Method: dashboardQueries.execute

Full name: projects.locations.instances.dashboardQueries.execute

Execute a query and return the data.

HTTP request


Path parameters

Parameters
parent

string

Required. The parent, under which to run this dashboardQuery. Format: projects/{project}/locations/{region}/instances/{instance}

Request body

The request body contains data with the following structure:

JSON representation 
{
  "query": {
    object (DashboardQuery)
  },
  "filters": [
    {
      object (DashboardFilter)
    }
  ],
  "clearCache": boolean,
  "usePreviousTimeRange": boolean
}
Fields
query

object (DashboardQuery)

Required. The query to execute and get results back for. QueryID or 'query', 'input.time_window' fields will be used. Use 'nativeDashboard' and 'dashboardChart' fields if it is an in-dashboard query.
filters[]

object (DashboardFilter)

Optional. Dashboard level filters other than query string.
clearCache

boolean

Optional. When true, the backend would read from the database, rather than fetching data directly from the cache.
usePreviousTimeRange

boolean

Optional. When true, the backend will execute the query against the previous time range of the query.

Response body

Response message for executing a dashboard query.

If successful, the response body contains data with the following structure:

JSON representation 
{
  "results": [
    {
      object (ColumnData)
    }
  ],
  "dataSources": [
    enum (DataSource)
  ],
  "lastBackendCacheRefreshedTime": string,
  "timeWindow": {
    object (Interval)
  },
  "queryRuntimeErrors": [
    {
      object (QueryRuntimeError)
    }
  ]
}
Fields
results[]

object (ColumnData)

Result rows that are queried.
dataSources[]

enum (DataSource)

Datasource of the query and results.
lastBackendCacheRefreshedTime

string (Timestamp format)

Optional. Last time the cache was refreshed. This would be used by the UI to show the last updated time.

Uses RFC 3339, where generated output will always be Z-normalized and uses 0, 3, 6 or 9 fractional digits. Offsets other than "Z" are also accepted. Examples: "2014-10-02T15:01:23Z", "2014-10-02T15:01:23.045123456Z" or "2014-10-02T15:01:23+05:30".
timeWindow

object (Interval)

Time window against which query was executed.
queryRuntimeErrors[]

object (QueryRuntimeError)

Runtime errors

Authorization scopes

Requires the following OAuth scope:

  • https://www.googleapis.com/auth/cloud-platform

For more information, see the Authentication Overview.

IAM Permissions

Requires the following IAM permission on the parent resource:

  • chronicle.dashboardQueries.execute

For more information, see the IAM documentation.

ColumnData

JSON representation 
{
  "column": string,
  "values": [
    {
      object (ColumnType)
    }
  ],
  "metadata": {
    object (ColumnMetadata)
  }
}
Fields
column

string

Used to store column names.
values[]

object (ColumnType)

To store column data.
metadata

object (ColumnMetadata)

To store column metadata.

ColumnType

Singular vs list of values in a column.

JSON representation 
{

  // Union field type can be only one of the following:
  "value": {
    object (ColumnValue)
  },
  "list": {
    object (List)
  }
  // End of list of possible types for union field type.
}
Fields

Union field type.

type can be only one of the following:
value

object (ColumnValue)

Single value in a column.
list

object (List)

List of values in a column e.g. IPs

ColumnValue

LINT.IfChange(stats_data) Value of the column based on data type.

JSON representation 
{
  "metadata": {
    object (ValueMetadata)
  },

  // Union field value can be only one of the following:
  "nullVal": boolean,
  "boolVal": boolean,
  "bytesVal": string,
  "doubleVal": number,
  "int64Val": string,
  "uint64Val": string,
  "stringVal": string,
  "timestampVal": string,
  "dateVal": {
    object (Date)
  },
  "protoVal": {
    "@type": string,
    field1: ...,
    ...
  }
  // End of list of possible types for union field value.
}
Fields
metadata

object (ValueMetadata)

Union field value.

value can be only one of the following:
nullVal

boolean

True if the value is NULL.
boolVal

boolean

Boolean value.
bytesVal

string (bytes format)

Bytes value.

A base64-encoded string.
doubleVal

number

Double value.
int64Val

string (int64 format)

Integer value (signed).
uint64Val

string

Un-signed integer value.
stringVal

string

String value. Enum values are returned as strings.
timestampVal

string (Timestamp format)

Timestamp values. Does not handle interval.

Uses RFC 3339, where generated output will always be Z-normalized and uses 0, 3, 6 or 9 fractional digits. Offsets other than "Z" are also accepted. Examples: "2014-10-02T15:01:23Z", "2014-10-02T15:01:23.045123456Z" or "2014-10-02T15:01:23+05:30".
dateVal

object (Date)

Date values.
protoVal

object

For any proto values that are not any of the above.

An object containing fields of an arbitrary type. An additional field "@type" contains a URI identifying the type. Example: { "id": 1234, "@type": "types.example.com/standard/id" }.

ValueMetadata

JSON representation 
{
  "links": [
    {
      object (InAppLink)
    }
  ],
  "fieldPaths": [
    string
  ],
  "timestampVal": string
}
Fields
fieldPaths[]

string
timestampVal

string (Timestamp format)

Timestamp value to store the timestamp for the case of the date and time data type.

Uses RFC 3339, where generated output will always be Z-normalized and uses 0, 3, 6 or 9 fractional digits. Offsets other than "Z" are also accepted. Examples: "2014-10-02T15:01:23Z", "2014-10-02T15:01:23.045123456Z" or "2014-10-02T15:01:23+05:30".

List

Store list of values in a column.

JSON representation 
{
  "values": [
    {
      object (ColumnValue)
    }
  ]
}
Fields
values[]

object (ColumnValue)

ColumnMetadata

Metadata of the column.

JSON representation 
{
  "column": string,
  "fieldPath": string,
  "functionName": string,
  "functionModule": string,
  "dataSource": enum (DataSource),
  "timestampMetadata": {
    object (TimestampMetadata)
  },
  "longitude": boolean,
  "latitude": boolean,
  "selected": boolean,
  "unselected": boolean
}
Fields
column

string

Name of the column.
fieldPath

string

Field path of the queried field, if any.
functionName

string

Name of the function used to query the field, if any.
functionModule

string

Module of the function used to query the field, if any.
dataSource

enum (DataSource)

Data source queried.
timestampMetadata

object (TimestampMetadata)

Timestamp Metadata
longitude

boolean

Whether the column is a longitude field.
latitude

boolean

Whether the column is a latitude field.
selected

boolean

Whether the column is selected in the final response.
unselected

boolean

Whether the column is unselected in the final response.

TimestampMetadata

Metadata of the timestamp column.

JSON representation 
{
  "timeFormat": string,
  "timeZone": string,
  "timeGranularity": string,
  "isSortable": boolean,
  "isInterpolable": boolean
}
Fields
timeFormat

string

Time format of the timestamp column.
timeZone

string

Time zone of the timestamp column.
timeGranularity

string

Time granularity of the timestamp column.
isSortable

boolean

Whether the timestamp column is sortable in UI.
isInterpolable

boolean

Whether the timestamp column is interpolable in UI.

QueryRuntimeError

Runtime error for a dashboard query.

JSON representation 
{
  "errorTitle": string,
  "errorDescription": string,
  "errorSeverity": enum (ErrorSeverity),
  "metadata": [
    {
      object (QueryRuntimeErrorMetadata)
    }
  ],
  "warningReason": enum (WarningReason)
}
Fields
errorTitle

string

Short Description of the error.
errorDescription

string

Error message
errorSeverity

enum (ErrorSeverity)

Severity of the error.
metadata[]

object (QueryRuntimeErrorMetadata)

Metadata for the error.
warningReason

enum (WarningReason)

Reason for the error.

ErrorSeverity

Based on ErrorSeverity, UI will choose to format the error differently.

Enums
ERROR_SEVERITY_UNSPECIFIED Severity is unknown.
WARNING Severity is warning.
SEVERE Error is severe.

QueryRuntimeErrorMetadata

Metadata for the error.

JSON representation 
{
  "key": enum (MetadataKey),
  "value": string
}
Fields
key

enum (MetadataKey)

Metadata key.
value

string

Metadata value.

MetadataKey

Metadata enum to identify the metadata key.

Enums
METADATA_KEY_UNSPECIFIED Key is unknown.
ROW_LIMIT Key is row limit.

WarningReason

Warning reason.

Enums
WARNING_REASON_UNSPECIFIED Reason is unknown.
ROW_LIMIT_EXCEEDED Reason is row limit exceeded.
DEFAULT_ROW_LIMIT_EXCEEDED Reason is default row limit exceeded.
CURATED_QUERY_DEFAULT_ROW_LIMIT_EXCEEDED Reason is curated query default row limit exceeded.