/api/search/lookup

Note

Available in 2.1

Lookup queries use either the meta data table or the main data table to determine what time series are associated with a given metric, tag name, tag value, tag pair or combination thereof. For example, if you want to know what metrics are available for a tag pair host=web01 you can execute a lookup to find out. Lookups do not require a search plugin to be installed.

Note

Lookups are performed against the tsdb-meta table. You must enable real-time meta data creation or perform a metasync using the uid command in order to retreive data from a lookup. Lookups can be executed against the raw data table using the CLI command only: ../../user_guide/cli/search

Verbs

  • GET

  • POST

Requests

Parameters used by the lookup endpoint include:

Name

Data Type

Required

Description

Default

QS

RW

Example

query

String

Required

A lookup query as defined below.

m

tsd.hbase.rpcs{type=*}

useMeta

Boolean

Optional

Whether or not to use the meta data table or the raw data table. The raw table will be much slower.

False

use_meta

True

limit

Integer

Optional

The maximum number of items returned in the result set.

25

100

startIndex

Integer

Optional

Ignored for lookup queries, always the default.

0

10

Lookup Queries

A lookup query consists of at least one metric, tag name (tagk) or tag value (tagv). Each value must be a literal name in the UID table. If a given name cannot be resolved to a UID, an exception will be returned. Only one metric can be supplied per query but multiple tagk, tagv or tag pairs may be provided.

Normally, tags a provided in the format <tagk>=<tagv> and a value is required on either side of the equals sign. However for lookups, one value may an asterisk *, i.e. <tagk>=* or *=<tagv>. In these cases, the asterisk acts as a wildcard meaning any time series with the given tagk or tagv will be returned. For example, if we issue a query for host=* then we will get all of the time series with a host tagk such as host=web01 and host=web02.

For complex queries with multiple values, each type is AND’d with the other types and OR’d with it’s own type.

<metric> AND (<tagk1>=[<tagv1>] OR <tagk1>=[<tagv2>]) AND ([<tagk2>]=<tagv3> OR [<tagk2>]=<tagv4>)

For example, the query tsd.hbase.rpcs{type=*,host=tsd1,host=tsd2,host=tsd3} would return only the time series with the metric tsd.hbase.rpcs and the type tagk with any value and a host tag with either tsd1 or tsd2 or tsd3. Unlike a data query, you may supply multiple tagks with the same name as seen in the example above. Wildcards always take priority so if your query looked like tsd.hbase.rpcs{type=*,host=tsd1,host=tsd2,host=*}, then the query would effectively be treated as tsd.hbase.rpcs{type=*,host=*}.

To retreive a list of all time series with a specific tag value, e.g. a particular host, you could issue a query like {*=web01} that will return all time series with a tag value of web01. This can be useful in debugging tag name issues such as some series having host=web01 or server=web01.

Example Request

Query String:

http://localhost:4242/api/search/lookup?m=tsd.hbase.rpcs{type=*}

POST:

JSON requests follow the search query format on the /api/search page. Limits and startNote that tags are supplied as a list of objects. The value for the key should be a tagk and the value for value should be a tagv or wildcard.

{
    "metric": "tsd.hbase.rpcs",
    "tags":[
        {
            "key": "type",
            "value": "*"
        }
    ]
}

Response

Depending on the endpoint called, the output will change slightly. However common fields include:

Name

Data Type

Description

Example

type

String

The type of query submitted, i.e. the endpoint called.

LOOKUP

query

String

Ignored for lookup queries.

limit

Integer

The maximum number of items returned in the result set.

25

startIndex

Integer

Ignored for lookup queries, always the default.

0

metric

String

The metric used for the lookup

*

tags

Array

The list of tag pairs used for the lookup. May be an empty list.

[ ]

time

Integer

The amount of time it took, in milliseconds, to complete the query

120

totalResults

Integer

The total number of results matched by the query

1024

results

Array

The result set with the TSUID, metric and tags for each series.

See Below

This endpoint will almost always return a 200 with content body. If the query doesn’t match any results, the results field will be an empty array and totalResults will be 0. If an error occurs, such as a failure to resolve a metric or tag name to a UID, an exception will be returned.

Example Response

{
    "type": "LOOKUP",
    "metric": "tsd.hbase.rpcs",
    "tags":[
        {
            "key": "type",
            "value": "*"
        }
    ]
    "limit": 3,
    "time": 565,
    "results": [
        {
            "tags": {
                "fqdn": "web01.mysite.com"
            },
            "metric": "app.apache.connections",
            "tsuid": "0000150000070010D0"
        },
        {
            "tags": {
                "fqdn": "web02.mysite.com"
            },
            "metric": "app.apache.connections",
            "tsuid": "0000150000070010D5"
        },
        {
            "tags": {
                "fqdn": "web03.mysite.com"
            },
            "metric": "app.apache.connections",
            "tsuid": "0000150000070010D6"
        }
    ],
    "startIndex": 0,
    "totalResults": 9688066
}