Support for NRQL functions in gateway rules

This document outlines the NRQL functions supported in Pipeline Control gateway rules. Use these functions to create more powerful and precise rules for filtering and managing your data.

Function	Description	Example NRQL query
`aparse()`	Extracts a value from a string based on a specified pattern.	`DELETE FROM Log WHERE aparse(message, 'Error: %') = 'timeout'`
`dimensions()`	Filters data based on facets or dimensions associated with your metrics/events.	`DELETE FROM Log WHERE dimensions() LIKE '%collectd%'`
`floor()`	Returns the largest integer less than or equal to the specified number.	`DELETE FROM Metric WHERE floor(duration) > 5`
`getField()`	Extracts a specific field from a complex data structure (for example, JSON object).	`DELETE FROM Metric WHERE getField(cpu_usage, percent) > 90`
`hourOf()`	Extracts the hour component from a timestamp.	`DELETE FROM Log WHERE hourOf(timestamp) IN (2, 3, 4)`
`mod()`	Returns the remainder of a division operation.	`DELETE FROM Log WHERE mod(timestamp/1000,20) != 1`
`numeric()`	Converts a string value to a numerical type.	`DELETE FROM Log WHERE numeric(responseTime) > 1000`
`round()`	Rounds a number to the nearest integer or to a specified number of decimals.	`DELETE FROM Metric WHERE round(latency, 2) > 0.5`
`string()`	Converts a numerical or other value to a string type.	`DELETE FROM Log WHERE string(statusCode) = '404'`
`substring()`	Extracts a specified portion of a string.	`DELETE FROM Log WHERE substring(transactionId, 1, 3) = 'tmp'`
`weekdayOf()`	Extracts the day of the week from a timestamp (for example, 'Monday', 'Sunday').	`DELETE FROM Metric WHERE weekdayOf(timestamp) IN ('Saturday', 'Sunday')`

Examples of multiple NRQL functions in gateway rules

These examples demonstrate how you can combine multiple functions and use them in more intricate scenarios to achieve precise data filtering and deletion.

This rule deletes data for containers that have exited, but preserves records for containers that have exited within the last 10 minutes:

DELETE FROM ContainerSample WHERE state = 'exited' AND status LIKE '%Exited%' AND NOT (status LIKE '%second%' AND numeric(aparse(status,'%Exited (%) * seconds ago%')) < 10) AND NOT (status LIKE '%About a minute ago%' OR status LIKE '%minute%' AND numeric(aparse(status,'%Exited (%) * minutes ago%')) < 10)

This rule deletes logs that are associated with a specific log pattern (collectd) and are not custom event types:

DELETE FROM Log, LogExtendedRecord WHERE dimensions() LIKE '%collectd%' AND newrelic.logs.customEventType IS NULL

This rule deletes a specific type of error log, but samples them by keeping only records where the timestamp is a multiple of 101:

DELETE FROM Log WHERE message LIKE '%lib/ladon/middleware/caching.rb:49 run> terminated with exception%' AND floor(timestamp/101) = (timestamp/101) AND newrelic.logs.customEventType IS NULL

These new functions significantly expand the capabilities of your NRQL queries when working with Pipeline Control gateway, allowing for more precise data analysis and management.

Support for NRQL functions in gateway rules

Examples of multiple NRQL functions in gateway rules.css-21sua1{background:none;border:none;width:0;padding:0;}

Examples of multiple NRQL functions in gateway rules