LogoLogo
StackState.comDownloadSupportExplore playground
StackState v5.1
StackState v5.1
  • Welcome to the StackState docs!
  • StackState self-hosted v5.1 docs
  • Getting Started
  • πŸš€Setup
    • Install StackState
      • Requirements
      • Kubernetes / OpenShift
        • Kubernetes install
        • OpenShift install
        • Required Permissions
        • Non-high availability setup
        • Override default configuration
        • Configure storage
        • Configure Ingress
        • Install from custom image registry
        • Migrate from Linux install
      • Linux
        • Before you install
        • Download
        • Install StackState
        • Install with production configuration
        • Install with development configuration
        • Install with POC configuration
        • Set up a reverse proxy
        • Set up TLS without reverse proxy
      • Initial run guide
      • Troubleshooting
    • Upgrade StackState
      • Steps to upgrade
      • Version specific upgrade instructions
      • StackPack versions
      • StackState release notes
    • StackState Agent
      • About StackState Agent V3
      • Docker
      • Kubernetes / OpenShift
      • Linux
      • Windows
      • Advanced Agent configuration
      • Use an HTTP/HTTPS proxy
      • Agent V1 (legacy)
      • Migrate Agent V1 to Agent V2
        • Linux
        • Docker
    • StackState CLI
      • CLI: sts
      • CLI: stac (deprecated)
      • Comparison between CLIs
    • Data management
      • Backup and Restore
        • Kubernetes backup
        • Linux backup
        • Configuration backup
      • Data retention
      • Clear stored data
  • πŸ‘€Use
    • Concepts
      • The 4T data model
      • Components
      • Relations
      • Health state
      • Layers, Domains and Environments
      • Perspectives
      • Anomaly detection
      • StackState architecture
    • StackState UI
      • Explore mode
      • Filters
      • Views
        • About views
        • Configure the view health
        • Create and edit views
        • Visualization settings
      • Perspectives
        • Topology Perspective
        • Events Perspective
        • Traces Perspective
        • Metrics Perspective
      • Timeline and time travel
      • Analytics
      • Keyboard shortcuts
    • Checks and monitors
      • Checks
      • Add a health check
      • Anomaly health checks
      • Monitors
      • Manage monitors
    • Problem analysis
      • About problems
      • Problem lifecycle
      • Investigate a problem
      • Problem notifications
    • Metrics
      • Telemetry streams
      • Golden signals
      • Top metrics
      • Add a telemetry stream
      • Browse telemetry
      • Set telemetry stream priority
    • Events
      • About events
      • Event notifications
      • Manage event handlers
    • Glossary
  • 🧩StackPacks
    • About StackPacks
    • Add-ons
      • Autonomous Anomaly Detector
      • Health Forecast
    • Integrations
      • About integrations
      • πŸ’ StackState Agent V2
      • πŸ’ AWS
        • AWS
        • AWS ECS
        • AWS X-ray
        • StackState/Agent IAM role: EC2
        • StackState/Agent IAM role: EKS
        • Policies for AWS
        • AWS (legacy)
        • Migrate AWS (legacy) to AWS
      • πŸ’ Dynatrace
      • πŸ’ Kubernetes
      • πŸ’ OpenShift
      • πŸ’ OpenTelemetry
        • About instrumentations
        • AWS NodeJS Instrumentation
        • Manual Instrumentation
          • Prerequisites
          • Tracer and span mappings
          • Relations between components
          • Span health state
          • Merging components
          • Code examples
      • πŸ’ ServiceNow
      • πŸ’ Slack
      • πŸ’ Splunk
        • Splunk
        • Splunk Events
        • Splunk Health
        • Splunk Metrics
        • Splunk Topology
      • πŸ’ VMWare vSphere
      • Apache Tomcat
      • Azure
      • Cloudera
      • Custom Synchronization
      • DotNet APM
      • Elasticsearch
      • Humio
      • Java APM
      • JMX
      • Logz.io
      • MySQL
      • Nagios
      • OpenMetrics
      • PostgreSQL
      • Prometheus
      • SAP
      • SCOM
      • SolarWinds
      • Static Health
      • Static Topology
      • Traefik
      • WMI
      • Zabbix
    • Develop your own StackPacks
  • πŸ”§Configure
    • Topology
      • Component actions
      • Identifiers
      • Topology naming guide
      • Topology sources
      • Create a topology manually
      • Configure topology synchronizations
      • Enable email event notifications
      • Send topology data over HTTP
      • Set the topology filtering limit
      • Use a proxy for event handlers
      • Use tags
      • Tune topology synchronization
      • Debug topology synchronization
    • Telemetry
      • Add telemetry during topology synchronization
      • Data sources
        • Elasticsearch
        • Prometheus mirror
      • Send events over HTTP
      • Send metrics data over HTTP
      • Set the default telemetry interval
      • Debug telemetry synchronization
    • Traces
      • Set up traces
      • Advanced configuration for traces
    • Health
      • Health synchronization
      • Send health data over HTTP
        • Send health data
        • Repeat Snapshots JSON
        • Repeat States JSON
        • Transactional Increments JSON
      • Debug health synchronization
    • Anomaly Detection
      • Export anomaly feedback
      • Scale the AAD up and down
      • The AAD status UI
    • Security
      • Authentication
        • Authentication options
        • File based
        • LDAP
        • Open ID Connect (OIDC)
        • KeyCloak
        • Service tokens
      • RBAC
        • Role-based Access Control
        • Permissions
        • Roles
        • Scopes
        • Subjects
      • Secrets management
      • Self-signed certificates
      • Set up a security backend for Linux
      • Set up a security backend for Windows
    • Logging
      • Kubernetes logs
      • Linux logs
      • Enable logging for functions
  • πŸ“–Develop
    • Developer guides
      • Agent checks
        • About Agent checks
        • Agent check API
        • Agent check state
        • How to develop Agent checks
        • Connect an Agent check to StackState
      • Custom functions and scripts
        • StackState functions
        • Check functions
        • Component actions
        • Event handler functions
        • ID extractor functions
        • Mapping functions
        • Monitor functions
        • Propagation functions
        • Template functions
        • View health state configuration functions
      • Custom Synchronization StackPack
        • About the Custom Synchronization StackPack
        • How to customize elements created by the Custom Synchronization StackPack
        • How to configure a custom synchronization
      • Integrate external services
      • Mirroring Telemetry
      • Monitors
        • Create monitors
        • Monitor STJ file format
      • StackPack development
        • How to create a StackPack
        • Packaging
        • How to get a template file
        • How to make a multi-instance StackPack
        • Prepare a multi-instance provisioning script
        • Upload a StackPack file
        • Prepare a shared template
        • Customize a StackPack
        • Prepare instance template files
        • Prepare a StackPack provisioning script
        • Resources in a StackPack
        • StackState Common Layer
      • Synchronizations and templated files
    • Reference
      • StackState OpenAPI docs
      • StackState Template JSON (STJ)
        • Using STJ
        • Template functions
      • StackState Markup Language (STML)
        • Using STML
        • STML Tags
      • StackState Query Language (STQL)
      • StackState Scripting Language (STSL)
        • Scripting in StackState
        • Script result: Async
        • Script result: Streaming
        • Time in scripts
        • Script APIs
          • Async - script API
          • Component - script API
          • HTTP - script API
          • Prediction - script API
          • StackPack - script API
          • Telemetry - script API
          • Time - script API
          • Topology - script API
          • UI - script API
          • View - script API
    • Tutorials
      • Create a simple StackPack
      • Push data to StackState from an external system
      • Send events to StackState from an external system
      • Set up a mirror to pull telemetry data from an external system
Powered by GitBook
LogoLogo

Legal notices

  • Privacy
  • Cookies
  • Responsible disclosure
  • SOC 2/SOC 3
On this page
  • Overview
  • Component filters
  • Filters
  • Operators
  • Wildcard
  • Examples
  • Functions
  • withNeighborsOf
  • withCauseOf - DEPRECATED
  • Compatibility basic and advanced filters
  • See also
  1. Develop
  2. Reference

StackState Query Language (STQL)

StackState Self-hosted v5.1.x

PreviousSTML TagsNextStackState Scripting Language (STSL)

Last updated 2 years ago

Overview

This page describes how to use the built-in StackState Query Language (STQL) to write advanced topology component filters. STQL queries are used in StackState to write .

An STQL query consists of and . The query output is a component, or set of components, filtered from the complete topology.

STQL queries can be combined with scripts in the environment.

Component filters

Component filters are used in two ways in STQL:

  • Define the set of components to be included in the query output.

  • Specify the set of components to be handled by an in-built STQL function.

Filters

The filters described below can be combined using the available to achieve complex selections of components.

Filter
Default
Description

domain

"all"

Components in the specified domain(s).

environment

"all"

Components in the named environment.

healthstate

"all"

Components with the named health state.

label

"all"

Components with the named labels.

layer

"all"

Components in the named layer.

name

"all"

Components with the specified name.

type

"all"

Components of the specified type.

identifier

"all"

Operators

The operators described below are available to use in STQL queries. Note that boolean operators will be executed in the standard order: NOT, OR, AND.

Operator
Description
Example

=

Equality matching

name = "DLL_DB"

!=

Inequality matching

name != "DLL_DB"

IN

Value is in subset

name in ("DLL_DB", "J2EE_04")

NOT

Negation

name NOT in ("DLL_DB", "J2EE_04")

AND and OR

Filter based on more than one condition or sub-query

name = "DLL_DB" OR type = "database"

()

Use parenthesis to group results

(name = … AND type = …) OR (…)

For example:

# Return all components named DLL_DB or J2EE_04 regardless of type:
  name = DLL_DB OR name = J2EE_04 

# Return only databases named DLL_DB and host systems named J2EE_04:
  (name = DLL_DB AND type = database) OR (name = J2EE_04 AND type = "host systems")

Wildcard

You can use * as a full wildcard in a component filter. It isn't possible to filter for partial matches using a wildcard character.

Examples

# Select all components
name = "*"

# Select all components with name "serviceB"
name = "serviceB"

# Select all components in the "application" layer:
layer = "application"

# Select all components named either "appA" or "appB" that don't have a label "bck"
name IN ("appA","appB") NOT label = "bck"

# Select all components named "appA" that don't have a label "bck" or "test"
name = "appA" NOT label in ("bck", "test")

Functions

withNeighborsOf

The function withNeighborsOf extends STQL query output, adding connected components in the specified direction(s). The number of topology levels included can be adjusted up to a maximum of 15.

withNeighborsOf(components=(), levels=, direction=)

Parameters / fields

Parameter
Default
Allowed values
Description

components

"all"

A component filter

levels

1

"all", [1:14]

The number of levels to include in the output. Use "all" to display all available levels (maximum 15)

direction

"both"

"up", "down", "both"

up: only components that depend on the named component(s) will be added down: only dependencies of the named component(s) will be added both: components that depend on and dependencies of the named component(s) will be added.

Example

The example below will return all components in the application layer that have a health state of either DEVIATING or CRITICAL. Components with names "appA" or "appB" and their neighbors will also be included.

layer = "application"
  AND (healthstate = "CRITICAL" OR healthstate = "DEVIATING")
  OR withNeighborsOf(components = (name in ("appA","appB")))

withCauseOf - DEPRECATED

The withCauseOf function has been deprecated. This functionality has been replaced by the Root Cause Analysis section in the visualizer. The construct will be parsed, but won't produce any additional components.

Compatibility basic and advanced filters

You can switch between basic and advanced filtering by selecting Basic or Advanced under Filter Topology in the View Filters panel.

It's always possible to switch from Basic to Advanced filtering. The selected basic filters will be converted directly to an STQL query. For simple queries it's also possible to switch from Advanced to Basic filtering, however, some advanced queries aren't compatible with basic filters.

  • Basic filters can't contain an inequality.

  • Basic filters don't use =, rather they're formatted using the IN operator. For example name IN ("DLL_DB”) and not name = "DLL_DB”.

  • Basic filters use AND/OR in a specific way:

    • All items in each basic filter box are joined with an OR: layer IN ("business service", "applications", "databases")

    • The different basic filter boxes are chained together with an AND: layer IN ("business service") AND domain IN ("online banking”)

    • The Include components basic filter box (name) is the exception - this is chained to the other filter boxes with an OR: layer IN ("business service") AND domain IN ("online banking") OR name IN ("DLL_DB”)

    • The advanced filtering options withNeighborsOf function and identifier are only compatible with basic filtering if they're joined to other filters with an OR: layer in ("Processes") OR identifier IN ("urn:test:component")

If you try to switch from an Advanced filter to a Basic filter and the query isn't compatible, StackState will let you know and ask for confirmation to continue as you will lose some set filters. Alternatively, you can choose to stay in advanced filtering.

See also

Components with the specified URN identifier. The identifier filter is only compatible with basic filtering when it's specified using identifier IN (...) and combined with other filters using an OR operator. When the set filter is compatible with basic filtering, the number of component identifiers queried will be reported in the .

To be compatible with basic filtering, the function can only be combined with other filters using an OR operator. When an advanced filter includes a function withNeighborsOf that's compatible with basic filtering, the number of components whose neighbors are queried for is shown in the .

The component(s) for which the neighbors will be returned, see .

πŸ“–
How to filter topology in the StackState UI
component filters
Analytics
component filters
functions
operators
advanced topology filters
Other filters box
Basic topology filters
Topology filter limits
Other filters box