query-log-explorer.json

{
  "format": "altinity-sql-browser/saved-queries",
  "version": 2,
  "exportedAt": "2026-07-15T00:00:00.000Z",
  "queries": [
    {
      "id": "qle-filter",
      "sql": "SELECT\n  arraySort(item -> item.label, groupUniqArray((user AS value, splitByChar('@', user)[1] AS label))) AS user,\n  arraySort(groupUniqArray(query_kind)) AS query_kind\nFROM system.query_log WHERE query_log.user != ''\nSETTINGS enable_named_columns_in_function_tuple = 1",
      "specVersion": 1,
      "spec": {
        "name": "Filter",
        "favorite": true,
        "description": "Single Dashboard Filter source. `user` is a value/label bundle (Array(Tuple(value, label)) — #160): the value is the full user that binds to a Panel's {user:String}, the label is the name before '@' for display. `query_kind` is a plain Array(String). Upgrades any Panel's {user:String} and {query_kind:String} parameters to searchable single-select dropdowns.",
        "dashboard": {
          "role": "filter"
        }
      }
    },
    {
      "id": "qle-kpi",
      "sql": "SELECT\n  count() AS total_queries,\n  countIf(exception_code != 0) AS errors,\n  round(100 * countIf(exception_code != 0) / count(), 2) AS error_rate_pct,\n  round(avg(query_duration_ms), 1) AS avg_duration_ms,\n  round(quantile(0.99)(query_duration_ms), 1) AS p99_duration_ms,\n  uniqExact(user) AS active_users\nFROM system.query_log\nWHERE type IN ('QueryFinish', 'ExceptionWhileProcessing') AND query_kind = 'Select'\n  AND event_time >= {from:DateTime}\n/*[ AND event_time <= {to:DateTime} ]*/\n/*[ AND positionCaseInsensitive(query, {search:String}) > 0 ]*/",
      "specVersion": 1,
      "spec": {
        "name": "Query log health (KPI)",
        "favorite": true,
        "description": "Top-line SELECT-query health for this cluster: volume, error rate, and latency. The time window is a real DateTime range shared by every data Panel: {from:DateTime} is REQUIRED (a Panel stays unfilled until you pick a start), {to:DateTime} is optional (blank means \"up to now\"). Both render as relative-time fields — type an absolute timestamp or a relative expression like -24h / -7d / now. The optional {search:String} field substring-matches the query text across every Panel too.",
        "view": "panel",
        "panel": {
          "cfg": {
            "type": "kpi"
          },
          "fieldConfig": {
            "columns": {
              "total_queries": {
                "displayName": "SELECT queries"
              },
              "errors": {
                "displayName": "Errors"
              },
              "error_rate_pct": {
                "displayName": "Error rate",
                "unit": "%",
                "decimals": 2
              },
              "avg_duration_ms": {
                "displayName": "Avg duration",
                "unit": " ms",
                "decimals": 1
              },
              "p99_duration_ms": {
                "displayName": "P99 duration",
                "unit": " ms",
                "decimals": 1
              },
              "active_users": {
                "displayName": "Active users"
              }
            }
          }
        }
      }
    },
    {
      "id": "qle-text",
      "sql": "",
      "specVersion": 1,
      "spec": {
        "name": "About this demo",
        "favorite": true,
        "description": "Static Text panel explaining the dashboard.",
        "view": "panel",
        "panel": {
          "cfg": {
            "type": "text",
            "content": "# Dashboard Filter sources demo\n\nEvery favorite below is a Panel, except one **Filter**-role source (#160) that populates the filter bar above with `user` and `query_kind` option lists queried live from `system.query_log` on the **otel** demo cluster.\n\n**Shared filters** — plain, type-detected controls (no Filter source), declared by the data Panels:\n\n- `from` — **required** window start (`DateTime`); type an absolute time or a relative expression like `-24h`, `-7d`, `now`\n- `to` — optional window end (`DateTime`); blank means \"up to now\"\n- `search` — optional case-insensitive substring search over the query text (and, in the log panel, the exception message)\n- `minDurationMs` — optional minimum query-duration threshold, in ms (slowest-queries panel)\n\n**Curated filters** — sourced from the single favorited **Filter** query, upgrading matching Panel parameters to searchable dropdowns:\n\n- `user` — real ClickHouse users seen in the query log\n- `query_kind` — the query kinds seen in the query log (Select, Insert, …)\n\nAnalytical panels are adapted from the Altinity KB page [\"Handy queries for system.query_log\"](https://kb.altinity.com/altinity-kb-useful-queries/query_log/)."
          }
        }
      }
    },
    {
      "id": "qle-slowest",
      "sql": "SELECT\n  event_time,\n  user,\n  round(query_duration_ms) AS duration_ms,\n  formatReadableSize(memory_usage) AS memory,\n  read_rows,\n  substring(query, 1, 100) AS query_preview\nFROM system.query_log\nWHERE type = 'QueryFinish' AND query_kind = 'Select'\n  AND event_time >= {from:DateTime}\n/*[ AND event_time <= {to:DateTime} ]*/\n/*[ AND user = {user:String} ]*/\n/*[ AND query_duration_ms >= {minDurationMs:UInt32} ]*/\n/*[ AND positionCaseInsensitive(query, {search:String}) > 0 ]*/\nORDER BY query_duration_ms DESC\nLIMIT 50",
      "specVersion": 1,
      "spec": {
        "name": "Slowest SELECT queries",
        "favorite": true,
        "description": "Adapted from the Altinity KB's \"Most resource-intensive queries\" — the highest-latency completed SELECTs, with duration/memory/rows-read to spot what's actually expensive. Demonstrates the shared time range ({from:DateTime} required, {to:DateTime} optional), the CURATED {user:String} dropdown (from the Filter source), the AUTO {minDurationMs:UInt32} numeric threshold, and the universal {search:String} query-text search.",
        "view": "panel",
        "panel": {
          "cfg": {
            "type": "table"
          }
        }
      }
    },
    {
      "id": "qle-columns",
      "sql": "SELECT arrayJoin(columns) AS column, count() AS hits\nFROM system.query_log\nWHERE type = 'QueryFinish'\n  AND event_time >= {from:DateTime}\n  AND notEmpty(columns)\n/*[ AND event_time <= {to:DateTime} ]*/\n/*[ AND query_kind = {query_kind:String} ]*/\n/*[ AND positionCaseInsensitive(query, {search:String}) > 0 ]*/\nGROUP BY column\nORDER BY hits DESC\nLIMIT 20",
      "specVersion": 1,
      "spec": {
        "name": "Most-selected columns",
        "favorite": true,
        "description": "Adapted from the Altinity KB's \"Most-selected columns\" — which columns have been referenced most often. Demonstrates the CURATED {query_kind:String} dropdown (from the Filter source) alongside the shared time range ({from:DateTime} required, {to:DateTime} optional) and the universal {search:String} search.",
        "view": "panel",
        "panel": {
          "cfg": {
            "type": "hbar",
            "x": 0,
            "y": [
              1
            ],
            "series": null
          }
        }
      }
    },
    {
      "id": "qle-functions",
      "sql": "SELECT arrayJoin(used_functions) AS function, count() AS hits\nFROM system.query_log\nWHERE type = 'QueryFinish'\n  AND event_time >= {from:DateTime}\n  AND notEmpty(used_functions)\n/*[ AND event_time <= {to:DateTime} ]*/\n/*[ AND positionCaseInsensitive(query, {search:String}) > 0 ]*/\nGROUP BY function\nORDER BY hits DESC\nLIMIT 20",
      "specVersion": 1,
      "spec": {
        "name": "Most-used functions",
        "favorite": true,
        "description": "Adapted from the Altinity KB's \"Most-used functions\" — which SQL functions appear most often across executed queries. Uses the shared time range ({from:DateTime} required, {to:DateTime} optional) and the universal {search:String} query-text search, the same fields every other Panel declares.",
        "view": "panel",
        "panel": {
          "cfg": {
            "type": "hbar",
            "x": 0,
            "y": [
              1
            ],
            "series": null
          }
        }
      }
    },
    {
      "id": "qle-logs",
      "sql": "SELECT\n  event_time,\n  multiIf(exception_code != 0, 'error', query_duration_ms > 1000, 'warn', 'info') AS level,\n  if(exception_code != 0, exception, query) AS message,\n  user,\n  query_kind,\n  query_duration_ms,\n  formatReadableSize(memory_usage) AS memory\nFROM system.query_log\nWHERE type IN ('QueryFinish', 'ExceptionWhileProcessing')\n  AND query_kind NOT IN ('Insert', 'AsyncInsertFlush')\n  AND event_time >= {from:DateTime}\n/*[ AND event_time <= {to:DateTime} ]*/\n/*[ AND user = {user:String} ]*/\n/*[ AND (positionCaseInsensitive(query, {search:String}) > 0 OR positionCaseInsensitive(exception, {search:String}) > 0) ]*/\nORDER BY event_time DESC\nLIMIT 300",
      "specVersion": 1,
      "spec": {
        "name": "Recent query activity (log)",
        "favorite": true,
        "description": "Raw query_log rows as a Logs view, level-colored by outcome (error/slow/info) and excluding the noisy internal Insert/AsyncInsertFlush firehose so the feed reads as actual query activity. Uses the shared time range ({from:DateTime} required, {to:DateTime} optional), the CURATED {user:String} dropdown (from the Filter source), and the universal {search:String} search — which here matches both the query text and the exception message.",
        "view": "panel",
        "panel": {
          "cfg": {
            "type": "logs",
            "time": "event_time",
            "msg": "message",
            "level": "level"
          }
        }
      }
    }
  ]
}