Query Language Syntax

The LogScale Query Language (LQL) is the syntax that lets you compose queries to retrieve, process, and analyze data in Falcon LogScale.

The query language is built around a chain of data-processing commands linked together. Each expression passes its result to the next expression in the sequence, allowing you to create complex queries by combining query expressions. This architecture is similar to command pipes, a powerful and flexible mechanism for advanced data analysis in Unix and Linux shells.

This reference section on the LogScale Query Language provides detailed explanations on several related topics. They're listed below with brief descriptions — click on a heading to see more:

  • Query Filters

    When querying data in LogScale, filters may be used to reduce the results to the relevant data. You can use free-text filters to grep data, or you can filter based on fields, stipulating acceptable field values or using regular expressions for matching field contents.

  • Query Functions

    You can use query functions to get values, or reduce results. LogScale provides many built-in query functions, and you can combine them to create your own.

  • Operators

    For filtering, there are several operators available: besides logical operators, there are also some comparison operators to narrow search results to what's most important to you.

  • Regular Expression Syntax

    Regular expressions in LogScale Query Language are similar to most regular expression environments, with slight differences though.

  • Adding Fields

    To improve results sets, as well as to construct more complex queries, you can create new fields when querying data. You can do this using the := syntax, the as syntax, a regex, or eval() function.

  • Conditional Expressions

    Although LogScale query language does not provide a typical conditional syntax, there are ways to evaluate data conditionally. You can use a case statement or a match() function.

  • Query Joins

    LogScale supports the joining of queries using the join() function. One query can be used to filter or enrich another, thus obtaining a combined result.

  • Array Syntax

    This applies to Array Query Functions, for indexing and selecting members in objects using a syntax similar to JSON.

  • Relative Time Syntax

    For time related queries, you may want to know about Rate Unit Conversion, or about relative time syntax.

  • LogScale Query Language Grammar Subset

    This grammar is a subset of the LogScale Query Language, intended as a guide for programmatically generating LogScale queries (not for parsing them).

You may also want to read the Falcon LogScale Beginner Introduction. It will link you to an interactive tutorial that will introduce you to queries in LogScale and let you try sample queries that will demonstrate the basic principles.