SQL

RawTree uses SQL to query ingested unstructured data.

Query endpoint

The query API accepts a JSON body with a sql field:

{"sql":"SELECT * FROM events LIMIT 10"}

Only read-only SQL is accepted through /v1/query.

Common patterns

SELECT * FROM events LIMIT 10;

SELECT action, count() AS total
FROM events
GROUP BY action
ORDER BY total DESC
LIMIT 10;

SELECT user.id, count() AS total
FROM events
GROUP BY user.id
ORDER BY total DESC
LIMIT 10;

SELECT __raw_data FROM events LIMIT 10;

SELECT __raw_data.user.id, __raw_data.event FROM events LIMIT 10;

Agent defaults

• Start with SELECT.
• Add LIMIT while exploring.
• Use dot notation for nested fields.
• Use __raw_data to read the original JSON object RawTree stored for each row.
• Use logs when a query fails.

Generated reference

The detailed SQL reference is generated from RawTree itself and may include pages for functions, aggregate functions, statements, and data types.

Use the generated pages when you need exact syntax or function behavior.