Graph-based query composition for monitoring an environment
In some embodiments, a data platform receives information associated with activities within a network environment, generates a logical graph based on the information, stores data representative of the logical graph in a database, receives, in response to a user interaction with an interface of the data platform, a request to filter the information, in response to the request generates a query using a graph-based schema, and performs the generated query against the database.
1. A method, comprising:
receiving, at a data platform, information associated with activities within a network environment;
generating a logical graph based on the information;
storing data representative of the logical graph in a database;
receiving, in response to a user interaction with an interface of the data platform, a request to filter the information;
in response to receiving the request, generating a query using a graph-based schema, wherein generating the query comprises constructing a join graph comprising a list of join links and wherein a join link maintains a reverse map of filter keys and entities; and
performing the generated query against the database.
2. The method of claim 1 , wherein the user interaction is with a representation of at least a portion of the logical graph in the interface, the logical graph comprising a plurality of nodes interconnected by a plurality of edges, the plurality of nodes and the plurality of edges representative of the activities within the network environment.
3. The method of claim 1 , wherein the user interaction is with a query field of the interface.
4. The method of claim 1 , wherein the request is associated with target information useable to generate or update a visualization of at least a portion of the logical graph in the interface, the logical graph comprising a plurality of nodes interconnected by a plurality of edges, the plurality of nodes and the plurality of edges representative of the activities within the network environment.
5. The method of claim 1 , wherein generating the query comprises discovering join relations via a filter key specification.
6. The method of claim 1 , wherein generating the query is based on a join defining a group of filter keys of a same key type.
7. The method of claim 6 , wherein instances of the same type of filter key are formed as an implicit join group.
8. The method of claim 6 , wherein a same instance of a filter key can participate in different implicit join groups.
9. The method of claim 1 , wherein generating the query is based on a join performed across at least one of event queries, network queries, or configuration queries.
10. The method of claim 1 , wherein a join link represents an implicit join group by a same filter key type.
11. The method of claim 1 , wherein generating the query further comprises traversing paths along the join graph.
12. The method of claim 1 , wherein the join graph manifests relationships of the filter keys among the entities.
13. The method of claim 1 , wherein generating the query further comprises generating an SQL query string using a query building library.
14. The method of claim 1 , wherein generating the query further comprises translating the user interaction with the interface into one or more filters and using the one or more filters to generate the query.
15. A computer program product embodied in a non-transitory computer readable storage medium and comprising computer instructions for:
receiving, at a data platform, information associated with activities within a network environment;
generating a logical graph based on the information;
storing data representative of the logical graph in a database;
receiving, in response to a user interaction with an interface of the data platform, a request to filter the information;
in response to the request, generating a query using a graph-based schema, wherein generating the query comprises constructing a join graph comprising a list of join links and wherein a join link maintains a reverse map of filter keys and entities; and
performing the generated query against the database.
16. The computer program product of claim 15 , wherein generating the query further comprises generating an SQL query string using a query building library.
17. The computer program product of claim 15 , wherein each join link is representative of an implicit join group by a same filter key type.
18. The computer program product of claim 15 , wherein the join graph manifests relationships of the filter keys among the entities.
19. The computer program product of claim 15 , wherein generating the query comprises discovering join relations via a filter key specification.
20. A system, comprising:
a processor; and
a memory coupled to the processor and configured to provide the processor with instructions to:
receive, at a data platform, information associated with activities within a network environment;
generate a logical graph based on the information;
store data representative of the logical graph in a database;
receive, in response to a user interaction with an interface of the data platform, a request to filter the information;
in response to the request, generate a query using a graph-based schema, wherein generating the query comprises constructing a join graph comprising a list of join links and wherein a join link maintains a reverse map of filter keys and entities; and
perform the generated query against the database.