topic Re: makeTimeseries from DQL to chart EC2 instances used by Kubernetes in DQL

makeTimeseries from DQL to chart EC2 instances used by Kubernetes

roberto_camp1 — Fri, 24 May 2024 09:30:48 GMT

I have the following DQL query that I would like visualize as a simple bar or donut chart, to display the ec2 instance types of the worker nodes in my EKS cluster at any give time.

We have multiple EKS clusters in several different development and production accounts and tracking ec2 instance type might be of value to us.

I am having difficulty mapping the query to the makeTimeseries command.

Can anyone suggest a nice way to achieve this?

```
fetch dt.entity.kubernetes_node
| filter in(id, classicEntitySelector("type(KUBERNETES_NODE),toRelationship.isClusterOfNode(type(KUBERNETES_CLUSTER),entityName.equals(operations-1))"))
| fields entity.name
| lookup [fetch dt.entity.ec2_instance | fields localHostName, awsInstanceType],lookupField:localHostName,sourceField:entity.name

// | makeTimeseries count()
| makeTimeseries count(default: 0), interval: 30m

```

I keep getting the error: "Please specify the parameter `time` explicitly, as the implicit default `timestamp` doesn't exist."

Re: makeTimeseries from DQL to chart EC2 instances used by Kubernetes

krzysztof_hoja — Fri, 24 May 2024 20:31:09 GMT

In this case case there is no need to (and in fact you cannot) use makeTimeseries
Time dimension does not exist in result of fetch <entity> query. To count occurrences of particular field summarize is enough:

fetch dt.entity.kubernetes_node //| filter in(id, classicEntitySelector("type(KUBERNETES_NODE),toRelationship.isClusterOfNode(type(KUBERNETES_CLUSTER),entityName.equals(operations-1))")) | fields entity.name | lookup [ fetch dt.entity.ec2_instance | fields localHostName, awsInstanceType ], lookupField:localHostName, sourceField:entity.name | summarize {cnt=count()}, by: {lookup.awsInstanceType} | fieldsAdd lookup.awsInstanceType = coalesce(lookup.awsInstanceType, "Unknown") | sort cnt desc

note: I commented out filer for cluster name. I do not have such name in my environment. Result looks like:

Re: makeTimeseries from DQL to chart EC2 instances used by Kubernetes

roberto_camp1 — Sun, 26 May 2024 16:21:56 GMT

Thank you @krzysztof_hoja that works very well!