Creating a Query for Flows

Select Query > Flows to perform rich and complex SQL-like queries on flows in the Contrail Controller. You can use the query results for such things as gaining insight into the operation of applications in a virtual network, performing historical analysis of flow issues, and pinpointing problem areas with flows.

Query Flow Series Table

Select Query > Flows > Series to create queries of the flow series table. The results are in the form of time series data for flow series. See Figure 1.

Figure 1: Query Flow Series Window

The query fields available on the screen for the Series tab are described in Table 1. Enter query data into the fields to create a SQL-like query to display and analyze flows.

Table 1: Query Flow Series Fields
Field	Description
Time Range	Select a range of time to display the flow series: Last 10 Mins Last 30 Mins Last 1 Hr Last 6 Hrs Last 12 Hrs Custom Click Custom to enter a specific custom time range in two fields: Start Time and End Time.
Select Terms	Click the edit button (pencil icon) to open a Select Terms window (Figure 2), where you can click one or more fields to display from the flow series, such as Virtual Router, Source VN, Destination VN, SUM(bytes), SUM(packets), and more.
Direction	Select the desired flow direction: Ingress or Egress.
Where	Click the +Add to open a query-writing window, where you can specify query values for variables such as destvn, protocol, sourcevn, and vrouter.
Filter	Click the edit button (pencil icon) to open a Filters window (Figure 1), where you can select filter items to sort by, the sort order, and limits to the number of results returned.
Time Granularity	When Time Granularity is selected, you have the option to view results in graph or flowchart form. Graph buttons appear on the screen above the Export button. Click a graph button to transform the tabular results into a graphical chart display.
Unit	Select minutes or seconds for unit of measurement.
Run	Click Run to retrieve the flows that match the query you created. The flows are listed on the lower portion of the screen in a box with columns identifying the selected fields for each flow.
Export	The Export button is displayed after you click Run. This allows you to export the list of flows to a text `.csv` file.

The Select Terms window allows you to select one or more attributes of a flow series by clicking each attribute desired. See Figure 2. Select SUM(Bytes) or SUM(Packets) to aggregate bytes and packets in intervals.

Figure 2: Flow Series Select Terms

Use the Filters window to refine the display of query results for flows, by defining an attribute by which to sort the results, the sort order of the results, and any limit needed to restrict the number of results. See Figure 3.

Figure 3: Flows Series Filter

Query Individual Flow Records

Select Query > Flow > Records to create queries of individual flow records for detailed debugging of connectivity issues between applications and virtual machines. Queries at this level return records of the active flows within a given time period.

Figure 4: Flows Records

The query fields available on the screen for the Records tab are described in Table 2. Enter query data into the fields to create an SQL-like query to display and analyze flows.

Table 2: Query Flow Records Fields
Field	Description
Time Range	Select a range of time for the flow records: Last 10 Mins Last 30 Mins Last 1 Hr Last 6 Hrs Last 12 Hrs Custom Click Custom to enter a specified custom time range in two fields: Start Time and End Time.
Select Terms	Click the edit button (pencil icon) to open a Select Terms window (Figure 4), where you can click one or more attributes to display for the flow records, including vrouter, sourcevn, sourceip, destvn, destip, protocol, dport, and action.
Direction	Select the desired flow direction: Ingress or Egress.
Where	Click +Add to open a query window where you can specify query values for destvn, protocol, sourcevn, and vrouter.
Run	Click Run to retrieve the flow records that match the query you created. The records are listed on the lower portion of the screen in a box with columns identifying the fields for each flow.
Export	The Export button is displayed after you click Run, allowing you to export the list of flows to a text .csv file.

The Select Terms window allows you to select one or more attributes to display for the flow records selected. See Figure 5.

Figure 5: Flows Records Select Terms

Using the Query Window

The query window is available by clicking the +Add in the Where field. Use the query window to enter query statements. See Figure 5.

You can restrict the query to a particular source VN and destination VN combination using the Select section.

The Where supports logical AND and logical OR operations, and is modeled as a logical OR of multiple AND terms. For example: ( (term1 AND term2 AND term3..) OR (term4 AND term5) OR…).

Each term is a single variable expression such as sourcevn = vn1.

See Table 3 for descriptions of the fields in the query window.

Table 3: Query Window Fields and Descriptions
Item	Description
—	Select from a list of available item types the type from which to query. destvn protocol sourcevn vrouter
(operator)	=(equal to) and Starts with are available.
AND +	Click the +Add to add more elements to your query. Repeat to include additional query elements to your query statement.
Apply	Click to enter the query into the fields on the main screen.

The Where clause supports logical AND and logical OR operations.

The Where can be modeled as logical OR of multiple AND terms. ( (term1 AND term2 AND term3..) OR (term4 AND term5) OR…).

Each term is a single variable expression such as Source VN = VN1.

Display Flows Query Queue

Select Query > Flows > Query Queue to display queries that are in the queue waiting to be performed on the data.

The query fields available on the screen for the Records tab are described in Table 4. Enter query data into the fields to create an SQL-like query to display and analyze flows.

Table 4: Query Flow Records Fields
Field	Description
Date	The date and time the query was started.
Query	A display of the parameters set for the query.
Progress	The percentage completion of the query to date.
Records	The number of records matching the query to date.
Status	The status of the query, such as completed.
Time Taken	The amount of time in seconds it has taken the query to return the matching records.
(Action icon)	Click the Action icon and select View Results to view a list of the records that match the query, or click Delete to remove the query from the queue.

ON THIS PAGE

Creating a Query for Flows

Query Flow Series Table

Query Individual Flow Records

Using the Query Window

Display Flows Query Queue

Related Documentation