当前位置：首页 > news >正文

skywalking es查询整理

news 来源：原创 2025/7/22 12:22:52

索引介绍

sw_records-all

这个索引用于存储所有的采样记录，包括但不限于慢SQL查询、Agent分析得到的数据等。这些记录数据包括Traces、Logs、TopN采样语句和告警信息。它们被用于性能分析和故障排查，帮助开发者和运维团队理解服务的行为和性能特点。

mapping

 {"sw_records-all": {"aliases": {"sw_records-all": {}},"mappings": {"_source": {"excludes": ["tags"]},"properties": {"alarm_message": {"type": "keyword","copy_to": ["alarm_message_match"},"alarm_message_match": {"type": "text","analyzer": "oap_analyzer"},"continuous_profiling_json": {"type": "keyword","index": false},"create_time": {"type": "long"},"data_binary": {"type": "binary"},"dump_binary": {"type": "binary"},"dump_period": {"type": "integer"},"dump_time": {"type": "long"},"duration": {"type": "integer"},"end_time_nanos": {"type": "integer"},"end_time_second": {"type": "long"},"endpoint_name": {"type": "keyword"},"entity_id": {"type": "keyword"},"event": {"type": "keyword"},"extension_config_json": {"type": "keyword","index": false},"fixed_trigger_duration": {"type": "long"},"id0": {"type": "keyword","index": false},"id1": {"type": "keyword","index": false},"instance_id": {"type": "keyword"},"last_update_time": {"type": "long"},"latency": {"type": "long"},"logical_id": {"type": "keyword"},"max_sampling_count": {"type": "integer"},"min_duration_threshold": {"type": "integer"},"name": {"type": "keyword","index": false},"operation_time": {"type": "long"},"operation_type": {"type": "integer","index": false},"process_labels_json": {"type": "keyword"},"record_table": {"type": "keyword"},"related_trace_id": {"type": "keyword"},"rule_name": {"type": "keyword"},"schedule_id": {"type": "keyword"},"scope": {"type": "integer"},"segment_id": {"type": "keyword"},"sequence": {"type": "integer"},"service_id": {"type": "keyword"},"stack_binary": {"type": "binary"},"stack_id": {"type": "keyword"},"start_time": {"type": "long"},"start_time_nanos": {"type": "integer"},"start_time_second": {"type": "long"},"statement": {"type": "keyword","index": false},"tags": {"type": "keyword"},"tags_raw_data": {"type": "binary"},"target_type": {"type": "integer"},"task_id": {"type": "keyword"},"time_bucket": {"type": "long"},"timestamp": {"type": "long"},"trace_id": {"type": "keyword","index": false},"trace_ref_type": {"type": "integer"},"trace_segment_id": {"type": "keyword"},"trace_span_id": {"type": "keyword"},"trigger_type": {"type": "integer"},"upload_time": {"type": "long"}}},"settings": {"index": {"routing": {"allocation": {"include": {"_tier_preference": "data_content"}}},"refresh_interval": "30s","number_of_shards": "1","provided_name": "sw_records-all-20241125","creation_date": "1732464023751","analysis": {"analyzer": {"oap_analyzer": {"type": "stop"}}},"number_of_replicas": "1","uuid": "qrRVCMSNSnO90iz9hHWD0Q","version": {"created": "7170799"}}}}
}

sw_metrics-all

这个索引存储服务、服务实例及端点的元数据，即指标信息。这些指标数据包括服务的响应时间、吞吐量、错误率等关键性能指标，以分钟级别存储。这些数据对于监控服务性能至关重要，因为它们提供了实时的性能反馈，使得团队能够快速识别和解决性能问题。

metric_table枚举值

1、endpoint_cpm：端点的每分钟调用次数（CPM）

2、endpoint_percentile：端点的响应时间百分位数

3、endpoint_resp_time：端点的平均响应时间

4、endpoint_sla：服务等级协议（SLA）指标

5、endpoint_sidecar_internal_req_latency_nanos 和 endpoint_sidecar_internal_resp_latency_nanos：端点Sidecar内部请求和响应延迟的纳秒数

6、instance_jvm_xxx：服务实例的JVM相关指标，如类加载数量、CPU使用率、内存使用情况、垃圾回收次数和线程状态等

7、meter_thread_pool：线程池相关的度量

8、service_instance_cpm、service_instance_resp_time、service_instance_sla：服务实例级别的CPM、响应时间和SLA指标

9、service_instance_sidecar_internal_req_latency_nanos 和 service_instance_sidecar_internal_resp_latency_nanos：服务实例级别的Sidecar内部请求和响应延迟的纳秒数

result

{"key": "endpoint_cpm","doc_count": 5763},{"key": "endpoint_percentile","doc_count": 5763},{"key": "endpoint_resp_time","doc_count": 5763},{"key": "endpoint_sla","doc_count": 5763},{"key": "endpoint_sidecar_internal_req_latency_nanos","doc_count": 5754},{"key": "endpoint_sidecar_internal_resp_latency_nanos","doc_count": 5754},{"key": "instance_jvm_class_loaded_class_count","doc_count": 2811},{"key": "instance_jvm_class_total_loaded_class_count","doc_count": 2811},{"key": "instance_jvm_class_total_unloaded_class_count","doc_count": 2811},{"key": "instance_jvm_cpu","doc_count": 2811},{"key": "instance_jvm_memory_heap","doc_count": 2811},{"key": "instance_jvm_memory_heap_max","doc_count": 2811},{"key": "instance_jvm_memory_noheap","doc_count": 2811},{"key": "instance_jvm_memory_noheap_max","doc_count": 2811},{"key": "instance_jvm_old_gc_count","doc_count": 2811},{"key": "instance_jvm_old_gc_time","doc_count": 2811},{"key": "instance_jvm_thread_blocked_state_thread_count","doc_count": 2811},{"key": "instance_jvm_thread_daemon_count","doc_count": 2811},{"key": "instance_jvm_thread_live_count","doc_count": 2811},{"key": "instance_jvm_thread_peak_count","doc_count": 2811},{"key": "instance_jvm_thread_runnable_state_thread_count","doc_count": 2811},{"key": "instance_jvm_thread_timed_waiting_state_thread_count","doc_count": 2811},{"key": "instance_jvm_thread_waiting_state_thread_count","doc_count": 2811},{"key": "instance_jvm_young_gc_count","doc_count": 2811},{"key": "instance_jvm_young_gc_time","doc_count": 2811},{"key": "meter_thread_pool","doc_count": 2811},{"key": "service_instance_cpm","doc_count": 1661},{"key": "service_instance_resp_time","doc_count": 1661},{"key": "service_instance_sla","doc_count": 1661},{"key": "service_instance_sidecar_internal_req_latency_nanos","doc_count": 1659},{"key": "service_instance_sidecar_internal_resp_latency_nanos","doc_count": 1659}

mapping

{"sw_metrics-all-20241125": {"aliases": {"sw_metrics-all": {}},"mappings": {"properties": {"address": {"type": "keyword"},"agent_id": {"type": "keyword"},"component_id": {"type": "integer","index": false},"component_ids": {"type": "keyword","index": false},"count": {"type": "long","index": false},"dataset": {"type": "text","index": false},"datatable_count": {"type": "text","index": false},"datatable_summation": {"type": "text","index": false},"datatable_value": {"type": "text","index": false},"denominator": {"type": "long"},"dest_endpoint": {"type": "keyword"},"dest_process_id": {"type": "keyword"},"dest_service_id": {"type": "keyword"},"dest_service_instance_id": {"type": "keyword"},"detect_type": {"type": "integer"},"double_summation": {"type": "double","index": false},"double_value": {"type": "double"},"ebpf_profiling_schedule_id": {"type": "keyword"},"end_time": {"type": "long"},"endpoint": {"type": "keyword"},"endpoint_traffic_name": {"type": "keyword","copy_to": ["endpoint_traffic_name_match"]},"endpoint_traffic_name_match": {"type": "text","analyzer": "oap_analyzer"},"entity_id": {"type": "keyword"},"instance_id": {"type": "keyword"},"instance_traffic_name": {"type": "keyword","index": false},"int_value": {"type": "integer"},"label": {"type": "keyword"},"labels_json": {"type": "keyword","index": false},"last_ping": {"type": "long"},"last_update_time_bucket": {"type": "long"},"layer": {"type": "integer"},"match": {"type": "long","index": false},"message": {"type": "keyword"},"metric_table": {"type": "keyword"},"name": {"type": "keyword"},"numerator": {"type": "long"},"parameters": {"type": "keyword","index": false},"percentage": {"type": "integer"},"precision": {"type": "integer","index": false},"process_id": {"type": "keyword"},"profiling_support_status": {"type": "integer"},"properties": {"type": "text","index": false},"ranks": {"type": "text","index": false},"remote_service_name": {"type": "keyword"},"represent_service_id": {"type": "keyword"},"represent_service_instance_id": {"type": "keyword"},"s_num": {"type": "long","index": false},"service": {"type": "keyword"},"service_group": {"type": "keyword"},"service_id": {"type": "keyword"},"service_instance": {"type": "keyword"},"service_instance_id": {"type": "keyword"},"service_name": {"type": "keyword"},"service_traffic_name": {"type": "keyword","copy_to": ["service_traffic_name_match"]},"service_traffic_name_match": {"type": "text","analyzer": "oap_analyzer"},"short_name": {"type": "keyword"},"source_endpoint": {"type": "keyword"},"source_process_id": {"type": "keyword"},"source_service_id": {"type": "keyword"},"source_service_instance_id": {"type": "keyword"},"span_name": {"type": "keyword"},"start_time": {"type": "long"},"summation": {"type": "long","index": false},"t_num": {"type": "long","index": false},"tag_key": {"type": "keyword"},"tag_type": {"type": "keyword"},"tag_value": {"type": "keyword"},"task_id": {"type": "keyword"},"time_bucket": {"type": "long"},"total": {"type": "long","index": false},"total_num": {"type": "long","index": false},"type": {"type": "keyword"},"uuid": {"type": "keyword"},"value": {"type": "long"}}},"settings": {"index": {"routing": {"allocation": {"include": {"_tier_preference": "data_content"}}},"refresh_interval": "30s","number_of_shards": "1","provided_name": "sw_metrics-all-20241125","creation_date": "1732464018472","analysis": {"analyzer": {"oap_analyzer": {"type": "stop"}}},"number_of_replicas": "1","uuid": "WzZSWrHRSKaHFFwbm5D75A","version": {"created": "7170799"}}}}
}

字段解释

address：服务实例的网络地址

agent_id：SkyWalking Agent的唯一标识符

component_id：组件的唯一标识符

component_ids：一个包含多个组件ID的列表，用于标识服务中使用的所有组件

count：计数器，记录调用次数等

dataset：数据集的标识符，用于区分不同类型的监控数据

datatable_count、datatable_summation、datatable_value：与数据表相关的字段，用于存储汇总数据

denominator：用于计算比率的分母值

dest_endpoint：目标端点的名称，用于标识服务调用的目标

dest_process_id、dest_service_id、dest_service_instance_id：目标进程、服务和实例的唯一标识符

detect_type：检测类型的标识符

double_summation：双精度浮点数的总和

double_value：双精度浮点数值

ebpf_profiling_schedule_id：eBPF性能分析任务的标识符

end_time：事件或记录的结束时间戳

endpoint：端点的名称，用于标识服务中的特定操作

endpoint_traffic_name：端点流量的名称，用于标识端点的流量

entity_id：实体的唯一标识符，用于标识服务、端点或实例

instance_id：服务实例的唯一标识符

instance_traffic_name：服务实例流量的名称

int_value：整数值

label：用于分类或标记数据的标签

labels_json：包含多个标签的JSON字符串

last_ping：服务实例最后一次发送心跳的时间戳

last_update_time_bucket：数据最后一次更新的时间桶

layer：服务的层次或层级

match：用于匹配规则的标识符

message：与事件或日志相关的信息

metric_table：度量表的名称，用于标识特定的度量数据

name：实体、服务或端点的名称

numerator：用于计算比率的分子值

parameters：与事件或操作相关的参数

percentage：百分比值

precision：数据的精度

process_id：进程的唯一标识符

profiling_support_status：性能分析支持的状态

properties：实体的属性

ranks：排名或等级

remote_service_name：远程服务的名称

represent_service_id、represent_service_instance_id：表示服务或实例的唯一标识符

s_num：用于统计的数值

service：服务的名称

service_group：服务组的名称

service_id：服务的唯一标识符

service_instance：服务实例的名称

service_instance_id：服务实例的唯一标识符

service_name：服务的名称

service_traffic_name：服务流量的名称

short_name：实体的简称或缩写

source_endpoint：源端点的名称

source_process_id、source_service_id、source_service_instance_id：源进程、服务和实例的唯一标识符

span_name：跨度（Span）的名称，用于分布式追踪

start_time：事件或记录的开始时间戳

summation：数值的总和

t_num：用于统计的数值

tag_key、tag_type、tag_value：标签的键、类型和值

task_id：任务的唯一标识符

time_bucket：时间桶，用于数据的时序聚合

total、total_num：总数和数量

type：数据的类型

uuid：全局唯一标识符

value：度量值

sw_segment

sw_segment索引用于收集链路信息日志。在SkyWalking中，一个Segment代表一个分布式追踪的路径，它由多个Span组成，记录了一次完整的请求处理过程。这些数据对于理解服务之间的调用关系和性能特性非常重要，它们是实现分布式追踪和性能监控的基础。

sw_zipkin_span

sw_zipkin_span索引用于存储Zipkin跟踪的Span数据。SkyWalking可以作为Zipkin的替代服务器，提供高级功能，这个索引就是用来兼容Zipkin格式的追踪数据。

sw_browser_error_log

sw_browser_error_log索引用于收集浏览器日志，特别是错误日志。这些日志对于前端监控和错误分析非常有用，可以帮助开发者了解用户在使用应用时遇到的前端问题。

sw_log

sw_log索引用于收集除浏览器外的日志。这些日志可能来自于后端服务、中间件或其他系统组件，对于整体的系统监控和日志分析非常重要。

sw_continuous_profiling_policy

这个索引用于存储连续性能分析（Continuous Profiling）的策略配置。连续性能分析是SkyWalking的一个特性，它允许基于预设的策略自动触发性能分析任务。这些策略可以定义何时以及如何对特定的目标（如进程或服务）进行性能分析，以便及时发现和诊断性能问题。例如，当eBPF Agent检测到某个进程的指标符合策略规则时，它会立即触发对该进程的性能分析任务，从而减少中间步骤，加快定位性能问题的能力

sw_ui_template

sw_ui_template索引用于存储SkyWalking UI的模板配置。这些模板定义了SkyWalking UI中的仪表板和视图，包括官方提供的默认仪表板以及用户自定义的仪表板。用户可以通过这些模板来创建新的仪表板，添加新的标签/页面/小部件，并根据自己的偏好重新配置仪表板。模板支持层（Layer）和实体类型（Entity Type）的概念，这对于理解和自定义SkyWalking UI中的仪表板至关重要

查询语句整理

查询sw_metrics-all索引

1、查找特定时间范围内，与特定服务相关的服务关系指标

{"size": 0,"query": {"bool": {"must": [{"range": {"time_bucket": {"from": 202411221112,"to": 202411221142,"include_lower": true,"include_upper": true,"boost": 1.0}}},{"bool": {"should": [{"term": {"source_service_id": {"value": "c2VydmljZTo6dGVuZGF0YS1jb250YWN0LXNlcnZpY2U=.1","boost": 1.0}}},{"term": {"dest_service_id": {"value": "c2VydmljZTo6dGVuZGF0YS1jb250YWN0LXNlcnZpY2U=.1","boost": 1.0}}}],"adjust_pure_negative": true,"boost": 1.0}},{"term": {"metric_table": {"value": "service_relation_server_side","boost": 1.0}}}],"adjust_pure_negative": true,"boost": 1.0}},"aggregations": {"entity_id": {"terms": {"field": "entity_id","size": 1000,"min_doc_count": 1,"shard_min_doc_count": 0,"show_term_doc_count_error": false,"execution_hint": "map","order": [{"_count": "desc"},{"_key": "asc"}],"collect_mode": "breadth_first"},"aggregations": {"component_ids": {"terms": {"field": "component_ids","size": 10,"min_doc_count": 1,"shard_min_doc_count": 0,"show_term_doc_count_error": false,"execution_hint": "map","order": [{"_count": "desc"},{"_key": "asc"}],"collect_mode": "breadth_first"}}}}}
}

2、对特定时间范围内的服务间关系数据进行聚合分析

{"size": 0,"query": {"bool": {"must": [{"range": {"time_bucket": {"from": 202411221112,"to": 202411221142,"include_lower": true,"include_upper": true,"boost": 1.0}}},{"bool": {"should": [{"term": {"source_service_id": {"value": "c2VydmljZTo6dGVuZGF0YS1jb250YWN0LXNlcnZpY2U=.1","boost": 1.0}}},{"term": {"dest_service_id": {"value": "c2VydmljZTo6dGVuZGF0YS1jb250YWN0LXNlcnZpY2U=.1","boost": 1.0}}}],"adjust_pure_negative": true,"boost": 1.0}},{"term": {"metric_table": {"value": "service_relation_client_side","boost": 1.0}}}],"adjust_pure_negative": true,"boost": 1.0}},"aggregations": {"entity_id": {"terms": {"field": "entity_id","size": 1000,"min_doc_count": 1,"shard_min_doc_count": 0,"show_term_doc_count_error": false,"execution_hint": "map","order": [{"_count": "desc"},{"_key": "asc"}],"collect_mode": "breadth_first"},"aggregations": {"component_ids": {"terms": {"field": "component_ids","size": 10,"min_doc_count": 1,"shard_min_doc_count": 0,"show_term_doc_count_error": false,"execution_hint": "map","order": [{"_count": "desc"},{"_key": "asc"}],"collect_mode": "breadth_first"}}}}}
}

3、统计服务下的实例流量

{"size": 5000,"query": {"bool": {"must": [{"range": {"last_ping": {"from": 202411221112,"to": null,"include_lower": true,"include_upper": true,"boost": 1.0}}},{"term": {"service_id": {"value": "c2VydmljZTo6dGVuZGF0YS1tZXNzYWdlLXNlcnZpY2U=.1","boost": 1.0}}},{"term": {"metric_table": {"value": "instance_traffic","boost": 1.0}}}],"adjust_pure_negative": true,"boost": 1.0}}
}

4、统计服务下的端点流量

{"size": 20,"query": {"bool": {"must": [{"term": {"service_id": {"value": "c2VydmljZTo6dGVuZGF0YS1tZXNzYWdlLXNlcnZpY2U=.1","boost": 1.0}}},{"term": {"metric_table": {"value": "endpoint_traffic","boost": 1.0}}}],"adjust_pure_negative": true,"boost": 1.0}}
}

5、查询标签数据

{"query": {"bool": {"must": [{"term": {"tag_type": {"value": "TRACE","boost": 1.0}}},{"term": {"metric_table": {"value": "tag_autocomplete","boost": 1.0}}}],"adjust_pure_negative": true,"boost": 1.0}},"aggregations": {"tag_key": {"terms": {"field": "tag_key","size": 100,"min_doc_count": 1,"shard_min_doc_count": 0,"show_term_doc_count_error": false,"order": [{"_count": "desc"},{"_key": "asc"}]}}}
}

6、统计服务流量

{"size": 5000,"query": {"bool": {"must": [{"term": {"layer": {"value": 2,"boost": 1.0}}},{"term": {"metric_table": {"value": "service_traffic","boost": 1.0}}}],"adjust_pure_negative": true,"boost": 1.0}}
}

7、计算服务间的服务每分钟调用次数

{"size": 0,"query": {"bool": {"must": [{"range": {"time_bucket": {"from": 202411221112,"to": 202411221142,"include_lower": true,"include_upper": true,"boost": 1.0}}},{"terms": {"entity_id": ["MTkyLjE2OC4zMC4xOjkwOTI7MTkyLjE2OC4zMC4zOjkwOTI=.1-c2VydmljZTo6dGVuZGF0YS1jb3JwLXNlcnZpY2U=.1"],"boost": 1.0}},{"term": {"metric_table": {"value": "service_relation_server_cpm","boost": 1.0}}}],"adjust_pure_negative": true,"boost": 1.0}},"aggregations": {"entity_id": {"terms": {"field": "entity_id","size": 1,"min_doc_count": 1,"shard_min_doc_count": 0,"show_term_doc_count_error": false,"execution_hint": "map","order": [{"_count": "desc"},{"_key": "asc"}],"collect_mode": "breadth_first"},"aggregations": {"value": {"avg": {"field": "value"}}}}}
}

8、计算服务间的服务响应时间

{"size": 0,"query": {"bool": {"must": [{"range": {"time_bucket": {"from": 202411221112,"to": 202411221142,"include_lower": true,"include_upper": true,"boost": 1.0}}},{"terms": {"entity_id": ["c2VydmljZTo6dGVuZGF0YS1iaXpyLXNlcnZpY2U=.1-c2VydmljZTo6dGVuZGF0YS1nbG9jby1zZXJ2aWNl.1"],"boost": 1.0}},{"term": {"metric_table": {"value": "service_relation_server_resp_time","boost": 1.0}}}],"adjust_pure_negative": true,"boost": 1.0}},"aggregations": {"entity_id": {"terms": {"field": "entity_id","size": 1,"min_doc_count": 1,"shard_min_doc_count": 0,"show_term_doc_count_error": false,"execution_hint": "map","order": [{"_count": "desc"},{"_key": "asc"}],"collect_mode": "breadth_first"},"aggregations": {"value": {"avg": {"field": "value"}}}}}
}

9、计算服务间的服务客户端响应时间

{"size": 0,"query": {"bool": {"must": [{"range": {"time_bucket": {"from": 202411221112,"to": 202411221142,"include_lower": true,"include_upper": true,"boost": 1.0}}},{"terms": {"entity_id": ["c2VydmljZTo6dGVuZGF0YS1tY3Mtc2VydmljZQ==.1-MTkyLjE2OC4zMC4xOjkwOTI7MTkyLjE2OC4zMC4zOjkwOTI=.0"],"boost": 1.0}},{"term": {"metric_table": {"value": "service_relation_client_resp_time","boost": 1.0}}}],"adjust_pure_negative": true,"boost": 1.0}},"aggregations": {"entity_id": {"terms": {"field": "entity_id","size": 1,"min_doc_count": 1,"shard_min_doc_count": 0,"show_term_doc_count_error": false,"execution_hint": "map","order": [{"_count": "desc"},{"_key": "asc"}],"collect_mode": "breadth_first"},"aggregations": {"value": {"avg": {"field": "value"}}}}}
}

10、计算服务间的客户端每分钟调用次数

{"size": 0,"query": {"bool": {"must": [{"range": {"time_bucket": {"from": 202411221112,"to": 202411221142,"include_lower": true,"include_upper": true,"boost": 1.0}}},{"terms": {"entity_id": ["c2VydmljZTo6dGVuZGF0YS10cmFuc2xhdGlvbi1zZXJ2aWNl.1-YXBpLnRyYW5zbGF0b3IuYXp1cmUuY246NDQz.1"],"boost": 1.0}},{"term": {"metric_table": {"value": "service_relation_client_cpm","boost": 1.0}}}],"adjust_pure_negative": true,"boost": 1.0}},"aggregations": {"entity_id": {"terms": {"field": "entity_id","size": 1,"min_doc_count": 1,"shard_min_doc_count": 0,"show_term_doc_count_error": false,"execution_hint": "map","order": [{"_count": "desc"},{"_key": "asc"}],"collect_mode": "breadth_first"},"aggregations": {"value": {"avg": {"field": "value"}}}}}
}

11、计算服务响应时间service_resp_time

{"size": 0,"query": {"bool": {"must": [{"range": {"time_bucket": {"from": 202411221112,"to": 202411221142,"include_lower": true,"include_upper": true,"boost": 1.0}}},{"terms": {"entity_id": ["c2VydmljZTo6dGVuZGF0YS1tY3Mtc2VydmljZQ==.1"],"boost": 1.0}},{"term": {"metric_table": {"value": "service_resp_time","boost": 1.0}}}],"adjust_pure_negative": true,"boost": 1.0}},"aggregations": {"entity_id": {"terms": {"field": "entity_id","size": 1,"min_doc_count": 1,"shard_min_doc_count": 0,"show_term_doc_count_error": false,"execution_hint": "map","order": [{"_count": "desc"},{"_key": "asc"}],"collect_mode": "breadth_first"},"aggregations": {"value": {"avg": {"field": "value"}}}}}
}

12、计算服务级别协议的成功百分比service_sla

{"size": 0,"query": {"bool": {"must": [{"range": {"time_bucket": {"from": 202411221112,"to": 202411221142,"include_lower": true,"include_upper": true,"boost": 1.0}}},{"terms": {"entity_id": ["c2VydmljZTo6dGVuZGF0YS1vcGVuYXBpLWdhdGV3YXktc2VydmljZQ==.1"],"boost": 1.0}},{"term": {"metric_table": {"value": "service_sla","boost": 1.0}}}],"adjust_pure_negative": true,"boost": 1.0}},"aggregations": {"entity_id": {"terms": {"field": "entity_id","size": 1,"min_doc_count": 1,"shard_min_doc_count": 0,"show_term_doc_count_error": false,"execution_hint": "map","order": [{"_count": "desc"},{"_key": "asc"}],"collect_mode": "breadth_first"},"aggregations": {"percentage": {"avg": {"field": "percentage"}}}}}
}

13、计算服务每分钟请求数service_cpm

{"size": 0,"query": {"bool": {"must": [{"range": {"time_bucket": {"from": 202411221112,"to": 202411221142,"include_lower": true,"include_upper": true,"boost": 1.0}}},{"terms": {"entity_id": ["c2VydmljZTo6dGVuZGF0YS1kZnMtc2VydmljZQ==.1"],"boost": 1.0}},{"term": {"metric_table": {"value": "service_cpm","boost": 1.0}}}],"adjust_pure_negative": true,"boost": 1.0}},"aggregations": {"entity_id": {"terms": {"field": "entity_id","size": 1,"min_doc_count": 1,"shard_min_doc_count": 0,"show_term_doc_count_error": false,"execution_hint": "map","order": [{"_count": "desc"},{"_key": "asc"}],"collect_mode": "breadth_first"},"aggregations": {"value": {"avg": {"field": "value"}}}}}
}

14、查询网络地址别名

{"size": 5000,"query": {"bool": {"must": [{"term": {"metric_table": {"value": "network_address_alias","boost": 1.0}}},{"range": {"last_update_time_bucket": {"from": 202411221132,"to": null,"include_lower": true,"include_upper": true,"boost": 1.0}}}],"adjust_pure_negative": true,"boost": 1.0}}
}

15、检索 service为service::tendata-contact-service的事件列表

{"from": 0,"size": 20,"query": {"bool": {"must": [{"term": {"metric_table": {"value": "events","boost": 1.0}}},{"term": {"service": {"value": "service::tendata-contact-service","boost": 1.0}}},{"range": {"start_time": {"from": 1732245120000,"to": null,"include_lower": false,"include_upper": true,"boost": 1.0}}},{"range": {"end_time": {"from": null,"to": 1732246980000,"include_lower": true,"include_upper": false,"boost": 1.0}}}],"adjust_pure_negative": true,"boost": 1.0}},"sort": [{"start_time": {"order": "desc"}}]
}

16、分页获取特定时间段内特定服务指标数据，并按时间戳排序

{"from": 0,"size": 15,"query": {"bool": {"must": [{"range": {"time_bucket": {"from": 20241122111200,"to": 20241122114259,"include_lower": true,"include_upper": true,"boost": 1.0}}},{"term": {"service_id": {"value": "c2VydmljZTo6dGVuZGF0YS1tZXNzYWdlLXNlcnZpY2U=.1","boost": 1.0}}}],"adjust_pure_negative": true,"boost": 1.0}},"sort": [{"timestamp": {"order": "desc"}}]
}

17、根据传递的id查询端点信息

{"size": 156,"query": {"ids": {"values": ["endpoint_traffic_c2VydmljZTo6dGVuZGF0YS1nYXRld2F5LXNlcnZpY2U=.1_L2luc2lnaHQtc2VhcmNoL3YxL3Byb2dyYW1tZXMvMjkyNTcvbWFya2V0LWNvdW50ZXJwYXJ0eS1hcmVh","endpoint_traffic_c2VydmljZTo6dGVuZGF0YS1nYXRld2F5LXNlcnZpY2U=.1_L2NvcnAvdjIvY29tcGFuaWVzLzEwYzdkMWVjYTY4NTE0NDQ1NzQ5OWVkZTJkZTQxY2I1L3JlZnJlc2gvcmVzdWx0"],"boost": 1.0}}
}

18、查询某个服务的每分钟请求次数最多的10个接口

{"query": {"bool": {"must": [{"term": {"metric_table": {"value": "endpoint_cpm","boost": 1.0}}},{"terms": {"service_id": ["c2VydmljZTo6dGVuZGF0YS1jb250YWN0LXNlcnZpY2U=.1"],"boost": 1.0}},{"range": {"time_bucket": {"from": 202411221112,"to": 202411221142,"include_lower": true,"include_upper": true,"boost": 1.0}}}],"adjust_pure_negative": true,"boost": 1.0}},"aggregations": {"entity_id": {"terms": {"field": "entity_id","size": 10,"min_doc_count": 1,"shard_min_doc_count": 0,"show_term_doc_count_error": false,"execution_hint": "map","order": [{"value": "desc"},{"_key": "asc"}],"collect_mode": "breadth_first"},"aggregations": {"value": {"avg": {"field": "value"}}}}}
}

19、查询某个服务的响应时间最大的10个接口

{"query": {"bool": {"must": [{"term": {"metric_table": {"value": "endpoint_resp_time","boost": 1.0}}},{"terms": {"service_id": ["c2VydmljZTo6dGVuZGF0YS1jb250YWN0LXNlcnZpY2U=.1"],"boost": 1.0}},{"range": {"time_bucket": {"from": 202411221112,"to": 202411221142,"include_lower": true,"include_upper": true,"boost": 1.0}}}],"adjust_pure_negative": true,"boost": 1.0}},"aggregations": {"entity_id": {"terms": {"field": "entity_id","size": 10,"min_doc_count": 1,"shard_min_doc_count": 0,"show_term_doc_count_error": false,"execution_hint": "map","order": [{"value": "desc"},{"_key": "asc"}],"collect_mode": "breadth_first"},"aggregations": {"value": {"avg": {"field": "value"}}}}}
}

20、查询某个服务的指定时间范围内成功率最小的10个接口

{"query": {"bool": {"must": [{"term": {"metric_table": {"value": "endpoint_sla","boost": 1.0}}},{"terms": {"service_id": ["c2VydmljZTo6dGVuZGF0YS1jb250YWN0LXNlcnZpY2U=.1"],"boost": 1.0}},{"range": {"time_bucket": {"from": 202411221112,"to": 202411221142,"include_lower": true,"include_upper": true,"boost": 1.0}}}],"adjust_pure_negative": true,"boost": 1.0}},"aggregations": {"entity_id": {"terms": {"field": "entity_id","size": 10,"min_doc_count": 1,"shard_min_doc_count": 0,"show_term_doc_count_error": false,"execution_hint": "map","order": [{"percentage": "asc"},{"_key": "asc"}],"collect_mode": "breadth_first"},"aggregations": {"percentage": {"avg": {"field": "percentage"}}}}}
}

21、查询标签信息

{"size": 12,"query": {"ids": {"values": ["tag_autocomplete_20241122_TRACE_db.instance_[im_moldova-2024, im_moldova-2022, im_moldova-2023, im_moldova-2021]","tag_autocomplete_20241122_TRACE_db.instance_[a04b2a53a6d946ad9fe525cd1ab2646a_alias]","tag_autocomplete_20241122_TRACE_db.instance_[im_maritime_silk_bol-2022, im_maritime_silk_bol-2023, im_maritime_silk_bol-2021, im_maritime_silk_bol-2024]"],"boost": 1.0}}
}

查询sw_records-all索引

1、查询优化任务列表

{"size": 200,"query": {"bool": {"must": [{"term": {"record_table": {"value": "profile_task","boost": 1.0}}},{"range": {"time_bucket": {"from": 202411221137,"to": null,"include_lower": true,"include_upper": true,"boost": 1.0}}},{"range": {"time_bucket": {"from": null,"to": 202411221147,"include_lower": true,"include_upper": true,"boost": 1.0}}}],"adjust_pure_negative": true,"boost": 1.0}},"sort": [{"start_time": {"order": "desc"}}]
}

2、查询sw_records-all与特定跨度（Span）关联的事件记录

{"size": 100,"query": {"bool": {"must": [{"term": {"record_table": {"value": "span_attached_event_record","boost": 1.0}}},{"terms": {"related_trace_id": ["ab80cf2b85fa4f3e9baabd114f3b909e.98.17322469467401053"],"boost": 1.0}},{"terms": {"trace_ref_type": [0],"boost": 1.0}}],"adjust_pure_negative": true,"boost": 1.0}},"sort": [{"start_time_second": {"order": "asc"}},{"start_time_nanos": {"order": "asc"}}]
}

3、检索ebpf优化任务

{"size": 200,"query": {"bool": {"must": [{"term": {"record_table": {"value": "ebpf_profiling_task","boost": 1.0}}},{"term": {"service_id": {"value": "c2VydmljZTo6dGVuZGF0YS1jb250YWN0LXNlcnZpY2U=.1","boost": 1.0}}},{"terms": {"target_type": [1,2],"boost": 1.0}},{"term": {"trigger_type": {"value": 1,"boost": 1.0}}}],"adjust_pure_negative": true,"boost": 1.0}},"sort": [{"create_time": {"order": "desc"}}]
}

4、查询性能任务日志

{"size": 10000,"query": {"bool": {"must": [{"term": {"record_table": {"value": "profile_task_log","boost": 1.0}}}],"adjust_pure_negative": true,"boost": 1.0}},"sort": [{"operation_time": {"order": "desc"}}]
}

查询sw_segment索引

1、查询某个服务的流量

{"size": 1,"query": {"ids": {"values": ["service_traffic_MTkyLjE2OC4xMS4xMDo1Njcy.15"],"boost": 1.0}}
}

2、查询某个调用链信息

{"size": 200,"query": {"term": {"trace_id": {"value": "ab80cf2b85fa4f3e9baabd114f3b909e.98.17322469467401053","boost": 1.0}}}
}

3、分页获取特定时间段内特定服务调用数据，并按开始时间排序

{"from": 0,"size": 20,"query": {"bool": {"must": [{"range": {"time_bucket": {"from": 20241122111200,"to": 20241122114259,"include_lower": true,"include_upper": true,"boost": 1.0}}},{"term": {"service_id": {"value": "c2VydmljZTo6dGVuZGF0YS1jb250YWN0LXNlcnZpY2U=.1","boost": 1.0}}}],"adjust_pure_negative": true,"boost": 1.0}},"sort": [{"start_time": {"order": "desc"}}]
}

索引介绍

sw_records-all

mapping

sw_metrics-all

metric_table枚举值

mapping

字段解释

sw_segment

sw_zipkin_span

sw_browser_error_log

sw_log

sw_continuous_profiling_policy

sw_ui_template

查询语句整理

查询sw_metrics-all索引

查询sw_records-all索引

查询sw_segment索引

相关文章：