source

You can choose different indexes to correspond to the log content. The default is the default index.

For more details, refer to Log Indexes.

Multiple Queries¶

Select multiple query conditions, and the data will be displayed grouped according to the selected filter items. Click the AS button to add an alias for each query condition, making it easier to distinguish the display of query results. If you want the added alias to be displayed directly on the chart, click the Legend on the right > Position, and select Bottom or Right.

Label Filter¶

Prerequisite

Label attributes have been set for hosts in Infrastructure > Hosts.

In fx > Label Filter, select or deselect host Label attributes to filter the display.

Add Filter¶

Click the icon to add filter conditions to the current query.

Multiple filter conditions can be added under a single query. The relationship between each filter condition includes two value methods: AND and OR.

Filter Condition	Description	Supported Filter Condition Types
`=`	Equal to	`Integer`, `Float`, `String`
`!=`	Not equal to	`Integer`, `Float`, `String`
`>=`	Greater than or equal to	`Integer`, `Float`, `String`
`<=`	Less than or equal to	`Integer`, `Float`, `String`
`>`	Greater than	`Integer`, `Float`, `String`
`<`	Less than	`Integer`, `Float`, `String`
`match`	Contains	`String`
`not match`	Does not contain	`String`
`wildcard`	Fuzzy match (supports log-type data except Metrics)	`String`
`not wildcard`	Fuzzy non-match (supports log-type data except Metrics)	`String`

Filter Query¶

After adding filter conditions, you can choose multiple types of value:

View Variable: {{variable_name}} View variable xx value;
Subquery: {{letter}} xx query result (❗️ Only visible when selecting in and not in filter conditions);
Time:
- #{startTime} Start time of chart query
- #{endTime} End time of chart query
Other optional values.

Functions¶

Click the fx icon to add function calculations for Metrics and other data sources to this query.

Rollup Function¶

Slices the data into specified time intervals and calculates the data returned for each interval.

Note

In time series charts, after selecting this function and the aggregation method, you can go to Advanced Configuration to choose the time interval;
In non-time series charts, after selecting this function, you can choose aggregation methods including avg, sum, min, etc., and time intervals (interval) including auto, 10s, 20s, 30s, 1m, 5m, 10m, 30m, 1h, 6h, 12h, 1d, 7d, 30d;
Only supports Metrics data queries; other data queries in simple chart mode do not support selecting the Rollup function;
The Rollup function does not support adding multiple instances.

For more details, refer to DQL Function Documentation.

Transformation Functions¶

Also known as outer functions. The functions supported for selection in UI mode are shown below:

Transformation Functions (Outer Functions)	Description
`cumsum`	Cumulative sum of the processed set
`abs`	Calculates the absolute value of each element in the processed set
`log2`	Calculates the base-2 logarithm of each element in the processed set. The processed set must have at least one row, otherwise returns null
`log10`	Calculates the base-10 logarithm of each element in the processed set. The processed set must have at least one row, otherwise returns null
`moving_average`	Calculates the moving average of the processed set. The window size must not be less than the number of rows in the processed set, otherwise returns null
`difference`	Calculates the difference between adjacent elements in the processed set. The processed set must have at least one row, otherwise returns null
`derivative`	Calculates the derivative between adjacent elements in the processed set. The time unit for derivation is seconds (s)
`non_negative_derivative`	Calculates the non-negative derivative between adjacent elements in the processed set. The time unit for derivation is seconds (s)
`non_negative_difference`	Calculates the non-negative difference between adjacent elements in the processed set. The processed set must have at least one row, otherwise returns null
`series_sum`	When grouping produces multiple `series`, merges them into 1 `series` based on time points. Among them, multiple `series` at the same time point are summed. The processed set must have at least one row, otherwise returns null
`rate`	Calculates the rate of change of a metric over a certain time range, suitable for slowly changing counters. The time unit is seconds (s)
`irate`	Calculates the rate of change of a metric over a certain time range, suitable for rapidly changing counters. The time unit is seconds (s)

In DQL mode, more outer functions are supported. Refer to DQL Function Documentation.

Aggregation Functions¶

UI mode supports selecting aggregation methods to return result values.

Aggregation Function	Description
`last`	Returns the value of the latest timestamp
`first`	Returns the value of the earliest timestamp
`avg`	Returns the average value of a field. Has exactly one parameter, and the parameter type is a field name
`min`	Returns the minimum value
`max`	Returns the maximum value
`sum`	Returns the sum of field values
`P50`	Returns the 50th percentile value of a field
`P75`	Returns the 75th percentile value of a field
`P90`	Returns the 90th percentile value of a field
`P99`	Returns the 99th percentile value of a field
`count`	Returns the aggregate value of non-null field values
`count_distinct`	Counts the number of distinct values in a field
`difference`	Returns the difference between consecutive time values in a field
`derivative`	Returns the rate of change of a field within a `series`
`non_negative_derivative`	Returns the non-negative rate of change of values in a field within a `series`

In DQL mode, more aggregation functions are supported. Refer to DQL Aggregation Functions.

Window Functions¶

Uses the selected time interval as the window (record set), combines with aggregation functions to perform statistical calculations on each record. Supports selecting 1 minute, 5 minutes, 15 minutes, 30 minutes, 1 hour, 3 hours, 6 hours, 12 hours, 24 hours.

Note

The window function query result does not change the number of records. The current number of existing records remains the same after executing the function result.

No Data Fill¶

Sets the fill method for null data. After setting, it appears as fill in the query, including three types:

Function	Description
Previous Fill (previous)	Converts null data to the previous value.
Linear Fill (linear)	Fills null data after calculation by a linear function.
Value Fill	Allows custom fill value.

Advanced Functions¶

Advanced functions are mainly used for further function calculations on data queried by DQL and for intuitive time series chart display.

For more details, refer to Advanced Functions.

Hide Query¶

Click the icon to hide the query result of that entry on the chart.

As shown in the figure below, the system loading data only displays the query results for 1m and 15m. The system loading query result for 5m has been hidden and cannot be viewed on the chart.