How to write this subquery
My logs have two statements, linked by a trace-id that I need to connect.
for example
"6:00:00 [abcdef] Job started by Alice"
"6:15:00 [jklmno] Job started by Bob"
"7:00:00 [abcdef] Job returned response 123"
"6:30:00 [jklmno] Job returned response 456"
What I'd like to see is a query showing:
"1:00 duration - by Alice - response 123"
"0:15 duration - by Bob - response 456"
I can't figure out how to do this with these subqueries... documentation and examples insufficient.
-
Official comment
Hey Alex,
Transactionize can be very useful especially in this type of use case.
Another way to get the duration is to use max() and min(), then do some math by each trace-id:
| max(_messagetime), min(_messagetime) by trace-id
| _max-_min as duration
You may also want to do this over time to show on a dashboard, in the below case you would want to use some query logic to remove traces where the start time is before the timeslice start or the end time is after the timeslice end:
| timeslice 10m
| max(_messagetime), min(_messagetime) by trace-id, _timeslice
| _max-_min as duration_ms | duration_ms/1000 as duration_sec
| pct(duration_sec,50,95) by _timeslice
Hope this helps!Comment actions
Please sign in to leave a comment.
Comments
2 comments