Platform Deep Dive: New Relic

Platform Architecture

New Relic's architecture centers on a single telemetry database — NRDB (New Relic Database) — that ingests metrics, events, logs, and traces (MELT) into one unified store. Every piece of telemetry is queryable via NRQL, and every visualization is backed by a NRQL query you can inspect and modify.

flowchart TD
    A[Applications & Services] --> B[New Relic Agents / OTel SDK]
    B --> C[New Relic Telemetry Data Platform — NRDB]
    C --> D[APM]
    C --> E[Infrastructure]
    C --> F[Logs]
    C --> G[Synthetics]
    C --> H[Browser & Mobile]
    C --> I[Alerts & AI]
    C --> J[Dashboards]

    style A fill:#3B9797,color:#fff
    style B fill:#132440,color:#fff
    style C fill:#BF092F,color:#fff
    style D fill:#16476A,color:#fff
    style E fill:#16476A,color:#fff
    style F fill:#16476A,color:#fff
    style G fill:#16476A,color:#fff
    style H fill:#16476A,color:#fff
    style I fill:#16476A,color:#fff
    style J fill:#16476A,color:#fff
                            

The entity-centric model means everything in New Relic — hosts, services, containers, Lambda functions, browser apps — is an "entity" with a unique GUID. Entities have relationships (e.g., service A calls service B), enabling automatic service maps and dependency visualization without manual configuration.

NRQL — The Query Language

NRQL (New Relic Query Language) is a SQL-like language purpose-built for querying time-series telemetry data. Every chart, alert condition, and dashboard widget in New Relic is powered by NRQL — making it the single most important skill for New Relic users.

Basic Queries

# Average response time for a service
SELECT average(duration) FROM Transaction
WHERE appName = 'checkout-service' SINCE 1 hour ago

# Error rate by endpoint
SELECT percentage(count(*), WHERE error IS true) FROM Transaction
FACET request.uri SINCE 30 minutes ago

# Request throughput over time
SELECT rate(count(*), 1 minute) FROM Transaction
TIMESERIES 1 minute SINCE 1 hour ago

Advanced NRQL Patterns

# Compare current performance with last week
SELECT average(duration) FROM Transaction
WHERE appName = 'checkout-service'
SINCE 1 hour ago COMPARE WITH 1 week ago

# Funnel analysis — conversion tracking
SELECT funnel(session,
  WHERE pageUrl LIKE '%/products%' AS 'Browse',
  WHERE pageUrl LIKE '%/cart%' AS 'Add to Cart',
  WHERE pageUrl LIKE '%/checkout%' AS 'Checkout',
  WHERE pageUrl LIKE '%/confirmation%' AS 'Purchase')
FROM PageView SINCE 1 week ago

# Percentile distribution
SELECT percentile(duration, 50, 90, 95, 99) FROM Transaction
WHERE appName = 'api-gateway' SINCE 1 hour ago

# Histogram of response times
SELECT histogram(duration, 10, 20) FROM Transaction
WHERE appName = 'payment-service' SINCE 1 hour ago

# Unique count with filtering
SELECT uniqueCount(userId) FROM Transaction
WHERE httpResponseCode >= 500
FACET appName SINCE 1 day ago LIMIT 20

NRQL Key Clauses

APM & Distributed Tracing

New Relic APM provides deep application-level visibility with automatic instrumentation for major languages. Once an agent is installed, you immediately get transaction traces, error analytics, service maps, and distributed tracing — all queryable via NRQL.

Supported Languages

Agent Configuration

# newrelic.yml — Java Agent Configuration
common: &default_settings
  license_key: 'YOUR_LICENSE_KEY'
  app_name: checkout-service
  agent_enabled: true

  distributed_tracing:
    enabled: true

  transaction_tracer:
    enabled: true
    transaction_threshold: apdex_f
    record_sql: obfuscated
    explain_enabled: true
    explain_threshold: 0.5

  error_collector:
    enabled: true
    ignore_classes:
      - 'com.example.ExpectedBusinessException'
    ignore_status_codes: '404'

  browser_monitoring:
    auto_instrument: true

  custom_insights_events:
    enabled: true
    max_samples_stored: 30000

  labels:
    environment: production
    team: payments
    region: us-east-1

Key APM Features

• Service Maps — Automatically generated topology showing service dependencies, throughput, and error rates between entities
• Transaction Traces — Detailed breakdown of slow transactions showing time spent in each segment (database, external calls, code)
• Error Analytics — Grouped errors with stack traces, occurrence counts, impacted users, and error fingerprinting
• Distributed Tracing — End-to-end trace visualization across services with W3C Trace Context propagation
• Vulnerability Management — Automatic detection of known CVEs in application dependencies

Infrastructure & Logs

New Relic Infrastructure provides host-level metrics, process monitoring, and cloud integration data. The infrastructure agent runs on hosts and forwards system metrics, while cloud integrations pull data from AWS, Azure, and GCP APIs.

Infrastructure Agent Configuration

# /etc/newrelic-infra.yml
license_key: YOUR_LICENSE_KEY
display_name: checkout-prod-01
enable_process_metrics: true

# Custom attributes for filtering
custom_attributes:
  environment: production
  team: platform
  region: us-east-1
  cluster: checkout-primary

# Log forwarding configuration
logging:
  level: info
  forward: true
  include_filters:
    - name: app-logs
      file: /var/log/app/*.log
      attributes:
        logtype: application
    - name: nginx-access
      file: /var/log/nginx/access.log
      attributes:
        logtype: nginx
      pattern: '.*"(GET|POST|PUT|DELETE).*'

# Kubernetes integration
integrations:
  - name: nri-kubernetes
    env:
      CLUSTER_NAME: checkout-prod
      KUBE_STATE_METRICS_URL: http://kube-state-metrics.kube-system:8080
    interval: 15s

Querying Infrastructure Data

# Top 10 hosts by CPU utilization
SELECT average(cpuPercent) FROM SystemSample
FACET hostname SINCE 30 minutes ago LIMIT 10

# Disk space running low
SELECT latest(diskUsedPercent) FROM StorageSample
WHERE diskUsedPercent > 80
FACET hostname, mountPoint SINCE 5 minutes ago

# Container memory usage in Kubernetes
SELECT average(memoryUsedBytes / memoryLimitBytes * 100)
  AS 'Memory %' FROM K8sContainerSample
FACET containerName, podName
WHERE clusterName = 'checkout-prod' SINCE 15 minutes ago

# Log pattern analysis
SELECT count(*) FROM Log
WHERE message LIKE '%ERROR%'
FACET message SINCE 1 hour ago LIMIT 20

Synthetic Monitoring

New Relic Synthetics proactively monitors endpoints and user workflows from global locations. Unlike reactive APM monitoring (which waits for real traffic), synthetics continuously validate availability and performance — catching issues before users encounter them.

Monitor Types

Private Locations

For internal services not accessible from the public internet, deploy Synthetics Job Managers (containerized runners) inside your VPC. These execute monitors from within your network, enabling synthetic monitoring of internal APIs, staging environments, and private endpoints.

# Deploy Synthetics Job Manager via Docker
docker run -d \
  --name synthetics-job-manager \
  -e PRIVATE_LOCATION_KEY="YOUR_PRIVATE_LOCATION_KEY" \
  -e MINION_LOG_LEVEL=INFO \
  -v /var/run/docker.sock:/var/run/docker.sock \
  -p 8080:8080 \
  newrelic/synthetics-job-manager:latest

Alerting & AI

New Relic's alerting system is built entirely on NRQL — every alert condition is a NRQL query with threshold logic. Combined with AI-powered incident intelligence, it reduces alert noise and accelerates root cause analysis.

Alert Condition Types

NRQL Alert Example

# Alert: Error rate exceeds 5% for 5 minutes
SELECT percentage(count(*), WHERE error IS true)
FROM Transaction
WHERE appName = 'checkout-service'

# Threshold: Critical > 5, Warning > 2
# Window: 5 minutes
# Evaluation offset: 3 minutes (data lag buffer)

# Alert: P95 latency anomaly (baseline condition)
SELECT percentile(duration, 95) FROM Transaction
WHERE appName = 'api-gateway'

# Baseline direction: Upper only
# Deviation: 3 standard deviations above predicted value

Incident Intelligence Workflow

1. Signal detection — NRQL conditions evaluate continuously and open violations
2. Correlation — AI groups related violations into a single incident based on topology, timing, and historical patterns
3. Enrichment — Incident is enriched with recent deployments, related changes, and entity metadata
4. Notification — Routed to appropriate team via PagerDuty, Slack, email, or webhook
5. Root cause suggestion — AI highlights the most likely causal entity and related anomalies

Pricing & Free Tier

New Relic's pricing model is uniquely simple: you pay for data ingest (per GB) and user seats. There are no per-host, per-container, or per-span charges — making it highly predictable for dynamic, containerized environments.

Pricing Tiers

Cost Optimization Strategies

1. Drop filter rules — Create ingest-time rules that discard known noisy data (health checks, debug logs) before it counts against your GB quota
2. Sampling strategies — Use tail-based sampling for distributed traces (keep errors + slow, sample routine); reduces trace data by 80-90%
3. Metric aggregation rules — Roll up high-cardinality metrics into lower-cardinality summaries at ingest; original data dropped, aggregates retained
4. Basic vs. full users — Assign "basic" (free) user type to team members who only need dashboards and alerts; reserve "full platform" seats for engineers who query and build
5. Data Plus add-on evaluation — At $0.50/GB, Data Plus provides 90-day retention, HIPAA compliance, and higher query limits; calculate break-even vs. standard + custom archival

When to Choose New Relic