Coralogix 查询语法

DataPrime 查询语法

source logs 
| filter $m.severity == ERROR 
| groupby $l.subsystemname as service aggregate count() as error_count 
| orderby $d.error_count desc 
| limit 5

数据标签说明

Ref: https://coralogix.com/docs/dataprime/beginners-guide/how-data-is-represented-in-dataprime/

在 DataPrime 中，数据使用四个关键路径前缀进行组织：$l（用户定义标签）、$m（元数据）、$p（参数元数据）和$d（实际事件数据）。每个前缀在 JSON 结构中创建一个命名空间，这些不同的数据类型和上下文被分离，除非用户明确合并。

$l / $labels: User-managed labels

Field 字段	Description 描述	Type 类型
applicationname	The name of the application generating the event 生成事件的应程序名称	string
subsystemname	The specific subsystem of the application 应程序的特定子系统	string
category	The event’s category, such as type or function 事件的类别，例如类型或功能	string
classname	The name of the class where the event occurred 事件发生所在的类名称	string
computername	The name of the machine or host 机器或主机的名称	string
methodname	The method or function related to the event 与事件相关的操作或函数	string
threadid	The ID of the thread that triggered the event 触发事件的线程 ID	number
ipaddress	The IP address from where the event originated 事件发生的 IP 地址	string

$m / $metadata: System metadata

本节包含自动生成的元数据，用于描述事件上下文。以下是 $m 命名空间内的字段：

Field 字段	Description 描述	Possible Values 可能值	Type 类型
timestamp	The time the event was recorded 事件记录时间	-	timestamp
severity	The event’s severity level 事件严重程度	Debug, Verbose, Info, Warning, Error, Critical	string
priorityclass	Indicates the event’s importance 指示事件的重要性	high, medium, low	string
logid	A unique identifier for the log 日志的唯一标识符	-	string

$d / $data: User data (actual event content)

本节包含用户提供的确切数据，代表事件的主要内容。

由于这是默认命名空间，您可以通过省略前缀来保持查询简洁。在本参考中，示例查询为简化起见，不包含对 $d 的明确引用。

• Purpose: Holds the raw data that makes up the event content.
• Behavior: As the default namespace, $d is optional in queries.
• Example Use Case: User logs or spans

Nested field access 嵌套字段访问

Nested keys may be accessed using dot notation (e.g., k8s.container.name) or map notation (e.g., $d['my_key.with-special-chars']) for fields containing special characters.

Examples: 示例：

• Dot Notation: user.name (to access the name field inside user)
• Map Notation: $d['my-special.log-key'] (for fields with special characters in their keys)

查询

source logs | count   #  查询log 数据集

between <timestamp> and <timestamp>

source logs between @'2025-06-01T00:00:00Z' and @'2025-06-02T00:00:00Z' # 处理时间范围

last <interval>

source logs last 1h| count  # 查询一小时前数据.

after <timestamp>

source logs after @'now' - 3h| count 

timeshifted <interval>

 Query:
source logs timeshifted 1h

# Explanation: Shift events forward by 1 hour

# Query:
source logs timeshifted -1d

# Explanation: Shift events backwards by 1 day

具体时间序列操作可以参考: https://coralogix.com/docs/dataprime/beginners-guide/working-with-time-in-dataprime/