log-queries/queryPackCore.json at main · logicmonitor/log-queries · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
[
    {
        "label": "Bad Anomalies",
        "duration": "24hour",
        "query": "_anomaly.type=\"never_before_seen\" and (\"error\" or \"fail\" or \"critical\" or \"fatal\" or \"terminate\" or \"kill\" or \"exception\" or \"timeout\")",
        "UseCase": "",
        "commentGroup": "Anomaly",
        "commentQueryType": "Basic"
    },
    {
        "label": "Good Anomalies",
        "duration": "24hour",
        "query": "_anomaly.type=\"never_before_seen\" and (\"success\" or \"complete\" or \"finish\")",
        "UseCase": "",
        "commentGroup": "Anomaly",
        "commentQueryType": "Basic"
    },
    {
        "label": "Bad Keywords",
        "duration": "24hour",
        "query": "(\"error\" or \"fail\" or \"critical\" or \"fatal\" or \"terminate\" or \"kill\" or \"exception\" or \"timeout\")",
        "UseCase": "",
        "commentGroup": "Error Conditions",
        "commentQueryType": "Basic"
    },
    {
        "label": "Resources Sending Logs by Resource Name",
        "duration": "24hour",
        "query": "* | count by _resource.name | sort by _count desc",
        "UseCase": "",
        "commentGroup": "Volume/Usage",
        "commentQueryType": "Aggregate"
    },
    {
        "label": "Total Number of Resources Sending Logs",
        "duration": "24hour",
        "query": "* | count by _resource.name | count",
        "UseCase": "",
        "commentGroup": "Volume/Usage",
        "commentQueryType": "Aggregate"
    },
    {
        "label": "Top 25 Resources by Volume",
        "duration": "24hour",
        "query": "* | count(_size), sum(_size) by _resource.name | sort by _sum desc | limit 25",
        "UseCase": "",
        "commentGroup": "Volume/Usage",
        "commentQueryType": "Aggregate"
    },
    {
        "label": "Top 25 Resource Groups by Volume",
        "duration": "24hour",
        "query": " * | count(_size), sum(_size) by _resource.group | sort by _sum desc | limit 25",
        "UseCase": "",
        "commentGroup": "Volume/Usage",
        "commentQueryType": "Aggregate"
    },
    {
        "label": "Total Volume by Resource Name as GB and average, min, max size per message",
        "duration": "24hour",
        "query": "* | count(_size), sum(_size), max(_size), min(_size) by _resource.name | num(_sum/1000000000) as GB | num(_sum/_count) as avg_size | sort by GB desc",
        "UseCase": "",
        "commentGroup": "Volume/Usage",
        "commentQueryType": "Aggregate"
    },
    {
        "label": "Events Per Sec over 7 Day Time Span by Resource Name as GB and average message size",
        "duration": "7days",
        "query": "* | count(_size), sum(_size) by _resource.name | num(_sum/1000000000) as GB | num(_sum/_count) as avg_size | num(_count/604800) as EPS | sort by EPS desc",
        "UseCase": "",
        "commentGroup": "Volume/Usage",
        "commentQueryType": "Aggregate"
    },
    {
        "label": "Daily Usage in 24 Hour Buckets",
        "duration": "7days",
        "query": "* | bucket(span=24h) | sum (_size) as size_in_bytes by_bucket | num(size_in_bytes/1000000000) as GB | sort by _bucket asc",
        "UseCase": "",
        "commentGroup": "Volume/Usage",
        "commentQueryType": "Aggregate"
    },
    {
        "label": "Top 10 Reoccuring Messages",
        "duration": "24hour",
        "query": "* | count by _message | sort by _count desc | limit 10",
        "UseCase": "",
        "commentGroup": "Volume/Usage",
        "commentQueryType": "Aggregate"
    },
    {
        "label": "Deviceless/Unmapped Logs",
        "duration": "24hour",
        "query": "_resource.id=\"0\"",
        "UseCase": "",
        "commentGroup": "Deviceless Logs",
        "commentQueryType": "Basic"
    },
    {
        "label": "Deviceless Logs Parsed Hostname if a Hostname is the First Value After Timestamp",
        "duration": "24hour",
        "query": "_resource.id=\"0\" | parse /[0-9]{2}:[0-9]{2}:[0-9]{2} (\\S+)/ as unmap_host | count by unmap_host | sort by _count desc",
        "UseCase": "",
        "commentGroup": "Deviceless Logs",
        "commentQueryType": "Aggregate"
    },
    {
        "label": "Login Failures",
        "duration": "24hour",
        "query": "(login or logon) and (fail or mismatch)| count by _resource.name | sort by _count desc",
        "UseCase": "",
        "commentGroup": "Logins",
        "commentQueryType": "Aggregate"
    }
]