SQL to CQL: Iterative Development Approach

SQL CQL

  • Queries typically written as complete statements

  • Debugging often requires running the entire query

  • Limited interactive refinement capabilities

  • Pipeline approach encourages incremental development

  • Each stage can be tested independently

  • Interactive UI supports iterative query building

Within LogScale an iterative approach can be taken to each stage of the query:

  1. Start with basic filter:

    logscale
    error=true

  2. Add field selection

    logscale
    error=true
| select([timestamp, service, message])

  3. Add parsing:

    logscale
    error=true 
| regex("failed with code (?:<error_code>[0-9]+)",field=message)

  4. Add aggregation:

    logscale
    error=true 
| regex("failed with code (?:<error_code>[0-9]+)",field=message)