This topic describes how to configure a sankey diagram to display query results. It also includes examples.

Background information

The sankey diagram is a specific type of flow chart. It shows the flow from one set of values to another. Sankey diagrams are applicable to scenarios such as network traffic flows. A sankey diagram contains values of three fields: source, target, and value. The source and target fields describes the source and target nodes, and the value field describes the flows from the source node to the target node.

The basic elements of a sankey diagram are as follows:
  • Nodes
  • Edge
The sankey diagram has the following features:
  • The start flow is as large as the end flow. The overall width of all main edges is the same as that of all branch edges. This maintains the balance of the flow volume.
  • In a sankey diagram, different edges indicate the distribution of different flows. The width of an edge is proportional to the flow volume it represents.
  • The width of an edge between two nodes represents the flow volume in a state.
For example, the following data can be displayed in a sankey diagram.
source target value
node1 node2 14
node1 node3 12
node3 node4 5
... ... ...
The sankey diagram in the following figure shows the relationship between the data.Data relations in a sankey diagram

Procedure

  1. On the Search & Analysis page of a Logstore, enter a search and analytics statement in the search box, specify the time range, and then click Search & Analyze.
    The Chart tab is automatically displayed when a query is completed.
  2. Click Sankey diagram - 001 to display the query results in a sankey diagram.
  3. On the Properties tab on the right, configure the properties of the sankey diagram.
    Configuration item Description
    Start Column The start node.
    End Column The end node.
    Value Column The value that indicates the flow volume from the start node to the end node.
    Margin The distance of the axis to the borders of the chart, including Top Margin, Bottom Margin, Right Margin, and Left Margin.

Example of a simple sankey diagram

If a log entry contains the source, target, and value fields, you can use a Nested subquery statement to obtain the sum of all steamValue values. 
* | select sourceValue, targetValue, sum(streamValue) as streamValue from (select sourceValue, targetValue,
 streamValue, __time__ from log group by  sourceValue, targetValue, streamValue, __time__ order by __time__ desc) group by sourceValue,
 targetValue
Simple sankey diagram

Sankey diagrams for log data of requests based on Layer-7 load balancing

Log Service allows you to display query results of SLB Layer 7 access log in a sankey diagram.

* | select COALESCE(client_ip, slbid, host) as source, COALESCE(host, slbid, client_ip) as dest, sum(request_length) as inflow group by grouping sets( (client_ip, slbid), (slbid, host))Nested queries