Review of Grail and DQL

What you will learn in this section :

• Understand the role of Grail
• Apply DQL best practices

1. What is Grail?

   Grail is Dynatrace's data lakehouse. Unlike traditional databases, Grail is designed specifically for observability. It stores logs, metrics, traces, and business events (bizevents) in a unified way, without requiring strict schemas or prior indexing (schema-on-read). This allows massive data querying with topological context (Smartscape) always preserved.

2. Best practices for DQL queries

   To write high-performance queries in DQL (Dynatrace Query Language), you must follow a few golden rules:
   
   • Filter early: Use the filter command as early as possible in your query to reduce the data volume processed in subsequent pipelines.
   • Time selectivity: Always limit the time range of your search (directly via the timeframe selector or in the query).
   • Leverage Entity Selectors: Use the entitySelector() function to benefit from dynamic context instead of hardcoding static IDs.
   • Use limit(): When writing and testing, end your queries with limit 10 to speed up response times.

Creating DQL queries

1. Query 1: Production host logs

   Write a DQL query to retrieve logs only for hosts bearing the 'ENV:PROD' tag. You must use an Entity Selector.

2. Query 2: Events related to Java services

   Write a query to list and count recent events related to services running the 'Java' technology.

3. Query 3: CPU usage via Timeseries

   Grail also allows querying metrics. Display the average CPU usage (metric `builtin:host.cpu.usage`) for all hosts belonging to a Management Zone named 'MZ_Finance'.

4. Query 4: Search for a specific team's errors

   Retrieve logs containing the word 'error' for process groups (PROCESS_GROUP) owned by the backend team (tag 'owner:backend').

5. Query 5: Business events (Bizevents) by application

   Retrieve the latest business events (bizevents) generated, but limit this search only to monitored applications of type APPLICATION (Web or Mobile).

Export to Notebook and Dashboard

1. Creating the Notebook

   Execute your DQL queries in the Notebooks application. Format your document and save it following the naming standard: `formation-` (for example: `formation-martin`).

2. Pin to a Dashboard

   Create a new dashboard named `formation-`. Pin at least 3 of your DQL results to this dashboard.