This is an automated email from the ASF dual-hosted git repository. wu-sheng pushed a commit to branch blog/horizon-ui-runtime-rules in repository https://gitbox.apache.org/repos/asf/skywalking-website.git
commit c132f9d4a634de729d98c8dd9f7da3c89c999ecd Author: Wu Sheng <[email protected]> AuthorDate: Mon Jun 29 17:41:44 2026 +0800 Blog: Meet Horizon UI 11/17 — Runtime Rules & Live Debugging Part 11 of the Meet Horizon UI series, continuing Act 3 (operate). Two admin-host capabilities new to the SkyWalking UI: editing OAL/MAL/LAL analysis rules in the browser and hot-applying them through a fenced, recoverable rollout; and the three-tab Live Debugger that steps each DSL against live samples (OAL->traces, MAL->metrics with the sample-group diff, LAL->logs as a record-by-block matrix). Both ride OAP's admin host and self-warn on OAP 10.x. 6 figures (WebP): rule catalog, editor, live-debug session + node coverage, OAL trace, MAL diff, LAL matrix. --- .../index.md | 63 +++++++++++++++++++++ .../horizon-0.7.0/p11-runtime-01-rule-catalog.webp | Bin 0 -> 144964 bytes .../horizon-0.7.0/p11-runtime-02-rule-editor.webp | Bin 0 -> 249010 bytes .../p11-runtime-03-livedebug-session.webp | Bin 0 -> 136242 bytes .../horizon-0.7.0/p11-runtime-04-oal-trace.webp | Bin 0 -> 92284 bytes .../horizon-0.7.0/p11-runtime-05-mal-diff.webp | Bin 0 -> 152224 bytes .../horizon-0.7.0/p11-runtime-06-lal-matrix.webp | Bin 0 -> 88814 bytes 7 files changed, 63 insertions(+) diff --git a/content/blog/2026-06-29-horizon-ui-runtime-rules-and-live-debugging/index.md b/content/blog/2026-06-29-horizon-ui-runtime-rules-and-live-debugging/index.md new file mode 100644 index 00000000000..5df91ef8ffe --- /dev/null +++ b/content/blog/2026-06-29-horizon-ui-runtime-rules-and-live-debugging/index.md @@ -0,0 +1,63 @@ +--- +title: "Meet Horizon UI · 11/17: Runtime Rules & Live Debugging" +date: 2026-06-29 +author: Sheng Wu +description: "Part 11 of the Meet Horizon UI series: edit SkyWalking's OAL/MAL/LAL analysis rules in the browser and hot-apply them to the running cluster with a fenced, recoverable rollout — then step those same rules against live data in the three-tab Live Debugger to see exactly what they compute." +tags: + - Engineering + - Metrics +--- + +This is the eleventh post in the [Meet Horizon UI](/blog/2026-06-21-skywalking-horizon-ui-introduction/) series, and it stays in **Act 3 — operate it**. The [previous post](/blog/2026-06-29-horizon-ui-alarms-and-incident-triage/) was about reading what the backend already decided; this one is about changing *how* it decides — and then proving the change does what you meant. + +Almost everything OAP computes runs through a small family of DSLs: **OAL** turns traces into service and endpoint metrics, **MAL** turns meters (OpenTelemetry, Telegraf) into metrics, **LAL** turns logs into tags and metrics. Traditionally you edit those as YAML on the server and restart. Horizon brings both halves into the console — **edit and hot-apply the rules**, and **debug them against live data** — two capabilities new to the SkyWalking UI that ride OAP's admin host. + +## Your rules, live in the console + +**Operate → DSL management** lists every analysis rule the cluster is running, grouped by source. Four catalogs are editable — **MAL · OTel**, **MAL · Telegraf**, **LAL**, and **LAL → MAL** (log-to-metric) — plus a read-only **OAL** browser. Rules group by prefix (ActiveMQ, BanyanDB, Elasticsearch, Flink…), each tagged by status, and you can filter by **active / inactive / bundled / modified** to see at a glance what an operator has changed versus what shipped. + + +Figure 1: DSL management — every OAL/MAL/LAL rule the cluster runs, grouped by source and filterable by status (active / inactive / bundled / modified). Here, the OpenTelemetry MAL catalog: 37 bundled rules.</br> + +## Edit, and hot-apply safely + +Open a rule and it's a Monaco YAML editor with syntax highlighting and two diff modes — **vs. server** (what's live) and **vs. bundled** (what shipped) — so you always see what you're about to change. The green ▶ in the gutter beside each `- name:` jumps that rule straight into the Live Debugger. + + +Figure 2: Edit a rule as Monaco YAML — syntax-highlighted, with diffs against the live (server) and bundled versions, and a green ▶ in the gutter that jumps the rule into the Live Debugger.</br> + +Saving is where the care shows. A body- or filter-only edit applies instantly. But a **structural** change — one that moves a metric's scope, downsampling, or storage shape — reshapes the cluster's storage, so Horizon runs it as a fenced rollout and tracks it on screen: **Compiled → Confirming across the cluster → Committing → Done**, reporting success only once the change is durable. If a node lags the fence, the apply ends **DEGRADED** — it names the laggard nodes (they self-converge o [...] + +## The Live Debugger: see what a rule actually does + +Editing a rule is the easy part. The hard part — the part that used to mean reading code and squinting at output — is knowing what a rule *computes* against your real data. **Operate → Live debugger** answers that directly: pick a rule, click **start sampling**, and Horizon installs a bounded capture on **every reachable OAP node**, grabs a handful of real records, and shows each one stepped through the rule. + + +Figure 3: Start a capture and it installs on every reachable OAP node (here 2/2), grabs real records, and bounds itself with a record cap and a retention window — the same shell serves all three analysis languages.</br> + +It has one tab per analysis language, because each works on a different kind of data. + +**OAL → traces.** A captured source row — a real trace segment — flows clause by clause: `from(Service.*)` reads the segment (you see its latency, status, endpoint), `build_metrics` shapes it, `cpm()` aggregates it. You watch a trace become a metric. + + +Figure 4: OAL → traces — a real segment from `agent::gateway` (latency 38, status 200, `/rcmd`) stepped clause by clause, `from(Service.*)` → `build_metrics` → `cpm()`, into the service-CPM metric it feeds.</br> + +**MAL → metrics.** A meter sample flows input → filter → function → output. Because one metric fans out into many label-sets, the samples are grouped by metric, and a **diff** dims the labels every sample shares and highlights only the ones that differ. + + +Figure 5: MAL → metrics — samples grouped by metric, with a diff that dims the 16 labels every sample shares and lights only the two that differ (`group`, `pod_name`), so four near-identical series read apart at a glance.</br> + +**LAL → logs.** Each captured log record becomes a column and each DSL block (or statement) a row, so the whole capture reads as a matrix: you can see which records the `filter` **aborted** and what the `extractor` pulled out of the ones that passed. + + +Figure 6: LAL → logs — every captured record a column, every DSL block a row. This filter aborts the normal logs (only abnormal ones pass) before the extractor pulls out `status.code` and `response.flag`.</br> + +## Where it runs + +Both surfaces are **operate** features: they talk to OAP's **admin host**, not the query port — DSL management through the `receiver-runtime-rule` module, the Live Debugger through `dsl-debugging`. That admin host ships with OAP 11, so on today's backend these two pages surface a clear "needs the admin host / module" banner and stay read-only, while every observe surface — dashboards, traces, logs, alarms, profiling — keeps working untouched. Access is role-gated: browsing rules and view [...] + +## Where to go next + +For the field reference — every apply state, the dump format, the per-tab capture controls — see the [Runtime Rules](https://skywalking.apache.org/docs/skywalking-horizon-ui/next/operate/runtime-rules/) and [Live Debugger](https://skywalking.apache.org/docs/skywalking-horizon-ui/next/operate/live-debugger/) docs. + +Next up: **Inspect — Cross-Layer Query Power-Tools** — the Operate-side surfaces for running metric, trace, and log queries straight across every layer. diff --git a/static/screenshots/horizon-0.7.0/p11-runtime-01-rule-catalog.webp b/static/screenshots/horizon-0.7.0/p11-runtime-01-rule-catalog.webp new file mode 100644 index 00000000000..989fa73e700 Binary files /dev/null and b/static/screenshots/horizon-0.7.0/p11-runtime-01-rule-catalog.webp differ diff --git a/static/screenshots/horizon-0.7.0/p11-runtime-02-rule-editor.webp b/static/screenshots/horizon-0.7.0/p11-runtime-02-rule-editor.webp new file mode 100644 index 00000000000..757aebc13df Binary files /dev/null and b/static/screenshots/horizon-0.7.0/p11-runtime-02-rule-editor.webp differ diff --git a/static/screenshots/horizon-0.7.0/p11-runtime-03-livedebug-session.webp b/static/screenshots/horizon-0.7.0/p11-runtime-03-livedebug-session.webp new file mode 100644 index 00000000000..8fbb4dc0de1 Binary files /dev/null and b/static/screenshots/horizon-0.7.0/p11-runtime-03-livedebug-session.webp differ diff --git a/static/screenshots/horizon-0.7.0/p11-runtime-04-oal-trace.webp b/static/screenshots/horizon-0.7.0/p11-runtime-04-oal-trace.webp new file mode 100644 index 00000000000..c65563ea3c8 Binary files /dev/null and b/static/screenshots/horizon-0.7.0/p11-runtime-04-oal-trace.webp differ diff --git a/static/screenshots/horizon-0.7.0/p11-runtime-05-mal-diff.webp b/static/screenshots/horizon-0.7.0/p11-runtime-05-mal-diff.webp new file mode 100644 index 00000000000..a1cf4e7391a Binary files /dev/null and b/static/screenshots/horizon-0.7.0/p11-runtime-05-mal-diff.webp differ diff --git a/static/screenshots/horizon-0.7.0/p11-runtime-06-lal-matrix.webp b/static/screenshots/horizon-0.7.0/p11-runtime-06-lal-matrix.webp new file mode 100644 index 00000000000..36e557e1142 Binary files /dev/null and b/static/screenshots/horizon-0.7.0/p11-runtime-06-lal-matrix.webp differ
