Phase 1 Table pattern

Core features

• Direct data access: Provides direct access to a dataset and returns an executable SPL query.

• Full control: Provides full control over the query logic and data processing flow.

• Storage transparency: Automatically handles differences between storage classes, such as MetricStore and LogStore.

• Field mapping: Automatically applies the field mapping rules defined in the dataset.

Scenarios

• You need precise control over query logic.

• You do not need high-level abstractions of entity relationships.

• You require high-performance data access.

• You have specific data processing and data analytics needs.

Get metrics data

.metric_set with(
    domain='domain_name', 
    name='dataset_name', 
    source='metrics', 
    metric='metric_name', 
    [other_optional_parameters]
)

.metric_set with(
    domain='rum', 
    name='rum.metric.api', 
    source='metrics', 
    metric='api_request_duration',
    aggregate=false
)

.metric_set with(
    domain='apm', 
    name='apm.metric.apm.operation', 
    source='metrics', 
    metric='request_count',
    query_type='range',
    step='1m',
    aggregate=true,
    aggregate_labels=['service', 'operation'],
    query='service_id = "hwx28v3j7p@9949e3dbf79e9a082105c"'
)

.metric_set with(
    domain='apm',
    name='apm.metric.apm.service',
    source='metrics',
    metric='error_rate',
    step='1m',
    aggregate='true'
  )
| extend slice_index = find_first_index(__ts__, x -> x > 1756904640000000000)
| extend len = cardinality(__ts__)
| extend ret = series_cnn_anomalies(__value__)
| extend anomalies_score_series = ret.anomalies_score_series, anomalies_type_series = ret.anomalies_type_series, error_msg = ret.error_msg
| project __labels__, __name__, __ts__, __value__, anomalies_score_series, anomalies_type_series, error_msg,len,slice_index
| extend __ts__ = slice(__ts__, slice_index, len - slice_index), __value__ = slice(__value__, slice_index, len - slice_index), anomalies_score_series = slice(anomalies_score_series, slice_index, len - slice_index), anomalies_type_series = slice(anomalies_type_series, slice_index, len - slice_index)
| extend anomay_cnt = CARDINALITY(FILTER(anomalies_score_series, x -> x > 0.5)), anomaly_sorce = array_sum(FILTER(anomalies_score_series, x -> x > 0.5))
| extend sort_score = anomaly_sorce / cast(anomay_cnt as double) 
| sort sort_score desc , anomay_cnt desc

Get label values (labels)

.metric_set with(
    domain='domain_name', 
    name='dataset_name', 
    source='labels', 
    label='label_name', 
    [other_optional_parameters]
)

.metric_set with(
    domain='apm', 
    name='apm.metric.apm.operation', 
    source='labels', 
    label='rpc',
    query='service_id = "hwx28v3j7p@9949e3dbf79e9a082105c"'
)

Description

Query log data in a LogSet, with support for full-text indexing, field filtering, and structured queries.

SPL syntax

.log_set with(
    domain='domain_name', 
    name='dataset_name', 
    [other_optional_parameters]
)

Parameters

Query example

• Query logs where level = "ERROR" and service = "order-service".

.log_set with(
    domain='apm', 
    name='apm.log.app',
    query='level = "ERROR" and service = "order-service"'
)

Description

Query distributed tracing data in a TraceSet, with support for trace analysis, Span retrieval, and App Performance Analytics.

SPL syntax

.trace_set with(
    domain='domain_name', 
    name='dataset_name', 
    [other_optional_parameters]
)

Parameters

Query example

• Query traces where service = "order-service" and duration > 1000.

.trace_set with(
    domain='apm', 
    name='apm.trace.span',
    query='service = "order-service" and duration > 1000'
)

Description

Query event data in an EventSet, including alert events, status change events, and business events.

SPL syntax

.event_set with(
    domain='domain_name', 
    name='dataset_name', 
    [other_optional_parameters]
)

Parameters

Query example

• Query events where severity = "P1" and status = "firing".

.event_set with(
    domain='apm', 
    name='apm.event.alert',
    query='severity = "P1" and status = "firing"'
)

Description

Query performance profiling data in a ProfileSet, with support for CPU profiling, memory profiling, and custom performance analytics.

SPL syntax

.profile_set with(
    domain='domain_name', 
    name='dataset_name', 
    [other_optional_parameters]
)

Parameters

Query example

• Query performance profiling data where service_id = "order-service" and profile_type = "cpu".

.profile_set with(
    domain='apm', 
    name='apm.profile.cpu',
    query='service_id = "order-service" and profile_type = "cpu"'
)

Automatic storage routing

The Phase 1 Table pattern automatically routes storage based on UModel definitions:

1. Storage class detection: Automatically detects storage classes such as MetricStore and LogStore.

2. Connection parameters: Automatically obtains connection parameters such as region and project.

3. Query transformation: Transforms UModel queries into the query syntax of the corresponding storage.

Field mapping mechanism

The system automatically applies the field mappings defined in DataLink and StorageLink:

# Example: Field mapping configuration
fields_mapping:
  'service_id': 'acs_arms_service_id'  # UModel field -> Storage field
  'operation': 'rpc'
  'region': 'acs_arms_region_id'

Query optimization

• Index utilization: Automatically uses the index attributes of the storage to optimize queries.

• Concurrency control: Supports high-concurrency query requests.

• Result caching: Caches frequently used query results to improve response speed.

Error handling

• Parameter verification: Strictly verifies the validity of input parameters.

• Storage exceptions: Gracefully handles storage connection and query exceptions.

• Format validation: Validates the correctness of the returned data format.