This topic describes the query languages and limits of time series search and analysis.

Log Service supports the following query languages for time series search and analysis:
  • SQL: You can use the SQL query language to search and analyze time series data based on the time series data format.
  • Combination of SQL and PromQL: This combination provides an easy-to-use method to search and analyze time series data. The combination is implemented by using nested queries. PromQL is the query language that is provided by Prometheus. For more information, see the Prometheus documentation.

SQL query language

Sample query statements:
  • Query all data records from a Metricstore.
    *| SELECT * FROM "my_metric_store.prom" WHERE __name__ != '' 
  • Query the data records in which the value of the __labels__, 'domain' field is www.example.com and obtain the sum of the __value__ field.
    *| SELECT sum(__value__) FROM "my_metric_store.prom" WHERE element_at(__labels__, 'domain')='www.example.com' 
  • Query the data records in which the value of the __labels__, 'domain' field is www.example.com, obtain the sum of the __value__ field, and aggregate data records by hour.
    *| SELECT sum(__value__),date_trunc('hour', __time_nano__/1000000) as t
    FROM "my_metric_store.prom" 
    WHERE element_at(__labels__, 'domain')='www.example.com'
    GROUP BY t
    ORDER BY t DESC
Description:
  • The SQL search and analysis syntax for time series data is the same as that for log data. For more information, see Log analysis. For SQL queries on time series data, the table name in the FROM clause must be {metrics_store_name}.prom. {metrics_store_name} indicates the name of the Metricstore that you want to query.
    Note You must enclose the table name in double quotation marks (").
  • You can use the element_at() function to obtain the value of a key from the __labels__ field, for example, element_at(__labels__, 'key').
  • For information about the table schema, see Format.

Combination of SQL and PromQL

If you use the combination of SQL and PromQL, you can also use the advanced features such as the machine learning syntax and functions and Security check functions.
Note If you use the combination of SQL and PromQL, the table name in the FROM clause must be metrics.

Log Service supports five PromQL functions: promql_query, promql_labels, promql_label_values, and promql_series functions. These functions can only be invoked on the Search & Analysis page of a specific Logstore. The following table describes the functions.

Function Description Example
promql_query(string) Evaluates an instant query on the latest value. This function is the same as the /query API for which the parameter settings are query=<string>. *| SELECT promql_query('up') FROM metrics
promql_query_range(string, string) Evaluates a query over a range of time. This function is the same as the /query_range API for which the parameter settings are query=<string> and step=<duration>. *| SELECT promql_query_range('up', '5m') FROM metrics
promql_labels() Returns all label keys. *| SELECT promql_labels() FROM metrics
promql_label_values(string) Returns the values of a label key. *| SELECT promql_label_values('__name__') FROM metrics
promql_series(string) Return the matching time series. *| SELECT promql_series('up') FROM metrics
Each PromQL function is similar to a user-defined table generating function (UDTF) and returns a table.
  • The following table describes the schema of the table that is returned by the promql_query(string) or promql_query_range(string, string) function.
    Field Type Description
    metric varchar The metric name of the time series. If the Group By clause is included in the query statement, this field may be empty.
    labels map<varchar, varchar> The labels.
    time bigint The timestamp.
    value double The value that corresponds to the timestamp.
  • The following table describes the schema of the table that is returned by the promql_labels() or promql_label_values(string) function.
    Field Type Description
    label varchar Label Key
  • The following table describes the schema of the table that is returned by the promql_series(string) function.
    Field Type Description
    series map<varchar, varchar> The time series.

Limits

  • A Metricstore only supports the query API operations of Prometheus, such as /query and /query_range. Other API operations such as /admin API, /alerts API, and /rules API are not supported.
  • If you use the combination of SQL and PromQL for search and analysis, a maximum of 11,000 timestamps are returned for a query.
  • If you use the combination of SQL and PromQL for search and analysis, the metric name and label names must comply with the naming conventions. For more information, see Metric identifier.