Crate ddquery_core 

Parse and explain Datadog monitor queries.

A Datadog monitor query packs an aggregation window, a metric, a scope, a grouping, transforms, an evaluation function, and a threshold into one dense line:

avg(last_1d):anomalies(sum:app.service.latency{platform:macos, country:us}.as_count(), 'agile', 5, direction='below') >= 1

This crate turns that string into a typed, serializable AST (MonitorQuery) and renders it back as either a plain-language paragraph (explain) or a structured, render-ready breakdown (summarize).

Design

• Hand-written recursive descent + a small Pratt loop for arithmetic precedence. No parser-generator dependency: the grammar is small and stable.
• Never panics on input. Every failure path returns a ParseError carrying a byte offset and a one-line reason.
• Graceful degradation. parse_or_unparsed never fails: a query the grammar does not yet model becomes MonitorQuery::Unparsed with the raw string preserved, so a consumer can always render something.
• Bounded recursion. Pathologically nested input is rejected before the stack can grow.
• Pure. No I/O, no global state; parsing is linear in the input length.

Dialects

Dialect	Shape	AST
metric	time-agg(window): expr op threshold	MetricQuery
search	logs("…").rollup(…).last(…) op n	SearchQuery
service check	"check".over(…).last(n).count_by_status()	CheckQuery
slo	error_budget("id").over("7d") op n	SloQuery
composite	123 && !456 || 789	CompositeExpr

Examples

use ddquery_core::{explain, parse, MonitorQuery};

let query = "avg(last_5m):avg:system.cpu.user{env:production} > 90";
let ast = parse(query).unwrap();
assert!(matches!(ast, MonitorQuery::Metric(_)));
println!("{}", explain(&ast));

Structs

CheckQuery

A service-check query.

Condition

The alerting condition: comparison operator plus thresholds.

FuncParam

A parameter to an evaluation function.

KeyVal

A scope key/value pair (a filter chip).

MetricQuery

A metric monitor query: time_agg(window): expr op threshold.

Modifier

A postfix series modifier.

MonitorRef

A reference to another monitor by its numeric id (kept as a string to preserve the verbatim token).

ParseError

An error produced while parsing a monitor query.

QuerySummary

A render-ready breakdown of a query for a front-end (labelled chips/rows).

Scalar

A numeric scalar literal (threshold or arithmetic operand).

SearchQuery

A log/event/rum/error-tracking search-source query.

Series

A scoped metric series.

SloQuery

An SLO error-budget query.

Window

A normalized evaluation window.

Enums

ArithOp

An arithmetic operator.

BoolOp

A boolean operator in a composite query.

ChangeKind

A change function kind.

CmpOp

A comparison operator in a condition.

CompositeExpr

A boolean tree over monitor-id references (composite monitors).

Filter

A scope filter inside { … }.

FuncKind

An evaluation function.

MetricExpr

The recursive metric expression — the tree a visualization renders.

MonitorQuery

A parsed Datadog monitor query, tagged by dialect.

ParamValue

The value of a FuncParam.

SearchSource

The source of a SearchQuery.

SpaceAgg

Spatial aggregation across reporting sources.

TimeAgg

Evaluation-time aggregation.

Functions

explain

Produce a one-paragraph, plain-language summary of a parsed query.

parse

Parse a Datadog monitor query into a typed AST.

parse_or_unparsed

Parse a query, degrading to MonitorQuery::Unparsed on failure.

summarize

Produce a structured, render-ready summary of a parsed query.