Skip to content

Unrecovered Events Query

Before querying, refer to the descriptions of the df_monitor_checker_event_ref, df_fault_id, df_status, and df_fault_status fields in Event-related Field Descriptions.

1. Query Access

You can also use OpenAPI Unrecovered Events List (POST /api/v1/events/abnormal/list). This API lists events where the most recent event for the same df_monitor_checker_event_ref has a status other than ok. The handwritten DQL below filters by df_fault_status=fault; choose the appropriate status criterion based on your needs.

2. Query Statements

The request body below uses JSON. Replace timeRange with the actual query time range; the start and end times in the example are both in milliseconds. disable_sampling=true disables sampling.

Method 1: Query with having (applicable to Doris engine) to get results directly

Query Structure

{
    "queries": [
        {
            "qtype": "dql",
            "query": {
                "disableMultipleField": false,
                "q": "E::`monitor`:(`__docid`, `df_title`,`df_monitor_checker_event_ref`, `df_fault_id`, `df_status`, `df_fault_status`,`df_fault_start_time`, `df_event_id`) { df_monitor_checker_event_ref = exists() } by `df_monitor_checker_event_ref` having df_fault_status = 'fault' sorder by create_time desc",
                "timeRange": [
                    1724320359294,
                    1724323959294
                ],
                "align_time": true,
                "disable_sampling": true,
                "slimit": 100,
                "tz": "Asia/Shanghai"
            }
        }
    ]
}

Here, slimit=100 means a maximum of 100 groups are returned.

Method 2: Query without having (non-Doris engines) requires filtering

Query Structure

{
    "queries": [
        {
            "qtype": "dql",
            "query": {
                "disableMultipleField": false,
                "q": "E::`monitor`:(`__docid`, `df_title`,`df_monitor_checker_event_ref`, `df_fault_id`, `df_status`, `df_fault_status`,`df_fault_start_time`, `df_event_id`, `create_time`) { df_monitor_checker_event_ref = exists() } by `df_monitor_checker_event_ref` sorder by create_time desc",
                "timeRange": [
                    1724320359294,
                    1724323959294
                ],
                "align_time": true,
                "disable_sampling": true,
                "slimit": 1000,
                "tz": "Asia/Shanghai"
            }
        }
    ]
}

Here, slimit=1000 means a maximum of 1,000 trigger target groups are returned, which are then filtered as described below.

Filtering DQL Query Results

Filter the query results by the df_fault_status field and retrieve only events where df_fault_status=fault. These entries constitute the list of Unrecovered Events.

Final Output

Sort the data by the time field in descending order to produce the final list of Unrecovered Events.

3. How to Determine the Storage Engine Type for Events in the Current Workspace

Get Workspace Storage Information via API

In the API response, datastore contains the storage engine type for all underlying data in the current Workspace (excluding external indexes). If the value of keyevent in datastore is doris, the event data uses the doris storage engine.

The following is an excerpt of the response example:

{
    "code": 200,
    "content": {
        "id": 1,
        "uuid": "wksp_xxxxx",
        "name": "【Doris】工作空间名",
        "versionType": "pay",
        "datastore": {
            "backup_log": "doris",
            "custom_object": "doris",
            "keyevent": "doris",
            "logging": "doris",
            "metric": "guancedb",
            "network": "doris",
            "object": "doris",
            "object_history": "doris",
            "profiling": "doris",
            "rum": "doris",
            "security": "doris",
            "tracing": "doris"
        }
    },
    "errorCode": "",
    "message": "",
    "success": true,
    "traceId": "2956247345653191101"
}