Generating search query autocomplete suggestions based on metadata derived from event data

A computer node comprising:

• one or more processors;
• a display device;
• and
• memory storing instructions that are configured, when executed by the one or more processors, to perform one or more operations comprising:
• obtaining search results generated by an observability analysis system based on prior search queries, the search results comprising a subset of event data generated in a computing environment;
• obtaining metadata based on the event data, wherein the metadata are generated by analyzing the event data to identify:
• a plurality of fields;
• and
• values for each of the plurality of fields;
• after obtaining the metadata, receiving a partial search query through a user interface on the display device, the partial search query representing at least a portion of a request to search the event data;
• generating a plurality of autocomplete suggestions based on the partial search query and the metadata, wherein each of the plurality of autocomplete suggestions comprises one or both of:
• a suggested field selected from the plurality of fields;
• and
• a suggested value selected from the values;
• and
• displaying at least one of the plurality of autocomplete suggestions in the user interface.

A non-transitory computer-readable medium storing instructions that are operable when executed by data processing apparatus to perform operations comprising:

• obtaining search results generated by an observability analysis system based on prior search queries, the search results comprising a subset of event data generated in a computing environment;
• obtaining metadata based on the event data, wherein the metadata are generated by analyzing the event data to identify:
• a plurality of fields;
• and
• values for each of the plurality of fields;
• after obtaining the metadata, receiving a partial search query through a user interface at a first computer node, the partial search query representing at least a portion of a request to search the event data;
• generating, at the first computer node, a plurality of autocomplete suggestions based on the partial search query and the metadata, wherein each of the plurality of autocomplete suggestions comprises one or both of:
• a suggested field selected from the plurality of fields;
• and
• a suggested value selected from the values;
• and
• displaying at least one of the plurality of autocomplete suggestions in the user interface at the first computer node.