Additional examples

Here are some practical examples on how to use the Kloudfuse log searching query language, FuseQL.

Count all logs

count of``all logs``Everything``top``10 5s

* | timeslice 5s | count by (_timeslice)

This analysis works well for the following use cases:

• Activity Patterns: Examining logs over a time range can help spot patterns in system usage, traffic, or performance.
• Scaling Decisions: Predicting when the system requires additional capacity based on log trends.
• Impact of Changes or Deployments: Analyzing logs generated at the time of deployment for unexpected issues.

Count all fingerprints

count of``all fingerprints``Everything``top``10 30s

* | timeslice 30s | count_unique(fingerprint) by (_timeslice)

This analysis works well for the following use cases:

• Identify Unexpected Usage Patterns: Tracking the changes in user-related fingerprints.
• Spot New Problems Early: Monitoring sudden increases in different kinds of fingerprints.

Count all logs grouped by level

count of``all logs``core:level``top 10``30 s

* | timeslice 30s | count by (_timeslice, level)

This analysis works well for the following use cases:

• Spot Spikes in Errors or Warnings: Detecting increases in logs classified as ERROR or WARN.
• Monitor System Usage Trends: Tracking general operational details through INFO logs.

Count all fingerprints grouped by source

count of``all fingerprints``Core:source``top``10``5s

* | timeslice 5s | count_unique(fingerprint) be (_timeslice, source)

This analysis works well for:

• Source-Level Diagnosis: Understanding which parts of the system create specific log patterns.
• Resource Allocation and Scaling: Identifying bottlenecks or resource contention issues.

Average of a duration or number facet

avg of``@*:duration``Everything``top``10``5s

* | timeslice 5s | avg(@duration:duration_seconds) by (_timeslice)

This analysis works well for the following use cases:

• Identify Bottlenecks and Latency Trends: Analyzing performance trends over time.
• Estimate Resource Requirements: Planning resources based on average durations.

Error rate formula

Core:level="error"

This analysis works well for:

• Failure Detection: Identifying system component failures through spikes in error rates.
• Trend Analysis: Monitoring gradual increases in error rates over time.

Anomaly on count of error logs

Core:level="error"

This analysis works well for:

• Anomaly Detection: Identifying sudden spikes in error logs that deviate from the norm.

Outlier

level="error" | timeslice 120s | count by (_timeslice, kube_namespace) | outlier (_count) by 120s, model=dbscan, eps=3

This analysis works well for:

• Identify Poor Performance by Source: Detecting outlier error logs across different components.

Log math operator to scale down the Y-axis

This analysis works well for:

• Compress wide ranges of values: Making comparisons easier.
• Reduce the impact of extreme outliers: Highlighting subtle trends.