Homeโ€บ๐Ÿ” Phase 1: Learn DQLโ€บModule 62 min read ยท 7/21

Migrate Entity Selectors โ†’ Smartscape

Hands-on

Entity Selectors โ†’ Smartscape DQL

Gen2 entity selectors were a mini-language for filtering entities. Gen3 replaces them with standard DQL queries on Smartscape nodes.

Gen2: type(HOST),tag("env:production"),healthState("UNHEALTHY")
Gen3: fetch dt.entity.host
      | filter matchesValue(tags, "env:production")
      | filter state != "RUNNING"

Common Conversions

Gen2 Entity Selector                    Gen3 DQL
โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€  โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€
type(HOST)                              fetch dt.entity.host
type(SERVICE),tag("team:payments")      fetch dt.entity.service
                                        | filter matchesValue(tags, "team:payments")
type(HOST),entityName("prod-*")         fetch dt.entity.host
                                        | filter contains(entity.name, "prod-")
type(SERVICE),relatesTo(HOST-ABC)       fetch dt.entity.service
                                        | filter ... (use traverse for complex)

๐Ÿ›  Try it: Open a Notebook and run:
fetch dt.entity.service | fields entity.name, serviceType, tags | limit 20
Compare the results with what you see in the Services app.

Relationship Traversal

In Gen2, you used relatesTo() in entity selectors. In Gen3, you have two options:

Option 1: fetch + filter (simple cases)

fetch dt.entity.service
| fields entity.name, serviceType
| limit 20

Option 2: smartscapeNodes + traverse (complex topology)

smartscapeNodes HOST
| filter name == "my-server"
| traverse runs_on, SERVICE, direction: backward
| fields name, id

๐Ÿ’ก For most use cases, fetch dt.entity.* is simpler and sufficient. Use smartscapeNodes + traverse only when you need to walk complex relationship chains.

Migration Task: Convert Your Entity Selectors

Before migrating dashboards and alerts, inventory all entity selectors in your Gen2 config. Here's how to convert each pattern:

Gen2 Pattern                            Gen3 Conversion
โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€  โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€
type(HOST)                              fetch dt.entity.host
tag("env:prod")                         | filter matchesValue(tags, "env:prod")
entityName("web-*")                     | filter startsWith(entity.name, "web-")
healthState("UNHEALTHY")                | filter state != "RUNNING"
relatesTo(HOST-ABC)                     smartscapeNodes + traverse
mzName("Production")                    Use Segments instead (Phase 4)

Full-Stack Traversal: Host โ†’ Process โ†’ Service

// Find all services running on a specific host
smartscapeNodes HOST
| filter name == "my-server"
| traverse runs_on, PROCESS_GROUP_INSTANCE, direction: backward
| traverse runs_on, SERVICE, direction: backward
| fields name, id

Impact Analysis: Which hosts run a service?

// Reverse: find all hosts for a service
smartscapeNodes SERVICE
| filter name == "payment-api"
| traverse runs_on, PROCESS_GROUP_INSTANCE
| traverse runs_on, HOST
| fields name, id

๐Ÿ›  Migration step: Export your Gen2 management zone rules. Each rule contains entity selectors. Convert them to DQL using the table above, then use these queries in your Gen3 dashboards and anomaly detectors.

Discovery: What Entity Types Exist?

// List all entity types in your environment
smartscapeNodes *
| summarize count = count(), by:{type}
| sort count desc
// Discover fields for any entity type
describe dt.entity.service