RUM fuzzy query - Application Real-Time Monitoring Service

ARMS stores Real User Monitoring (RUM) data in the Simple Log Service (SLS) Logstore within your account. Therefore, all chart and list data on the monitoring details page must be queried using the SLS search syntax. This topic describes how to use the fuzzy query feature of RUM.

Introduction

For information about the storage path of RUM data in SLS, see Observable data storage. You can filter monitoring data on the monitoring details page by using the SLS search syntax, or perform secondary development based on the fully stored data.

The search statement and analytic statement are separated by |. Format:

Search statement|Analytic statement

A search statement can be independently executed. An analytic statement must be executed together with a search statement. You can use the log analysis feature to analyze data in the search results or all data in a Logstore.

Important

We recommend that you specify up to 30 search conditions in a search statement.
You do not need to specify the FROM or WHERE clause in an analytic statement. By default, all data of the current Logstore is analyzed. Analytic statements do not support offsets and are not case-sensitive. You do not need to append a period to an analytic statement.

SLS implements fuzzy queries in the following two ways:

Search syntax: Add fuzzy query conditions in the search statement.
SQL analytic syntax: Add fuzzy query conditions in the SQL WHERE clause.

However, since RUM has predefined the data formats corresponding to charts and lists on the monitoring details page, RUM currently only supports adding fuzzy query filter conditions in the search statement, but does not support custom SQL analytic statements.

key: value* (User-input fuzzy matching condition) | SQL (System predefined, not modifiable)

Limits

Only prefix matching is supported. The first character must be filled in, and suffix matching (for example, *abc) is not supported. However, multiple fuzzy matches in intermediate positions are supported (for example, a*bc*).
The length of the text for matching cannot exceed 48 characters. Text exceeding this limit will not match any data.
The text for fuzzy matching cannot contain special characters (such as :). If it does, you need to replace the special characters with ? or *.
If the text to be matched contains tokenizing characters such as ?, &, #, or =, only the part before or after the tokenizing character can be matched during the query. Cross-token matching is not supported. If cross-token matching is required, you need to split the query into multiple conditions. For more information, see Example 4.

Examples

Example	Explorer module	Query requirement	Search statement	Description
Example 1	Page access	Filter page access records with paths starting with `/cart`.	`"view.name" : /cart*`	Use prefix matching, adding `*` to match any character.
Example 2	API requests	Filter API requests with URLs starting with `http://120.55.XX.XX/images`.	`"resource.url" : http?//120.55.XX.XX/images/*`	SLS search statements do not allow `:`, so use `?` instead.
Example 3	API requests	Filter API requests with URLs containing the domain name `www.example.com`.	`"resource.url" : httpwww.example.com`	As RUM fuzzy matching currently only supports prefix matching, you need to add the domain name prefix. Otherwise, no data will be queried.
Example 4	API requests	Filter API requests with URLs containing `www.example.com/test?abc=123`.	`"resource.url" : http?//www.example.com/test* and "resource.url" : abc* and "resource.url" : 123*`	Since `?` and `=` are tokenizing characters, when matching, you need to split the query into 3 parts and perform fuzzy matching on each part.