Telemetry
Database reliability SQL recipe

Find Slow Database Queries by Fingerprint

Rank normalized database operations by slow-query rate, average duration, and worst observed duration without storing raw SQL or parameters.

Beginnerdatabase_query_eventsReviewed 2026-07-28Tested with Apache DataFusion 45.2.0

Reviewed by the Telemetry product team on . SQL compatibility, event contract, synthetic output, and operational caveats. Editorial ownership

Question answered

Which database operations are consistently slow enough to investigate?

Raw SQL often contains identifiers, values, and unbounded variations. A controlled query fingerprint keeps equivalent operations together so a slow-query rate can identify recurring application paths without turning telemetry into a query-text archive.

Event contract

Fields the query expects

FieldTypeWhy it exists
timestamp_utcTimestampWhen the database operation completed, in UTC.
query_fingerprintUtf8A normalized, bounded operation label without parameter values.
serviceUtf8Application or worker that issued the operation.
database_nameUtf8Approved logical database name.
statusUtf8success or failed.
duration_msFloat64End-to-end database operation duration in milliseconds.
rows_returnedInt64Rows returned or affected when the client exposes the count.
releaseUtf8Application release that issued the query.
environmentUtf8Deployment environment.
DataFusion SQL

Copy the query

sql
SELECT
  query_fingerprint,
  service,
  database_name,
  COUNT(*) AS executions,
  SUM(CASE WHEN duration_ms >= 1000 THEN 1 ELSE 0 END) AS slow_executions,
  100.0 * SUM(CASE WHEN duration_ms >= 1000 THEN 1 ELSE 0 END)
    / NULLIF(COUNT(*), 0) AS slow_query_rate_pct,
  AVG(duration_ms) AS average_duration_ms,
  MAX(duration_ms) AS maximum_duration_ms
FROM database_query_events
WHERE timestamp_utc >= now() - INTERVAL '30 days'
  AND environment = 'production'
GROUP BY query_fingerprint, service, database_name
HAVING COUNT(*) >= 10
ORDER BY slow_query_rate_pct DESC, executions DESC
LIMIT 20;

This read-only query is planned and executed against an empty typed table with Apache DataFusion 45.2.0. The deterministic sample output is synthetic and reviewed separately; validate field types, thresholds, and business definitions against your own data. Read the testing methodology.

Query result

Slow-query rate by fingerprint

The invoice update is slow on most executions, while the catalog query remains below the illustrative one-second threshold.

query_fingerprintservicedatabase_nameexecutionsslow_executionsslow_query_rate_pctaverage_duration_msmaximum_duration_ms
UPDATE invoices SET status = ?billing-workerapp_production108801,2501,700
SELECT checkout WITH line_itemscheckout-apiapp_production126501,012.51,600
SELECT products BY categorycatalog-apicatalog_production1200330440

Synthetic example output. Run the query against your own event schema and thresholds before using it for operational decisions.

Slow-query rate by fingerprint: static chart of synthetic slow_query_rate_pct values from the Find Slow Database Queries by Fingerprint example result
Indexable SVG of the deterministic example output. Download it for an article, runbook, or design review with attribution.

Reproduce the example

Download the public fixture

The JSON bundle includes the typed event contract, reproducible input rows, exact SQL, expected output, review notes, and engine version. The CSV contains the displayed result.

How the SQL works

  1. 1The fingerprint is an application-controlled label, not raw SQL. That bounds cardinality and avoids capturing parameter values.
  2. 2A rate distinguishes an occasionally slow high-volume operation from an operation that is slow most of the time.
  3. 3The minimum execution count prevents a single cold query from dominating the ranking.

Edge cases to decide

  • Choose a slow threshold per workload; one second is illustrative and may be far too high for an interactive request.
  • Client duration includes pool wait and network time unless those phases are recorded separately.
  • Do not log raw query parameters, connection strings, or unrestricted SQL text.

Recommended dashboard

  • Bars: slow_query_rate_pct by query_fingerprint
  • Trend: average_duration_ms by release
  • Table: newest failures for a selected fingerprint and service

Alert guidance

Alert when a high-volume fingerprint remains above its reviewed slow-query rate for several complete buckets.

Read alert setup

Put the recipe to work

Related instrumentation and guides

Continue the analysis

Run it on real events

Create a table, adapt the fields, and save the result

Start free, send structured events, and use the query result as a chart, shared dashboard widget, or alert input.

Get an API key