Where To Use BPQL
Use BPQL to construct advanced query strings:
- In the Incidents tab - Search incidents in the selected Environment and folder. You can search active incidents or incidents resolved in the last 24 hours.
- In the Search tab - Search current and historical monitoring data. You can filter incidents by Environment, source, and exact time period in the last 3 months.
- In the Correlation editor - Filter which alerts are correlated by the pattern.
- In the Changes section - Search for specific tag values in changes associated with the incident to help identify the incident's Root Cause.
Syntax Rules
Basic Queries
The basic syntax for a query with a single condition is: <tag>
<operator>
<value>
. For example:
host=srv-ny-1
This example uses the host
tag, the equals operator, and the value srv-ny-1
. Tags and values are not case sensitive.
When searching for comments, you can use "comment" as a tag to search for comments specific to a particular incident.
Finding Tag Names
The available tags can vary based on the source system and integration. To find the tag names for an integration, you can view an alert in the BigPanda UI or reference the documentation on standard tags. On the Search tab, the search bar displays suggested tags and relevant system names as you type.
Multiple Conditions and Precedence of Operators (Parentheses)
For multiple conditions, use any combination of AND
and OR
to combine terms in a query. For example:
host=srv-1 AND check=chk-1
Use parentheses (( )) to give priority to a part of the query. For example:
host=srv-1 AND (check=chk-1 OR check=chk-2 OR check=chk-3)
You can use nested parentheses. For example:
host=srv-1 AND (check=chk-1 OR (check=chk-2 AND status=critical))
Tag Names with Spaces and Special Characters
Spaces, periods, and special characters are not supported when querying tag names. When creating multi-word tags, spaces should be removed or replaced with underscores. To learn more, see the Tag Naming Requirements in our Enrichment user guide.
Tag Name | Searchable |
---|---|
| Yes |
| Yes |
| No |
| No |
| No |
Value Phrases with Spaces
Use quotes (" or ') around an exact phrase that contains spaces. Spaces are allowed only between quotes. For example, to search for checks containing CPU over 90%
:
check="*CPU over 90%*"
You can use special characters and wildcards between quotes.
Wildcards
Use an asterisk as a wildcard to match multiple values that contain a common element. For example, to search for hosts that end with .host1.com
.
host=*.host1.com
To search for hosts that start with db
and end with .domain1.com
.
host=db*.domain1.com
To search for hosts that contain prod
:
host=*prod*
You can use wildcards inside of quotes (exact phrases).
Special Characters
Use quotes (" or ') around an exact phrase that contains any of the following special characters:
= " ' | : \ / ( ) { } [ ] ^ ~ * ? ,
< >`
For example, to search for a specific URL:
url="*https://my.domain.com/businessapp*"
Regular Expressions (Regex)
Use a slash (/) as the first and last character to search for values that match a regex; for example, host = /<regex pattern>/
.
Use a regex to find values that match a certain pattern. For example, this regex query looks for host values with any three characters followed by abc
then by any 3 digits:
host=/...abc[0-9]{3}/
Regex tag value queries are limited to 32,000 characters or less; values surpassing this limit are trimmed.
Regex Syntax
BigPanda searches follow the Elasticsearch Regular Expression Syntax. This syntax has some differences compared to other common regex engines, including:
- Values are case sensitive; you must enter patterns with the correct character case for the query to match. Other searches in BigPanda, including wildcards and exact phrases, are case insensitive.
- Queries require the entire pattern to obtain a match. Regex queries do not match on partial patterns because the start (
^
) and end patterns ($
) are always assumed.- Queries with
\s
,\d
, or\w
are not supported.
Searching for Tags with Empty Values
A specific regex search syntax needs to be used when searching for tags with empty values:
host != /[a-zA-Z0-9]+/
Operators
Operator | Description | Example |
---|---|---|
= | Equals |
|
!= | Not equal |
|
=== | Strict match; true for all alerts in an incident |
|
IN | Equal to one of the values in a list |
|
NOT IN | Not equal to any of the values in a list |
|
OR | At least one of the conditions is true |
|
AND | All of the conditions are true |
|
Strict Match vs. Equals
Strict match criteria must be met by all alerts within an incident, whereas an equals (=) search finds incidents that have at least one matching alert, even if other alerts do not match the criteria. For example, if the strict match criteria is host==="prod-1"
, incidents where all alerts match the host are listed as results. However, incidents where only some of the alerts match, such as alerts from the same cluster but not the same host, do not appear in the results.
The following example shows a strict match versus an equals search.
Example Incidents | Strict Match (host==="prod-1") | Equals Match (host="prod-1") |
---|---|---|
Incident 1 contains:
| ||
Incident 2 contains:
|
Strict match considers all alerts in the incident regardless of status
Strict match considers both active and inactive alerts in an incident. If the active alerts in an incident meet the criteria and the inactive alerts don't, the incident does not match.
Keyword Searches
A keyword search looks for a value in descriptions, source system names, and in any tag—in contrast to a BPQL query, which looks for a value in a specific tag. For tags that contain multiple values, a keyword search identifies matches if any of the values match the search term.
You can use an asterisk (*) as a wildcard to match multiple values that contain a common element. For example:
phx*db
Keyword searches can find exact search terms between special characters without using wildcards. For example, if you search for
api
, it matches all tags, source system names, and descriptions whereapi
is present between special characters, such asprod-api-1
andweb-api
. You do not need to use wildcards; for example,*api*
.
You can use quotes (" or ') around an exact phrase that contains spaces. Spaces are allowed only between quotes. For example:
"CPU over 90*"
You can use a slash (/) as the first and last character to search for values that match a regex. Regular expressions are case sensitive and are limited to 32,000 characters. For example:
/...Phx[0-9]{3}/
Updated 8 months ago
Recommended Reading
Quick Start Guide: Unified Search |
Using Unified Search |