DataPrime Quick-Start Guide
Namespaces
The user-data (JSON):
Engine-related event metadata. Ex - "timestamp", "severity", "logid", "priorityclass":
User-managed event labels. Flat, key/values (strings only) Known labels: "applicationname", "subsystemname", "category", "classname", "computername", "methodname", "threadid", "ipaddress":
Example keypaths
Example expressions
Refer to the key key
inside the key stats
and apply lowercase function to it:
The result of multiplying the value of 8 and the radius
key casted to number (does not work now will be fixed soon):
The logical timestamp of the event (any keypath is valid expression):
Operators syntax
Filter data matching expression-predicate:
- Ex:
Find entries containing search-string:
- Ex:
Find entries matching lucene-query:
- Ex:
Find entries containing search-string in given keypath:
- Ex:
Order entries by given expression:
- Ex:
Take first N entries:
- Ex:
Leave only the keypaths provided, discarding all other keys from an entry:
Cast any expression to one of the following types [bool, num, string]:
- Ex:
Extract parts of one keypath into new keypath using extractor-function:
- Ex:
- Creates field
"y"
of shape:{"name" : "foo" , "id" : "42"}
givenx:"Name:foo Id:42"
- Creates field
- Ex:
- Creates field
"y"
of shape:{"a" : "42", "b" : "11"}
givenx: "a=42 b=11"
- Creates field
- Ex:
- Creates field
"y"
of shape:{"a": 1, "b": true}
givenx:"{\\"a\\": 1, \\"b\\": true}"
(stringified json object)
- Creates field
Example queries
Select the 10 ‘successful’ logs ordered by department_id:
Find cx-cluster logs (without knowing the log structure):
Select 100 log messages along with 'processed’ statuses from ‘enrichment-ingest’ service where processed ≠ 0:
source logs
| lucene 'NOT log:"stderr F"'
| lucene 'log:"stdout F"'
| filter $d.kubernetes.labels.CX_SERVICE_NAME != 'enrichment-ingest'
| extract $d.log into $d.stats using regexp(e=/.*T?(?<processed>\\d+:\\d+:\\d+[.,]\\d+).*/)
| filter $d.stats.processed != '0'
| limit 100
[NEW] DataPrime now supports Data Aggregation, for more information and examples please refer to the DataPrime Cheat Sheet.