docs/guide/sql-engine.md
The SQL Engine is a powerful tool that allows you to run SQL queries against your data. It is designed to provide a seamless experience for users who are familiar with SQL and want to interact with their data using a familiar language.
This feature is currently in beta and is available to all users. If you have any feedback or suggestions, please let us know!
To get started with the SQL Engine, you will need to have a dataset that you can query. Only JSON logs can be queried using SQL. Dozzle leverages the power of WebAssembly to run SQL queries in the browser, which means that your data never leaves your machine.
To start using the SQL Engine, make sure you have JSON logs and navigate to the dropdown and choose SQL Analytics. There is also a keyboard shortcut Ctrl+Shift+F (or Cmd+Shift+F on macOS) to quickly open the SQL Engine.
The SQL Engine uses WebAssembly to run SQL queries in the browser with DuckDB. When the SQL Engine is first opened, DuckDB WASM is downloaded and initialized in the browser. This could take a while if you are on a slow connection. The SQL Engine then reads only the JSON logs and creates a virtual table in DuckDB. This allows you to run SQL queries against your data in real-time.
The query that Dozzle runs initially is similar to:
CREATE TABLE logs AS SELECT unnest(m) FROM 'logs.json'
This query creates a table called logs and unnests the JSON logs into rows. You can then run SQL queries against this table to analyze your data.
Here are some example queries that you can run using the SQL Engine:
SELECT COUNT(*) FROM logs
SELECT * FROM logs WHERE level = 'error'
SELECT level, COUNT(*) FROM logs GROUP BY level
SELECT message.path, message.status, message.duration
FROM logs
WHERE message.status >= 400
ORDER BY message.duration DESC
SELECT
date_trunc('minute', timestamp) AS minute,
COUNT(*) AS error_count
FROM logs
WHERE level = 'error'
GROUP BY minute
ORDER BY minute DESC
WebAssembly has some limitations that you should be aware of when using the SQL Engine: