Unified Query Language User Guide
Overview
Unified Query Language (UQL) is a domain-specific language that is used to observe data in Cisco Observability Platform. Some of its features are:
- It is a domain-specific language for the MELT (metrics, events, logs, traces) model.
- It is a declarative language
- It is a data query language
- It is read-only
- It presents
MELT data and State in the scope of monitored topology
All UQL queries are executed for a specific time range. UQL presents MELT data (metrics, events, logs, traces) and State in the scope of monitored topology.
The various sections of this document describe the UQL components and provide examples.
Query defines the selection and transformation of observed data from a single tenant. UQL is built as a form (or questionnaire). The query consists of answers to specific questions or form fields.
- Each answer starts with a reserved word.
- Answers can be in any order.
- Some questions are distinct, the query can contain answer only for one of these questions.
- Some questions provide default answers.
- Specific questions define specific syntax - It still shares generic principles (such as, escaping, reserved characters).
A Form block or the UQL questionnaire comprises objects that are specified using conditions. These conditions are based on associated MELT data, state data, topology data, or a combination of these data, including attributes of primary objects and relationships. Primary topology objects are Entities, Transactions, and Interactions.
Examples:
- MELT data: "Entities with more than 100 error log messages in last hour"
- State data: "Entities with tag 'region' equal to 'FRA'"
- Topology attributes: "Entities with type 'Pod'" or "Interactions starting from Service 123"
- Relationships: "All pods associated with Application 123"