Entity Explorer overview

In observability, an entity is any object that can be independently identified and monitored. Examples include:

• Infrastructure entities: hosts, containers, network devices, and storage systems.

• Application layer entities: microservices, API operations, database instances, and message queues.

• Business entities: user sessions, business processes, and transaction orders.

• O&M entities: deployment environments, code repositories, and O&M engineers.

The core value of entity queries is breaking down the siloed views of traditional monitoring, which are often organized by product or metric, to build a panoramic catalog of entity assets. You can use entity queries to achieve the following goals:

• Unified inventory: Provides a categorized inventory of all entity types and instances from UModel, organized by domain and type.

• Fast retrieval: Use the USearch query language to quickly locate entities with features like full-text search, exact match, and conditional filtering.

• Correlation analysis: Start with any entity to explore its status, performance metrics, associated logs, Tracing Analysis, and topological relationships, for one-stop problem diagnosis and analysis.

1. Entity overview

Entity Explorer associates all entities defined in UModel with their corresponding Cloud Monitor 2.0 apps based on domain and entity type. Ingested entities are categorized under their respective apps.

1. View the total count of all entities.

2. View the instance count for each entity type.

3. For cloud product entities, verify whether all entities from that cloud product have been fully ingested.

4. Click an entity to select its domain and entity type for filtering.

The Entity Explorer page has tabs at the top, including All Entities, Recently Accessed, Application List, K8s Clusters, ECS List, RDS List, RUM Applications, and Favorite Entities. The main section displays ingested entities organized by categories such as Application Monitoring, AI Application Observability, Container Insight, Database Insight, ECS Insight, and Other Entities, along with the instance counts for each entity type. A green Fully Ingested label indicates the full ingestion status for cloud product entities.

2. Entity query and display

1. Query language introduction: Entity Explorer supports two query languages: USearch and SPL. You can switch between them in the upper-left corner of the entity query page. For more information, see USearch entity query language and SPL data processing language.

2. In USearch mode, you can select a domain and entity type in the upper-left corner. This option is not available in SPL mode.

3. USearch query results are displayed by entity type and include the entity's Primary Key and Name fields, as well as its golden metrics.

For example, for an APM application service, the results table includes attribute columns such as probe type, language, and region, in addition to the Primary Key and Name fields. The golden metrics columns include Average Requests, Average Errors, and Average Latency, each accompanied by a mini trend sparkline.

4. SPL query results are not displayed by entity type. Instead, they show specific fields.

For example, in SPL mode, enter the query .entity with(domain='apm', type='apm.service', query='service') | limit 0,100 and click the Query button. The results are displayed in a table that shows the attribute information for all service entities in the APM domain, including fields like service, service_id, source, telemetry_client, region_id, language, __domain__, __entity_type__, __method__, and __entity_id__. You can switch between the Table and Topology views by using the buttons on the right.

3. Topology view

The Topology view visualizes your system architecture, displaying all ingested entity categories, their counts, and their dependencies in your cloud environment. This global architecture view provides an intuitive way for O&M and development teams to understand the system architecture, supporting service governance and dependency management.

1. Homepage.

On the All Entities tab, click Topology in the upper-right corner to view the total count and relationships of all ingested entity types in the current workspace.

2. Toolbar (upper-left corner).

The toolbar components support Zoom and Center operations.

3. Minimap (lower-right corner).

The minimap allows you to quickly drag the viewport to navigate the graph.

4. Focus interaction.

Nodes support a Focus operation. When you focus on a node, the topology graph displays only the ancestor and descendant nodes of the selected node, clarifying dependency relationships and propagation paths.

In focus mode, click Unfocus in the toolbar to return to the full topology graph.

5. Entity list display.

Clicking an entity node opens a panel on the right that lists all ingested instances of that entity type.

6. Query.

This feature integrates with USearch queries to show the topological relationships of all entities that match the search string.

In USearch query mode, clicking a node displays a list of all current query results.

Introduction

USearch is a specialized SPL syntax for entity queries that supports multiple query modes, including full-text search, exact match, and conditional filtering. Deeply integrated into Cloud Monitor 2.0, USearch provides features such as global quick searches, field drill-downs, and metric drill-downs.

Basic syntax

.entity with(
    domain='domain_pattern',     -- Filter by domain
    type='type_pattern',         -- Filter by type
    query='search_query',        -- Query condition
    topk=10                      -- Maximum number of returned items
)

Core features

• Full-text search: Supports keyword searches across all fields.

• Field-specific queries: Supports precise searches within specific fields.

• Logical combinations: Supports logical operators such as AND, OR, and NOT.

• Smart scoring and sorting: Ranks results based on relevance scoring using IDF and column weights.

• Special character handling: Automatically handles special characters in queries.

Use cases

-- Full-text search
.entity with(query='web service')
-- Field-specific search
.entity with(query='status:running')
-- Logical combination query
.entity with(query='environment:prod AND status:error')
-- Domain and type filtering
.entity with(domain='apm', type='apm.service', query='production')

For detailed syntax and usage of USearch, see USearch.

Introduction

The SPL syntax (SLS Processing Language) is a data processing language provided by Simple Log Service. It performs operations such as structured information extraction, field manipulation, and data filtering on raw data. SPL supports multi-level pipeline cascading, which allows for complex data processing and analysis.

How it works

SPL uses a pipeline processing architecture:

1. First-level pipeline: Index filtering conditions, such as a USearch query.

2. Subsequent pipelines: SPL commands for data processing.

3. Final output: The resulting data after SPL processing.

Core functions

-- Filter by condition
| where status = "error"
| where cpu_usage > 0.8
-- Filter by time range
| where __time__ > "2024-01-01 00:00:00"

-- Extract a field
| extend new_field = field1 + field2
-- Rename a field
| project-rename new_name = old_name
-- Select fields
| project field1, field2, field3

Using USearch with SPL

USearch can be used as a data source for SPL, enabling a complete workflow from entity query to data analysis:

-- Basic combination: Entity query + data processing
.entity with(domain='apm', type='apm.service', query='production')
| where language = 'java'