Timeseries Widget

The timeseries visualization allows you to display the evolution of one or more metrics, log events, or Indexed Spans over time. The time window depends on what is selected on the timeboard or screenboard:

A timeseries widget showing the average system.cpu.user for a host

Setup

Configuration

Timeseries setup

  1. Choose the data to graph:

  2. Customize your graph with the available options.

Display options

Graphs can be displayed as lines, areas, and bars. Line graphs contain additional parameters:

ParameterOptions
StyleSolid, dashed, or dotted
StrokeNormal, thin, or thick

Color

For all graph types, Datadog offers various color options to differentiate multiple metrics displayed on the same graph:

PaletteDescription
ClassicThe simple colors light blue, dark blue, light purple, purple, light yellow, and yellow (colors repeat).
ConsistentUsing a set of 16 colors, applies a consistent color for each series of data across all widgets for each tag group.

For line graphs, different metrics can be assigned specific palettes by separating the queries in JSON. For more information, see the guide for Selecting the right colors for your graphs.

Sorting

Order the graph by Tags or by Values to sort timeseries legends and stacked graphs. This only sorts the graph visualization, and does not impact the query. Toggle the Reverse option to sort by reverse alphabetical order or by descending values.

Metric aliasing

Each query or formula, along with any filtering tags, can be aliased. The alias overrides the display on the graph and legend, which is useful for long metric names or long lists of filters. At the end of your query or formula, click on as… and enter your metric alias:

Adding an alias to a search query in the Timeseries widget editor

Event overlay

The event overlay supports all data sources. This allows for easier correlation between business events and data from any Datadog service.

With the event overlay, you can see how actions within the organization impact application and infrastructure performance. Here are some example use cases:

  • RUM error rates with deployment events overlaid
  • Correlating CPU usage with events related to provisioning extra servers
  • Correlating egress traffic with suspicious login activity
  • Correlating any timeseries data with monitor alerts to ensure that Datadog has been configured with the appropriate alerts
Timeseries widgets showing RUM error rates with deployment events overlaid

You can add events from related systems to add more context to your graph, such as GitHub commits, Jenkins deploys, and Docker creation events. Click Add Event Overlay in the Event Overlays section and enter a query to display those events.

Use the same query format as for the Event Explorer, for example:

QueryDescription
sources:jenkinsShows all events from the Jenkins source.
tag:role:webShows all events with the role:web tag.
tags:$<TEMPLATE_VARIABLE>Shows all events from the selected template variable.

Markers

To add markers for additional data sets, click Add Marker in the Markers section.

  1. Select a Line or Range and input a value or a range or values.
  2. In the Show as field, select an alerting status/color and choose from a solid, bold, or dashed horizontal line.
  3. To add a label that displays on the bottom left of the timeseries widget, define a value for the Y-Axis and click the Label checkbox.

Y-Axis controls

Y-axis controls are available in the UI and in the JSON editor. You can set the value and type of the y-axis to:

  • Clip the y-axis to specific ranges.
  • Automatically change y-axis bounds based on an absolute value threshold. This threshold can be applied to one or both ends of the graph (lower and upper) to remove the “outlier” series.
  • Change the y-axis scale from linear to log, pow, or sqrt.

The following configuration options are available:

OptionRequiredDescription
MinNoSpecify the minimum value to show on the y-axis. It takes a number or Auto as the default value.
MaxNoSpecify the maximum value to show on the y-axis. It takes a number or Auto as the default value.
ScaleNoSpecifies the scale type. Possible values include:
- linear: A linear scale (default).
- log: A logarithmic scale.
- pow: A Power of 2 scale (2 is default, modify in JSON).
- sqrt: A square root scale.
Always include zeroNoAlways include zero or fit the y-axis to the data range. The default is to always include zero.

Because the mathematical log function does not accept negative values, the Datadog log scale only works if values are of the same sign (everything > 0 or everything < 0). Otherwise, an empty graph is returned.

Legend configuration

You can add configurable legends to your screenboards by selecting from the following options in the Legend section:

  • Automatic (default)
  • Compact
  • Expanded: Configurable columns for value, avg, sum, min, and max
  • None

For timeboards, legends display automatically when a dashboard is set to L or XL.

To add a context link in the dropdown menu that appears when you click in a dashboard widget, click Add a Context Link in the Context Links section.

For more information about editing and deleting context links, see Context Links.

Full screen

In addition to the standard full screen options, you can apply quick functions, compare to previous time periods, adjust the Y scale, save changes, or save as a new graph.

For more information, see Explore your data in full-screen graph mode.

API

This widget can be used with the Dashboards API. See the following table for the widget JSON schema definition:

Expand All

Field

Type

Description

custom_links

[object]

List of custom links.

is_hidden

boolean

The flag for toggling context menu link visibility.

label

string

The label for the custom link URL. Keep the label short and descriptive. Use metrics and tags as variables.

link

string

The URL of the custom link. URL must include http or https. A relative URL must start with /.

override_label

string

The label ID that refers to a context menu link. Can be logs, hosts, traces, profiles, processes, containers, or rum.

events

[object]

List of widget events.

q [required]

string

Query definition.

tags_execution

string

The execution method for multi-value filters.

legend_columns

[string]

Columns displayed in the legend.

legend_layout

enum

Layout of the legend. Allowed enum values: auto,horizontal,vertical

legend_size

string

Available legend sizes for a widget. Should be one of "0", "2", "4", "8", "16", or "auto".

markers

[object]

List of markers.

display_type

string

Combination of:

  • A severity error, warning, ok, or info
  • A line type: dashed, solid, or bold In this case of a Distribution widget, this can be set to be x_axis_percentile.

label

string

Label to display over the marker.

time

string

Timestamp for the widget.

value [required]

string

Value to apply. Can be a single value y = 15 or a range of values 0 < y < 10.

requests [required]

[object]

List of timeseries widget requests.

apm_query

object

The log query.

compute

object

Define computation for a log query.

aggregation [required]

string

The aggregation method.

facet

string

Facet name.

interval

int64

Define a time interval in seconds.

group_by

[object]

List of tag prefixes to group by in the case of a cluster check.

facet [required]

string

Facet name.

limit

int64

Maximum number of items in the group.

sort

object

Define a sorting method.

aggregation [required]

string

The aggregation method.

facet

string

Facet name.

order [required]

enum

Widget sorting methods. Allowed enum values: asc,desc

index

string

A coma separated-list of index names. Use "*" query all indexes at once. Multiple Indexes

multi_compute

[object]

This field is mutually exclusive with compute.

aggregation [required]

string

The aggregation method.

facet

string

Facet name.

interval

int64

Define a time interval in seconds.

search

object

The query being made on the logs.

query [required]

string

Search value to apply.

audit_query

object

The log query.

compute

object

Define computation for a log query.

aggregation [required]

string

The aggregation method.

facet

string

Facet name.

interval

int64

Define a time interval in seconds.

group_by

[object]

List of tag prefixes to group by in the case of a cluster check.

facet [required]

string

Facet name.

limit

int64

Maximum number of items in the group.

sort

object

Define a sorting method.

aggregation [required]

string

The aggregation method.

facet

string

Facet name.

order [required]

enum

Widget sorting methods. Allowed enum values: asc,desc

index

string

A coma separated-list of index names. Use "*" query all indexes at once. Multiple Indexes

multi_compute

[object]

This field is mutually exclusive with compute.

aggregation [required]

string

The aggregation method.

facet

string

Facet name.

interval

int64

Define a time interval in seconds.

search

object

The query being made on the logs.

query [required]

string

Search value to apply.

display_type

enum

Type of display to use for the request. Allowed enum values: area,bars,line,overlay

event_query

object

The log query.

compute

object

Define computation for a log query.

aggregation [required]

string

The aggregation method.

facet

string

Facet name.

interval

int64

Define a time interval in seconds.

group_by

[object]

List of tag prefixes to group by in the case of a cluster check.

facet [required]

string

Facet name.

limit

int64

Maximum number of items in the group.

sort

object

Define a sorting method.

aggregation [required]

string

The aggregation method.

facet

string

Facet name.

order [required]

enum

Widget sorting methods. Allowed enum values: asc,desc

index

string

A coma separated-list of index names. Use "*" query all indexes at once. Multiple Indexes

multi_compute

[object]

This field is mutually exclusive with compute.

aggregation [required]

string

The aggregation method.

facet

string

Facet name.

interval

int64

Define a time interval in seconds.

search

object

The query being made on the logs.

query [required]

string

Search value to apply.

formulas

[object]

List of formulas that operate on queries.

alias

string

Expression alias.

cell_display_mode

enum

Define a display mode for the table cell. Allowed enum values: number,bar

conditional_formats

[object]

List of conditional formats.

comparator [required]

enum

Comparator to apply. Allowed enum values: =,>,>=,<,<=

custom_bg_color

string

Color palette to apply to the background, same values available as palette.

custom_fg_color

string

Color palette to apply to the foreground, same values available as palette.

hide_value

boolean

True hides values.

image_url

string

Displays an image as the background.

metric

string

Metric from the request to correlate this conditional format with.

palette [required]

enum

Color palette to apply. Allowed enum values: blue,custom_bg,custom_image,custom_text,gray_on_white,grey,green,orange,red,red_on_white,white_on_gray,white_on_green,green_on_white,white_on_red,white_on_yellow,yellow_on_white,black_on_light_yellow,black_on_light_green,black_on_light_red

timeframe

string

Defines the displayed timeframe.

value [required]

double

Value for the comparator.

formula [required]

string

String expression built from queries, formulas, and functions.

limit

object

Options for limiting results returned.

count

int64

Number of results to return.

order

enum

Direction of sort. Allowed enum values: asc,desc

default: desc

style

object

Styling options for widget formulas.

palette

string

The color palette used to display the formula. A guide to the available color palettes can be found at https://docs.datadoghq.com/dashboards/guide/widget_colors

palette_index

int64

Index specifying which color to use within the palette.

log_query

object

The log query.

compute

object

Define computation for a log query.

aggregation [required]

string

The aggregation method.

facet

string

Facet name.

interval

int64

Define a time interval in seconds.

group_by

[object]

List of tag prefixes to group by in the case of a cluster check.

facet [required]

string

Facet name.

limit

int64

Maximum number of items in the group.

sort

object

Define a sorting method.

aggregation [required]

string

The aggregation method.

facet

string

Facet name.

order [required]

enum

Widget sorting methods. Allowed enum values: asc,desc

index

string

A coma separated-list of index names. Use "*" query all indexes at once. Multiple Indexes

multi_compute

[object]

This field is mutually exclusive with compute.

aggregation [required]

string

The aggregation method.

facet

string

Facet name.

interval

int64

Define a time interval in seconds.

search

object

The query being made on the logs.

query [required]

string

Search value to apply.

metadata

[object]

Used to define expression aliases.

alias_name

string

Expression alias.

expression [required]

string

Expression name.

network_query

object

The log query.

compute

object

Define computation for a log query.

aggregation [required]

string

The aggregation method.

facet

string

Facet name.

interval

int64

Define a time interval in seconds.

group_by

[object]

List of tag prefixes to group by in the case of a cluster check.

facet [required]

string

Facet name.

limit

int64

Maximum number of items in the group.

sort

object

Define a sorting method.

aggregation [required]

string

The aggregation method.

facet

string

Facet name.

order [required]

enum

Widget sorting methods. Allowed enum values: asc,desc

index

string

A coma separated-list of index names. Use "*" query all indexes at once. Multiple Indexes

multi_compute

[object]

This field is mutually exclusive with compute.

aggregation [required]

string

The aggregation method.

facet

string

Facet name.

interval

int64

Define a time interval in seconds.

search

object

The query being made on the logs.

query [required]

string

Search value to apply.

on_right_yaxis

boolean

Whether or not to display a second y-axis on the right.

process_query

object

The process query to use in the widget.

filter_by

[string]

List of processes.

limit

int64

Max number of items in the filter list.

metric [required]

string

Your chosen metric.

search_by

string

Your chosen search term.

profile_metrics_query

object

The log query.

compute

object

Define computation for a log query.

aggregation [required]

string

The aggregation method.

facet

string

Facet name.

interval

int64

Define a time interval in seconds.

group_by

[object]

List of tag prefixes to group by in the case of a cluster check.

facet [required]

string

Facet name.

limit

int64

Maximum number of items in the group.

sort

object

Define a sorting method.

aggregation [required]

string

The aggregation method.

facet

string

Facet name.

order [required]

enum

Widget sorting methods. Allowed enum values: asc,desc

index

string

A coma separated-list of index names. Use "*" query all indexes at once. Multiple Indexes

multi_compute

[object]

This field is mutually exclusive with compute.

aggregation [required]

string

The aggregation method.

facet

string

Facet name.

interval

int64

Define a time interval in seconds.

search

object

The query being made on the logs.

query [required]

string

Search value to apply.

q

string

Widget query.

queries

[ <oneOf>]

List of queries that can be returned directly or used in formulas.

Option 1

object

A formula and functions metrics query.

aggregator

enum

The aggregation methods available for metrics queries. Allowed enum values: avg,min,max,sum,last,area,l2norm,percentile

cross_org_uuids

[string]

The source organization UUID for cross organization queries. Feature in Private Beta.

data_source [required]

enum

Data source for metrics queries. Allowed enum values: metrics

name [required]

string

Name of the query for use in formulas.

query [required]

string

Metrics query definition.

Option 2

object

A formula and functions events query.

compute [required]

object

Compute options.

aggregation [required]

enum

Aggregation methods for event platform queries. Allowed enum values: count,cardinality,median,pc75,pc90,pc95,pc98,pc99,sum,min,max,avg

interval

int64

A time interval in milliseconds.

metric

string

Measurable attribute to compute.

cross_org_uuids

[string]

The source organization UUID for cross organization queries. Feature in Private Beta.

data_source [required]

enum

Data source for event platform-based queries. Allowed enum values: logs,spans,network,rum,security_signals,profiles,audit,events,ci_tests,ci_pipelines,incident_analytics

group_by

[object]

Group by options.

facet [required]

string

Event facet.

limit

int64

Number of groups to return.

sort

object

Options for sorting group by results.

aggregation [required]

enum

Aggregation methods for event platform queries. Allowed enum values: count,cardinality,median,pc75,pc90,pc95,pc98,pc99,sum,min,max,avg

metric

string

Metric used for sorting group by results.

order

enum

Direction of sort. Allowed enum values: asc,desc

default: desc

indexes

[string]

An array of index names to query in the stream. Omit or use [] to query all indexes at once.

name [required]

string

Name of the query for use in formulas.

search

object

Search options.

query [required]

string

Events search string.

storage

string

Option for storage location. Feature in Private Beta.

Option 3

object

Process query using formulas and functions.

aggregator

enum

The aggregation methods available for metrics queries. Allowed enum values: avg,min,max,sum,last,area,l2norm,percentile

cross_org_uuids

[string]

The source organization UUID for cross organization queries. Feature in Private Beta.

data_source [required]

enum

Data sources that rely on the process backend. Allowed enum values: process,container

is_normalized_cpu

boolean

Whether to normalize the CPU percentages.

limit

int64

Number of hits to return.

metric [required]

string

Process metric name.

name [required]

string

Name of query for use in formulas.

sort

enum

Direction of sort. Allowed enum values: asc,desc

default: desc

tag_filters

[string]

An array of tags to filter by.

text_filter

string

Text to use as filter.

Option 4

object

A formula and functions APM dependency stats query.

cross_org_uuids

[string]

The source organization UUID for cross organization queries. Feature in Private Beta.

data_source [required]

enum

Data source for APM dependency stats queries. Allowed enum values: apm_dependency_stats

env [required]

string

APM environment.

is_upstream

boolean

Determines whether stats for upstream or downstream dependencies should be queried.

name [required]

string

Name of query to use in formulas.

operation_name [required]

string

Name of operation on service.

primary_tag_name

string

The name of the second primary tag used within APM; required when primary_tag_value is specified. See https://docs.datadoghq.com/tracing/guide/setting_primary_tags_to_scope/#add-a-second-primary-tag-in-datadog.

primary_tag_value

string

Filter APM data by the second primary tag. primary_tag_name must also be specified.

resource_name [required]

string

APM resource.

service [required]

string

APM service.

stat [required]

enum

APM statistic. Allowed enum values: avg_duration,avg_root_duration,avg_spans_per_trace,error_rate,pct_exec_time,pct_of_traces,total_traces_count

Option 5

object

APM resource stats query using formulas and functions.

cross_org_uuids

[string]

The source organization UUID for cross organization queries. Feature in Private Beta.

data_source [required]

enum

Data source for APM resource stats queries. Allowed enum values: apm_resource_stats

env [required]

string

APM environment.

group_by

[string]

Array of fields to group results by.

name [required]

string

Name of this query to use in formulas.

operation_name

string

Name of operation on service.

primary_tag_name

string

Name of the second primary tag used within APM. Required when primary_tag_value is specified. See https://docs.datadoghq.com/tracing/guide/setting_primary_tags_to_scope/#add-a-second-primary-tag-in-datadog

primary_tag_value

string

Value of the second primary tag by which to filter APM data. primary_tag_name must also be specified.

resource_name

string

APM resource name.

service [required]

string

APM service name.

stat [required]

enum

APM resource stat name. Allowed enum values: errors,error_rate,hits,latency_avg,latency_distribution,latency_max,latency_p50,latency_p75,latency_p90,latency_p95,latency_p99

Option 6

object

A formula and functions metrics query.

additional_query_filters

string

Additional filters applied to the SLO query.

cross_org_uuids

[string]

The source organization UUID for cross organization queries. Feature in Private Beta.

data_source [required]

enum

Data source for SLO measures queries. Allowed enum values: slo

group_mode

enum

Group mode to query measures. Allowed enum values: overall,components

measure [required]

enum

SLO measures queries. Allowed enum values: good_events,bad_events,slo_status,error_budget_remaining,burn_rate,error_budget_burndown

name

string

Name of the query for use in formulas.

slo_id [required]

string

ID of an SLO to query measures.

slo_query_type

enum

Name of the query for use in formulas. Allowed enum values: metric,time_slice

Option 7

object

A formula and functions Cloud Cost query.

aggregator

enum

Aggregator used for the request. Allowed enum values: avg,last,max,min,sum,percentile

cross_org_uuids

[string]

The source organization UUID for cross organization queries. Feature in Private Beta.

data_source [required]

enum

Data source for Cloud Cost queries. Allowed enum values: cloud_cost

name [required]

string

Name of the query for use in formulas.

query [required]

string

Query for Cloud Cost data.

response_format

enum

Timeseries, scalar, or event list response. Event list response formats are supported by Geomap widgets. Allowed enum values: timeseries,scalar,event_list

rum_query

object

The log query.

compute

object

Define computation for a log query.

aggregation [required]

string

The aggregation method.

facet

string

Facet name.

interval

int64

Define a time interval in seconds.

group_by

[object]

List of tag prefixes to group by in the case of a cluster check.

facet [required]

string

Facet name.

limit

int64

Maximum number of items in the group.

sort

object

Define a sorting method.

aggregation [required]

string

The aggregation method.

facet

string

Facet name.

order [required]

enum

Widget sorting methods. Allowed enum values: asc,desc

index

string

A coma separated-list of index names. Use "*" query all indexes at once. Multiple Indexes

multi_compute

[object]

This field is mutually exclusive with compute.

aggregation [required]

string

The aggregation method.

facet

string

Facet name.

interval

int64

Define a time interval in seconds.

search

object

The query being made on the logs.

query [required]

string

Search value to apply.

security_query

object

The log query.

compute

object

Define computation for a log query.

aggregation [required]

string

The aggregation method.

facet

string

Facet name.

interval

int64

Define a time interval in seconds.

group_by

[object]

List of tag prefixes to group by in the case of a cluster check.

facet [required]

string

Facet name.

limit

int64

Maximum number of items in the group.

sort

object

Define a sorting method.

aggregation [required]

string

The aggregation method.

facet

string

Facet name.

order [required]

enum

Widget sorting methods. Allowed enum values: asc,desc

index

string

A coma separated-list of index names. Use "*" query all indexes at once. Multiple Indexes

multi_compute

[object]

This field is mutually exclusive with compute.

aggregation [required]

string

The aggregation method.

facet

string

Facet name.

interval

int64

Define a time interval in seconds.

search

object

The query being made on the logs.

query [required]

string

Search value to apply.

style

object

Define request widget style.

line_type

enum

Type of lines displayed. Allowed enum values: dashed,dotted,solid

line_width

enum

Width of line displayed. Allowed enum values: normal,thick,thin

palette

string

Color palette to apply to the widget.

right_yaxis

object

Axis controls for the widget.

include_zero

boolean

Set to true to include zero.

label

string

The label of the axis to display on the graph. Only usable on Scatterplot Widgets.

max

string

Specifies maximum numeric value to show on the axis. Defaults to auto.

default: auto

min

string

Specifies minimum numeric value to show on the axis. Defaults to auto.

default: auto

scale

string

Specifies the scale type. Possible values are linear, log, sqrt, and pow## (for example pow2 or pow0.5).

default: linear

show_legend

boolean

(screenboard only) Show the legend for this widget.

time

object

Time setting for the widget.

live_span

enum

The available timeframes depend on the widget you are using. Allowed enum values: 1m,5m,10m,15m,30m,1h,4h,1d,2d,1w,1mo,3mo,6mo,week_to_date,month_to_date,1y,alert

title

string

Title of your widget.

title_align

enum

How to align the text on the widget. Allowed enum values: center,left,right

title_size

string

Size of the title.

type [required]

enum

Type of the timeseries widget. Allowed enum values: timeseries

default: timeseries

yaxis

object

Axis controls for the widget.

include_zero

boolean

Set to true to include zero.

label

string

The label of the axis to display on the graph. Only usable on Scatterplot Widgets.

max

string

Specifies maximum numeric value to show on the axis. Defaults to auto.

default: auto

min

string

Specifies minimum numeric value to show on the axis. Defaults to auto.

default: auto

scale

string

Specifies the scale type. Possible values are linear, log, sqrt, and pow## (for example pow2 or pow0.5).

default: linear

{
  "custom_links": [
    {
      "is_hidden": false,
      "label": "Search logs for {{host}}",
      "link": "https://app.datadoghq.com/logs?query={{host}}",
      "override_label": "logs"
    }
  ],
  "events": [
    {
      "q": "",
      "tags_execution": "string"
    }
  ],
  "legend_columns": [],
  "legend_layout": "string",
  "legend_size": "string",
  "markers": [
    {
      "display_type": "error dashed",
      "label": "Error threshold",
      "time": "string",
      "value": "y = 15"
    }
  ],
  "requests": [
    {
      "apm_query": {
        "compute": {
          "aggregation": "avg",
          "facet": "@duration",
          "interval": 5000
        },
        "group_by": [
          {
            "facet": "resource_name",
            "limit": 50,
            "sort": {
              "aggregation": "avg",
              "facet": "@string_query.interval",
              "order": "desc"
            }
          }
        ],
        "index": "days-3,days-7",
        "multi_compute": [
          {
            "aggregation": "avg",
            "facet": "@duration",
            "interval": 5000
          }
        ],
        "search": {
          "query": ""
        }
      },
      "audit_query": {
        "compute": {
          "aggregation": "avg",
          "facet": "@duration",
          "interval": 5000
        },
        "group_by": [
          {
            "facet": "resource_name",
            "limit": 50,
            "sort": {
              "aggregation": "avg",
              "facet": "@string_query.interval",
              "order": "desc"
            }
          }
        ],
        "index": "days-3,days-7",
        "multi_compute": [
          {
            "aggregation": "avg",
            "facet": "@duration",
            "interval": 5000
          }
        ],
        "search": {
          "query": ""
        }
      },
      "display_type": "string",
      "event_query": {
        "compute": {
          "aggregation": "avg",
          "facet": "@duration",
          "interval": 5000
        },
        "group_by": [
          {
            "facet": "resource_name",
            "limit": 50,
            "sort": {
              "aggregation": "avg",
              "facet": "@string_query.interval",
              "order": "desc"
            }
          }
        ],
        "index": "days-3,days-7",
        "multi_compute": [
          {
            "aggregation": "avg",
            "facet": "@duration",
            "interval": 5000
          }
        ],
        "search": {
          "query": ""
        }
      },
      "formulas": [
        {
          "alias": "string",
          "cell_display_mode": "number",
          "conditional_formats": [
            {
              "comparator": ">",
              "custom_bg_color": "string",
              "custom_fg_color": "string",
              "hide_value": false,
              "image_url": "string",
              "metric": "string",
              "palette": "blue",
              "timeframe": "string",
              "value": 0
            }
          ],
          "formula": "func(a) + b",
          "limit": {
            "count": "integer",
            "order": "string"
          },
          "style": {
            "palette": "classic",
            "palette_index": 1
          }
        }
      ],
      "log_query": {
        "compute": {
          "aggregation": "avg",
          "facet": "@duration",
          "interval": 5000
        },
        "group_by": [
          {
            "facet": "resource_name",
            "limit": 50,
            "sort": {
              "aggregation": "avg",
              "facet": "@string_query.interval",
              "order": "desc"
            }
          }
        ],
        "index": "days-3,days-7",
        "multi_compute": [
          {
            "aggregation": "avg",
            "facet": "@duration",
            "interval": 5000
          }
        ],
        "search": {
          "query": ""
        }
      },
      "metadata": [
        {
          "alias_name": "string",
          "expression": ""
        }
      ],
      "network_query": {
        "compute": {
          "aggregation": "avg",
          "facet": "@duration",
          "interval": 5000
        },
        "group_by": [
          {
            "facet": "resource_name",
            "limit": 50,
            "sort": {
              "aggregation": "avg",
              "facet": "@string_query.interval",
              "order": "desc"
            }
          }
        ],
        "index": "days-3,days-7",
        "multi_compute": [
          {
            "aggregation": "avg",
            "facet": "@duration",
            "interval": 5000
          }
        ],
        "search": {
          "query": ""
        }
      },
      "on_right_yaxis": false,
      "process_query": {
        "filter_by": [],
        "limit": "integer",
        "metric": "system.load.1",
        "search_by": "string"
      },
      "profile_metrics_query": {
        "compute": {
          "aggregation": "avg",
          "facet": "@duration",
          "interval": 5000
        },
        "group_by": [
          {
            "facet": "resource_name",
            "limit": 50,
            "sort": {
              "aggregation": "avg",
              "facet": "@string_query.interval",
              "order": "desc"
            }
          }
        ],
        "index": "days-3,days-7",
        "multi_compute": [
          {
            "aggregation": "avg",
            "facet": "@duration",
            "interval": 5000
          }
        ],
        "search": {
          "query": ""
        }
      },
      "q": "string",
      "queries": [],
      "response_format": "timeseries",
      "rum_query": {
        "compute": {
          "aggregation": "avg",
          "facet": "@duration",
          "interval": 5000
        },
        "group_by": [
          {
            "facet": "resource_name",
            "limit": 50,
            "sort": {
              "aggregation": "avg",
              "facet": "@string_query.interval",
              "order": "desc"
            }
          }
        ],
        "index": "days-3,days-7",
        "multi_compute": [
          {
            "aggregation": "avg",
            "facet": "@duration",
            "interval": 5000
          }
        ],
        "search": {
          "query": ""
        }
      },
      "security_query": {
        "compute": {
          "aggregation": "avg",
          "facet": "@duration",
          "interval": 5000
        },
        "group_by": [
          {
            "facet": "resource_name",
            "limit": 50,
            "sort": {
              "aggregation": "avg",
              "facet": "@string_query.interval",
              "order": "desc"
            }
          }
        ],
        "index": "days-3,days-7",
        "multi_compute": [
          {
            "aggregation": "avg",
            "facet": "@duration",
            "interval": 5000
          }
        ],
        "search": {
          "query": ""
        }
      },
      "style": {
        "line_type": "string",
        "line_width": "string",
        "palette": "string"
      }
    }
  ],
  "right_yaxis": {
    "include_zero": false,
    "label": "string",
    "max": "string",
    "min": "string",
    "scale": "string"
  },
  "show_legend": false,
  "time": {
    "live_span": "5m"
  },
  "title": "string",
  "title_align": "string",
  "title_size": "string",
  "type": "timeseries",
  "yaxis": {
    "include_zero": false,
    "label": "string",
    "max": "string",
    "min": "string",
    "scale": "string"
  }
}

Further Reading

Additional helpful documentation, links, and articles:

Explore your data in full-screen graph modeBLOG more more Building Dashboards using JSONDOCUMENTATION more more Graph historical SLO data on DashboardsGUIDE more more