Additional examples

Here are some practical examples on how to use the Kloudfuse log searching query language, FuseQL.

Count all logs

• Query Builder

• Advanced Search

count of``all logs``Everything``top``10 5s

* | timeslice 5s | count by (_timeslice)

This analysis works well for the following use cases:

• Activity Patterns: Analyzing logs over a time range can help spot patterns in system usage, traffic, or performance.
• Scaling Decisions: Predicting when the system requires additional capacity based on log patterns.
• Impact of Changes or Deployments: Analyzing logs after changes to ensure no unexpected issues arise.

Count all fingerprints

• Query Builder

• Advanced Search

count of``all fingerprints``Everything``top``10 30s

* | timeslice 30s | count_unique(fingerprint) by (_timeslice)

This analysis works well for the following use cases:

• Identify Unexpected Usage Patterns: Tracking changes in user-related fingerprints over time.
• Spot New Problems Early: Identifying a sudden increase in the count of different kinds of fingerprints.

Count all logs grouped by level

• Query Builder

• Advanced Search

count of``all logs``core:level``top 10``30 s

* | timeslice 30s | count by (_timeslice, level)

This analysis works well for the following use cases:

• Spot Spikes in Errors or Warnings: Monitoring logs by severity level to detect issues proactively.
• Monitor System Usage Trends: Analyzing system operational details through log levels.

Count all fingerprints grouped by source

• Query Builder

• Advanced Search

count of``al lfingerprints``Core:source``top``10``5s

* | timeslice 5s | count_unique(fingerprint) by (_timeslice, source)

This analysis works well for the following use cases:

• Source-Level Diagnosis: Understanding log patterns by grouping them using their sources.
• Resource Allocation and Scaling: Targeting scaling or resource allocation based on log distribution.

Average of a duration or number facet

• Query Builder

• Advanced Search

avg of``@*:duration``Everything``top``10``5s

* | timeslice 5s | avg(@duration:duration_seconds) by (_timeslice)

This analysis works well for the following use cases:

• Identify Bottlenecks and Latency Trends: Identifying performance trends over time.
• Estimate Resource Requirements: Planning for resource scaling based on average duration evaluations.

Error rate formula

• FILTER a

• FILTER b

• FORMULA a/b

Core:level="error"

This analysis works well for the following use cases:

• Failure Detection: Identifying spikes in error rates to catch component failures or malfunctions.
• Trend Analysis: Monitoring gradual increases in error rates over time to detect potential issues.

Anomaly on count of error logs

• Query Builder

• Advanced Search

Core:level="error"

This analysis works well for the following use case:

• Anomaly Detection: Detecting spikes in error log counts that deviate from expected ranges.

Outlier

level="error" | timeslice 120s | count by (_timeslice, kube_namespace) | outlier (_count) by 120s, model=dbscan, eps=3

This analysis works well for the following use case:

• Identify Poor Performance by Source: Monitoring error log rates by components to identify root causes for issues.