Add query assist documentation to Observability (#6419)
Add Query Assistant documentation --------- Signed-off-by: Ashish Agrawal <ashisagr@amazon.com> Signed-off-by: Melissa Vagi <vagimeli@amazon.com> Co-authored-by: Melissa Vagi <vagimeli@amazon.com> Co-authored-by: Nathan Bower <nbower@amazon.com>
This commit is contained in:
Ashish Agrawal
GitHub
parent
c389fd66c2
commit
8d2a7f263f
|
|
@ -8,15 +8,15 @@ redirect_from:
|
|||
|
||||
# Event analytics
|
||||
|
||||
Event analytics in Observability is where you can use [Piped Processing Language]({{site.url}}{{site.baseurl}}/search-plugins/sql/ppl/index) (PPL) queries to build and view different visualizations of your data.
|
||||
Event analytics in OpenSearch Observability allow you to create data visualizations using [Piped Processing Language]({{site.url}}{{site.baseurl}}/search-plugins/sql/ppl/index/) (PPL) queries.
|
||||
|
||||
## Getting started with event analytics
|
||||
|
||||
To get started, choose **Observability** in OpenSearch Dashboards and then choose **Event analytics**. If you want to start exploring without adding any of your own data, choose **Add samples**, and Dashboards adds sample visualizations you can interact with.
|
||||
To get started, choose **Observability** in OpenSearch Dashboards and then choose **Logs**. If you want to start exploring without adding your own data, choose **Add samples**. Dashboards adds sample visualizations you can interact with. You can also try out preconfigured analytics in [OpenSearch Playground](https://playground.opensearch.org/app/observability-logs#/).
|
||||
|
||||
## Building a query
|
||||
|
||||
To generate custom visualizations, you must first specify a PPL query. OpenSearch Dashboards then automatically creates a visualization based on the results of your query.
|
||||
To generate custom visualizations, you must first specify a PPL query. OpenSearch Dashboards then automatically creates a visualization based on your query results.
|
||||
|
||||
For example, the following PPL query returns a count of how many host addresses are currently in your data.
|
||||
|
||||
|
|
@ -24,41 +24,69 @@ For example, the following PPL query returns a count of how many host addresses
|
|||
source = opensearch_dashboards_sample_data_logs | fields host | stats count()
|
||||
```
|
||||
|
||||
By default, Dashboards shows results from the last 15 minutes of your data. To see data from a different time frame, use the date and time selector.
|
||||
By default, Dashboards shows results from the last 15 minutes of your data. To see data from a different time frame, use the date and time selector to choose the desired settings.
|
||||
|
||||
For more information about building PPL queries, see [Piped Processing Language]({{site.url}}{{site.baseurl}}/search-plugins/sql/ppl/index).
|
||||
For more information about building PPL queries, see [Piped Processing Language]({{site.url}}{{site.baseurl}}/search-plugins/sql/ppl/index/).
|
||||
|
||||
### OpenSearch Dashboards Query Assistant
|
||||
|
||||
This is an experimental feature and is not recommended for use in a production environment. For updates on the progress of the feature or if you want to leave feedback, see the associated [OpenSearch forum thread](https://forum.opensearch.org/t/feedback-opensearch-assistant/16741).
|
||||
{: .warning}
|
||||
|
||||
To simplify query building, the **OpenSearch Assistant** toolkit offers an assistant that converts natural language queries into PPL. A screenshot is shown in the following image.
|
||||
|
||||
|
||||
|
||||
#### Enabling Query Assistant
|
||||
|
||||
To enable **Query Assistant** in OpenSearch Dashboards, locate your copy of the `opensearch_dashboards.yml` file and set the following option:
|
||||
|
||||
```
|
||||
observability.query_assist.enabled: true
|
||||
observability.query_assist.ppl_agent_name: "PPL agent"
|
||||
```
|
||||
|
||||
To enable summarization of responses, locate your copy of the `opensearch_dashboards.yml` file and set the following option:
|
||||
|
||||
```
|
||||
observability.summarize.enabled: true
|
||||
observability.summarize.response_summary_agent_name: "Response summary agent"
|
||||
observability.summarize.error_summary_agent_name: "Error summary agent"
|
||||
```
|
||||
|
||||
#### Setting up Query Assistant
|
||||
|
||||
To set up **Query Assistant**, follow the steps in the [Getting started guide](https://github.com/opensearch-project/dashboards-assistant/blob/main/GETTING_STARTED_GUIDE.md) on GitHub. This guide provides step-by-step setup instructions for **OpenSearch Assistant** and **Query Assistant**. To set up **Query Assistant** only, use the `query-assist-agent` template included in the guide.
|
||||
|
||||
## Saving a visualization
|
||||
|
||||
After Dashboards generates a visualization, you must save it if you want to return to it at a later time or if you want to add it to an [operational panel]({{site.url}}{{site.baseurl}}/observing-your-data/operational-panels).
|
||||
|
||||
To save a visualization, expand the save dropdown menu next to **Refresh**, enter a name for your visualization, then choose **Save**. You can reopen any saved visualizations on the event analytics page.
|
||||
After Dashboards generates a visualization, save it if you want to revisit it or include it in an [operational panel]({{site.url}}{{site.baseurl}}/observing-your-data/operational-panels). To save a visualization, expand the **Save** dropdown menu in the upper-right corner, enter a name for the visualization, and then select the **Save** button. You can reopen saved visualizations on the event analytics page.
|
||||
|
||||
## Creating event analytics visualizations and adding them to dashboards
|
||||
|
||||
This feature is available in OpenSearch Dashboards version 2.7 and later. It works with new visualizations created in version 2.7 or later that use PPL to query data from OpenSearch or federated data sources such as Prometheus.
|
||||
This feature is available in OpenSearch Dashboards 2.7 and later. It works with new visualizations that use PPL to query data from OpenSearch or federated data sources such as Prometheus.
|
||||
{: .note}
|
||||
|
||||
Presenting your visualizations on a dashboard, instead of the event analytics page, makes it easier for users to understand and interpret the data at a glance.
|
||||
|
||||
To create a PPL visualization, follow these steps:
|
||||
|
||||
1. On the main menu, choose **Visualize** > **PPL**.
|
||||
2. In the **Observability** > **Logs** > **Explorer** window, enter the index source in the **PPL query** field, for example, `source = opensearch_dashboards_sample_data_flights | stats count() by DestCountry`. You must enter the query using PPL syntax.
|
||||
2. From the **Observability** > **Logs** > **Explorer** window, enter the index source in the **PPL query** field, for example, `source = opensearch_dashboards_sample_data_flights | stats count() by DestCountry`. You must enter the query using PPL syntax.
|
||||
3. Set the time filter, for example, **This week**, and then select **Refresh**.
|
||||
4. Choose the visualization type, for example, **Pie**, from the right sidebar dropdown menu.
|
||||
4. Choose the visualization type, for example, **Pie**, from the sidebar dropdown menu to the right.
|
||||
5. Select **Save** and enter a name for the visualization.
|
||||
|
||||
You've created a new visualization that can be added to a new or existing dashboard. To add a PPL query to a dashboard, follow these steps:
|
||||
You've now created a new visualization that can be added to a new or existing dashboard. To add a PPL query to a dashboard, follow these steps:
|
||||
|
||||
1. Select **Dashboard** from the main menu.
|
||||
2. In the **Dashboards** window, select **Create > Dashboard**.
|
||||
1. Select **Dashboards** from the main menu.
|
||||
2. In the **Dashboards** window, select **Create** > **Dashboard**.
|
||||
3. In the **Editing New Dashboard** window, choose **Add an existing**.
|
||||
4. In the **Add panels** window, choose **PPL** and select the visualization. It is now displayed on your dashboard.
|
||||
4. In the **Add panels** window, choose **PPL** from the **Types** dropdown menu, and then select the visualization. It is now displayed on your dashboard.
|
||||
5. Select **Save** and enter a name for the dashboard.
|
||||
6. To add more visualizations to the dashboard, choose **Select existing visualization** and follow the steps above. Alternatively, choose **Create new** and then select **PPL** in the **New Visualization** window. You'll return to the event analytics page and follow steps 1--6 in the preceding instructions.
|
||||
6. To add more visualizations to the dashboard, choose **Select existing visualization** and follow steps 1--5. Alternatively, choose **Create new** and then select **PPL** in the **New Visualization** window. You'll return to the event analytics page and follow steps 1--5 in the preceding instructions.
|
||||
|
||||
|
||||
The following demo provides an overview of creating event analytics visualizations and adding them to a dashboard.
|
||||
|
||||
|
||||
|
||||
### Limitations of event analytics visualizations
|
||||
|
||||
|
|
@ -73,20 +101,26 @@ The following are methods you can use to view logs.
|
|||
|
||||
### Correlating logs and traces
|
||||
|
||||
If you regularly track events across applications, you can correlate logs and traces. To view the correlation, you have to index the traces according to Open Telemetry standards (similar to trace analytics). Once you add a `TraceId` field to your logs, you can view the correlated trace information in the event explorer log details. This method lets you correlate logs and traces that correspond to the same execution context.
|
||||
If you regularly track events across applications, you can correlate logs and traces. To view correlations, you must index the traces according to OpenTelemetry standards, similarly to [trace analytics]({{site.url}}{{site.baseurl}}/observing-your-data/trace/index/). Once you add a `TraceId` field to your logs, you can view the correlated trace information in the event explorer log details. This method correlates logs and traces that correspond to the same execution context. The following demo shows this feature in action.
|
||||
|
||||
|
||||
|
||||
### Viewing surrounding events
|
||||
|
||||
If you want to know more about a log event you're looking at, you can select **View surrounding events** to get a bigger picture of what was happening around the time of interest.
|
||||
If you need more information about a log event, you can select **View surrounding events** to gain a more comprehensive understanding of the context around the time of interest. The following demo shows this feature in action.
|
||||
|
||||
|
||||
|
||||
### Livestreaming logs
|
||||
|
||||
If you prefer watching events happen live, you can configure an interval so event analytics automatically refreshes the content. Live tail lets you stream logs live to OpenSearch observability event analytics based on the provided PPL query, as well as provide rich functionality such as filters. Doing so improves your debugging experience and lets you monitor your logs in real-time without having to manually refresh.
|
||||
If you prefer real-time monitoring, you can set up an interval at which event analytics content will be automatically refreshed. With Live Tail, you can stream logs directly to OpenSearch Observability event analytics using the specified PPL query while leveraging robust features like filters. This can enhance your debugging process and enables seamless real-time monitoring of logs without the need to manually refresh content.
|
||||
|
||||
You can also choose intervals and switch between them to dictate how often live tail should stream live logs. This feature is similar to the CLI's `tail -f` command in that it only retrieves the most recent live logs by possibly eliminating a large portion of live logs. Live tail also provides you with the total count of live logs received by OpenSearch during the live stream, which you can use to better understand the incoming traffic.
|
||||
With Live Tail, you can select intervals and seamlessly switch between them to control the frequency of live log streaming. This functionality is similar to the `tail -f` CLI command, as it retrieves only the most recent live logs, potentially eliminating a significant portion of live logs. Live Tail displays the total number of live logs received by OpenSearch during the live stream, offering insight into incoming traffic patterns. The following demo shows this feature in action.
|
||||
|
||||
|
||||
|
||||
## Related articles
|
||||
|
||||
- [Demonstrating the OpenSearch Assistant toolkit](https://www.youtube.com/watch?v=VTiJtGI2Sr4&t=152s)
|
||||
- [Getting started guide for OpenSearch Assistant in OpenSearch Dashboards](https://github.com/opensearch-project/dashboards-assistant/blob/main/GETTING_STARTED_GUIDE.md)
|
||||
- OpenSearch Assistant configuration through the REST API
|
||||
|
|
|
|||
Binary file not shown.
|
After Width: | Height: | Size: 280 KiB |
Loading…
Reference in New Issue