General functions
Functions with a general purpose.
classicEntitySelector
Returns entities matching the specified entity selector.
You can use the returned entity IDs to filter entities based on their ID. The classicEntitySelector
function is only supported as in(field, classicEntitySelector(".."))
.
To learn more, see entity selector.
Syntax
classicEntitySelector(entitySelector [, field])
Parameters
Parameter | Type | Description | Required |
---|---|---|---|
entitySelector | string | The entity selector string. See limitations. | required |
field | string | The entity property to be returned. If not defined, the entity IDs will be returned. | optional |
Returns
The data type of the returned value is array
.
Examples
Example 1
In this example, the query fetches all logs for pod running on the Kubernetes namespace CLOUD_APPLICATION_NAMESPACE-1B6CFC8C542A2273
.
fetch logs| filter in(dt.entity.cloud_application_instance, classicEntitySelector("type(CLOUD_APPLICATION_INSTANCE),toRelationShip.IS_NAMESPACE_OF_CAI(type(CLOUD_APPLICATION_NAMESPACE), entityId(CLOUD_APPLICATION_NAMESPACE-1B6CFC8C542A2273))"))
entityAttr
Returns the attribute value for an entity.
If you do not define an alias for a field added using the entityAttr
function, the default field name will be <entity-type>.<attribute-name>
.
Syntax
entityAttr(expression, name [, type])
Parameters
Parameter | Type | Description | Required |
---|---|---|---|
expression | entity type | The expression to determine the entity ID. | required |
name | string | The entity attribute name that shall be queried. | required |
type | string | The entity type that shall be queried. | optional |
Returns
The data type of the returned value depends on the queried entity attribute.
Examples
Example 1
timeseries avg(dt.host.cpu.idle), by:{ dt.entity.host }| fieldsAdd entityAttr(dt.entity.host, "tags")
entityName
Returns the name of an entity.
If you do not define an alias for a field added using the entityName
function, the default field name will be <entity-type>.name
.
Syntax
entityName(expression [, type])
Parameters
Parameter | Type | Description | Required |
---|---|---|---|
expression | entity type | The expression to determine the entity ID. | required |
type | string | The entity type that shall be queried. | optional |
Returns
The data type of the returned value is a string
.
Examples
Example 1
fetch bizevents| fieldsAdd entityName(dt.entity.host)
in
Tests if a value is a member of an array
.
The in
function supports multiple haystacks and allows arrays in all arguments.
Syntax
in(needle, haystack, …)
Parameters
Parameter | Type | Description | Required |
---|---|---|---|
needle | array, boolean, double, duration, ip, long, record, string, timeframe, timestamp | The element(s) to search for (the needle). | required |
haystack | array, boolean, double, duration, ip, long, record, string, timeframe, timestamp | The elements to search for the needle element (the haystack). | required |
Returns
The data type of the returned value is boolean
.
Examples
Example 1
data record(a = "java"),record(a = "python"),record(a = "dotnet"),record(a = "rust")| fieldsAdd in(a, "java", "go", "rust")
Query result:
a | in(a, {"java", "go", "rust"}) |
---|---|
|
|
|
|
|
|
|
|
Example 2
data record(technologies = array("Java", "Spring", "Jetty")),record(technologies = array("Python", "Flask")),record(technologies = array("Java", "Hibernate"))| fieldsAdd in(technologies, "Python", "Hibernate"),in(technologies, array("Spring", "Flask"))
Query result:
technologies | in(technologies, {"Python", "Hibernate"}) | in(technologies, array("Spring", "Flask")) |
---|---|---|
|
|
|
|
|
|
|
|
|
record
Creates a record
from the keys and values of the parameter.
Syntax
record(expression, …)
Parameters
Parameter | Type | Description | Required |
---|---|---|---|
expression | array, boolean, double, duration, ip, long, record, string, timeframe, timestamp | An expression to add to the record. | required |
Returns
The data type of the returned value is record
.
Examples
Example 1
data record(executable = "java", technologies = array("Java", "Spring", "Jetty")),record(executable = "python", technologies = array("Python", "Flask")),record(executable = "java", technologies = array("Java", "Jetty", "Hibernate"))
Query result:
executable | technologies |
---|---|
|
|
|
|
|
|