Query Examples

Run these queries in the Logs section of the Kloudfuse UI. Audit queries start from @audit_log="true". Performance queries start from @perf_log="true" and @msg="Finished API", which selects one line per completed API call. See Audit Log Fields and Performance Log Fields for the fields.

Audit Log Examples

Count events by action
@audit_log="true" | count by (@action)
fuseql
Count events by user and action
@audit_log="true" | count by (@user_email, @action)
fuseql
Everything one user did, by action and resource type
@audit_log="true" and @user_email="alice@example.com" | count by (@action, @resource_type)
fuseql
Changes by resource type
@audit_log="true" | count by (@resource_type, @action)
fuseql
Successful versus failed operations
@audit_log="true" | count by (@status_1, @action)
fuseql
Authorization failures by user and denying service
@audit_log="true" and @action="authorization_failure" | count by (@user_email, source)
fuseql
Logins by user and source IP
@audit_log="true" and @action="logged in" | count by (@user_email, @session_ip)
fuseql
Group membership changes
@audit_log="true" and (@action="add_user_to_group" or @action="remove_user_from_group") | count by (@user_email, @resource_name, @action)
fuseql
Service account tokens issued and revoked
@audit_log="true" and @resource_type="service_account" and (@action="create_token" or @action="delete_token") | count by (@user_email, @resource_name, @action)
fuseql
MCP client registrations, logins, and token refreshes
@audit_log="true" and (@action="mcp.register" or @action="mcp.login" or @action="mcp.token.code_grant" or @action="mcp.token.refresh") | count by (@action, @resource_name)
fuseql
Top users changing alert rules
@audit_log="true" and @resource_type="AlertRule" | count by (@action, @user_email) | sort by _count desc | limit 5
fuseql

Performance Log Examples

Top callers by query volume
@perf_log="true" and @msg="Finished API" | count by (@User) | sort by _count desc | limit 5
fuseql
Query volume by service
@perf_log="true" and @msg="Finished API" | count by (source)
fuseql
Top APIs by query volume
@perf_log="true" and @msg="Finished API" | count by (source, @api_name) | sort by _count desc | limit 5
fuseql
Average latency by caller
@perf_log="true" and @msg="Finished API" | avg(@duration_ms) by (@User)
fuseql
Calls slower than 5 seconds, by service and API
@perf_log="true" and @msg="Finished API" and @duration_ms > 5000 | count by (source, @api_name)
fuseql
p95 latency by service
@perf_log="true" and @msg="Finished API" | p95(@duration_ms) by (source)
fuseql
Failed calls by error type and component
@perf_log="true" and @msg="Finished API" and @is_error="true" | count by (source, @error_type, @error_component)
fuseql
Query volume by origin
@perf_log="true" and @msg="Finished API" | count by (source, @ViewName) | sort by _count desc | limit 8
fuseql
Alert rules with the most evaluation time
@perf_log="true" and @msg="Finished API" and @ViewName="alert" | sum(@duration_ms) as total_ms, avg(@duration_ms) as avg_ms by (@AlertName) | sort by total_ms desc | limit 5
fuseql
Slowest dashboard panels
@perf_log="true" and @msg="Finished API" and @ViewName="dashboard" | avg(@duration_ms) as avg_ms, count by (@DashboardName, @PanelName) | sort by avg_ms desc | limit 5
fuseql
Query volume per hour, by service
@perf_log="true" and @msg="Finished API" | timeslice 1h | count by (_timeslice, source)
fuseql
Every log line for one request
@kf_request_id="3e165960-624c-4ad5-9a35-ab21439da6ec"
fuseql