Joining Grail metrics with BizEvents metadata in a single DQL table

achoud22 — Tue, 28 Apr 2026 13:09:32 GMT

I’m working on a use case where all proxy metadata is ingested as BizEvents and displayed in a table. In addition, I’ve defined a derived variable ProxyStatus that toggles between Active and Inactive depending on the request count over the last 30 days.

The challenge is that the request count comes from Grail metrics, while the proxy metadata comes from BizEvents. I’d like to add filtering in the table so that I can switch between active and inactive proxies, but this requires combining both sources.

My question:

Is there a way in DQL to join metrics from Grail with BizEvents metadata into a single query result?
If so, what’s the recommended approach — e.g., using lookup(), join(), or some other operator to correlate metric time series with event attributes?
Are there constraints around joining across Grail metrics and BizEvents that I should be aware of (performance, schema alignment, etc.)?

Any examples or best practices for combining these two data sources into one table view would be very helpful.

Re: Joining Grail metrics with BizEvents metadata in a single DQL table

MaximilianoML — Wed, 29 Apr 2026 20:56:13 GMT

Hello @achoud22,

Yes, you can combine BizEvents and Grail metrics in one DQL result. I would start from the proxy metadata BizEvents, reduce them to one row per proxy, then use a lookup or leftOuter join against a timeseries subquery that calculates the request count for the last 30 days. The important part is to make the metric side return one scalar value per proxy, not a raw timeseries array. Then you can derive ProxyStatus directly in the same query and use it as a dashboard/table filter.

In most cases I’d use lookup for this because you are enriching metadata with one calculated metric value. Use join only if you need more complex matching behavior. Just make sure both sides share a stable key and that the lookup/join side is deduplicated to avoid unexpected results.

You can try something like this too:

fetch bizevents | filter event.type == "proxy.metadata" | sort timestamp desc | dedup proxy_id | fields proxy_id, proxy_name, proxy_owner, proxy_environment, proxy_url | join [ timeseries request_count_30d = sum(dt.service.request.count, scalar: true), by: { proxy_id }, from: -30d | fields proxy_id, request_count_30d ], kind: leftOuter, on: { left[proxy_id] == right[proxy_id] }, fields: { request_count_30d } | fieldsAdd request_count_30d = coalesce( request_count_30d, 0), ProxyStatus = if(request_count_30d > 0, "Active", else: "Inactive")

I hope it helps you 😃

topic Joining Grail metrics with BizEvents metadata in a single DQL table in DQL

Joining Grail metrics with BizEvents metadata in a single DQL table

Re: Joining Grail metrics with BizEvents metadata in a single DQL table