Skip to content
Telemetry
Database reliability SQL recipe

Find slow database queries by fingerprint

Rank normalized database operations by slow-query rate, average duration, and worst observed duration without storing raw SQL or parameters.

Beginnerdatabase_query_eventsReviewed 2026-07-28Tested with Apache DataFusion 45.2.0

Reviewed by the Telemetry product team on . We checked the SQL syntax, required event fields, sample results, and limits on using the query. Who reviews this page

Question answered

Which database operations are consistently slow enough to investigate?

Raw SQL can contain identifiers and sensitive values. Use a normalized query fingerprint to group equivalent operations and calculate their slow-query rate without storing statement text.

Event schema

Fields the query expects

FieldTypeWhy it exists
timestamp_utcTimestampWhen the database operation completed, in UTC.
query_fingerprintUtf8A consistent operation label from a fixed list. Exclude parameter values.
serviceUtf8Application or worker that issued the operation.
database_nameUtf8Approved logical database name.
statusUtf8success or failed.
duration_msFloat64End-to-end database operation duration in milliseconds.
rows_returnedInt64Rows returned or affected when the client exposes the count.
releaseUtf8Application release that issued the query.
environmentUtf8Deployment environment.
DataFusion SQL

Copy the query

sql
SELECT
  query_fingerprint,
  service,
  database_name,
  COUNT(*) AS executions,
  SUM(CASE WHEN duration_ms >= 1000 THEN 1 ELSE 0 END) AS slow_executions,
  100.0 * SUM(CASE WHEN duration_ms >= 1000 THEN 1 ELSE 0 END)
    / NULLIF(COUNT(*), 0) AS slow_query_rate_pct,
  AVG(duration_ms) AS average_duration_ms,
  MAX(duration_ms) AS maximum_duration_ms
FROM database_query_events
WHERE timestamp_utc >= now() - INTERVAL '30 days'
  AND environment = 'production'
GROUP BY query_fingerprint, service, database_name
HAVING COUNT(*) >= 10
ORDER BY slow_query_rate_pct DESC, executions DESC
LIMIT 20;

This read-only query is planned and executed against an empty typed table with Apache DataFusion 45.2.0. We review the synthetic sample output separately. Check field types, thresholds, and counting rules against your own data. Read the testing methodology.

Query result

Slow-query rate by fingerprint

The invoice update is slow on most executions, while the catalog query remains below the illustrative one-second threshold.

query_fingerprintservicedatabase_nameexecutionsslow_executionsslow_query_rate_pctaverage_duration_msmaximum_duration_ms
UPDATE invoices SET status = ?billing-workerapp_production108801,2501,700
SELECT checkout WITH line_itemscheckout-apiapp_production126501,012.51,600
SELECT products BY categorycatalog-apicatalog_production1200330440

Synthetic example output. Run the query against your own event schema and thresholds before using it for operational decisions.

Slow-query rate by fingerprint: static chart of synthetic slow_query_rate_pct values from the Find slow database queries by fingerprint example result
Download this SVG chart of the sample results for an article, runbook, or design review. Please credit Telemetry.

Reproduce the example

Download the sample data

The JSON bundle includes the event schema with field types, reproducible input rows, exact SQL, expected output, review notes, and engine version. The CSV contains the displayed result.

How the SQL works

  1. 1The fingerprint is an application-controlled label, not raw SQL. That bounds cardinality and avoids capturing parameter values.
  2. 2A rate distinguishes an occasionally slow high-volume operation from an operation that is slow most of the time.
  3. 3The minimum execution count prevents a single cold query from dominating the ranking.

Edge cases to check

  • Choose a slow threshold per workload; one second is illustrative and may be far too high for an interactive request.
  • Client duration includes pool wait and network time unless those phases are recorded separately.
  • Do not log raw query parameters, connection strings, or unrestricted SQL text.

Recommended dashboard

  • Bars: slow_query_rate_pct by query_fingerprint
  • Trend: average_duration_ms by release
  • Table: newest failures for a selected fingerprint and service

Alert guidance

Alert when a high-volume fingerprint remains above its reviewed slow-query rate for several complete buckets.

Read alert setup

Set up the events this query needs

Related instrumentation and guides

Define the source data

Event schemas for this analysis

Continue the analysis

Run it on your events

Create a table, adapt the fields, and save the result

Start free, send structured events, and use the query result as a chart, shared dashboard widget, or alert input.

Get an API key