Pulse’s source query language provides a mechanism for creating dynamic lists of sources which are in turn used in source filter definitions, dashboard legend searches, and source selections. Where within Pulse the queries can be used is discussed here.
Available search criteria are:
- source name patterns, and;
- the relative time since data was last seen from the sources.
For example, to create a filter that includes all sources that contain the text “prod” which have been active in the last two hours you would cre-ate a filter with the query:
prod && last: 2h
By default, queries are implied substring searches. Examples follow.
This query returns all sources that contain “prod” in the source name. Matched sources would include:
This is an explicit version of the previous example. The wild-carding is explicitly defined but has the same effect of returning all sources that contain the string.
This query searches for “sources that start with” and would match:
This query searches for “sources that end with” and would match:
This query would have the following valid matches:
To find a specific source that must be an exact match, one must surround the string search with double quotes. For example:
This query will return a source which has a name "service-24.prod.domain.com".
Relative Active Time
To find sources that have reported within the last few hours you can use the following query:
This query will return all sources that have been active in the last 24 hours.
Relative Active Time with comparisons
Alternatively this same time modifier can be written like the following:
last > 24h
The following query will return all sources that have not been active in the last 2 hours.
last < 2h
Binary Comparison "AND" Queries
This query will return only the matching sources that matched in our implicit wildcard query example earlier which have sent data within the last 2 hours:
prod && last: 2h
Alternatively you can use the word “AND” which has the exact same effect:
prod and last: 2h
Binary Comparison "OR" Queries
This query will return the matching sources from our implicit wildcard query example as well as any other sources that have been active within the last 2 hours:
prod || last: 2h
Alternatively, you can use the word “OR” which has the exact same effect:
prod or last: 2h
Chained Comparison Queries:
This query is effectively processed like ((prod || staging) && last: 24h) due to typical order of operations.
prod || staging && last: 24h