FuseQL Examples

Here are some practical examples on how to use the Kloudfuse log searching query language, FuseQL.

Count All Logs

count of``all logs``Everything``top``10 5s

* | timeslice 5s | count by (_timeslice)

fuseqlCopied!

This analysis works well for the following use cases:

• Activity Patterns: Examining logs over a time range can help spot patterns in system usage, traffic, or performance.
• Scaling Decisions: Consistent spikes in traffic can guide decisions to scale resources.
• Impact of Changes or Deployments: After updates, logs can help ensure no unexpected issues arise.

Count of All Fingerprints

count of``all fingerprints``Everything``top``10 30s

* | timeslice 30s | count_unique(fingerprint) by (_timeslice)

fuseqlCopied!

This analysis works well for the following use cases:

• Identify Unexpected Usage Patterns: Spotting changes in user fingerprints can indicate new usage trends.
• Spot New Problems Early: A rise in fingerprint diversity may highlight emerging issues.

Count of All Logs Grouped by Level

count of``all logs``core:level``top 10``30 s

* | timeslice 30s | count by (_timeslice, level)

fuseqlCopied!

This analysis works well for the following use cases:

• Spot Spikes in Errors or Warnings: Increases in ERROR or WARN logs indicate issues in the system.
• Monitor System Usage Trends: INFO logs can track user activity and system performance.

Count of All Fingerprints Grouped by Source

count of``all fingerprints``Core:source``top``10``5s

* | timeslice 5s | count_unique(fingerprint) by (_timeslice, source)

fuseqlCopied!

This analysis works well for the following use cases:

• Source-Level Diagnosis: Identifying which parts of the system generate specific logs can reveal root causes.
• Resource Allocation and Scaling: Understanding resource usage from specific sources helps target scaling decisions.

Average of a Duration/Number Facet

avg of``@*:duration``Everything``top``10``5s

* | timeslice 5s | avg(@duration:duration_seconds) by (_timeslice)

fuseqlCopied!

This analysis works well for the following use cases:

• Identify Bottlenecks and Latency Trends: Monitoring duration metrics can unveil performance issues.
• Estimate Resource Requirements: Understanding average process durations assists in planning resource allocations.

Error Rate Formula

FILTER a

Core:level="error"

fuseqlCopied! + count of``all logs``Everything``top``10``5s

FILTER b Nothing

count of``all logs``Everything``top``10``5s

FORMULA a/b

This analysis works well for the following use cases:

• Failure Detection: Monitoring error rates can rapidly signal system failures.
• Trend Analysis: Observing gradual changes in error rates can reveal underlying system issues.

Anomaly on Count of Error Logs

Core:level="error"

fuseqlCopied!

count of``all logs``Everything``2m``anomalies``agile-robust``hourly``1

This analysis works well for the following use case:

• Anomaly Detection: Identifying sharp spikes in error logs can indicate critical issues needing immediate attention.

Outlier

This analysis helps in monitoring error logs across various sources within a distributed system, allowing teams to detect components that may require immediate investigation.

Log Math Operator to Scale the Y-Axis Down

This analysis can:

• Compress wide ranges of values to make data trends more comparable.
• Reduce the impact of extreme outliers, revealing subtle trends.