DQL in practice: exploring logs and events, notebooks, dashboards and performance

1. Exploring logs and events #

First queries.

Basic commands #

fetch logs, from: now() - 2h
| filter loglevel == "ERROR" and k8s.namespace.name == "boutique"
| summarize erreurs = count(), by: {dt.entity.service}
| sort erreurs desc
| limit 10

fetch events, from: now() - 24h
| filter event.kind == "DAVIS_PROBLEM"
| fields timestamp, event.name, event.status, affected_entity_ids

Common sources: logs, events, bizevents, spans, dt.entity.* (entities) and time series with timeseries.

2. Enriching queries #

Parsing and transforming.

Examples #

// Extraire des champs d'un log texte (DPL)
fetch logs
| filter matchesPhrase(content, "paiement")
| parse content, "LD 'montant=' INT:montant LD 'client=' WORD:client"
| summarize total = sum(montant), by: {client}

// Transformer des logs en série temporelle
fetch logs
| filter loglevel == "ERROR"
| makeTimeseries erreurs = count(), by: {dt.entity.service}, interval: 5m

// Relier traces et logs
fetch spans
| filter duration > 2s and service.name == "checkout"
| fields trace.id, span.name, duration

Notebooks and dashboards #

A notebook chains queries, graphs and text: ideal for a shared investigation or post-mortem. A validated query can be turned into a dashboard tile, possibly with variables (service, namespace).

Good practice: Davis CoPilot can generate a DQL query from a natural-language question: a good starting point, to review before saving.

3. Writing efficient queries #

Reading less data.

Best practices #

Common mistake: Depending on the license model, log queries may be billed by volume read: an unfiltered 30-day query run every minute by a dashboard is expensive. See also the article « Grail: Dynatrace Data Lakehouse ».