diff --git a/docs/user-guide/management/audit-trail.md b/docs/user-guide/management/audit-trail.md index 030e645e..4d738f1e 100644 --- a/docs/user-guide/management/audit-trail.md +++ b/docs/user-guide/management/audit-trail.md @@ -9,7 +9,7 @@ description: >- !!! info "Availability" This feature is available in Enterprise Edition and Cloud. Not available in Open Source. -## What is Audit Trail +## What is audit trail? Audit Trail records user actions across all organizations in OpenObserve. It captures non-ingestion API calls and helps you monitor activity and improve security. !!! note "Who can access" diff --git a/docs/user-guide/metrics/downsampling-metrics.md b/docs/user-guide/metrics/downsampling-metrics.md index b3f81efb..c60469a7 100644 --- a/docs/user-guide/metrics/downsampling-metrics.md +++ b/docs/user-guide/metrics/downsampling-metrics.md @@ -10,7 +10,7 @@ This guide provides an overview of downsampling, including its configuration, ru Downsampling summarizes historical data into fewer data points. Each summarized data point is calculated using an aggregation method, such as the last recorded value, the average, or the total, applied over a defined time block. -## Configure Downsampling +## Configure downsampling Downsampling is configured using the following environment variables.: @@ -21,7 +21,7 @@ Downsampling is configured using the following environment variables.: > Refer to the [Downsampling Rule](#downsampling-rule) section.
-#### Downsampling Configuration For Helm Chart Users +#### Downsampling configuration for Helm Chart users Add the environment variables under the `enterprise.parameters` section in your `values.yaml` file: ``` @@ -32,7 +32,7 @@ enterprise: `O2_METRICS_DOWNSAMPLING_RULES`: "o2_cpu_usage:avg:30d:5m" ``` -#### Downsampling Configuration For Terraform Users +#### Downsampling configuration for Terraform users Set the same variables in your `terraform.tfvars` file: ``` @@ -42,7 +42,7 @@ Set the same variables in your `terraform.tfvars` file: > **Note**: **After setting the environment variables, make sure to redeploy the OpenObserve instance for the changes to apply.** -### Downsampling Rule +### Downsampling rule User-defined rules determine how downsampling is applied to metrics streams. You can define multiple downsampling rules to target different streams or use different configurations. @@ -64,14 +64,14 @@ Here: - **offset**: It defines the age of data eligible for downsampling. For example, 15d for applying downsampling on data older than 15 days. - **step**: The time block used to group data points. For example, 30m for applying downsampling to retain one value every 30 minutes. -### Sample Downsampling Rules +### Sample downsampling rules -#### Single Rule +#### Single rule ```yaml O2_METRICS_DOWNSAMPLING_RULES: "o2_cpu_metrics:avg:30d:5m" ``` Retains one average value every 5 minutes for `o2_cpu_metrics` data older than 30 days.
-**Multiple Rules** +**Multiple rules** ```yaml O2_METRICS_DOWNSAMPLING_RULES: "o2_cpu_metrics:avg:30d:5m, o2_app_logs:last:10d:10m" ``` @@ -82,7 +82,7 @@ O2_METRICS_DOWNSAMPLING_RULES: "o2_cpu_.*:sum:10d:60m" ``` Targets all streams starting with `o2_cpu_`, and for each matching stream, retains one hourly sum for data older than 10 days. -### Downsampling Example +### Downsampling example **Scenario**
A system is recording CPU usage data every 10 seconds to the stream `o2_cpu_usage`, generating a large volume of high-resolution metrics. Over time, this data becomes too granular and expensive to store or query efficiently for historical analysis. @@ -94,7 +94,7 @@ Downsample data older than 30 days to retain one average for every 2-minute time `O2_COMPACT_DOWNSAMPLING_INTERVAL` = "180" `O2_METRICS_DOWNSAMPLING_RULES` = "o2_cpu_usage:avg:30d:2m" -**Input Metrics**
+**Input metrics**
```json @@ -158,7 +158,7 @@ Downsample data older than 30 days to retain one average for every 2-minute time { "timestamp": "2024-03-01 00:08:50", "cpu": 20.2 } ``` -**Downsampling Time Blocks (Step = 2m) and Average CPU Usage** +**Downsampling time blocks (Step = 2m) and average CPU usage** - Time Block 1: From 00:00:00 to 00:01:59, average CPU usage is 20.55 - Time Block 2: From 00:02:00 to 00:03:59, average CPU usage is 21.75 @@ -166,7 +166,7 @@ Downsample data older than 30 days to retain one average for every 2-minute time - Time Block 4: From 00:06:00 to 00:07:59, average CPU usage is 21.65 - Time Block 5: From 00:08:00 to 00:09:59, average CPU usage is 20.88 (not processed yet) -**Downsampling Job Runs and Outputs** +**Downsampling job runs and outputs** Job 1 runs at 00:03:00 and processes Time Block 1
Output: diff --git a/docs/user-guide/metrics/file-access-time-metric.md b/docs/user-guide/metrics/file-access-time-metric.md index a3d6e472..bcf68579 100644 --- a/docs/user-guide/metrics/file-access-time-metric.md +++ b/docs/user-guide/metrics/file-access-time-metric.md @@ -3,11 +3,11 @@ description: >- Analyze file access age in OpenObserve to gauge query performance. Buckets track how recently files were accessed, revealing hot vs. cold data trends. --- -## What Is File Access Time Metric? +## What is file access time metric? This histogram metric helps analyze the age of files accessed by the querier. This helps in understanding the distribution of file access times across queries and evaluating system performance. -## How Does It Works? +## How does it work? The metric tracks file age in hourly buckets ranging from 1 hour to 32 hours. Each data point represents how long ago a file was accessed during query execution. **The metric is exposed as:** @@ -16,7 +16,7 @@ The metric tracks file age in hourly buckets ranging from 1 hour to 32 hours. Ea Zo_file_access_time_bucket ``` -## Example Usage +## Example usage To calculate the 95th percentile of file access age for logs over a 5-minute window: ``` diff --git a/docs/user-guide/streams/.pages b/docs/user-guide/streams/.pages index c535cf46..60604675 100644 --- a/docs/user-guide/streams/.pages +++ b/docs/user-guide/streams/.pages @@ -5,4 +5,6 @@ nav: - Schema Settings: schema-settings.md - Extended Retention: extended-retention.md - Summary Streams: summary-streams.md - - Field and Index Types in Streams: fields-and-index-in-streams.md \ No newline at end of file + - Field and Index Types in Streams: fields-and-index-in-streams.md + - Query Recommendations Stream: query-recommendations.md + \ No newline at end of file diff --git a/docs/user-guide/streams/index.md b/docs/user-guide/streams/index.md index 52dda94f..222df8fd 100644 --- a/docs/user-guide/streams/index.md +++ b/docs/user-guide/streams/index.md @@ -6,4 +6,6 @@ Streams define how observability data is ingested, stored, indexed, and queried - ### [Schema Settings](schema-settings.md) - ### [Extended Retention](extended-retention.md) - ### [Summary Streams](summary-streams.md) - - ### [Data Type and Index Types in Streams](data-type-and-index-type-in-streams.md) \ No newline at end of file + - ### [Data Type and Index Types in Streams](data-type-and-index-type-in-streams.md) + - ### [Field and Index Types in Streams](fields-and-index-in-streams.md) + - ### [Query Recommendations Stream](query-recommendations.md) \ No newline at end of file diff --git a/docs/user-guide/streams/query-recommendations.md b/docs/user-guide/streams/query-recommendations.md index e9bed99b..c3388e0b 100644 --- a/docs/user-guide/streams/query-recommendations.md +++ b/docs/user-guide/streams/query-recommendations.md @@ -62,7 +62,7 @@ This recommendation indicates that across the last 360000000 hours of query data
**Example 2**
-![example-2-query-recommendations](../../images/example-2-query-recommendationsage.png) +![example-2-query-recommendations](../../images/example-2-query-recommendations.png) This recommendation is for the `status` field in the `alert_test` stream. All 5 queries used `status` with an equality operator. Although the number is small, the uniform pattern indicates a potential for future optimization. !!! note "Interpretation"