OQL query patterns

Use these patterns after choosing workspace, project, environment, service, and time range in the scope bar. Oriel injects that scope into telemetry reads, so the examples stay short.

Find a noisy route

spans | where http.route exists | stats count() as calls, count_if(is_error) as errors by http.route | top 20 by errors

Use the result to open Traces or turn the predicate into an alert rule.

Compare latency by service

spans | stats p95(duration) as p95, count() as calls by service, bin(5m)

Keep the bin when the trend matters. Drop it when you need one row per service.

Find logs for one trace

logs | where trace_id == "4f3b8d3b1f4a3a3c0e0b4d0a9b7c2d1e" | fields time, service, severity_text, body

Trace detail links to this shape when logs carry trace_id.

Turn a log message into a count

logs | where body contains "deadline exceeded" | stats count() as timeouts by service, bin(1m)

Use this for incident dashboards and threshold alerts when the log line is the only reliable symptom.

Read a metric rate

metrics | where name == "http.server.request.duration" | stats sum(value) as requests by service, bin(1m)

For cumulative metrics, Oriel handles temporality during ingest and query planning. Metric labels arrive as attributes and can be used as fields.

Inspect metric cardinality

metrics | where name == "http.server.request.duration" | stats count() by service, http.route | top 50 by count

High-cardinality attributes count against the active-series cap. Drop or aggregate volatile labels in the Collector before export.

Find hot profile stacks

profiles | where profile_type == "cpu" | stats sum(value) as cpu by service | top 10 by cpu

Profiles use bare resource attribute names in OQL, such as host_name, rather than resource.host.name.

Keep a dashboard query stable

Prefer scope-driven queries:

spans | stats count() as calls, count_if(is_error) as errors by service, bin(auto)

Avoid hard-coding environment == "prod" inside every dashboard panel unless the panel must ignore the active scope.

Shape an SLO SLI

An SLO query must produce good and total with no grouping or binning:

spans | where http.route == "/checkout" | stats count_if(is_error == false) as good, count() as total

Oriel records the minute buckets for the SLO. Add filters before stats; do not add by or bin.