LogoLogo
Log in|Playground
  • Welcome
    • Introduction
    • FAQ
  • Capabilities
    • Log Management
    • Infrastructure Monitoring
    • Application Performance Monitoring (APM)
      • Application Metrics
      • Traces
      • Supported Technologies
    • Real User Monitoring (RUM)
  • Getting Started
    • Requirements
      • Kubernetes requirements
      • Kernel requirements for eBPF sensor
      • CPU architectures
      • ClickHouse resources
    • Installation & updating
    • Connect Linux hosts
    • Connect RUM
    • 5 quick steps to get you started
    • groundcover MCP
      • Configure groundcover's MCP Server
      • Getting-started Prompts
      • Real-world Use Cases
  • Use groundcover
    • Monitors
      • Create a new Monitor
      • Issues page
      • Monitor List page
      • Silences page
      • Monitor Catalog page
      • Monitor YAML structure
      • Embedded Grafana Alerts
        • Create a Grafana alert
    • Dashboards
      • Create a dashboard
      • Embedded Grafana Dashboards
        • Create a Grafana dashboard
        • Build alerts & dashboards with Grafana Terraform provider
        • Using groundcover datasources in a Self-hosted Grafana
    • Insights
    • Explore & Monitors query builder
    • Workflows
      • Create a new Workflow
      • Workflow Examples
      • Alert Structure
    • Search & Filter
    • Issues
    • Role-Based Access Control (RBAC)
    • Service Accounts
    • API Keys
    • APIs
    • Log Patterns
    • Drilldown
    • Scraping custom metrics
      • Operator based metrics
      • kube-state-metrics
      • cadvisor metrics
    • Backup & Restore Metrics
    • Metrics & Labels
    • Add custom environment labels
    • Configuring Pipelines
      • Writing Remap Transforms
      • Logs Pipeline Examples
      • Traces Pipeline Examples
      • Logs to Events Pipeline Examples
      • Logs/Traces Sensitive Data Obfuscation
      • Sensitive Data Obfuscation using OTTL
      • Log Filtering using OTTL
    • Querying your groundcover data
      • Query your logs
        • Example queries
        • Logs alerting
      • Query your metrics
      • Querying you data using an API
      • Using KEDA autoscaler with groundcover
  • Log Parsing with OpenTelemetry Pipelines
  • Log and Trace Correlation
  • RUM
  • Customization
    • Customize deployment
      • Agents in host network mode
      • API Key Secret
      • Argo CD
      • On-premise deployment
      • Quay.io registry
      • Configuring sensor deployment coverage
      • Enabling SSL Tracing in Java Applications
    • Customize usage
      • Filtering Kubernetes entities
      • Custom data retention
      • Sensitive data obfuscation
      • Custom storage
      • Custom logs collection
      • Custom labels and annotations
        • Enrich logs and traces with pod labels & annotations
        • Enrich metrics with node labels
      • Disable tracing for specific protocols
      • Tuning resources
      • Controlling the eBPF sampling mechanism
  • Integrations
    • Overview
    • Workflow Integrations
      • Slack Webhook Integration
      • Opsgenie Integration
      • Webhook Integration
        • Incident.io
      • PagerDuty Integration
      • Jira Webhook Integration
      • Send groundcover Alerts to Email via Zapier
    • Data sources
      • OpenTelemetry
        • Traces & Logs
        • Metrics
      • Istio
      • AWS
        • Ingest CloudWatch Metrics
        • Ingest CloudWatch Logs
        • Ingest Logs Stored on S3
        • Integrate CloudWatch Grafana Datasource
      • GCP
        • Ingest Google Cloud Monitoring Metrics
        • Stream Logs using Pub/Sub
        • Integrate Google Cloud Monitoring Grafana Datasource
      • Azure
        • Ingest Azure Monitor Metrics
      • DataDog
        • Traces
        • Metrics
      • FluentBit
      • Fluentd
      • JSON Logs
    • 3rd-party metrics
      • ActiveMQ
      • Aerospike
      • Cassandra
      • CloudFlare
      • Consul
      • CoreDNS
      • Etcd
      • HAProxy
      • Harbor
      • JMeter
      • K6
      • Loki
      • Nginx
      • Pi-hole
      • Postfix
      • RabbitMQ
      • Redpanda
      • SNMP
      • Solr
      • Tomcat
      • Traefik
      • Varnish
      • Vertica
      • Zabbix
    • Source control (Gitlab/Github)
  • Architecture
    • Overview
    • inCloud Managed
      • Setup inCloud Managed with AWS
        • AWS PrivateLink Setup
        • EKS add-on
      • Setup inCloud Managed with GCP
      • Setup inCloud Managed with Azure
      • High Availability
      • Disaster Recovery
      • Ingestion Endpoints
      • Deploying in Sensor-Only mode
    • Security considerations
      • Okta SSO - onboarding
    • Service endpoints inside the cluster
  • Product Updates
    • What's new?
    • Earlier updates
      • 2025
        • Mar 2025
        • Feb 2025
        • Jan 2025
      • 2024
        • Dec 2024
        • Nov 2024
        • Oct 2024
        • Sep 2024
        • Aug 2024
        • July 2024
        • May 2024
        • Apr 2024
        • Mar 2024
        • Feb 2024
        • Jan 2024
      • 2023
        • Dec 2023
        • Nov 2023
        • Oct 2023
Powered by GitBook
On this page
  • Modes Overview
  • Metrics/Infra Metrics
  • Metrics Formulas
  • Logs/Traces
  • Examples
  • RUM
Export as PDF
  1. Use groundcover

Explore & Monitors query builder

The Query Builder in the platform's Explore and Monitors sections helps you craft and visualize queries on top of your data - Metrics, Infra Metrics, Logs, and Traces.

Last updated 1 month ago

Modes Overview

  1. Metrics – Work with all your available metrics. Great for advanced use cases and custom metrics.

  2. Infra Metrics – Use expert-built, predefined queries for common infrastructure scenarios. Ideal if you’re not sure which metric to pick or just want a quick start.

  3. Logs – Query and visualize Logs data.

  4. Traces – Query and visualize Traces, similar to logs.

  5. RUM - Query and visualizer RUM Events.

Metrics/Infra Metrics

When you select the Metrics or Infra Metrics modes, you’ll work with something akin to Prometheus queries - but simplified.

Metric Selector:

  • Search and choose a metric.

  • View associated labels and metadata (for groundcover’s built-in metrics).

  • If the chosen built-in metric’s type is known, the Query Builder automatically applies the best-suited function to streamline your workflow.

Infra Metrics Mode:

  • Select from ready-made queries grouped into categories (e.g., Container CPU, Node Disk).

  • Perfect if you’re unsure which metric to choose. Just pick a category, and you’re set.

Filters Bar (Metrics/Infra Metrics):

  • Filter by label key/value pairs.

  • Use - to exclude values

  • All filters are ANDed together, but multiple values for the same key form an OR condition.

  • Type a key and : (e.g cluster:) to list its values.

  • Use patterns (wildcards, partial matches) to refine results.

Aggregation Function Selector:

  • sum: Adds up all values.

  • avg: Calculates the average value.

  • max: Finds the maximum value.

  • min: Finds the minimum value.

  • count: Counts how many data points there are.

  • no aggregation: Leaves data un-aggregated.

Aggregation Labels Selector:

  • Select one or more labels to group your results by.

Limit Selector:

  • Show top or bottom results based on:

    • Max: Highest values.

    • Min: Lowest values.

    • Mean: Highest/lowest average values.

    • Median: Highest/lowest median values.

    • Last: Highest/lowest most recent values.

Visualization Type:

  • Time-series: View data over time (time range set by the time-picker).

  • Table: See instant snapshot data.

Time & Rollup Notes:

  • The time-picker defines the time range for your query.

Advanced Query

Switching to Advanced Query mode allows you to view and modify the PromQL query generated by the Query Builder. This mode provides full flexibility for advanced users. However, changes made in the editor are not reflected back in the Query Builder. The editor is ideal for making manual adjustments that are beyond the capabilities offered in Query Builder mode.

Selecting or deselecting Clusters and Environments in the Backend Picker won't affect the metrics displayed.

Metrics Formulas

To enhance your data analysis in Metrics mode, groundcover supports the use of Formulas. Formulas allow you to perform arithmetic operations and apply functions to your metrics queries.

Using Formulas:

  1. Assign Query Symbols: each metric query is automatically assigned a letter (A, B, C, etc.).

  2. Construct Formulas: Combine these letters using operators and functions to create expressions.

Supported Operators:

  • Addition: +

  • Subtraction: -

  • Multiplication: *

  • Division: /

  • Modulo: %

  • Exponentiation: **

  • Parentheses: () for grouping

Example:

To calculate the CPU usage percentage where A is the used CPU metric and B is the total CPU capacity:

(A / B) * 100

Logs/Traces

Filters Bar (Logs/Traces):

  • Same label-based filtering as Metrics.

  • Free Text Search (Logs only): Search for any substring.

  • Exclude terms by prefixing with -

  • Use * as a wildcard.

Measurement Selection (Logs/Traces):

  • Count: Count total logs/traces.

  • Count (unique): Count distinct values of a chosen field.

  • Avg/Sum/Max/Min: For numeric fields, perform calculations.

  • Percentiles (P99/P95/P50/P10): Show the value at a specific percentile.

Group By:

  • Group results by fields (e.g., k8s.namespace, service.name) to break down the data by categories.

Rollup (Logs/Traces):

  • Choose time buckets (like 1m, 5m) for aggregation. This helps smooth out spikes or show trends over chosen intervals.

Limit:

  • Limit and sort table data to display only the most relevant rows.

Visualization Type (Logs/Traces):

  • Time-series

  • Table

  • Stat

  • Top List

  • Pie

Examples

Here are a few examples to help you understand how to build and visualize queries using the Query Builder:

Query the top 5 workloads with the highest average container CPU usage in the namespaces demo-ng and opentelemetry-demo.

Quickly find the average memory usage of workloads in the namespace demo-ng. Instead of crafting a complex query, we simply selected Container Memory > Usage Amount.

Query the P99 duration of all HTTP traces across the platform. This query is broad, with no filters applied for clusters, namespaces, or specific services.

Narrow it down: Query the P99 duration of HTTP traces, but this time only for outbound traces from a specific workload.

Visualize the distribution of log counts per log level in the cluster demo. This provides a quick snapshot of the log severity levels.

RUM

The RUM Query Builder allows you to query RUM data collected by the groundcover SDK.

The following event types and their properties are available:

Event Type
Property
Description
Type

Page Loads

page_load_time

Page Load Time

Numeric

page_url

Page URL

String

Errors

error_fingerprint

Error Fingerprint

String

error_message

Error Message

String

error_type

Error Type

String

Custom Events

custom_event_name

Event Name

String

Interactions

dom_event_target.text

Target Text

String

dom_event_selector

Target Selector

String

dom_event_target.id

Target ID

String

dom_event_target.className

Target Class Name

String

Performance

performance_metric_name

Metric Name

String

performance_metric_value

Metric Value

Numeric

Navigations

page_url

URL

String

Global properties available for all RUM events:

  • session_id

  • service.name

  • location.path

  • location.title

  • user.email

  • user.organization

  • user.name

  • browser.version

  • browser.name

  • browser.type

  • browser.platform

Example

Create a visualization of Errors over time grouped by error_message in the demo service:

groundcover supports a wide variety of metrics - and metrics are automatically generated using our eBPF sensor, and can be ingested natively.

It includes the same components as the builder (Measurement Selection, Group By, Rollup, Limit, Visualization Type), plus an additional selector for Event Type.

Application
Infrastructure
custom metrics
Logs/Traces