Query using Editor

Query your data using the text-based query editor in Console:

1. Click the Query tab.
2. Click Editor in the top left.
3. Write your query in the editor.
4. Click Run.

The Editor of the Query tab accepts both APL (Axiom Processing Language) and MPL (Metrics Processing Language) queries and automatically detects the query language you use:

• APL is a data processing language that supports filtering, extending, and summarizing data. For more information, see Introduction to APL.
• MPL is a metric-focused query language that combines the simplicity of APL with the expressive power of PromQL. It enables effective querying, transformation, and aggregation of metric data, supporting diverse observability use cases. For more information, see Introduction to MPL.

Generate query using natural language

Instead of writing the query yourself, you can use Axiom AI to generate a query for you. Explain what you want to infer from your data in your own words and Axiom AI generates the valid APL query.

To generate a query using natural language:

1. Click the Query tab.
2. Click APL, and then click in the query editor.
3. Press Cmd/Ctrl K.
4. Type what you want to infer from your data in your own words using natural language, and then click Generate. For example, type Show me the most common status responses in HTTP logs.
5. Axiom’s AI generates the APL query based on your prompt and gives you the following options:
   • Click Accept to update the editor with the generated query and change the generated query before running it. Any previous input in the query editor is lost.
   • Click Accept and run to update the editor with the generated query and run it immediately. Any previous input in the query editor is lost.
   • Click Reject to go back to your previous input in the query editor and close the query generator.

Iterate over prompt history

Axiom saves the prompts you type in the query generator. To find one of your previous prompts and generate an APL query for it:

1. Click the Query tab.
2. Click APL, and then click in the query editor.
3. Press Cmd/Ctrl K.
4. Cycle through your history using the arrow keys and to find the prompt.
5. Click Generate.

APL examples

Some APL queries are explained below. The pipe symbol | separates the operations as they flow from left to right, and top to bottom.

APL is case-sensitive for everything: dataset names, field names, operators, functions, etc.

Use double forward slashes (//) for comments.

count operator

The below query returns the number of events from the sample-http-logs dataset.

['sample-http-logs']
| summarize count()

limit operator

The limit operator returns a random subset of rows from a dataset up to the specified number of rows. This query returns a thousand rows from sample-http-logs randomly chosen by APL.

['sample-http-logs']
| limit 1000

summarize operator

The summarize operator produces a table that aggregates the content of the dataset. This query returns a chart of the avg(req_duration_ms), and a table of geo.city and avg(req_duration_ms) of the sample-http-logs dataset from the time range of 2 days and time interval of 4 hours.

['sample-http-logs']
| where _time > ago(2d)
| summarize avg(req_duration_ms) by _time=bin(_time, 4h), ['geo.city']

MPL examples

align operator

The align operator aggregates metric values over time windows. This query returns the average value of the go.memory.used metric from the otel-demo-metrics dataset, grouped into 5-minute intervals.

`otel-demo-metrics`:`go.memory.used`
| align to 5m using avg

where operator

The where operator restricts results to series whose tag values match the specified conditions. This query returns the average value of the go.memory.used metric from the otel-demo-metrics dataset for the checkout deployment, aligned over 5-minute windows.

`otel-demo-metrics`:`go.memory.used`
| where `k8s.deployment.name` == "checkout"
| align to 5m using avg

group operator

The group operator combines multiple series by tag values into a single aggregated series. This query returns the sum of go.memory.used per deployment, aligned to 5-minute windows, showing memory usage broken down by k8s.deployment.name.

`otel-demo-metrics`:`go.memory.used`
| align to 5m using avg
| group by `k8s.deployment.name` using sum

What's next

• Interpret query results
• Visualize data
• Views
• Virtual fields