Metrics API - Metric selector

The metric selector is a powerful instrument for specifying which metrics you want to read with the GET metric data points or the GET metrics call.

In addition, you can transform the resulting set of data points. These transformations modify the plain metric data.

Limitations

The total length of the metricSelector string is limited to 5,000 characters.

You can query data points of up to 10 metrics in one query.

Select metrics

You need to specify a metric key to select it. You can specify multiple metric keys separated by commas (for example, metrickey1,metrickey2). To select multiple metrics belonging to the same parent, list the last part of the required metric keys in parentheses, separated by commas. For example, to list the builtin:host.cpu.idle and builtin:host.cpu.user metric, write: builtin:host.cpu.(idle,user).

Dimensions

Many Dynatrace metrics can be referenced with finer granularity using dimensions. For example, the builtin:host.disk.avail metric has two dimensions:

  • The primary dimension is Host
  • The secondary dimension is Disk

Query a metric with the GET metric descriptor call to obtain information about available dimensions—you can find them in the dimensionDefinitions field of the metric descriptor.

Wherever you see the <dimension> placeholder in the example syntax, you can select a specific dimension of the metric. You can reference a dimension by its key. For example, for builtin:host.disk.avail these are dt.entity.host and dt.entity.disk.

Transform operations modify the list of dimensions by adding or removing them. Subsequent transformations operate on modified list of dimensions. Query the metric descriptor with preceding transformations (for example builtin:host.disk.avail:names) to view the new list of available dimensions.

Aggregation transformation

Syntax :(<agg1>,<agg2>,<aggN>)
Arguments A list of desired aggregations.

Specifies the aggregation of the returned data points. If you specify several aggregations, each is returned as a different metric object. Each of these objects is contributing to the limit of metrics per query.

The following aggregation types are available:

Aggregation Notes
auto Applies the default aggregation. To check the default aggregation, query a metric with the GET metric descriptors call and check the defaultAggregation field.
min Selects the lowest value from the time slot. All null values are ignored.
max Selects the highest value from the time slot. All null values are ignored.
avg Calculates the arithmetic mean of all values from the time slot. All null values are ignored.
sum Sums all values from the time slot. All null values are ignored.
value Takes a single value as is. Only applicable to previously aggregated values and metrics that support the value aggregation.
count Takes the count of the values in the time slot. All null values are ignored.
percentile(N) Calculates the Nth percentile, where N is between 0 and 100 (inclusive).

Syntax examples

:(percentile(99.9)) Gets the 99.9th percentile.
:(min,max) Gets a metric with min and max aggregations as two separate metric objects.

For example, for the builtin:host.disk.avail metric these will be builtin:host.disk.avail:min and builtin:host.disk.avail:max.

Filter transformation

Syntax :filter(<condition1>,<condition2>,<conditionN>)
Arguments A list of filtering conditions. A dimension has to match all of the conditions to pass filtering.

The filter transformation filters the response by the specified criteria. It enables you to filter the data points by a secondary dimension, as entitySelector supports only the first dimension, which is an entity. The combination of scope and filter transformation helps you maximize data filtering efficiency.

Conditions

The :filter transformation supports the following conditions.

Syntax Description
prefix("<dimension>","<expected prefix>") Matches if the value of the specified dimension starts with the expected prefix.
eq("<dimension>","<expected value>") Matches if the value of the specified dimension equals the expected value.
ne("<dimension>","<value to be excluded>") The reverse of the eq condition. The dimension with the specified name is excluded from the response.
in("<dimension>",entitySelector("<selector>") Matches if the value of the specified dimension equals any of the expected values provided by the entity selector.

Quotes (") and tildes (~) that are part of the entity selector syntax must be escaped with a tilde (~).
remainder() The response contains only the remainder dimension.
remainder("<dimension>") Matches if the specified dimension is part of the remainder.
series(<aggregation>,<operator>,<reference value>) The response contains only series with data points matching the provided criterion.

Series condition

The series condition filters resulting series by the provided criterion. The specified aggregation is applied (for example, for max aggregation the highest value is taken and for sum aggregation all values of the series are summed up) then the result is compared to the reference value with the specified operator. The aggregation is used only for filtering, it doesn't affect data points.

The condition supports the following aggregations and operators.

Available aggregations
  • min
  • max
  • avg
  • sum
  • median
  • percentile(N), with N in the 0 to 100 range.
Available operators
  • lt: lower than
  • le: lower than or equal to
  • eq: equal
  • ne: not equal
  • gt: greater than
  • ge: greater than or equal to

Condition combinations

Each condition can be a combination of subconditions.

Syntax Description
and(<subcondition1>,<subcondition2>,<subconditionN>) All subconditions must be fulfilled.
or(<subcondition1>,<subcondition2>,<subconditionN>) At least one subcondition must be fulfilled.
not(<subcondition>) Reverses the subcondition. For example, it turns contains into does not contain.

Syntax examples

:filter(or(eq("dt.entity.host","HOST-0990886B7D39FE29"),eq("dt.entity.host","HOST-0956C3557E9109C1")))

Filters data points to those delivered by either HOST-0990886B7D39FE29 or HOST-0956C3557E9109C1.

:filter(and(prefix("App Version","2."),ne("dt.entity.os","OS-472A4A3B41095B09")))

Filters data points to those delivered by an application of major version 2 that is not run on the OS-472A4A3B41095B09 operating system.

Fold transformation

Syntax :fold
Arguments None

The fold transformation aggregates a data points list into an aggregated data point.

Names transformation

Syntax :names
Limitations Applies only to dimensions of the entity type.

The names transformation adds the name of the dimension value to the dimensions array and dimensionMap object of the response. The name of each dimension is placed before the ID of the dimension.

Parents transformation

Syntax :parents
Limitations Applies only to dimensions of the entity type listed below.

The parents transformation adds the parent of the dimension to the dimensions array and dimensionMap object of the response. The parent of each dimension is placed before the dimension itself.

This transformation works only if the dimension entity is part of another, bigger entity. For example, PROCESS_GROUP_INSTANCE is always the child of the HOST it runs on. The following relationships are supported.

Child dimension Parent dimension
SERVICE_METHOD SERVICE
SERVICE_INSTANCE SERVICE
APPLICATION_METHOD APPLICATION
PROCESS_GROUP_INSTANCE HOST
DISK HOST
NETWORK_INTERFACE HOST
SYNTHETIC_TEST_STEP SYNTHETIC_TEST
HTTP_CHECK_STEP HTTP_CHECK
EXTERNAL_SYNTHETIC_TEST_STEP EXTERNAL_SYNTHETIC_TEST

Merge transformation

Syntax :merge("<dimension0>","<dimension1>","<dimensionN>")
Arguments A list of dimensions to be removed. A dimension must be specified by its key.

The merge transformation removes the specified dimensions from the result. All series/values that have the same dimensions after the removal are merged into one. The values are recalculated according to the selected aggregation.

You can apply any aggregation to the result of the merge transformation, including those that the original metric doesn't support.

Split by transformation

Syntax :splitBy("<dimension0>","<dimension1>","<dimensionN>")
Arguments A list of dimensions to be preserved in the result. A dimension must be specified by its key.

The split by transformation keeps the specified dimensions in the result and merges all remaining dimensions. The values are recalculated according to the selected aggregation.

You can apply any aggregation to the result of the split by transformation, including those that the original metric doesn't support.

Rate transformation

Syntax

:rate(5m)

Arguments

The base of the rate. The following values are supported:

m: per minute
h: per hour
d: per day
w: per week
M: per month
y: per year

The rate transformation converts a count-based metric (for example, bytes) into a rate-based metric (for example, bytes per minute).

Any argument can be modified by an integer factor. For example, 5m means per 5 minutes rate. If no argument is specified, the per 1 minute rate is used.

You can use the rate transformation with any metric that supports the VALUE aggregation. Query a metric with the GET metric descriptors call to obtain information about available aggregations. If the metric doesn't support the VALUE aggregation, apply the aggregation transformation first and then the rate transformation.

You can use rate transformation only once in a single transformation chain.

Time shift transformation

Syntax

:timeshift(5m)

Arguments

The period of the shift. The following values are supported:

m: minutes
h: hours
d: days
w: weeks
M: months
y: years

The time shift transformation shifts the timeframe specified by the from and to query parameters and maps the resulting data points to timestamps from the original timeframe. It can help you hand data from different time zones or put yesterday's and today's data on the same chart for visual comparison.

A positive argument shifts the timeframe into the future; a negative argument shifts the timeframe into the past.

You can use this transformation to handle data from different time zones

Let's consider an example with a timeframe from 1615550400000 (March 12, 2021 13:00 CET) to 1615557600000 (March 12, 2021 15:00 CET) and a time shift of -1d (one day into the past).

  1. The data points will be queried for the timeframe from 1615464000000 (March 11, 2021 13:00 CET) to 1615471200000 (March 11, 2021 15:00 CET).
  2. Timestamps in the response will be aligned to the original timeframe. For example, the data point with a timestamp of 1615465800000 (March 11, 2021 13:30 CET) will be returned as 1615552200000 (March 12, 2021 13:30 CET).

Sort transformation

Syntax :sort(<sorting key 1>,<sorting key 2>)
Arguments One or several sorting keys.

The sort transformation specifies the order of tuples (unique combinations of metric—dimension—dimension value) in the response. You can specify one or several sorting criteria. The first criterion is used for sorting. Further criteria are used for tie-breaking. You can choose the direction of the sort:

  • ascending
  • descending

Dimension sorting

To sort results by the value of a dimension, use the dimension("<dimension>",<direction>) key.

Entity dimensions are sorted lexicographically (0..9a..z) by Dynatrace entity ID values.

String dimensions are sorted lexicographically.

Data points sorting

To sort results by metric data points in a dimension, use the value(<aggregation>,<direction>) key.

The following aggregations are available:

  • min
  • max
  • avg
  • sum
  • median
  • percentile(N), with N in the 0 to 100 range.

The aggregation is used only for sorting and doesn't affect the returned data points.

The sorting is applied to the resulting data points of the whole transformation chain before the sort transformation. If the transformation chain doesn't have an aggregation transformation, the sorting is applied to the default aggregation of the metric.

Limit transformation

Syntax :limit(3)
Arguments The maximum number of tuples in the result.

The limit transformation limits the number of tuples (unique combinations of metric—dimension—dimension value) in the response. Only the first X tuples are included in the response; the rest are discarded.

To ensure that the required tuples are at the top of the result, apply the sort transformation before using the limit.

Last transformation

Syntax :last
:lastReal

The last transformation returns the most recent data point from the query timeframe.

If the metric before transformation contains multiple tuples (unique combinations of metric—dimension—dimension value), the most recent timestamp is applied for all tuples. To obtain the actual last timestamp, use the lastReal operator.

Default transformation

Syntax :default(0)
Arguments The value to replace null values in the result.

The default transformation replaces null values in the payload with the specified value.

Combining transformations

You can combine any number of transformations as long as the total length of the selector string is within the limit (see Limitations section). The selector string is evaluated from left to right. Each successive transformation is applied to the result of the previous transformation.

For example, consider builtin:apps.other.apdex.osAndGeo, which includes geolocations. We may know the name of the desired geolocation (for example, Austria) but not the ID of the geolocation. We want to use this name for filtering. This can be achieved by combining the :names and :filter transformations:

builtin:apps.other.apdex.geo:names:filter(eq(dt.entity.geolocation.name,Austria))

Remainder dimension

Dynatrace keeps only the top X dimension tuples (the exact number depends on the metric, aggregation, timeframe, and other factors). All other dimension tuples are aggregated into one, called the remainder dimension.

If the query result includes this dimension, the dimensions and dimensionMap value will be null. However, if the dimensionMap does not contain an entry at all, then this is not the remainder dimension, but rather a literal null value.