Fetching latest commit…
Cannot retrieve the latest commit at this time.
Permalink
..
Failed to load latest commit information.
images
README.md
entity-search.md
metric-search.md
synonyms.md

README.md

Search

Overview

The search interface finds series by matching keywords against series fields.

Syntax

Queries consists of search terms and boolean operators. There are two types of search terms: keywords and phrases.

A keyword term is a single word such as location or nur.

A phrase is a group of words surrounded by double quotes such as "location nur".

Multiple terms can be combined together using boolean operators to form a more complex query.

A keyword can be prefixed with a field name to narrow the scope of the search to a particular series property, for example entity:nurswgvml007.

If no field is specified, the search queries all fields.

Fields

Field Description Example
entity Entity name. entity:nurswgvml007
entity.label Entity label. entity.label:nur*007
metric Metric name. metric:mpstat.cpu_busy
metric.label Metric label. metric.label:"cpu busy"
date Last insert date yyyy-MM-dd. date:2017-06-25
{tag.name} Series/metric/entity tag name. location:nur
contents All fields. nurswgvml007 or contents:nurswgvml007

Operators

To combine multiple terms, use boolean operators AND, OR, and NOT. Operators must be specified with uppercase letters.

entity:nurswgvml007* AND mount_point:\/opt

The default operator used to combine multiple keywords is OR. The following expressions are equivalent:

location OR nur
location nur
Operator Description Example
AND Both conditions must be satisfied. location AND nur
OR One of the conditions must be satisfied. location OR nur
NOT The condition must not be satisfied. location NOT nur

An expression cannot begin with the NOT operator.

Wildcards

Keywords support both single and multiple character wildcards.

  • "*" symbol matches multiple characters.
he*
  • "?" symbol matches one character.
h?llo

Wildcards can be used at the end or in the middle of a keyword.

Reserved Characters

The following characters are reserved: + - && || ! ( ) { } [ ] ^ " ~ * ? : \ /.

To escape reserved characters use double quotes or a backslash:

mount_point:"/opt"
mount_point:\/opt

Case Sensitivity

Search is case-insensitive.

Synonyms

Synonym search is supported by adding keyword mappings to the conf/synonym.conf file.

Examples

/* Search for 'nurswgvml007' entity */
entity:nurswgvml007

/* Search for entities starting with 'nurswgvml' */
entity:nurswgvml*

/* Search for entities starting with 'nur' and ending with '007' */
entity:nur*007

/* Search for 'mpstat.cpu_busy' metric */
metric:mpstat.cpu_busy

/* Search for metrics starting with 'mpstat.cpu' */
metric:mpstat.cpu*

/* Search for metrics starting with 'mpstat.' and containing 'cpu' */
metric:mpstat.*cpu*

/* Search for any field name or value containing the keyword 'location' */
location

/* Search for any field name or value starting with 'location' */
location*

/* Search for any field name or value containing keywords 'location' or 'Baltimore' */
location baltimore

/* Search for any field name or value containing both keywords 'location' and 'baltimore' */
location AND baltimore

/* Search for series with series tag, metric tag or entity tag named 'location' containing the keyword 'baltimore' */
location:baltimore

/* Search for series with series tag, metric tag or entity tag named 'location' starting with 'balt' */
location:balt*

/* Search for series with last insert date of June 15, 2017  */
date:2017-06-15

/* Search for series with last insert date in June, 2017  */
date:2017-06-*

Scheduling

The search index is continuously refreshed on schedule and as such does not reflect the latest changes such as a new series or modifications to an existing series that have occurred since the most recent refresh.

The interval between the incremental refreshes can be controlled with the search.indexing.incremental.interval setting. Each refresh operation takes up to ten seconds.

The frequency of rebuild tasks can be controlled with the search.indexing.full.schedule setting. The full rebuild takes up to ten minutes.

Administrators can refresh the index manually on the Settings > Diagnostics > Search Index page.

Monitoring

The database collects the following measurements to facilitate monitoring of background index tasks:

  • Metrics
series e:atsd t:host={hostname} m:index.build_time={time in millis} type=incremental OR full
series e:atsd t:host={hostname} m:index.directory_size={disk size in megabytes}
series e:atsd t:host={hostname} m:index.series_count={number of series}
  • Control Messages
message e:atsd t:host={hostname} t:type=search t:source={scheduled | manual} t:task=re-index t:scope={full | incremental} m:"Starting search re-indexing."
message e:atsd t:host={hostname} t:type=search t:source={scheduled | manual} t:task=re-index t:scope={full | incremental} m:"Completed search re-indexing in {time in millis} ms."