diff --git a/apl/guides/migrating-from-sql-to-apl.mdx b/apl/guides/migrating-from-sql-to-apl.mdx index 412c0dae..9745a8de 100644 --- a/apl/guides/migrating-from-sql-to-apl.mdx +++ b/apl/guides/migrating-from-sql-to-apl.mdx @@ -7,13 +7,13 @@ tags: ['axiom documentation', 'documentation', 'axiom', 'apl', 'sql', 'guide', ' ## Introduction -As data grows exponentially, organizations are continuously seeking more efficient and powerful tools to manage and analyze their data. The Query tab, which utilizes the Axiom Processing Language (APL), is one such service that offers fast, scalable, and interactive data exploration capabilities. If you are an SQL user looking to migrate to APL, this guide will provide a gentle introduction to help you make the transition smoothly. +As data grows exponentially, organizations are continuously seeking more efficient and powerful tools to manage and analyze their data. The Explore tab, which utilizes the Axiom Processing Language (APL), is one such service that offers fast, scalable, and interactive data exploration capabilities. If you are an SQL user looking to migrate to APL, this guide will provide a gentle introduction to help you make the transition smoothly. **This tutorial will guide you through migrating SQL to APL, helping you understand key differences and providing you with query examples.** ## Introduction to Axiom Processing Language (APL) -Axiom Processing Language (APL) is the language used by the Query tab, a fast and highly scalable data exploration service. APL is optimized for real-time and historical data analytics, making it a suitable choice for various data analysis tasks. +Axiom Processing Language (APL) is the language used by the Explore tab, a fast and highly scalable data exploration service. APL is optimized for real-time and historical data analytics, making it a suitable choice for various data analysis tasks. **Tabular operators**: In APL, there are several tabular operators that help you manipulate and filter data, similar to SQL’s SELECT, FROM, WHERE, GROUP BY, and ORDER BY clauses. Some of the commonly used tabular operators are: diff --git a/apl/guides/splunk-cheat-sheet.mdx b/apl/guides/splunk-cheat-sheet.mdx index 625d2287..21518dd7 100644 --- a/apl/guides/splunk-cheat-sheet.mdx +++ b/apl/guides/splunk-cheat-sheet.mdx @@ -5,7 +5,7 @@ sidebarTitle: Splunk SPL tags: ['axiom documentation', 'documentation', 'axiom', 'splunk', 'apl', 'searching', 'aggregation', 'time frames', 'sorting', 'functions'] --- -Splunk and Axiom are powerful tools for log analysis and data exploration. The data explorer interface uses Axiom Processing Language (APL). There are some differences between the query languages for Splunk and Axiom. When transitioning from Splunk to APL, you will need to understand how to convert your Splunk SPL queries into APL. +Splunk and Axiom data Explorer are powerful tools for log analysis and data exploration. The data explorer interface uses Axiom Processing Language (APL). There are some differeces between the query languages for Splunk and Axiom. When transitioning from Splunk to APL, you will need to understand how to convert your Splunk SPL queries into APL. **This guide provides a high-level mapping from Splunk to APL.** @@ -289,4 +289,4 @@ In Splunk, to sort in ascending order, you must use the `reverse` operator. APL Whether you’re just starting your transition or you’re in the thick of it, this guide can serve as a helpful roadmap to assist you in your journey from Splunk to Axiom Processing Language. -Dive into the Axiom Processing Language, start converting your Splunk queries to APL, and explore the rich capabilities of the Query tab. Embrace the learning curve, and remember, every complex query you master is another step forward in your data analytics journey. \ No newline at end of file +Dive into the Axiom Processing Language, start converting your Splunk queries to APL, and explore the rich capabilities of the Explore tab. Embrace the learning curve, and remember, every complex query you master is another step forward in your data analytics journey. \ No newline at end of file diff --git a/apl/introduction.mdx b/apl/introduction.mdx index 194e627a..17e79d95 100644 --- a/apl/introduction.mdx +++ b/apl/introduction.mdx @@ -12,7 +12,7 @@ The Axiom Processing Language (APL) is a query language that is perfect for gett ## Getting Started -Go to the Query tab and click one of your datasets to get started. The APL editor has full auto-completion so you can poke around or you can get a better understanding of all the features by using the reference menu to the left of this page. +Go to the Explore tab and click one of your datasets to get started. The APL editor has full auto-completion so you can poke around or you can get a better understanding of all the features by using the reference menu to the left of this page. ## APL Query Structure diff --git a/apl/tutorial.mdx b/apl/tutorial.mdx index 212b8b07..013e44f9 100644 --- a/apl/tutorial.mdx +++ b/apl/tutorial.mdx @@ -1,12 +1,12 @@ --- title: 'Sample queries' -description: "Explore how to use APL in Axiom’s Query tab to run queries using Tabular Operators, Scalar Functions, and Aggregation Functions." +description: "Explore how to use APL in Axiom’s Explore tab to run queries using Tabular Operators, Scalar Functions, and Aggregation Functions." sidebarTitle: Sample Queries icon: vial tags: ['axiom documentation', 'documentation', 'axiom', 'APL', 'tutorial', 'apl overview', 'tabular operators', 'scalar functions', 'aggregation functions'] --- -In this tutorial, you’ll explore how to use APL in Axiom’s Query tab to run queries using Tabular Operators, Scalar Functions, and Aggregation Functions. +In this tutorial, you’ll explore how to use APL in Axiom’s Explore tab to run queries using Tabular Operators, Scalar Functions, and Aggregation Functions. ## Prerequisites diff --git a/dashboard-elements/create.mdx b/dashboard-elements/create.mdx index af512136..46b4affb 100644 --- a/dashboard-elements/create.mdx +++ b/dashboard-elements/create.mdx @@ -10,10 +10,16 @@ To create new dashboard elements: 1. [Create a dashboard](/dashboards/create) or open an existing dashboard. 1. Click Add chart **Add chart** in the top right corner. -1. Choose the dashboard element from the list. -1. For charts, select one of the following: - - Click **Simple Query Builder** to create your chart using a [visual query builder](#create-chart-using-visual-query-builder). - - Click **Advanced Query Language** to create your chart using the Axiom Processing Language (APL). Create a chart in the same way you create a chart in the APL query builder of the [Query tab](/query-data/explore#create-a-query-using-apl). +1. Choose the dashboard element from the list. For more information on each dashboard element, choose one of the following: + - [Filter bar](/query-data/filters) + - [Log stream](/dashboard-elements/log-stream) + - [Scatter plot](/dashboard-elements/scatter-plot) + - [Statistic](/dashboard-elements/statistic) + - [Table](/dashboard-elements/table) + - [Time series](/dashboard-elements/time-series) +1. Choose one of the following: + - Click **Simple Query Builder** to create your chart using a visual query builder. Create a chart in the same way you create a chart in the [Datasets tab](/query-data/datasets). + - Click **Advanced Query Language** to create your chart using the Axiom Processing Language (APL). Create a chart in the same way you create a chart in the APL query builder of the [Explore tab](/query-data/explore#create-a-query-using-apl). 1. Optional: [Configure chart options](/dashboard-elements/configure). 1. Click **Save**. @@ -33,153 +39,4 @@ To change the size of the element, drag the bottom-right corner. - - -## Create chart using visual query builder - -Use the query builder to create or edit queries for the selected dataset: - - - Query builder - - -This component is a visual query builder that eases the process of building visualizations and segments of your data. - -This guide walks you through the individual sections of the query builder. - -### Time range - -Every query has a start and end time and the time range component allows quick selection of common time ranges as well as the ability to input specific start and end timestamps: - - - Time range - - -- Use the **Quick Range** items to quickly select popular ranges -- Use the **Custom Start/End Date** inputs to select specific times -- Use the **Resolution** items to choose between various time bucket resolutions - -### Against - -When a time series visualization is selected, such as `count`, the **Against** menu is enabled and it’s possible to select a historical time to compare the results of your time range too. - -For example, to compare the last hour’s average response time to the same time yesterday, select `1 hr` in the time range menu, and then select `-1D` from the **Against** menu: - - - Time range against menu - - -The results look like this: - - - Time range against chart - - -The dotted line represents results from the base date, and the totals table includes the comparative totals. - -When you add `field` to the `group by` clause, the **time range against** values are attached to each `events`. - - - Time range against chart - - -### Visualizations - -Axiom provides powerful visualizations that display the output of running aggregate functions across your dataset. The Visualization menu allows you to add these visualizations and, where required, input their arguments: - - - Visualizations menu - - -You can select a visualization to add it to the query. If a visualization requires an argument (such as the field and/or other parameters), the menu allows you to select eligible fields and input those arguments. Press `Enter` to complete the addition: - - - Visualizations demo - - -Click Visualization in the query builder to edit it at any time. - -[Learn about supported visualizations](/query-data/visualizations) - -### Filters - -Use the filter menu to attach filter clauses to your search. - -Axiom supports AND/OR operators at the top-level as well as one level deep. This means you can create filters that would read as `status == 200 AND (method == get OR method == head) AND (user-agent contains Mozilla or user-agent contains Webkit)`. - -Filters are divided up by the field type they operate on, but some may apply to more than one field type. - - - Filters demo - - -#### List of filters - -_String Fields_ - -- `==` -- `!=` -- `exists` -- `not-exists` -- `starts-with` -- `not-starts-with` -- `ends-with` -- `not-ends-with` -- `contains` -- `not-contains` -- `regexp` -- `not-regexp` - -_Number Fields_ - -- `==` -- `!=` -- `exists` -- `not-exists` -- `>` -- `>=` -- `<` -- `<=` - -_Boolean Fields_ - -- `==` -- `!=` -- `exists` -- `not-exists` - -_Array Fields_ - -- `contains` -- `not-contains` -- `exists` -- `not-exists` - -#### Special fields - -Axiom creates the following two fields automatically for a new dataset: - -- `_time` is the timestamp of the event. If the data you ingest doesn’t have a `_time` field, Axiom assigns the time of the data ingest to the events. -- `_sysTime` is the time when you ingested the data. - -In most cases, you can use `_time` and `_sysTime` interchangeably. The difference between them can be useful if you experience clock skews on your event-producing systems. - -### Group by (segmentation) - -When visualizing data, it can be useful to segment data into specific groups to more clearly understand how the data behaves. - -The Group By component enables you to add one or more fields to group events by: - - - Group by - - -### Other options - -#### Order - -By default, Axiom automatically chooses the best ordering for results. However, you can manually set the desired order through this menu. - -#### Limit - -By default, Axiom chooses a reasonable limit for the query that has been passed in. However, you can control that limit manually through this component. \ No newline at end of file + \ No newline at end of file diff --git a/dashboard-elements/overview.mdx b/dashboard-elements/overview.mdx index 43d71102..5382bb12 100644 --- a/dashboard-elements/overview.mdx +++ b/dashboard-elements/overview.mdx @@ -10,7 +10,6 @@ Dashboard elements are the different visual elements that you can include in you Choose one of the following to learn more about a dashboard element: - - - \ No newline at end of file + \ No newline at end of file diff --git a/doc-assets/icons/chart-line.svg b/doc-assets/icons/chart-line.svg deleted file mode 100644 index d4f9fb57..00000000 --- a/doc-assets/icons/chart-line.svg +++ /dev/null @@ -1 +0,0 @@ - \ No newline at end of file diff --git a/doc-assets/icons/chart-scatter.svg b/doc-assets/icons/chart-scatter.svg deleted file mode 100644 index 83dea6fe..00000000 --- a/doc-assets/icons/chart-scatter.svg +++ /dev/null @@ -1 +0,0 @@ - \ No newline at end of file diff --git a/doc-assets/icons/many-users.svg b/doc-assets/icons/many-users.svg deleted file mode 100644 index e025e7ee..00000000 --- a/doc-assets/icons/many-users.svg +++ /dev/null @@ -1 +0,0 @@ - \ No newline at end of file diff --git a/doc-assets/icons/percent.svg b/doc-assets/icons/percent.svg deleted file mode 100644 index ebf022e9..00000000 --- a/doc-assets/icons/percent.svg +++ /dev/null @@ -1 +0,0 @@ - \ No newline at end of file diff --git a/doc-assets/icons/single-user.svg b/doc-assets/icons/single-user.svg deleted file mode 100644 index c96f27fc..00000000 --- a/doc-assets/icons/single-user.svg +++ /dev/null @@ -1 +0,0 @@ - \ No newline at end of file diff --git a/doc-assets/icons/stopwatch.svg b/doc-assets/icons/stopwatch.svg deleted file mode 100644 index c4c3ed50..00000000 --- a/doc-assets/icons/stopwatch.svg +++ /dev/null @@ -1 +0,0 @@ - \ No newline at end of file diff --git a/doc-assets/shots/analyze-your-data-1.png b/doc-assets/shots/analyze-your-data-1.png new file mode 100644 index 00000000..5103a43b Binary files /dev/null and b/doc-assets/shots/analyze-your-data-1.png differ diff --git a/doc-assets/shots/customize-your-organization.png b/doc-assets/shots/customize-your-organization.png new file mode 100644 index 00000000..13a6173e Binary files /dev/null and b/doc-assets/shots/customize-your-organization.png differ diff --git a/doc-assets/shots/dataset-overview-1.png b/doc-assets/shots/dataset-overview-1.png new file mode 100644 index 00000000..e95c620d Binary files /dev/null and b/doc-assets/shots/dataset-overview-1.png differ diff --git a/doc-assets/shots/explore-your-data-1.png b/doc-assets/shots/explore-your-data-1.png new file mode 100644 index 00000000..7ec1b449 Binary files /dev/null and b/doc-assets/shots/explore-your-data-1.png differ diff --git a/doc-assets/shots/getting-started-24.png b/doc-assets/shots/getting-started-24.png new file mode 100644 index 00000000..ef511214 Binary files /dev/null and b/doc-assets/shots/getting-started-24.png differ diff --git a/doc-assets/shots/getting-started-stream.png b/doc-assets/shots/getting-started-stream.png new file mode 100644 index 00000000..969b62eb Binary files /dev/null and b/doc-assets/shots/getting-started-stream.png differ diff --git a/doc-assets/shots/monitor-for-problems.png b/doc-assets/shots/monitor-for-problems.png new file mode 100644 index 00000000..32562750 Binary files /dev/null and b/doc-assets/shots/monitor-for-problems.png differ diff --git a/doc-assets/shots/query-history-1.png b/doc-assets/shots/query-history-1.png new file mode 100644 index 00000000..a218463b Binary files /dev/null and b/doc-assets/shots/query-history-1.png differ diff --git a/doc-assets/shots/query-history.png b/doc-assets/shots/query-history.png new file mode 100644 index 00000000..5fbb8f47 Binary files /dev/null and b/doc-assets/shots/query-history.png differ diff --git a/doc-assets/shots/quick-chart-1.png b/doc-assets/shots/quick-chart-1.png new file mode 100644 index 00000000..863f0fd1 Binary files /dev/null and b/doc-assets/shots/quick-chart-1.png differ diff --git a/doc-assets/shots/select-a-dataset-from-list.png b/doc-assets/shots/select-a-dataset-from-list.png new file mode 100644 index 00000000..64d65b68 Binary files /dev/null and b/doc-assets/shots/select-a-dataset-from-list.png differ diff --git a/doc-assets/shots/select-a-dataset.png b/doc-assets/shots/select-a-dataset.png new file mode 100644 index 00000000..887f8a54 Binary files /dev/null and b/doc-assets/shots/select-a-dataset.png differ diff --git a/doc-assets/shots/starred-3.png b/doc-assets/shots/starred-3.png new file mode 100644 index 00000000..6bec335e Binary files /dev/null and b/doc-assets/shots/starred-3.png differ diff --git a/doc-assets/shots/starred-datasets-2.png b/doc-assets/shots/starred-datasets-2.png new file mode 100644 index 00000000..80c77ef9 Binary files /dev/null and b/doc-assets/shots/starred-datasets-2.png differ diff --git a/doc-assets/shots/virtual-fields.png b/doc-assets/shots/virtual-fields.png new file mode 100644 index 00000000..c721bb0f Binary files /dev/null and b/doc-assets/shots/virtual-fields.png differ diff --git a/getting-started-guide/getting-started.mdx b/getting-started-guide/getting-started.mdx index 18badd4e..1c333209 100644 --- a/getting-started-guide/getting-started.mdx +++ b/getting-started-guide/getting-started.mdx @@ -7,11 +7,11 @@ tags: ['axiom documentation', 'documentation', 'axiom', 'stream data', 'analyze data', 'explore data'] --- - - Axiom user interface + + Axiom overview -## 1. Send your data to Axiom +## 1. Get your data into Axiom You can send data to Axiom in a variety of ways. Each individual piece of data is an event. @@ -36,65 +36,99 @@ Axiom stores every event you send and makes it available to you for querying eit The underlying data store of Axiom is a time series database. This means every event is indexed with a timestamp specified at ingress or set automatically. -Axiom doesn’t sample your data on ingest or querying, unless you’ve expressly instructed it to. +Axiom doesn’t sample your data on ingest or querying, unless you've expressly instructed it to. - + ## 2. Stream your data Axiom makes it really easy to view your data as it’s being ingested live. This is also referred to as "Live Stream" or "Live Tail," and the result is having a terminal-like feel of being able to view all your events in real-time: + + Stream tab + + From the Stream tab, you can easily add filters to narrow down the results as well as save popular searches and share them with your organization members. You can also hide/show specific fields Another useful feature of the Stream tab is to only show events in a particular time-window. This could be the last N minutes or a more-specific time range you specify manually. This feature is extremely useful when you need to closely inspect your data, allowing you to get an chronological view of every event in that time window. - + ## 3. Analyze your data -In Axiom, an individual piece of data is an event, and a dataset is a collection of related events. Datasets contain incoming event data. The Datasets tab allows you to analyze fields within your datasets. For example: +While viewing individual events can be very useful, at scale and for general monitoring and observability, it’s important to be able to quickly aggregate, filter, and segment your data. The Analytics page lets you do just that, and more: + + + Datasets tab + + +The Datasets tab gives you various tools to extract insights from a dataset: +- Visualizing aggregations with count, min, max, average, percentiles, heatmaps, and more +- Filtering events with and/or grouped filters containing one or more field filters +- Segment data with `group-by` + +You can control the time range of your search, and even compare your results to a previous point-in-time using the **Against** feature. Queries are rounded off with support for time resolution, ordering, and limits. -- Determine field data types and names. -- Edit field properties. -- Gain insights about the underlying data using quick charts. -- Add virtual fields. +Any query you create can be saved as well as easily sharable with your team. - + ## 4. Explore your data -While viewing individual events can be very useful, at scale and for general monitoring and observability, it’s important to be able to quickly aggregate, filter, and segment your data. +Axiom Processing Language enhanced data exploration capabilities allows users to write powerful queries to explore, analyze, and visualize large queries in real-time. + + + Explore tab + -The Query tab gives you various tools to extract insights from your data: -- Visualize aggregations with count, min, max, average, percentiles, heatmaps, and more. -- Filter events. -- Segment data with `group-by`. +By writing targeted queries with APL, you can swiftly identify and diagnose issues, reducing downtime and minimizing the impact on your business operations. APL’s ability to analyze logs and data in real-time allows you to stay on top of potential problems and address them before they escalate. - + ## 5. Monitor for problems -Get alerted when there are problems with your data. For example: +Get alerted when there are problems with your data, such as -- A queue size is larger than acceptable limits. -- Web containers take too long to respond. -- A specific customer starts using a new feature. +- A queue size is larger than acceptable limits +- Web containers are taking too long to respond +- A specific customer has started using a new feature +- etc, etc - + + Monitors tab + + +Axiom alerting consists of two key concepts: + +1. Monitors that run in the background querying your data on a frequency and checking whether a threshold has been reached to trigger the monitor, and +2. Notifiers which encapsulate how to alert a person, a team, or a service that a monitor has been triggered. + +Monitors are configured with the following: +- Query +- Frequency is how often the monitor runs +- Interval is the time range of data that the monitor queries +- Threshold is the value where the monitor triggers +- One or more notifiers that specify how to alert you when the monitor is triggered + + ## 6. Integrate with data shippers Integrations can be installed and configured using different third-party Data shippers to quickly get insights from your logs and services by setting up a background task that continuously synchronizes events into Axiom. - + + +## 7. Customize for your organization -## 7. Customize your organization +As your use of Axiom widens, you can customize it for your organization’s needs: -As your use of Axiom widens, customize it for your organization’s needs. For example: +- Add users +- Set up third-party authentication providers +- Set up role-based access control +- Create and manage API tokens -- Add users. -- Set up third-party authentication providers. -- Set up role-based access control. -- Create and manage API tokens. + + Settings + - + diff --git a/introduction.mdx b/introduction.mdx index e66e07fd..38bd55a2 100644 --- a/introduction.mdx +++ b/introduction.mdx @@ -26,17 +26,10 @@ The Axiom documentation enables you to gain a deeper understanding of what Axiom Get data into Axiom - - Inspect streams of data live - - Gain insights from your data - - - Personalize custom models + Inspect streams of data live Alert in real-time - Filter, shape, and route data + Personalize custom models Enrich your Axiom organization diff --git a/mint.json b/mint.json index 82da05de..8fdbbc88 100644 --- a/mint.json +++ b/mint.json @@ -164,8 +164,8 @@ "icon": "server", "pages": [ "query-data/datasets", - "query-data/stream", "query-data/explore", + "query-data/stream", "query-data/visualizations", "query-data/virtual-fields", "query-data/traces" diff --git a/query-data/datasets.mdx b/query-data/datasets.mdx index 692437a7..83ecb6af 100644 --- a/query-data/datasets.mdx +++ b/query-data/datasets.mdx @@ -1,80 +1,255 @@ --- title: 'Analyze data' -description: This page explains how to use the Datasets tab in Axiom. +description: 'Gain insights from your data visually, and run aggregations across all or a subset of events in a dataset.' sidebarTitle: Analyze Data tags: ['axiom documentation', 'documentation', 'axiom', 'analytics', 'dataset', 'queries', 'virtual fields', 'visualizations', 'filters', 'charts'] --- -The Datasets tab allows you to gain a better understanding of the fields you have in your datasets. +The Datasets tab allows you to gain insights from your data visually. -In Axiom, an individual piece of data is an event, and a dataset is a collection of related events. Datasets contain incoming event data. The Datasets tab provides you with information about each field within your datasets. +Rather than inspect individual events, you can run aggregations across all or a subset of events in a dataset and visualize the output. Queries can be crafted to get any level of detail from results, and are easily saved for future use as well as being easy to share with team members. -## Datasets overview +This section introduces the Datasets tab and its components that unlock powerful insights from your data. -When you open the Datasets tab, you see the list of datasets on the left. To explore the fields in a dataset, select the dataset from the list on the left. +## Select a dataset -On the right, you see the following: -- The list of integration dashboards appears on the Datasets overview page. These are prebuilt dashboards automatically generated by Axiom to enhance your experience. For more information, see [Apps](/apps). -- The list of [starred queries](#starred-queries) -- The [query history](#query-history) +As all events in Axiom reside in a dataset, first choose a dataset to analyze. When no dataset is chosen, you are presented with a list of your datasets and quick-access panels for recent Starred Queries and Query History (see [Dataset Overview](#dataset-overview) for more detail): -## Fields list + + Datasets overview + -When you select a dataset, Axiom displays the list of fields within the dataset. +Select a dataset from the list of datasets: -The field types are the following: -- String -- Number -- Boolean -- Array -- [Virtual fields](#virtual-fields) + + Datasets lists + -This view flattens field names with dot notation. This means that the event `{"foo": { "bar": "baz" }}` appears as `foo.bar`. Field names containing periods (`.`) are folded. +## Dataset overview -### Edit field +After selecting a dataset, you see an overview of the dataset, its fields, starred queries, query history, and the query builder: -Click the field name to change the following: -- Change the field description. -- Change the field unit. This is only available for number field types. -- Hide the field. This means that the field is still present in the underlying Axiom database, but it doesn’t appear in the Axiom UI. Use this option if you sent the field to Axiom by mistake or you don’t want to use it anymore in Axiom. + + Dataset overview + -## Quick charts +### Fields List -Quick charts allow fast charting of fields depending on their field type. For example, for number fields, choose one of the following for easily visualizing -- Percent icon Percentiles -- Stopwatch icon Averages -- Scatter chart icon Histograms +The fields list gives an overview of all fields from all events that are in this dataset. -## Virtual fields +### Field Type -Virtual fields are powerful expressions that run on every event during a query to create new fields. The virtual fields are calculated from the events in the query using an APL expression. They’re similar to tools like derived columns in other products but super-charged with an expressive interpreter and with the flexibility to add, edit, or remove them any time. +- Supported types are: + - `string` + - `number` + - `boolean` + - `array` +- Field names are flattened with dot-notation so an event like `{"foo": { "bar": "baz" }}` as a field called `foo.bar` -To manage a dataset’s virtual fields, click Virtual fields icon in the toolbar. +### Field name -## Queries +Field names match the JSON specification. Field names containing periods (`.`) are folded. -Every query has a unique ID that you can save and share with your team members. The Datasets tab allows you to do the following: -- Find a past query. -- Run previously saved queries. -- Star a query so that you and your team members can easily find it in the future. +If you get a 400 when you use the field name `_time` with the [Elastic Search endpoint](/send-data/elastic-beats) or when you override the [`timestamp` field](/reference/field-restrictions), use the query parameter `?timestamp-field` to set a field as the time field. -### Recent queries +### Quick charts -To find and run recent queries: -1. Click **Query library** in the toolbar. -1. Click the **Recent** tab. -1. Optional: In the top right, select whether to display Single user icon your queries or Many users icon your team’s queries. -1. Find the query in the list, and then click it to run the query. +Quick charts allow fast charting of fields depending on their field type. For example, number fields have quick charts for easily visualizing percentiles, averages, and histograms. -### Saved queries + + Fields list + -To find and run previously saved queries: -1. Click **Query library** in the toolbar. -1. Click the **Saved** tab. -1. Optional: In the top right, select whether to display Single user icon your queries or Many users icon your team’s queries. -1. Find the query in the list, and then click it to run the query. +### Virtual fields + +Virtual fields are powerful expressions that run on every event during a query to create new fields. The virtual fields are calculated from the events in the query using an APL expression. They’re similar to tools like derived-columns in other products but super-charged with an expressive interpreter and with the flexibility to add/edit/remove them at any time. + + + Virtual fields slide-out + + +Click **Virtual fields** on the toolbar to manage of a dataset’s virtual fields. + + + Virtual fields tool button + ### Starred queries -In the **Starred queries** section on the right, you see queries saved for future use. They’re great for keeping a list of useful queries for a dataset. All starred queries are shared with your team. \ No newline at end of file +Starred queries are queries saved for future use. They’re great for keeping a list of useful queries for a dataset. All starred queries are shared with your team. + +Click **Starred queries** on the toolbar to manage starred queries. + + + Starred tool button + + +### Query history + +Every query you and your team members run is given a unique ID and saved inside Axiom. Use the query history to share results with other members or find a past query that you want to star for future use. + +Click **Query History** on the toolbar: + + + Query history tool button + + +You see historical queries in reverse-chronological order. You can choose between your own queries or those of your team: + + + Query history slide-out + + +## Build a query + +Use the query builder to create or edit queries for the selected dataset: + + + Query builder + + +This component is a visual query builder that eases the process of building visualizations and segments of your data. + +This guide walks you through the individual sections of the query builder. + +### Time range + +Every query has a start and end time and the time range component allows quick selection of common time ranges as well as the ability to input specific start and end timestamps: + + + Time range + + +- Use the **Quick Range** items to quickly select popular ranges +- Use the **Custom Start/End Date** inputs to select specific times +- Use the **Resolution** items to choose between various time bucket resolutions + +### Against + +When a time series visualization is selected, such as `count`, the **Against** menu is enabled and it’s possible to select a historical time to compare the results of your time range too. + +For example, to compare the last hour’s average response time to the same time yesterday, select `1 hr` in the time range menu, and then select `-1D` from the **Against** menu: + + + Time range against menu + + +The results look like this: + + + Time range against chart + + +The dotted line represents results from the base date, and the totals table includes the comparative totals. + +When you add `field` to the `group by` clause, the **time range against** values are attached to each `events`. + + + Time range against chart + + +### Visualizations + +Axiom provides powerful visualizations that display the output of running aggregate functions across your dataset. The Visualization menu allows you to add these visualizations and, where required, input their arguments: + + + Visualizations menu + + +You can select a visualization to add it to the query. If a visualization requires an argument (such as the field and/or other parameters), the menu allows you to select eligible fields and input those arguments. Press `Enter` to complete the addition: + + + Visualizations demo + + +Click Visualization in the query builder to edit it at any time. + +[Learn about supported visualizations](/query-data/visualizations) + +### Filters + +Use the filter menu to attach filter clauses to your search. + +Axiom supports AND/OR operators at the top-level as well as one level deep. This means you can create filters that would read as `status == 200 AND (method == get OR method == head) AND (user-agent contains Mozilla or user-agent contains Webkit)`. + +Filters are divided up by the field type they operate on, but some may apply to more than one field type. + + + Filters demo + + +#### List of filters + +_String Fields_ + +- `==` +- `!=` +- `exists` +- `not-exists` +- `starts-with` +- `not-starts-with` +- `ends-with` +- `not-ends-with` +- `contains` +- `not-contains` +- `regexp` +- `not-regexp` + +_Number Fields_ + +- `==` +- `!=` +- `exists` +- `not-exists` +- `>` +- `>=` +- `<` +- `<=` + +_Boolean Fields_ + +- `==` +- `!=` +- `exists` +- `not-exists` + +_Array Fields_ + +- `contains` +- `not-contains` +- `exists` +- `not-exists` + +#### Special fields + +Axiom creates the following two fields automatically for a new dataset: + +- `_time` is the timestamp of the event. If the data you ingest doesn’t have a `_time` field, Axiom assigns the time of the data ingest to the events. +- `_sysTime` is the time when you ingested the data. + +In most cases, you can use `_time` and `_sysTime` interchangeably. The difference between them can be useful if you experience clock skews on your event-producing systems. + +### Group by (segmentation) + +When visualizing data, it can be useful to segment data into specific groups to more clearly understand how the data behaves. + +The Group By component enables you to add one or more fields to group events by: + + + Group by + + +### Other options + +#### Order + +By default, Axiom automatically chooses the best ordering for results. However, you can manually set the desired order through this menu. + +#### Limit + +By default, Axiom chooses a reasonable limit for the query that has been passed in. However, you can control that limit manually through this component. + +## Results view + +Axiom displays the results of the query in the Explore tab. For more information, see [Explore](/query-data/explore#query-results). \ No newline at end of file diff --git a/query-data/explore.mdx b/query-data/explore.mdx index d5d78b1e..2943dbd5 100644 --- a/query-data/explore.mdx +++ b/query-data/explore.mdx @@ -6,11 +6,11 @@ tags: ['axiom documentation', 'documentation', 'axiom', 'dashboards', 'monitors', 'notifiers', 'slack', 'data explorer', 'apl', 'count', 'operator'] --- -The Query tab provides you with robust computation and processing power to get deeper insights into your data. It enables you to filter, manipulate, extend, and summarize your data. +The Explore tab provides you with robust computation and processing power to get deeper insights into your data. It enables you to filter, manipulate, extend, and summarize your data. -## Use the Query tab +## Use the Explore tab -Go to the Query tab and choose one of the following options: +Go to the Explore tab and choose one of the following options: - [Create a query with the visual query builder](#create-a-query-using-the-visual-query-builder). - [Create a query using Axiom Processing Language (APL)](#create-a-query-using-apl). diff --git a/query-data/stream.mdx b/query-data/stream.mdx index df98a7be..ca96f3a4 100644 --- a/query-data/stream.mdx +++ b/query-data/stream.mdx @@ -1,5 +1,5 @@ --- -title: 'Stream data with Axiom' +title: 'Stream data' description: 'The Stream tab enables you to process and analyze high volumes of high-velocity data from a variety of sources in real time.' sidebarTitle: Stream Data tags: @@ -14,7 +14,7 @@ This section introduces the Stream tab and its components that unlock powerful i ## Choose a dataset -The default view is one where you can easily see which datasets are available and also see some recent Starred Queries in case you want to jump directly into a stream: +Similar to the [Datasets](/query-data/datasets) tab, the Stream tab requires a selected dataset. And so the default view is one where you can easily see which datasets are available and also see some recent Starred Queries in case you want to jump directly into a stream: Datasets overview @@ -46,13 +46,13 @@ You can view and copy the raw data: ## Filter data -The Stream tab provides access to a powerful filter builder right on the toolbar: +As with the [Datasets](/query-data/datasets#filters) tab, the Stream tab provides access to a powerful filter builder right on the toolbar: Filter bar -For more information, see the [filters documentation](/dashboard-elements/create#filters). +It provides all the features of the filter bar in the Datasets tab. See the [filters documentation](/query-data/datasets#filters) for more information. ## Time range selection @@ -95,7 +95,7 @@ Options include: ## Starred queries -The starred queries slide-out is activated via the toolbar: +Similar to the Explore tab, the starred queries slide-out is activated via the toolbar: Starred queries diff --git a/query-data/traces.mdx b/query-data/traces.mdx index 55dbe27b..d74b81f6 100644 --- a/query-data/traces.mdx +++ b/query-data/traces.mdx @@ -98,10 +98,10 @@ To try out this example, go to the Axiom Playground. [Run in Playground](https://play.axiom.co/axiom-play-qf1k/dashboards/otel.traces.otel-demo-traces) -To access the waterfall view from the Query tab, follow these steps: +To access the waterfall view from Explore, follow these steps: 1. Ensure the dataset you work with has trace data. -2. Click the Query tab. +2. Click the `Explore` tab. 3. Run a query that returns the `_time` and `trace_id` fields. For example, the following query returns the number of spans in each trace: ```kusto diff --git a/query-data/virtual-fields.mdx b/query-data/virtual-fields.mdx index d8bf3c2e..0a3f0816 100644 --- a/query-data/virtual-fields.mdx +++ b/query-data/virtual-fields.mdx @@ -18,13 +18,15 @@ In this guide, you’ll be introduced to virtual fields, their features, how to To create a virtual field, follow these steps: -1. Go to the Datasets tab. +1. Open the [Datasets](/query-data/datasets) or the [Stream](/query-data/stream) tab. 2. Select the dataset where you want to create the virtual field. 3. Click the Virtual fields icon **Virtual fields** icon in the top right. You see a list of all the virtual fields for the dataset. 4. Click **Add virtual field**. 5. Fill in the following fields: + - **Name** and **Description** help your team understand what the virtual field is about. - **Expression** is the formula applied to every event to calculate the virtual field. The expression produces a result such as a `boolean`, `string`, `number`, or `object`. + The **Preview** section displays the result of applying the expression to some of your data. Use this section to verify the expression and the resulting values of the virtual field. The power of virtual fields is in letting you manipulate data on read instead of on write, allowing you to adjust and update virtual fields over time as well as easily add new ones without worrying that the data has already been indexed. diff --git a/reference/audit-log.mdx b/reference/audit-log.mdx index 35d39ec6..6c0e87c8 100644 --- a/reference/audit-log.mdx +++ b/reference/audit-log.mdx @@ -23,7 +23,7 @@ The audit log is available to all users. Enterprise customers can query the audi ## Explore audit log -1. Go to the Query tab, and then click **APL**. +1. Go to the **Explore** tab, and then click **APL**. 2. Query the `axiom-audit` dataset. For example, run the query `['axiom-audit']` to display the raw audit log data in a table. 3. Optional: Customize your query to filter or summarize the audit log. For more information, see [Explore data](/query-data/explore). 4. Click **Run**. diff --git a/send-data/elastic-beats.mdx b/send-data/elastic-beats.mdx index 06e069bd..8767e442 100644 --- a/send-data/elastic-beats.mdx +++ b/send-data/elastic-beats.mdx @@ -12,15 +12,15 @@ There are different [Elastic Beats](https://www.elastic.co/beats/) you could use You'd need to specify the `org-id` header if you are using personal token, it’s best to use an API token to avoid the need to specify the `org-id` header. -Learn more about [API and Personal Token](/reference/tokens). +Learn more about [API and Personal Token](/reference/tokens) + +You get a `400` if you use the field name `_time` when using the [Elastic Search endpoint](/send-data/elastic-beats). Axiom accepts many date strings and timestamps without knowing the format in advance, including Unix Epoch, RFC3339, and ISO 8601. To ensure compatibility with Axiom, use the following versions: - For Elastic Beats log shippers such as Filebeat, Metricbeat, Heartbeat, Auditbeat, and Packetbeat, use their open-source software (OSS) version 8.12.1 or lower. - For Winlogbeat, use the OSS version 7.17.22 or lower. - For Journalbeat, use the OSS version 7.15.2 or lower. - -If you get a 400 error when you use the field name `_time` or when you override the [`timestamp` field](/reference/field-restrictions), use the query parameter `?timestamp-field` to set a field as the time field. ## Filebeat diff --git a/snippets/create-dashboard-element.mdx b/snippets/create-dashboard-element.mdx index 03e82b7b..18a96eac 100644 --- a/snippets/create-dashboard-element.mdx +++ b/snippets/create-dashboard-element.mdx @@ -4,8 +4,8 @@ 1. Click Add chart **Add chart** in the top right corner. 1. Click **{elementButtonLabel}** from the list. 1. Choose one of the following: - - Click **Simple Query Builder** to create your chart using a visual query builder. For more information, see [Create chart using visual query builder](/dashboard-elements/create#create-chart-using-visual-query-builder). - - Click **Advanced Query Language** to create your chart using the Axiom Processing Language (APL). Create a chart in the same way you create a chart in the APL query builder of the [Query tab](/query-data/explore#create-a-query-using-apl). + - Click **Simple Query Builder** to create your chart using a visual query builder. Create a chart in the same way you create a chart in the [Datasets tab](/query-data/datasets). + - Click **Advanced Query Language** to create your chart using the Axiom Processing Language (APL). Create a chart in the same way you create a chart in the APL query builder of the [Explore tab](/query-data/explore#create-a-query-using-apl). 1. Optional: [Configure the dashboard element](/dashboard-elements/configure). 1. Click **Save**. diff --git a/vale/styles/docs/word-choice.yml b/vale/styles/docs/word-choice.yml index 13387444..d539de50 100644 --- a/vale/styles/docs/word-choice.yml +++ b/vale/styles/docs/word-choice.yml @@ -7,8 +7,7 @@ action: name: replace swap: (?:[Dd])atasets (?:page|view): Datasets tab - (?:[Ee])xplore (?:page|view): Query tab - Data Explorer: Query tab + (?:[Ee])xplore (?:page|view): Explore tab + Data Explorer: Explore tab (?:[Ss])tream (?:page|view): Stream tab - (?:[Cc])olumn: field - Explore tab: Query tab \ No newline at end of file + (?:[Cc])olumn: field \ No newline at end of file