DQL¶

namespace[index]::datasource[:select-clause] [{where-clause}] [time-expr] [group-by-clause] [having-clause] [order-by-clause] [limit-clause] [sorder-by-clause] [slimit-clause] [soffset-clause]

M("production")::cpu:(avg(usage) as avg_usage, max(usage) as max_usage) {host =~ 'web-.*', usage > 50} [1h::5m] BY host, env HAVING avg_usage > 60 ORDER BY time DESC LIMIT 100 SORDER BY avg_usage DESC SLIMIT 10

// 使用默认索引（当不指定时自动使用 default）
M::cpu           // 等价于 M("default")::cpu
L::nginx         // 等价于 L("default")::nginx

// 指定单个索引
M("production")::cpu     // 查询 production 索引中的 CPU 指标
L("web-logs")::nginx     // 查询 web-logs 索引中的 Nginx 日志

// 多索引查询（同时查询多个索引的数据）
M("production", "staging")::cpu     // 查询生产和测试环境的 CPU 指标
L("web-logs", "api-logs")::nginx     // 查询 Web 和 API 日志

// 旧语法，不推荐
L::nginx { index = "web-logs" }
L::nginx { index IN ["web-logs", "api-logs"] }

// 查询生产环境的 CPU 使用率
M("production")::cpu:(avg(usage)) [1h] BY host

// 查询生产和测试环境的对比
M("production", "staging")::cpu:(avg(usage)) [1h] BY index, host

// 分析 Web 服务器日志
L("web-logs")::nginx:(count(*)) {status >= 400} [1h] BY status

// 对比 Web 和 API 服务器错误率
L("web-logs", "api-logs")::*:(count(*)) {status >= 500} [1h] BY index

M::cpu:(usage)                    // 查询 CPU 指标
L::nginx:(count(*))                // 查询 Nginx 日志
T::user-service:(traces)           // 查询用户服务追踪

M::*:(usage)                      // 查询所有指标

M::re('cpu.*'):(usage)            // 查询以 cpu 开头的指标
L::re('web.*'):(count(*))          // 查询以 web 开头的日志
T::re('.*-service'):(traces)      // 查询以 -service 结尾的服务

namespace::(subquery):(projections)

L::(L::*:(count(*)) {level = 'error'} BY app_id):(count_distinct(app_id))

// 统计有错误的应用数量
L::(L::*:(count(*)) {level = 'error'} BY app_id):(count_distinct(app_id))

// 分析高 CPU 使用率的服务器
M::(M::cpu:(avg(usage)) [1h] BY host {avg(usage) > 80}):(count(host))

// 先找出错误率超过 1% 的服务端点，然后统计受影响的服务数量
M::(M::http_requests:(sum(request_count), sum(error_count)) [1h] BY service, endpoint
   {sum(error_count) / sum(request_count) > 0.01}
):(count(service))

// 选择单个字段
M::cpu:(usage)

// 选择多个字段
M::cpu:(usage, system, user)

// 选择所有字段
M::cpu:(*)

field-name@json-path
@json-path                    // 默认使用 message 字段

{
  "message": "User login attempt",
  "request": {
    "method": "POST",
    "path": "/api/login",
    "headers": {
      "user-agent": "Mozilla/5.0",
      "content-type": "application/json"
    },
    "body": {
      "username": "john.doe",
      "password": "***",
      "permissions": ["read", "write", "admin"]
    }
  },
  "response": {
    "status": 200,
    "time": 156,
    "data": [
      {"id": 1, "name": "user1"},
      {"id": 2, "name": "user2"}
    ]
  }
}

// 提取请求方法
L::auth_logs:(message@request.method)

// 提取请求路径
L::auth_logs:(message@request.path)

// 提取用户名
L::auth_logs:(message@request.body.username)

// 提取响应状态
L::auth_logs:(message@response.status)

// 提取 User-Agent（包含连字符，需要用方括号）
L::auth_logs:(message@request.headers["user-agent"])

// 提取权限数组第一个元素
L::auth_logs:(message@request.body.permissions[0])

// 提取响应数据第一个对象的 name
L::auth_logs:(message@response.data[0].name)

// 统计不同请求方法的数量
L::auth_logs:(count(*)) [1h] BY message@request.method

// 分析响应时间分布
L::auth_logs:(avg(message@response.time), max(message@response.time)) [1h] BY message@request.method

// 提取多个字段
L::auth_logs:(
    message,
    message@request.method as method,
    message@request.path as path,
    message@response.status as status,
    message@response.time as response_time
) {message@response.status >= 400} [1h]

// 单位转换（毫秒转秒）
L::nginx:(response_time / 1000) as response_time_seconds

// 计算百分比
M::memory:(used / total * 100) as usage_percentage

// 复合计算
M::network:((bytes_in + bytes_out) / 1024 / 1024) as total_traffic_mb

// 聚合函数
M::cpu:(max(usage), min(usage), avg(usage)) [1h] BY host

// 转换函数
L::logs:(int(response_time) as response_time_seconds)
L::logs:(floor(response_time) as response_time_seconds)

expression as alias_name

// 简单别名
M::cpu:(avg(usage) as avg_usage, max(usage) as max_usage) [1h] BY host

// 表达式别名
M::memory:((used / total) * 100 as usage_percent) [1h] BY host

// 函数别名
L::logs:(count(*) as error_count) {level = 'error'} [1h] BY service

// JSON 提取别名
L::api_logs:(
    message@request.method as http_method,
    message@response.status as http_status,
    message@response.time as response_time_ms
) [1h]

M::cpu:(max(usage)) [1h] BY host

// 结果会包含 max(usage) 列，可以直接在后续直接使用 usage 列名拿到子查询结果的 `max(usage)` 列：
M::(M::cpu:(max(usage)) [1h] BY host):(max(usage)) { usage > 80 }

// 必须使用别名的情况
M::cpu:(max(usage) as max_usage, min(usage) as min_usage) [1h] BY host

[start_time:end_time:interval:rollup]

[1672502400000:1672588800000]     // 毫秒级时间戳
[1672502400:1672588800]           // 秒级时间戳

[1h]                             // 过去 1 小时到现在
[1h:5m]                          // 从过去 1 小时到过去 5 分钟
[1h30m]                          // 过去 1 小时 30 分钟
[2h15m30s]                       // 过去 2 小时 15 分钟 30 秒

[TODAY]                          // 今天的数据
[YESTERDAY]                      // 昨天的数据
[THIS WEEK]                      // 本周的数据
[LAST WEEK]                      // 上周的数据
[THIS MONTH]                     // 本月的数据
[LAST MONTH]                     // 上月的数据

M::cpu:(max(usage_total)) [1h]

{
  "columns": ["time", "max(usage_total)"],
  "values": [
    [1721059200000, 37.46]
  ]
}

M::cpu:(max(usage_total)) [1h::10m]

{
  "columns": ["time", "max(usage_total)"],
  "values": [
    [1721059200000, 37.46],
    [1721058600000, 34.12],
    [1721058000000, 33.81],
    [1721057400000, 30.92],
    [1721058000000, 34.53],
    [1721057400000, 36.11]
  ]
}

原始数据 → WHERE 筛选 → **Rollup 预处理** → 分组聚合 → HAVING 筛选 → 最终结果

{
  "host": "web-server-01",
  "data": [
    {"time": "2024-07-15 08:25:00", "request_count": 150},
    {"time": "2024-07-15 08:20:00", "request_count": 140},
    {"time": "2024-07-15 08:15:00", "request_count": 130},
    {"time": "2024-07-15 08:10:00", "request_count": 120},
    {"time": "2024-07-15 08:05:00", "request_count": 110},
    {"time": "2024-07-15 08:00:00", "request_count": 100}
  ]
}

{
  "host": "web-server-02",
  "data": [
    {"time": "2024-07-15 08:25:00", "request_count": 250},
    {"time": "2024-07-15 08:20:00", "request_count": 240},
    {"time": "2024-07-15 08:15:00", "request_count": 230},
    {"time": "2024-07-15 08:10:00", "request_count": 220},
    {"time": "2024-07-15 08:05:00", "request_count": 210},
    {"time": "2024-07-15 08:00:00", "request_count": 200}
  ]
}

M::http:(sum(request_count)) [rate]

// 计算所有服务器的总请求速率
M::http_requests:(sum(request_count)) [rate]

// 计算错误率
M::http_requests:(
    sum(error_count) as errors,
    sum(request_count) as requests
) [rate] BY service

[1h]                             // 只指定时间范围
[1h::5m]                         // 时间范围 + 聚合步长
[1h:5m]                          // 开始时间 + 结束时间
[1h:5m:1m]                       // 开始 + 结束 + 步长
[1h:5m:1m:avg]                   // 完整格式
[::5m]                           // 只指定聚合步长
[:::sum]                         // 只指定 rollup 函数
[sum]                            // 只指定 rollup 函数（最简形式）

{condition1, condition2, condition3}

// 单一条件
M::cpu:(usage) {host = 'web-01'} [1h]

// 多个 AND 条件
M::cpu:(usage) {host = 'web-01', usage > 80} [1h]

// 使用 AND 关键字
M::cpu:(usage) {host = 'web-01' AND usage > 80} [1h]

// 混合使用逻辑操作符
M::cpu:(usage) {(host = 'web-01' OR host = 'web-02') AND usage > 80} [1h]

// 匹配错误日志
L::logs:(message) {message =~ 'ERROR.*\\d{4}'} [1h]

// 匹配特定格式的日志
L::logs:(message) {message =~ '\\[(ERROR|WARN)\\].*'} [1h]

// 排除调试信息
L::logs:(message) {message !~ 'DEBUG.*'} [1h]

// 主机名模式匹配
M::cpu:(usage) {host =~ 'web-.*\\.prod\\.com'} [1h]

// 状态码过滤
L::nginx:(count(*)) {status IN [200, 201, 202, 204]} [1h]

// 排除特定状态码
L::nginx:(count(*)) {status NOT IN [404, 500, 502]} [1h]

// 日志级别过滤
L::app_logs:(count(*)) {level IN ['ERROR', 'WARN', 'CRITICAL']} [1h]

// 检查数组是否包含某个值
{tags IN ['web']}           // true，因为 tags 包含 'web'
{tags IN ['mobile']}        // false，因为 tags 不包含 'mobile'

// 检查数组是否不包含某个值
{tags NOT IN ['mobile']}    // true，因为 tags 不包含 'mobile'
{tags NOT IN ['web']}       // false，因为 tags 包含 'web'

// 检查数组是否包含所有指定的值
{tags IN ['web', 'api']}           // true，包含 'web' 和 'api'
{tags IN ['web', 'api', 'mobile']} // false，不包含 'mobile'

// 历史语法：单值包含检查（等于操作符的重载语义）
{tags = 'web'}           // true，因为 tags 包含 'web'
{tags = 'mobile'}        // false，因为 tags 不包含 'mobile'

// 历史语法：单值不包含检查（不等于操作符的重载语义）
{tags != 'mobile'}       // true，因为 tags 不包含 'mobile'
{tags != 'web'}          // false，因为 tags 包含 'web'

// 字符串匹配
L::logs:(message) { match(message, 'error') }
L::logs:(message) { wildcard(message, 'error*') }

// 查询响应时间异常的请求
L::access_logs:(*) {
    response_time > 1000 AND
    match(message, 'timeout')
}

// 查询内存使用率异常的主机
M::memory:(usage) {
    (usage > 90 OR usage < 10) AND
    host =~ 'prod-.*' AND
    tags IN ['critical', 'important']
}

M::cpu:(avg(usage)) [1h] BY host
{host IN (O::HOST:(hostname) {provider = 'cloud-a'})}

// 监控特定云服务商的服务器
M::cpu:(avg(usage)) [1h] BY host
{host IN (O::HOST:(hostname) {provider = 'cloud-a'})}

// 对比不同云服务商的性能
M::memory:(avg(used / total * 100)) [1h] BY host
{host IN (O::HOST:(hostname) {provider IN ['cloud-a', 'cloud-b']})}

// 分析特定业务的日志
L::app_logs:(count(*)) [1h] BY level
{service IN (T::services:(service_name) {business_unit = 'ecommerce'})}

// 监控关键业务的应用性能
M::response_time:(avg(response_time)) [1h] BY service
{service IN (T::services:(service_name) {criticality = 'high'})}

BY expression1, expression2, ...

// 单字段分组
M::cpu:(avg(usage)) [1h] BY host

// 多字段分组
M::cpu:(avg(usage)) [1h] BY host, env

// 嵌套分组
M::cpu:(avg(usage)) [1h] BY datacenter, rack, host

// 复合数学表达式
M::memory:(avg(used)) [1h] BY ((used / total) * 100) as
usage_percent

// 多字段数学运算
M::performance:(avg(response_time)) [1h] BY
(response_time / 1000) as response_seconds

// Drain 聚类算法
L::logs:(count(*)) BY drain(message, 0.7) as sample

// 正则提取分组
L::logs:(count(*)) [1h] BY regexp_extract(message, 'error_code: (\\d+)', 1)

{
  "series": [
    {
      "columns": ["time", "max(usage_total)"],
      "name": "cpu",
      "tags": {"host": "web-server-01"},
      "values": [
        [1721059200000, 78.5],
        [1721058600000, 82.3],
        [1721058000000, 75.8],
        [1721057400000, 88.2]
      ]
    },
    {
      "columns": ["time", "max(usage_total)"],
      "name": "cpu",
      "tags": {"host": "web-server-02"},
      "values": [
        [1721059200000, 45.2],
        [1721058600000, 52.8],
        [1721058000000, 48.5],
        [1721057400000, 61.3]
      ]
    },
    {
      "columns": ["time", "max(usage_total)"],
      "name": "cpu",
      "tags": {"host": "web-server-03"},
      "values": [
        [1721059200000, 92.1],
        [1721058600000, 95.7],
        [1721058000000, 89.4],
        [1721057400000, 97.6]
      ]
    }
  ]
}

HAVING condition

原始数据 → WHERE 筛选 → 分组聚合 → HAVING 筛选 → 最终结果

// 基于聚合函数值的筛选
M::cpu:(avg(usage) as avg_usage) [1h] BY host HAVING avg_usage > 80

// 基于多个聚合条件的筛选
M::http_requests:(
    sum(request_count) as total,
    sum(error_count) as errors
) [1h] BY service, endpoint
HAVING errors / total > 0.01 AND total > 1000

// 基于分组统计的筛选
L::logs:(count(*) as count) [1h] BY service HAVING count > 100

// 基于复合聚合条件的筛选
M::response_time:(
    avg(response_time) as avg_time,
    max(response_time) as max_time,
    min(response_time) as min_time
) [1h] BY endpoint
HAVING avg_time > 1000 AND max_time > 5000 AND (max_time - min_time) > 2000

ORDER BY expression [ASC|DESC]
LIMIT row_count
OFFSET row_offset

// 按时间降序排列，显示每个主机的最新数据
M::cpu:(max(usage_total)) [1h::10m] BY host ORDER BY time DESC

// 按时间升序排列，显示历史趋势
M::cpu:(max(usage_total)) [1h::10m] BY host ORDER BY time ASC

{
  "series": [
    {
      "columns": ["time", "max(usage_total)"],
      "name": "cpu",
      "tags": {"host": "web-server-01"},
      "values": [
        [1721059200000, 78.5],  // 12:00:00
        [1721058600000, 82.3],  // 11:50:00
        [1721058000000, 75.8],  // 11:40:00
        [1721057400000, 88.2],  // 11:30:00
        [1721056800000, 72.1],  // 11:20:00
        [1721056200000, 69.4]   // 11:10:00
      ]
    },
    {
      "columns": ["time", "max(usage_total)"],
      "name": "cpu",
      "tags": {"host": "web-server-02"},
      "values": [
        [1721059200000, 45.2],  // 12:00:00
        [1721058600000, 52.8],  // 11:50:00
        [1721058000000, 48.5],  // 11:40:00
        [1721057400000, 61.3],  // 11:30:00
        [1721056800000, 55.7],  // 11:20:00
        [1721056200000, 58.9]   // 11:10:00
      ]
    }
  ]
}

// 按CPU使用率降序排列，找出每个主机的峰值时段
M::cpu:(max(usage_total) as max_usage_total) [1h::10m] BY host ORDER BY max_usage_total DESC

// 按响应时间升序排列，找出性能最好的时段
M::response_time:(avg(response_time) as avg_response_time) [1h::5m] BY endpoint ORDER BY avg_response_time ASC

// 每个主机只显示最新的3个数据点
M::cpu:(max(usage_total)) [1h::10m] BY host ORDER BY time DESC LIMIT 3

// 跳过最新的2个数据点，显示接下来的3个
M::cpu:(max(usage_total)) [1h::10m] BY host ORDER BY time DESC LIMIT 3 OFFSET 2

{
  "series": [
    {
      "columns": ["time", "max(usage_total)"],
      "name": "cpu",
      "tags": {"host": "web-server-01"},
      "values": [
        [1721059200000, 78.5],  // 12:00:00 - 最新
        [1721058600000, 82.3],  // 11:50:00
        [1721058000000, 75.8]   // 11:40:00
        // 只返回前3条数据
      ]
    },
    {
      "columns": ["time", "max(usage_total)"],
      "name": "cpu",
      "tags": {"host": "web-server-02"},
      "values": [
        [1721059200000, 45.2],  // 12:00:00 - 最新
        [1721058600000, 52.8],  // 11:50:00
        [1721058000000, 48.5]   // 11:40:00
        // 只返回前3条数据
      ]
    }
  ]
}

SORDER BY aggregate_function(expression) [ASC|DESC]
SLIMIT group_count
SOFFSET group_offset

// 按平均CPU使用率降序排列，找出负载最高的主机
M::cpu:(avg(usage)) [1h::10m] BY host SORDER BY avg(usage) DESC SLIMIT 5

// 按平均响应时间升序排列，找出性能最好的服务
M::response_time:(avg(response_time)) [1h] BY service SORDER BY avg(response_time) ASC SLIMIT 10

{
  "series": [
    {
      "columns": ["time", "avg(usage)"],
      "name": "cpu",
      "tags": {"host": "web-server-03"},  // 平均使用率: 90.9 - 排名第一
      "values": [
        [1721059200000, 92.1],
        [1721058600000, 95.7],
        [1721058000000, 89.4]
      ]
    },
    {
      "columns": ["time", "avg(usage)"],
      "name": "cpu",
      "tags": {"host": "web-server-01"},  // 平均使用率: 77.7 - 排名第二
      "values": [
        [1721059200000, 78.5],
        [1721058600000, 82.3],
        [1721058000000, 75.8]
      ]
    }
    // web-server-02 (avg: 53.7) 被过滤掉，因为 SLIMIT 2
  ]
}

// 按最大CPU使用率排序，找出有异常峰值的主机
M::cpu:(max(usage_total)) [1h::10m] BY host SORDER BY max(usage_total) DESC SLIMIT 10

// 按最小内存使用率排序，找出资源利用率最低的主机
M::memory:(min(usage_percent)) [24h::1h] BY host SORDER BY min(usage_percent) ASC SLIMIT 5

// 按最新的CPU使用率排序，找出当前负载最高的主机
M::cpu:(usage) [1h::10m] BY host SORDER BY last(usage) DESC SLIMIT 10

// 按最新的错误率排序，找出当前问题最多的服务
L::logs:(count(*) as error_count) {level = 'error'} [1h] BY service SORDER BY error_count DESC SLIMIT 5

// 找出CPU使用率最高的10台服务器，每台显示最新的5个数据点
M::cpu:(avg(usage)) [1h::10m] BY host
SORDER BY avg(usage) DESC SLIMIT 10    // 组间排序：找出使用率最高的10台
ORDER BY time DESC LIMIT 5             // 组内排序：每台显示最新的5个点

{
  "series": [
    {
      "columns": ["time", "avg(usage)"],
      "name": "cpu",
      "tags": {"host": "web-server-03"},  // 平均使用率: 90.9 - 排名第一
      "values": [
        [1721059200000, 92.1],  // 12:00:00 - 最新
        [1721058600000, 95.7],  // 11:50:00
        [1721058000000, 89.4],  // 11:40:00
        [1721057400000, 97.6],  // 11:30:00
        [1721056800000, 87.3]   // 11:20:00
        // 只返回最新的5个数据点（LIMIT 5）
      ]
    },
    {
      "columns": ["time", "avg(usage)"],
      "name": "cpu",
      "tags": {"host": "web-server-01"},  // 平均使用率: 77.7 - 排名第二
      "values": [
        [1721059200000, 78.5],  // 12:00:00 - 最新
        [1721058600000, 82.3],  // 11:50:00
        [1721058000000, 75.8],  // 11:40:00
        [1721057400000, 88.2],  // 11:30:00
        [1721056800000, 72.1]   // 11:20:00
        // 只返回最新的5个数据点（LIMIT 5）
      ]
    }
    // 其他主机被过滤掉，因为 SLIMIT 10 只返回使用率最高的10台
  ]
}