Telemetry query

Repeatable — values OR together (e.g. two occurrences match either service). A single occurrence is unchanged from before this field was repeatable (issue #331).

Same shape as 'service_name', negated: excludes rows matching any of these values. If a value appears in both 'service_name' and this field, it is excluded — exclude always wins on conflict.

Repeatable (issue #331) — same semantics as 'service_name'.

Same shape as 'status_code', negated — same semantics as 'service_name_exclude'.

Language q is written in (#177). lucene is the default and what every request omitting this field gets. sql reads q as a bare ClickHouse predicate, AND-joined under the tenant clamp so it can only narrow — see docs/v2/architecture/TELEMETRY_INGESTION_ARCHITECTURE.md §9.3.1.

Repeatable, index-aligned with 'attribute_value' (issue #331): the i-th key pairs with the i-th value. Values sharing a key OR together; distinct keys AND together. A single (key, value) pair is unchanged from before this field was repeatable.

Paired with 'attribute_key' — see its description.

Same shape as 'attribute_key', negated — pairs with 'attribute_value_exclude'. A key excluded here is excluded even if the same key/value also appears in 'attribute_key'/'attribute_value'.

Paired with 'attribute_key_exclude' — see its description.

Narrow to one Event Patterns cluster (#179). Pass a pattern_hash from the patterns endpoint back verbatim — it is a UInt64 carried as a string because the larger values exceed JavaScript's Number.MAX_SAFE_INTEGER. The hash is derived from the message, not stored, so a value produced before a change to the mask list will match nothing; see §9.11.

Comma-separated column projection (§9.9, issue #356), e.g. 'service_name,span_name'. 'row_id' is always included. Absent returns the full row, unchanged from before this parameter existed.

' asc|desc' (§9.9, issue #356). Only 'start_time' is sortable — the keyset cursor is typed against it. Absent means 'start_time desc', unchanged from before this parameter existed.

Repeatable — values OR together (e.g. two occurrences match either service). A single occurrence is unchanged from before this field was repeatable (issue #331).

Same shape as 'service_name', negated: excludes rows matching any of these values. If a value appears in both 'service_name' and this field, it is excluded — exclude always wins on conflict.

Repeatable (issue #331) — same semantics as 'service_name'.

Same shape as 'status_code', negated — same semantics as 'service_name_exclude'.

Language q is written in (#177). lucene is the default and what every request omitting this field gets. sql reads q as a bare ClickHouse predicate, AND-joined under the tenant clamp so it can only narrow — see docs/v2/architecture/TELEMETRY_INGESTION_ARCHITECTURE.md §9.3.1.

Repeatable, index-aligned with 'attribute_value' (issue #331): the i-th key pairs with the i-th value. Values sharing a key OR together; distinct keys AND together. A single (key, value) pair is unchanged from before this field was repeatable.

Paired with 'attribute_key' — see its description.

Same shape as 'attribute_key', negated — pairs with 'attribute_value_exclude'. A key excluded here is excluded even if the same key/value also appears in 'attribute_key'/'attribute_value'.

Paired with 'attribute_key_exclude' — see its description.

Narrow to one Event Patterns cluster (#179). Pass a pattern_hash from the patterns endpoint back verbatim — it is a UInt64 carried as a string because the larger values exceed JavaScript's Number.MAX_SAFE_INTEGER. The hash is derived from the message, not stored, so a value produced before a change to the mask list will match nothing; see §9.11.

Repeatable — values OR together (e.g. two occurrences match either service). A single occurrence is unchanged from before this field was repeatable (issue #331).

Same shape as 'service_name', negated: excludes rows matching any of these values. If a value appears in both 'service_name' and this field, it is excluded — exclude always wins on conflict.

Repeatable (issue #331) — same semantics as 'service_name'.

Same shape as 'status_code', negated — same semantics as 'service_name_exclude'.

Language q is written in (#177). lucene is the default and what every request omitting this field gets. sql reads q as a bare ClickHouse predicate, AND-joined under the tenant clamp so it can only narrow — see docs/v2/architecture/TELEMETRY_INGESTION_ARCHITECTURE.md §9.3.1.

Repeatable, index-aligned with 'attribute_value' (issue #331): the i-th key pairs with the i-th value. Values sharing a key OR together; distinct keys AND together. A single (key, value) pair is unchanged from before this field was repeatable.

Paired with 'attribute_key' — see its description.

Same shape as 'attribute_key', negated — pairs with 'attribute_value_exclude'. A key excluded here is excluded even if the same key/value also appears in 'attribute_key'/'attribute_value'.

Paired with 'attribute_key_exclude' — see its description.

Narrow to one Event Patterns cluster (#179). Pass a pattern_hash from the patterns endpoint back verbatim — it is a UInt64 carried as a string because the larger values exceed JavaScript's Number.MAX_SAFE_INTEGER. The hash is derived from the message, not stored, so a value produced before a change to the mask list will match nothing; see §9.11.

Group per-bucket counts by status_code

Repeatable — values OR together (e.g. two occurrences match either service). A single occurrence is unchanged from before this field was repeatable (issue #331).

Same shape as 'service_name', negated: excludes rows matching any of these values. If a value appears in both 'service_name' and this field, it is excluded — exclude always wins on conflict.

Repeatable (issue #331) — same semantics as 'service_name'.

Same shape as 'status_code', negated — same semantics as 'service_name_exclude'.

Language q is written in (#177). lucene is the default and what every request omitting this field gets. sql reads q as a bare ClickHouse predicate, AND-joined under the tenant clamp so it can only narrow — see docs/v2/architecture/TELEMETRY_INGESTION_ARCHITECTURE.md §9.3.1.

Repeatable, index-aligned with 'attribute_value' (issue #331): the i-th key pairs with the i-th value. Values sharing a key OR together; distinct keys AND together. A single (key, value) pair is unchanged from before this field was repeatable.

Paired with 'attribute_key' — see its description.

Same shape as 'attribute_key', negated — pairs with 'attribute_value_exclude'. A key excluded here is excluded even if the same key/value also appears in 'attribute_key'/'attribute_value'.

Paired with 'attribute_key_exclude' — see its description.

Narrow to one Event Patterns cluster (#179). Pass a pattern_hash from the patterns endpoint back verbatim — it is a UInt64 carried as a string because the larger values exceed JavaScript's Number.MAX_SAFE_INTEGER. The hash is derived from the message, not stored, so a value produced before a change to the mask list will match nothing; see §9.11.

Max attribute values returned per attribute key

Repeatable — values OR together (e.g. two occurrences match either service). A single occurrence is unchanged from before this field was repeatable (issue #331).

Same shape as 'service_name', negated: excludes rows matching any of these values. If a value appears in both 'service_name' and this field, it is excluded — exclude always wins on conflict.

Repeatable (issue #331) — same semantics as 'service_name'.

Same shape as 'status_code', negated — same semantics as 'service_name_exclude'.

Language q is written in (#177). lucene is the default and what every request omitting this field gets. sql reads q as a bare ClickHouse predicate, AND-joined under the tenant clamp so it can only narrow — see docs/v2/architecture/TELEMETRY_INGESTION_ARCHITECTURE.md §9.3.1.

Repeatable, index-aligned with 'attribute_value' (issue #331): the i-th key pairs with the i-th value. Values sharing a key OR together; distinct keys AND together. A single (key, value) pair is unchanged from before this field was repeatable.

Paired with 'attribute_key' — see its description.

Same shape as 'attribute_key', negated — pairs with 'attribute_value_exclude'. A key excluded here is excluded even if the same key/value also appears in 'attribute_key'/'attribute_value'.

Paired with 'attribute_key_exclude' — see its description.

Max patterns returned, most frequent first.

The span's name, matched exactly.

The span's service, matched exactly.

The subject span's own duration, ranked against its peers.

Include each span's events (#304). Off by default because the Events.* arrays are the one unbounded thing on a span row — the surfaces that do not render events should not pay for them. Capped per span (MAX_SPAN_EVENTS_PER_SPAN) and per trace (MAX_TRACE_EVENTS); either cap firing sets events_truncated.

Repeatable — values OR together (e.g. two occurrences match either service). A single occurrence is unchanged from before this field was repeatable (issue #331).

Same shape as 'service_name', negated: excludes rows matching any of these values. If a value appears in both 'service_name' and this field, it is excluded — exclude always wins on conflict.

Repeatable (issue #331) — same semantics as 'service_name'. Case-insensitive, matches the canonical severity (§9.1).

Same shape as 'severity_text', negated — same semantics as 'service_name_exclude'.

Language q is written in (#177). lucene is the default and what every request omitting this field gets. sql reads q as a bare ClickHouse predicate, AND-joined under the tenant clamp so it can only narrow — see docs/v2/architecture/TELEMETRY_INGESTION_ARCHITECTURE.md §9.3.1.

Repeatable, index-aligned with 'attribute_value' (issue #331): the i-th key pairs with the i-th value. Values sharing a key OR together; distinct keys AND together. A single (key, value) pair is unchanged from before this field was repeatable.

Paired with 'attribute_key' — see its description.

Same shape as 'attribute_key', negated — pairs with 'attribute_value_exclude'. A key excluded here is excluded even if the same key/value also appears in 'attribute_key'/'attribute_value'.

Paired with 'attribute_key_exclude' — see its description.

Narrow to one Event Patterns cluster (#179). Pass a pattern_hash from the patterns endpoint back verbatim — it is a UInt64 carried as a string because the larger values exceed JavaScript's Number.MAX_SAFE_INTEGER. The hash is derived from the message, not stored, so a value produced before a change to the mask list will match nothing; see §9.11.

Comma-separated column projection (§9.9, issue #356), e.g. 'service_name,body'. 'row_id' is always included. Absent returns the full row, unchanged from before this parameter existed.

' asc|desc' (§9.9, issue #356). Only 'timestamp' is sortable — the keyset cursor is typed against it. Absent means 'timestamp desc', unchanged from before this parameter existed.

Repeatable — values OR together (e.g. two occurrences match either service). A single occurrence is unchanged from before this field was repeatable (issue #331).

Same shape as 'service_name', negated: excludes rows matching any of these values. If a value appears in both 'service_name' and this field, it is excluded — exclude always wins on conflict.

Repeatable (issue #331) — same semantics as 'service_name'. Case-insensitive, matches the canonical severity (§9.1).

Same shape as 'severity_text', negated — same semantics as 'service_name_exclude'.

Language q is written in (#177). lucene is the default and what every request omitting this field gets. sql reads q as a bare ClickHouse predicate, AND-joined under the tenant clamp so it can only narrow — see docs/v2/architecture/TELEMETRY_INGESTION_ARCHITECTURE.md §9.3.1.

Repeatable, index-aligned with 'attribute_value' (issue #331): the i-th key pairs with the i-th value. Values sharing a key OR together; distinct keys AND together. A single (key, value) pair is unchanged from before this field was repeatable.

Paired with 'attribute_key' — see its description.

Same shape as 'attribute_key', negated — pairs with 'attribute_value_exclude'. A key excluded here is excluded even if the same key/value also appears in 'attribute_key'/'attribute_value'.

Paired with 'attribute_key_exclude' — see its description.

Narrow to one Event Patterns cluster (#179). Pass a pattern_hash from the patterns endpoint back verbatim — it is a UInt64 carried as a string because the larger values exceed JavaScript's Number.MAX_SAFE_INTEGER. The hash is derived from the message, not stored, so a value produced before a change to the mask list will match nothing; see §9.11.

Repeatable — values OR together (e.g. two occurrences match either service). A single occurrence is unchanged from before this field was repeatable (issue #331).

Same shape as 'service_name', negated: excludes rows matching any of these values. If a value appears in both 'service_name' and this field, it is excluded — exclude always wins on conflict.

Repeatable (issue #331) — same semantics as 'service_name'. Case-insensitive, matches the canonical severity (§9.1).

Same shape as 'severity_text', negated — same semantics as 'service_name_exclude'.

Language q is written in (#177). lucene is the default and what every request omitting this field gets. sql reads q as a bare ClickHouse predicate, AND-joined under the tenant clamp so it can only narrow — see docs/v2/architecture/TELEMETRY_INGESTION_ARCHITECTURE.md §9.3.1.

Repeatable, index-aligned with 'attribute_value' (issue #331): the i-th key pairs with the i-th value. Values sharing a key OR together; distinct keys AND together. A single (key, value) pair is unchanged from before this field was repeatable.

Paired with 'attribute_key' — see its description.

Same shape as 'attribute_key', negated — pairs with 'attribute_value_exclude'. A key excluded here is excluded even if the same key/value also appears in 'attribute_key'/'attribute_value'.

Paired with 'attribute_key_exclude' — see its description.

Narrow to one Event Patterns cluster (#179). Pass a pattern_hash from the patterns endpoint back verbatim — it is a UInt64 carried as a string because the larger values exceed JavaScript's Number.MAX_SAFE_INTEGER. The hash is derived from the message, not stored, so a value produced before a change to the mask list will match nothing; see §9.11.

Group per-bucket counts by severity_text

Repeatable — values OR together (e.g. two occurrences match either service). A single occurrence is unchanged from before this field was repeatable (issue #331).

Same shape as 'service_name', negated: excludes rows matching any of these values. If a value appears in both 'service_name' and this field, it is excluded — exclude always wins on conflict.

Repeatable (issue #331) — same semantics as 'service_name'. Case-insensitive, matches the canonical severity (§9.1).

Same shape as 'severity_text', negated — same semantics as 'service_name_exclude'.

Language q is written in (#177). lucene is the default and what every request omitting this field gets. sql reads q as a bare ClickHouse predicate, AND-joined under the tenant clamp so it can only narrow — see docs/v2/architecture/TELEMETRY_INGESTION_ARCHITECTURE.md §9.3.1.

Repeatable, index-aligned with 'attribute_value' (issue #331): the i-th key pairs with the i-th value. Values sharing a key OR together; distinct keys AND together. A single (key, value) pair is unchanged from before this field was repeatable.

Paired with 'attribute_key' — see its description.

Same shape as 'attribute_key', negated — pairs with 'attribute_value_exclude'. A key excluded here is excluded even if the same key/value also appears in 'attribute_key'/'attribute_value'.

Paired with 'attribute_key_exclude' — see its description.

Narrow to one Event Patterns cluster (#179). Pass a pattern_hash from the patterns endpoint back verbatim — it is a UInt64 carried as a string because the larger values exceed JavaScript's Number.MAX_SAFE_INTEGER. The hash is derived from the message, not stored, so a value produced before a change to the mask list will match nothing; see §9.11.

Max attribute values returned per attribute key

Repeatable — values OR together (e.g. two occurrences match either service). A single occurrence is unchanged from before this field was repeatable (issue #331).

Same shape as 'service_name', negated: excludes rows matching any of these values. If a value appears in both 'service_name' and this field, it is excluded — exclude always wins on conflict.

Repeatable (issue #331) — same semantics as 'service_name'. Case-insensitive, matches the canonical severity (§9.1).

Same shape as 'severity_text', negated — same semantics as 'service_name_exclude'.

Language q is written in (#177). lucene is the default and what every request omitting this field gets. sql reads q as a bare ClickHouse predicate, AND-joined under the tenant clamp so it can only narrow — see docs/v2/architecture/TELEMETRY_INGESTION_ARCHITECTURE.md §9.3.1.

Repeatable, index-aligned with 'attribute_value' (issue #331): the i-th key pairs with the i-th value. Values sharing a key OR together; distinct keys AND together. A single (key, value) pair is unchanged from before this field was repeatable.

Paired with 'attribute_key' — see its description.

Same shape as 'attribute_key', negated — pairs with 'attribute_value_exclude'. A key excluded here is excluded even if the same key/value also appears in 'attribute_key'/'attribute_value'.

Paired with 'attribute_key_exclude' — see its description.

Max patterns returned, most frequent first.

The same log record's list-view timestamp — required for partition pruning (otel_logs is PARTITION BY toDate, §8.2); row_id alone is not indexed.

Exact metric_name — required, one metric per request.

Fixed enum: sum, avg, min, max, count, quantile — never caller-supplied SQL (ADR-0016). 'quantile' additionally requires 'quantile'.

Required iff aggregation='quantile' — a fraction in [0, 1] (e.g. 0.95), matching the console query language's 'quantile(metric, threshold)' format (#482).

One or more otel_metrics.labels keys (repeatable) — one series per distinct combination of values actually present in the range. Absent returns one ungrouped series with empty labels.

Repeatable label filter (issue #1329's console enabler) — each entry is 'key=value' (equality) or 'key!=value' (inequality) over the same otel_metrics.labels key space 'group_by' accepts. Multiple entries AND together. Split at the FIRST '=' in the entry: if the character immediately before it is '!', the operator is '!=' and the key ends there; otherwise the operator is '=' and the key ends at the '='. Everything after that first '=' is the value, so a value may itself contain '=' and '!=' and still round-trip exactly — 'region!=eu=west' means key 'region', operator '!=', value 'eu=west'; 'region=a!=b' means key 'region', operator '=', value 'a!=b'. A key may not itself contain '=' or '!' immediately before an '='. An empty value ('region=') is a valid empty-string filter; an entry with no '=' at all, or an empty key, is a validation failure. Applied before aggregation and grouping, so a filtered 'group_by' returns only the surviving series.

Exact metric_name — required, one metric per request.

Exact metric_name — required, one metric per request.

Label key to enumerate values for — required. Use .../metrics/label-keys to discover it.

Max values returned, by count.