65 lines
2.8 KiB
Plaintext
65 lines
2.8 KiB
Plaintext
[role="xpack"]
|
|
[[advanced-queries]]
|
|
=== Query your data
|
|
|
|
Querying your APM data is a powerful tool that can make finding bottlenecks in your code even easier.
|
|
Imagine you have a user that complains about a slow response time in a specific service.
|
|
With the query bar, you can easily filter the APM app to only display trace data for that user,
|
|
or, to only show transactions that are slower than a specified time threshold.
|
|
|
|
[float]
|
|
==== Example APM app queries
|
|
|
|
* Exclude response times slower than 2000 ms: `transaction.duration.us > 2000000`
|
|
* Filter by response status code: `context.response.status_code ≥ 400`
|
|
* Filter by single user ID: `context.user.id : 12`
|
|
|
|
When querying in the APM app, you're merely searching and selecting data from fields in Elasticsearch documents.
|
|
Queries entered into the query bar are also added as parameters to the URL,
|
|
so it's easy to share a specific query or view with others.
|
|
|
|
When you type, you can begin to see some of the transaction fields available for filtering:
|
|
|
|
[role="screenshot"]
|
|
image::apm/images/apm-query-bar.png[Example of the Kibana Query bar in APM app in Kibana]
|
|
|
|
TIP: Read the {kibana-ref}/kuery-query.html[Kibana Query Language Enhancements] documentation to learn more about the capabilities of the {kib} query language.
|
|
|
|
[float]
|
|
[[discover-advanced-queries]]
|
|
=== Querying in Discover
|
|
|
|
Alternatively, you can query your APM documents in {kibana-ref}/discover.html[*Discover*].
|
|
Querying documents in *Discover* works the same way as querying in the APM app,
|
|
and *Discover* supports all of the example APM app queries shown on this page.
|
|
|
|
[float]
|
|
==== Example Discover query
|
|
|
|
One example where you may want to make use of *Discover*,
|
|
is for viewing _all_ transactions for an endpoint, instead of just a sample.
|
|
|
|
TIP: Starting in v7.6, you can view ten samples per bucket in the APM app, instead of just one.
|
|
|
|
Use the APM app to find a transaction name and time bucket that you're interested in learning more about.
|
|
Then, switch to *Discover* and make a search:
|
|
|
|
["source","sh"]
|
|
-----
|
|
processor.event: "transaction" AND transaction.name: "<TRANSACTION_NAME_HERE>" and transaction.duration.us > 13000 and transaction.duration.us < 14000`
|
|
-----
|
|
|
|
In this example, we're interested in viewing all of the `APIRestController#customers` transactions
|
|
that took between 13 and 14 milliseconds. Here's what Discover returns:
|
|
|
|
[role="screenshot"]
|
|
image::apm/images/advanced-discover.png[View all transactions in bucket]
|
|
|
|
You can now explore the data until you find a specific transaction that you're interested in.
|
|
Copy that transaction's `transaction.id`, and paste it into the APM app to view the data in the context of the APM app:
|
|
|
|
[role="screenshot"]
|
|
image::apm/images/specific-transaction-search.png[View specific transaction in apm app]
|
|
[role="screenshot"]
|
|
image::apm/images/specific-transaction.png[View specific transaction in apm app]
|