Dynamic Focus queries

Dynamic Graph

Instana's Dynamic Graph is a comprehensive model that includes all the physical and logical components of your environment, along with historical attributes, metrics, distributed traces, and events. These elements are interconnected in a graph, based on their dependencies. With Dynamic Focus queries, you can create filters on the graph so that you can define custom views on your data and focus on exactly the information you need. For more information about Dynamic Graphs, see Using the Dynamic Graph.

Automatic discovery

Instana's agents automatically discover all components and their dependencies in real-time, adding them to the Dynamic Graph. All saved Dynamic Focus queries automatically update, if impacted, without requiring any manual updates or configuration.

Lucene-based query language

Dynamic Focus queries are built on Lucene, a powerful and flexible text search engine library. Lucene enables Dynamic Focus queries to efficiently search and filter large volumes of data by indexing the attributes, metrics, and other elements within the Dynamic Graph. By using Dynamic Focus Queries, you can perform complex and precise "cross-context" searches across the entire dataset, retrieving the most relevant information quickly. Lucene's capabilities also support full-text search, making it easier to find specific data points or patterns within your monitored environment. For more information about how to use Lucene's query language, see Lucene Query Syntax documentation.

Query syntax

Dynamic Focus queries use Lucene's query syntax, which provides a flexible and powerful way to construct search queries. The following components provide an overview of how it works:

• Basic syntax: Lucene queries are composed of terms and operators, where terms can be a single word (for example, "error") or a phrase (for example, "memory leak"). Operators such as AND, OR, and NOT can be used to combine terms, control their relationship, and refine the query.

• Field-specific queries: You can restrict a search to a specific field by prefixing the term with the field name (for example, status:500). Field-specific queries can focus on particular attributes within the data.

• Wildcards: Lucene supports the use of wildcards for partial matching. For instance, mem* matches with "memory" and "memcache."

Default operator

The default operator in Lucene determines how terms are combined when no explicit operator is provided. In Instana's Dynamic Focus queries, the default operator is typically AND. This means that if you enter multiple terms without specifying an operator, the query returns results that match all of those terms.

For example, the query error timeout is interpreted as error AND timeout, returning only those results that contain both "error" and "timeout."

Complex subqueries

With Dynamic Focus queries you can create complex subqueries that use parentheses to group terms and operators. This feature provides greater control over how queries are structured and how results are filtered.

For example, (error OR timeout) AND status:500 returns results that contain either "error" or "timeout," but only if the status is 500.

These complex subqueries build detailed and precise filters that are tailored to your specific needs.

Known limitations

While DFQs are powerful, the following known limitations exist:

• Performance: Complex queries with multiple terms and operators can impact performance, especially in large environments with extensive data.
• Field-specific Limitations: Not all fields might be available for filtering depending on how the data is indexed and stored in the Dynamic Graph.
• Lack of Full-text Search in Some Contexts: In certain contexts, full-text search capabilities might be limited or unavailable, which can restrict the types of queries that can be performed.

Despite these limitations, Dynamic Focus queries remain an essential tool for users who need advanced filtering and search capabilities within Instana.