This topic describes how to configure drill-down analysis for a chart of a Logstore. When you add a chart to a dashboard, you can modify the configurations in the drill-down list to obtain deeper data analysis results.

Drilling is an essential part of data analysis. This feature allows you to view more detailed information by moving to different layers of data. Drilling includes rolling up and drilling down. Rolling up allows you to move to higher data layers, where the information is more aggregated. Drilling down allows you to move to deeper data layers, which reveals more detailed information. You can drill down multiple layers of data, where each consecutive layer provides more detailed data, allowing you to extract more value from the data. This helps you improve the decision-making process and its efficiency.

Log Service supports drill-down analysis for analysis charts on the dashboard. After you configure drill-down analysis and click a chart value on the dashboard, you are redirected to the specified analysis page. Analysis charts on the dashboard show the results of query statements. If you configure drill-down analysis for the request status table and add the table to the dashboard, you can click a request status type on the dashboard to view logs of the request status.

Limits

In Log Service, only the following charts support drill-down analysis:

  • Tables
  • Line charts
  • Column charts
  • Bar charts
  • Pie charts
  • Single value charts
  • Area charts
  • Tree maps

Prerequisites

  • The index of the Logstore is enabled and configured.
  • A saved search, a dashboard, and a custom link to which you want to be redirected are configured.
  • A placeholder variable is specified in the query statement for the saved search and dashboard if you want to add a variable. For more information, see Save a query statement as a search and Create and delete a dashboard.

Procedure

  1. Log on to the Log Service console, and then click the target project name.
  2. Click the Logstore management icon icon next to the name of the Logstore, and then select Search & Analysis.
  3. Enter a query statement in the search box, set a time range, and then click Search & Analytics.
  4. Click the Graph tab, select a chart type, and then set the parameters on the Properties page of the chart.
  5. Click the Interactive Behavior tab, and then configure the Event Action for drill-down analysis.
    A drill-down event is an event that is triggered when an analysis chart on the dashboard page is clicked. This event is disabled by default. After you configure a drill-down event and click a chart value on the dashboard, you are redirected to a page based on the event action that you configure. Select one of the following event actions:
    • Disable: disables drill-down analysis.
    • Open Logstore: enables drill-down analysis. The drill-down event opens a Logstore.

      If you have set a filter statement, it is applied as a query statement to the Logstore to which you are redirected when you click a value in the chart. You cannot set the parameters on the Variable tab.

      Interactive Behavior tab
      Parameter Description
      Select Logstore The name of the Logstore to which you want to be redirected. For information about how to create a Logstore, see Manage a Logstore.
      Open in New Tab If you turn on this switch, the specified Logstore is opened on a new tab when interactive behavior is triggered.
      Time Range Set the query time range for the Logstore to which you want to be redirected. Valid values:
      • Default: the default relative time range (15 minutes) for a saved search. This default time range is used for the saved search after you are redirected to the specified Logstore.
      • Inherit table time: After you are redirected to the Logstore, the time range of the query statement is the chart time specified on the dashboard when the event is triggered.
      • Relative: sets the time range of the saved search to a relative time that you specify.
      • Time Frame: sets the time range of the saved search to a time frame that you specify.

      Default value: Default.

      Inherit Filtering Conditions If you turn on the Inherit Filtering Conditions switch, the filtering conditions added on the dashboard are synchronized to the saved search of the specified Logstore. At the same time, the filtering conditions are added before the query statement by using the logical AND operator.
      Filter Click the Filter tab, and enter a Filter Statement. The filter statement can contain the Optional Parameter Fields.

      If you have set the Filter, a query statement is added to the saved search of the specified Logstore when you click a chart value on the dashboard. The query statement is the specified Filter Statement.

    • Open Saved Search: enables drill-down analysis. The drill-down event opens a saved search.

      When you click a chart value, the placeholder configured in the saved search statement is replaced with the chart value if you have set a variable. At the same time, a deeper query is performed based on the chart value. If you have set a filter statement, a query statement is added to the saved search to which you are redirected. You can specify a variable and a placeholder at the same time.

      Open saved search
      Parameter Description
      Select Saved Search The name of the saved search to which you want to be redirected. For more information, see Save a query statement as a search.
      Open in New Tab If you turn on this switch, the specified saved search is opened on a new tab when interactive behavior is triggered.
      Time Range Set the time range for the saved search to which you want to be redirected. Valid values:
      • Default: the default relative time range (15 minutes) for a saved search. This default time range is used for the saved search after you are redirected to the specified saved search.
      • Inherit table time: After you are redirected to the saved search, the time range of the query statement is the chart time specified on the dashboard when the event is triggered.
      • Relative: sets the time range of the selected saved search to a relative time that you specify.
      • Time Frame: sets the time range of the selected saved search to a time frame that you specify.

      Default value: Default.

      Inherit Filtering Conditions If you turn on the Inherit Filtering Conditions switch, the filtering conditions added on the dashboard are synchronized to the saved search of the specified Logstore. At the same time, the filtering conditions are added before the query statement by using the logical AND operator.
      Filter Click the Filter tab, and then enter a Filter Statement. The filter statement can contain the Optional Parameter Fields.

      If you have set the Filter, a query statement is added to the saved search when you click a chart value on the dashboard. The query statement is the specified Filter Statement.

      Variable Click the Variable tab, click Add Variable, and then set the following parameters:
      • Replace Variable Name: the variable that triggers drill-down analysis. When you click this variable, you are redirected to the specified saved search.
      • Replace the value in the column: the column where the value that you want to replace data with is located. To process multiple columns, you can specify the current column and other columns. The current column is the column on which you want to perform drill-down analysis. Specify the current column in the Replace the value in the column field. Other columns can be the columns in the chart for drill-down analysis.

      If the query statement variable of the selected saved search is the same as the added variable, the query statement variable is replaced with the chart value that triggers the drill-down event. This helps you change the query statement of the selected saved search.

      Note
      • To add a variable, you must first configure a placeholder in the query statement for the saved search to which you want to be redirected.
      • You can add up to five variables.
    • Open Dashboard: enables drill-down analysis. The drill-down event opens a dashboard.

      Analysis charts on the dashboard show the results of query statements. You must pre-configure a placeholder in the query statement for the dashboard to which you want to be redirected. When you click a chart value on the upper-layer dashboard, the pre-configured placeholder is replaced with the chart value if you have set a variable. If you have set a filter statement, the relevant filtering conditions are added to the dashboard to which you are redirected. At the same time, a deeper query is performed based on the chart value.

      Open Dashboard
      Parameter Description
      Select Dashboard The name of the dashboard to which you want to be redirected. For more information, see Create and delete a dashboard.
      Open in New Tab If you turn on this switch, the specified dashboard is opened on a new tab when interactive behavior is triggered.
      Time Range Set the time range for the dashboard to which you want to be redirected. Valid values:
      • Default: After you are redirected to the selected dashboard by clicking a chart on the current dashboard, the selected dashboard uses the time range of the current dashboard.
      • Inherit table time: After you are redirected to the dashboard, the time range of the chart on the dashboard is the chart time specified on the dashboard when the event is triggered.
      • Relative: sets the time range of the selected dashboard to the specified relative time.
      • Time Frame: sets the time range of the selected dashboard to the specified time frame.

      Default value: Default.

      Inherit Filtering Conditions If you turn on the Inherit Filtering Conditions switch, the filtering conditions added on the current dashboard are synchronized to the dashboard to which you are redirected. At the same time, the filtering conditions are added before the query statement by using the logical AND operator.
      Filter Click the Filter tab, and then enter a Filter Statement. The filter statement can contain the Optional Parameter Fields.

      If you have set the Filter, a filtering condition is added to the selected dashboard when you click a chart value on the current dashboard. The filtering condition is the specified Filter Statement.

      Variable Click the Variable tab, click Add Variable, and then set the following parameters:
      • Replace Variable Name: the variable that triggers drill-down analysis. When you click this variable, you are redirected to the specified saved search.
      • Replace the value in the column: the column where the value that you want to replace data with is located. To process multiple columns, you can specify the Default Column and other columns. The Default Column is the current column on which you want to perform drill-down analysis. Other columns can be any other columns in the chart for drill-down analysis.

      If the query statement variable of the selected dashboard is the same as the added variable, the query statement variable is replaced with the chart value that triggers the drill-down event. This helps you change the query statement of the selected dashboard.

      Note
      • To add a variable, you must first configure a placeholder in the query statement for the selected dashboard to which you want to be redirected.
      • You can add up to five variables.
    • Custom HTTP Link: enables drill-down analysis. The drill-down event opens a custom HTTP link.

      The path in the HTTP link is the hierarchical path of the destination file. When you add optional parameter fields to the path and click the chart value of the dashboard, the added parameter fields are replaced with the chart value. At the same time, you are redirected to the new HTTP link.

      Custom HTTP Link
      Parameter Description
      Enter Link The destination address to which you want to be redirected.
      Optional Parameter Fields By clicking an optional parameter variable, you can replace part of the HTTP link with the chart value that triggers a drill-down event.
  6. Click Add to New Dashboard, configure the dashboard, and then click OK.

    Then, you can view the analysis chart on the Dashboard page and click the analysis chart to view deeper analysis results.

Example

You want to store collected NGINX access logs in a Logstore named accesslog, display the relevant analysis results on a dashboard named RequestMethod, and display the trend of page view (PV) distribution over time on a dashboard named destination_drilldown. You can configure drill-down analysis for the table of request methods, add the table to the RequestMethod dashboard, and then configure the drill-down event that redirects you to the destination_drilldown dashboard. Then, when you click a request method on the RequestMethod dashboard, you are redirected to the destination_drilldown dashboard to view the corresponding PV trend.

The procedure is as follows:
  1. Configure a dashboard named destination_drilldown.
    1. Filter logs by request type and check how the PV changes over time.

      The query statement is as follows:

      request_method: * | SELECT date_format(date_trunc('minute', __time__), '%H:%i:%s') AS time, COUNT(1) AS PV GROUP BY time ORDER BY time
    2. Use a line chart to display the query result and save the line chart to the dashboard.

      When you save the line chart to the dashboard, specify the asterisk (*) as a placeholder named method. If the variable of the drill-down event that redirects you to this saved search is also named method, you can replace the asterisk (*) with the chart value that you click. Then, you can perform a query and analysis again.

      Placeholder
  2. Configure a chart that triggers drill-down analysis, and then add the chart to the dashboard named RequestMethod.
    1. On the Search & Analysis page, use SQL statements to analyze the number of NGINX access logs by request method, and display the result in a table.
      *|SELECT request_method, COUNT(1) AS c GROUP BY request_method ORDER BY c DESC LIMIT 10

      The following figure shows the query result.

      Search and analysis
    2. Configure drill-down analysis for the request_method column in the table.
      Select an event action
  3. Click the GET request on the RequestMethod dashboard.
    Request method
  4. Go to the destination_drilldown dashboard.
    You are redirected to the dashboard configured in step 1. The asterisk (*) in the query statement is replaced with GET. The dashboard shows how the GET request PV changes over time.Dashboard to which you are redirected