Hi There, I was trying to create monitors based on...
# support
a
Hi There, I was trying to create monitors based on logs, few observations 1. My signoz version is 14 but still distributed_logs table is not being used, all the data is being pushed in logs 2. Was trying to write query based on container name and namespace to create alerts, not able to do it. Can you please help
Any idea on how to write clickhouse queries on resources_string_value
p
@Apoorva can you share what results you wanted to get from your query and current clickhouse queries which are not giving results as expected
When you say
distributed logs table is not being used
what do you mean? do you mean that it doesn't have actual rows/data?
a
do you mean that it doesn't have actual rows/data? (edited)
Yes, look at the stats
Screen Shot 2023-01-14 at 5.21.11 PM.png
Screen Shot 2023-01-14 at 5.31.37 PM.png
a
@Apoorva distributed view in clickhouse does not retail data. The data is supposed to be in shards only. Distributed tables do the splitting of queries and aggregation of results
Tables with Distributed engine do not store any data of their own, but allow distributed query processing on multiple servers. Reading is automatically parallelized. During a read, the table indexes on remote servers are used, if there are any.
https://clickhouse.com/docs/en/engines/table-engines/special/distributed/
you should query
distributed_logs
table to fetch data from all shards
a
@Ankit Nayan Thanks for the detailed explanation, really helpful 🙏