# FuseQL Examples

Here are some practical examples on how to use the Kloudfuse log searching query language, FuseQL.

## Count All Logs

`count of``all logs``Everything``top``10` 5s

```fuseql
* | timeslice 5s | count by (_timeslice)
```
fuseqlCopied!

This analysis works well for the following use cases:

- **Activity Patterns**: Examining logs over a time range can help spot patterns in system usage, traffic, or performance.
- **Scaling Decisions**: Consistent spikes in traffic can guide decisions to scale resources.
- **Impact of Changes or Deployments**: After updates, logs can help ensure no unexpected issues arise.

## Count of All Fingerprints

`count of``all fingerprints``Everything``top``10` 30s

```fuseql
* | timeslice 30s | count_unique(fingerprint) by (_timeslice)
```
fuseqlCopied!

This analysis works well for the following use cases:

- **Identify Unexpected Usage Patterns**: Spotting changes in user fingerprints can indicate new usage trends.
- **Spot New Problems Early**: A rise in fingerprint diversity may highlight emerging issues.

## Count of All Logs Grouped by Level

`count of``all logs``core:level``top 10``30 s`

```fuseql
* | timeslice 30s | count by (_timeslice, level)
```
fuseqlCopied!

This analysis works well for the following use cases:

- **Spot Spikes in Errors or Warnings**: Increases in `ERROR` or `WARN` logs indicate issues in the system.
- **Monitor System Usage Trends**: `INFO` logs can track user activity and system performance.

## Count of All Fingerprints Grouped by Source

`count of``all fingerprints``Core:source``top``10``5s`

```fuseql
* | timeslice 5s | count_unique(fingerprint) by (_timeslice, source)
```
fuseqlCopied!

This analysis works well for the following use cases:

- **Source-Level Diagnosis**: Identifying which parts of the system generate specific logs can reveal root causes.
- **Resource Allocation and Scaling**: Understanding resource usage from specific sources helps target scaling decisions.

## Average of a Duration/Number Facet

`avg of``@*:duration``Everything``top``10``5s`

```fuseql
* | timeslice 5s | avg(@duration:duration_seconds) by (_timeslice)
```
fuseqlCopied!

This analysis works well for the following use cases:

- **Identify Bottlenecks and Latency Trends**: Monitoring duration metrics can unveil performance issues.
- **Estimate Resource Requirements**: Understanding average process durations assists in planning resource allocations.

## Error Rate Formula

FILTER a
```fuseql
Core:level="error"
```
fuseqlCopied!
+
`count of``all logs``Everything``top``10``5s`

FILTER b
Nothing

`count of``all logs``Everything``top``10``5s`

FORMULA
`a/b`

This analysis works well for the following use cases:

- **Failure Detection**: Monitoring error rates can rapidly signal system failures.
- **Trend Analysis**: Observing gradual changes in error rates can reveal underlying system issues.

## Anomaly on Count of Error Logs

```fuseql
Core:level="error"
```
fuseqlCopied!

`count of``all logs``Everything``2m``anomalies``agile-robust``hourly``1`

This analysis works well for the following use case:

- **Anomaly Detection**: Identifying sharp spikes in error logs can indicate critical issues needing immediate attention.

## Outlier

This analysis helps in monitoring error logs across various sources within a distributed system, allowing teams to detect components that may require immediate investigation.

## Log Math Operator to Scale the Y-Axis Down

This analysis can:
- **Compress wide ranges of values** to make data trends more comparable.
- **Reduce the impact of extreme outliers**, revealing subtle trends.