streams.query.
A workspace that has no application yet shows how to create one instead.
Types of rows
The tabs under the title choose what a row is. A row is the latest version of its entity: a view that was reported many times appears once, with its last counts.Write a query
The query editor opens folded. Select Expand query editor, or Code or Builder, to open it. Code takes a field query: comparisons of the fields of the open type, joined byAND.
Durations are stored in nanoseconds, so
1000000000 is one second. The cell of a table shows them in the unit that fits.
Words that are not comparisons are looked for in the text columns of the open type, such as the user, the page, the
error message, and the request URL. A comparison on a field that the type does not have, or on a field that holds a
JSON document, is ignored and shown as Ignored.
Builder shows the same query as filters. Select Filter, then choose a field, a comparison, and a value.
Run the query with Run query, or press ⌘ Enter or Ctrl+Enter in the editor. Refresh reads the results
again. The time range sits next to the run button. The explorer opens on the last 24 hours.
Fields
The Fields list beside the results has every field of the open type, in three groups: Displayed fields, the columns of the table; Indexed fields, which filter without reading every row; and Other fields. Type in Find a field to narrow the list.- Click the name of a field to list its most common values with their counts, over the rows the query matches.
- Filter for this value and Filter out this value add the comparison to the query. Select a value that is already filtered to remove the filter.
- The eye of a field adds it to the table or removes it. Back to the default columns resets the table.
- The plus button of a field starts a comparison on it in the query.
Results and the histogram
The table shows one row for each result, newest first, with the time of the row first. A row that went wrong is marked down its left edge. Choose the page size, 100, 200, 500, 1,000, 2,000, or 5,000 rows, and move with Previous and Next. The histogram above the table counts every row the query matches over the time range, not only the loaded page, and says how many rows each bar stands for. Drag across the bars to narrow the time range. Select Hide histogram to close it; the choice is kept.Draw the rows as numbers
Visualize as, above the results, chooses how the rows the query matches are drawn. List is the table of rows and opens by default. The other four are numbers counted over every row the query matches in the time range, not over the loaded page, so they agree with the list beside them.
The map zooms from the whole world to eight times. Use the buttons at its corner, the wheel or a pinch (about the pointer),
or a double click, and drag a zoomed map to move it. With the map in focus,
+ and - zoom, 0 shows the whole world,
and the arrow keys move a zoomed map. A country that is too small to be seen, such as Singapore or Malta, is marked
where it lies. Point at a country to read what it came to. The outlines are Natural Earth’s 1:10m country boundaries,
simplified, in the worldview of China, without Antarctica. Taiwan, Hong Kong, and Macao are parts of China: Taiwan is a
piece of its own with no border about it, so that its rows are tinted apart. The availability map of
Synthetics draws the same shapes.
Select a group of a top list or a table to narrow the query to it, and select it again to let go. Select a head of a table
to order by it: the server ranks by that column, so the rows are the first of that order, not the first of another order
sorted. Click a timeseries to pin its tooltip: Include and Exclude in it narrow the query to the series under the pointer, or
leave it out. Dragging across the chart narrows the time range, as on the histogram.
When the number is a level of Largest Contentful Paint, Interaction to Next Paint, or Cumulative Layout Shift, the
chart is drawn in seconds, in milliseconds, or as a score, with two dashed lines where the vital turns from good to poor
(2.5 s and 4 s, 200 ms and 500 ms, 0.1 and 0.25), and the numbers of a top list or a table are coloured by their grade.
What is counted
The row under the query appears when the rows are drawn as numbers. Each change applies at once.- Measure is a function of a field.
countcounts rows.count_distinctcounts the different values of a field, such assession.idorusr.id.sum,avg,min,max,p50,p75,p90,p95, andp99take a numeric field, and the percentiles are estimates. A duration is stored in nanoseconds and is shown in the unit that fits. Select a measure to change it; select Measure to add one to a table. - Group by tells the rows apart by the values of a field, and Then by by a second. A row that has no value in the field is counted under (none). A measurement, a time, and a JSON document cannot be grouped by.
- Bucket is how long one point of a timeseries is. Auto cuts the range into about thirty points, each beginning on a multiple of its length on the clock of the page. Only the lengths that cut the range into two to 300 points are offered.
- Top is how many groups are drawn: 3 to 20 in a timeseries, 5 to 100 in a top list or a table.
viz is
timeseries, toplist, table, or map (the list leaves it out); m is a measure, as count or
p75:view.performance.lcp.timestamp, once for each; by is a group field, once for each; bucket is a length such as 5m or
1h; top is the number of groups; and sort and dir order a table. Changing the type keeps the way of drawing and
drops m, by, and sort, which belong to the fields of one type. The numbers are read with
aggregate.
Open a row
Click a row, or move with the arrow keys and pressEnter, to open it in a drawer beside the list. The drawer shows the
facts the type is told by, then every field of the row, and the stack of an error. Drag its left edge to resize it.
JandK, or the arrows in the head, move to the next and the previous row of the list.- Open the session opens the session the row belongs to.
- A view of a browser opens wide, on Load waterfall: the requests it made and the long tasks that blocked it, on one time axis from its start. Its fields are in the next section. See the load of a view.
- Closing the drawer gives the focus back to the row.
Open a session
The session page opens from the explorer. It shows:- the Replay player when the session recorded a DOM replay, or the Action timeline when it did not. The ruler of the replay has a tick for each error (red), for each action that showed a sign of frustration (orange), and for each page after the first (grey);
- the Developer tools under the replay: Errors, Network, and Performance, described below;
- User context: the user, the device, the location, the IP address, the application, the environment, the version, and the duration;
- Pages: the first and the last page of the visit, and Detected issues: errors, crashes, frustration signals, and long tasks;
- the Event timeline: every view, action, request, error, and long task of the session in the order it happened;
- Related traces: the backend traces whose ID a request of the session carried (Direct), or, when no request carried one, the traces that ran while the session did (Time-correlated). Each trace opens on Traces.
Developer tools
Under the replay are three tabs, each with a count: Errors, Network, and Performance. They read the events of the session itself, and they follow the replay.- The row the replay is at, which is the last that had happened by its moment, is lit with a line at its left. The list scrolls to keep it in sight as the replay plays or is moved, and the page under it stays where it is.
- A row moves the replay to its moment and pauses it. Times are minutes and seconds from the beginning of the recording, the ruler of the progress bar. A session that recorded no replay has nothing to follow or to move: its times run from the start of the session, and a row only tells what happened.
- Errors lists the errors of the session in the order they happened: the time, the type, the message, and the issue the error was grouped into, which opens on Errors. The tab is the one the tools open on when the session ran into an error, and Network is the one when it did not.
- Network lists the requests of one view: the time, the method, the host and the path, the status, the kind, the time taken, and the size, with a bar for each on the time the requests of the view took. View chooses the view. Until one is chosen it is the one the replay is in, and Follow the replay gives it back. All views lists every request of the session. Show narrows the list to the slow requests (500 ms or more) or the ones that failed. Waterfall shows the load of the view as the explorer does (see the load of a view).
- Performance has a row for each view of the session: LCP, INP, and CLS in the colour of their grade, and how many requests and long tasks the view met. A row opens the waterfall of its view in Network.
tab, view, display, and show), and so is the moment the replay opens at (at, in microseconds since the epoch), where the
replay waits until it is played. The links of Frustration open a session there.
Tabs, sharing, and the address
The explorer uses the same query tabs as Logs: open several queries side by side, rename them, and split the page. The address of the page is the query on screen. It carries the type (type), the field query (q), the time range (time), and
when the rows are drawn as numbers, how (see Draw the rows as numbers), so a copy of the address bar shares the query. Share copies a link with a choice of the time range.
What the explorer reads
The rows are in the RUM streams. The query runs through the query engine with the same masking and limits as Logs, and a count that takes too long is reported as unavailable. The columns and their units are the same as the fields of the event format.RUM event format
The fields behind the columns.
RUM applications
Create an application and give its token to an SDK.