Powerful Explorers¶

Explorers of Guance can be used in features including Infrastructure, Events, Logs, APM, RUM, CI Visibility, Synthetic Tests, Security Check, etc.

As one of the important tools for data observability, Explorers of Guance provide a variety of search and filter methods and supports combined use to obtain the final data results. This article will introduce major explorer features to help you quickly and accurately retrieve data and locate faults.

Search¶

Search generally consists of terms and operators. Wildcard query is supported, ? means matching any character and * matching 0 or more characters; To combine multiple terms into a complex query, you can use Boolean operator.

Terms can be words or phrases. For example:

• Word: guance;
• Phrase: "guance test"

Note: Using double quotation marks can convert a group of words into phrases.

Query sample (here, the example enters the search content for the explorer):

# Word
guance  // Precise search
guanc[e   // There is a special character writing example (no need to add/escape)   

# Word wildcard search (for performance reasons, Guance does not support prefix * writing for the time being, and if there is wildcard search, the following writing is supported)
guance*
gua?ce*  
gua*ce

# Phrase (the contents enclosed in double quotation marks are collectively referred to as phrases, and the contents of double quotation marks in this way will initiate a matching search as a whole)
"guance test"  // Query full-text index field, there is a match result of "guance test" content
"guance 127.0.0.1" // Sample writing when special characters exist

JSON Search¶

Precondition: Sites "China 1 (Hangzhou)", "China 3 (Zhangjiakou)" and "China 4 (Guangzhou)" are supported. Workspace needs to be created after June 23, 2022. JSON search function only supports log explorer at present.

• By default, the content of message is retrieved accurately, and it is required that message is in JSON format, which is not supported by log content in other formats;
• The json search format is: @key:value, or @ key1.key2: value for multi-level json available "." inheritance, as shown in the figure.

JSON search example:

message is as follows:
{
    __namespace:tracing,
    cluster_name_k8s:k8s-demo,
    meta:{    
        service:ruoyi-mysql-k8s,
        name:mysql.query,
        resource:select dict_code, dict_sort, dict_label, dict_value, dict_type, css_class, list_class, is_default, status, create_by, create_time, remark 
                from sys_dict_data
 }
}

# Query cluster_name_k8s = k8s-demo
@cluster_name_k8s:k8s-demo     // Precise search
@cluster_name_k8s:k?s*        // Wildcard search

# Query service = ruoyi-mysql-k8s under meta
@meta.service:ruoyi-mysql-k8s   // Precise search
@meta.service:ruoyi?mysql*   // Wildcard search

Filter¶

In the explorer, you can filter the format of tags/attributes, splicing them in the order of field operator values.

Note: The biggest difference between filtering and searching is whether there is a colon spacer in the input content. If there is a colon spacer, it will be judged as a filtering condition. If not, it will be a search condition (if there is a double quotation mark in the search content, it can be changed into a phrase).

Field¶

You can view the official field information provided by Guance by default on the Management > Field Management page.

Operator¶

Guance supports filtering for string OR numeric type fields.

• String field operator: = ≠ wildcard not wildcard exist not exist;
• Numeric field operator: = ≠ > >= < <= [xx TO xx] exist not exist.

Wildcard¶

? or * wildcard query is supported, ? means matches any character, * matches zero or multiple characters:

Value: guanceyun

# Only the suffix * matching is used. This scenario is suitable for the case where the string of a certain value prefix is fixed and accurate, and the second half changes dynamically
key:guance*    // * matches yun

# Use only ? match, this scenario is suitable for cases where only a few fixed-position characters are dynamically updated
key:gua?ceyun   // ? matches n

# ? * overlay use
key:gua?ce*   // ? matches n, * matches yun

# * mixed use
key:gua*e*   // the first * matches nc, and the second * matches yun

Value¶

AND and OR operator combination queries are supported.

# Precise search
key:(value1 AND value2 OR value3)

# Contain wildcard match    
key:(value1 OR test* OR value3)

# Contain * exist      
key:(value1 OR * OR value3)          // Equivalent to key:* 
key:(value1 AND *)                  // Equivalent to key:value1
key:(value1 AND * OR value3)        // Equivalent to key:(value1 OR value3)

Boolean Operator¶

The form of AND/OR/NOT supports further combination of association search.

Search/Filter Notes¶

Grouping¶

Use parentheses () to prioritize the data query criteria, i.e. the query logic in () takes precedence over the filter criteria if there is a selected part of the search in the query (). The query priority within () is still executed as NOT > AND > OR.

Handwriting Mode¶

Note: The new version of DQL handwriting mode previously supported by Log > Explorer will be offline after it goes online.

This handwriting mode covers all explorers (except dashboard/custom explorer). In the new mode, UI interaction is supported to add search, filter conditions and handwriting mode can be switched freely, and no changes will be made to the content before mode switching, thus realizing real-time switching and restoration of UI and handwriting input.

Analysis Mode¶

In the explorer analysis column, multi-dimensional analysis and statistics based on 1 to 3 tags are supported to reflect the distribution characteristics and trends of data in different dimensions and at different times.

Data display:

• Data point: Data point refers to the coordinate point where the data value is located. The line chart and area chart of the timing chart will be automatically aggregated into data points according to the time range you choose, and the number of data points will not exceed 360 points; The number of data points in the histogram shall not exceed 60.
• Data range: Data range refers to the value range of each data point, that is, the coordinate point of the current data point is pushed forward to the coordinate point of the previous data point as the interval range, and the data value in this range is taken.

Quick Filter¶

Custom Filter Fields¶

It supports editing Quick Filter to add new Fields in the explorer. Two configuration modes are supported: spatial filter items and personal filter items.

Preset fields in shortcut filtering is available. The newly added fields default to the field type in field management. If there is no field type in field management, it defaults to text format.

Operating Instructions¶

Filtering History¶

Filtering History, where you can view filter and searching history, can be applied to different explorers in the current workspace.

• Open filtering history: you can quickly open filter history by clicking the expansion icon in the lower-right corner of the explorer, or directly through the shortcut key (Mac OS: shift + cmd + k/Windows: shift + ctrl + k);
• Close filtering history: click the close button x or use the esc button to close the filter history.

Note: Filtering history only supports saving the current user's search criteria in the local browser.

Operating Instructions¶

Guance saves up to 100 search criteria in the explorer filter history. You can switch keys (↑ ↓) up and down on the keyboard to switch and select search criteria, and then click the keyboard enter to add to the filter.

• Fixed to Filter: The mouse is placed on the screening history, and the top search criteria can be set through the Fixed to Filter button on the right;
• Add to Filter: Click search criteria to add to the explorer for filtering, which supports multiple choices;
• Cancel Filter: After adding to the filter, click Search Criteria again to cancel the filter.

• Apply filter history in different explorers: Filter history is saved in the log explorer and can be used directly in other explorers.

Time Control¶

Guance supports controlling the data display range of the current explorer through time control. You can manually enter the time range, quickly select the built-in time range of the current explorer, or set the time range by customization.

Enter Time Range Manually¶

The time control supports interval display by default, and you can click the time control to view the format of manually input time range, including Dynamic Time and Static Time. After input, Enter or Click any blank area can filter and view the corresponding data according to the input time range.

Quick Filter Time Range¶

You can click More in the time control to quickly select the corresponding time range for data viewing. A variety of shortcut filter time ranges are preset in the time control, including "last 15 minutes, last 1 hour, last 1 day, etc." in the drop-down list and "30s, 45m, 3d, etc." in the dynamic time.

The dynamic time can be linked with the content of the input box in real time, and the data content of the corresponding time range can be viewed by clicking.

Custom Time Range¶

In addition to the preset time range, you can click Custom Time in the time control to select a time range, including date and specific time, and click Apply to filter data according to the customized time range.

Time Range of URL¶

In addition to the time range selection provided by the time control, Guance also supports directly modifying the time range of the time parameter of the current workspace explorer in the URL of the browser for data query. Four units of seconds, minutes, hours and days are supported, such as time=30s, time=20m, time=6h, time=2d, etc.

As shown in the following figure, modify time=2h in the browser, and the explorer displays the data of the last 2 hours.

Lock Time Range¶

Guance supports in time control by clicking to lock the icon and set a fixed query time range, and all Explorers/Dashboards default to the current time range.

As shown in the following figure, if the lock time is "last 45 minutes", all Explorers/Dashboards will query and display the data of "last 45 minutes" according to the current lock time.

Set Time Zone¶

Guance supports setting the current display time zone in the time control, thereby switching to the corresponding workspace time zone to view the data.

Enter time control > Change t9ijme settings:

• The default display is Browser Time, that is, the time detected by the local browser;
• After Owner or Administrator sets Workspace Time Zone, members can select the configured workspace time zone.

You can also modify it in Account Management.

Explorer Auto Refresh¶

In Guance workspace, click Account to turn on/off Explorer Auto Refresh.

• Open: The data of the explorer is automatically refreshed according to the default data refresh time of 30 seconds of the time control. For example, if you select the last 15 minutes, refresh once according to 30 seconds to display the data of the last 15 minutes.
• Close: When the time control of the explorer enters, turn off the automatic refresh for 30 seconds. If you select the last 15 minutes, the content data of the absolute time of the 15 minutes will be displayed without automatic refresh. You can click the Play button to refresh and view the data of the last 15 minutes.

Note: Explorer automatic refresh only works for local browsers.

Click the Pause button to exit the real-time data refresh mode and lock the current time range to absolute time.

Display Column¶

Explorers support:

• selecting the number of rows to display to expand the view log Message data;
• clicking Column to add, edit, delete and drag display columns;
• selecting and adding display columns by switching keys up and down on the keyboard;
• searching keywords in Column;
• customizing display columns as preset fields in Column. After cutting fields and reporting data through Pipeline, the reported data can be directly displayed.

Add Column¶

In the explorer display column, matching search for input fields is supported and the first searched field is selected by default. You can select and addi display columns by switching keys up and down (↑ ↓) on the keyboard.

If the input field does not exist, it prompts Create and add display column, which will be used as default field after creation, and the reported data can be directly displayed after cutting the field and reporting the data through Pipeline.

Operating Instructions¶

In the explorer list, when the mouse is placed on the display column, you can click the Settings button of the display column, which supports the following operations:

If the contents of the displayed column are not completely displayed, it is supported to hover on the dividing line on the right side of the displayed column and double-click to expand the contents, as shown in the source column in the following figure.

Save Snapshot¶

In Explorers, You can perform a series of operations as mentioned above and Save Snapshot of the data content displayed by the current explorer.

For more details on snapshot usage, refer to the documentation Snapshot.

Export¶

In the explorer, you can search and filter the currently displayed data, select the time range, add viewing columns and other operations, and then click the Settings button on the right side of the explorer to export the data content currently displayed in the explorer.

It supports Export to CSV File, Export to Dashboard and Export to Notes for data viewing and analysis.

Chart¶

• Chart Export: In the explorer chart, you can click to export or copy the chart to the dashboard and notes;
• Chart Time Interval: In the explorer chart, you can select the chart time interval to view the corresponding chart data.