UQL Query

The Unified Query Language (UQL) query comprises clauses. The query can contain clauses in any order. You can type the keyword in upper or lower case. However, you must not use mixed-case. Each clause starts with a keyword and defines a selection of some query aspect.

UQL supports the following clauses:

• FETCH - Defines the observation data that will be in the response. This is a mandatory clause.
• SINCE - Defines the start of queried time interval.
• UNTIL - Defines the end of queried time interval.
• FROM - Defines the topology of the query (entities and their relationships).
• NAMESPACES - Defines default namespaces for types used in the query.
• LIMITS - Defines limits for array MELT data.
• ORDER - Defines the order for array MELT data.

'FETCH' is the only mandatory block to fetch events. For all other cases, 'FETCH' and 'FROM' are only mandatory blocks. All other blocks are optional and have a default value.

Example:

Copyfetch
  id, 
  attributes("service.name")
from
  entities(apm:service)

Note the following points from the example:

• The fetch block defines the metric, events, logs, and traces (MELT) or state data to be returned:

  • the ID of selected entities.

  • the attribute `service.name`` of the selected entities.

• The from block defines the topology context of the query - entities and their associations:

  • get the data for the entities of the type apm:service.

Escape Identifiers and Strings

You can use the Identifiers (types, aliases, ...) without any escaping if they comprise these alpha-numeric and special characters [a-zA-Z_][a-zA-Z0-9_@]*. Otherwise, you must escape them by enclosing them in backticks `<identifier>`.

Note

An identifier cannot contain a backtick as escaping of backtick is not supported.

String constants must be enclosed by either:

• single quotes '<string_constant>'

• double quotes "<string_constant>"

Quoting and Escaping Rules

• A single-quoted string containing the ' character needs to have it escaped with a backslash, particularly \'.

• A double-quoted string containing the " character needs to have it escaped with a backslash, particularly \".

• If the string contains the backslash character \, it must be escaped with a backslash \\.

• If the string contains an escaped ordinary character (e.g., \a), it will resolve to the character it represents (e.g., a).

UQL string examples:

Escaping In Wildcards

The escaping behavior for wildcard filters is mentioned in the Filter Metrics, Spans, and Traces with Wildcards section.