SLS metric data query syntax - PromQL SQL limits - Simple Log Service

Simple Log Service (SLS) supports PromQL, SQL, and combined SQL+PromQL syntaxes for querying and analyzing metric data, with specific naming conventions and query limits.

SLS supports three syntaxes for querying and analyzing metric data:

PromQL syntax: PromQL, the Prometheus query language, simplifies metric data queries. For more information, see Prometheus documentation and PromQL function usage examples.
SQL syntax: Use SQL to query and analyze metric data based on the data encoding format.
Combination of SQL and PromQL: Combine SQL with SLS PromQL functions for nested queries. PromQL queries also support SLS Machine learning syntax.

When using PromQL or combined SQL+PromQL, metric names and labels must follow the naming conventions. For more information, see Metric identifier.

PromQL syntax

PromQL examples:

Query the time series in which the metric name is http_requests_total, the job label is apiserver, and the handler label is /api/comments.
```
http_requests_total{job="apiserver", handler="/api/comments"}
```
Query the top 3 CPU users grouped by app and proc within the previous 5 minutes. app specifies applications, and proc specifies process types.
```
topk(3, sum by (app, proc) (rate(instance_cpu_time_ns[5m])))
```

Query unhealthy pods.

min_over_time(sum by (namespace, pod) (kube_pod_status_phase{phase=~"Pending|Unknown|Failed"})[15m:1m]) > 0

Query the sum of the CPU utilization for Kubernetes DaemonSets.

sum (rate (container_cpu_usage_seconds_total{pod=~"^x.*$",cluster=~".*",namespace=~".*"}[1m])) / sum (kube_pod_container_resource_limits_cpu_cores{pod=~"^null.*$",cluster=~".*",namespace=~".*"}) * 100

For more information about the PromQL syntax, see Prometheus documentation, Querying examples, and PromQL use cases.

SQL syntax

SQL examples. For more information, see SQL use cases.

Query and analyze all data.

*| SELECT * FROM "my_metric_store.prom" WHERE __name__ != ''

For the http_request_count metric, query the data in which the domain value of the __labels__ field is www.example.com and obtain the sum of the values for the __value__ field.
```
*| SELECT sum(__value__) FROM "my_metric_store.prom" WHERE __name__='http_request_count' and element_at(__labels__, 'domain')='www.example.com' 
```

For the http_request_count metric, query the data in which the domain value of the __labels__ field is www.example.com, aggregate the values of the __value__ field by hour, and obtain the sum of the values.

*| SELECT sum(__value__),date_trunc('hour', __time_nano__/1000000) as t
FROM "my_metric_store.prom" 
WHERE __name__='http_request_count' and element_at(__labels__, 'domain')='www.example.com'
GROUP BY t
ORDER BY t DESC

SQL syntax details:

The SQL syntax for metric data matches the SQL syntax for log data (Analysis syntax). When querying metric data with SQL, the table name in a FROM clause must be in the {metrics_store_name}.prom format. {metrics_store_name} specifies the name of the Metricstore that you create.

Note
Enclose the table name in double quotes ("").
Use the element_at() function to get a key value from the __labels__ field. Example: element_at(__labels__, 'key').
For more information about table schemas, see Encoding format.

SQL+PromQL syntax

SLS provides seven PromQL functions. The promql_query, promql_labels, promql_label_values, and promql_series functions can only be called on the custom query and analysis page of a Metricstore.

Important

When combining SQL and PromQL, the table name in a FROM clause must be metrics.
PromQL function API endpoints and descriptions: Prometheus documentation.

Function Name	Description	Example
promql_query(string)	Evaluates an instant query at the EndTime of a time range. Equivalent to the /query API of Prometheus. Parameter setting: query=<string>.	*\| SELECT promql_query('up') FROM metrics
promql_query_range(string, string)	Evaluates a query within the time range from StartTime to EndTime. Equivalent to the /query_range API of Prometheus. Parameter settings: query=<string> and step=<duration>.	*\| SELECT promql_query_range('up', '5m') FROM metrics
promql_labels()	Returns all label keys. By default, this function returns only the data within the following time range: [<EndTime> - 5min, <EndTime>].	*\| SELECT promql_labels() FROM metrics
promql_labels(string)	Supports the match[] parameter to return label keys matching <series_selector>. Supports only one match[] value. Example: promql_labels('up'). By default, this function returns only the data within the following time range: [<EndTime> - 5min, <EndTime>].	*\| SELECT promql_labels('up') FROM metrics
promql_label_values(string)	Returns the values of a label. By default, this function returns only the data within the following time range: [<EndTime> - 5min, <EndTime>].	*\| SELECT promql_label_values('__name__') FROM metrics
promql_label_values(string, string)	Supports the match[] parameter to return values for a label matching <series_selector>. Supports only one match[] value, which must precede the Label parameter. Example: promql_label_values('up', '__label_name__') . By default, this function returns only the data within the following time range: [<EndTime> - 5min, <EndTime>].	*\| SELECT promql_label_values('up', '__label_name__') FROM metrics
promql_series(string)	Returns the matched time series. By default, this function returns only the data within the following time range: [<EndTime> - 5min, <EndTime>].	*\| SELECT promql_series('up') FROM metrics

Each PromQL function returns a table, similar to a user-defined table-valued function (UDTF).

Table schema returned by promql_query(string) and promql_query_range(string, string):

Field	Field type	Description
metric	varchar	The metric name. May be empty if the query includes a GROUP BY clause.
labels	map<varchar, varchar>	The labels as a key-value map.
time	bigint	The time.
value	double	The value at a specific point in time.

Query examples:

promql_query(string) function
promql_query_range(string, string) function

Table schema returned by promql_labels(), promql_labels(string), promql_label_values(string), and promql_label_values(string, string):

Field	Field type	Description
label	varchar	Label key

Query examples:

promql_labels() function
promql_labels(string) function
promql_label_values(string) function
promql_label_values(string, string) function

Table schema returned by promql_series(string):

Field	Field type	Description
series	map<varchar, varchar>	The time series.

Query example: series

Limits

A Metricstore supports only Prometheus query API endpoints (/query and /query_range). Other endpoints such as /admin, /alerts, and /rules are not supported.
PromQL and combined SQL+PromQL queries return values for up to 11,000 data points.