Chart Query¶
After selecting a chart, you can use various query methods to perform in-depth queries and analysis on different categories of data. These query methods help intuitively display numerical information in the chart and reveal important relationships between data.
Query Methods¶
A single chart supports the following query methods simultaneously:
- Simple Query
- Expression Query
- DQL Query
- PromQL Query
- Data Source
Switching Query Methods
Simple Query and DQL Query can be switched via the button. After switching, if it cannot be parsed or parsed incompletely:
- If no operation has been performed under Simple Query, switching back to DQL Query will show the previous DQL query statement.
- If the query statement has been adjusted under Simple Query, switching back to DQL Query will parse according to the latest Simple Query.
Simple Query¶
Queries data from different data sources and displays it through charts by selecting aggregation functions, grouping labels, Labels, filter conditions, etc.
Data Sources¶
Data comes from a series of combinations including Metrics, logs, basic objects, resource catalog, events, APM, RUM, security checks, network, Profile, cloud billing.
| Source | Description |
|---|---|
| Metrics | You need to select Measurement and Metrics, one Measurement can contain multiple metrics. |
| Other Types | Basic objects, resource catalog, security checks: Need to select Resource Class and Properties/Labels; Logs, events, APM, RUM: Need to select Source and Properties/Labels. |
When Logs are Used as Data Source
Different indexes can be selected for corresponding log content, default index is default.
For more details, refer to the documentation Log Index.
Multiple Queries¶
Select multiple query conditions, and data is grouped and displayed according to the selected filters.
To easily distinguish the display of query results, click the AS button to add an alias for each query condition.
If you want the added aliases to be directly displayed on the chart, click the right-hand side Legend > Position, and choose bottom or right.
Label Filtering¶
Prerequisite: Labels have already been set for hosts in Infrastructure > Hosts.
In fx > Label Filtering, select or exclude host Label properties for filtering display.
Adding Filters¶
Click the icon to add filter conditions to the current query.
Multiple filter conditions can be added under a single query, with each condition having either AND or OR relationships.
| Filter Condition | Description | Supported Condition Types |
|---|---|---|
= |
Equals | Integer, Float, String |
!= |
Not equal | Integer, Float, String |
>= |
Greater than or equal | Integer, Float, String |
<= |
Less than or equal | Integer, Float, String |
> |
Greater than | Integer, Float, String |
< |
Less than | Integer, Float, String |
match |
Contains | String |
not match |
Does not contain | String |
wildcard |
Fuzzy match (supports log data except Metrics) | String |
not wildcard |
Fuzzy non-match (supports log data except Metrics) | String |
Functions¶
Click the fx icon to add function calculations for indicators and other data sources.
Rollup Function¶
This slices data into specified time intervals and calculates and returns data for each interval.
Note:
- In time series charts, after selecting this function and the aggregation method, go to Advanced Configuration to choose the time interval;
- In non-time series charts, after selecting this function, you can choose aggregation methods such as
avg,sum,min, and time intervals including auto, 10s, 20s, 30s, 1m, 5m, 10m, 30m, 1h, 6h, 12h, 1d, 7d, 30d (interval); - Only supports Metrics data queries; simple mode does not support choosing the Rollup function for other data queries;
- The Rollup function does not support adding multiple instances.
For more details, refer to Rollup Function.
Transformation Functions¶
Also known as outer functions, UI mode supports the following functions:
Transformation Function (Outer Function) |
Description |
|---|---|
cumsum |
Cumulative sum of processed sets |
abs |
Calculate the absolute value of each element in the processed set |
log2 |
Calculate the logarithm of each element in the processed set with base 2, requires at least one row, otherwise returns null |
log10 |
Calculate the logarithm of each element in the processed set with base 10, requires at least one row, otherwise returns null |
moving_average |
Calculate the moving average of the processed set, window size must be no less than the number of rows in the processed set, otherwise returns null |
difference |
Calculate the difference between adjacent elements in the processed set, requires at least one row, otherwise returns null |
derivative |
Calculate the derivative of adjacent elements in the processed set, differentiation time unit is seconds (s) |
non_negative_derivative |
Calculate the non-negative derivative of adjacent elements in the processed set, differentiation time unit is seconds (s) |
non_negative_difference |
Calculate the non-negative difference between adjacent elements in the processed set, requires at least one row, otherwise returns null |
series_sum |
When grouping produces multiple series, merge them into one series based on timestamps. Sum values of the same timestamp across multiple series, requires at least one row, otherwise returns null |
rate |
Calculate the rate of change of a metric over a certain time range, suitable for slowly changing counters. Time unit is seconds (s) |
irate |
Calculate the rate of change of a metric over a certain time range, suitable for rapidly changing counters, time unit is seconds (s) |
In DQL mode, more outer functions are supported, refer to DQL Outer Functions.
Aggregation Functions¶
UI mode supports selecting aggregation methods to return result values.
| Aggregation Function | Description |
|---|---|
last |
Returns the value of the latest timestamp |
first |
Returns the value of the earliest timestamp |
avg |
Returns the average value of the field. Parameter is only one field name |
min |
Returns the minimum value |
max |
Returns the maximum value |
sum |
Returns the sum of field values |
P50 |
Returns the 50th percentile value of the field |
P75 |
Returns the 75th percentile value of the field |
P90 |
Returns the 90th percentile value of the field |
P99 |
Returns the 99th percentile value of the field |
count |
Returns the count of non-null field values |
count_distinct |
Counts the number of distinct values in a field |
difference |
Returns the difference between consecutive time values in a field |
derivative |
Returns the rate of change of a field within a series |
non_negative_derivative |
Returns the non-negative rate of change of a field within a series |
In DQL mode, more aggregation functions are supported, refer to DQL Aggregation Functions.
Window Functions¶
Window functions use selected time intervals as windows (record sets), combining aggregation functions to perform statistical calculations on each record, supporting intervals of 1 minute, 5 minutes, 15 minutes, 30 minutes, 1 hour, 3 hours, 6 hours, 12 hours, 24 hours.
Note: Window function query results do not change the number of records; the number of existing records remains the same after executing the function.
No Data Fill¶
Set the filling method for null values. After setting, it is displayed as fill in queries, including three types:
| Function | Description |
|---|---|
| Previous Value Fill (previous) | Convert null values to the previous value. |
| Linear Fill (linear) | Perform linear function calculation on null values and fill them. |
| Value Fill | Customizable fill value. |
Advanced Functions¶
Advanced functions are mainly used for further function calculations on data queried by DQL and provide intuitive time series chart displays. Guance time series charts support custom functions for secondary processing and returning data results.
For more details, refer to Advanced Functions.
Hide Query¶
Click the icon to hide the query result of that line on the chart.
As shown below, the system loads data only displaying 1m and 15m query results, while the 5m system load query result is hidden and cannot be viewed on the chart.
Expression Query¶
Calculate using added expressions. If the expression query contains multiple query statements, grouping tags need to remain consistent. In expression calculations, if Query A has units, the result of operations involving Query A and numbers also retains the units. For example, if A's unit is KB, then A+100 also has the unit KB.
DQL Query¶
Guance supports switching to DQL mode to manually input DQL statements for chart queries.
A single chart supports multiple DQL queries simultaneously. For more details, refer to DQL Query.
PromQL Query¶
Guance supports writing PromQL queries to fetch data.
| Query Type | Description |
|---|---|
| Range Query | Run queries over a time range |
| Instant Query | Run queries for a single point in time |
PromQL is added by default as a text box input. In this input box, both simple PromQL queries and expression queries can be entered.
Click to learn about Comparison of DQL and Other Query Languages; or visit PromQL.
Add Data Source¶
Perform operations like filtering, searching, and aggregating data stored in databases.
Specific configuration methods see External Function Configuration.