diff --git a/content/en/ddsql_reference/_index.md b/content/en/ddsql_reference/_index.md index 791d2b87f88a9..40f49b7ef4c94 100644 --- a/content/en/ddsql_reference/_index.md +++ b/content/en/ddsql_reference/_index.md @@ -33,6 +33,7 @@ This documentation covers the SQL support available and includes: - [SQL functions](#functions) - [Window functions](#window-functions) - [JSON functions](#json-functions-and-operators) +- [Table functions](#table-functions) - [Tags](#tags) @@ -453,6 +454,77 @@ This table provides an overview of the supprted window functions. For comprehens | json_extract_path_text(text json, text path…) | text | Extracts a JSON sub-object as text, defined by the path. Its behavior is equivalent to the [Postgres function with the same name][3]. For example, `json_extract_path_text(col, ‘forest')` returns the value of the key `forest` for each JSON object in `col`. See the example below for a JSON array syntax.| | json_extract_path(text json, text path…) | JSON | Same functionality as `json_extract_path_text`, but returns a column of JSON type instead of text type.| +## Table functions + +{{< callout url="https://www.datadoghq.com/product-preview/logs-metrics-support-in-ddsql-editor/" >}} +Querying Logs and Metrics through DDSQL is in Preview. Use this form to request access. +{{< /callout >}} + +Table functions are used to query Logs and Metrics + + + + + + + + + + + + + + + + + + + + + +
FunctionDescriptionExample
+
+dd.logs(
+    filter => varchar,
+    columns => array < varchar >,
+    indexes ? => array < varchar >,
+    from_timestamp ? => timestamp,
+    to_timestamp ? => timestamp
+) AS (column_name type [, ...])
+
Returns log data as a table. The columns parameter specifies which log fields to extract, and the AS clause defines the schema of the returned table. Optional: filtering by index or time range. When time is not specified, we default to the past 1 hour of data. + {{< code-block lang="sql" >}} +SELECT timestamp, host, service, message +FROM dd.logs( + filter => 'source:java', + columns => ARRAY['timestamp','host', 'service','message'] +) AS ( + timestamp TIMESTAMP, + host VARCHAR, + service VARCHAR, + message VARCHAR +){{< /code-block >}} +
+
+dd.metric_scalar(
+    query varchar,
+    reducer varchar [, from_timestamp timestamp, to_timestamp timestamp]
+)
+
Returns metric data as a scalar value. The function accepts a metrics query (with optional grouping), a reducer to determine how values are aggregated (avg, max, etc.), and optional timestamp parameters (default 1 hour) to define the time range. + {{< code-block lang="sql" >}} +SELECT * +FROM dd.metric_scalar( + 'avg:system.cpu.user{*} by {service}', + 'avg', + TIMESTAMP '2025-07-10 00:00:00.000-04:00', + TIMESTAMP '2025-07-17 00:00:00.000-04:00' +) +ORDER BY value DESC;{{< /code-block >}} +
+ + + + + ## Tags DDSQL exposes tags as an `hstore` type, which you can query using the PostgreSQL arrow operator. For example: