Cloud Monitor:Overview of Entity Explorer

In observability, an entity is any object that can be independently identified and monitored, such as:

• Infrastructure entities: Hosts, containers, network devices, and storage systems.

• Application layer entities: Microservices, API operations, database instances, and message queues.

• Business entities: User sessions, business processes, and transaction orders.

• O&M entities: Deployment environments, code repositories, and O&M engineers.

The core value of entity queries is to break down the siloed views of traditional monitoring, which are often divided by product or metric. Entity queries help build a panoramic catalog of entity assets. Entity queries achieve the following goals:

• Unified inventory: Provides a clear view of all entity types and specific entity instances defined in UModel. The entities are categorized and displayed by domain and type.

• Fast retrieval: Allows you to quickly locate entities using the USearch query language. USearch supports multiple methods, such as full-text search, exact match, and conditional filtering.

• Association analysis: Allows you to start with any entity to explore its status, performance metrics, associated logs, Tracing Analysis, and topological relationships. This provides one-stop problem diagnosis and analysis.

1. Entity overview

Entity Explorer associates all entities defined in UModel with Cloud Monitor 2.0 apps based on their domain and entity type. Ingested entities are categorized under their respective apps.

1. You can view the total number of all entities.

2. You can view the number of instances for each entity.

3. For cloud product entities, you can check whether all entities for that cloud product have been fully ingested.

4. You can click an entity to select its domain and entity type.

2. Entity query and display

1. Introduction to query languages: Entity Explorer supports two query languages: USearch and the SLS Processing Language (SPL). You can switch between the languages in the upper-left corner of the Entity Explorer page. For more information, see USearch entity query language and SPL data processing language.

2. In USearch mode, you can select a domain and entity type in the upper-left corner. This is not supported in SPL mode.

3. USearch query results are displayed based on the entity type. The results include the entity's primary key and name fields, and its Gold metrics.

4. SPL query results are not displayed by entity type. Instead, they show specific fields.

3. Topology overview view

The topology overview transforms an abstract system architecture into a visual digital model. It displays all ingested entity categories in the cloud environment, the number of ingested entities, and the dependencies between them. This global architecture view supports service administration and dependency management, and provides an intuitive way for O&M and developer teams to understand the system architecture.

1. Homepage.

In the upper-right corner of 'All Entities', click 'Topology' to view the total number of all entity types ingested into the current workspace and their relationships.

2. Toolbar (upper-left corner).

The toolbar widget supports scaling and centering operations.

3. Minimap (lower-right corner).

The minimap lets you drag the viewport to quickly navigate the topology graph.

4. Link focus interaction.

Nodes support a focus operation. When you click Focus, the topology graph shows only the ancestor and descendant nodes of the current node. This clearly displays dependencies and propagation links.

In focus mode, click 'Unfocus' in the toolbar to return to the original topology graph.

5. Entity list display.

Click an entity. A list of all ingested entities of that type appears on the right.

6. Query

The topology view supports filter interactions with USearch queries to show the topological associations of all entities that match the specified string.

In USearch query mode, click a node to display a list of all current query results.

Introduction

USearch is a specialized SPL syntax for entity queries. It supports multiple query patterns, including full-text search, exact match, and conditional filtering. USearch is deeply integrated into Cloud Monitor 2.0. It provides features such as global saved searches, quick field drill-downs, and metric drill-downs.

Basic syntax

.entity with(
    domain='domain_pattern',     -- Filter by domain
    type='type_pattern',         -- Filter by type
    query='search_query',        -- Query condition
    topk=10                      -- Maximum number of returned items
)

Core features

• Full-text search: Supports keyword searches across all fields.

• Field-specific query: Supports precise searches within specific fields.

• Logical condition combination: Supports logical operators such as AND, OR, and NOT.

• Smart scoring and sorting: Scores relevance based on IDF weights and column weights.

• Special character handling: Automatically handles special characters in queries.

Common scenarios

-- Full-text search
.entity with(query='web service')

-- Field-specific search
.entity with(query='status:running')

-- Logical combination query
.entity with(query='environment:prod AND status:error')

-- Domain and type filtering
.entity with(domain='apm', type='apm.service', query='production')

For more information about USearch syntax and usage, see USearch.

Introduction

SPL syntax is a data processing language provided by Simple Log Service. It is used to perform operations such as structured information extraction, field manipulation, and data filtering on raw data. SPL supports multi-level pipeline cascading for complex data processing and analysis.

How it works

SPL uses a pipeline processing architecture:

1. First-level pipeline: Index filter conditions, such as a USearch query.

2. Subsequent pipelines: SPL instructions for data processing.

3. Final output: The resulting data after SPL processing.

Core functions

-- Filter by condition
| where status = "error"
| where cpu_usage > 0.8
-- Filter by time range
| where __time__ > "2024-01-01 00:00:00"

-- Extract a field
| extend new_field = field1 + field2

-- Rename a field
| project-rename new_name = old_name

-- Select fields
| project field1, field2, field3

Using USearch with SPL

USearch can be used as a data source for SPL. This enables a complete flow from entity query to data analytics:

-- Basic combination: Entity query + data processing
.entity with(domain='apm', type='apm.service', query='production')
| where language = 'java'