When monitoring page views, API requests, or other Real User Monitoring (RUM) events, you may need to filter data by partial string matches -- for example, finding all page paths that start with /cart or all API requests to a specific domain. Use wildcard-based fuzzy queries in the search statement to filter RUM monitoring data by partial string patterns.
Application Real-Time Monitoring Service (ARMS) stores RUM data in a Simple Log Service (SLS) Logstore within your account. RUM uses SLS search syntax for all queries on the monitoring details page. You can also perform secondary development based on the fully stored data. For details about where RUM data is stored, see Observable data storage.
Quick reference
"view.name" : /cart*This query matches all page view records whose path starts with /cart, such as /cart, /cart/item, and /cart/checkout. Run this in the Page access Explorer module.
Search statement format
An SLS query uses the following format:
Search statement|Analytic statementA search statement runs independently. An analytic statement must be paired with a search statement, separated by |.
SLS implements fuzzy queries in the following two ways:
Search syntax: Add fuzzy query conditions in the search statement.
SQL analytic syntax: Add fuzzy query conditions in the SQL WHERE clause.
However, RUM has predefined analytic statements for its charts and lists. Only the search statement is customizable:
key: value* (your fuzzy match condition) | SQL (predefined, not modifiable)Limit search statements to 30 or fewer conditions. Analytic statements are not case-sensitive, do not support offsets, do not require a FROM or WHERE clause, and do not need to end with a period. By default, all data in the current Logstore is analyzed.
Wildcard syntax
Use wildcards in the search statement to perform fuzzy matching.
| Wildcard | Matches | Example | Matched values |
|---|---|---|---|
* | Zero or more characters | "view.name" : /cart* | /cart, /cart/item, /cart/checkout |
? | Exactly one character | http?// | http:// (the ? replaces :) |
Combine wildcards for more flexible patterns:
"view.name" : a*bc*This matches any value starting with a that contains bc, such as abc and a123bc456.
Handle special characters
SLS search statements do not allow certain characters to appear literally in query values. The most common special character is :, which frequently appears in URLs.
Replace special characters with the appropriate wildcard:
| Character to replace | Wildcard | When to use |
|---|---|---|
A single known character (such as :) | ? | You know the exact position and that it is one character |
| One or more unknown characters | * | You want to skip a variable-length portion |
Example -- match a URL containing ::
The URL http://120.55.XX.XX/images/logo.png contains : after http. Replace : with ?:
"resource.url" : http?//120.55.XX.XX/images/*Matched values: http://120.55.XX.XX/images/logo.png, http://120.55.XX.XX/images/banner.jpg
Handle tokenizing characters
SLS splits indexed text at tokenizing characters such as ?, &, #, and =. A fuzzy query cannot match across token boundaries in a single condition.
To match a string that spans multiple tokens, split the query into separate conditions joined with and.
Example -- match www.example.com/test?abc=123:
The ? and = in this URL are tokenizing characters, creating three tokens:
| Token | Source segment |
|---|---|
www.example.com/test | Before ? |
abc | Between ? and = |
123 | After = |
Match each token separately:
"resource.url" : http?//www.example.com/test* and "resource.url" : abc* and "resource.url" : 123*Common query examples
Filter page views by path prefix
Scenario: In the Page access Explorer module, find all page view records with paths starting with /cart.
"view.name" : /cart*| Input pattern | Matched values |
|---|---|
/cart* | /cart, /cart/item, /cart/checkout |
The * wildcard matches any characters after /cart.
Filter API requests by URL prefix
Scenario: In the API requests Explorer module, find all requests to URLs starting with http://120.55.XX.XX/images.
"resource.url" : http?//120.55.XX.XX/images/*| Input pattern | Matched values |
|---|---|
http?//120.55.XX.XX/images/* | http://120.55.XX.XX/images/logo.png, http://120.55.XX.XX/images/banner.jpg |
The ? replaces the : in http:// because SLS search statements do not allow : as a literal character.
Filter API requests by domain name
Scenario: In the API requests Explorer module, find all requests to www.example.com.
"resource.url" : http*www.example.com*| Input pattern | Matched values |
|---|---|
http*www.example.com* | http://www.example.com/page, https://www.example.com/api/data |
Only prefix matching is supported. Start the pattern with http* to match the protocol portion before the domain name.
Filter API requests by URL with query parameters
Scenario: In the API requests Explorer module, find all requests to www.example.com/test?abc=123.
"resource.url" : http?//www.example.com/test* and "resource.url" : abc* and "resource.url" : 123*| Input pattern | Matched values |
|---|---|
Three and-joined conditions | http://www.example.com/test?abc=123, http://www.example.com/test?abc=12345 |
The ? and = are tokenizing characters in SLS. Split the query at each tokenizing character and match the resulting tokens (www.example.com/test, abc, 123) individually using and.
Limitations
Prefix matching only. The first character of the match value must be specified. Suffix patterns like
*abcare not supported.48-character limit. Match text longer than 48 characters returns no results.
No custom analytic statements. RUM uses predefined SQL analytic statements. Custom
WHEREclauses in the analytic statement are not supported.