打通可观测性的“任督二脉”：实体与关系的终极融合

UModel (知识图谱)├── EntitySet: apm.service (类型定义)│   ├── Entity: user-service (实例1)│   ├── Entity: payment-service (实例2)│   └── Entity: order-service (实例3)├── EntitySet: k8s.pod (类型定义)│   ├── Entity: web-pod-123 (实例1)│   └── Entity: api-pod-456 (实例2)└── EntitySetLink: service_runs_on_pod (关系定义)    ├── Relation: user-service -> web-pod-123    └── Relation: payment-service -> api-pod-456

// 任意节点()// 具有特定标签的节点  (:"apm@apm.service")           // graph-match写法(:`apm@apm.service`)           // cypher写法// 具有标签和属性的节点(:"apm@apm.service" { __entity_type__: 'apm.service' })// 命名变量的节点(s:"apm@apm.service" { __entity_id__: '123456' })// 任意边[]// 命名边[edge]// 具有类型的边[e:calls { __type__: "calls" }]

// graph-match语法.topo | graph-match (s:"apm@apm.service" {__entity_id__: '123'})-[e]-(d)        project s, e, d// Cypher语法（``apm@apm.service`` 反引号字符串格式，使用两个反引号包裹）.topo | graph-call cypher(`    MATCH (s:``apm@apm.service`` {__entity_id__: '35af918180394ff853be6c9b458704ea'})-[e]-(d)    RETURN s, e, d`)

{  "id": "apm@apm.service:347150ad7eaee43d2bd25d113f567569",  "label": "apm@apm.service",   "properties": {    "__domain__": "apm",    "__entity_type__": "apm.service",    "__entity_id__": "347150ad7eaee43d2bd25d113f567569",    "__label__": "apm@apm.service"  }}

{  "startNodeId": "apm@apm.service:347150ad7eaee43d2bd25d113f567569",  "endNodeId": "apm@apm.service.host:34f627359470c9d36da593708e9f2db7",  "type": "contains",  "properties": {    "__type__": "contains"  }}

.topo |  graph-match (s:"apm@apm.operation" {__entity_id__: '925f76b2a7943e910187fd5961125288'})              <-[e1]-(v1)-[e2:calls]->(v2)-[e3]->(v3)  project s,           "e1.__type__",           "v1.__label__",           "e2.__type__",           "v2.__label__",           "e3.__type__",           "v3.__label__",           v3

.topo |  graph-match (s:"apm@apm.service" {__entity_id__: '0e73700c768a8e662165a8d4d46cd286'})              -[e]-(d)     project eType="e.__type__", dLabel="d.__label__"| stats cnt=count(1) by dLabel, eType| sort cnt desc| limit 20

.topo |  graph-match (s:"apm@apm.service.operation" {__entity_id__: '6f0bb4c892effff81538df574a5cfcd9'})              <-[e1]-(v1)-[e2:runs_on]->(v2)-[e3]->(v3)  project s,           "e1.__type__",           "v1.__label__",           "e2.__type__",           "v2.__label__",           "e3.__type__",           destId="v3.__entity_id__",           v3 | where destId='9a3ad23aa0826d643c7b2ab7c6897591'| project s, v3

.topo |  graph-match (pod:"k8s@k8s.pod" {__entity_id__: '347150ad7eaee43d2bd25d113f567569'})              <-[r1:contains]-(node:"k8s@k8s.node")              <-[r2:contains]-(cluster:"k8s@k8s.cluster")  project     pod,    node,     cluster,    "r1.__type__",    "r2.__type__"

-- 获取服务的所有邻居（2跳内）.topo | graph-call getNeighborNodes(  'full', 2,  [(:"apm@apm.service" {__entity_id__: '0e73700c768a8e662165a8d4d46cd286'})])| stats cnt=count(1) by relationType| sort cnt desc

.topo | graph-call getNeighborNodes(  'sequence_in', 3,  [(:"apm@apm.service" {__entity_id__: '0e73700c768a8e662165a8d4d46cd286'})])| where relationType in ('calls', 'depends_on')| extend impact_level = CASE    WHEN srcPosition = '-1' THEN 'direct'    WHEN srcPosition = '-2' THEN 'secondary'    ELSE 'indirect' END| extend parsed_service_id = json_extract_scalar(srcNode, '$.id')| project     upstream_service = parsed_service_id,    impact_level,    relation_type = relationType| stats cnt=count(1) by impact_level, relation_type

.topo | graph-call getNeighborNodes(  'sequence_out', 3,  [(:"apm@apm.service" {__entity_id__: 'failing-service-id'})])| where relationType in ('calls', 'depends_on')| extend affected_service = json_extract_scalar(destNode, '$.id')| stats impact_count=count(1) by affected_service| sort impact_count desc| limit 20

.topo | graph-call getNeighborNodes(  'sequence_out', 2,  [(:"acs@acs.ecs.instance" {__entity_id__: 'i-bp1234567890'})])| extend relation_category = CASE    WHEN relationType in ('belongs_to', 'runs_in') THEN 'infrastructure'    WHEN relationType in ('depends_on', 'uses') THEN 'dependency'    WHEN relationType in ('connects_to', 'accesses') THEN 'network'    ELSE 'other' END| stats cnt=count(1) by relation_category| sort cnt desc| limit 0, 100

.topo | graph-call getDirectRelations(  [    (:"app@app.service" {__entity_id__: '347150ad7eaee43d2bd25d113f567569'}),    (:"app@app.operation" {__entity_id__: '73ef19770998ff5d4c1bfd042bc00a0f'})  ])

{  "startNodeId": "app@app.service:347150ad7eaee43d2bd25d113f567569",  "endNodeId": "app@app.operation:73ef19770998ff5d4c1bfd042bc00a0f",   "type": "contains",  "properties": {"__type__": "contains"}}

-- 查询特定类型的所有节点.topo | graph-call cypher(`    MATCH (n {__entity_type__:"apm.service"})    WHERE n.__domain__ STARTS WITH 'a' AND n.__entity_type__ = "apm.service"    RETURN n`)

-- 查询服务间调用关系.topo | graph-call cypher(`    MATCH (src:``apm@apm.service``)-[e:calls]->(dest:``apm@apm.service``)    WHERE src.cluster = 'production' AND dest.cluster = 'production'    RETURN src.service, dest.service, e.__type__`)

-- 查找2-3跳的调用链路.topo | graph-call cypher(`    MATCH (src {__entity_type__:"acs.service"})-[e:calls*2..4]->(dest)    WHERE dest.__domain__ = 'acs'    RETURN src, dest, dest.__entity_type__`)

-- 查找服务间的可达路径.topo | graph-call cypher(`    MATCH (startNode:``apm@apm.service`` {service: 'gateway'})          -[path:calls*1..4]->          (endNode:``apm@apm.service`` {service: 'database'})    RETURN startNode.service, length(path) as hop_count, endNode.service`)

-- 分析故障传播路径.topo | graph-call cypher(`    MATCH (failed:``apm@apm.test_service`` {status: 'error'})          -[impact:depends_on*1..3]->          (affected)    WHERE affected.__entity_type__ = 'apm.service'    RETURN failed.service,            length(impact) as impact_distance,           affected.service    ORDER BY impact_distance ASC`)

-- 统计不同域的服务数量.topo | graph-call cypher(`    MATCH (src {__entity_type__:"apm.service"})-[e:calls*2..3]->(dest)    WHERE dest.__domain__ = 'apm'    RETURN src, count(src) as connection_count`)

-- 查找特定的拓扑模式.topo | graph-call cypher(`    MATCH (src:``acs@acs.vpc.vswitch``)-[e1]->(n1)<-[e2]-(n2)-[e3]->(n3)    WHERE NOT (src = n2 AND e1.__type__ = e2.__type__)         AND n1.__entity_type__ <> n3.__entity_type__         AND NOT (src)<-[e1:``calls``]-(n1)    RETURN src, e1.__type__, n1, e2.__type__, n2, e3.__type__, n3`)

-- 使用实体的自定义属性进行查询 (仅为示例，实际属性kv以真实场景为准).topo | graph-call cypher(`    MATCH (n:``acs@acs.alb.listener`` {listener_id: 'lsn-rxp57*****'})-[e]->(d)    WHERE d.vSwitchId CONTAINS 'vsw-bp1gvyids******'         AND d.user_id IN ['1654*******', '2']         AND d.dns_name ENDS WITH '.com'    RETURN n, e, d`)

-- 复杂的属性条件查询 (仅为示例，实际属性kv以真实场景为准).topo | graph-call cypher(`    MATCH (instance:``acs@acs.ecs.instance``)    WHERE instance.instance_type STARTS WITH 'ecs.c6'        AND instance.cpu_cores >= 4        AND instance.memory_gb >= 8        AND instance.status = 'Running'    RETURN         instance.instance_id,        instance.instance_type,        instance.cpu_cores,        instance.memory_gb,        instance.availability_zone    ORDER BY instance.cpu_cores DESC, instance.memory_gb DESC`)

-- 返回多级跳的完整路径信息.topo | graph-call cypher(`    MATCH (n:``acs@acs.alb.listener``)-[e:``calls``*2..3]-()    RETURN e`)

-- 查找ECS实例到负载均衡器的连接路径.topo | graph-call cypher(`    MATCH (start_node:``acs@acs.ecs.instance``)          -[e*2..3]-          (mid_node {listener_name: 'entity-test-listener-zuozhi'})          -[e2*1..2]-          (end_node:``acs@acs.alb.loadbalancer``)    WHERE start_node.__entity_id__ <> mid_node.__entity_id__         AND start_node.__entity_type__ <> mid_node.__entity_type__    RETURN         start_node.instance_name,         e,         mid_node.__entity_type__,         e2,         end_node.instance_name`)

-- 分析微服务网格中的流量路径.topo | graph-call cypher(`    MATCH (client:``apm@apm.service``)          -[request:calls]->          (gateway:``apm@apm.gateway``)          -[route:routes_to]->          (service:``apm@apm.service``)          -[backend:calls]->          (database:``middleware@database``)    WHERE client.environment = 'production'        AND request.protocol = 'HTTP'        AND route.load_balancer_type = 'round_robin'    RETURN         client.service,        gateway.gateway_name,        service.service,        database.database_name,        request.request_count,        backend.connection_pool_size`)

-- 分析服务故障的级联影响.topo | graph-call cypher(`    MATCH (failed_service:``apm@apm.service`` {service: 'load-generator'})    MATCH (failed_service)-[cascade_path*1..4]->(affected_service:``apm@apm.service``)    RETURN         failed_service.service as root_cause,        length(cascade_path) as impact_depth,        affected_service.service as affected_service,        cascade_path as dependency_chain    ORDER BY impact_depth ASC`)

-- 分析特定服务的调用模式.topo |  graph-match (s:"apm@apm.service" {__entity_id__: 'abcdefg123123'})              -[e:calls]-(d:"apm@apm.service")  project     source_service="s.service",    target_service="d.service",     call_type="e.__type__"| stats call_count=count(1) by source_service, target_service| sort call_count desc

-- 追踪用户到资源的访问路径.topo |  graph-match (user:"identity@user" {__entity_id__: 'user-123'})              -[auth:authenticated_to]->(app:"apm@apm.service")              -[access:accesses]->(resource:"acs@acs.rds.instance")  project     user_id="user.user_id",    app_name="app.service",    resource_id="resource.instance_id",    auth_method="auth.auth_method",    access_level="access.permission_level"

.topo | graph-call cypher(`    MATCH (n)-[e]->(m)    RETURN         count(DISTINCT n) as unique_nodes,        count(DISTINCT e) as unique_edges,        count(DISTINCT e.__type__) as edge_types`)

-- 查找指向不存在实体的关系.let topoData = .topo | graph-call cypher(`        MATCH ()-[e]->()        RETURN e    `)    | extend startNodeId = json_extract_scalar(e, '$.startNodeId'), endNodeId = json_extract_scalar(e, '$.endNodeId'), relationType = json_extract_scalar(e, '$.type')    | project startNodeId, endNodeId, relationType;--$topoData.let entityData = .entity with(domain='*', type='*') | project __entity_id__, __entity_type__, __domain__| extend matchedId = concat(__domain__, '@', __entity_type__, ':', __entity_id__)| join -kind='left' $topoData on matchedId = $topoData.endNodeId| project matchedId, startNodeId, endNodeId, relationType| extend status = COALESCE(startNodeId, '悬挂')| where status = '悬挂';$entityData

-- 标准模式（需要完整数据）.topo | graph-call cypher(`    MATCH (n:``acs@acs.alb.listener`` {ListenerId: 'lsn-123'})-[e]->(d)    WHERE d.vSwitchId CONTAINS 'vsw-456'    RETURN n, e, d`)-- pure-topo模式（仅依赖关系数据）.topo | graph-call cypher(`    MATCH (n:``acs@acs.alb.listener``)-[e]->(d)    RETURN n, e, d`, 'pure-topo')

-- ❌ 优化前：全表扫描.topo | graph-call cypher(`    MATCH (n) WHERE n.service = 'web-app'    RETURN n`)-- ✅ 优化后：使用标签索引.topo | graph-call cypher(`    MATCH (n:``apm@apm.service`` {service: 'web-app'})    RETURN n`)

-- ❌ 优化前：后期过滤.topo | graph-call cypher(`    MATCH (start)-[*1..5]->(endNode)    WHERE start.environment = 'production' AND endNode.status = 'active'    RETURN start, endNode`)-- ✅ 优化后：早期过滤.topo | graph-call cypher(`    MATCH (start {environment: 'production'})-[*1..5]->(endNode {status: 'active'})    RETURN start, endNode`)

-- 使用LIMIT控制结果数量.topo | graph-call cypher(`    MATCH (service:``apm@apm.service``)-[calls:calls]->(target)    WHERE calls.request_count > 1000    RETURN service.service, target.service, calls.request_count    ORDER BY calls.request_count DESC    LIMIT 50`)

-- 对大结果集进行采样.topo | graph-call cypher(`    MATCH (n:``apm@apm.service``)    RETURN n.service    LIMIT 100`)| extend seed = random()| where seed < 0.1

-- 避免过深的遍历.topo | graph-call cypher(`    MATCH (start)-[path*1..3]->(endNode)    WHERE length(path) <= 2    RETURN path`)

-- 利用关系方向减少搜索空间.topo | graph-call cypher(`    MATCH (start)-[calls:calls*1..3]->(endNode)  -- 明确方向    WHERE start.__entity_type__ = 'apm.service'    RETURN start, endNode`)

.topo | graph-call cypher(`    MATCH (s)-[e:``contains``]->(d)    WHERE s.__domain__ CONTAINS "apm"    RETURN e`)

-- 查找2-3跳的调用链路.topo | graph-call cypher(`    MATCH (src {__entity_type__:"acs.service"})-[e:calls*2..4]->(dest)    WHERE dest.__domain__ = 'acs'    RETURN src, dest, dest.__entity_type__`)

.topo | graph-call cypher(`    MATCH (s)-[e*1..3]->(d)    RETURN length(e) as len`, 'pure-topo')| stats cnt=count(1) by len| project len, cnt

.topo | graph-call cypher(`    MATCH (s)-[]->(d)    RETURN s`, 'pure-topo')