Filters, joins, and summaries — the three moves that cover most real investigations.

HelixQL has a small surface area on purpose. Three patterns get you through almost any investigation.

Filter

Narrow to the signal and time you care about.

from logs | where service = "checkout" and level = "error"

Summarize

Roll the rows up into the number you actually want to see.

from metrics | summarize p95(latency) by route

Join across signals

The move that makes HelixQL worth learning is the cross-signal join — pivoting from a slow trace straight to the logs it emitted, with no copy-pasting of IDs:

from traces | where duration_ms > 500 | join logs on trace_id

That single line replaces the tab-juggling that eats the first ten minutes of most investigations.

Where to go next

Save the queries you reach for during incidents and pin them to the service dashboard. A HelixQL query you can re-run in one click during a page is worth ten you have to remember how to write.