fix: removed print

Body-JSON array functions hasAny/hasAll (string + numeric arrays) succeed in
JSON-body mode (body_v2 -> ClickHouse Array via dynamicElement), complementing
the legacy-mode xfail in querierlogs/09. Verified on ClickHouse 25.12.5.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Rt2Xi6TdBDBAc3mhYZAb9q

.github/workflows/integrationci.yaml

@@ -48,7 +48,11 @@ jobs:
           - logspipelines
           - passwordauthn
           - preference
-          - querier
+          - querierlogs
+          - queriertraces
+          - queriermetrics
+          - querierscalar
+          - queriercommon
           - rawexportdata
           - role
           - rootuser

frontend/src/pages/DashboardPageV2/DashboardContainer/PanelEditor/Header/Header.tsx

@@ -11,14 +11,18 @@ import styles from './Header.module.scss';
 interface HeaderProps {
 	isDirty: boolean;
 	isSaving: boolean;
+	showSwitchToView?: boolean;
 	onSave: () => void;
+	onSwitchToView?: () => void;
 	onClose: () => void;
 }
 
 function Header({
 	isDirty,
 	isSaving,
+	showSwitchToView = false,
 	onSave,
+	onSwitchToView,
 	onClose,
 }: HeaderProps): JSX.Element {
 	const discard = useConfirmableAction(
@@ -49,6 +53,16 @@ function Header({
 				<Typography.Text>Configure panel</Typography.Text>
 			</div>
 			<div className={styles.actions}>
+				{showSwitchToView && (
+					<Button
+						variant="outlined"
+						color="secondary"
+						data-testid="panel-editor-v2-switch-to-view"
+						onClick={onSwitchToView}
+					>
+						Switch to View Mode
+					</Button>
+				)}
 				<Button
 					variant="solid"
 					color="primary"

frontend/src/pages/DashboardPageV2/DashboardContainer/PanelEditor/PreviewPane/PreviewPane.tsx

@@ -5,6 +5,7 @@ import { PanelMode } from 'container/DashboardContainer/visualization/panels/typ
 import DateTimeSelectionV2 from 'container/TopNav/DateTimeSelectionV2';
 import PanelBody from 'pages/DashboardPageV2/DashboardContainer/PanelsAndSectionsLayout/Panel/PanelBody/PanelBody';
 import PanelHeader from 'pages/DashboardPageV2/DashboardContainer/PanelsAndSectionsLayout/Panel/PanelHeader/PanelHeader';
+import type { AnyPanelInteractionProps } from 'pages/DashboardPageV2/DashboardContainer/Panels/types/interactions';
 import type { RenderablePanelDefinition } from 'pages/DashboardPageV2/DashboardContainer/Panels/types/panelDefinition';
 import { PANEL_KIND_TO_PANEL_TYPE } from 'pages/DashboardPageV2/DashboardContainer/Panels/types/panelKind';
 import type { DashboardPreference } from 'pages/DashboardPageV2/DashboardContainer/Panels/types/rendererProps';
@@ -42,6 +43,10 @@ interface PreviewPaneProps {
 	dashboardPreference?: DashboardPreference;
 	/** Close the standalone View modal — forwarded to the time-series/bar graph manager. */
 	onCloseStandaloneView?: () => void;
+	/** Opens the drill-down context menu; only the View modal wires it (the editor preview omits it). */
+	onClick?: AnyPanelInteractionProps['onClick'];
+	/** Arms the drill-down click on interactive renderers — the View modal enables it, the editor doesn't. */
+	enableDrillDown?: boolean;
 }
 
 /**
@@ -64,6 +69,8 @@ function PreviewPane({
 	hideHeader = false,
 	dashboardPreference,
 	onCloseStandaloneView,
+	onClick,
+	enableDrillDown,
 }: PreviewPaneProps): JSX.Element {
 	const panelType = PANEL_KIND_TO_PANEL_TYPE[panel.spec.plugin.kind];
 	const queryType = getPanelQueryType(panel);
@@ -119,6 +126,8 @@ function PreviewPane({
 						searchTerm={searchable ? searchTerm : undefined}
 						pagination={pagination}
 						onCloseStandaloneView={onCloseStandaloneView}
+						onClick={onClick}
+						enableDrillDown={enableDrillDown}
 					/>
 				</div>
 			</div>

frontend/src/pages/DashboardPageV2/DashboardContainer/PanelEditor/__tests__/PanelEditorContainer.test.tsx

@@ -48,6 +48,10 @@ jest.mock('../hooks/usePanelEditorSave', () => ({
 jest.mock('../hooks/useSwitchColumnsOnSignalChange', () => ({
 	useSwitchColumnsOnSignalChange: jest.fn(),
 }));
+const mockOnSwitchToView = jest.fn();
+jest.mock('../hooks/useSwitchToViewMode', () => ({
+	useSwitchToViewMode: (): (() => void) => mockOnSwitchToView,
+}));
 jest.mock('../hooks/useSeedNewListColumns', () => ({
 	useSeedNewListColumns: jest.fn(),
 }));
@@ -138,13 +142,16 @@ jest.mock('../ListColumnsEditor/ListColumnsEditor', () => ({
 	default: (): JSX.Element => <div data-testid="list-columns" />,
 }));
 
-function makePanel(kind: string): DashboardtypesPanelDTO {
+function makePanel(
+	kind: string,
+	queries: unknown[] = [],
+): DashboardtypesPanelDTO {
 	return {
 		kind: 'Panel',
 		spec: {
 			display: { name: 'CPU' },
 			plugin: { kind, spec: {} },
-			queries: [],
+			queries,
 		},
 	} as unknown as DashboardtypesPanelDTO;
 }
@@ -159,12 +166,13 @@ const baseProps = {
 function setup(
 	panel: DashboardtypesPanelDTO,
 	overrides?: Partial<React.ComponentProps<typeof PanelEditorContainer>>,
+	draftOverrides?: { isSpecDirty?: boolean },
 ): void {
 	mockUseDraft.mockReturnValue({
 		draft: panel,
 		spec: panel.spec,
 		setSpec: mockSetSpec,
-		isSpecDirty: false,
+		isSpecDirty: draftOverrides?.isSpecDirty ?? false,
 	});
 	mockUseQuery.mockReturnValue({
 		data: { response: undefined },
@@ -240,12 +248,38 @@ describe('PanelEditorContainer composition', () => {
 		);
 	});
 
-	it('marks a new panel dirty and always serializes its query', () => {
+	it('keeps a query-less new panel unsaveable but still serializes its seed query', () => {
 		setup(makePanel('signoz/TimeSeriesPanel'), { isNew: true });
 
 		expect(mockUseQuerySync).toHaveBeenCalledWith(
 			expect.objectContaining({ alwaysSerializeQuery: true }),
 		);
+		// No query and no edits yet → nothing to save, so Save stays disabled.
+		expect(mockHeaderProps).toHaveBeenCalledWith(
+			expect.objectContaining({ isDirty: false }),
+		);
+	});
+
+	it('marks a new panel that already has a query saveable (e.g. list auto-runs one)', () => {
+		const seededQuery = {
+			spec: { plugin: { kind: 'signoz/BuilderQuery', spec: { signal: 'logs' } } },
+		};
+		setup(makePanel('signoz/ListPanel', [seededQuery]), { isNew: true });
+
+		expect(mockHeaderProps).toHaveBeenCalledWith(
+			expect.objectContaining({ isDirty: true }),
+		);
+	});
+
+	it('marks a new panel dirty once the user edits its spec', () => {
+		setup(
+			makePanel('signoz/TimeSeriesPanel'),
+			{ isNew: true },
+			{
+				isSpecDirty: true,
+			},
+		);
+
 		expect(mockHeaderProps).toHaveBeenCalledWith(
 			expect.objectContaining({ isDirty: true }),
 		);
@@ -258,10 +292,30 @@ describe('PanelEditorContainer composition', () => {
 		await userEvent.click(screen.getByTestId('editor-save'));
 
 		await waitFor(() => expect(baseProps.onSaved).toHaveBeenCalled());
+
 		expect(mockBuildSaveSpec).toHaveBeenCalledWith(panel.spec);
 		expect(mockSave).toHaveBeenCalledWith(panel.spec);
 	});
 
+	it('offers Switch to View Mode for an existing panel', () => {
+		setup(makePanel('signoz/TimeSeriesPanel'));
+
+		expect(mockHeaderProps).toHaveBeenCalledWith(
+			expect.objectContaining({
+				showSwitchToView: true,
+				onSwitchToView: expect.any(Function),
+			}),
+		);
+	});
+
+	it('hides Switch to View Mode for a new (unsaved) panel', () => {
+		setup(makePanel('signoz/TimeSeriesPanel'), { isNew: true });
+
+		expect(mockHeaderProps).toHaveBeenCalledWith(
+			expect.objectContaining({ showSwitchToView: false }),
+		);
+	});
+
 	it('renders the list-columns editor only for list panels', () => {
 		setup(makePanel('signoz/ListPanel'));
 		expect(screen.getByTestId('list-columns')).toBeInTheDocument();

frontend/src/pages/DashboardPageV2/DashboardContainer/PanelEditor/hooks/__tests__/useSwitchToViewMode.test.ts

@@ -0,0 +1,64 @@
+import { renderHook } from '@testing-library/react';
+import { PANEL_TYPES } from 'constants/queryBuilder';
+import type { Query } from 'types/api/queryBuilder/queryBuilderData';
+
+import { useSwitchToViewMode } from '../useSwitchToViewMode';
+
+const mockSafeNavigate = jest.fn();
+jest.mock('hooks/useSafeNavigate', () => ({
+	useSafeNavigate: (): { safeNavigate: jest.Mock } => ({
+		safeNavigate: mockSafeNavigate,
+	}),
+}));
+
+let mockSearch = '';
+jest.mock('hooks/useUrlQuery', () => ({
+	__esModule: true,
+	default: (): URLSearchParams => new URLSearchParams(mockSearch),
+}));
+
+const query = { queryType: 'builder' } as unknown as Query;
+
+describe('useSwitchToViewMode', () => {
+	beforeEach(() => {
+		jest.clearAllMocks();
+		mockSearch = '';
+	});
+
+	function invoke(): void {
+		const { result } = renderHook(() =>
+			useSwitchToViewMode({
+				dashboardId: 'dash-1',
+				panelId: 'panel-1',
+				panelType: PANEL_TYPES.TIME_SERIES,
+				query,
+			}),
+		);
+		result.current();
+	}
+
+	it('opens the dashboard with the View modal seeded from the live query', () => {
+		invoke();
+
+		expect(mockSafeNavigate).toHaveBeenCalledTimes(1);
+		const target = new URL(mockSafeNavigate.mock.calls[0][0], 'http://x');
+		expect(target.pathname).toBe('/dashboard/dash-1');
+		expect(target.searchParams.get('expandedWidgetId')).toBe('panel-1');
+		expect(target.searchParams.get('graphType')).toBe(PANEL_TYPES.TIME_SERIES);
+		expect(
+			JSON.parse(
+				decodeURIComponent(target.searchParams.get('compositeQuery') || ''),
+			),
+		).toStrictEqual(query);
+	});
+
+	it('carries dashboard variables through and drops other editor URL state', () => {
+		mockSearch = 'variables=%7B%22a%22%3A1%7D&compositeQuery=stale';
+		invoke();
+
+		const target = new URL(mockSafeNavigate.mock.calls[0][0], 'http://x');
+		expect(target.searchParams.get('variables')).toBe('{"a":1}');
+		// The stale editor query is replaced with the live one, not the URL leftover.
+		expect(target.searchParams.get('compositeQuery')).not.toBe('stale');
+	});
+});

frontend/src/pages/DashboardPageV2/DashboardContainer/PanelEditor/hooks/useSwitchToViewMode.ts

@@ -0,0 +1,46 @@
+import { useCallback } from 'react';
+import { generatePath } from 'react-router-dom';
+import { QueryParams } from 'constants/query';
+import type { PANEL_TYPES } from 'constants/queryBuilder';
+import ROUTES from 'constants/routes';
+import { useSafeNavigate } from 'hooks/useSafeNavigate';
+import useUrlQuery from 'hooks/useUrlQuery';
+import type { Query } from 'types/api/queryBuilder/queryBuilderData';
+
+interface UseSwitchToViewModeArgs {
+	dashboardId: string;
+	panelId: string;
+	panelType: PANEL_TYPES;
+	query: Query;
+}
+
+/**
+ * Callback that leaves the editor for the dashboard with this panel expanded in the
+ * View modal, seeded with the live (un-saved) query — V1's "Switch to View Mode".
+ */
+export function useSwitchToViewMode({
+	dashboardId,
+	panelId,
+	panelType,
+	query,
+}: UseSwitchToViewModeArgs): () => void {
+	const { safeNavigate } = useSafeNavigate();
+	const urlQuery = useUrlQuery();
+
+	return useCallback((): void => {
+		const params = new URLSearchParams();
+		const variables = urlQuery.get(QueryParams.variables);
+		if (variables) {
+			params.set(QueryParams.variables, variables);
+		}
+		params.set(QueryParams.expandedWidgetId, panelId);
+		params.set(QueryParams.graphType, panelType);
+		params.set(
+			QueryParams.compositeQuery,
+			encodeURIComponent(JSON.stringify(query)),
+		);
+		safeNavigate(
+			`${generatePath(ROUTES.DASHBOARD, { dashboardId })}?${params.toString()}`,
+		);
+	}, [safeNavigate, urlQuery, dashboardId, panelId, panelType, query]);
+}

frontend/src/pages/DashboardPageV2/DashboardContainer/PanelEditor/index.tsx

@@ -13,6 +13,7 @@ import {
 	TelemetrytypesSignalDTO,
 } from 'api/generated/services/sigNoz.schemas';
 import { useQueryBuilder } from 'hooks/queryBuilder/useQueryBuilder';
+import { PANEL_KIND_TO_PANEL_TYPE } from 'pages/DashboardPageV2/DashboardContainer/Panels/types/panelKind';
 import { getBuilderQueries } from 'pages/DashboardPageV2/DashboardContainer/Panels/utils/getBuilderQueries';
 
 import { getExecStats } from '../queryV5/v5ResponseData';
@@ -28,6 +29,7 @@ import { usePanelEditSession } from './hooks/usePanelEditSession';
 import { usePanelEditorSave } from './hooks/usePanelEditorSave';
 import { useSeedNewListColumns } from './hooks/useSeedNewListColumns';
 import { useSwitchColumnsOnSignalChange } from './hooks/useSwitchColumnsOnSignalChange';
+import { useSwitchToViewMode } from './hooks/useSwitchToViewMode';
 import { useTableColumns } from './hooks/useTableColumns';
 import ListColumnsEditor from './ListColumnsEditor/ListColumnsEditor';
 
@@ -143,9 +145,13 @@ function PanelEditorContainer({
 		onSelectUnit: seedFormattingUnit,
 	});
 
-	// Spec and query dirtiness are tracked independently so query re-serialization
-	// never false-dirties. A new panel is always savable (you're creating it).
-	const isDirty = isNew || isSpecDirty || isQueryDirty;
+	// A new panel is savable once it has a query to run — List auto-seeds one; other
+	// kinds open query-less, so there's nothing to save until the user builds one.
+	const isDirty = useMemo(
+		() => isSpecDirty || isQueryDirty || (isNew && draft.spec.queries.length > 0),
+		[isSpecDirty, isQueryDirty, isNew, draft.spec.queries.length],
+	);
+
 	const isListPanel = panelKind === 'signoz/ListPanel';
 	// The builder-query `signal` literal matches the TelemetrytypesSignalDTO enum
 	// values; cast at this boundary (as ConfigPane does) so the columns editor's
@@ -184,6 +190,13 @@ function PanelEditorContainer({
 		return values.length ? Math.min(...values) : undefined;
 	}, [data.response]);
 
+	const onSwitchToView = useSwitchToViewMode({
+		dashboardId,
+		panelId,
+		panelType: PANEL_KIND_TO_PANEL_TYPE[panelKind],
+		query: currentQuery,
+	});
+
 	const onSave = useCallback(async (): Promise<void> => {
 		try {
 			// Bake the live query into the spec so unstaged edits are saved too.
@@ -200,7 +213,9 @@ function PanelEditorContainer({
 			<Header
 				isDirty={isDirty}
 				isSaving={isSaving}
+				showSwitchToView={!isNew}
 				onSave={onSave}
+				onSwitchToView={onSwitchToView}
 				onClose={onClose}
 			/>
 			<ResizablePanelGroup

frontend/src/pages/DashboardPageV2/DashboardContainer/Panels/kinds/ListPanel/ListPanel.module.scss

@@ -21,6 +21,11 @@
 
 // Logs: drop the row separators for a denser log view (V1 logs table parity).
 .logRows {
+	// Every row opens the log detail drawer, so flag it as clickable.
+	:global(.ant-table-tbody) > tr {
+		cursor: pointer;
+	}
+
 	:global(.ant-table-tbody) > tr > td {
 		border-bottom: none;
 	}

frontend/src/pages/DashboardPageV2/DashboardContainer/Panels/kinds/TablePanel/TablePanel.module.scss

@@ -18,3 +18,11 @@
 		@include custom-scrollbar;
 	}
 }
+
+.clickableCell {
+	cursor: pointer;
+
+	&:hover {
+		color: var(--primary-background);
+	}
+}

frontend/src/pages/DashboardPageV2/DashboardContainer/Panels/kinds/TablePanel/tableColumns.tsx

@@ -10,6 +10,8 @@ import { formatPanelValue } from '../../utils/formatPanelValue';
 import { getColumnUnit } from '../../utils/getColumnUnit';
 import { toPanelThreshold } from '../../utils/mapComparisonThreshold';
 
+import styles from './TablePanel.module.scss';
+
 /** A prepared scalar-table row flattened for the antd Table, with the antd key. */
 export type TableRowData = Record<string, unknown> & { key: number };
 
@@ -120,7 +122,7 @@ export function buildTableColumns({
 				if (onCellClick) {
 					cellProps.onClick = (event): void =>
 						onCellClick({ columnId: key, record, event });
-					cellProps.style = { ...cellProps.style, cursor: 'pointer' };
+					cellProps.className = styles.clickableCell;
 				}
 
 				return cellProps;

frontend/src/pages/DashboardPageV2/DashboardContainer/Panels/types/drilldown.ts

@@ -1,5 +1,7 @@
 import type { TelemetrytypesSignalDTO } from 'api/generated/services/sigNoz.schemas';
+import type { PANEL_TYPES } from 'constants/queryBuilder';
 import type { FilterData } from 'container/QueryTable/Drilldown/drilldownUtils';
+import type { Query } from 'types/api/queryBuilder/queryBuilderData';
 
 // Drilldown is the click-to-context-menu feature ported from V1. Every renderer turns its native
 // click into one `DrilldownClickPayload`; the kind-agnostic orchestration layer consumes only that.
@@ -34,3 +36,13 @@ export interface DrilldownClickPayload {
 	coordinates: { x: number; y: number };
 	context: DrilldownContext;
 }
+
+/**
+ * Opens the View modal on a refined drilldown query (filter-by-value / breakout). In the grid this
+ * navigates to the modal seeded with the query; inside the modal it refines the view in place.
+ */
+export type OpenDrilldownView = (
+	panelId: string,
+	query: Query,
+	panelType: PANEL_TYPES,
+) => void;

frontend/src/pages/DashboardPageV2/DashboardContainer/PanelsAndSectionsLayout/Panel/ViewPanelModal/ViewPanelModalContent.tsx

@@ -2,11 +2,13 @@ import { useMemo } from 'react';
 import type { DashboardtypesPanelDTO } from 'api/generated/services/sigNoz.schemas';
 import { PanelMode } from 'container/DashboardContainer/visualization/panels/types';
 import { DashboardCursorSync } from 'lib/uPlotV2/plugins/TooltipPlugin/types';
+import ContextMenu from 'periscope/components/ContextMenu';
 import PanelEditorQueryBuilder from 'pages/DashboardPageV2/DashboardContainer/PanelEditor/PanelEditorQueryBuilder/PanelEditorQueryBuilder';
 import PreviewPane from 'pages/DashboardPageV2/DashboardContainer/PanelEditor/PreviewPane/PreviewPane';
 import type { DashboardPreference } from 'pages/DashboardPageV2/DashboardContainer/Panels/types/rendererProps';
 import { useOpenPanelEditor } from 'pages/DashboardPageV2/DashboardContainer/hooks/useOpenPanelEditor';
 
+import { useDrilldown } from '../hooks/useDrilldown';
 import { usePanelInteractions } from '../hooks/usePanelInteractions';
 import ViewPanelModalHeader from './ViewPanelModalHeader';
 import { useViewPanelMode } from './useViewPanelMode';
@@ -48,9 +50,16 @@ function ViewPanelModalContent({
 		onChangePanelKind,
 		resetQuery,
 		buildSaveSpec,
+		applyDrilldownQuery,
 	} = useViewPanelMode({ panel, panelId, time: timeOverride });
 	const { data, isFetching, error, refetch, cancelQuery, pagination } = query;
 
+	// Grid drill-down, but filter-by-value / breakout refine this view in place. Drills the draft
+	// so it reflects in-modal edits (and the click's time range follows the per-view window).
+	const drilldown = useDrilldown(draft, panelId, {
+		openDrilldownView: applyDrilldownQuery,
+	});
+
 	// Drag-to-zoom stays inside the modal; opt the chart out of the dashboard's
 	// cursor-sync group so a drag here can't replay onto the grid panels.
 	const { dashboardPreference } = usePanelInteractions();
@@ -115,9 +124,12 @@ function ViewPanelModalContent({
 					panelMode={PanelMode.STANDALONE_VIEW}
 					dashboardPreference={isolatedPreference}
 					onCloseStandaloneView={onClose}
+					onClick={drilldown.onPanelClick}
+					enableDrillDown={drilldown.enableDrillDown}
 					hideHeader
 				/>
 			</div>
+			<ContextMenu {...drilldown.contextMenuProps} />
 		</div>
 	);
 }

frontend/src/pages/DashboardPageV2/DashboardContainer/PanelsAndSectionsLayout/Panel/ViewPanelModal/useViewPanelMode.ts

@@ -10,6 +10,7 @@ import { useGetCompositeQueryParam } from 'hooks/queryBuilder/useGetCompositeQue
 import { useQueryBuilder } from 'hooks/queryBuilder/useQueryBuilder';
 import useUrlQuery from 'hooks/useUrlQuery';
 import { usePanelEditSession } from 'pages/DashboardPageV2/DashboardContainer/PanelEditor/hooks/usePanelEditSession';
+import type { OpenDrilldownView } from 'pages/DashboardPageV2/DashboardContainer/Panels/types/drilldown';
 import type { RenderablePanelDefinition } from 'pages/DashboardPageV2/DashboardContainer/Panels/types/panelDefinition';
 import {
 	PANEL_KIND_TO_PANEL_TYPE,
@@ -56,6 +57,11 @@ export interface UseViewPanelModeReturn {
 	buildSaveSpec: (
 		spec: DashboardtypesPanelSpecDTO,
 	) => DashboardtypesPanelSpecDTO;
+	/**
+	 * Drill-down handoff for filter-by-value / breakout: refine the view in place (persist to the
+	 * URL so it survives refresh, and re-run the preview), rather than opening a new View modal.
+	 */
+	applyDrilldownQuery: OpenDrilldownView;
 }
 
 /**
@@ -101,6 +107,7 @@ export function useViewPanelMode({
 		onChangePanelKind,
 		buildSaveSpec,
 		reset,
+		setSpec,
 	} = usePanelEditSession({ panel: initialPanel, panelId, time });
 
 	// The query the view opened with, captured once — the Reset target.
@@ -119,6 +126,31 @@ export function useViewPanelMode({
 		redirectWithQueryBuilderData(savedQuery);
 	}, [reset, redirectWithQueryBuilderData, savedQuery]);
 
+	// redirectWithQueryBuilderData (not the grid's openViewWithQuery): the cloned query keeps its id,
+	// so the QB provider's `stagedQuery.id === url id` guard would skip a plain URL write. setSpec
+	// commits into the draft too — filter/breakout aren't a structural change, so it won't auto-commit.
+	const applyDrilldownQuery = useCallback<OpenDrilldownView>(
+		(viewPanelId, drilldownQuery, drilldownPanelType): void => {
+			redirectWithQueryBuilderData(
+				drilldownQuery,
+				{
+					[QueryParams.expandedWidgetId]: viewPanelId,
+					[QueryParams.graphType]: drilldownPanelType,
+				},
+				undefined,
+				true,
+			);
+			setSpec(
+				buildViewPanelSpec({
+					spec: draft.spec,
+					query: drilldownQuery,
+					panelType: drilldownPanelType,
+				}),
+			);
+		},
+		[redirectWithQueryBuilderData, setSpec, draft.spec],
+	);
+
 	// Current builder datasource — resolved the same way as the full editor's
 	// ConfigPane so the two selectors stay in sync, then defaulted to the kind's first
 	// signal (PromQL/ClickHouse carry none) so the query builder always has one.
@@ -135,5 +167,6 @@ export function useViewPanelMode({
 		onChangePanelKind,
 		resetQuery,
 		buildSaveSpec,
+		applyDrilldownQuery,
 	};
 }

frontend/src/pages/DashboardPageV2/DashboardContainer/PanelsAndSectionsLayout/Panel/__tests__/ViewPanelModal.test.tsx

@@ -47,10 +47,28 @@ jest.mock('../ViewPanelModal/useViewPanelMode', () => ({
 			resetQuery: jest.fn(),
 			signal: 'logs',
 			buildSaveSpec: (spec: unknown): unknown => spec,
+			applyDrilldownQuery: jest.fn(),
 		};
 	},
 }));
 
+// Drill-down orchestration (popover, submenus, View-in-X) has its own suite
+// (useDrilldown.test.tsx) and pulls in router/redux/react-query; stub it so this
+// suite only asserts that the modal arms the preview and renders the menu host.
+const mockOnPanelClick = jest.fn();
+jest.mock('../hooks/useDrilldown', () => ({
+	useDrilldown: (): unknown => ({
+		enableDrillDown: true,
+		onPanelClick: mockOnPanelClick,
+		contextMenuProps: {
+			coordinates: null,
+			popoverPosition: null,
+			items: null,
+			onClose: jest.fn(),
+		},
+	}),
+}));
+
 // The View modal reuses the edit page's query builder, which reads the global
 // QueryBuilder context and pulls in the ClickHouse/PromQL editors; stub it here.
 jest.mock(
@@ -174,4 +192,23 @@ describe('ViewPanelModal', () => {
 		};
 		expect(props.dashboardPreference?.syncMode).toBe(DashboardCursorSync.None);
 	});
+
+	// Parity with the grid: the View modal arms the same drill-down click on the preview.
+	it('arms drill-down on the preview', () => {
+		mockPreviewPaneRender.mockClear();
+		renderWithProvider(
+			<ViewPanelModal
+				panel={makePanel('signoz/TimeSeriesPanel')}
+				panelId="p1"
+				open
+				onClose={jest.fn()}
+			/>,
+		);
+		const props = mockPreviewPaneRender.mock.calls.at(-1)?.[0] as {
+			onClick?: unknown;
+			enableDrillDown?: boolean;
+		};
+		expect(props.enableDrillDown).toBe(true);
+		expect(props.onClick).toBe(mockOnPanelClick);
+	});
 });

frontend/src/pages/DashboardPageV2/DashboardContainer/PanelsAndSectionsLayout/Panel/hooks/useDrilldown.tsx

@@ -10,6 +10,7 @@ import type {
 import type {
 	DrilldownClickPayload,
 	DrilldownContext,
+	OpenDrilldownView,
 } from 'pages/DashboardPageV2/DashboardContainer/Panels/types/drilldown';
 import { PANEL_KIND_TO_PANEL_TYPE } from 'pages/DashboardPageV2/DashboardContainer/Panels/types/panelKind';
 import { getPanelDefinition } from 'pages/DashboardPageV2/DashboardContainer/Panels/registry';
@@ -54,6 +55,14 @@ export interface UseDrilldownResult {
 	contextMenuProps: DrilldownContextMenuProps;
 }
 
+export interface UseDrilldownOptions {
+	/**
+	 * How filter-by-value / breakout hand off the refined query. Defaults to navigating to the View
+	 * modal (grid); the View modal passes its own handler so those actions refine the view in place.
+	 */
+	openDrilldownView?: OpenDrilldownView;
+}
+
 /**
  * Orchestrates panel drill-down: owns the popover + which submenu is open, and routes the clicked
  * point to the base aggregate menu (View in Logs/Traces), the group filter menu, or the breakout picker.
@@ -61,6 +70,7 @@ export interface UseDrilldownResult {
 export function useDrilldown(
 	panel: DashboardtypesPanelDTO,
 	panelId: string,
+	options?: UseDrilldownOptions,
 ): UseDrilldownResult {
 	const kind = panel.spec.plugin.kind;
 	const panelType = PANEL_KIND_TO_PANEL_TYPE[kind];
@@ -122,7 +132,9 @@ export function useDrilldown(
 		onClose();
 	}, [onClose]);
 
-	const { openViewWithQuery } = useViewPanel();
+	// Default handoff navigates to the View modal (grid); the modal overrides this to refine in place.
+	const { openViewWithQuery: navigateToView } = useViewPanel();
+	const openViewWithQuery = options?.openDrilldownView ?? navigateToView;
 
 	const breakout = useDrilldownBreakout({
 		panelId,

frontend/src/pages/DashboardPageV2/DashboardContainer/hooks/useDashboardFetch.ts

@@ -31,9 +31,15 @@ export interface UseDashboardFetchResult {
 export function useDashboardFetch(
 	dashboardId: string,
 ): UseDashboardFetchResult {
-	const { data, isLoading, isError, error, refetch } = useGetDashboardV2({
-		id: dashboardId,
-	});
+	const { data, isLoading, isError, error, refetch } = useGetDashboardV2(
+		{ id: dashboardId },
+		{
+			// The spec is kept fresh in-cache by optimistic patches (useOptimisticPatch),
+			// so never auto-refetch: it would flash the grid back to server state as
+			// observers mount across the panel tree. Explicit refetch() still works.
+			query: { staleTime: Infinity, refetchOnMount: false },
+		},
+	);
 	const dashboard = data?.data;
 
 	return { dashboard, isLoading, isError, error, refetch };

frontend/src/pages/TraceDetailsV3/SpanDetailsPanel/SpanDetailsPanel.module.scss

@@ -60,6 +60,21 @@
 	}
 }
 
+// The Badge is already pill-rounded, so an 18x18 box renders a circle for a
+// single digit and a capsule for more.
+.eventsBadge {
+	// l3 background (!important beats the Badge's [data-color] rule).
+	--badge-background: var(--l3-background) !important;
+	--badge-padding: 0 5px;
+	// Static count, not interactive — cancel the Badge's hover background change.
+	--badge-hover-background: var(--badge-background) !important;
+
+	margin-left: var(--spacing-3);
+	min-width: 18px;
+	height: 18px;
+	vertical-align: middle;
+}
+
 .tabsScroll {
 	flex: 1;
 	min-height: 0;

frontend/src/pages/TraceDetailsV3/SpanDetailsPanel/SpanDetailsPanel.tsx

@@ -1,4 +1,5 @@
 import { useCallback, useMemo } from 'react';
+import { Badge } from '@signozhq/ui/badge';
 import {
 	TabsContent,
 	TabsList,
@@ -281,6 +282,8 @@ function SpanDetailsContent({
 	// 		.map((key) => ({ key, value: allAttrs[key] }));
 	// }, [selectedSpan]);
 
+	const eventsCount = selectedSpan.events?.length || 0;
+
 	return (
 		<div className={styles.body}>
 			<div className={styles.detailsSection}>
@@ -397,7 +400,12 @@ function SpanDetailsContent({
 							<Bookmark size={14} /> Overview
 						</TabsTrigger>
 						<TabsTrigger value="events" variant="secondary">
-							<ScrollText size={14} /> Events ({selectedSpan.events?.length || 0})
+							<ScrollText size={14} /> Events
+							{eventsCount > 0 && (
+								<Badge color="secondary" className={styles.eventsBadge}>
+									{eventsCount}
+								</Badge>
+							)}
 						</TabsTrigger>
 						<TabsTrigger value="logs" variant="secondary">
 							<List size={14} /> Logs

frontend/src/pages/TraceDetailsV3/TraceDetailsHeader/TraceDetailsHeader.module.scss

@@ -19,6 +19,7 @@
 
 .backBtn {
 	flex-shrink: 0;
+	border: 1px solid var(--l1-border);
 }
 
 .traceIdSection {
@@ -26,6 +27,11 @@
 	align-items: center;
 	gap: 8px;
 	flex-shrink: 0;
+
+	// Tabular figures so the trace ID's digits line up at a fixed width.
+	:global(.key-value-label__value) {
+		font-variant-numeric: tabular-nums;
+	}
 }
 
 .filterSection {

frontend/src/pages/TraceDetailsV3/TraceDetailsHeader/TraceDetailsHeader.tsx

@@ -133,7 +133,7 @@ function TraceDetailsHeader({
 						<Button
 							variant="solid"
 							color="secondary"
-							size="md"
+							size="icon"
 							className={styles.backBtn}
 							onClick={handlePreviousBtnClick}
 							aria-label="Back"

frontend/src/pages/TraceDetailsV3/TraceWaterfall/TraceWaterfallStates/Success/Filters/Filters.tsx

@@ -1,10 +1,8 @@
 import { useCallback, useRef, useState } from 'react';
 import { useHistory, useLocation } from 'react-router-dom';
-import { useCopyToClipboard } from 'react-use';
-import { ChevronsRight, Copy, Search, X } from '@signozhq/icons';
+import { ArrowRightFromLine, Search, X } from '@signozhq/icons';
 import { Switch } from '@signozhq/ui/switch';
 import { ToggleGroupSimple } from '@signozhq/ui/toggle-group';
-import { toast } from '@signozhq/ui/sonner';
 import { Button } from '@signozhq/ui/button';
 import {
 	TooltipRoot,
@@ -21,6 +19,7 @@ import { initialQueriesMap, PANEL_TYPES } from 'constants/queryBuilder';
 import { useGetQueryRange } from 'hooks/queryBuilder/useGetQueryRange';
 import { uniqBy } from 'lodash-es';
 import NozButton from 'pages/TraceDetailsV3/TraceDetailsHeader/NozButton';
+import CopyButton from 'periscope/components/CopyButton/CopyButton';
 import { DataTypes } from 'types/api/queryBuilder/queryAutocompleteResponse';
 import { Query, TagFilter } from 'types/api/queryBuilder/queryBuilderData';
 import {
@@ -89,7 +88,6 @@ function Filters({
 	onExpand: () => void;
 	onCollapse: () => void;
 }): JSX.Element {
-	const [, setCopy] = useCopyToClipboard();
 	const [filters, setFilters] = useState<TagFilter>(
 		BASE_FILTER_QUERY.filters || { items: [], op: 'AND' },
 	);
@@ -301,20 +299,7 @@ function Filters({
 				<div className={styles.pillPopover}>
 					<div className={styles.pillPopoverHeader}>
 						<Typography.Text>Search query</Typography.Text>
-						<Button
-							variant="ghost"
-							size="icon"
-							color="secondary"
-							onClick={(): void => {
-								setCopy(expression);
-								toast.success('Copied to clipboard', {
-									richColors: false,
-									position: 'top-right',
-								});
-							}}
-						>
-							<Copy size={12} />
-						</Button>
+						<CopyButton value={expression} size={12} />
 					</div>
 					<div className={styles.pillPopoverExpression}>{expression}</div>
 				</div>
@@ -421,7 +406,7 @@ function Filters({
 										color="secondary"
 										onClick={onCollapse}
 									>
-										<ChevronsRight size={14} />
+										<ArrowRightFromLine size={14} />
 									</Button>
 								</TooltipTrigger>
 								<TooltipContent>Collapse filters</TooltipContent>

frontend/src/periscope/components/CopyButton/CopyButton.module.scss

@@ -0,0 +1,52 @@
+// Square copy button whose icon cross-fades between copy and check.
+.copyButton {
+	flex-shrink: 0;
+}
+
+// Both icons occupy the same box; only one is visible at a time.
+.iconStack {
+	position: relative;
+	display: inline-flex;
+	align-items: center;
+	justify-content: center;
+}
+
+.icon {
+	position: absolute;
+	inset: 0;
+	transition:
+		opacity 300ms ease,
+		filter 300ms ease,
+		transform 300ms ease;
+}
+
+// Idle state: copy visible, check blurred/rotated/faded out.
+.copyIcon {
+	opacity: 1;
+	filter: blur(0);
+	transform: rotate(0deg);
+}
+
+.checkIcon {
+	opacity: 0;
+	filter: blur(4px);
+	transform: rotate(-90deg);
+	// Green checkmark to signal a successful copy; eases in a touch slower.
+	color: var(--bg-forest-500);
+	transition-duration: 500ms;
+}
+
+// Copied state: copy fades/blurs/rotates out, check animates in.
+.iconStack[data-copied='true'] {
+	.copyIcon {
+		opacity: 0;
+		filter: blur(4px);
+		transform: rotate(90deg);
+	}
+
+	.checkIcon {
+		opacity: 1;
+		filter: blur(0);
+		transform: rotate(0deg);
+	}
+}

frontend/src/periscope/components/CopyButton/CopyButton.tsx

@@ -0,0 +1,66 @@
+import { CSSProperties, useCallback } from 'react';
+import { Check, Copy } from '@signozhq/icons';
+import { Button } from '@signozhq/ui/button';
+import cx from 'classnames';
+import { useCopyToClipboard } from 'hooks/useCopyToClipboard';
+
+import styles from './CopyButton.module.scss';
+
+export interface CopyButtonProps {
+	/** Text written to the clipboard on click. */
+	value: string;
+	/** Icon size in px. Default 14. */
+	size?: number;
+	/** Accessible label for the idle (not-yet-copied) state. Default "Copy". */
+	ariaLabel?: string;
+	/** Extra class merged onto the button. */
+	className?: string;
+	testId?: string;
+}
+
+/**
+ * Square, icon-only copy button. Shows a copy icon that cross-fades to a
+ * checkmark (blur + rotate + fade) on copy, reverting after 2s. The checkmark
+ * uses the hover-state icon colour.
+ */
+function CopyButton({
+	value,
+	size = 14,
+	ariaLabel = 'Copy',
+	className,
+	testId,
+}: CopyButtonProps): JSX.Element {
+	const { copyToClipboard, isCopied } = useCopyToClipboard();
+
+	const handleClick = useCallback((): void => {
+		copyToClipboard(value);
+	}, [copyToClipboard, value]);
+
+	const stackStyle: CSSProperties = { width: size, height: size };
+
+	return (
+		<Button
+			variant="ghost"
+			color="secondary"
+			size="icon"
+			className={cx(styles.copyButton, className)}
+			onClick={handleClick}
+			aria-label={isCopied ? 'Copied' : ariaLabel}
+			testId={testId}
+		>
+			<span className={styles.iconStack} style={stackStyle} data-copied={isCopied}>
+				<Copy size={size} className={cx(styles.icon, styles.copyIcon)} />
+				<Check size={size} className={cx(styles.icon, styles.checkIcon)} />
+			</span>
+		</Button>
+	);
+}
+
+CopyButton.defaultProps = {
+	size: 14,
+	ariaLabel: 'Copy',
+	className: undefined,
+	testId: undefined,
+};
+
+export default CopyButton;

frontend/src/periscope/components/DataViewer/DataViewer.styles.scss

@@ -22,23 +22,6 @@
 		--dropdown-menu-content-z-index: 1000;
 	}
 
-	&__copy-btn {
-		display: flex;
-		align-items: center;
-		justify-content: center;
-		padding: 4px 8px;
-		border: 1px solid var(--l2-border);
-		border-radius: 4px;
-		background: transparent;
-		color: var(--l2-foreground);
-		cursor: pointer;
-
-		&:hover {
-			color: var(--l1-foreground);
-			background: var(--l3-background);
-		}
-	}
-
 	// Shared content container — no scroll, each view handles its own
 	&__content {
 		flex: 1;

frontend/src/periscope/components/DataViewer/DataViewer.tsx

@@ -1,13 +1,11 @@
 import { useMemo, useState } from 'react';
-import { useCopyToClipboard } from 'react-use';
-import { ChevronDown, Copy } from '@signozhq/icons';
+import { ChevronDown } from '@signozhq/icons';
 import { Button } from '@signozhq/ui/button';
 import { DropdownMenuSimple as Dropdown } from '@signozhq/ui/dropdown-menu';
-import { toast } from '@signozhq/ui/sonner';
 import logEvent from 'api/common/logEvent';
+import CopyButton from 'periscope/components/CopyButton/CopyButton';
 import { JsonView } from 'periscope/components/JsonView';
-import { PrettyView } from 'periscope/components/PrettyView';
-import { PrettyViewProps } from 'periscope/components/PrettyView';
+import { PrettyView, PrettyViewProps } from 'periscope/components/PrettyView';
 
 import './DataViewer.styles.scss';
 
@@ -33,7 +31,6 @@ function DataViewer({
 	prettyViewProps,
 }: DataViewerProps): JSX.Element {
 	const [viewMode, setViewMode] = useState<ViewMode>('pretty');
-	const [, setCopy] = useCopyToClipboard();
 
 	const jsonString = useMemo(() => JSON.stringify(data, null, 2), [data]);
 
@@ -51,14 +48,6 @@ function DataViewer({
 		}
 	};
 
-	const handleCopy = (): void => {
-		const text = JSON.stringify(data, null, 2);
-		setCopy(text);
-		toast.success('Copied to clipboard', {
-			position: 'top-right',
-		});
-	};
-
 	const currentLabel =
 		VIEW_MODE_OPTIONS.find((opt) => opt.value === viewMode)?.label ?? 'Pretty';
 
@@ -94,14 +83,7 @@ function DataViewer({
 						{currentLabel}
 					</Button>
 				</Dropdown>
-				<button
-					type="button"
-					className="data-viewer__copy-btn"
-					onClick={handleCopy}
-					aria-label="Copy JSON"
-				>
-					<Copy size={14} />
-				</button>
+				<CopyButton value={jsonString} ariaLabel="Copy JSON" />
 			</div>
 
 			<div className="data-viewer__content">

tests/fixtures/querier.py

@@ -950,3 +950,25 @@ def generate_traces_with_corrupt_metadata() -> list[Traces]:
             },
         ),
     ]
+
+
+def make_scalar_query_request(
+    signoz: types.SigNoz,
+    token: str,
+    now: datetime,
+    queries: list[dict],
+    lookback_minutes: int = 5,
+) -> requests.Response:
+    return requests.post(
+        signoz.self.host_configs["8080"].get("/api/v5/query_range"),
+        timeout=5,
+        headers={"authorization": f"Bearer {token}"},
+        json={
+            "schemaVersion": "v1",
+            "start": int((now - timedelta(minutes=lookback_minutes)).timestamp() * 1000),
+            "end": int(now.timestamp() * 1000),
+            "requestType": "scalar",
+            "compositeQuery": {"queries": queries},
+            "formatOptions": {"formatTableResultForUI": True, "fillGaps": False},
+        },
+    )

tests/integration/tests/querier/06_order_by_table_querier.py

@@ -1,928 +0,0 @@
-from collections.abc import Callable
-from datetime import UTC, datetime, timedelta
-from http import HTTPStatus
-
-import requests
-
-from fixtures import querier, types
-from fixtures.auth import USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD
-from fixtures.logs import Logs
-from fixtures.metrics import Metrics
-from fixtures.traces import TraceIdGenerator, Traces, TracesKind, TracesStatusCode
-
-log_or_trace_service_counts = {
-    "service-a": 5,
-    "service-b": 3,
-    "service-c": 7,
-    "service-d": 1,
-}
-
-metric_values_for_test = {
-    "service-a": 50.0,
-    "service-b": 30.0,
-    "service-c": 70.0,
-    "service-d": 10.0,
-}
-
-
-def generate_logs_with_counts(
-    now: datetime,
-    service_counts: dict[str, int],
-) -> list[Logs]:
-    logs = []
-    for service, count in service_counts.items():
-        for i in range(count):
-            logs.append(
-                Logs(
-                    timestamp=now - timedelta(seconds=i + 1),
-                    resources={"service.name": service},
-                    body=f"{service} log {i}",
-                )
-            )
-    return logs
-
-
-def generate_traces_with_counts(
-    now: datetime,
-    service_counts: dict[str, int],
-) -> list[Traces]:
-    traces = []
-    for service, count in service_counts.items():
-        for i in range(count):
-            trace_id = TraceIdGenerator.trace_id()
-            span_id = TraceIdGenerator.span_id()
-            traces.append(
-                Traces(
-                    timestamp=now - timedelta(seconds=i + 1),
-                    kind=TracesKind.SPAN_KIND_SERVER,
-                    status_code=TracesStatusCode.STATUS_CODE_OK,
-                    trace_id=trace_id,
-                    span_id=span_id,
-                    resources={"service.name": service},
-                    name=f"{service} span {i}",
-                )
-            )
-    return traces
-
-
-def generate_metrics_with_values(
-    now: datetime,
-    service_values: dict[str, float],
-) -> list[Metrics]:
-    metrics = []
-    for service, value in service_values.items():
-        metrics.append(
-            Metrics(
-                metric_name="test.metric",
-                labels={"service.name": service},
-                timestamp=now - timedelta(seconds=1),
-                temporality="Unspecified",
-                type_="Gauge",
-                is_monotonic=False,
-                value=value,
-            )
-        )
-    return metrics
-
-
-def make_scalar_query_request(
-    signoz: types.SigNoz,
-    token: str,
-    now: datetime,
-    queries: list[dict],
-    lookback_minutes: int = 5,
-) -> requests.Response:
-    return requests.post(
-        signoz.self.host_configs["8080"].get("/api/v5/query_range"),
-        timeout=5,
-        headers={"authorization": f"Bearer {token}"},
-        json={
-            "schemaVersion": "v1",
-            "start": int((now - timedelta(minutes=lookback_minutes)).timestamp() * 1000),
-            "end": int(now.timestamp() * 1000),
-            "requestType": "scalar",
-            "compositeQuery": {"queries": queries},
-            "formatOptions": {"formatTableResultForUI": True, "fillGaps": False},
-        },
-    )
-
-
-def build_logs_query(
-    name: str = "A",
-    aggregations: list[str] | None = None,
-    group_by: list[str] | None = None,
-    order_by: list[tuple[str, str]] | None = None,
-    limit: int | None = None,
-) -> dict:
-    if aggregations is None:
-        aggregations = ["count()"]
-
-    aggs = [querier.build_logs_aggregation(expr) for expr in aggregations]
-    gb = [querier.build_group_by_field(f, "string", "resource") for f in group_by] if group_by else None
-    order = [querier.build_order_by(name, direction) for name, direction in order_by] if order_by else None
-
-    return querier.build_scalar_query(
-        name=name,
-        signal="logs",
-        aggregations=aggs,
-        group_by=gb,
-        order=order,
-        limit=limit,
-    )
-
-
-def build_traces_query(
-    name: str = "A",
-    aggregations: list[str] | None = None,
-    group_by: list[str] | None = None,
-    order_by: list[tuple[str, str]] | None = None,
-    limit: int | None = None,
-) -> dict:
-    if aggregations is None:
-        aggregations = ["count()"]
-
-    aggs = [querier.build_logs_aggregation(expr) for expr in aggregations]
-    gb = [querier.build_group_by_field(f, "string", "resource") for f in group_by] if group_by else None
-    order = [querier.build_order_by(name, direction) for name, direction in order_by] if order_by else None
-
-    return querier.build_scalar_query(
-        name=name,
-        signal="traces",
-        aggregations=aggs,
-        group_by=gb,
-        order=order,
-        limit=limit,
-    )
-
-
-def build_metrics_query(
-    name: str = "A",
-    metric_name: str = "test.metric",
-    time_aggregation: str = "latest",
-    space_aggregation: str = "sum",
-    group_by: list[str] | None = None,
-    order_by: list[tuple[str, str]] | None = None,
-    limit: int | None = None,
-) -> dict:
-    aggs = [querier.build_metrics_aggregation(metric_name, time_aggregation, space_aggregation, "unspecified")]
-    gb = [querier.build_group_by_field(f, "string", "attribute") for f in group_by] if group_by else None
-    order = [querier.build_order_by(name, direction) for name, direction in order_by] if order_by else None
-
-    return querier.build_scalar_query(
-        name=name,
-        signal="metrics",
-        aggregations=aggs,
-        group_by=gb,
-        order=order,
-        limit=limit,
-    )
-
-
-def test_logs_scalar_group_by_single_agg_no_order(
-    signoz: types.SigNoz,
-    create_user_admin: None,  # pylint: disable=unused-argument
-    get_token: Callable[[str, str], str],
-    insert_logs: Callable[[list[Logs]], None],
-) -> None:
-    now = datetime.now(tz=UTC).replace(second=0, microsecond=0)
-    insert_logs(generate_logs_with_counts(now, log_or_trace_service_counts))
-
-    token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
-    response = make_scalar_query_request(
-        signoz,
-        token,
-        now,
-        [build_logs_query(group_by=["service.name"])],
-    )
-
-    assert response.status_code == HTTPStatus.OK
-    assert response.json()["status"] == "success"
-
-    data = querier.get_scalar_table_data(response.json())
-    querier.assert_scalar_result_order(
-        data,
-        [("service-c", 7), ("service-a", 5), ("service-b", 3), ("service-d", 1)],
-        "Logs no order - default desc",
-    )
-
-
-def test_logs_scalar_group_by_single_agg_order_by_agg_asc(
-    signoz: types.SigNoz,
-    create_user_admin: None,  # pylint: disable=unused-argument
-    get_token: Callable[[str, str], str],
-    insert_logs: Callable[[list[Logs]], None],
-) -> None:
-    now = datetime.now(tz=UTC).replace(second=0, microsecond=0)
-    insert_logs(generate_logs_with_counts(now, log_or_trace_service_counts))
-
-    token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
-    response = make_scalar_query_request(
-        signoz,
-        token,
-        now,
-        [build_logs_query(group_by=["service.name"], order_by=[("count()", "asc")])],
-    )
-
-    assert response.status_code == HTTPStatus.OK
-    assert response.json()["status"] == "success"
-
-    data = querier.get_scalar_table_data(response.json())
-    querier.assert_scalar_result_order(
-        data,
-        [("service-d", 1), ("service-b", 3), ("service-a", 5), ("service-c", 7)],
-        "Logs order by agg asc",
-    )
-
-
-def test_logs_scalar_group_by_single_agg_order_by_agg_desc(
-    signoz: types.SigNoz,
-    create_user_admin: None,  # pylint: disable=unused-argument
-    get_token: Callable[[str, str], str],
-    insert_logs: Callable[[list[Logs]], None],
-) -> None:
-    now = datetime.now(tz=UTC).replace(second=0, microsecond=0)
-    insert_logs(generate_logs_with_counts(now, log_or_trace_service_counts))
-
-    token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
-    response = make_scalar_query_request(
-        signoz,
-        token,
-        now,
-        [build_logs_query(group_by=["service.name"], order_by=[("count()", "desc")])],
-    )
-
-    assert response.status_code == HTTPStatus.OK
-    assert response.json()["status"] == "success"
-
-    data = querier.get_scalar_table_data(response.json())
-    querier.assert_scalar_result_order(
-        data,
-        [("service-c", 7), ("service-a", 5), ("service-b", 3), ("service-d", 1)],
-        "Logs order by agg desc",
-    )
-
-
-def test_logs_scalar_group_by_single_agg_order_by_grouping_key_asc(
-    signoz: types.SigNoz,
-    create_user_admin: None,  # pylint: disable=unused-argument
-    get_token: Callable[[str, str], str],
-    insert_logs: Callable[[list[Logs]], None],
-) -> None:
-    now = datetime.now(tz=UTC).replace(second=0, microsecond=0)
-    insert_logs(generate_logs_with_counts(now, log_or_trace_service_counts))
-
-    token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
-    response = make_scalar_query_request(
-        signoz,
-        token,
-        now,
-        [build_logs_query(group_by=["service.name"], order_by=[("service.name", "asc")])],
-    )
-
-    assert response.status_code == HTTPStatus.OK
-    assert response.json()["status"] == "success"
-
-    data = querier.get_scalar_table_data(response.json())
-    querier.assert_scalar_result_order(
-        data,
-        [("service-a", 5), ("service-b", 3), ("service-c", 7), ("service-d", 1)],
-        "Logs order by grouping key asc",
-    )
-
-
-def test_logs_scalar_group_by_single_agg_order_by_grouping_key_desc(
-    signoz: types.SigNoz,
-    create_user_admin: None,  # pylint: disable=unused-argument
-    get_token: Callable[[str, str], str],
-    insert_logs: Callable[[list[Logs]], None],
-) -> None:
-    now = datetime.now(tz=UTC).replace(second=0, microsecond=0)
-    insert_logs(generate_logs_with_counts(now, log_or_trace_service_counts))
-
-    token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
-    response = make_scalar_query_request(
-        signoz,
-        token,
-        now,
-        [build_logs_query(group_by=["service.name"], order_by=[("service.name", "desc")])],
-    )
-
-    assert response.status_code == HTTPStatus.OK
-    assert response.json()["status"] == "success"
-
-    data = querier.get_scalar_table_data(response.json())
-    querier.assert_scalar_result_order(
-        data,
-        [("service-d", 1), ("service-c", 7), ("service-b", 3), ("service-a", 5)],
-        "Logs order by grouping key desc",
-    )
-
-
-def test_logs_scalar_group_by_multiple_aggs_order_by_first_agg_asc(
-    signoz: types.SigNoz,
-    create_user_admin: None,  # pylint: disable=unused-argument
-    get_token: Callable[[str, str], str],
-    insert_logs: Callable[[list[Logs]], None],
-) -> None:
-    now = datetime.now(tz=UTC).replace(second=0, microsecond=0)
-    insert_logs(generate_logs_with_counts(now, log_or_trace_service_counts))
-
-    token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
-    response = make_scalar_query_request(
-        signoz,
-        token,
-        now,
-        [
-            build_logs_query(
-                group_by=["service.name"],
-                aggregations=["count()", "count_distinct(body)"],
-                order_by=[("count()", "asc")],
-            )
-        ],
-    )
-
-    assert response.status_code == HTTPStatus.OK
-    assert response.json()["status"] == "success"
-
-    data = querier.get_scalar_table_data(response.json())
-    querier.assert_scalar_column_order(data, 0, ["service-d", "service-b", "service-a", "service-c"], "First column")
-
-
-def test_logs_scalar_group_by_multiple_aggs_order_by_second_agg_desc(
-    signoz: types.SigNoz,
-    create_user_admin: None,  # pylint: disable=unused-argument
-    get_token: Callable[[str, str], str],
-    insert_logs: Callable[[list[Logs]], None],
-) -> None:
-    now = datetime.now(tz=UTC).replace(second=0, microsecond=0)
-    insert_logs(generate_logs_with_counts(now, log_or_trace_service_counts))
-
-    token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
-    response = make_scalar_query_request(
-        signoz,
-        token,
-        now,
-        [
-            build_logs_query(
-                group_by=["service.name"],
-                aggregations=["count()", "count_distinct(body)"],
-                order_by=[("count_distinct(body)", "desc")],
-            )
-        ],
-    )
-
-    assert response.status_code == HTTPStatus.OK
-    assert response.json()["status"] == "success"
-
-    data = querier.get_scalar_table_data(response.json())
-    # count_distinct(body) should equal count() since each log has unique body
-    querier.assert_scalar_column_order(data, 0, ["service-c", "service-a", "service-b", "service-d"], "First column")
-
-
-def test_logs_scalar_group_by_single_agg_order_by_agg_asc_limit_2(
-    signoz: types.SigNoz,
-    create_user_admin: None,  # pylint: disable=unused-argument
-    get_token: Callable[[str, str], str],
-    insert_logs: Callable[[list[Logs]], None],
-) -> None:
-    now = datetime.now(tz=UTC).replace(second=0, microsecond=0)
-    insert_logs(generate_logs_with_counts(now, log_or_trace_service_counts))
-
-    token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
-    response = make_scalar_query_request(
-        signoz,
-        token,
-        now,
-        [build_logs_query(group_by=["service.name"], order_by=[("count()", "asc")], limit=2)],
-    )
-
-    assert response.status_code == HTTPStatus.OK
-    assert response.json()["status"] == "success"
-
-    data = querier.get_scalar_table_data(response.json())
-    querier.assert_scalar_result_order(
-        data,
-        [("service-d", 1), ("service-b", 3)],
-        "Logs order by agg asc with limit 2",
-    )
-
-
-def test_logs_scalar_group_by_single_agg_order_by_agg_desc_limit_3(
-    signoz: types.SigNoz,
-    create_user_admin: None,  # pylint: disable=unused-argument
-    get_token: Callable[[str, str], str],
-    insert_logs: Callable[[list[Logs]], None],
-) -> None:
-    now = datetime.now(tz=UTC).replace(second=0, microsecond=0)
-    insert_logs(generate_logs_with_counts(now, log_or_trace_service_counts))
-
-    token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
-    response = make_scalar_query_request(
-        signoz,
-        token,
-        now,
-        [build_logs_query(group_by=["service.name"], order_by=[("count()", "desc")], limit=3)],
-    )
-
-    assert response.status_code == HTTPStatus.OK
-    assert response.json()["status"] == "success"
-
-    data = querier.get_scalar_table_data(response.json())
-    querier.assert_scalar_result_order(
-        data,
-        [("service-c", 7), ("service-a", 5), ("service-b", 3)],
-        "Logs order by agg desc with limit 3",
-    )
-
-
-def test_logs_scalar_group_by_order_by_grouping_key_asc_limit_2(
-    signoz: types.SigNoz,
-    create_user_admin: None,  # pylint: disable=unused-argument
-    get_token: Callable[[str, str], str],
-    insert_logs: Callable[[list[Logs]], None],
-) -> None:
-    now = datetime.now(tz=UTC).replace(second=0, microsecond=0)
-    insert_logs(generate_logs_with_counts(now, log_or_trace_service_counts))
-
-    token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
-    response = make_scalar_query_request(
-        signoz,
-        token,
-        now,
-        [build_logs_query(group_by=["service.name"], order_by=[("service.name", "asc")], limit=2)],
-    )
-
-    assert response.status_code == HTTPStatus.OK
-    assert response.json()["status"] == "success"
-
-    data = querier.get_scalar_table_data(response.json())
-    querier.assert_scalar_result_order(
-        data,
-        [("service-a", 5), ("service-b", 3)],
-        "Logs order by grouping key asc with limit 2",
-    )
-
-
-def test_traces_scalar_group_by_single_agg_no_order(
-    signoz: types.SigNoz,
-    create_user_admin: None,  # pylint: disable=unused-argument
-    get_token: Callable[[str, str], str],
-    insert_traces: Callable[[list[Traces]], None],
-) -> None:
-    now = datetime.now(tz=UTC).replace(second=0, microsecond=0)
-    insert_traces(generate_traces_with_counts(now, log_or_trace_service_counts))
-
-    token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
-    response = make_scalar_query_request(
-        signoz,
-        token,
-        now,
-        [build_traces_query(group_by=["service.name"])],
-    )
-
-    assert response.status_code == HTTPStatus.OK
-    assert response.json()["status"] == "success"
-
-    data = querier.get_scalar_table_data(response.json())
-    querier.assert_scalar_result_order(
-        data,
-        [("service-c", 7), ("service-a", 5), ("service-b", 3), ("service-d", 1)],
-        "Traces no order - default desc",
-    )
-
-
-def test_traces_scalar_group_by_single_agg_order_by_agg_asc(
-    signoz: types.SigNoz,
-    create_user_admin: None,  # pylint: disable=unused-argument
-    get_token: Callable[[str, str], str],
-    insert_traces: Callable[[list[Traces]], None],
-) -> None:
-    now = datetime.now(tz=UTC).replace(second=0, microsecond=0)
-    insert_traces(generate_traces_with_counts(now, log_or_trace_service_counts))
-
-    token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
-    response = make_scalar_query_request(
-        signoz,
-        token,
-        now,
-        [build_traces_query(group_by=["service.name"], order_by=[("count()", "asc")])],
-    )
-
-    assert response.status_code == HTTPStatus.OK
-    assert response.json()["status"] == "success"
-
-    data = querier.get_scalar_table_data(response.json())
-    querier.assert_scalar_result_order(
-        data,
-        [("service-d", 1), ("service-b", 3), ("service-a", 5), ("service-c", 7)],
-        "Traces order by agg asc",
-    )
-
-
-def test_traces_scalar_group_by_single_agg_order_by_agg_desc(
-    signoz: types.SigNoz,
-    create_user_admin: None,  # pylint: disable=unused-argument
-    get_token: Callable[[str, str], str],
-    insert_traces: Callable[[list[Traces]], None],
-) -> None:
-    now = datetime.now(tz=UTC).replace(second=0, microsecond=0)
-    insert_traces(generate_traces_with_counts(now, log_or_trace_service_counts))
-
-    token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
-    response = make_scalar_query_request(
-        signoz,
-        token,
-        now,
-        [build_traces_query(group_by=["service.name"], order_by=[("count()", "desc")])],
-    )
-
-    assert response.status_code == HTTPStatus.OK
-    assert response.json()["status"] == "success"
-
-    data = querier.get_scalar_table_data(response.json())
-    querier.assert_scalar_result_order(
-        data,
-        [("service-c", 7), ("service-a", 5), ("service-b", 3), ("service-d", 1)],
-        "Traces order by agg desc",
-    )
-
-
-def test_traces_scalar_group_by_single_agg_order_by_grouping_key_asc(
-    signoz: types.SigNoz,
-    create_user_admin: None,  # pylint: disable=unused-argument
-    get_token: Callable[[str, str], str],
-    insert_traces: Callable[[list[Traces]], None],
-) -> None:
-    now = datetime.now(tz=UTC).replace(second=0, microsecond=0)
-    insert_traces(generate_traces_with_counts(now, log_or_trace_service_counts))
-
-    token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
-    response = make_scalar_query_request(
-        signoz,
-        token,
-        now,
-        [build_traces_query(group_by=["service.name"], order_by=[("service.name", "asc")])],
-    )
-
-    assert response.status_code == HTTPStatus.OK
-    assert response.json()["status"] == "success"
-
-    data = querier.get_scalar_table_data(response.json())
-    querier.assert_scalar_result_order(
-        data,
-        [("service-a", 5), ("service-b", 3), ("service-c", 7), ("service-d", 1)],
-        "Traces order by grouping key asc",
-    )
-
-
-def test_traces_scalar_group_by_single_agg_order_by_grouping_key_desc(
-    signoz: types.SigNoz,
-    create_user_admin: None,  # pylint: disable=unused-argument
-    get_token: Callable[[str, str], str],
-    insert_traces: Callable[[list[Traces]], None],
-) -> None:
-    now = datetime.now(tz=UTC).replace(second=0, microsecond=0)
-    insert_traces(generate_traces_with_counts(now, log_or_trace_service_counts))
-
-    token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
-    response = make_scalar_query_request(
-        signoz,
-        token,
-        now,
-        [build_traces_query(group_by=["service.name"], order_by=[("service.name", "desc")])],
-    )
-
-    assert response.status_code == HTTPStatus.OK
-    assert response.json()["status"] == "success"
-
-    data = querier.get_scalar_table_data(response.json())
-    querier.assert_scalar_result_order(
-        data,
-        [("service-d", 1), ("service-c", 7), ("service-b", 3), ("service-a", 5)],
-        "Traces order by grouping key desc",
-    )
-
-
-def test_traces_scalar_group_by_multiple_aggs_order_by_first_agg_asc(
-    signoz: types.SigNoz,
-    create_user_admin: None,  # pylint: disable=unused-argument
-    get_token: Callable[[str, str], str],
-    insert_traces: Callable[[list[Traces]], None],
-) -> None:
-    now = datetime.now(tz=UTC).replace(second=0, microsecond=0)
-    insert_traces(generate_traces_with_counts(now, log_or_trace_service_counts))
-
-    token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
-    response = make_scalar_query_request(
-        signoz,
-        token,
-        now,
-        [
-            build_traces_query(
-                group_by=["service.name"],
-                aggregations=["count()", "count_distinct(trace_id)"],
-                order_by=[("count()", "asc")],
-            )
-        ],
-    )
-
-    assert response.status_code == HTTPStatus.OK
-    assert response.json()["status"] == "success"
-
-    data = querier.get_scalar_table_data(response.json())
-    querier.assert_scalar_column_order(data, 0, ["service-d", "service-b", "service-a", "service-c"], "First column")
-
-
-def test_traces_scalar_group_by_single_agg_order_by_agg_asc_limit_2(
-    signoz: types.SigNoz,
-    create_user_admin: None,  # pylint: disable=unused-argument
-    get_token: Callable[[str, str], str],
-    insert_traces: Callable[[list[Traces]], None],
-) -> None:
-    now = datetime.now(tz=UTC).replace(second=0, microsecond=0)
-    insert_traces(generate_traces_with_counts(now, log_or_trace_service_counts))
-
-    token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
-    response = make_scalar_query_request(
-        signoz,
-        token,
-        now,
-        [build_traces_query(group_by=["service.name"], order_by=[("count()", "asc")], limit=2)],
-    )
-
-    assert response.status_code == HTTPStatus.OK
-    assert response.json()["status"] == "success"
-
-    data = querier.get_scalar_table_data(response.json())
-    querier.assert_scalar_result_order(
-        data,
-        [("service-d", 1), ("service-b", 3)],
-        "Traces order by agg asc with limit 2",
-    )
-
-
-def test_traces_scalar_group_by_single_agg_order_by_agg_desc_limit_3(
-    signoz: types.SigNoz,
-    create_user_admin: None,  # pylint: disable=unused-argument
-    get_token: Callable[[str, str], str],
-    insert_traces: Callable[[list[Traces]], None],
-) -> None:
-    now = datetime.now(tz=UTC).replace(second=0, microsecond=0)
-    insert_traces(generate_traces_with_counts(now, log_or_trace_service_counts))
-
-    token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
-    response = make_scalar_query_request(
-        signoz,
-        token,
-        now,
-        [build_traces_query(group_by=["service.name"], order_by=[("count()", "desc")], limit=3)],
-    )
-
-    assert response.status_code == HTTPStatus.OK
-    assert response.json()["status"] == "success"
-
-    data = querier.get_scalar_table_data(response.json())
-    querier.assert_scalar_result_order(
-        data,
-        [("service-c", 7), ("service-a", 5), ("service-b", 3)],
-        "Traces order by agg desc with limit 3",
-    )
-
-
-def test_traces_scalar_group_by_order_by_grouping_key_asc_limit_2(
-    signoz: types.SigNoz,
-    create_user_admin: None,  # pylint: disable=unused-argument
-    get_token: Callable[[str, str], str],
-    insert_traces: Callable[[list[Traces]], None],
-) -> None:
-    now = datetime.now(tz=UTC).replace(second=0, microsecond=0)
-    insert_traces(generate_traces_with_counts(now, log_or_trace_service_counts))
-
-    token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
-    response = make_scalar_query_request(
-        signoz,
-        token,
-        now,
-        [build_traces_query(group_by=["service.name"], order_by=[("service.name", "asc")], limit=2)],
-    )
-
-    assert response.status_code == HTTPStatus.OK
-    assert response.json()["status"] == "success"
-
-    data = querier.get_scalar_table_data(response.json())
-    querier.assert_scalar_result_order(
-        data,
-        [("service-a", 5), ("service-b", 3)],
-        "Traces order by grouping key asc with limit 2",
-    )
-
-
-def test_metrics_scalar_group_by_single_agg_no_order(
-    signoz: types.SigNoz,
-    create_user_admin: None,  # pylint: disable=unused-argument
-    get_token: Callable[[str, str], str],
-    insert_metrics: Callable[[list[Metrics]], None],
-) -> None:
-    now = datetime.now(tz=UTC).replace(second=0, microsecond=0)
-    insert_metrics(generate_metrics_with_values(now, metric_values_for_test))
-
-    token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
-    response = make_scalar_query_request(
-        signoz,
-        token,
-        now,
-        [build_metrics_query(group_by=["service.name"])],
-    )
-
-    assert response.status_code == HTTPStatus.OK
-    assert response.json()["status"] == "success"
-
-    data = querier.get_scalar_table_data(response.json())
-    querier.assert_scalar_result_order(
-        data,
-        [
-            ("service-c", 70.0),
-            ("service-a", 50.0),
-            ("service-b", 30.0),
-            ("service-d", 10.0),
-        ],
-        "Metrics no order - default desc",
-    )
-
-
-def test_metrics_scalar_group_by_single_agg_order_by_agg_asc(
-    signoz: types.SigNoz,
-    create_user_admin: None,  # pylint: disable=unused-argument
-    get_token: Callable[[str, str], str],
-    insert_metrics: Callable[[list[Metrics]], None],
-) -> None:
-    now = datetime.now(tz=UTC).replace(second=0, microsecond=0)
-    insert_metrics(generate_metrics_with_values(now, metric_values_for_test))
-
-    token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
-    response = make_scalar_query_request(
-        signoz,
-        token,
-        now,
-        [
-            build_metrics_query(
-                group_by=["service.name"],
-                order_by=[("sum(test.metric)", "asc")],
-            )
-        ],
-    )
-
-    assert response.status_code == HTTPStatus.OK
-    assert response.json()["status"] == "success"
-
-    data = querier.get_scalar_table_data(response.json())
-    querier.assert_scalar_result_order(
-        data,
-        [
-            ("service-d", 10.0),
-            ("service-b", 30.0),
-            ("service-a", 50.0),
-            ("service-c", 70.0),
-        ],
-        "Metrics order by agg asc",
-    )
-
-
-def test_metrics_scalar_group_by_single_agg_order_by_grouping_key_asc(
-    signoz: types.SigNoz,
-    create_user_admin: None,  # pylint: disable=unused-argument
-    get_token: Callable[[str, str], str],
-    insert_metrics: Callable[[list[Metrics]], None],
-) -> None:
-    now = datetime.now(tz=UTC).replace(second=0, microsecond=0)
-    insert_metrics(generate_metrics_with_values(now, metric_values_for_test))
-
-    token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
-    response = make_scalar_query_request(
-        signoz,
-        token,
-        now,
-        [
-            build_metrics_query(
-                group_by=["service.name"],
-                order_by=[("service.name", "asc")],
-            )
-        ],
-    )
-
-    assert response.status_code == HTTPStatus.OK
-    assert response.json()["status"] == "success"
-
-    data = querier.get_scalar_table_data(response.json())
-    querier.assert_scalar_result_order(
-        data,
-        [
-            ("service-a", 50.0),
-            ("service-b", 30.0),
-            ("service-c", 70.0),
-            ("service-d", 10.0),
-        ],
-        "Metrics order by grouping key asc",
-    )
-
-
-def test_metrics_scalar_group_by_single_agg_order_by_agg_asc_limit_2(
-    signoz: types.SigNoz,
-    create_user_admin: None,  # pylint: disable=unused-argument
-    get_token: Callable[[str, str], str],
-    insert_metrics: Callable[[list[Metrics]], None],
-) -> None:
-    now = datetime.now(tz=UTC).replace(second=0, microsecond=0)
-    insert_metrics(generate_metrics_with_values(now, metric_values_for_test))
-
-    token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
-    response = make_scalar_query_request(
-        signoz,
-        token,
-        now,
-        [
-            build_metrics_query(
-                group_by=["service.name"],
-                order_by=[("sum(test.metric)", "asc")],
-                limit=2,
-            )
-        ],
-    )
-
-    assert response.status_code == HTTPStatus.OK
-    assert response.json()["status"] == "success"
-
-    data = querier.get_scalar_table_data(response.json())
-    querier.assert_scalar_result_order(
-        data,
-        [("service-d", 10.0), ("service-b", 30.0)],
-        "Metrics order by agg asc with limit 2",
-    )
-
-
-def test_metrics_scalar_group_by_single_agg_order_by_agg_desc_limit_3(
-    signoz: types.SigNoz,
-    create_user_admin: None,  # pylint: disable=unused-argument
-    get_token: Callable[[str, str], str],
-    insert_metrics: Callable[[list[Metrics]], None],
-) -> None:
-    now = datetime.now(tz=UTC).replace(second=0, microsecond=0)
-    insert_metrics(generate_metrics_with_values(now, metric_values_for_test))
-
-    token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
-    response = make_scalar_query_request(
-        signoz,
-        token,
-        now,
-        [
-            build_metrics_query(
-                group_by=["service.name"],
-                order_by=[("sum(test.metric)", "desc")],
-                limit=3,
-            )
-        ],
-    )
-
-    assert response.status_code == HTTPStatus.OK
-    assert response.json()["status"] == "success"
-
-    data = querier.get_scalar_table_data(response.json())
-    querier.assert_scalar_result_order(
-        data,
-        [("service-c", 70.0), ("service-a", 50.0), ("service-b", 30.0)],
-        "Metrics order by agg desc with limit 3",
-    )
-
-
-def test_metrics_scalar_group_by_order_by_grouping_key_asc_limit_2(
-    signoz: types.SigNoz,
-    create_user_admin: None,  # pylint: disable=unused-argument
-    get_token: Callable[[str, str], str],
-    insert_metrics: Callable[[list[Metrics]], None],
-) -> None:
-    now = datetime.now(tz=UTC).replace(second=0, microsecond=0)
-    insert_metrics(generate_metrics_with_values(now, metric_values_for_test))
-
-    token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
-    response = make_scalar_query_request(
-        signoz,
-        token,
-        now,
-        [
-            build_metrics_query(
-                group_by=["service.name"],
-                order_by=[("service.name", "asc")],
-                limit=2,
-            )
-        ],
-    )
-
-    assert response.status_code == HTTPStatus.OK
-    assert response.json()["status"] == "success"
-
-    data = querier.get_scalar_table_data(response.json())
-    querier.assert_scalar_result_order(
-        data,
-        [("service-a", 50.0), ("service-b", 30.0)],
-        "Metrics order by grouping key asc with limit 2",
-    )

tests/integration/tests/querier_json_body/03_body_array_functions.py

@@ -0,0 +1,114 @@
+import json
+from collections.abc import Callable
+from datetime import UTC, datetime, timedelta
+from http import HTTPStatus
+
+from fixtures import types
+from fixtures.auth import USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD
+from fixtures.logs import Logs
+from fixtures.querier import get_rows, make_query_request
+
+# Positive coverage for the body-JSON array functions hasAny / hasAll in JSON-body
+# mode (BODY_JSON_QUERY_ENABLED=true). Here body_v2 arrays resolve to real ClickHouse
+# Arrays via dynamicElement, so these succeed — unlike legacy body mode, where
+# hasAny/hasAll xfail (see querierlogs/09_json_body_functions.py).
+# export_json_types registers the body paths + array element types (tags -> []string,
+# ids -> []int64) so the builder resolves body.tags/body.ids as arrays.
+
+
+def test_logs_json_body_has_any_string(
+    signoz: types.SigNoz,
+    create_user_admin: None,  # pylint: disable=unused-argument
+    get_token: Callable[[str, str], str],
+    insert_logs: Callable[[list[Logs]], None],
+    export_json_types: Callable[[list[Logs]], None],
+) -> None:
+    """hasAny over a []string body array: matches logs sharing ANY listed value."""
+    now = datetime.now(tz=UTC)
+    logs = [
+        Logs(timestamp=now - timedelta(seconds=3), resources={"service.name": "app-service"}, body_v2=json.dumps({"tags": ["production", "api", "critical"]}), body_promoted="", severity_text="INFO"),
+        Logs(timestamp=now - timedelta(seconds=2), resources={"service.name": "app-service"}, body_v2=json.dumps({"tags": ["staging", "api", "test"]}), body_promoted="", severity_text="INFO"),
+        Logs(timestamp=now - timedelta(seconds=1), resources={"service.name": "app-service"}, body_v2=json.dumps({"tags": ["production", "web", "important"]}), body_promoted="", severity_text="INFO"),
+    ]
+    export_json_types(logs)
+    insert_logs(logs)
+    token = get_token(email=USER_ADMIN_EMAIL, password=USER_ADMIN_PASSWORD)
+
+    # log1 has "critical", log2 has "test", log3 has neither -> 2 matches
+    response = make_query_request(
+        signoz,
+        token,
+        start_ms=int((now - timedelta(seconds=10)).timestamp() * 1000),
+        end_ms=int(now.timestamp() * 1000),
+        request_type="raw",
+        queries=[{"type": "builder_query", "spec": {"name": "A", "signal": "logs", "disabled": False, "limit": 100, "offset": 0, "filter": {"expression": "hasAny(body.tags, ['critical', 'test'])"}, "order": [{"key": {"name": "timestamp"}, "direction": "desc"}], "aggregations": [{"expression": "count()"}]}}],
+    )
+    assert response.status_code == HTTPStatus.OK
+    rows = get_rows(response)
+    assert len(rows) == 2
+    assert all(("critical" in row["data"]["body"]["tags"]) or ("test" in row["data"]["body"]["tags"]) for row in rows)
+
+
+def test_logs_json_body_has_all_string(
+    signoz: types.SigNoz,
+    create_user_admin: None,  # pylint: disable=unused-argument
+    get_token: Callable[[str, str], str],
+    insert_logs: Callable[[list[Logs]], None],
+    export_json_types: Callable[[list[Logs]], None],
+) -> None:
+    """hasAll over a []string body array: matches only logs having ALL listed values."""
+    now = datetime.now(tz=UTC)
+    logs = [
+        Logs(timestamp=now - timedelta(seconds=2), resources={"service.name": "app-service"}, body_v2=json.dumps({"tags": ["production", "api", "critical"]}), body_promoted="", severity_text="INFO"),
+        Logs(timestamp=now - timedelta(seconds=1), resources={"service.name": "app-service"}, body_v2=json.dumps({"tags": ["production", "web", "important"]}), body_promoted="", severity_text="INFO"),
+    ]
+    export_json_types(logs)
+    insert_logs(logs)
+    token = get_token(email=USER_ADMIN_EMAIL, password=USER_ADMIN_PASSWORD)
+
+    # only the second log has both "production" AND "web"
+    response = make_query_request(
+        signoz,
+        token,
+        start_ms=int((now - timedelta(seconds=10)).timestamp() * 1000),
+        end_ms=int(now.timestamp() * 1000),
+        request_type="raw",
+        queries=[{"type": "builder_query", "spec": {"name": "A", "signal": "logs", "disabled": False, "limit": 100, "offset": 0, "filter": {"expression": "hasAll(body.tags, ['production', 'web'])"}, "order": [{"key": {"name": "timestamp"}, "direction": "desc"}], "aggregations": [{"expression": "count()"}]}}],
+    )
+    assert response.status_code == HTTPStatus.OK
+    rows = get_rows(response)
+    assert len(rows) == 1
+    tags = rows[0]["data"]["body"]["tags"]
+    assert "production" in tags and "web" in tags
+
+
+def test_logs_json_body_has_any_number(
+    signoz: types.SigNoz,
+    create_user_admin: None,  # pylint: disable=unused-argument
+    get_token: Callable[[str, str], str],
+    insert_logs: Callable[[list[Logs]], None],
+    export_json_types: Callable[[list[Logs]], None],
+) -> None:
+    """hasAny over a []int64 body array."""
+    now = datetime.now(tz=UTC)
+    logs = [
+        Logs(timestamp=now - timedelta(seconds=2), resources={"service.name": "app-service"}, body_v2=json.dumps({"ids": [100, 200, 300]}), body_promoted="", severity_text="INFO"),
+        Logs(timestamp=now - timedelta(seconds=1), resources={"service.name": "app-service"}, body_v2=json.dumps({"ids": [400, 600, 700]}), body_promoted="", severity_text="INFO"),
+    ]
+    export_json_types(logs)
+    insert_logs(logs)
+    token = get_token(email=USER_ADMIN_EMAIL, password=USER_ADMIN_PASSWORD)
+
+    # only the first log has 300 in ids; 999 matches nothing
+    response = make_query_request(
+        signoz,
+        token,
+        start_ms=int((now - timedelta(seconds=10)).timestamp() * 1000),
+        end_ms=int(now.timestamp() * 1000),
+        request_type="raw",
+        queries=[{"type": "builder_query", "spec": {"name": "A", "signal": "logs", "disabled": False, "limit": 100, "offset": 0, "filter": {"expression": "hasAny(body.ids, [300, 999])"}, "order": [{"key": {"name": "timestamp"}, "direction": "desc"}], "aggregations": [{"expression": "count()"}]}}],
+    )
+    assert response.status_code == HTTPStatus.OK
+    rows = get_rows(response)
+    assert len(rows) == 1
+    assert 300 in rows[0]["data"]["body"]["ids"]

tests/integration/tests/queriercommon/04_filter_operators.py

@@ -0,0 +1,141 @@
+from collections.abc import Callable
+from datetime import UTC, datetime, timedelta
+from http import HTTPStatus
+
+import pytest
+
+from fixtures import types
+from fixtures.auth import USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD
+from fixtures.logs import Logs
+from fixtures.querier import get_column_data_from_response, make_query_request
+
+# Filter-operator coverage that 01_filter_expression.py (NOT semantics) and
+# 06_json_body.py (CONTAINS) leave out: ILIKE / NOT LIKE / NOT CONTAINS, the
+# `key:number` data-type-suffix disambiguator on an ambiguous key, and a
+# truly-unknown key (rejected as a bad request on this HEAD).
+#
+# Data model mirrors 01_filter_expression.py::test_not_filter_expression:
+#   alpha-log: resources region="us-east"; attributes status_code=200 (number)
+#   beta-log:  resources status_code="500" (string); attributes region=1 (number)
+# so region/status_code each appear as both a resource and an attribute across the
+# two logs — the intentional overlap that context prefix + :type disambiguate.
+
+
+@pytest.mark.parametrize(
+    "expression,expected_bodies",
+    [
+        pytest.param('resource.region ILIKE "%US-EAST%"', {"alpha-log"}, id="ilike_resource"),
+        pytest.param('body ILIKE "%ALPHA%"', {"alpha-log"}, id="ilike_body"),
+        pytest.param('body NOT CONTAINS "alpha"', {"beta-log"}, id="not_contains_body"),
+        pytest.param('NOT body LIKE "%alpha%"', {"beta-log"}, id="not_like_body"),
+        pytest.param("attribute.status_code:number = 200", {"alpha-log"}, id="datatype_suffix_number"),
+        pytest.param('resource.status_code:string = "500"', {"beta-log"}, id="datatype_suffix_string"),
+    ],
+)
+def test_logs_filter_operators_and_datatype_suffix(
+    signoz: types.SigNoz,
+    create_user_admin: None,  # pylint: disable=unused-argument
+    get_token: Callable[[str, str], str],
+    insert_logs: Callable[[list[Logs]], None],
+    expression: str,
+    expected_bodies: set[str],
+) -> None:
+    """ILIKE / NOT LIKE / NOT CONTAINS and the key:number|string suffix resolve correctly."""
+    now = datetime.now(tz=UTC)
+    insert_logs(
+        [
+            Logs(
+                timestamp=now - timedelta(seconds=5),
+                body="alpha-log",
+                resources={"region": "us-east", "env": "production", "hostname": "host-alpha"},
+                attributes={"status_code": 200, "latency_ms": 350, "error_count": 3},
+            ),
+            Logs(
+                timestamp=now - timedelta(seconds=3),
+                body="beta-log",
+                resources={"status_code": "500", "latency_ms": "2500", "error_count": "10"},
+                attributes={"region": 1, "env": 2, "hostname": 3},
+            ),
+        ]
+    )
+    token = get_token(email=USER_ADMIN_EMAIL, password=USER_ADMIN_PASSWORD)
+
+    response = make_query_request(
+        signoz,
+        token,
+        start_ms=int((now - timedelta(seconds=30)).timestamp() * 1000),
+        end_ms=int(now.timestamp() * 1000),
+        request_type="raw",
+        queries=[
+            {
+                "type": "builder_query",
+                "spec": {
+                    "name": "A",
+                    "signal": "logs",
+                    "disabled": False,
+                    "limit": 100,
+                    "offset": 0,
+                    "filter": {"expression": expression},
+                    "order": [
+                        {"key": {"name": "timestamp"}, "direction": "desc"},
+                        {"key": {"name": "id"}, "direction": "desc"},
+                    ],
+                    "having": {"expression": ""},
+                    "aggregations": [{"expression": "count()"}],
+                },
+            }
+        ],
+    )
+    assert response.status_code == HTTPStatus.OK
+    assert response.json()["status"] == "success"
+    assert set(get_column_data_from_response(response.json(), "body")) == expected_bodies
+
+
+def test_logs_filter_key_not_found(
+    signoz: types.SigNoz,
+    create_user_admin: None,  # pylint: disable=unused-argument
+    get_token: Callable[[str, str], str],
+    insert_logs: Callable[[list[Logs]], None],
+) -> None:
+    """A filter on a key that exists in no context is rejected (400).
+
+    NOTE: reflects current HEAD behavior. The parked `convert-not-found-to-warning`
+    change will turn this into a 200 with a warning — update this assertion when it lands.
+    """
+    now = datetime.now(tz=UTC)
+    insert_logs(
+        [
+            Logs(
+                timestamp=now - timedelta(seconds=3),
+                body="alpha-log",
+                resources={"region": "us-east"},
+                attributes={"status_code": 200},
+            ),
+        ]
+    )
+    token = get_token(email=USER_ADMIN_EMAIL, password=USER_ADMIN_PASSWORD)
+
+    response = make_query_request(
+        signoz,
+        token,
+        start_ms=int((now - timedelta(seconds=30)).timestamp() * 1000),
+        end_ms=int(now.timestamp() * 1000),
+        request_type="raw",
+        queries=[
+            {
+                "type": "builder_query",
+                "spec": {
+                    "name": "A",
+                    "signal": "logs",
+                    "disabled": False,
+                    "limit": 100,
+                    "offset": 0,
+                    "filter": {"expression": 'totally.unknown.key = "x"'},
+                    "order": [{"key": {"name": "timestamp"}, "direction": "desc"}],
+                    "having": {"expression": ""},
+                    "aggregations": [{"expression": "count()"}],
+                },
+            }
+        ],
+    )
+    assert response.status_code == HTTPStatus.BAD_REQUEST

tests/integration/tests/querierlogs/01_list.py

@@ -0,0 +1,500 @@
+from collections.abc import Callable
+from datetime import UTC, datetime, timedelta
+from http import HTTPStatus
+
+import pytest
+import requests
+
+from fixtures import types
+from fixtures.auth import USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD
+from fixtures.logs import Logs
+from fixtures.querier import (
+    assert_identical_query_response,
+    make_query_request,
+)
+
+
+def test_logs_list(
+    signoz: types.SigNoz,
+    create_user_admin: None,  # pylint: disable=unused-argument
+    get_token: Callable[[str, str], str],
+    insert_logs: Callable[[list[Logs]], None],
+) -> None:
+    """
+    Setup:
+    Insert 2 logs with different attributes
+
+    Tests:
+    1. Query logs for the last 10 seconds and check if the logs are returned in the correct order
+    2. Query values of severity_text attribute from the autocomplete API
+    3. Query values of severity_text attribute from the fields API
+    4. Query values of code.file attribute from the autocomplete API
+    5. Query values of code.file attribute from the fields API
+    6. Query values of code.line attribute from the autocomplete API
+    7. Query values of code.line attribute from the fields API
+    """
+    insert_logs(
+        [
+            Logs(
+                timestamp=datetime.now(tz=UTC) - timedelta(seconds=1),
+                resources={
+                    "deployment.environment": "production",
+                    "service.name": "java",
+                    "os.type": "linux",
+                    "host.name": "linux-001",
+                    "cloud.provider": "integration",
+                    "cloud.account.id": "001",
+                },
+                attributes={
+                    "log.iostream": "stdout",
+                    "logtag": "F",
+                    "code.file": "/opt/Integration.java",
+                    "code.function": "com.example.Integration.process",
+                    "code.line": 120,
+                    "telemetry.sdk.language": "java",
+                },
+                body="This is a log message, coming from a java application",
+                severity_text="DEBUG",
+            ),
+            Logs(
+                timestamp=datetime.now(tz=UTC),
+                resources={
+                    "deployment.environment": "production",
+                    "service.name": "go",
+                    "os.type": "linux",
+                    "host.name": "linux-001",
+                    "cloud.provider": "integration",
+                    "cloud.account.id": "001",
+                },
+                attributes={
+                    "log.iostream": "stdout",
+                    "logtag": "F",
+                    "code.file": "/opt/integration.go",
+                    "code.function": "com.example.Integration.process",
+                    "code.line": 120,
+                    "metric.domain_id": "d-001",
+                    "telemetry.sdk.language": "go",
+                },
+                body="This is a log message, coming from a go application",
+                severity_text="INFO",
+            ),
+        ]
+    )
+
+    token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
+
+    # Query Logs for the last 10 seconds and check if the logs are returned in the correct order
+    response = requests.post(
+        signoz.self.host_configs["8080"].get("/api/v5/query_range"),
+        timeout=2,
+        headers={
+            "authorization": f"Bearer {token}",
+        },
+        json={
+            "schemaVersion": "v1",
+            "start": int((datetime.now(tz=UTC) - timedelta(seconds=10)).timestamp() * 1000),
+            "end": int(datetime.now(tz=UTC).timestamp() * 1000),
+            "requestType": "raw",
+            "compositeQuery": {
+                "queries": [
+                    {
+                        "type": "builder_query",
+                        "spec": {
+                            "name": "A",
+                            "signal": "logs",
+                            "disabled": False,
+                            "limit": 100,
+                            "offset": 0,
+                            "order": [
+                                {"key": {"name": "timestamp"}, "direction": "desc"},
+                                {"key": {"name": "id"}, "direction": "desc"},
+                            ],
+                            "having": {"expression": ""},
+                            "aggregations": [{"expression": "count()"}],
+                        },
+                    }
+                ]
+            },
+            "formatOptions": {"formatTableResultForUI": False, "fillGaps": False},
+        },
+    )
+
+    assert response.status_code == HTTPStatus.OK
+    assert response.json()["status"] == "success"
+
+    results = response.json()["data"]["data"]["results"]
+    assert len(results) == 1
+
+    rows = results[0]["rows"]
+    assert len(rows) == 2
+
+    assert rows[0]["data"]["body"] == "This is a log message, coming from a go application"
+    assert rows[0]["data"]["resources_string"] == {
+        "cloud.account.id": "001",
+        "cloud.provider": "integration",
+        "deployment.environment": "production",
+        "host.name": "linux-001",
+        "os.type": "linux",
+        "service.name": "go",
+    }
+    assert rows[0]["data"]["attributes_string"] == {
+        "code.file": "/opt/integration.go",
+        "code.function": "com.example.Integration.process",
+        "log.iostream": "stdout",
+        "logtag": "F",
+        "metric.domain_id": "d-001",
+        "telemetry.sdk.language": "go",
+    }
+    assert rows[0]["data"]["attributes_number"] == {"code.line": 120}
+
+    assert rows[1]["data"]["body"] == "This is a log message, coming from a java application"
+    assert rows[1]["data"]["resources_string"] == {
+        "cloud.account.id": "001",
+        "cloud.provider": "integration",
+        "deployment.environment": "production",
+        "host.name": "linux-001",
+        "os.type": "linux",
+        "service.name": "java",
+    }
+    assert rows[1]["data"]["attributes_string"] == {
+        "code.file": "/opt/Integration.java",
+        "code.function": "com.example.Integration.process",
+        "log.iostream": "stdout",
+        "logtag": "F",
+        "telemetry.sdk.language": "java",
+    }
+    assert rows[1]["data"]["attributes_number"] == {"code.line": 120}
+
+    # Query values of severity_text attribute from the autocomplete API
+    response = requests.get(
+        signoz.self.host_configs["8080"].get("/api/v3/autocomplete/attribute_values"),
+        timeout=2,
+        headers={
+            "authorization": f"Bearer {token}",
+        },
+        params={
+            "aggregateOperator": "noop",
+            "dataSource": "logs",
+            "aggregateAttribute": "",
+            "attributeKey": "severity_text",
+            "searchText": "",
+            "filterAttributeKeyDataType": "string",
+            "tagType": "resource",
+        },
+    )
+
+    assert response.status_code == HTTPStatus.OK
+    assert response.json()["status"] == "success"
+
+    values = response.json()["data"]["stringAttributeValues"]
+    assert len(values) == 2
+    assert "DEBUG" in values
+    assert "INFO" in values
+
+    # Query values of severity_text attribute from the fields API
+    response = requests.get(
+        signoz.self.host_configs["8080"].get("/api/v1/fields/values"),
+        timeout=2,
+        headers={
+            "authorization": f"Bearer {token}",
+        },
+        params={
+            "signal": "logs",
+            "name": "severity_text",
+            "searchText": "",
+        },
+    )
+
+    assert response.status_code == HTTPStatus.OK
+    assert response.json()["status"] == "success"
+
+    values = response.json()["data"]["values"]["stringValues"]
+    assert len(values) == 2
+    assert "DEBUG" in values
+    assert "INFO" in values
+
+    # Query values of code.file attribute from the autocomplete API
+    response = requests.get(
+        signoz.self.host_configs["8080"].get("/api/v3/autocomplete/attribute_values"),
+        timeout=2,
+        headers={
+            "authorization": f"Bearer {token}",
+        },
+        params={
+            "aggregateOperator": "noop",
+            "dataSource": "logs",
+            "aggregateAttribute": "",
+            "attributeKey": "code.file",
+            "searchText": "",
+            "filterAttributeKeyDataType": "string",
+            "tagType": "tag",
+        },
+    )
+
+    assert response.status_code == HTTPStatus.OK
+    assert response.json()["status"] == "success"
+
+    values = response.json()["data"]["stringAttributeValues"]
+    assert len(values) == 2
+    assert "/opt/Integration.java" in values
+    assert "/opt/integration.go" in values
+
+    # Query values of code.file attribute from the fields API
+    response = requests.get(
+        signoz.self.host_configs["8080"].get("/api/v1/fields/values"),
+        timeout=2,
+        headers={
+            "authorization": f"Bearer {token}",
+        },
+        params={
+            "signal": "logs",
+            "name": "code.file",
+            "searchText": "",
+        },
+    )
+
+    assert response.status_code == HTTPStatus.OK
+    assert response.json()["status"] == "success"
+
+    values = response.json()["data"]["values"]["stringValues"]
+    assert len(values) == 2
+    assert "/opt/Integration.java" in values
+    assert "/opt/integration.go" in values
+
+    # Query values of code.line attribute from the autocomplete API
+    response = requests.get(
+        signoz.self.host_configs["8080"].get("/api/v3/autocomplete/attribute_values"),
+        timeout=2,
+        headers={
+            "authorization": f"Bearer {token}",
+        },
+        params={
+            "aggregateOperator": "noop",
+            "dataSource": "logs",
+            "aggregateAttribute": "",
+            "attributeKey": "code.line",
+            "searchText": "",
+            "filterAttributeKeyDataType": "float64",
+            "tagType": "tag",
+        },
+    )
+
+    assert response.status_code == HTTPStatus.OK
+    assert response.json()["status"] == "success"
+
+    values = response.json()["data"]["numberAttributeValues"]
+    assert len(values) == 1
+    assert 120 in values
+
+    # Query values of code.line attribute from the fields API
+    response = requests.get(
+        signoz.self.host_configs["8080"].get("/api/v1/fields/values"),
+        timeout=2,
+        headers={
+            "authorization": f"Bearer {token}",
+        },
+        params={
+            "signal": "logs",
+            "name": "code.line",
+            "searchText": "",
+        },
+    )
+
+    assert response.status_code == HTTPStatus.OK
+    assert response.json()["status"] == "success"
+
+    values = response.json()["data"]["values"]["numberValues"]
+    assert len(values) == 1
+    assert 120 in values
+
+    # Query keys from the fields API with context specified in the key
+    response = requests.get(
+        signoz.self.host_configs["8080"].get("/api/v1/fields/keys"),
+        timeout=2,
+        headers={
+            "authorization": f"Bearer {token}",
+        },
+        params={
+            "signal": "logs",
+            "searchText": "resource.servic",
+        },
+    )
+
+    assert response.status_code == HTTPStatus.OK
+    assert response.json()["status"] == "success"
+
+    keys = response.json()["data"]["keys"]
+    assert "service.name" in keys
+    assert any(k["fieldContext"] == "resource" for k in keys["service.name"])
+
+    # Do not treat `metric.` as a context prefix for logs
+    response = requests.get(
+        signoz.self.host_configs["8080"].get("/api/v1/fields/keys"),
+        timeout=2,
+        headers={
+            "authorization": f"Bearer {token}",
+        },
+        params={
+            "signal": "logs",
+            "searchText": "metric.do",
+        },
+    )
+
+    assert response.status_code == HTTPStatus.OK
+    assert response.json()["status"] == "success"
+
+    keys = response.json()["data"]["keys"]
+    assert "metric.domain_id" in keys
+
+    # Query values of service.name resource attribute using context-prefixed key
+    response = requests.get(
+        signoz.self.host_configs["8080"].get("/api/v1/fields/values"),
+        timeout=2,
+        headers={
+            "authorization": f"Bearer {token}",
+        },
+        params={
+            "signal": "logs",
+            "name": "resource.service.name",
+            "searchText": "",
+        },
+    )
+
+    assert response.status_code == HTTPStatus.OK
+    assert response.json()["status"] == "success"
+
+    values = response.json()["data"]["values"]["stringValues"]
+    assert "go" in values
+    assert "java" in values
+
+    # Query values of metric.domain_id (string attribute) and ensure context collision doesn't break it
+    response = requests.get(
+        signoz.self.host_configs["8080"].get("/api/v1/fields/values"),
+        timeout=2,
+        headers={
+            "authorization": f"Bearer {token}",
+        },
+        params={
+            "signal": "logs",
+            "name": "metric.domain_id",
+            "searchText": "",
+        },
+    )
+
+    assert response.status_code == HTTPStatus.OK
+    assert response.json()["status"] == "success"
+
+    values = response.json()["data"]["values"]["stringValues"]
+    assert "d-001" in values
+
+
+@pytest.mark.parametrize(
+    "order_by_context,expected_order",
+    ####
+    #    Tests:
+    #    1. Query logs ordered by attribute.service.name descending
+    #    2. Query logs ordered by resource.service.name descending
+    #    3. Query logs ordered by service.name descending
+    ###
+    [
+        pytest.param("attribute", ["log-002", "log-001", "log-004", "log-003"]),
+        pytest.param("resource", ["log-003", "log-004", "log-001", "log-002"]),
+        pytest.param("", ["log-002", "log-001", "log-003", "log-004"]),
+    ],
+)
+def test_logs_list_with_order_by(
+    signoz: types.SigNoz,
+    create_user_admin: None,  # pylint: disable=unused-argument
+    get_token: Callable[[str, str], str],
+    insert_logs: Callable[[list[Logs]], None],
+    order_by_context: str,
+    expected_order: list[str],
+) -> None:
+    """
+    Setup:
+    Insert 3 logs with service.name in attributes and resources
+    """
+
+    attribute_resource_pair = [
+        [{"id": "log-001", "service.name": "c"}, {}],
+        [{"id": "log-002", "service.name": "d"}, {}],
+        [{"id": "log-003"}, {"service.name": "b"}],
+        [{"id": "log-004"}, {"service.name": "a"}],
+    ]
+    insert_logs(
+        [
+            Logs(
+                timestamp=datetime.now(tz=UTC) - timedelta(seconds=3),
+                attributes=attribute_resource_pair[i][0],
+                resources=attribute_resource_pair[i][1],
+                body="Log with DEBUG severity",
+                severity_text="DEBUG",
+            )
+            for i in range(4)
+        ]
+    )
+
+    token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
+
+    query = {
+        "type": "builder_query",
+        "spec": {
+            "name": "A",
+            "signal": "logs",
+            "order": [
+                {
+                    "key": {
+                        "name": "service.name",
+                        "fieldContext": order_by_context,
+                    },
+                    "direction": "desc",
+                }
+            ],
+        },
+    }
+
+    query_with_inline_context = {
+        "type": "builder_query",
+        "spec": {
+            "name": "A",
+            "signal": "logs",
+            "order": [
+                {
+                    "key": {
+                        "name": f"{order_by_context + '.' if order_by_context else ''}service.name",
+                    },
+                    "direction": "desc",
+                }
+            ],
+        },
+    }
+
+    response = make_query_request(
+        signoz,
+        token,
+        start_ms=int((datetime.now(tz=UTC) - timedelta(minutes=1)).timestamp() * 1000),
+        end_ms=int(datetime.now(tz=UTC).timestamp() * 1000),
+        request_type="raw",
+        queries=[query],
+    )
+
+    # Verify that both queries return the same results with specifying context with key name
+    response_with_inline_context = make_query_request(
+        signoz,
+        token,
+        start_ms=int((datetime.now(tz=UTC) - timedelta(minutes=1)).timestamp() * 1000),
+        end_ms=int(datetime.now(tz=UTC).timestamp() * 1000),
+        request_type="raw",
+        queries=[query_with_inline_context],
+    )
+
+    assert_identical_query_response(response, response_with_inline_context)
+
+    assert response.status_code == HTTPStatus.OK
+    assert response.json()["status"] == "success"
+
+    results = response.json()["data"]["data"]["results"]
+    rows = results[0]["rows"]
+    ids = [row["data"]["attributes_string"].get("id", "") for row in rows]
+
+    assert ids == expected_order

tests/integration/tests/querierlogs/02_aggregation.py

@@ -0,0 +1,788 @@
+from collections.abc import Callable
+from datetime import UTC, datetime, timedelta
+from http import HTTPStatus
+
+import requests
+
+from fixtures import types
+from fixtures.auth import USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD
+from fixtures.logs import Logs
+from fixtures.querier import (
+    assert_identical_query_response,
+    make_query_request,
+)
+
+
+def test_logs_time_series_count(
+    signoz: types.SigNoz,
+    create_user_admin: None,  # pylint: disable=unused-argument
+    get_token: Callable[[str, str], str],
+    insert_logs: Callable[[list[Logs]], None],
+) -> None:
+    """
+    Setup:
+    Insert 17 logs with service.name attribute set to "java" and severity_text attribute set to "DEBUG", 23 logs with service.name attribute set to "erlang" and severity_text attribute set to "ERROR", 29 logs with service.name attribute set to "go" and severity_text attribute set to "WARNING".
+    All logs have incrementing code.line attribute, modulo 2 for host.name and cloud.account.id.
+
+    Tests:
+    1. count() of all logs for the last 5 minutes
+    2. count() of all logs where code.line = 7 for last 5 minutes
+    3. count() of all logs where service.name = "erlang" OR cloud.account.id = "000" for last 5 minutes
+    4. count() of all logs grouped by host.name for the last 5 minutes
+    """
+    now = datetime.now(tz=UTC).replace(second=0, microsecond=0)
+    logs: list[Logs] = []
+
+    for i in range(17):
+        logs.append(
+            Logs(
+                timestamp=now - timedelta(microseconds=i + 1),  # These logs will be grouped in the now - 1 minute bucket
+                resources={
+                    "deployment.environment": "production",
+                    "service.name": "java",
+                    "os.type": "linux",
+                    "host.name": f"linux-00{i % 2}",
+                    "cloud.provider": "integration",
+                    "cloud.account.id": f"00{i % 2}",
+                },
+                attributes={
+                    "log.iostream": "stdout",
+                    "logtag": "F",
+                    "code.file": "/opt/Integration.java",
+                    "code.function": "com.example.Integration.process",
+                    "code.line": i + 1,
+                    "telemetry.sdk.language": "java",
+                },
+                body=f"This is a log message, number {i + 1} coming from a java application",
+                severity_text="DEBUG",
+            )
+        )
+    for i in range(23):
+        logs.append(
+            Logs(
+                timestamp=now - timedelta(minutes=1) - timedelta(microseconds=i + 1),  # These logs will be grouped in the now - 2 minute bucket
+                resources={
+                    "deployment.environment": "production",
+                    "service.name": "erlang",
+                    "os.type": "linux",
+                    "host.name": f"linux-00{i % 2}",
+                    "cloud.provider": "integration",
+                    "cloud.account.id": f"00{i % 2}",
+                },
+                attributes={
+                    "log.iostream": "stdout",
+                    "logtag": "F",
+                    "code.file": "/opt/Integration.erlang",
+                    "code.function": "com.example.Integration.process",
+                    "code.line": i + 1,
+                    "telemetry.sdk.language": "erlang",
+                },
+                body=f"This is a log message, number {i + 1} coming from a erlang application",
+                severity_text="ERROR",
+            )
+        )
+    for i in range(29):
+        logs.append(
+            Logs(
+                timestamp=now - timedelta(minutes=2) - timedelta(microseconds=i + 1),  # These logs will be grouped in the now - 3 minute bucket
+                resources={
+                    "deployment.environment": "production",
+                    "service.name": "go",
+                    "os.type": "linux",
+                    "host.name": f"linux-00{i % 2}",
+                    "cloud.provider": "integration",
+                    "cloud.account.id": f"00{i % 2}",
+                },
+                attributes={
+                    "log.iostream": "stdout",
+                    "logtag": "F",
+                    "code.file": "/opt/Integration.go",
+                    "code.function": "com.example.Integration.process",
+                    "code.line": i + 1,
+                    "telemetry.sdk.language": "go",
+                },
+                body=f"This is a log message, number {i + 1} coming from a go application",
+                severity_text="WARNING",
+            )
+        )
+    insert_logs(logs)
+
+    token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
+
+    # count() of all logs for the last 5 minutes
+    response = requests.post(
+        signoz.self.host_configs["8080"].get("/api/v5/query_range"),
+        timeout=2,
+        headers={
+            "authorization": f"Bearer {token}",
+        },
+        json={
+            "schemaVersion": "v1",
+            "start": int((datetime.now(tz=UTC).replace(second=0, microsecond=0) - timedelta(minutes=5)).timestamp() * 1000),
+            "end": int(datetime.now(tz=UTC).replace(second=0, microsecond=0).timestamp() * 1000),
+            "requestType": "time_series",
+            "compositeQuery": {
+                "queries": [
+                    {
+                        "type": "builder_query",
+                        "spec": {
+                            "name": "A",
+                            "signal": "logs",
+                            "stepInterval": 60,
+                            "disabled": False,
+                            "having": {"expression": ""},
+                            "aggregations": [{"expression": "count()"}],
+                        },
+                    }
+                ]
+            },
+            "formatOptions": {"formatTableResultForUI": False, "fillGaps": False},
+        },
+    )
+
+    assert response.status_code == HTTPStatus.OK
+    assert response.json()["status"] == "success"
+
+    results = response.json()["data"]["data"]["results"]
+    assert len(results) == 1
+
+    aggregations = results[0]["aggregations"]
+    assert len(aggregations) == 1
+
+    series = aggregations[0]["series"]
+    assert len(series) == 1
+
+    values = series[0]["values"]
+    assert len(values) == 3
+
+    # Care about the order of the values
+    assert [
+        i
+        for i in values
+        if i
+        not in [
+            {
+                "timestamp": int((now - timedelta(minutes=3)).replace(second=0, microsecond=0).timestamp() * 1000),
+                "value": 29,
+            },
+            {
+                "timestamp": int((now - timedelta(minutes=2)).replace(second=0, microsecond=0).timestamp() * 1000),
+                "value": 23,
+            },
+            {
+                "timestamp": int((now - timedelta(minutes=1)).replace(second=0, microsecond=0).timestamp() * 1000),
+                "value": 17,
+            },
+        ]
+    ] == []
+
+    # count() of all logs where code.line = 7 for last 5 minutes
+    response = requests.post(
+        signoz.self.host_configs["8080"].get("/api/v5/query_range"),
+        timeout=2,
+        headers={
+            "authorization": f"Bearer {token}",
+        },
+        json={
+            "schemaVersion": "v1",
+            "start": int((datetime.now(tz=UTC).replace(second=0, microsecond=0) - timedelta(minutes=5)).timestamp() * 1000),
+            "end": int(datetime.now(tz=UTC).replace(second=0, microsecond=0).timestamp() * 1000),
+            "requestType": "time_series",
+            "compositeQuery": {
+                "queries": [
+                    {
+                        "type": "builder_query",
+                        "spec": {
+                            "name": "A",
+                            "signal": "logs",
+                            "stepInterval": 60,
+                            "disabled": False,
+                            "filter": {"expression": "code.line = 7"},
+                            "having": {"expression": ""},
+                            "aggregations": [{"expression": "count()"}],
+                        },
+                    }
+                ]
+            },
+            "formatOptions": {"formatTableResultForUI": False, "fillGaps": False},
+        },
+    )
+
+    assert response.status_code == HTTPStatus.OK
+    assert response.json()["status"] == "success"
+
+    results = response.json()["data"]["data"]["results"]
+    assert len(results) == 1
+
+    aggregations = results[0]["aggregations"]
+    assert len(aggregations) == 1
+
+    series = aggregations[0]["series"]
+    assert len(series) == 1
+
+    values = series[0]["values"]
+    assert len(values) == 3
+
+    # Care about the order of the values
+    assert [
+        i
+        for i in values
+        if i
+        not in [
+            {
+                "timestamp": int((now - timedelta(minutes=3)).replace(second=0, microsecond=0).timestamp() * 1000),
+                "value": 1,
+            },
+            {
+                "timestamp": int((now - timedelta(minutes=2)).replace(second=0, microsecond=0).timestamp() * 1000),
+                "value": 1,
+            },
+            {
+                "timestamp": int((now - timedelta(minutes=1)).replace(second=0, microsecond=0).timestamp() * 1000),
+                "value": 1,
+            },
+        ]
+    ] == []
+
+    # count() of all logs where service.name = "erlang" OR cloud.account.id = "000" for last 5 minutes
+    response = requests.post(
+        signoz.self.host_configs["8080"].get("/api/v5/query_range"),
+        timeout=2,
+        headers={
+            "authorization": f"Bearer {token}",
+        },
+        json={
+            "schemaVersion": "v1",
+            "start": int((datetime.now(tz=UTC).replace(second=0, microsecond=0) - timedelta(minutes=5)).timestamp() * 1000),
+            "end": int(datetime.now(tz=UTC).replace(second=0, microsecond=0).timestamp() * 1000),
+            "requestType": "time_series",
+            "compositeQuery": {
+                "queries": [
+                    {
+                        "type": "builder_query",
+                        "spec": {
+                            "name": "A",
+                            "signal": "logs",
+                            "stepInterval": 60,
+                            "disabled": False,
+                            "filter": {"expression": "service.name = 'erlang' OR cloud.account.id = '000'"},
+                            "having": {"expression": ""},
+                            "aggregations": [{"expression": "count()"}],
+                        },
+                    }
+                ]
+            },
+            "formatOptions": {"formatTableResultForUI": False, "fillGaps": False},
+        },
+    )
+
+    assert response.status_code == HTTPStatus.OK
+    assert response.json()["status"] == "success"
+
+    results = response.json()["data"]["data"]["results"]
+    assert len(results) == 1
+
+    aggregations = results[0]["aggregations"]
+    assert len(aggregations) == 1
+
+    series = aggregations[0]["series"]
+    assert len(series) == 1
+
+    values = series[0]["values"]
+    assert len(values) == 3
+
+    # Do not care about the order of the values
+    assert {
+        "timestamp": int((now - timedelta(minutes=3)).replace(second=0, microsecond=0).timestamp() * 1000),
+        "value": 15,
+    } in values
+    assert {
+        "timestamp": int((now - timedelta(minutes=2)).replace(second=0, microsecond=0).timestamp() * 1000),
+        "value": 23,
+    } in values
+    assert {
+        "timestamp": int((now - timedelta(minutes=1)).replace(second=0, microsecond=0).timestamp() * 1000),
+        "value": 9,
+    } in values
+
+    # count() of all logs grouped by host.name for the last 5 minutes
+    response = requests.post(
+        signoz.self.host_configs["8080"].get("/api/v5/query_range"),
+        timeout=2,
+        headers={
+            "authorization": f"Bearer {token}",
+        },
+        json={
+            "schemaVersion": "v1",
+            "start": int((datetime.now(tz=UTC).replace(second=0, microsecond=0) - timedelta(minutes=5)).timestamp() * 1000),
+            "end": int(datetime.now(tz=UTC).replace(second=0, microsecond=0).timestamp() * 1000),
+            "requestType": "time_series",
+            "compositeQuery": {
+                "queries": [
+                    {
+                        "type": "builder_query",
+                        "spec": {
+                            "name": "A",
+                            "signal": "logs",
+                            "stepInterval": 60,
+                            "disabled": False,
+                            "groupBy": [
+                                {
+                                    "name": "host.name",
+                                    "fieldDataType": "string",
+                                    "fieldContext": "resource",
+                                }
+                            ],
+                            "order": [{"key": {"name": "host.name"}, "direction": "desc"}],
+                            "having": {"expression": ""},
+                            "aggregations": [{"expression": "count()"}],
+                        },
+                    }
+                ]
+            },
+            "formatOptions": {"formatTableResultForUI": False, "fillGaps": False},
+        },
+    )
+
+    response_with_inline_context = make_query_request(
+        signoz,
+        token,
+        start_ms=int((datetime.now(tz=UTC).replace(second=0, microsecond=0) - timedelta(minutes=5)).timestamp() * 1000),
+        end_ms=int(datetime.now(tz=UTC).replace(second=0, microsecond=0).timestamp() * 1000),
+        request_type="time_series",
+        queries=[
+            {
+                "type": "builder_query",
+                "spec": {
+                    "name": "A",
+                    "signal": "logs",
+                    "stepInterval": 60,
+                    "disabled": False,
+                    "groupBy": [
+                        {
+                            "name": "resource.host.name:string",
+                        }
+                    ],
+                    "order": [{"key": {"name": "host.name"}, "direction": "desc"}],
+                    "having": {"expression": ""},
+                    "aggregations": [{"expression": "count()"}],
+                },
+            }
+        ],
+    )
+
+    assert_identical_query_response(response, response_with_inline_context)
+
+    assert response.status_code == HTTPStatus.OK
+    assert response.json()["status"] == "success"
+
+    results = response.json()["data"]["data"]["results"]
+    assert len(results) == 1
+
+    aggregations = results[0]["aggregations"]
+    assert len(aggregations) == 1
+
+    series = aggregations[0]["series"]
+    assert len(series) == 2
+
+    # Care about the order of the values
+    assert series[0]["labels"] == [
+        {
+            "key": {
+                "name": "host.name",
+            },
+            "value": "linux-001",
+        }
+    ]
+    assert {
+        "timestamp": int((now - timedelta(minutes=3)).replace(second=0, microsecond=0).timestamp() * 1000),
+        "value": 14,
+    } in series[0]["values"]
+    assert {
+        "timestamp": int((now - timedelta(minutes=2)).replace(second=0, microsecond=0).timestamp() * 1000),
+        "value": 11,
+    } in series[0]["values"]
+    assert {
+        "timestamp": int((now - timedelta(minutes=1)).replace(second=0, microsecond=0).timestamp() * 1000),
+        "value": 8,
+    } in series[0]["values"]
+
+    assert series[1]["labels"] == [
+        {
+            "key": {
+                "name": "host.name",
+            },
+            "value": "linux-000",
+        }
+    ]
+    assert {
+        "timestamp": int((now - timedelta(minutes=3)).replace(second=0, microsecond=0).timestamp() * 1000),
+        "value": 15,
+    } in series[1]["values"]
+    assert {
+        "timestamp": int((now - timedelta(minutes=2)).replace(second=0, microsecond=0).timestamp() * 1000),
+        "value": 12,
+    } in series[1]["values"]
+    assert {
+        "timestamp": int((now - timedelta(minutes=1)).replace(second=0, microsecond=0).timestamp() * 1000),
+        "value": 9,
+    } in series[1]["values"]
+
+
+def test_datatype_collision(
+    signoz: types.SigNoz,
+    create_user_admin: None,  # pylint: disable=unused-argument
+    get_token: Callable[[str, str], str],
+    insert_logs: Callable[[list[Logs]], None],
+) -> None:
+    """
+    Setup:
+    Insert logs with data type collision scenarios to test DataTypeCollisionHandledFieldName function
+
+    Tests:
+    1. severity_number comparison with string value
+    2. http.status_code with mixed string/number values
+    3. response.time with string values in numeric field
+    4. Edge cases: empty strings
+    """
+    now = datetime.now(tz=UTC).replace(second=0, microsecond=0)
+    logs: list[Logs] = []
+
+    # Logs with string values in numeric fields
+    severity_levels = ["DEBUG", "INFO", "WARN"]
+    for i in range(3):
+        logs.append(
+            Logs(
+                timestamp=now - timedelta(microseconds=i + 1),
+                resources={
+                    "deployment.environment": "production",
+                    "service.name": "java",
+                    "os.type": "linux",
+                    "host.name": f"linux-00{i % 2}",
+                    "cloud.provider": "integration",
+                    "cloud.account.id": f"00{i % 2}",
+                },
+                attributes={
+                    "log.iostream": "stdout",
+                    "logtag": "F",
+                    "code.file": "/opt/Integration.java",
+                    "code.function": "com.example.Integration.process",
+                    "code.line": i + 1,
+                    "telemetry.sdk.language": "java",
+                    "http.status_code": "200",  # String value
+                    "response.time": "123.45",  # String value
+                },
+                body=f"Test log {i + 1} with string values",
+                severity_text=severity_levels[i],  # DEBUG(5-8), INFO(9-12), WARN(13-16)
+            )
+        )
+
+    # Logs with numeric values in string fields
+    severity_levels_2 = ["ERROR", "FATAL", "TRACE", "DEBUG"]
+    for i in range(4):
+        logs.append(
+            Logs(
+                timestamp=now - timedelta(microseconds=i + 10),
+                resources={
+                    "deployment.environment": "production",
+                    "service.name": "go",
+                    "os.type": "linux",
+                    "host.name": f"linux-00{i % 2}",
+                    "cloud.provider": "integration",
+                    "cloud.account.id": f"00{i % 2}",
+                },
+                attributes={
+                    "log.iostream": "stdout",
+                    "logtag": "F",
+                    "code.file": "/opt/integration.go",
+                    "code.function": "com.example.Integration.process",
+                    "code.line": i + 1,
+                    "telemetry.sdk.language": "go",
+                    "http.status_code": 404,  # Numeric value
+                    "response.time": 456.78,  # Numeric value
+                },
+                body=f"Test log {i + 4} with numeric values",
+                severity_text=severity_levels_2[i],  # ERROR(17-20), FATAL(21-24), TRACE(1-4), DEBUG(5-8)
+            )
+        )
+
+    # Edge case: empty string and zero value
+    logs.append(
+        Logs(
+            timestamp=now - timedelta(microseconds=20),
+            resources={
+                "deployment.environment": "production",
+                "service.name": "python",
+                "os.type": "linux",
+                "host.name": "linux-002",
+                "cloud.provider": "integration",
+                "cloud.account.id": "002",
+            },
+            attributes={
+                "log.iostream": "stdout",
+                "logtag": "F",
+                "code.file": "/opt/integration.py",
+                "code.function": "com.example.Integration.process",
+                "code.line": 1,
+                "telemetry.sdk.language": "python",
+                "http.status_code": "",  # Empty string
+                "response.time": 0,  # Zero value
+            },
+            body="Edge case test log",
+            severity_text="ERROR",
+        )
+    )
+
+    insert_logs(logs)
+
+    token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
+
+    # count() of all logs for the where severity_number > '7'
+    response = requests.post(
+        signoz.self.host_configs["8080"].get("/api/v5/query_range"),
+        timeout=2,
+        headers={
+            "authorization": f"Bearer {token}",
+        },
+        json={
+            "schemaVersion": "v1",
+            "start": int((datetime.now(tz=UTC).replace(second=0, microsecond=0) - timedelta(minutes=5)).timestamp() * 1000),
+            "end": int(datetime.now(tz=UTC).replace(second=0, microsecond=0).timestamp() * 1000),
+            "requestType": "scalar",
+            "compositeQuery": {
+                "queries": [
+                    {
+                        "type": "builder_query",
+                        "spec": {
+                            "name": "A",
+                            "signal": "logs",
+                            "stepInterval": 60,
+                            "disabled": False,
+                            "filter": {"expression": "severity_number > '7'"},
+                            "having": {"expression": ""},
+                            "aggregations": [{"expression": "count()"}],
+                        },
+                    }
+                ]
+            },
+            "formatOptions": {"formatTableResultForUI": True, "fillGaps": False},
+        },
+    )
+
+    assert response.status_code == HTTPStatus.OK
+    assert response.json()["status"] == "success"
+
+    results = response.json()["data"]["data"]["results"]
+    assert len(results) == 1
+
+    count = results[0]["data"][0][0]
+    assert count == 5
+
+    # count() of all logs for the where severity_number > '7.0'
+    response = requests.post(
+        signoz.self.host_configs["8080"].get("/api/v5/query_range"),
+        timeout=2,
+        headers={
+            "authorization": f"Bearer {token}",
+        },
+        json={
+            "schemaVersion": "v1",
+            "start": int((datetime.now(tz=UTC).replace(second=0, microsecond=0) - timedelta(minutes=5)).timestamp() * 1000),
+            "end": int(datetime.now(tz=UTC).replace(second=0, microsecond=0).timestamp() * 1000),
+            "requestType": "scalar",
+            "compositeQuery": {
+                "queries": [
+                    {
+                        "type": "builder_query",
+                        "spec": {
+                            "name": "A",
+                            "signal": "logs",
+                            "stepInterval": 60,
+                            "disabled": False,
+                            "filter": {"expression": "severity_number > '7.0'"},
+                            "having": {"expression": ""},
+                            "aggregations": [{"expression": "count()"}],
+                        },
+                    }
+                ]
+            },
+            "formatOptions": {"formatTableResultForUI": True, "fillGaps": False},
+        },
+    )
+
+    assert response.status_code == HTTPStatus.OK
+    assert response.json()["status"] == "success"
+
+    results = response.json()["data"]["data"]["results"]
+    assert len(results) == 1
+
+    count = results[0]["data"][0][0]
+    assert count == 5
+
+    # Test 2: severity_number comparison with string value
+    response = requests.post(
+        signoz.self.host_configs["8080"].get("/api/v5/query_range"),
+        timeout=2,
+        headers={
+            "authorization": f"Bearer {token}",
+        },
+        json={
+            "schemaVersion": "v1",
+            "start": int((datetime.now(tz=UTC).replace(second=0, microsecond=0) - timedelta(minutes=5)).timestamp() * 1000),
+            "end": int(datetime.now(tz=UTC).replace(second=0, microsecond=0).timestamp() * 1000),
+            "requestType": "scalar",
+            "compositeQuery": {
+                "queries": [
+                    {
+                        "type": "builder_query",
+                        "spec": {
+                            "name": "A",
+                            "signal": "logs",
+                            "stepInterval": 60,
+                            "disabled": False,
+                            "filter": {"expression": "severity_number = '13'"},  # String comparison with numeric field
+                            "having": {"expression": ""},
+                            "aggregations": [{"expression": "count()"}],
+                        },
+                    }
+                ]
+            },
+            "formatOptions": {"formatTableResultForUI": True, "fillGaps": False},
+        },
+    )
+
+    assert response.status_code == HTTPStatus.OK
+    assert response.json()["status"] == "success"
+
+    results = response.json()["data"]["data"]["results"]
+    assert len(results) == 1
+
+    count = results[0]["data"][0][0]
+    # WARN severity maps to 13-16 range, so should find 1 log with severity_number = 13
+    assert count == 1
+
+    # Test 3: http.status_code with numeric value (query contains number, actual value is string "200")
+    response = requests.post(
+        signoz.self.host_configs["8080"].get("/api/v5/query_range"),
+        timeout=2,
+        headers={
+            "authorization": f"Bearer {token}",
+        },
+        json={
+            "schemaVersion": "v1",
+            "start": int((datetime.now(tz=UTC).replace(second=0, microsecond=0) - timedelta(minutes=5)).timestamp() * 1000),
+            "end": int(datetime.now(tz=UTC).replace(second=0, microsecond=0).timestamp() * 1000),
+            "requestType": "scalar",
+            "compositeQuery": {
+                "queries": [
+                    {
+                        "type": "builder_query",
+                        "spec": {
+                            "name": "A",
+                            "signal": "logs",
+                            "stepInterval": 60,
+                            "disabled": False,
+                            "filter": {"expression": "http.status_code = 200"},  # Numeric comparison with string field
+                            "having": {"expression": ""},
+                            "aggregations": [{"expression": "count()"}],
+                        },
+                    }
+                ]
+            },
+            "formatOptions": {"formatTableResultForUI": True, "fillGaps": False},
+        },
+    )
+
+    assert response.status_code == HTTPStatus.OK
+    assert response.json()["status"] == "success"
+
+    results = response.json()["data"]["data"]["results"]
+    assert len(results) == 1
+
+    count = results[0]["data"][0][0]
+    # Should return 3 logs with http.status_code = "200" (first 3 logs have string value "200")
+    assert count == 3
+
+    # Test 4: http.status_code with string value (query contains string, actual value is numeric 404)
+    response = requests.post(
+        signoz.self.host_configs["8080"].get("/api/v5/query_range"),
+        timeout=2,
+        headers={
+            "authorization": f"Bearer {token}",
+        },
+        json={
+            "schemaVersion": "v1",
+            "start": int((datetime.now(tz=UTC).replace(second=0, microsecond=0) - timedelta(minutes=5)).timestamp() * 1000),
+            "end": int(datetime.now(tz=UTC).replace(second=0, microsecond=0).timestamp() * 1000),
+            "requestType": "scalar",
+            "compositeQuery": {
+                "queries": [
+                    {
+                        "type": "builder_query",
+                        "spec": {
+                            "name": "A",
+                            "signal": "logs",
+                            "stepInterval": 60,
+                            "disabled": False,
+                            "filter": {"expression": "http.status_code = '404'"},  # String comparison with numeric field
+                            "having": {"expression": ""},
+                            "aggregations": [{"expression": "count()"}],
+                        },
+                    }
+                ]
+            },
+            "formatOptions": {"formatTableResultForUI": True, "fillGaps": False},
+        },
+    )
+
+    assert response.status_code == HTTPStatus.OK
+    assert response.json()["status"] == "success"
+
+    results = response.json()["data"]["data"]["results"]
+    assert len(results) == 1
+
+    count = results[0]["data"][0][0]
+    # Should return 4 logs with http.status_code = 404 (next 4 logs have numeric value 404)
+    assert count == 4
+
+    # Test 5: Edge case - empty string comparison
+    response = requests.post(
+        signoz.self.host_configs["8080"].get("/api/v5/query_range"),
+        timeout=2,
+        headers={
+            "authorization": f"Bearer {token}",
+        },
+        json={
+            "schemaVersion": "v1",
+            "start": int((datetime.now(tz=UTC).replace(second=0, microsecond=0) - timedelta(minutes=5)).timestamp() * 1000),
+            "end": int(datetime.now(tz=UTC).replace(second=0, microsecond=0).timestamp() * 1000),
+            "requestType": "scalar",
+            "compositeQuery": {
+                "queries": [
+                    {
+                        "type": "builder_query",
+                        "spec": {
+                            "name": "A",
+                            "signal": "logs",
+                            "stepInterval": 60,
+                            "disabled": False,
+                            "filter": {"expression": "http.status_code = ''"},  # Empty string comparison
+                            "having": {"expression": ""},
+                            "aggregations": [{"expression": "count()"}],
+                        },
+                    }
+                ]
+            },
+            "formatOptions": {"formatTableResultForUI": True, "fillGaps": False},
+        },
+    )
+
+    assert response.status_code == HTTPStatus.OK
+    assert response.json()["status"] == "success"
+
+    results = response.json()["data"]["data"]["results"]
+    assert len(results) == 1
+
+    count = results[0]["data"][0][0]
+    # Should return 1 log with empty http.status_code (edge case log)
+    assert count == 1

tests/integration/tests/querierlogs/03_fill.py

@@ -0,0 +1,849 @@
+from collections.abc import Callable
+from datetime import UTC, datetime, timedelta
+from http import HTTPStatus
+
+import requests
+
+from fixtures import types
+from fixtures.auth import USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD
+from fixtures.logs import Logs
+from fixtures.querier import (
+    assert_minutely_bucket_values,
+    find_named_result,
+    index_series_by_label,
+)
+
+
+def test_logs_fill_gaps(
+    signoz: types.SigNoz,
+    create_user_admin: None,  # pylint: disable=unused-argument
+    get_token: Callable[[str, str], str],
+    insert_logs: Callable[[list[Logs]], None],
+) -> None:
+    """
+    Test fillGaps for logs without groupBy.
+    """
+    now = datetime.now(tz=UTC).replace(second=0, microsecond=0)
+    logs: list[Logs] = [
+        Logs(
+            timestamp=now - timedelta(minutes=3),
+            resources={"service.name": "test-service"},
+            attributes={"code.file": "test.py"},
+            body="Log at minute 3",
+            severity_text="INFO",
+        ),
+        Logs(
+            timestamp=now - timedelta(minutes=1),
+            resources={"service.name": "test-service"},
+            attributes={"code.file": "test.py"},
+            body="Log at minute 1",
+            severity_text="INFO",
+        ),
+    ]
+    insert_logs(logs)
+
+    token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
+
+    start_ms = int((now - timedelta(minutes=5)).timestamp() * 1000)
+    end_ms = int(now.timestamp() * 1000)
+
+    response = requests.post(
+        signoz.self.host_configs["8080"].get("/api/v5/query_range"),
+        timeout=5,
+        headers={"authorization": f"Bearer {token}"},
+        json={
+            "schemaVersion": "v1",
+            "start": start_ms,
+            "end": end_ms,
+            "requestType": "time_series",
+            "compositeQuery": {
+                "queries": [
+                    {
+                        "type": "builder_query",
+                        "spec": {
+                            "name": "A",
+                            "signal": "logs",
+                            "stepInterval": 60,
+                            "disabled": False,
+                            "having": {"expression": ""},
+                            "aggregations": [{"expression": "count()"}],
+                        },
+                    }
+                ]
+            },
+            "formatOptions": {"formatTableResultForUI": False, "fillGaps": True},
+        },
+    )
+
+    assert response.status_code == HTTPStatus.OK
+    assert response.json()["status"] == "success"
+
+    results = response.json()["data"]["data"]["results"]
+    assert len(results) == 1
+
+    aggregations = results[0]["aggregations"]
+    assert len(aggregations) == 1
+
+    series = aggregations[0]["series"]
+    assert len(series) >= 1
+
+    values = series[0]["values"]
+    # Logs are exactly at minute -3 and minute -1, so counts should be 1 there and 0 everywhere else
+    ts_min_1 = int((now - timedelta(minutes=1)).timestamp() * 1000)
+    ts_min_3 = int((now - timedelta(minutes=3)).timestamp() * 1000)
+
+    assert_minutely_bucket_values(
+        values,
+        now,
+        expected_by_ts={ts_min_1: 1, ts_min_3: 1},
+        context="logs/fillGaps",
+    )
+
+
+def test_logs_fill_gaps_with_group_by(
+    signoz: types.SigNoz,
+    create_user_admin: None,  # pylint: disable=unused-argument
+    get_token: Callable[[str, str], str],
+    insert_logs: Callable[[list[Logs]], None],
+) -> None:
+    """
+    Test fillGaps for logs with groupBy.
+    """
+    now = datetime.now(tz=UTC).replace(second=0, microsecond=0)
+    logs: list[Logs] = [
+        Logs(
+            timestamp=now - timedelta(minutes=3),
+            resources={"service.name": "service-a"},
+            attributes={"code.file": "test.py"},
+            body="Log from service A",
+            severity_text="INFO",
+        ),
+        Logs(
+            timestamp=now - timedelta(minutes=2),
+            resources={"service.name": "service-b"},
+            attributes={"code.file": "test.py"},
+            body="Log from service B",
+            severity_text="ERROR",
+        ),
+    ]
+    insert_logs(logs)
+
+    token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
+
+    start_ms = int((now - timedelta(minutes=5)).timestamp() * 1000)
+    end_ms = int(now.timestamp() * 1000)
+
+    response = requests.post(
+        signoz.self.host_configs["8080"].get("/api/v5/query_range"),
+        timeout=5,
+        headers={"authorization": f"Bearer {token}"},
+        json={
+            "schemaVersion": "v1",
+            "start": start_ms,
+            "end": end_ms,
+            "requestType": "time_series",
+            "compositeQuery": {
+                "queries": [
+                    {
+                        "type": "builder_query",
+                        "spec": {
+                            "name": "A",
+                            "signal": "logs",
+                            "stepInterval": 60,
+                            "disabled": False,
+                            "groupBy": [
+                                {
+                                    "name": "service.name",
+                                    "fieldDataType": "string",
+                                    "fieldContext": "resource",
+                                }
+                            ],
+                            "having": {"expression": ""},
+                            "aggregations": [{"expression": "count()"}],
+                        },
+                    }
+                ]
+            },
+            "formatOptions": {"formatTableResultForUI": False, "fillGaps": True},
+        },
+    )
+
+    assert response.status_code == HTTPStatus.OK
+    assert response.json()["status"] == "success"
+
+    results = response.json()["data"]["data"]["results"]
+    assert len(results) == 1
+
+    aggregations = results[0]["aggregations"]
+    assert len(aggregations) == 1
+
+    series = aggregations[0]["series"]
+    assert len(series) == 2, "Expected 2 series for 2 service groups"
+    ts_min_2 = int((now - timedelta(minutes=2)).timestamp() * 1000)
+    ts_min_3 = int((now - timedelta(minutes=3)).timestamp() * 1000)
+
+    series_by_service = index_series_by_label(series, "service.name")
+
+    assert set(series_by_service.keys()) == {"service-a", "service-b"}
+
+    # service-a has one log at minute -3, service-b at minute -2
+    expectations = {
+        "service-a": {ts_min_3: 1.0},
+        "service-b": {ts_min_2: 1.0},
+    }
+
+    for service_name, s in series_by_service.items():
+        assert_minutely_bucket_values(
+            s["values"],
+            now,
+            expected_by_ts=expectations[service_name],
+            context=f"logs/fillGaps/{service_name}",
+        )
+
+
+def test_logs_fill_gaps_formula(
+    signoz: types.SigNoz,
+    create_user_admin: None,  # pylint: disable=unused-argument
+    get_token: Callable[[str, str], str],
+    insert_logs: Callable[[list[Logs]], None],
+) -> None:
+    """
+    Test fillGaps for logs with formula.
+    """
+    now = datetime.now(tz=UTC).replace(second=0, microsecond=0)
+    logs: list[Logs] = [
+        Logs(
+            timestamp=now - timedelta(minutes=3),
+            resources={"service.name": "test"},
+            attributes={"code.file": "test.py"},
+            body="Test log",
+            severity_text="INFO",
+        ),
+        Logs(
+            timestamp=now - timedelta(minutes=2),
+            resources={"service.name": "another-test"},
+            attributes={"code.file": "test.py"},
+            body="Another test log",
+            severity_text="INFO",
+        ),
+    ]
+    insert_logs(logs)
+
+    token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
+
+    start_ms = int((now - timedelta(minutes=5)).timestamp() * 1000)
+    end_ms = int(now.timestamp() * 1000)
+
+    response = requests.post(
+        signoz.self.host_configs["8080"].get("/api/v5/query_range"),
+        timeout=5,
+        headers={"authorization": f"Bearer {token}"},
+        json={
+            "schemaVersion": "v1",
+            "start": start_ms,
+            "end": end_ms,
+            "requestType": "time_series",
+            "compositeQuery": {
+                "queries": [
+                    {
+                        "type": "builder_query",
+                        "spec": {
+                            "name": "A",
+                            "signal": "logs",
+                            "stepInterval": 60,
+                            "disabled": True,
+                            "filter": {"expression": "service.name = 'test'"},
+                            "having": {"expression": ""},
+                            "aggregations": [{"expression": "count()"}],
+                        },
+                    },
+                    {
+                        "type": "builder_query",
+                        "spec": {
+                            "name": "B",
+                            "signal": "logs",
+                            "stepInterval": 60,
+                            "disabled": True,
+                            "filter": {"expression": "service.name = 'another-test'"},
+                            "having": {"expression": ""},
+                            "aggregations": [{"expression": "count()"}],
+                        },
+                    },
+                    {
+                        "type": "builder_formula",
+                        "spec": {
+                            "name": "F1",
+                            "expression": "A + B",
+                            "disabled": False,
+                        },
+                    },
+                ]
+            },
+            "formatOptions": {"formatTableResultForUI": False, "fillGaps": True},
+        },
+    )
+
+    assert response.status_code == HTTPStatus.OK
+    assert response.json()["status"] == "success"
+
+    results = response.json()["data"]["data"]["results"]
+    assert len(results) == 1
+
+    ts_min_2 = int((now - timedelta(minutes=2)).timestamp() * 1000)
+    ts_min_3 = int((now - timedelta(minutes=3)).timestamp() * 1000)
+
+    f1 = find_named_result(results, "F1")
+    assert f1 is not None, "Expected formula result named F1"
+
+    aggregations = f1.get("aggregations") or []
+    assert len(aggregations) == 1
+    series = aggregations[0]["series"]
+    assert len(series) >= 1
+
+    assert_minutely_bucket_values(
+        series[0]["values"],
+        now,
+        expected_by_ts={ts_min_3: 1, ts_min_2: 1},
+        context="logs/fillGaps/F1",
+    )
+
+
+def test_logs_fill_gaps_formula_with_group_by(
+    signoz: types.SigNoz,
+    create_user_admin: None,  # pylint: disable=unused-argument
+    get_token: Callable[[str, str], str],
+    insert_logs: Callable[[list[Logs]], None],
+) -> None:
+    """
+    Test fillGaps for logs with formula and groupBy.
+    """
+    now = datetime.now(tz=UTC).replace(second=0, microsecond=0)
+    logs: list[Logs] = [
+        Logs(
+            timestamp=now - timedelta(minutes=3),
+            resources={"service.name": "group1"},
+            attributes={"code.file": "test.py"},
+            body="Test log",
+            severity_text="INFO",
+        ),
+        Logs(
+            timestamp=now - timedelta(minutes=2),
+            resources={"service.name": "group2"},
+            attributes={"code.file": "test.py"},
+            body="Test log 2",
+            severity_text="INFO",
+        ),
+    ]
+    insert_logs(logs)
+
+    token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
+
+    start_ms = int((now - timedelta(minutes=5)).timestamp() * 1000)
+    end_ms = int(now.timestamp() * 1000)
+
+    response = requests.post(
+        signoz.self.host_configs["8080"].get("/api/v5/query_range"),
+        timeout=5,
+        headers={"authorization": f"Bearer {token}"},
+        json={
+            "schemaVersion": "v1",
+            "start": start_ms,
+            "end": end_ms,
+            "requestType": "time_series",
+            "compositeQuery": {
+                "queries": [
+                    {
+                        "type": "builder_query",
+                        "spec": {
+                            "name": "A",
+                            "signal": "logs",
+                            "stepInterval": 60,
+                            "disabled": True,
+                            "groupBy": [
+                                {
+                                    "name": "service.name",
+                                    "fieldDataType": "string",
+                                    "fieldContext": "resource",
+                                }
+                            ],
+                            "having": {"expression": ""},
+                            "aggregations": [{"expression": "count()"}],
+                        },
+                    },
+                    {
+                        "type": "builder_query",
+                        "spec": {
+                            "name": "B",
+                            "signal": "logs",
+                            "stepInterval": 60,
+                            "disabled": True,
+                            "groupBy": [
+                                {
+                                    "name": "service.name",
+                                    "fieldDataType": "string",
+                                    "fieldContext": "resource",
+                                }
+                            ],
+                            "having": {"expression": ""},
+                            "aggregations": [{"expression": "count()"}],
+                        },
+                    },
+                    {
+                        "type": "builder_formula",
+                        "spec": {
+                            "name": "F1",
+                            "expression": "A + B",
+                            "disabled": False,
+                        },
+                    },
+                ]
+            },
+            "formatOptions": {"formatTableResultForUI": False, "fillGaps": True},
+        },
+    )
+
+    assert response.status_code == HTTPStatus.OK
+    assert response.json()["status"] == "success"
+
+    results = response.json()["data"]["data"]["results"]
+    assert len(results) == 1
+    ts_min_2 = int((now - timedelta(minutes=2)).timestamp() * 1000)
+    ts_min_3 = int((now - timedelta(minutes=3)).timestamp() * 1000)
+
+    f1 = find_named_result(results, "F1")
+    assert f1 is not None, "Expected formula result named F1"
+
+    aggregations = f1.get("aggregations") or []
+    assert len(aggregations) == 1
+    series = aggregations[0]["series"]
+    assert len(series) == 2
+
+    series_by_service = index_series_by_label(series, "service.name")
+
+    assert set(series_by_service.keys()) == {"group1", "group2"}
+
+    expectations = {
+        "group1": {ts_min_3: 2.0},
+        "group2": {ts_min_2: 2.0},
+    }
+
+    for service_name, s in series_by_service.items():
+        assert_minutely_bucket_values(
+            s["values"],
+            now,
+            expected_by_ts=expectations[service_name],
+            context=f"logs/fillGaps/F1/{service_name}",
+        )
+
+
+def test_logs_fill_zero(
+    signoz: types.SigNoz,
+    create_user_admin: None,  # pylint: disable=unused-argument
+    get_token: Callable[[str, str], str],
+    insert_logs: Callable[[list[Logs]], None],
+) -> None:
+    """
+    Test fillZero function for logs without groupBy.
+    """
+    now = datetime.now(tz=UTC).replace(second=0, microsecond=0)
+    logs: list[Logs] = [
+        Logs(
+            timestamp=now - timedelta(minutes=3),
+            resources={"service.name": "test"},
+            attributes={"code.file": "test.py"},
+            body="Test log",
+            severity_text="INFO",
+        ),
+    ]
+    insert_logs(logs)
+
+    token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
+
+    start_ms = int((now - timedelta(minutes=5)).timestamp() * 1000)
+    end_ms = int(now.timestamp() * 1000)
+
+    response = requests.post(
+        signoz.self.host_configs["8080"].get("/api/v5/query_range"),
+        timeout=5,
+        headers={"authorization": f"Bearer {token}"},
+        json={
+            "schemaVersion": "v1",
+            "start": start_ms,
+            "end": end_ms,
+            "requestType": "time_series",
+            "compositeQuery": {
+                "queries": [
+                    {
+                        "type": "builder_query",
+                        "spec": {
+                            "name": "A",
+                            "signal": "logs",
+                            "stepInterval": 60,
+                            "disabled": False,
+                            "having": {"expression": ""},
+                            "aggregations": [{"expression": "count()"}],
+                            "functions": [{"name": "fillZero"}],
+                        },
+                    }
+                ]
+            },
+            "formatOptions": {"formatTableResultForUI": False, "fillGaps": False},
+        },
+    )
+
+    assert response.status_code == HTTPStatus.OK
+    assert response.json()["status"] == "success"
+
+    results = response.json()["data"]["data"]["results"]
+    assert len(results) == 1
+
+    aggregations = results[0].get("aggregations") or []
+    assert len(aggregations) == 1
+    series = aggregations[0]["series"]
+    assert len(series) >= 1
+    values = series[0]["values"]
+    ts_min_3 = int((now - timedelta(minutes=3)).timestamp() * 1000)
+
+    assert_minutely_bucket_values(
+        values,
+        now,
+        expected_by_ts={ts_min_3: 1},
+        context="logs/fillZero",
+    )
+
+
+def test_logs_fill_zero_with_group_by(
+    signoz: types.SigNoz,
+    create_user_admin: None,  # pylint: disable=unused-argument
+    get_token: Callable[[str, str], str],
+    insert_logs: Callable[[list[Logs]], None],
+) -> None:
+    """
+    Test fillZero function for logs with groupBy.
+    """
+    now = datetime.now(tz=UTC).replace(second=0, microsecond=0)
+    logs: list[Logs] = [
+        Logs(
+            timestamp=now - timedelta(minutes=3),
+            resources={"service.name": "service-a"},
+            attributes={"code.file": "test.py"},
+            body="Log A",
+            severity_text="INFO",
+        ),
+        Logs(
+            timestamp=now - timedelta(minutes=2),
+            resources={"service.name": "service-b"},
+            attributes={"code.file": "test.py"},
+            body="Log B",
+            severity_text="ERROR",
+        ),
+    ]
+    insert_logs(logs)
+
+    token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
+
+    start_ms = int((now - timedelta(minutes=5)).timestamp() * 1000)
+    end_ms = int(now.timestamp() * 1000)
+
+    response = requests.post(
+        signoz.self.host_configs["8080"].get("/api/v5/query_range"),
+        timeout=5,
+        headers={"authorization": f"Bearer {token}"},
+        json={
+            "schemaVersion": "v1",
+            "start": start_ms,
+            "end": end_ms,
+            "requestType": "time_series",
+            "compositeQuery": {
+                "queries": [
+                    {
+                        "type": "builder_query",
+                        "spec": {
+                            "name": "A",
+                            "signal": "logs",
+                            "stepInterval": 60,
+                            "disabled": False,
+                            "groupBy": [
+                                {
+                                    "name": "service.name",
+                                    "fieldDataType": "string",
+                                    "fieldContext": "resource",
+                                }
+                            ],
+                            "having": {"expression": ""},
+                            "aggregations": [{"expression": "count()"}],
+                            "functions": [{"name": "fillZero"}],
+                        },
+                    }
+                ]
+            },
+            "formatOptions": {"formatTableResultForUI": False, "fillGaps": False},
+        },
+    )
+
+    assert response.status_code == HTTPStatus.OK
+    assert response.json()["status"] == "success"
+
+    results = response.json()["data"]["data"]["results"]
+    assert len(results) == 1
+
+    aggregations = results[0]["aggregations"]
+    assert len(aggregations) == 1
+
+    series = aggregations[0]["series"]
+    assert len(series) == 2, "Expected 2 series for 2 service groups"
+    ts_min_2 = int((now - timedelta(minutes=2)).timestamp() * 1000)
+    ts_min_3 = int((now - timedelta(minutes=3)).timestamp() * 1000)
+
+    series_by_service = index_series_by_label(series, "service.name")
+
+    assert set(series_by_service.keys()) == {"service-a", "service-b"}
+    expectations = {
+        "service-a": {ts_min_3: 1.0},
+        "service-b": {ts_min_2: 1.0},
+    }
+
+    for service_name, s in series_by_service.items():
+        assert_minutely_bucket_values(
+            s["values"],
+            now,
+            expected_by_ts=expectations[service_name],
+            context=f"logs/fillZero/{service_name}",
+        )
+
+
+def test_logs_fill_zero_formula(
+    signoz: types.SigNoz,
+    create_user_admin: None,  # pylint: disable=unused-argument
+    get_token: Callable[[str, str], str],
+    insert_logs: Callable[[list[Logs]], None],
+) -> None:
+    """
+    Test fillZero function for logs with formula.
+    """
+    now = datetime.now(tz=UTC).replace(second=0, microsecond=0)
+    logs: list[Logs] = [
+        Logs(
+            timestamp=now - timedelta(minutes=3),
+            resources={"service.name": "test"},
+            attributes={"code.file": "test.py"},
+            body="Test log",
+            severity_text="INFO",
+        ),
+        Logs(
+            timestamp=now - timedelta(minutes=2),
+            resources={"service.name": "another-test"},
+            attributes={"code.file": "test.py"},
+            body="Another log",
+            severity_text="INFO",
+        ),
+    ]
+    insert_logs(logs)
+
+    token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
+
+    start_ms = int((now - timedelta(minutes=5)).timestamp() * 1000)
+    end_ms = int(now.timestamp() * 1000)
+
+    response = requests.post(
+        signoz.self.host_configs["8080"].get("/api/v5/query_range"),
+        timeout=5,
+        headers={"authorization": f"Bearer {token}"},
+        json={
+            "schemaVersion": "v1",
+            "start": start_ms,
+            "end": end_ms,
+            "requestType": "time_series",
+            "compositeQuery": {
+                "queries": [
+                    {
+                        "type": "builder_query",
+                        "spec": {
+                            "name": "A",
+                            "signal": "logs",
+                            "stepInterval": 60,
+                            "disabled": True,
+                            "filter": {"expression": "service.name = 'test'"},
+                            "having": {"expression": ""},
+                            "aggregations": [{"expression": "count()"}],
+                        },
+                    },
+                    {
+                        "type": "builder_query",
+                        "spec": {
+                            "name": "B",
+                            "signal": "logs",
+                            "stepInterval": 60,
+                            "disabled": True,
+                            "filter": {"expression": "service.name = 'another-test'"},
+                            "having": {"expression": ""},
+                            "aggregations": [{"expression": "count()"}],
+                        },
+                    },
+                    {
+                        "type": "builder_formula",
+                        "spec": {
+                            "name": "F1",
+                            "expression": "A + B",
+                            "disabled": False,
+                            "functions": [{"name": "fillZero"}],
+                        },
+                    },
+                ]
+            },
+            "formatOptions": {"formatTableResultForUI": False, "fillGaps": False},
+        },
+    )
+
+    assert response.status_code == HTTPStatus.OK
+    assert response.json()["status"] == "success"
+
+    results = response.json()["data"]["data"]["results"]
+    assert len(results) == 1
+    ts_min_2 = int((now - timedelta(minutes=2)).timestamp() * 1000)
+    ts_min_3 = int((now - timedelta(minutes=3)).timestamp() * 1000)
+
+    f1 = find_named_result(results, "F1")
+    assert f1 is not None, "Expected formula result named F1"
+
+    aggregations = f1.get("aggregations") or []
+    assert len(aggregations) == 1
+    series = aggregations[0]["series"]
+    assert len(series) >= 1
+    values = series[0]["values"]
+
+    assert_minutely_bucket_values(
+        values,
+        now,
+        expected_by_ts={ts_min_3: 1, ts_min_2: 1},
+        context="logs/fillZero/F1",
+    )
+
+
+def test_logs_fill_zero_formula_with_group_by(
+    signoz: types.SigNoz,
+    create_user_admin: None,  # pylint: disable=unused-argument
+    get_token: Callable[[str, str], str],
+    insert_logs: Callable[[list[Logs]], None],
+) -> None:
+    """
+    Test fillZero function for logs with formula and groupBy.
+    """
+    now = datetime.now(tz=UTC).replace(second=0, microsecond=0)
+    logs: list[Logs] = [
+        Logs(
+            timestamp=now - timedelta(minutes=3),
+            resources={"service.name": "group1"},
+            attributes={"code.file": "test.py"},
+            body="Test log",
+            severity_text="INFO",
+        ),
+        Logs(
+            timestamp=now - timedelta(minutes=2),
+            resources={"service.name": "group2"},
+            attributes={"code.file": "test.py"},
+            body="Test log 2",
+            severity_text="INFO",
+        ),
+    ]
+    insert_logs(logs)
+
+    token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
+
+    start_ms = int((now - timedelta(minutes=5)).timestamp() * 1000)
+    end_ms = int(now.timestamp() * 1000)
+
+    response = requests.post(
+        signoz.self.host_configs["8080"].get("/api/v5/query_range"),
+        timeout=5,
+        headers={"authorization": f"Bearer {token}"},
+        json={
+            "schemaVersion": "v1",
+            "start": start_ms,
+            "end": end_ms,
+            "requestType": "time_series",
+            "compositeQuery": {
+                "queries": [
+                    {
+                        "type": "builder_query",
+                        "spec": {
+                            "name": "A",
+                            "signal": "logs",
+                            "stepInterval": 60,
+                            "disabled": True,
+                            "groupBy": [
+                                {
+                                    "name": "service.name",
+                                    "fieldDataType": "string",
+                                    "fieldContext": "resource",
+                                }
+                            ],
+                            "having": {"expression": ""},
+                            "aggregations": [{"expression": "count()"}],
+                        },
+                    },
+                    {
+                        "type": "builder_query",
+                        "spec": {
+                            "name": "B",
+                            "signal": "logs",
+                            "stepInterval": 60,
+                            "disabled": True,
+                            "groupBy": [
+                                {
+                                    "name": "service.name",
+                                    "fieldDataType": "string",
+                                    "fieldContext": "resource",
+                                }
+                            ],
+                            "having": {"expression": ""},
+                            "aggregations": [{"expression": "count()"}],
+                        },
+                    },
+                    {
+                        "type": "builder_formula",
+                        "spec": {
+                            "name": "F1",
+                            "expression": "A + B",
+                            "disabled": False,
+                            "functions": [{"name": "fillZero"}],
+                        },
+                    },
+                ]
+            },
+            "formatOptions": {"formatTableResultForUI": False, "fillGaps": False},
+        },
+    )
+
+    assert response.status_code == HTTPStatus.OK
+    assert response.json()["status"] == "success"
+
+    results = response.json()["data"]["data"]["results"]
+    assert len(results) == 1
+    ts_min_2 = int((now - timedelta(minutes=2)).timestamp() * 1000)
+    ts_min_3 = int((now - timedelta(minutes=3)).timestamp() * 1000)
+
+    f1 = find_named_result(results, "F1")
+    assert f1 is not None, "Expected formula result named F1"
+
+    aggregations = f1.get("aggregations") or []
+    assert len(aggregations) == 1
+    series = aggregations[0]["series"]
+    assert len(series) == 2
+
+    series_by_service = index_series_by_label(series, "service.name")
+
+    assert set(series_by_service.keys()) == {"group1", "group2"}
+
+    expectations = {
+        "group1": {ts_min_3: 2.0},
+        "group2": {ts_min_2: 2.0},
+    }
+
+    for service_name, s in series_by_service.items():
+        assert_minutely_bucket_values(
+            s["values"],
+            now,
+            expected_by_ts=expectations[service_name],
+            context=f"logs/fillZero/F1/{service_name}",
+        )

tests/integration/tests/querierlogs/04_formula.py

@@ -0,0 +1,193 @@
+from collections.abc import Callable
+from datetime import UTC, datetime, timedelta
+from http import HTTPStatus
+
+from fixtures import types
+from fixtures.auth import USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD
+from fixtures.logs import Logs
+from fixtures.querier import (
+    build_formula_query,
+    build_group_by_field,
+    build_logs_aggregation,
+    build_order_by,
+    build_scalar_query,
+    find_named_result,
+    make_query_request,
+)
+
+
+def test_logs_formula_orderby_and_limit(
+    signoz: types.SigNoz,
+    create_user_admin: None,  # pylint: disable=unused-argument
+    get_token: Callable[[str, str], str],
+    insert_logs: Callable[[list[Logs]], None],
+) -> None:
+    """
+    Test that formula results are correctly ordered and limited when
+    order and limit are applied on the formula.
+    """
+    now = datetime.now(tz=UTC).replace(second=0, microsecond=0)
+    logs: list[Logs] = []
+    # For service-i (i in 0..9): insert (10 - i) ERROR logs and 2 INFO logs.
+    # A counts ERROR, B counts INFO, so A/B = (10 - i) / 2.
+    # service-0 ratio = 5.0 (highest), service-9 ratio = 0.5 (lowest).
+    for i in range(10):
+        for j in range(10 - i):
+            logs.append(
+                Logs(
+                    timestamp=now - timedelta(minutes=j + 1),
+                    resources={"service.name": f"service-{i}"},
+                    attributes={"code.file": "test.py"},
+                    body=f"Error log {i}-{j}",
+                    severity_text="ERROR",
+                )
+            )
+        for k in range(2):
+            logs.append(
+                Logs(
+                    timestamp=now - timedelta(minutes=k + 1),
+                    resources={"service.name": f"service-{i}"},
+                    attributes={"code.file": "test.py"},
+                    body=f"Info log {i}-{k}",
+                    severity_text="INFO",
+                )
+            )
+    # Extra INFO-only services that appear in B but not in A. The formula
+    for name in ("service-info-only-1", "service-info-only-2"):
+        for k in range(2):
+            logs.append(
+                Logs(
+                    timestamp=now - timedelta(minutes=k + 1),
+                    resources={"service.name": name},
+                    attributes={"code.file": "test.py"},
+                    body=f"Info log {name}-{k}",
+                    severity_text="INFO",
+                )
+            )
+
+    # Logs look like this (columns = minutes before `now`; query range is
+    # (now - 15m, now], so the `now` column is the exclusive upper bound and
+    # no log lands there). E = ERROR, I = INFO, X = both at that minute.
+    #
+    #              t-10 t-9 t-8 t-7 t-6 t-5 t-4 t-3 t-2 t-1 |now |  A  B  A/B
+    # service-0:    E   E   E   E   E   E   E   E   X   X  |    | 10  2  5.0
+    # service-1:    .   E   E   E   E   E   E   E   X   X  |    |  9  2  4.5
+    # service-2:    .   .   E   E   E   E   E   E   X   X  |    |  8  2  4.0
+    # service-3:    .   .   .   E   E   E   E   E   X   X  |    |  7  2  3.5
+    # service-4:    .   .   .   .   E   E   E   E   X   X  |    |  6  2  3.0
+    # service-5:    .   .   .   .   .   E   E   E   X   X  |    |  5  2  2.5
+    # service-6:    .   .   .   .   .   .   E   E   X   X  |    |  4  2  2.0
+    # service-7:    .   .   .   .   .   .   .   E   X   X  |    |  3  2  1.5
+    # service-8:    .   .   .   .   .   .   .   .   X   X  |    |  2  2  1.0
+    # service-9:    .   .   .   .   .   .   .   .   I   X  |    |  1  2  0.5
+    # info-only-1:  .   .   .   .   .   .   .   .   I   I  |    |  0* 2  0.0
+    # info-only-2:  .   .   .   .   .   .   .   .   I   I  |    |  0* 2  0.0
+    #
+    # * A is missing for the info-only services; because A is count(), the
+    #   formula evaluator defaults missing A to 0, yielding A/B = 0.
+    insert_logs(logs)
+
+    token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
+
+    result = make_query_request(
+        signoz,
+        token,
+        start_ms=int((now - timedelta(minutes=15)).timestamp() * 1000),
+        end_ms=int(now.timestamp() * 1000),
+        request_type="scalar",
+        queries=[
+            build_scalar_query(
+                name="A",
+                signal="logs",
+                aggregations=[build_logs_aggregation("count()")],
+                group_by=[build_group_by_field("service.name")],
+                filter_expression="severity_text = 'ERROR'",
+                disabled=True,
+            ),
+            build_scalar_query(
+                name="B",
+                signal="logs",
+                aggregations=[build_logs_aggregation("count()")],
+                group_by=[build_group_by_field("service.name")],
+                filter_expression="severity_text = 'INFO'",
+                disabled=True,
+            ),
+            build_formula_query(
+                "F1",
+                "A / B",
+                order=[build_order_by("__result", "desc")],
+                limit=3,
+            ),
+            build_formula_query(
+                "F2",
+                "A / B",
+                order=[build_order_by("__result", "desc")],
+            ),
+            build_formula_query(
+                "F3",
+                "A / B",
+                order=[build_order_by("__result", "asc")],
+                limit=3,
+            ),
+            build_formula_query(
+                "F4",
+                "A / B",
+                order=[build_order_by("__result", "asc")],
+            ),
+        ],
+    )
+    assert result.status_code == HTTPStatus.OK
+    assert result.json()["status"] == "success"
+
+    results = result.json()["data"]["data"]["results"]
+
+    def extract_services_and_values(query_name: str) -> tuple[list, list]:
+        res = find_named_result(results, query_name)
+        assert res is not None, f"Expected formula result named {query_name}"
+        cols = res["columns"]
+        s_col = next(i for i, c in enumerate(cols) if c["name"] == "service.name")
+        v_col = next(i for i, c in enumerate(cols) if c["name"] == "__result")
+        rows = res["data"]
+        return [row[s_col] for row in rows], [row[v_col] for row in rows]
+
+    # Because A is count(), canDefaultZero["A"] is true; the formula evaluator
+    # defaults A to 0 for services that exist only in B. So the two INFO-only
+    # services appear in the formula result with value 0.0 (extreme bottom in
+    # desc order, extreme top in asc order). Their relative ordering is not
+    # deterministic across separate formula evaluations (tied values).
+    info_only_services = {"service-info-only-1", "service-info-only-2"}
+
+    # F2: desc, no limit -> 12 rows in descending order by value.
+    f2_services, f2_values = extract_services_and_values("F2")
+    assert len(f2_services) == 12, f"F2: expected 12 rows with no limit, got {len(f2_services)}"
+    assert f2_values == [5.0, 4.5, 4.0, 3.5, 3.0, 2.5, 2.0, 1.5, 1.0, 0.5, 0.0, 0.0], f2_values
+    # Top 10 have distinct positive values -> deterministic service ordering.
+    assert f2_services[:10] == [f"service-{i}" for i in range(10)], f2_services[:10]
+    # Tail 2 are the INFO-only services tied at 0.0 (order between them not guaranteed).
+    assert set(f2_services[10:]) == info_only_services, f2_services[10:]
+
+    # F1: desc + limit 3 -> must be exactly the first 3 rows of F2.
+    # Top 3 are not in the tie region, so prefix equality is safe.
+    f1_services, f1_values = extract_services_and_values("F1")
+    assert len(f1_services) == 3, f"F1: expected 3 rows after limit, got {len(f1_services)}"
+    assert f1_services == f2_services[:3], f"F1 services {f1_services} are not the prefix of F2 services {f2_services}"
+    assert f1_values == f2_values[:3], f"F1 values {f1_values} are not the prefix of F2 values {f2_values}"
+
+    # F4: asc, no limit -> 12 rows in ascending order by value.
+    f4_services, f4_values = extract_services_and_values("F4")
+    assert len(f4_services) == 12, f"F4: expected 12 rows with no limit, got {len(f4_services)}"
+    assert f4_values == sorted(f4_values), f"F4 not ascending: {f4_values}"
+    # First 2 are the INFO-only services tied at 0.0 (order between them not guaranteed).
+    assert set(f4_services[:2]) == info_only_services, f4_services[:2]
+    assert f4_values[:2] == [0.0, 0.0], f4_values[:2]
+    # Tail 10 are service-9 down to service-0 by value.
+    assert f4_services[2:] == [f"service-{i}" for i in reversed(range(10))], f4_services[2:]
+    assert f4_values[2:] == [(10 - i) / 2 for i in reversed(range(10))], f4_values[2:]
+
+    # F3: asc + limit 3 -> values must match F4[:3] exactly; service set must
+    # match too. Direct prefix equality on services would be flaky because the
+    # two tied INFO-only entries can swap order between formula evaluations.
+    f3_services, f3_values = extract_services_and_values("F3")
+    assert len(f3_services) == 3, f"F3: expected 3 rows after limit, got {len(f3_services)}"
+    assert f3_values == f4_values[:3], f"F3 values {f3_values} do not match F4[:3] values {f4_values[:3]}"
+    assert set(f3_services) == set(f4_services[:3]), f"F3 services {f3_services} do not match F4[:3] services {f4_services[:3]}"

tests/integration/tests/querierlogs/05_trace_id_filter.py

@@ -0,0 +1,364 @@
+from collections.abc import Callable
+from datetime import UTC, datetime, timedelta
+from http import HTTPStatus
+
+from fixtures import types
+from fixtures.auth import USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD
+from fixtures.logs import Logs
+from fixtures.querier import (
+    make_query_request,
+)
+from fixtures.traces import TraceIdGenerator, Traces, TracesKind, TracesStatusCode
+
+
+def test_logs_list_filter_by_trace_id(
+    signoz: types.SigNoz,
+    create_user_admin: None,  # pylint: disable=unused-argument
+    get_token: Callable[[str, str], str],
+    insert_logs: Callable[[list[Logs]], None],
+    insert_traces: Callable[[list[Traces]], None],
+) -> None:
+    """
+    Tests that filtering logs by trace_id uses the trace_summary lookup to
+    narrow the query window before scanning the logs table:
+    1. Returns the matching logs (narrow window, single bucket), including a log
+       flushed shortly after the span ends — kept by the configured padding.
+    2. Does not return duplicate logs when the query window should span multiple
+       exponential buckets (>1 h). The window is clamped to the trace's recorded
+       range widened by the padding, so the post-span log survives the clamp.
+    3. Returns no results when the query window does not contain the trace.
+    4. Logs carrying a trace_id whose trace is NOT in trace_summary (e.g.
+       traces disabled) are still returned — the lookup miss must not
+       short-circuit logs queries.
+    """
+    target_trace_id = TraceIdGenerator.trace_id()
+    orphan_trace_id = TraceIdGenerator.trace_id()
+    target_root_span_id = TraceIdGenerator.span_id()
+    target_child_span_id = TraceIdGenerator.span_id()
+    orphan_span_id = TraceIdGenerator.span_id()
+
+    now = datetime.now(tz=UTC).replace(second=0, microsecond=0)
+
+    common_resources = {
+        "deployment.environment": "production",
+        "service.name": "logs-trace-filter-service",
+        "cloud.provider": "integration",
+    }
+
+    # Populate signoz_traces.distributed_trace_summary by inserting spans for
+    # the target trace_id. trace_summary records min/max of span timestamps
+    # (it ignores span duration), so two spans are inserted to give the trace
+    # a non-trivial recorded window of [now-10s, now-5s].
+    insert_traces(
+        [
+            Traces(
+                timestamp=now - timedelta(seconds=10),
+                duration=timedelta(seconds=1),
+                trace_id=target_trace_id,
+                span_id=target_root_span_id,
+                parent_span_id="",
+                name="root-span",
+                kind=TracesKind.SPAN_KIND_SERVER,
+                status_code=TracesStatusCode.STATUS_CODE_OK,
+                status_message="",
+                resources=common_resources,
+                attributes={},
+            ),
+            Traces(
+                timestamp=now - timedelta(seconds=5),
+                duration=timedelta(seconds=1),
+                trace_id=target_trace_id,
+                span_id=target_child_span_id,
+                parent_span_id=target_root_span_id,
+                name="child-span",
+                kind=TracesKind.SPAN_KIND_CLIENT,
+                status_code=TracesStatusCode.STATUS_CODE_OK,
+                status_message="",
+                resources=common_resources,
+                attributes={},
+            ),
+        ]
+    )
+
+    # Insert logs:
+    # - one with the target trace_id, at a timestamp within the trace's
+    #   recorded window (now-10s..now-5s, padded ±1s).
+    # - one with the target trace_id flushed ~3s AFTER the span's recorded end
+    #   (now-2s). This is outside the ±1s base pad but inside the multi-minute
+    #   log_trace_id_window_padding, so it must still be returned.
+    # - one with an orphan trace_id whose trace was never ingested — used to
+    #   verify the lookup miss does NOT short-circuit logs queries.
+    insert_logs(
+        [
+            Logs(
+                timestamp=now - timedelta(seconds=7),
+                resources=common_resources,
+                attributes={"http.method": "GET"},
+                body="log inside the target trace window",
+                severity_text="INFO",
+                trace_id=target_trace_id,
+                span_id=target_root_span_id,
+            ),
+            Logs(
+                timestamp=now - timedelta(seconds=2),
+                resources=common_resources,
+                attributes={"http.method": "POST"},
+                body="log flushed after the span ends, within padding window",
+                severity_text="INFO",
+                trace_id=target_trace_id,
+                span_id=target_root_span_id,
+            ),
+            Logs(
+                timestamp=now - timedelta(seconds=2),
+                resources=common_resources,
+                attributes={"http.method": "PUT"},
+                body="log with a trace_id absent from trace_summary",
+                severity_text="INFO",
+                trace_id=orphan_trace_id,
+                span_id=orphan_span_id,
+            ),
+        ]
+    )
+
+    token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
+
+    def _query(start_ms: int, end_ms: int, trace_id: str) -> tuple[list, list[str]]:
+        response = make_query_request(
+            signoz,
+            token,
+            start_ms=start_ms,
+            end_ms=end_ms,
+            request_type="raw",
+            queries=[
+                {
+                    "type": "builder_query",
+                    "spec": {
+                        "name": "A",
+                        "signal": "logs",
+                        "disabled": False,
+                        "limit": 100,
+                        "offset": 0,
+                        "filter": {"expression": f"trace_id = '{trace_id}'"},
+                        "order": [
+                            {"key": {"name": "timestamp"}, "direction": "desc"},
+                            {"key": {"name": "id"}, "direction": "desc"},
+                        ],
+                    },
+                }
+            ],
+        )
+        assert response.status_code == HTTPStatus.OK
+        assert response.json()["status"] == "success"
+        rows = response.json()["data"]["data"]["results"][0]["rows"] or []
+        warning = (response.json().get("data") or {}).get("warning") or {}
+        messages = [w.get("message", "") for w in (warning.get("warnings") or [])]
+        return rows, messages
+
+    outside_range_msg = "lies outside the selected time range"
+
+    now_ms = int(now.timestamp() * 1000)
+
+    inside_window_body = "log inside the target trace window"
+    post_span_body = "log flushed after the span ends, within padding window"
+
+    # --- Test 1: narrow window (single bucket, <1 h) ---
+    narrow_start_ms = int((now - timedelta(minutes=5)).timestamp() * 1000)
+    narrow_rows, narrow_warnings = _query(narrow_start_ms, now_ms, target_trace_id)
+
+    assert len(narrow_rows) == 2, f"Expected 2 logs for trace_id filter (narrow window), got {len(narrow_rows)}"
+    assert {r["data"]["trace_id"] for r in narrow_rows} == {target_trace_id}
+    narrow_bodies = {r["data"]["body"] for r in narrow_rows}
+    assert inside_window_body in narrow_bodies
+    assert post_span_body in narrow_bodies, "post-span log should be returned within the padding window"
+    assert not any(outside_range_msg in m for m in narrow_warnings), f"Did not expect outside-range warning, got {narrow_warnings}"
+
+    # --- Test 2: wide window (>1 h, clamp to the padded timerange from trace_summary) ---
+    # Should return exactly the two target logs — no duplicates from multi-bucket
+    # scan, and the post-span log survives the clamp only because of the padding.
+    wide_start_ms = int((now - timedelta(hours=12)).timestamp() * 1000)
+    wide_rows, wide_warnings = _query(wide_start_ms, now_ms, target_trace_id)
+
+    assert len(wide_rows) == 2, f"Expected 2 logs for trace_id filter (wide window, multi-bucket), got {len(wide_rows)} — possible duplicate-log regression or padding not applied"
+    assert {r["data"]["trace_id"] for r in wide_rows} == {target_trace_id}
+    wide_bodies = {r["data"]["body"] for r in wide_rows}
+    assert inside_window_body in wide_bodies
+    assert post_span_body in wide_bodies, "post-span log should survive the clamp because of the padding"
+    assert not any(outside_range_msg in m for m in wide_warnings), f"Did not expect outside-range warning, got {wide_warnings}"
+
+    # --- Test 3: window that does not contain the trace returns no results + warning ---
+    past_start_ms = int((now - timedelta(hours=6)).timestamp() * 1000)
+    past_end_ms = int((now - timedelta(hours=2)).timestamp() * 1000)
+    past_rows, past_warnings = _query(past_start_ms, past_end_ms, target_trace_id)
+
+    assert len(past_rows) == 0, f"Expected 0 logs for trace_id filter outside time window, got {len(past_rows)}"
+    assert any(outside_range_msg in m for m in past_warnings), f"Expected outside-range warning, got warnings={past_warnings}"
+
+    # --- Test 4: trace_id not present in trace_summary still returns logs (no warning) ---
+    orphan_rows, orphan_warnings = _query(narrow_start_ms, now_ms, orphan_trace_id)
+
+    assert len(orphan_rows) == 1, f"Expected 1 log for orphan trace_id (no trace_summary entry), got {len(orphan_rows)} — logs query may have been incorrectly short-circuited"
+    assert orphan_rows[0]["data"]["trace_id"] == orphan_trace_id
+    assert not any(outside_range_msg in m for m in orphan_warnings), f"Did not expect outside-range warning for orphan trace_id, got {orphan_warnings}"
+
+
+def test_logs_aggregation_filter_by_trace_id(
+    signoz: types.SigNoz,
+    create_user_admin: None,  # pylint: disable=unused-argument
+    get_token: Callable[[str, str], str],
+    insert_logs: Callable[[list[Logs]], None],
+    insert_traces: Callable[[list[Traces]], None],
+) -> None:
+    """
+    Tests that the trace_id time-range optimization also applies to
+    non-window-list (time_series / aggregation) logs queries:
+    1. Wide query window containing the trace returns the correct count.
+    2. Query window outside the trace's time range short-circuits to an
+       empty result.
+    3. A trace_id with no row in trace_summary (e.g. traces disabled) still
+       returns the matching logs — the lookup miss must not short-circuit
+       logs aggregation queries.
+    """
+    target_trace_id = TraceIdGenerator.trace_id()
+    orphan_trace_id = TraceIdGenerator.trace_id()
+    target_root_span_id = TraceIdGenerator.span_id()
+    target_child_span_id = TraceIdGenerator.span_id()
+    orphan_span_id = TraceIdGenerator.span_id()
+
+    now = datetime.now(tz=UTC).replace(second=0, microsecond=0)
+
+    common_resources = {
+        "deployment.environment": "production",
+        "service.name": "logs-trace-agg-service",
+        "cloud.provider": "integration",
+    }
+
+    # trace_summary records min/max of span timestamps (it ignores duration),
+    # so insert two spans to give the trace a recorded window wide enough to
+    # comfortably contain the log timestamps below.
+    insert_traces(
+        [
+            Traces(
+                timestamp=now - timedelta(seconds=10),
+                duration=timedelta(seconds=1),
+                trace_id=target_trace_id,
+                span_id=target_root_span_id,
+                parent_span_id="",
+                name="root-span",
+                kind=TracesKind.SPAN_KIND_SERVER,
+                status_code=TracesStatusCode.STATUS_CODE_OK,
+                status_message="",
+                resources=common_resources,
+                attributes={},
+            ),
+            Traces(
+                timestamp=now - timedelta(seconds=5),
+                duration=timedelta(seconds=1),
+                trace_id=target_trace_id,
+                span_id=target_child_span_id,
+                parent_span_id=target_root_span_id,
+                name="child-span",
+                kind=TracesKind.SPAN_KIND_CLIENT,
+                status_code=TracesStatusCode.STATUS_CODE_OK,
+                status_message="",
+                resources=common_resources,
+                attributes={},
+            ),
+        ]
+    )
+
+    # Two logs for the target trace_id, both inside the recorded trace window.
+    # One additional log carries an orphan trace_id with no row in
+    # trace_summary — used to verify that the lookup miss does not
+    # short-circuit logs aggregations.
+    insert_logs(
+        [
+            Logs(
+                timestamp=now - timedelta(seconds=7),
+                resources=common_resources,
+                attributes={},
+                body="log A inside trace window",
+                severity_text="INFO",
+                trace_id=target_trace_id,
+                span_id=target_root_span_id,
+            ),
+            Logs(
+                timestamp=now - timedelta(seconds=6),
+                resources=common_resources,
+                attributes={},
+                body="log B inside trace window",
+                severity_text="INFO",
+                trace_id=target_trace_id,
+                span_id=target_root_span_id,
+            ),
+            Logs(
+                timestamp=now - timedelta(seconds=2),
+                resources=common_resources,
+                attributes={},
+                body="log with a trace_id absent from trace_summary",
+                severity_text="INFO",
+                trace_id=orphan_trace_id,
+                span_id=orphan_span_id,
+            ),
+        ]
+    )
+
+    token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
+
+    def _count(start_ms: int, end_ms: int, trace_id: str) -> tuple[float, list[str]]:
+        response = make_query_request(
+            signoz,
+            token,
+            start_ms=start_ms,
+            end_ms=end_ms,
+            request_type="time_series",
+            queries=[
+                {
+                    "type": "builder_query",
+                    "spec": {
+                        "name": "A",
+                        "signal": "logs",
+                        "stepInterval": 60,
+                        "disabled": False,
+                        "filter": {"expression": f"trace_id = '{trace_id}'"},
+                        "having": {"expression": ""},
+                        "aggregations": [{"expression": "count()"}],
+                    },
+                }
+            ],
+        )
+        assert response.status_code == HTTPStatus.OK
+        assert response.json()["status"] == "success"
+        results = response.json()["data"]["data"]["results"]
+        assert len(results) == 1
+        warning = (response.json().get("data") or {}).get("warning") or {}
+        messages = [w.get("message", "") for w in (warning.get("warnings") or [])]
+        aggregations = results[0].get("aggregations") or []
+        if not aggregations:
+            return 0, messages
+        series = aggregations[0].get("series") or []
+        if not series:
+            return 0, messages
+        return sum(v["value"] for v in series[0]["values"]), messages
+
+    outside_range_msg = "lies outside the selected time range"
+
+    now_ms = int(now.timestamp() * 1000)
+    narrow_start_ms = int((now - timedelta(minutes=5)).timestamp() * 1000)
+
+    # --- Test 1: wide window (>1 h) containing the trace returns 2 logs ---
+    wide_start_ms = int((now - timedelta(hours=12)).timestamp() * 1000)
+    wide_count, wide_warnings = _count(wide_start_ms, now_ms, target_trace_id)
+    assert wide_count == 2, f"Expected count=2 for trace_id aggregation (wide window), got {wide_count}"
+    assert not any(outside_range_msg in m for m in wide_warnings), f"Did not expect outside-range warning, got {wide_warnings}"
+
+    # --- Test 2: window outside the trace short-circuits to empty + warning ---
+    past_start_ms = int((now - timedelta(hours=6)).timestamp() * 1000)
+    past_end_ms = int((now - timedelta(hours=2)).timestamp() * 1000)
+    past_count, past_warnings = _count(past_start_ms, past_end_ms, target_trace_id)
+    assert past_count == 0, f"Expected count=0 for trace_id aggregation outside time window, got {past_count}"
+    assert any(outside_range_msg in m for m in past_warnings), f"Expected outside-range warning, got warnings={past_warnings}"
+
+    # --- Test 3: trace_id not present in trace_summary still returns logs (no warning) ---
+    orphan_count, orphan_warnings = _count(narrow_start_ms, now_ms, orphan_trace_id)
+    assert orphan_count == 1, f"Expected count=1 for orphan trace_id aggregation, got {orphan_count} — query may have been incorrectly short-circuited"
+    assert not any(outside_range_msg in m for m in orphan_warnings), f"Did not expect outside-range warning for orphan trace_id, got {orphan_warnings}"

tests/integration/tests/querierlogs/07_list_expectations.py

@@ -735,7 +735,6 @@ def test_logs_list_query_trace_id_expectations(
             # No results expected
             assert response.json()["data"]["data"]["results"][0]["rows"] is None
         else:
-            print(response.json())
             rows = response.json()["data"]["data"]["results"][0]["rows"]
             assert len(rows) == len(results(logs)), f"Expected {len(results(logs))} rows, got {len(rows)}"
             for row, expected_row in zip(rows, results(logs)):

tests/integration/tests/querierlogs/09_json_body_functions.py

@@ -0,0 +1,276 @@
+import json
+from collections.abc import Callable
+from datetime import UTC, datetime, timedelta
+from http import HTTPStatus
+
+import pytest
+import requests
+
+from fixtures import types
+from fixtures.auth import USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD
+from fixtures.logs import Logs
+
+# Body-JSON array/token functions on the logs body. has() success paths are already
+# covered by 06_json_body.py::test_logs_json_body_array_membership; this file adds the
+# sibling functions hasAny / hasAll / hasToken (success) and the function-operator error
+# paths (has/hasToken on a non-body key, non-string token) which must be rejected.
+
+
+@pytest.mark.xfail(
+    reason="hasAny/hasAll over a body-JSON array return 500 in legacy body mode (use_json_body off): ClickHouse 'Argument 0 for hasAny must be an array but has type String'. has() handles body arrays here; hasAny/hasAll do not (they work only in JSON-body mode).",
+    strict=False,
+)
+def test_logs_json_body_has_any(
+    signoz: types.SigNoz,
+    create_user_admin: None,  # pylint: disable=unused-argument
+    get_token: Callable[[str, str], str],
+    insert_logs: Callable[[list[Logs]], None],
+) -> None:
+    """hasAny(body.tags, [...]) matches a log whose array shares ANY value."""
+    now = datetime.now(tz=UTC)
+    insert_logs(
+        [
+            Logs(
+                timestamp=now - timedelta(seconds=3),
+                resources={"service.name": "app-service"},
+                body=json.dumps({"tags": ["production", "api", "critical"]}),
+                severity_text="INFO",
+            ),
+            Logs(
+                timestamp=now - timedelta(seconds=2),
+                resources={"service.name": "app-service"},
+                body=json.dumps({"tags": ["staging", "api", "test"]}),
+                severity_text="INFO",
+            ),
+            Logs(
+                timestamp=now - timedelta(seconds=1),
+                resources={"service.name": "app-service"},
+                body=json.dumps({"tags": ["production", "web", "important"]}),
+                severity_text="INFO",
+            ),
+        ]
+    )
+    token = get_token(email=USER_ADMIN_EMAIL, password=USER_ADMIN_PASSWORD)
+
+    # log1 has "critical", log2 has "test", log3 has neither -> 2 matches
+    response = requests.post(
+        signoz.self.host_configs["8080"].get("/api/v5/query_range"),
+        timeout=2,
+        headers={"authorization": f"Bearer {token}"},
+        json={
+            "schemaVersion": "v1",
+            "start": int((now - timedelta(seconds=10)).timestamp() * 1000),
+            "end": int(now.timestamp() * 1000),
+            "requestType": "raw",
+            "compositeQuery": {
+                "queries": [
+                    {
+                        "type": "builder_query",
+                        "spec": {
+                            "name": "A",
+                            "signal": "logs",
+                            "disabled": False,
+                            "limit": 100,
+                            "offset": 0,
+                            "filter": {"expression": "hasAny(body.tags, ['critical', 'test'])"},
+                            "order": [{"key": {"name": "timestamp"}, "direction": "desc"}],
+                            "aggregations": [{"expression": "count()"}],
+                        },
+                    }
+                ]
+            },
+            "formatOptions": {"formatTableResultForUI": False, "fillGaps": False},
+        },
+    )
+    assert response.status_code == HTTPStatus.OK
+    assert response.json()["status"] == "success"
+    rows = response.json()["data"]["data"]["results"][0]["rows"]
+    assert len(rows) == 2
+    tags_list = [json.loads(row["data"]["body"])["tags"] for row in rows]
+    assert all(("critical" in tags) or ("test" in tags) for tags in tags_list)
+
+
+@pytest.mark.xfail(
+    reason="hasAny/hasAll over a body-JSON array return 500 in legacy body mode (use_json_body off): ClickHouse 'Argument 0 for hasAll must be an array but has type String'. has() handles body arrays here; hasAny/hasAll do not (they work only in JSON-body mode).",
+    strict=False,
+)
+def test_logs_json_body_has_all(
+    signoz: types.SigNoz,
+    create_user_admin: None,  # pylint: disable=unused-argument
+    get_token: Callable[[str, str], str],
+    insert_logs: Callable[[list[Logs]], None],
+) -> None:
+    """hasAll(body.tags, [...]) matches only a log whose array has ALL values."""
+    now = datetime.now(tz=UTC)
+    insert_logs(
+        [
+            Logs(
+                timestamp=now - timedelta(seconds=3),
+                resources={"service.name": "app-service"},
+                body=json.dumps({"tags": ["production", "api", "critical"]}),
+                severity_text="INFO",
+            ),
+            Logs(
+                timestamp=now - timedelta(seconds=2),
+                resources={"service.name": "app-service"},
+                body=json.dumps({"tags": ["production", "web", "important"]}),
+                severity_text="INFO",
+            ),
+        ]
+    )
+    token = get_token(email=USER_ADMIN_EMAIL, password=USER_ADMIN_PASSWORD)
+
+    # only the second log has both "production" AND "web"
+    response = requests.post(
+        signoz.self.host_configs["8080"].get("/api/v5/query_range"),
+        timeout=2,
+        headers={"authorization": f"Bearer {token}"},
+        json={
+            "schemaVersion": "v1",
+            "start": int((now - timedelta(seconds=10)).timestamp() * 1000),
+            "end": int(now.timestamp() * 1000),
+            "requestType": "raw",
+            "compositeQuery": {
+                "queries": [
+                    {
+                        "type": "builder_query",
+                        "spec": {
+                            "name": "A",
+                            "signal": "logs",
+                            "disabled": False,
+                            "limit": 100,
+                            "offset": 0,
+                            "filter": {"expression": "hasAll(body.tags, ['production', 'web'])"},
+                            "order": [{"key": {"name": "timestamp"}, "direction": "desc"}],
+                            "aggregations": [{"expression": "count()"}],
+                        },
+                    }
+                ]
+            },
+            "formatOptions": {"formatTableResultForUI": False, "fillGaps": False},
+        },
+    )
+    assert response.status_code == HTTPStatus.OK
+    assert response.json()["status"] == "success"
+    rows = response.json()["data"]["data"]["results"][0]["rows"]
+    assert len(rows) == 1
+    tags = json.loads(rows[0]["data"]["body"])["tags"]
+    assert "production" in tags and "web" in tags
+
+
+def test_logs_json_body_has_token(
+    signoz: types.SigNoz,
+    create_user_admin: None,  # pylint: disable=unused-argument
+    get_token: Callable[[str, str], str],
+    insert_logs: Callable[[list[Logs]], None],
+) -> None:
+    """hasToken(body, 'token') matches logs whose body text contains the token."""
+    now = datetime.now(tz=UTC)
+    insert_logs(
+        [
+            Logs(
+                timestamp=now - timedelta(seconds=3),
+                resources={"service.name": "app-service"},
+                body=json.dumps({"tags": ["production", "api", "critical"]}),
+                severity_text="INFO",
+            ),
+            Logs(
+                timestamp=now - timedelta(seconds=2),
+                resources={"service.name": "app-service"},
+                body=json.dumps({"tags": ["staging", "api", "test"]}),
+                severity_text="INFO",
+            ),
+            Logs(
+                timestamp=now - timedelta(seconds=1),
+                resources={"service.name": "app-service"},
+                body=json.dumps({"tags": ["production", "web", "important"]}),
+                severity_text="INFO",
+            ),
+        ]
+    )
+    token = get_token(email=USER_ADMIN_EMAIL, password=USER_ADMIN_PASSWORD)
+
+    # "production" appears in the first and third log bodies
+    response = requests.post(
+        signoz.self.host_configs["8080"].get("/api/v5/query_range"),
+        timeout=2,
+        headers={"authorization": f"Bearer {token}"},
+        json={
+            "schemaVersion": "v1",
+            "start": int((now - timedelta(seconds=10)).timestamp() * 1000),
+            "end": int(now.timestamp() * 1000),
+            "requestType": "raw",
+            "compositeQuery": {
+                "queries": [
+                    {
+                        "type": "builder_query",
+                        "spec": {
+                            "name": "A",
+                            "signal": "logs",
+                            "disabled": False,
+                            "limit": 100,
+                            "offset": 0,
+                            "filter": {"expression": 'hasToken(body, "production")'},
+                            "order": [{"key": {"name": "timestamp"}, "direction": "desc"}],
+                            "aggregations": [{"expression": "count()"}],
+                        },
+                    }
+                ]
+            },
+            "formatOptions": {"formatTableResultForUI": False, "fillGaps": False},
+        },
+    )
+    assert response.status_code == HTTPStatus.OK
+    assert response.json()["status"] == "success"
+    rows = response.json()["data"]["data"]["results"][0]["rows"]
+    assert len(rows) == 2
+    assert all("production" in row["data"]["body"] for row in rows)
+
+
+@pytest.mark.parametrize(
+    "expression",
+    [
+        pytest.param('has(code.function, "main")', id="has_non_body_key"),
+        pytest.param('hasToken(code.function, "main")', id="hastoken_non_body_key"),
+        pytest.param("hasToken(body, 123)", id="hastoken_non_string_value"),
+    ],
+)
+def test_logs_json_body_function_errors(
+    signoz: types.SigNoz,
+    create_user_admin: None,  # pylint: disable=unused-argument
+    get_token: Callable[[str, str], str],
+    expression: str,
+) -> None:
+    """has/hasToken support only the body JSON field; misuse is rejected (400)."""
+    now = datetime.now(tz=UTC)
+    token = get_token(email=USER_ADMIN_EMAIL, password=USER_ADMIN_PASSWORD)
+    response = requests.post(
+        signoz.self.host_configs["8080"].get("/api/v5/query_range"),
+        timeout=2,
+        headers={"authorization": f"Bearer {token}"},
+        json={
+            "schemaVersion": "v1",
+            "start": int((now - timedelta(seconds=10)).timestamp() * 1000),
+            "end": int(now.timestamp() * 1000),
+            "requestType": "raw",
+            "compositeQuery": {
+                "queries": [
+                    {
+                        "type": "builder_query",
+                        "spec": {
+                            "name": "A",
+                            "signal": "logs",
+                            "disabled": False,
+                            "limit": 100,
+                            "offset": 0,
+                            "filter": {"expression": expression},
+                            "order": [{"key": {"name": "timestamp"}, "direction": "desc"}],
+                            "aggregations": [{"expression": "count()"}],
+                        },
+                    }
+                ]
+            },
+            "formatOptions": {"formatTableResultForUI": False, "fillGaps": False},
+        },
+    )
+    assert response.status_code == HTTPStatus.BAD_REQUEST

tests/integration/tests/queriermetrics/01_fill.py

@@ -8,20 +8,15 @@ import requests
 
 from fixtures import types
 from fixtures.auth import USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD
-from fixtures.fs import get_testdata_file_path
 from fixtures.metrics import Metrics
 from fixtures.querier import (
     assert_minutely_bucket_values,
-    build_builder_query,
     find_named_result,
-    get_all_warnings,
     index_series_by_label,
-    make_query_request,
 )
 
 FILL_GAPS = "fillGaps"
 FILL_ZERO = "fillZero"
-HISTOGRAM_FILE = get_testdata_file_path("histogram_data_1h.jsonl")
 
 
 def _build_format_options(fill_mode: str) -> dict[str, Any]:
@@ -570,371 +565,3 @@ def test_metrics_fill_formula_with_group_by(
             expected_by_ts=expectations[group],
             context=f"metrics/{fill_mode}/F1/{group}",
         )
-
-
-def test_histogram_p90_returns_warning_outside_data_window(
-    signoz: types.SigNoz,
-    create_user_admin: None,  # pylint: disable=unused-argument
-    get_token: Callable[[str, str], str],
-    insert_metrics: Callable[[list[Metrics]], None],
-) -> None:
-
-    now = datetime.now(tz=UTC).replace(second=0, microsecond=0)
-    metric_name = "test_p90_last_seen_bucket"
-
-    metrics = Metrics.load_from_file(
-        HISTOGRAM_FILE,
-        base_time=now - timedelta(minutes=90),
-        metric_name_override=metric_name,
-    )
-    insert_metrics(metrics)
-
-    token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
-    query = build_builder_query(
-        "A",
-        metric_name,
-        "doesnotreallymatter",
-        "p90",
-    )
-
-    end_ms = int(now.timestamp() * 1000)
-
-    start_2h = int((now - timedelta(hours=2)).timestamp() * 1000)
-    response = make_query_request(signoz, token, start_2h, end_ms, [query])
-    assert response.status_code == HTTPStatus.OK
-    assert response.json()["status"] == "success"
-
-    start_15m = int((now - timedelta(minutes=15)).timestamp() * 1000)
-    response = make_query_request(signoz, token, start_15m, end_ms, [query])
-    assert response.status_code == HTTPStatus.OK
-    data = response.json()
-    warnings = get_all_warnings(data)
-    assert len(warnings) == 1
-    assert warnings[0]["message"].startswith(f"no data found for the metric {metric_name}")
-
-
-def test_non_existent_metrics_returns_warning(
-    signoz: types.SigNoz,
-    create_user_admin: None,  # pylint: disable=unused-argument
-    get_token: Callable[[str, str], str],
-) -> None:
-
-    now = datetime.now(tz=UTC).replace(second=0, microsecond=0)
-    metric_name = "whatevergoennnsgoeshere"
-
-    token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
-    query = build_builder_query(
-        "A",
-        metric_name,
-        "doesnotreallymatter",
-        "sum",
-    )
-
-    end_ms = int(now.timestamp() * 1000)
-
-    start_2h = int((now - timedelta(hours=2)).timestamp() * 1000)
-    response = make_query_request(signoz, token, start_2h, end_ms, [query])
-    assert response.status_code == HTTPStatus.OK
-
-    data = response.json()
-    warnings = get_all_warnings(data)
-    assert any("whatevergoennnsgoeshere" in w["message"] and "has never been received" in w["message"] for w in warnings), f"expected never-seen metric warning, got: {warnings}"
-
-
-def test_non_existent_internal_metrics_returns_no_warning(
-    signoz: types.SigNoz,
-    create_user_admin: None,  # pylint: disable=unused-argument
-    get_token: Callable[[str, str], str],
-) -> None:
-
-    now = datetime.now(tz=UTC).replace(second=0, microsecond=0)
-    metric_name = "signoz_calls_total"
-
-    token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
-    query = build_builder_query(
-        "A",
-        metric_name,
-        "doesnotreallymatter",
-        "sum",
-    )
-
-    end_ms = int(now.timestamp() * 1000)
-
-    start_2h = int((now - timedelta(hours=2)).timestamp() * 1000)
-    response = make_query_request(signoz, token, start_2h, end_ms, [query])
-    assert response.status_code == HTTPStatus.OK
-    data = response.json()
-    assert get_all_warnings(data) == []
-
-
-def test_variable_in_filter_returns_no_warning(
-    signoz: types.SigNoz,
-    create_user_admin: None,  # pylint: disable=unused-argument
-    get_token: Callable[[str, str], str],
-    insert_metrics: Callable[[list[Metrics]], None],
-) -> None:
-    """
-    A dashboard variable used in a metric filter expression (e.g.
-    `my_tag = $tag`) sits in value position but is lexed as a key token. It
-    must not be mistaken for a missing attribute key and must not produce a
-    "key not found" warning.
-
-    Regression test for https://github.com/SigNoz/engineering-pod/issues/5481
-    """
-    now = datetime.now(tz=UTC).replace(second=0, microsecond=0)
-    metric_name = "test_variable_filter_metric"
-
-    metrics: list[Metrics] = [
-        Metrics(
-            metric_name=metric_name,
-            labels={"my_tag": "service-a"},
-            timestamp=now - timedelta(minutes=3),
-            value=10.0,
-            temporality="Cumulative",
-        ),
-        Metrics(
-            metric_name=metric_name,
-            labels={"my_tag": "service-a"},
-            timestamp=now - timedelta(minutes=2),
-            value=30.0,
-            temporality="Cumulative",
-        ),
-    ]
-    insert_metrics(metrics)
-
-    token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
-    query = build_builder_query(
-        "A",
-        metric_name,
-        "increase",
-        "sum",
-        temporality="cumulative",
-        filter_expression="my_tag = $tag",
-    )
-
-    start_ms = int((now - timedelta(minutes=5)).timestamp() * 1000)
-    end_ms = int(now.timestamp() * 1000)
-
-    response = make_query_request(
-        signoz,
-        token,
-        start_ms,
-        end_ms,
-        [query],
-        variables={"tag": {"type": "query", "value": "service-a"}},
-    )
-
-    assert response.status_code == HTTPStatus.OK
-    data = response.json()
-    assert data["status"] == "success"
-    # `my_tag` is a real label and `$tag` is a value-position variable, so
-    # neither should be flagged as a missing key on the metric.
-    assert get_all_warnings(data) == [], f"expected no warnings, got: {get_all_warnings(data)}"
-
-
-# Verify /api/v1/fields/values filters label values by metricNamespace prefix.
-# Inserts metrics under ns.a and ns.b, then asserts a specific prefix returns
-# only matching values while a common prefix returns both.
-def test_metric_namespace_values_filtering(
-    signoz: types.SigNoz,
-    create_user_admin: None,  # pylint: disable=unused-argument
-    get_token: Callable[[str, str], str],
-    insert_metrics: Callable[[list[Metrics]], None],
-) -> None:
-    now = datetime.now(tz=UTC).replace(second=0, microsecond=0)
-
-    metrics: list[Metrics] = [
-        Metrics(
-            metric_name="ns.a.requests_total",
-            labels={"service": "svc-a"},
-            timestamp=now - timedelta(minutes=2),
-            value=10.0,
-        ),
-        Metrics(
-            metric_name="ns.b.requests_total",
-            labels={"service": "svc-b"},
-            timestamp=now - timedelta(minutes=2),
-            value=20.0,
-        ),
-    ]
-    insert_metrics(metrics)
-
-    token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
-
-    # Specific prefix: metricNamespace=ns.a should return only svc-a
-    response = requests.get(
-        signoz.self.host_configs["8080"].get("/api/v1/fields/values"),
-        timeout=5,
-        headers={"authorization": f"Bearer {token}"},
-        params={
-            "signal": "metrics",
-            "name": "service",
-            "searchText": "",
-            "metricNamespace": "ns.a",
-        },
-    )
-
-    assert response.status_code == HTTPStatus.OK
-    assert response.json()["status"] == "success"
-
-    values = response.json()["data"]["values"]["stringValues"]
-    assert "svc-a" in values
-    assert "svc-b" not in values
-
-    # Common prefix: metricNamespace=ns should return both
-    response = requests.get(
-        signoz.self.host_configs["8080"].get("/api/v1/fields/values"),
-        timeout=5,
-        headers={"authorization": f"Bearer {token}"},
-        params={
-            "signal": "metrics",
-            "name": "service",
-            "searchText": "",
-            "metricNamespace": "ns",
-        },
-    )
-
-    assert response.status_code == HTTPStatus.OK
-    assert response.json()["status"] == "success"
-
-    values = response.json()["data"]["values"]["stringValues"]
-    assert "svc-a" in values
-    assert "svc-b" in values
-
-
-# Verify /api/v1/fields/values with name=metric_name filters metric names by
-# metricNamespace prefix. A specific prefix returns only its metric names;
-# a common prefix returns metric names from all matching namespaces.
-def test_metric_namespace_metric_name_values_filtering(
-    signoz: types.SigNoz,
-    create_user_admin: None,  # pylint: disable=unused-argument
-    get_token: Callable[[str, str], str],
-    insert_metrics: Callable[[list[Metrics]], None],
-) -> None:
-    now = datetime.now(tz=UTC).replace(second=0, microsecond=0)
-
-    metrics: list[Metrics] = [
-        Metrics(
-            metric_name="ns.a.cpu.utilization",
-            labels={"host": "host-a"},
-            timestamp=now - timedelta(minutes=2),
-            value=50.0,
-        ),
-        Metrics(
-            metric_name="ns.b.cpu.utilization",
-            labels={"host": "host-b"},
-            timestamp=now - timedelta(minutes=2),
-            value=60.0,
-        ),
-    ]
-    insert_metrics(metrics)
-
-    token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
-
-    # Specific prefix: metricNamespace=ns.a should return only ns.a.* metric names
-    response = requests.get(
-        signoz.self.host_configs["8080"].get("/api/v1/fields/values"),
-        timeout=5,
-        headers={"authorization": f"Bearer {token}"},
-        params={
-            "signal": "metrics",
-            "name": "metric_name",
-            "searchText": "",
-            "metricNamespace": "ns.a",
-        },
-    )
-
-    assert response.status_code == HTTPStatus.OK
-    assert response.json()["status"] == "success"
-
-    values = response.json()["data"]["values"]["stringValues"]
-    assert "ns.a.cpu.utilization" in values
-    assert "ns.b.cpu.utilization" not in values
-
-    # Common prefix: metricNamespace=ns should return both
-    response = requests.get(
-        signoz.self.host_configs["8080"].get("/api/v1/fields/values"),
-        timeout=5,
-        headers={"authorization": f"Bearer {token}"},
-        params={
-            "signal": "metrics",
-            "name": "metric_name",
-            "searchText": "",
-            "metricNamespace": "ns",
-        },
-    )
-
-    assert response.status_code == HTTPStatus.OK
-    assert response.json()["status"] == "success"
-
-    values = response.json()["data"]["values"]["stringValues"]
-    assert "ns.a.cpu.utilization" in values
-    assert "ns.b.cpu.utilization" in values
-
-
-# Verify /api/v1/fields/keys filters attribute keys by metricNamespace prefix.
-# Metrics under ns.a and ns.b carry distinct labels; a specific prefix returns
-# only its keys while a common prefix returns keys from both namespaces.
-def test_metric_namespace_keys_filtering(
-    signoz: types.SigNoz,
-    create_user_admin: None,  # pylint: disable=unused-argument
-    get_token: Callable[[str, str], str],
-    insert_metrics: Callable[[list[Metrics]], None],
-) -> None:
-    now = datetime.now(tz=UTC).replace(second=0, microsecond=0)
-
-    metrics: list[Metrics] = [
-        Metrics(
-            metric_name="ns.a.cpu.utilization",
-            labels={"a_only_label": "val-a"},
-            timestamp=now - timedelta(minutes=2),
-            value=10.0,
-        ),
-        Metrics(
-            metric_name="ns.b.cpu.utilization",
-            labels={"b_only_label": "val-b"},
-            timestamp=now - timedelta(minutes=2),
-            value=20.0,
-        ),
-    ]
-    insert_metrics(metrics)
-
-    token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
-
-    # Specific prefix: metricNamespace=ns.a should return only a_only_label
-    response = requests.get(
-        signoz.self.host_configs["8080"].get("/api/v1/fields/keys"),
-        timeout=5,
-        headers={"authorization": f"Bearer {token}"},
-        params={
-            "signal": "metrics",
-            "searchText": "label",
-            "metricNamespace": "ns.a",
-        },
-    )
-
-    assert response.status_code == HTTPStatus.OK
-    assert response.json()["status"] == "success"
-
-    keys = response.json()["data"]["keys"]
-    assert "a_only_label" in keys
-    assert "b_only_label" not in keys
-
-    # Common prefix: metricNamespace=ns should return both keys
-    response = requests.get(
-        signoz.self.host_configs["8080"].get("/api/v1/fields/keys"),
-        timeout=5,
-        headers={"authorization": f"Bearer {token}"},
-        params={
-            "signal": "metrics",
-            "searchText": "label",
-            "metricNamespace": "ns",
-        },
-    )
-
-    assert response.status_code == HTTPStatus.OK
-    assert response.json()["status"] == "success"
-
-    keys = response.json()["data"]["keys"]
-    assert "a_only_label" in keys
-    assert "b_only_label" in keys

tests/integration/tests/queriermetrics/02_warnings.py

@@ -0,0 +1,175 @@
+from collections.abc import Callable
+from datetime import UTC, datetime, timedelta
+from http import HTTPStatus
+
+from fixtures import types
+from fixtures.auth import USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD
+from fixtures.fs import get_testdata_file_path
+from fixtures.metrics import Metrics
+from fixtures.querier import (
+    build_builder_query,
+    get_all_warnings,
+    make_query_request,
+)
+
+HISTOGRAM_FILE = get_testdata_file_path("histogram_data_1h.jsonl")
+
+
+def test_histogram_p90_returns_warning_outside_data_window(
+    signoz: types.SigNoz,
+    create_user_admin: None,  # pylint: disable=unused-argument
+    get_token: Callable[[str, str], str],
+    insert_metrics: Callable[[list[Metrics]], None],
+) -> None:
+
+    now = datetime.now(tz=UTC).replace(second=0, microsecond=0)
+    metric_name = "test_p90_last_seen_bucket"
+
+    metrics = Metrics.load_from_file(
+        HISTOGRAM_FILE,
+        base_time=now - timedelta(minutes=90),
+        metric_name_override=metric_name,
+    )
+    insert_metrics(metrics)
+
+    token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
+    query = build_builder_query(
+        "A",
+        metric_name,
+        "doesnotreallymatter",
+        "p90",
+    )
+
+    end_ms = int(now.timestamp() * 1000)
+
+    start_2h = int((now - timedelta(hours=2)).timestamp() * 1000)
+    response = make_query_request(signoz, token, start_2h, end_ms, [query])
+    assert response.status_code == HTTPStatus.OK
+    assert response.json()["status"] == "success"
+
+    start_15m = int((now - timedelta(minutes=15)).timestamp() * 1000)
+    response = make_query_request(signoz, token, start_15m, end_ms, [query])
+    assert response.status_code == HTTPStatus.OK
+    data = response.json()
+    warnings = get_all_warnings(data)
+    assert len(warnings) == 1
+    assert warnings[0]["message"].startswith(f"no data found for the metric {metric_name}")
+
+
+def test_non_existent_metrics_returns_warning(
+    signoz: types.SigNoz,
+    create_user_admin: None,  # pylint: disable=unused-argument
+    get_token: Callable[[str, str], str],
+) -> None:
+
+    now = datetime.now(tz=UTC).replace(second=0, microsecond=0)
+    metric_name = "whatevergoennnsgoeshere"
+
+    token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
+    query = build_builder_query(
+        "A",
+        metric_name,
+        "doesnotreallymatter",
+        "sum",
+    )
+
+    end_ms = int(now.timestamp() * 1000)
+
+    start_2h = int((now - timedelta(hours=2)).timestamp() * 1000)
+    response = make_query_request(signoz, token, start_2h, end_ms, [query])
+    assert response.status_code == HTTPStatus.OK
+
+    data = response.json()
+    warnings = get_all_warnings(data)
+    assert any("whatevergoennnsgoeshere" in w["message"] and "has never been received" in w["message"] for w in warnings), f"expected never-seen metric warning, got: {warnings}"
+
+
+def test_non_existent_internal_metrics_returns_no_warning(
+    signoz: types.SigNoz,
+    create_user_admin: None,  # pylint: disable=unused-argument
+    get_token: Callable[[str, str], str],
+) -> None:
+
+    now = datetime.now(tz=UTC).replace(second=0, microsecond=0)
+    metric_name = "signoz_calls_total"
+
+    token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
+    query = build_builder_query(
+        "A",
+        metric_name,
+        "doesnotreallymatter",
+        "sum",
+    )
+
+    end_ms = int(now.timestamp() * 1000)
+
+    start_2h = int((now - timedelta(hours=2)).timestamp() * 1000)
+    response = make_query_request(signoz, token, start_2h, end_ms, [query])
+    assert response.status_code == HTTPStatus.OK
+    data = response.json()
+    assert get_all_warnings(data) == []
+
+
+def test_variable_in_filter_returns_no_warning(
+    signoz: types.SigNoz,
+    create_user_admin: None,  # pylint: disable=unused-argument
+    get_token: Callable[[str, str], str],
+    insert_metrics: Callable[[list[Metrics]], None],
+) -> None:
+    """
+    A dashboard variable used in a metric filter expression (e.g.
+    `my_tag = $tag`) sits in value position but is lexed as a key token. It
+    must not be mistaken for a missing attribute key and must not produce a
+    "key not found" warning.
+
+    Regression test for https://github.com/SigNoz/engineering-pod/issues/5481
+    """
+    now = datetime.now(tz=UTC).replace(second=0, microsecond=0)
+    metric_name = "test_variable_filter_metric"
+
+    metrics: list[Metrics] = [
+        Metrics(
+            metric_name=metric_name,
+            labels={"my_tag": "service-a"},
+            timestamp=now - timedelta(minutes=3),
+            value=10.0,
+            temporality="Cumulative",
+        ),
+        Metrics(
+            metric_name=metric_name,
+            labels={"my_tag": "service-a"},
+            timestamp=now - timedelta(minutes=2),
+            value=30.0,
+            temporality="Cumulative",
+        ),
+    ]
+    insert_metrics(metrics)
+
+    token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
+    query = build_builder_query(
+        "A",
+        metric_name,
+        "increase",
+        "sum",
+        temporality="cumulative",
+        filter_expression="my_tag = $tag",
+    )
+
+    start_ms = int((now - timedelta(minutes=5)).timestamp() * 1000)
+    end_ms = int(now.timestamp() * 1000)
+
+    response = make_query_request(
+        signoz,
+        token,
+        start_ms,
+        end_ms,
+        [query],
+        variables={"tag": {"type": "query", "value": "service-a"}},
+    )
+
+    assert response.status_code == HTTPStatus.OK
+    data = response.json()
+    assert data["status"] == "success"
+    # `my_tag` is a real label and `$tag` is a value-position variable, so
+    # neither should be flagged as a missing key on the metric.
+    assert get_all_warnings(data) == [], f"expected no warnings, got: {get_all_warnings(data)}"

tests/integration/tests/queriermetrics/03_namespace_metadata.py

@@ -0,0 +1,217 @@
+from collections.abc import Callable
+from datetime import UTC, datetime, timedelta
+from http import HTTPStatus
+
+import requests
+
+from fixtures import types
+from fixtures.auth import USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD
+from fixtures.metrics import Metrics
+
+
+# Verify /api/v1/fields/values filters label values by metricNamespace prefix.
+# Inserts metrics under ns.a and ns.b, then asserts a specific prefix returns
+# only matching values while a common prefix returns both.
+def test_metric_namespace_values_filtering(
+    signoz: types.SigNoz,
+    create_user_admin: None,  # pylint: disable=unused-argument
+    get_token: Callable[[str, str], str],
+    insert_metrics: Callable[[list[Metrics]], None],
+) -> None:
+    now = datetime.now(tz=UTC).replace(second=0, microsecond=0)
+
+    metrics: list[Metrics] = [
+        Metrics(
+            metric_name="ns.a.requests_total",
+            labels={"service": "svc-a"},
+            timestamp=now - timedelta(minutes=2),
+            value=10.0,
+        ),
+        Metrics(
+            metric_name="ns.b.requests_total",
+            labels={"service": "svc-b"},
+            timestamp=now - timedelta(minutes=2),
+            value=20.0,
+        ),
+    ]
+    insert_metrics(metrics)
+
+    token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
+
+    # Specific prefix: metricNamespace=ns.a should return only svc-a
+    response = requests.get(
+        signoz.self.host_configs["8080"].get("/api/v1/fields/values"),
+        timeout=5,
+        headers={"authorization": f"Bearer {token}"},
+        params={
+            "signal": "metrics",
+            "name": "service",
+            "searchText": "",
+            "metricNamespace": "ns.a",
+        },
+    )
+
+    assert response.status_code == HTTPStatus.OK
+    assert response.json()["status"] == "success"
+
+    values = response.json()["data"]["values"]["stringValues"]
+    assert "svc-a" in values
+    assert "svc-b" not in values
+
+    # Common prefix: metricNamespace=ns should return both
+    response = requests.get(
+        signoz.self.host_configs["8080"].get("/api/v1/fields/values"),
+        timeout=5,
+        headers={"authorization": f"Bearer {token}"},
+        params={
+            "signal": "metrics",
+            "name": "service",
+            "searchText": "",
+            "metricNamespace": "ns",
+        },
+    )
+
+    assert response.status_code == HTTPStatus.OK
+    assert response.json()["status"] == "success"
+
+    values = response.json()["data"]["values"]["stringValues"]
+    assert "svc-a" in values
+    assert "svc-b" in values
+
+
+# Verify /api/v1/fields/values with name=metric_name filters metric names by
+# metricNamespace prefix. A specific prefix returns only its metric names;
+# a common prefix returns metric names from all matching namespaces.
+def test_metric_namespace_metric_name_values_filtering(
+    signoz: types.SigNoz,
+    create_user_admin: None,  # pylint: disable=unused-argument
+    get_token: Callable[[str, str], str],
+    insert_metrics: Callable[[list[Metrics]], None],
+) -> None:
+    now = datetime.now(tz=UTC).replace(second=0, microsecond=0)
+
+    metrics: list[Metrics] = [
+        Metrics(
+            metric_name="ns.a.cpu.utilization",
+            labels={"host": "host-a"},
+            timestamp=now - timedelta(minutes=2),
+            value=50.0,
+        ),
+        Metrics(
+            metric_name="ns.b.cpu.utilization",
+            labels={"host": "host-b"},
+            timestamp=now - timedelta(minutes=2),
+            value=60.0,
+        ),
+    ]
+    insert_metrics(metrics)
+
+    token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
+
+    # Specific prefix: metricNamespace=ns.a should return only ns.a.* metric names
+    response = requests.get(
+        signoz.self.host_configs["8080"].get("/api/v1/fields/values"),
+        timeout=5,
+        headers={"authorization": f"Bearer {token}"},
+        params={
+            "signal": "metrics",
+            "name": "metric_name",
+            "searchText": "",
+            "metricNamespace": "ns.a",
+        },
+    )
+
+    assert response.status_code == HTTPStatus.OK
+    assert response.json()["status"] == "success"
+
+    values = response.json()["data"]["values"]["stringValues"]
+    assert "ns.a.cpu.utilization" in values
+    assert "ns.b.cpu.utilization" not in values
+
+    # Common prefix: metricNamespace=ns should return both
+    response = requests.get(
+        signoz.self.host_configs["8080"].get("/api/v1/fields/values"),
+        timeout=5,
+        headers={"authorization": f"Bearer {token}"},
+        params={
+            "signal": "metrics",
+            "name": "metric_name",
+            "searchText": "",
+            "metricNamespace": "ns",
+        },
+    )
+
+    assert response.status_code == HTTPStatus.OK
+    assert response.json()["status"] == "success"
+
+    values = response.json()["data"]["values"]["stringValues"]
+    assert "ns.a.cpu.utilization" in values
+    assert "ns.b.cpu.utilization" in values
+
+
+# Verify /api/v1/fields/keys filters attribute keys by metricNamespace prefix.
+# Metrics under ns.a and ns.b carry distinct labels; a specific prefix returns
+# only its keys while a common prefix returns keys from both namespaces.
+def test_metric_namespace_keys_filtering(
+    signoz: types.SigNoz,
+    create_user_admin: None,  # pylint: disable=unused-argument
+    get_token: Callable[[str, str], str],
+    insert_metrics: Callable[[list[Metrics]], None],
+) -> None:
+    now = datetime.now(tz=UTC).replace(second=0, microsecond=0)
+
+    metrics: list[Metrics] = [
+        Metrics(
+            metric_name="ns.a.cpu.utilization",
+            labels={"a_only_label": "val-a"},
+            timestamp=now - timedelta(minutes=2),
+            value=10.0,
+        ),
+        Metrics(
+            metric_name="ns.b.cpu.utilization",
+            labels={"b_only_label": "val-b"},
+            timestamp=now - timedelta(minutes=2),
+            value=20.0,
+        ),
+    ]
+    insert_metrics(metrics)
+
+    token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
+
+    # Specific prefix: metricNamespace=ns.a should return only a_only_label
+    response = requests.get(
+        signoz.self.host_configs["8080"].get("/api/v1/fields/keys"),
+        timeout=5,
+        headers={"authorization": f"Bearer {token}"},
+        params={
+            "signal": "metrics",
+            "searchText": "label",
+            "metricNamespace": "ns.a",
+        },
+    )
+
+    assert response.status_code == HTTPStatus.OK
+    assert response.json()["status"] == "success"
+
+    keys = response.json()["data"]["keys"]
+    assert "a_only_label" in keys
+    assert "b_only_label" not in keys
+
+    # Common prefix: metricNamespace=ns should return both keys
+    response = requests.get(
+        signoz.self.host_configs["8080"].get("/api/v1/fields/keys"),
+        timeout=5,
+        headers={"authorization": f"Bearer {token}"},
+        params={
+            "signal": "metrics",
+            "searchText": "label",
+            "metricNamespace": "ns",
+        },
+    )
+
+    assert response.status_code == HTTPStatus.OK
+    assert response.json()["status"] == "success"
+
+    keys = response.json()["data"]["keys"]
+    assert "a_only_label" in keys
+    assert "b_only_label" in keys

tests/integration/tests/querierscalar/01_logs.py

@@ -0,0 +1,341 @@
+from collections.abc import Callable
+from datetime import UTC, datetime, timedelta
+from http import HTTPStatus
+
+from fixtures import querier, types
+from fixtures.auth import USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD
+from fixtures.logs import Logs
+from fixtures.querier import make_scalar_query_request
+
+log_or_trace_service_counts = {
+    "service-a": 5,
+    "service-b": 3,
+    "service-c": 7,
+    "service-d": 1,
+}
+
+
+def generate_logs_with_counts(
+    now: datetime,
+    service_counts: dict[str, int],
+) -> list[Logs]:
+    logs = []
+    for service, count in service_counts.items():
+        for i in range(count):
+            logs.append(
+                Logs(
+                    timestamp=now - timedelta(seconds=i + 1),
+                    resources={"service.name": service},
+                    body=f"{service} log {i}",
+                )
+            )
+    return logs
+
+
+def build_logs_query(
+    name: str = "A",
+    aggregations: list[str] | None = None,
+    group_by: list[str] | None = None,
+    order_by: list[tuple[str, str]] | None = None,
+    limit: int | None = None,
+) -> dict:
+    if aggregations is None:
+        aggregations = ["count()"]
+
+    aggs = [querier.build_logs_aggregation(expr) for expr in aggregations]
+    gb = [querier.build_group_by_field(f, "string", "resource") for f in group_by] if group_by else None
+    order = [querier.build_order_by(name, direction) for name, direction in order_by] if order_by else None
+
+    return querier.build_scalar_query(
+        name=name,
+        signal="logs",
+        aggregations=aggs,
+        group_by=gb,
+        order=order,
+        limit=limit,
+    )
+
+
+def test_logs_scalar_group_by_single_agg_no_order(
+    signoz: types.SigNoz,
+    create_user_admin: None,  # pylint: disable=unused-argument
+    get_token: Callable[[str, str], str],
+    insert_logs: Callable[[list[Logs]], None],
+) -> None:
+    now = datetime.now(tz=UTC).replace(second=0, microsecond=0)
+    insert_logs(generate_logs_with_counts(now, log_or_trace_service_counts))
+
+    token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
+    response = make_scalar_query_request(
+        signoz,
+        token,
+        now,
+        [build_logs_query(group_by=["service.name"])],
+    )
+
+    assert response.status_code == HTTPStatus.OK
+    assert response.json()["status"] == "success"
+
+    data = querier.get_scalar_table_data(response.json())
+    querier.assert_scalar_result_order(
+        data,
+        [("service-c", 7), ("service-a", 5), ("service-b", 3), ("service-d", 1)],
+        "Logs no order - default desc",
+    )
+
+
+def test_logs_scalar_group_by_single_agg_order_by_agg_asc(
+    signoz: types.SigNoz,
+    create_user_admin: None,  # pylint: disable=unused-argument
+    get_token: Callable[[str, str], str],
+    insert_logs: Callable[[list[Logs]], None],
+) -> None:
+    now = datetime.now(tz=UTC).replace(second=0, microsecond=0)
+    insert_logs(generate_logs_with_counts(now, log_or_trace_service_counts))
+
+    token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
+    response = make_scalar_query_request(
+        signoz,
+        token,
+        now,
+        [build_logs_query(group_by=["service.name"], order_by=[("count()", "asc")])],
+    )
+
+    assert response.status_code == HTTPStatus.OK
+    assert response.json()["status"] == "success"
+
+    data = querier.get_scalar_table_data(response.json())
+    querier.assert_scalar_result_order(
+        data,
+        [("service-d", 1), ("service-b", 3), ("service-a", 5), ("service-c", 7)],
+        "Logs order by agg asc",
+    )
+
+
+def test_logs_scalar_group_by_single_agg_order_by_agg_desc(
+    signoz: types.SigNoz,
+    create_user_admin: None,  # pylint: disable=unused-argument
+    get_token: Callable[[str, str], str],
+    insert_logs: Callable[[list[Logs]], None],
+) -> None:
+    now = datetime.now(tz=UTC).replace(second=0, microsecond=0)
+    insert_logs(generate_logs_with_counts(now, log_or_trace_service_counts))
+
+    token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
+    response = make_scalar_query_request(
+        signoz,
+        token,
+        now,
+        [build_logs_query(group_by=["service.name"], order_by=[("count()", "desc")])],
+    )
+
+    assert response.status_code == HTTPStatus.OK
+    assert response.json()["status"] == "success"
+
+    data = querier.get_scalar_table_data(response.json())
+    querier.assert_scalar_result_order(
+        data,
+        [("service-c", 7), ("service-a", 5), ("service-b", 3), ("service-d", 1)],
+        "Logs order by agg desc",
+    )
+
+
+def test_logs_scalar_group_by_single_agg_order_by_grouping_key_asc(
+    signoz: types.SigNoz,
+    create_user_admin: None,  # pylint: disable=unused-argument
+    get_token: Callable[[str, str], str],
+    insert_logs: Callable[[list[Logs]], None],
+) -> None:
+    now = datetime.now(tz=UTC).replace(second=0, microsecond=0)
+    insert_logs(generate_logs_with_counts(now, log_or_trace_service_counts))
+
+    token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
+    response = make_scalar_query_request(
+        signoz,
+        token,
+        now,
+        [build_logs_query(group_by=["service.name"], order_by=[("service.name", "asc")])],
+    )
+
+    assert response.status_code == HTTPStatus.OK
+    assert response.json()["status"] == "success"
+
+    data = querier.get_scalar_table_data(response.json())
+    querier.assert_scalar_result_order(
+        data,
+        [("service-a", 5), ("service-b", 3), ("service-c", 7), ("service-d", 1)],
+        "Logs order by grouping key asc",
+    )
+
+
+def test_logs_scalar_group_by_single_agg_order_by_grouping_key_desc(
+    signoz: types.SigNoz,
+    create_user_admin: None,  # pylint: disable=unused-argument
+    get_token: Callable[[str, str], str],
+    insert_logs: Callable[[list[Logs]], None],
+) -> None:
+    now = datetime.now(tz=UTC).replace(second=0, microsecond=0)
+    insert_logs(generate_logs_with_counts(now, log_or_trace_service_counts))
+
+    token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
+    response = make_scalar_query_request(
+        signoz,
+        token,
+        now,
+        [build_logs_query(group_by=["service.name"], order_by=[("service.name", "desc")])],
+    )
+
+    assert response.status_code == HTTPStatus.OK
+    assert response.json()["status"] == "success"
+
+    data = querier.get_scalar_table_data(response.json())
+    querier.assert_scalar_result_order(
+        data,
+        [("service-d", 1), ("service-c", 7), ("service-b", 3), ("service-a", 5)],
+        "Logs order by grouping key desc",
+    )
+
+
+def test_logs_scalar_group_by_multiple_aggs_order_by_first_agg_asc(
+    signoz: types.SigNoz,
+    create_user_admin: None,  # pylint: disable=unused-argument
+    get_token: Callable[[str, str], str],
+    insert_logs: Callable[[list[Logs]], None],
+) -> None:
+    now = datetime.now(tz=UTC).replace(second=0, microsecond=0)
+    insert_logs(generate_logs_with_counts(now, log_or_trace_service_counts))
+
+    token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
+    response = make_scalar_query_request(
+        signoz,
+        token,
+        now,
+        [
+            build_logs_query(
+                group_by=["service.name"],
+                aggregations=["count()", "count_distinct(body)"],
+                order_by=[("count()", "asc")],
+            )
+        ],
+    )
+
+    assert response.status_code == HTTPStatus.OK
+    assert response.json()["status"] == "success"
+
+    data = querier.get_scalar_table_data(response.json())
+    querier.assert_scalar_column_order(data, 0, ["service-d", "service-b", "service-a", "service-c"], "First column")
+
+
+def test_logs_scalar_group_by_multiple_aggs_order_by_second_agg_desc(
+    signoz: types.SigNoz,
+    create_user_admin: None,  # pylint: disable=unused-argument
+    get_token: Callable[[str, str], str],
+    insert_logs: Callable[[list[Logs]], None],
+) -> None:
+    now = datetime.now(tz=UTC).replace(second=0, microsecond=0)
+    insert_logs(generate_logs_with_counts(now, log_or_trace_service_counts))
+
+    token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
+    response = make_scalar_query_request(
+        signoz,
+        token,
+        now,
+        [
+            build_logs_query(
+                group_by=["service.name"],
+                aggregations=["count()", "count_distinct(body)"],
+                order_by=[("count_distinct(body)", "desc")],
+            )
+        ],
+    )
+
+    assert response.status_code == HTTPStatus.OK
+    assert response.json()["status"] == "success"
+
+    data = querier.get_scalar_table_data(response.json())
+    # count_distinct(body) should equal count() since each log has unique body
+    querier.assert_scalar_column_order(data, 0, ["service-c", "service-a", "service-b", "service-d"], "First column")
+
+
+def test_logs_scalar_group_by_single_agg_order_by_agg_asc_limit_2(
+    signoz: types.SigNoz,
+    create_user_admin: None,  # pylint: disable=unused-argument
+    get_token: Callable[[str, str], str],
+    insert_logs: Callable[[list[Logs]], None],
+) -> None:
+    now = datetime.now(tz=UTC).replace(second=0, microsecond=0)
+    insert_logs(generate_logs_with_counts(now, log_or_trace_service_counts))
+
+    token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
+    response = make_scalar_query_request(
+        signoz,
+        token,
+        now,
+        [build_logs_query(group_by=["service.name"], order_by=[("count()", "asc")], limit=2)],
+    )
+
+    assert response.status_code == HTTPStatus.OK
+    assert response.json()["status"] == "success"
+
+    data = querier.get_scalar_table_data(response.json())
+    querier.assert_scalar_result_order(
+        data,
+        [("service-d", 1), ("service-b", 3)],
+        "Logs order by agg asc with limit 2",
+    )
+
+
+def test_logs_scalar_group_by_single_agg_order_by_agg_desc_limit_3(
+    signoz: types.SigNoz,
+    create_user_admin: None,  # pylint: disable=unused-argument
+    get_token: Callable[[str, str], str],
+    insert_logs: Callable[[list[Logs]], None],
+) -> None:
+    now = datetime.now(tz=UTC).replace(second=0, microsecond=0)
+    insert_logs(generate_logs_with_counts(now, log_or_trace_service_counts))
+
+    token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
+    response = make_scalar_query_request(
+        signoz,
+        token,
+        now,
+        [build_logs_query(group_by=["service.name"], order_by=[("count()", "desc")], limit=3)],
+    )
+
+    assert response.status_code == HTTPStatus.OK
+    assert response.json()["status"] == "success"
+
+    data = querier.get_scalar_table_data(response.json())
+    querier.assert_scalar_result_order(
+        data,
+        [("service-c", 7), ("service-a", 5), ("service-b", 3)],
+        "Logs order by agg desc with limit 3",
+    )
+
+
+def test_logs_scalar_group_by_order_by_grouping_key_asc_limit_2(
+    signoz: types.SigNoz,
+    create_user_admin: None,  # pylint: disable=unused-argument
+    get_token: Callable[[str, str], str],
+    insert_logs: Callable[[list[Logs]], None],
+) -> None:
+    now = datetime.now(tz=UTC).replace(second=0, microsecond=0)
+    insert_logs(generate_logs_with_counts(now, log_or_trace_service_counts))
+
+    token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
+    response = make_scalar_query_request(
+        signoz,
+        token,
+        now,
+        [build_logs_query(group_by=["service.name"], order_by=[("service.name", "asc")], limit=2)],
+    )
+
+    assert response.status_code == HTTPStatus.OK
+    assert response.json()["status"] == "success"
+
+    data = querier.get_scalar_table_data(response.json())
+    querier.assert_scalar_result_order(
+        data,
+        [("service-a", 5), ("service-b", 3)],
+        "Logs order by grouping key asc with limit 2",
+    )

tests/integration/tests/querierscalar/02_traces.py

@@ -0,0 +1,316 @@
+from collections.abc import Callable
+from datetime import UTC, datetime, timedelta
+from http import HTTPStatus
+
+from fixtures import querier, types
+from fixtures.auth import USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD
+from fixtures.querier import make_scalar_query_request
+from fixtures.traces import TraceIdGenerator, Traces, TracesKind, TracesStatusCode
+
+log_or_trace_service_counts = {
+    "service-a": 5,
+    "service-b": 3,
+    "service-c": 7,
+    "service-d": 1,
+}
+
+
+def generate_traces_with_counts(
+    now: datetime,
+    service_counts: dict[str, int],
+) -> list[Traces]:
+    traces = []
+    for service, count in service_counts.items():
+        for i in range(count):
+            trace_id = TraceIdGenerator.trace_id()
+            span_id = TraceIdGenerator.span_id()
+            traces.append(
+                Traces(
+                    timestamp=now - timedelta(seconds=i + 1),
+                    kind=TracesKind.SPAN_KIND_SERVER,
+                    status_code=TracesStatusCode.STATUS_CODE_OK,
+                    trace_id=trace_id,
+                    span_id=span_id,
+                    resources={"service.name": service},
+                    name=f"{service} span {i}",
+                )
+            )
+    return traces
+
+
+def build_traces_query(
+    name: str = "A",
+    aggregations: list[str] | None = None,
+    group_by: list[str] | None = None,
+    order_by: list[tuple[str, str]] | None = None,
+    limit: int | None = None,
+) -> dict:
+    if aggregations is None:
+        aggregations = ["count()"]
+
+    aggs = [querier.build_logs_aggregation(expr) for expr in aggregations]
+    gb = [querier.build_group_by_field(f, "string", "resource") for f in group_by] if group_by else None
+    order = [querier.build_order_by(name, direction) for name, direction in order_by] if order_by else None
+
+    return querier.build_scalar_query(
+        name=name,
+        signal="traces",
+        aggregations=aggs,
+        group_by=gb,
+        order=order,
+        limit=limit,
+    )
+
+
+def test_traces_scalar_group_by_single_agg_no_order(
+    signoz: types.SigNoz,
+    create_user_admin: None,  # pylint: disable=unused-argument
+    get_token: Callable[[str, str], str],
+    insert_traces: Callable[[list[Traces]], None],
+) -> None:
+    now = datetime.now(tz=UTC).replace(second=0, microsecond=0)
+    insert_traces(generate_traces_with_counts(now, log_or_trace_service_counts))
+
+    token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
+    response = make_scalar_query_request(
+        signoz,
+        token,
+        now,
+        [build_traces_query(group_by=["service.name"])],
+    )
+
+    assert response.status_code == HTTPStatus.OK
+    assert response.json()["status"] == "success"
+
+    data = querier.get_scalar_table_data(response.json())
+    querier.assert_scalar_result_order(
+        data,
+        [("service-c", 7), ("service-a", 5), ("service-b", 3), ("service-d", 1)],
+        "Traces no order - default desc",
+    )
+
+
+def test_traces_scalar_group_by_single_agg_order_by_agg_asc(
+    signoz: types.SigNoz,
+    create_user_admin: None,  # pylint: disable=unused-argument
+    get_token: Callable[[str, str], str],
+    insert_traces: Callable[[list[Traces]], None],
+) -> None:
+    now = datetime.now(tz=UTC).replace(second=0, microsecond=0)
+    insert_traces(generate_traces_with_counts(now, log_or_trace_service_counts))
+
+    token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
+    response = make_scalar_query_request(
+        signoz,
+        token,
+        now,
+        [build_traces_query(group_by=["service.name"], order_by=[("count()", "asc")])],
+    )
+
+    assert response.status_code == HTTPStatus.OK
+    assert response.json()["status"] == "success"
+
+    data = querier.get_scalar_table_data(response.json())
+    querier.assert_scalar_result_order(
+        data,
+        [("service-d", 1), ("service-b", 3), ("service-a", 5), ("service-c", 7)],
+        "Traces order by agg asc",
+    )
+
+
+def test_traces_scalar_group_by_single_agg_order_by_agg_desc(
+    signoz: types.SigNoz,
+    create_user_admin: None,  # pylint: disable=unused-argument
+    get_token: Callable[[str, str], str],
+    insert_traces: Callable[[list[Traces]], None],
+) -> None:
+    now = datetime.now(tz=UTC).replace(second=0, microsecond=0)
+    insert_traces(generate_traces_with_counts(now, log_or_trace_service_counts))
+
+    token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
+    response = make_scalar_query_request(
+        signoz,
+        token,
+        now,
+        [build_traces_query(group_by=["service.name"], order_by=[("count()", "desc")])],
+    )
+
+    assert response.status_code == HTTPStatus.OK
+    assert response.json()["status"] == "success"
+
+    data = querier.get_scalar_table_data(response.json())
+    querier.assert_scalar_result_order(
+        data,
+        [("service-c", 7), ("service-a", 5), ("service-b", 3), ("service-d", 1)],
+        "Traces order by agg desc",
+    )
+
+
+def test_traces_scalar_group_by_single_agg_order_by_grouping_key_asc(
+    signoz: types.SigNoz,
+    create_user_admin: None,  # pylint: disable=unused-argument
+    get_token: Callable[[str, str], str],
+    insert_traces: Callable[[list[Traces]], None],
+) -> None:
+    now = datetime.now(tz=UTC).replace(second=0, microsecond=0)
+    insert_traces(generate_traces_with_counts(now, log_or_trace_service_counts))
+
+    token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
+    response = make_scalar_query_request(
+        signoz,
+        token,
+        now,
+        [build_traces_query(group_by=["service.name"], order_by=[("service.name", "asc")])],
+    )
+
+    assert response.status_code == HTTPStatus.OK
+    assert response.json()["status"] == "success"
+
+    data = querier.get_scalar_table_data(response.json())
+    querier.assert_scalar_result_order(
+        data,
+        [("service-a", 5), ("service-b", 3), ("service-c", 7), ("service-d", 1)],
+        "Traces order by grouping key asc",
+    )
+
+
+def test_traces_scalar_group_by_single_agg_order_by_grouping_key_desc(
+    signoz: types.SigNoz,
+    create_user_admin: None,  # pylint: disable=unused-argument
+    get_token: Callable[[str, str], str],
+    insert_traces: Callable[[list[Traces]], None],
+) -> None:
+    now = datetime.now(tz=UTC).replace(second=0, microsecond=0)
+    insert_traces(generate_traces_with_counts(now, log_or_trace_service_counts))
+
+    token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
+    response = make_scalar_query_request(
+        signoz,
+        token,
+        now,
+        [build_traces_query(group_by=["service.name"], order_by=[("service.name", "desc")])],
+    )
+
+    assert response.status_code == HTTPStatus.OK
+    assert response.json()["status"] == "success"
+
+    data = querier.get_scalar_table_data(response.json())
+    querier.assert_scalar_result_order(
+        data,
+        [("service-d", 1), ("service-c", 7), ("service-b", 3), ("service-a", 5)],
+        "Traces order by grouping key desc",
+    )
+
+
+def test_traces_scalar_group_by_multiple_aggs_order_by_first_agg_asc(
+    signoz: types.SigNoz,
+    create_user_admin: None,  # pylint: disable=unused-argument
+    get_token: Callable[[str, str], str],
+    insert_traces: Callable[[list[Traces]], None],
+) -> None:
+    now = datetime.now(tz=UTC).replace(second=0, microsecond=0)
+    insert_traces(generate_traces_with_counts(now, log_or_trace_service_counts))
+
+    token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
+    response = make_scalar_query_request(
+        signoz,
+        token,
+        now,
+        [
+            build_traces_query(
+                group_by=["service.name"],
+                aggregations=["count()", "count_distinct(trace_id)"],
+                order_by=[("count()", "asc")],
+            )
+        ],
+    )
+
+    assert response.status_code == HTTPStatus.OK
+    assert response.json()["status"] == "success"
+
+    data = querier.get_scalar_table_data(response.json())
+    querier.assert_scalar_column_order(data, 0, ["service-d", "service-b", "service-a", "service-c"], "First column")
+
+
+def test_traces_scalar_group_by_single_agg_order_by_agg_asc_limit_2(
+    signoz: types.SigNoz,
+    create_user_admin: None,  # pylint: disable=unused-argument
+    get_token: Callable[[str, str], str],
+    insert_traces: Callable[[list[Traces]], None],
+) -> None:
+    now = datetime.now(tz=UTC).replace(second=0, microsecond=0)
+    insert_traces(generate_traces_with_counts(now, log_or_trace_service_counts))
+
+    token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
+    response = make_scalar_query_request(
+        signoz,
+        token,
+        now,
+        [build_traces_query(group_by=["service.name"], order_by=[("count()", "asc")], limit=2)],
+    )
+
+    assert response.status_code == HTTPStatus.OK
+    assert response.json()["status"] == "success"
+
+    data = querier.get_scalar_table_data(response.json())
+    querier.assert_scalar_result_order(
+        data,
+        [("service-d", 1), ("service-b", 3)],
+        "Traces order by agg asc with limit 2",
+    )
+
+
+def test_traces_scalar_group_by_single_agg_order_by_agg_desc_limit_3(
+    signoz: types.SigNoz,
+    create_user_admin: None,  # pylint: disable=unused-argument
+    get_token: Callable[[str, str], str],
+    insert_traces: Callable[[list[Traces]], None],
+) -> None:
+    now = datetime.now(tz=UTC).replace(second=0, microsecond=0)
+    insert_traces(generate_traces_with_counts(now, log_or_trace_service_counts))
+
+    token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
+    response = make_scalar_query_request(
+        signoz,
+        token,
+        now,
+        [build_traces_query(group_by=["service.name"], order_by=[("count()", "desc")], limit=3)],
+    )
+
+    assert response.status_code == HTTPStatus.OK
+    assert response.json()["status"] == "success"
+
+    data = querier.get_scalar_table_data(response.json())
+    querier.assert_scalar_result_order(
+        data,
+        [("service-c", 7), ("service-a", 5), ("service-b", 3)],
+        "Traces order by agg desc with limit 3",
+    )
+
+
+def test_traces_scalar_group_by_order_by_grouping_key_asc_limit_2(
+    signoz: types.SigNoz,
+    create_user_admin: None,  # pylint: disable=unused-argument
+    get_token: Callable[[str, str], str],
+    insert_traces: Callable[[list[Traces]], None],
+) -> None:
+    now = datetime.now(tz=UTC).replace(second=0, microsecond=0)
+    insert_traces(generate_traces_with_counts(now, log_or_trace_service_counts))
+
+    token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
+    response = make_scalar_query_request(
+        signoz,
+        token,
+        now,
+        [build_traces_query(group_by=["service.name"], order_by=[("service.name", "asc")], limit=2)],
+    )
+
+    assert response.status_code == HTTPStatus.OK
+    assert response.json()["status"] == "success"
+
+    data = querier.get_scalar_table_data(response.json())
+    querier.assert_scalar_result_order(
+        data,
+        [("service-a", 5), ("service-b", 3)],
+        "Traces order by grouping key asc with limit 2",
+    )

tests/integration/tests/querierscalar/03_metrics.py

@@ -0,0 +1,269 @@
+from collections.abc import Callable
+from datetime import UTC, datetime, timedelta
+from http import HTTPStatus
+
+from fixtures import querier, types
+from fixtures.auth import USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD
+from fixtures.metrics import Metrics
+from fixtures.querier import make_scalar_query_request
+
+metric_values_for_test = {
+    "service-a": 50.0,
+    "service-b": 30.0,
+    "service-c": 70.0,
+    "service-d": 10.0,
+}
+
+
+def generate_metrics_with_values(
+    now: datetime,
+    service_values: dict[str, float],
+) -> list[Metrics]:
+    metrics = []
+    for service, value in service_values.items():
+        metrics.append(
+            Metrics(
+                metric_name="test.metric",
+                labels={"service.name": service},
+                timestamp=now - timedelta(seconds=1),
+                temporality="Unspecified",
+                type_="Gauge",
+                is_monotonic=False,
+                value=value,
+            )
+        )
+    return metrics
+
+
+def build_metrics_query(
+    name: str = "A",
+    metric_name: str = "test.metric",
+    time_aggregation: str = "latest",
+    space_aggregation: str = "sum",
+    group_by: list[str] | None = None,
+    order_by: list[tuple[str, str]] | None = None,
+    limit: int | None = None,
+) -> dict:
+    aggs = [querier.build_metrics_aggregation(metric_name, time_aggregation, space_aggregation, "unspecified")]
+    gb = [querier.build_group_by_field(f, "string", "attribute") for f in group_by] if group_by else None
+    order = [querier.build_order_by(name, direction) for name, direction in order_by] if order_by else None
+
+    return querier.build_scalar_query(
+        name=name,
+        signal="metrics",
+        aggregations=aggs,
+        group_by=gb,
+        order=order,
+        limit=limit,
+    )
+
+
+def test_metrics_scalar_group_by_single_agg_no_order(
+    signoz: types.SigNoz,
+    create_user_admin: None,  # pylint: disable=unused-argument
+    get_token: Callable[[str, str], str],
+    insert_metrics: Callable[[list[Metrics]], None],
+) -> None:
+    now = datetime.now(tz=UTC).replace(second=0, microsecond=0)
+    insert_metrics(generate_metrics_with_values(now, metric_values_for_test))
+
+    token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
+    response = make_scalar_query_request(
+        signoz,
+        token,
+        now,
+        [build_metrics_query(group_by=["service.name"])],
+    )
+
+    assert response.status_code == HTTPStatus.OK
+    assert response.json()["status"] == "success"
+
+    data = querier.get_scalar_table_data(response.json())
+    querier.assert_scalar_result_order(
+        data,
+        [
+            ("service-c", 70.0),
+            ("service-a", 50.0),
+            ("service-b", 30.0),
+            ("service-d", 10.0),
+        ],
+        "Metrics no order - default desc",
+    )
+
+
+def test_metrics_scalar_group_by_single_agg_order_by_agg_asc(
+    signoz: types.SigNoz,
+    create_user_admin: None,  # pylint: disable=unused-argument
+    get_token: Callable[[str, str], str],
+    insert_metrics: Callable[[list[Metrics]], None],
+) -> None:
+    now = datetime.now(tz=UTC).replace(second=0, microsecond=0)
+    insert_metrics(generate_metrics_with_values(now, metric_values_for_test))
+
+    token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
+    response = make_scalar_query_request(
+        signoz,
+        token,
+        now,
+        [
+            build_metrics_query(
+                group_by=["service.name"],
+                order_by=[("sum(test.metric)", "asc")],
+            )
+        ],
+    )
+
+    assert response.status_code == HTTPStatus.OK
+    assert response.json()["status"] == "success"
+
+    data = querier.get_scalar_table_data(response.json())
+    querier.assert_scalar_result_order(
+        data,
+        [
+            ("service-d", 10.0),
+            ("service-b", 30.0),
+            ("service-a", 50.0),
+            ("service-c", 70.0),
+        ],
+        "Metrics order by agg asc",
+    )
+
+
+def test_metrics_scalar_group_by_single_agg_order_by_grouping_key_asc(
+    signoz: types.SigNoz,
+    create_user_admin: None,  # pylint: disable=unused-argument
+    get_token: Callable[[str, str], str],
+    insert_metrics: Callable[[list[Metrics]], None],
+) -> None:
+    now = datetime.now(tz=UTC).replace(second=0, microsecond=0)
+    insert_metrics(generate_metrics_with_values(now, metric_values_for_test))
+
+    token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
+    response = make_scalar_query_request(
+        signoz,
+        token,
+        now,
+        [
+            build_metrics_query(
+                group_by=["service.name"],
+                order_by=[("service.name", "asc")],
+            )
+        ],
+    )
+
+    assert response.status_code == HTTPStatus.OK
+    assert response.json()["status"] == "success"
+
+    data = querier.get_scalar_table_data(response.json())
+    querier.assert_scalar_result_order(
+        data,
+        [
+            ("service-a", 50.0),
+            ("service-b", 30.0),
+            ("service-c", 70.0),
+            ("service-d", 10.0),
+        ],
+        "Metrics order by grouping key asc",
+    )
+
+
+def test_metrics_scalar_group_by_single_agg_order_by_agg_asc_limit_2(
+    signoz: types.SigNoz,
+    create_user_admin: None,  # pylint: disable=unused-argument
+    get_token: Callable[[str, str], str],
+    insert_metrics: Callable[[list[Metrics]], None],
+) -> None:
+    now = datetime.now(tz=UTC).replace(second=0, microsecond=0)
+    insert_metrics(generate_metrics_with_values(now, metric_values_for_test))
+
+    token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
+    response = make_scalar_query_request(
+        signoz,
+        token,
+        now,
+        [
+            build_metrics_query(
+                group_by=["service.name"],
+                order_by=[("sum(test.metric)", "asc")],
+                limit=2,
+            )
+        ],
+    )
+
+    assert response.status_code == HTTPStatus.OK
+    assert response.json()["status"] == "success"
+
+    data = querier.get_scalar_table_data(response.json())
+    querier.assert_scalar_result_order(
+        data,
+        [("service-d", 10.0), ("service-b", 30.0)],
+        "Metrics order by agg asc with limit 2",
+    )
+
+
+def test_metrics_scalar_group_by_single_agg_order_by_agg_desc_limit_3(
+    signoz: types.SigNoz,
+    create_user_admin: None,  # pylint: disable=unused-argument
+    get_token: Callable[[str, str], str],
+    insert_metrics: Callable[[list[Metrics]], None],
+) -> None:
+    now = datetime.now(tz=UTC).replace(second=0, microsecond=0)
+    insert_metrics(generate_metrics_with_values(now, metric_values_for_test))
+
+    token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
+    response = make_scalar_query_request(
+        signoz,
+        token,
+        now,
+        [
+            build_metrics_query(
+                group_by=["service.name"],
+                order_by=[("sum(test.metric)", "desc")],
+                limit=3,
+            )
+        ],
+    )
+
+    assert response.status_code == HTTPStatus.OK
+    assert response.json()["status"] == "success"
+
+    data = querier.get_scalar_table_data(response.json())
+    querier.assert_scalar_result_order(
+        data,
+        [("service-c", 70.0), ("service-a", 50.0), ("service-b", 30.0)],
+        "Metrics order by agg desc with limit 3",
+    )
+
+
+def test_metrics_scalar_group_by_order_by_grouping_key_asc_limit_2(
+    signoz: types.SigNoz,
+    create_user_admin: None,  # pylint: disable=unused-argument
+    get_token: Callable[[str, str], str],
+    insert_metrics: Callable[[list[Metrics]], None],
+) -> None:
+    now = datetime.now(tz=UTC).replace(second=0, microsecond=0)
+    insert_metrics(generate_metrics_with_values(now, metric_values_for_test))
+
+    token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
+    response = make_scalar_query_request(
+        signoz,
+        token,
+        now,
+        [
+            build_metrics_query(
+                group_by=["service.name"],
+                order_by=[("service.name", "asc")],
+                limit=2,
+            )
+        ],
+    )
+
+    assert response.status_code == HTTPStatus.OK
+    assert response.json()["status"] == "success"
+
+    data = querier.get_scalar_table_data(response.json())
+    querier.assert_scalar_result_order(
+        data,
+        [("service-a", 50.0), ("service-b", 30.0)],
+        "Metrics order by grouping key asc with limit 2",
+    )

tests/integration/tests/querierscalar/04_having.py

@@ -0,0 +1,58 @@
+from collections.abc import Callable
+from datetime import UTC, datetime, timedelta
+from http import HTTPStatus
+
+from fixtures import types
+from fixtures.auth import USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD
+from fixtures.logs import Logs
+from fixtures.querier import (
+    assert_scalar_result_order,
+    build_group_by_field,
+    build_logs_aggregation,
+    build_order_by,
+    build_scalar_query,
+    get_scalar_table_data,
+    make_scalar_query_request,
+)
+
+# Non-empty HAVING (a post-aggregation filter) — every existing querier test uses
+# only the empty `{"expression": ""}` HAVING boilerplate.
+
+
+def test_logs_scalar_group_by_having(
+    signoz: types.SigNoz,
+    create_user_admin: None,  # pylint: disable=unused-argument
+    get_token: Callable[[str, str], str],
+    insert_logs: Callable[[list[Logs]], None],
+) -> None:
+    """A scalar group-by with `having count() > 3` returns only the qualifying groups."""
+    now = datetime.now(tz=UTC).replace(second=0, microsecond=0)
+    service_counts = {"service-a": 5, "service-b": 3, "service-c": 7, "service-d": 1}
+    logs = []
+    for service, count in service_counts.items():
+        for i in range(count):
+            logs.append(
+                Logs(
+                    timestamp=now - timedelta(seconds=i + 1),
+                    resources={"service.name": service},
+                    body=f"{service} log {i}",
+                )
+            )
+    insert_logs(logs)
+    token = get_token(email=USER_ADMIN_EMAIL, password=USER_ADMIN_PASSWORD)
+
+    query = build_scalar_query(
+        name="A",
+        signal="logs",
+        aggregations=[build_logs_aggregation("count()")],
+        group_by=[build_group_by_field("service.name", "string", "resource")],
+        order=[build_order_by("count()", "desc")],
+        having_expression="count() > 3",
+    )
+    response = make_scalar_query_request(signoz, token, now, [query])
+
+    assert response.status_code == HTTPStatus.OK
+    assert response.json()["status"] == "success"
+    data = get_scalar_table_data(response.json())
+    # only service-c (7) and service-a (5) have count() > 3; service-b (3) and service-d (1) dropped
+    assert_scalar_result_order(data, [("service-c", 7), ("service-a", 5)], "having count() > 3")

tests/integration/tests/querierscalar/05_reduce_to.py

@@ -0,0 +1,54 @@
+from collections.abc import Callable
+from datetime import UTC, datetime, timedelta
+from http import HTTPStatus
+
+from fixtures import types
+from fixtures.auth import USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD
+from fixtures.metrics import Metrics
+from fixtures.querier import (
+    assert_scalar_result_order,
+    build_group_by_field,
+    build_metrics_aggregation,
+    build_scalar_query,
+    get_scalar_table_data,
+    make_scalar_query_request,
+)
+
+# Metric scalar `reduceTo`: collapse a time series to a single value for a value/table
+# panel. Metrics scalar group-by is covered by 03_metrics.py, but reduceTo (last/sum/
+# avg/min/max) is not exercised anywhere.
+
+
+def test_metrics_scalar_reduce_to_sum(
+    signoz: types.SigNoz,
+    create_user_admin: None,  # pylint: disable=unused-argument
+    get_token: Callable[[str, str], str],
+    insert_metrics: Callable[[list[Metrics]], None],
+) -> None:
+    """reduceTo=sum collapses a series' per-step points (10, 20, 30) to 60."""
+    now = datetime.now(tz=UTC).replace(second=0, microsecond=0)
+    # same metric_name + labels => one fingerprint/series; three samples in three
+    # distinct 60s step buckets so latest-per-step yields 10, 20, 30.
+    insert_metrics(
+        [
+            Metrics(metric_name="test.reduce.metric", labels={"service.name": "service-a"}, timestamp=now - timedelta(seconds=121), value=10.0, temporality="Unspecified", type_="Gauge", is_monotonic=False),
+            Metrics(metric_name="test.reduce.metric", labels={"service.name": "service-a"}, timestamp=now - timedelta(seconds=61), value=20.0, temporality="Unspecified", type_="Gauge", is_monotonic=False),
+            Metrics(metric_name="test.reduce.metric", labels={"service.name": "service-a"}, timestamp=now - timedelta(seconds=1), value=30.0, temporality="Unspecified", type_="Gauge", is_monotonic=False),
+        ]
+    )
+    token = get_token(email=USER_ADMIN_EMAIL, password=USER_ADMIN_PASSWORD)
+
+    aggregation = build_metrics_aggregation("test.reduce.metric", "latest", "sum", "unspecified")
+    aggregation["reduceTo"] = "sum"
+    query = build_scalar_query(
+        name="A",
+        signal="metrics",
+        aggregations=[aggregation],
+        group_by=[build_group_by_field("service.name", "string", "attribute")],
+    )
+    response = make_scalar_query_request(signoz, token, now, [query])
+
+    assert response.status_code == HTTPStatus.OK
+    assert response.json()["status"] == "success"
+    data = get_scalar_table_data(response.json())
+    assert_scalar_result_order(data, [("service-a", 60.0)], "metrics reduceTo=sum")

tests/integration/tests/queriertraces/01_list.py

@@ -0,0 +1,905 @@
+from collections.abc import Callable
+from datetime import UTC, datetime, timedelta
+from http import HTTPStatus
+from typing import Any
+
+import pytest
+import requests
+
+from fixtures import types
+from fixtures.auth import USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD
+from fixtures.querier import (
+    assert_identical_query_response,
+    format_timestamp,
+    generate_traces_with_corrupt_metadata,
+    make_query_request,
+)
+from fixtures.traces import (
+    ALL_SELECT_FIELDS,
+    TraceIdGenerator,
+    Traces,
+    TracesEvent,
+    TracesKind,
+    TracesLink,
+    TracesRefType,
+    TracesStatusCode,
+)
+
+
+def test_traces_list(
+    signoz: types.SigNoz,
+    create_user_admin: None,  # pylint: disable=unused-argument
+    get_token: Callable[[str, str], str],
+    insert_traces: Callable[[list[Traces]], None],
+) -> None:
+    """
+    Setup:
+    Insert 4 traces with different attributes.
+    http-service: POST /integration -> SELECT, HTTP PATCH
+    topic-service: topic publish
+
+    Tests:
+    1. Query traces for the last 5 minutes and check if the spans are returned in the correct order
+    2. Query root spans for the last 5 minutes and check if the spans are returned in the correct order
+    3. Query values of http.request.method attribute from the autocomplete API
+    4. Query values of http.request.method attribute from the fields API
+    """
+    http_service_trace_id = TraceIdGenerator.trace_id()
+    http_service_span_id = TraceIdGenerator.span_id()
+    http_service_db_span_id = TraceIdGenerator.span_id()
+    http_service_patch_span_id = TraceIdGenerator.span_id()
+    topic_service_trace_id = TraceIdGenerator.trace_id()
+    topic_service_span_id = TraceIdGenerator.span_id()
+
+    now = datetime.now(tz=UTC).replace(second=0, microsecond=0)
+
+    insert_traces(
+        [
+            Traces(
+                timestamp=now - timedelta(seconds=4),
+                duration=timedelta(seconds=3),
+                trace_id=http_service_trace_id,
+                span_id=http_service_span_id,
+                parent_span_id="",
+                name="POST /integration",
+                kind=TracesKind.SPAN_KIND_SERVER,
+                status_code=TracesStatusCode.STATUS_CODE_OK,
+                status_message="",
+                resources={
+                    "deployment.environment": "production",
+                    "service.name": "http-service",
+                    "os.type": "linux",
+                    "host.name": "linux-000",
+                    "cloud.provider": "integration",
+                    "cloud.account.id": "000",
+                },
+                attributes={
+                    "net.transport": "IP.TCP",
+                    "http.scheme": "http",
+                    "http.user_agent": "Integration Test",
+                    "http.request.method": "POST",
+                    "http.response.status_code": "200",
+                },
+            ),
+            Traces(
+                timestamp=now - timedelta(seconds=3.5),
+                duration=timedelta(seconds=0.5),
+                trace_id=http_service_trace_id,
+                span_id=http_service_db_span_id,
+                parent_span_id=http_service_span_id,
+                name="SELECT",
+                kind=TracesKind.SPAN_KIND_CLIENT,
+                status_code=TracesStatusCode.STATUS_CODE_OK,
+                status_message="",
+                resources={
+                    "deployment.environment": "production",
+                    "service.name": "http-service",
+                    "os.type": "linux",
+                    "host.name": "linux-000",
+                    "cloud.provider": "integration",
+                    "cloud.account.id": "000",
+                },
+                attributes={
+                    "db.name": "integration",
+                    "db.operation": "SELECT",
+                    "db.statement": "SELECT * FROM integration",
+                },
+            ),
+            Traces(
+                timestamp=now - timedelta(seconds=3),
+                duration=timedelta(seconds=1),
+                trace_id=http_service_trace_id,
+                span_id=http_service_patch_span_id,
+                parent_span_id=http_service_span_id,
+                name="HTTP PATCH",
+                kind=TracesKind.SPAN_KIND_CLIENT,
+                status_code=TracesStatusCode.STATUS_CODE_OK,
+                status_message="",
+                resources={
+                    "deployment.environment": "production",
+                    "service.name": "http-service",
+                    "os.type": "linux",
+                    "host.name": "linux-000",
+                    "cloud.provider": "integration",
+                    "cloud.account.id": "000",
+                },
+                attributes={
+                    "http.request.method": "PATCH",
+                    "http.status_code": "404",
+                },
+            ),
+            Traces(
+                timestamp=now - timedelta(seconds=1),
+                duration=timedelta(seconds=4),
+                trace_id=topic_service_trace_id,
+                span_id=topic_service_span_id,
+                parent_span_id="",
+                name="topic publish",
+                kind=TracesKind.SPAN_KIND_PRODUCER,
+                status_code=TracesStatusCode.STATUS_CODE_OK,
+                status_message="",
+                resources={
+                    "deployment.environment": "production",
+                    "service.name": "topic-service",
+                    "os.type": "linux",
+                    "host.name": "linux-001",
+                    "cloud.provider": "integration",
+                    "cloud.account.id": "001",
+                },
+                attributes={
+                    "message.type": "SENT",
+                    "messaging.operation": "publish",
+                    "messaging.message.id": "001",
+                },
+            ),
+        ]
+    )
+
+    token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
+
+    # Query all traces for the past 5 minutes
+    response = requests.post(
+        signoz.self.host_configs["8080"].get("/api/v5/query_range"),
+        timeout=2,
+        headers={
+            "authorization": f"Bearer {token}",
+        },
+        json={
+            "schemaVersion": "v1",
+            "start": int((datetime.now(tz=UTC) - timedelta(minutes=5)).timestamp() * 1000),
+            "end": int(datetime.now(tz=UTC).timestamp() * 1000),
+            "requestType": "raw",
+            "compositeQuery": {
+                "queries": [
+                    {
+                        "type": "builder_query",
+                        "spec": {
+                            "name": "A",
+                            "signal": "traces",
+                            "disabled": False,
+                            "limit": 10,
+                            "offset": 0,
+                            "order": [
+                                {"key": {"name": "timestamp"}, "direction": "desc"},
+                            ],
+                            "selectFields": [
+                                {
+                                    "name": "service.name",
+                                    "fieldDataType": "string",
+                                    "fieldContext": "resource",
+                                    "signal": "traces",
+                                },
+                                {
+                                    "name": "name",
+                                    "fieldDataType": "string",
+                                    "fieldContext": "span",
+                                    "signal": "traces",
+                                },
+                                {
+                                    "name": "duration_nano",
+                                    "fieldDataType": "",
+                                    "fieldContext": "span",
+                                    "signal": "traces",
+                                },
+                                {
+                                    "name": "http_method",
+                                    "fieldDataType": "",
+                                    "fieldContext": "span",
+                                    "signal": "traces",
+                                },
+                                {
+                                    "name": "response_status_code",
+                                    "fieldDataType": "",
+                                    "fieldContext": "span",
+                                    "signal": "traces",
+                                },
+                            ],
+                            "having": {"expression": ""},
+                            "aggregations": [{"expression": "count()"}],
+                        },
+                    }
+                ]
+            },
+            "formatOptions": {"formatTableResultForUI": False, "fillGaps": False},
+        },
+    )
+
+    # Query results with context appended to key names
+    response_with_inline_context = make_query_request(
+        signoz,
+        token,
+        start_ms=int((datetime.now(tz=UTC) - timedelta(minutes=5)).timestamp() * 1000),
+        end_ms=int(datetime.now(tz=UTC).timestamp() * 1000),
+        request_type="raw",
+        queries=[
+            {
+                "type": "builder_query",
+                "spec": {
+                    "name": "A",
+                    "signal": "traces",
+                    "disabled": False,
+                    "limit": 10,
+                    "offset": 0,
+                    "order": [
+                        {"key": {"name": "timestamp"}, "direction": "desc"},
+                    ],
+                    "selectFields": [
+                        {
+                            "name": "resource.service.name",
+                            "fieldDataType": "string",
+                            "signal": "traces",
+                        },
+                        {
+                            "name": "span.name:string",
+                            "signal": "traces",
+                        },
+                        {
+                            "name": "span.duration_nano",
+                            "signal": "traces",
+                        },
+                        {
+                            "name": "span.http_method",
+                            "signal": "traces",
+                        },
+                        {
+                            "name": "span.response_status_code",
+                            "signal": "traces",
+                        },
+                    ],
+                    "having": {"expression": ""},
+                    "aggregations": [{"expression": "count()"}],
+                },
+            }
+        ],
+    )
+    assert_identical_query_response(response, response_with_inline_context)
+
+    assert response.status_code == HTTPStatus.OK
+    assert response.json()["status"] == "success"
+
+    results = response.json()["data"]["data"]["results"]
+    assert len(results) == 1
+
+    rows = results[0]["rows"]
+    assert len(rows) == 4
+
+    # Care about the order of the rows
+    row_0 = dict(rows[0]["data"])
+    assert row_0.pop("timestamp") is not None
+    assert row_0 == {
+        "duration_nano": 4 * 1e9,
+        "http_method": "",
+        "name": "topic publish",
+        "response_status_code": "",
+        "service.name": "topic-service",
+        "span_id": topic_service_span_id,
+        "trace_id": topic_service_trace_id,
+    }
+
+    row_2 = dict(rows[1]["data"])
+    assert row_2.pop("timestamp") is not None
+    assert row_2 == {
+        "duration_nano": 1 * 1e9,
+        "http_method": "PATCH",
+        "name": "HTTP PATCH",
+        "response_status_code": "404",
+        "service.name": "http-service",
+        "span_id": http_service_patch_span_id,
+        "trace_id": http_service_trace_id,
+    }
+
+    row_3 = dict(rows[2]["data"])
+    assert row_3.pop("timestamp") is not None
+    assert row_3 == {
+        "duration_nano": 0.5 * 1e9,
+        "http_method": "",
+        "name": "SELECT",
+        "response_status_code": "",
+        "service.name": "http-service",
+        "span_id": http_service_db_span_id,
+        "trace_id": http_service_trace_id,
+    }
+
+    row_1 = dict(rows[3]["data"])
+    assert row_1.pop("timestamp") is not None
+    assert row_1 == {
+        "duration_nano": 3 * 1e9,
+        "http_method": "POST",
+        "name": "POST /integration",
+        "response_status_code": "200",
+        "service.name": "http-service",
+        "span_id": http_service_span_id,
+        "trace_id": http_service_trace_id,
+    }
+
+    # Query root spans for the last 5 minutes and check if the spans are returned in the correct order
+    response = requests.post(
+        signoz.self.host_configs["8080"].get("/api/v5/query_range"),
+        timeout=2,
+        headers={
+            "authorization": f"Bearer {token}",
+        },
+        json={
+            "schemaVersion": "v1",
+            "start": int((datetime.now(tz=UTC) - timedelta(minutes=5)).timestamp() * 1000),
+            "end": int(datetime.now(tz=UTC).timestamp() * 1000),
+            "requestType": "raw",
+            "compositeQuery": {
+                "queries": [
+                    {
+                        "type": "builder_query",
+                        "spec": {
+                            "name": "A",
+                            "signal": "traces",
+                            "disabled": False,
+                            "limit": 10,
+                            "offset": 0,
+                            "filter": {"expression": "isRoot = 'true'"},
+                            "order": [
+                                {"key": {"name": "timestamp"}, "direction": "desc"},
+                            ],
+                            "selectFields": [
+                                {
+                                    "name": "service.name",
+                                    "fieldDataType": "string",
+                                    "fieldContext": "resource",
+                                }
+                            ],
+                            "having": {"expression": ""},
+                            "aggregations": [{"expression": "count()"}],
+                        },
+                    }
+                ]
+            },
+            "formatOptions": {"formatTableResultForUI": False, "fillGaps": False},
+        },
+    )
+
+    assert response.status_code == HTTPStatus.OK
+    assert response.json()["status"] == "success"
+
+    results = response.json()["data"]["data"]["results"]
+    assert len(results) == 1
+
+    rows = results[0]["rows"]
+    assert len(rows) == 2
+
+    assert rows[0]["data"]["service.name"] == "topic-service"
+    assert rows[1]["data"]["service.name"] == "http-service"
+
+    # Query values of http.request.method attribute from the autocomplete API
+    response = requests.get(
+        signoz.self.host_configs["8080"].get("/api/v3/autocomplete/attribute_values"),
+        timeout=2,
+        headers={
+            "authorization": f"Bearer {token}",
+        },
+        params={
+            "aggregateOperator": "noop",
+            "dataSource": "traces",
+            "aggregateAttribute": "",
+            "attributeKey": "http.request.method",
+            "searchText": "",
+            "filterAttributeKeyDataType": "string",
+            "tagType": "tag",
+        },
+    )
+
+    assert response.status_code == HTTPStatus.OK
+    assert response.json()["status"] == "success"
+
+    values = response.json()["data"]["stringAttributeValues"]
+    assert len(values) == 2
+
+    assert set(values) == set(["POST", "PATCH"])
+
+    # Query values of http.request.method attribute from the fields API
+    response = requests.get(
+        signoz.self.host_configs["8080"].get("/api/v1/fields/values"),
+        timeout=2,
+        headers={
+            "authorization": f"Bearer {token}",
+        },
+        params={
+            "signal": "traces",
+            "name": "http.request.method",
+            "searchText": "",
+        },
+    )
+
+    assert response.status_code == HTTPStatus.OK
+    assert response.json()["status"] == "success"
+
+    values = response.json()["data"]["values"]["stringValues"]
+    assert len(values) == 2
+
+    assert set(values) == set(["POST", "PATCH"])
+
+    # Query keys from the fields API with context specified in the key
+    response = requests.get(
+        signoz.self.host_configs["8080"].get("/api/v1/fields/keys"),
+        timeout=2,
+        headers={
+            "authorization": f"Bearer {token}",
+        },
+        params={
+            "signal": "traces",
+            "searchText": "resource.servic",
+        },
+    )
+
+    assert response.status_code == HTTPStatus.OK
+    assert response.json()["status"] == "success"
+
+    keys = response.json()["data"]["keys"]
+    assert "service.name" in keys
+    assert any(k["fieldContext"] == "resource" for k in keys["service.name"])
+
+    # Query values of service.name resource attribute using context-prefixed key
+    response = requests.get(
+        signoz.self.host_configs["8080"].get("/api/v1/fields/values"),
+        timeout=2,
+        headers={
+            "authorization": f"Bearer {token}",
+        },
+        params={
+            "signal": "traces",
+            "name": "resource.service.name",
+            "searchText": "",
+        },
+    )
+
+    assert response.status_code == HTTPStatus.OK
+    assert response.json()["status"] == "success"
+
+    values = response.json()["data"]["values"]["stringValues"]
+    assert set(values) == set(["topic-service", "http-service"])
+
+
+@pytest.mark.parametrize(
+    "payload,status_code,results",
+    [
+        # Case 1: order by timestamp; empty selectFields returns the full
+        # response shape (all intrinsic + calculated columns plus the merged
+        # `attributes` and `resource` maps). x[3] (topic-service) is latest.
+        pytest.param(
+            {
+                "type": "builder_query",
+                "spec": {
+                    "name": "A",
+                    "signal": "traces",
+                    "disabled": False,
+                    "order": [{"key": {"name": "timestamp"}, "direction": "desc"}],
+                    "limit": 1,
+                },
+            },
+            HTTPStatus.OK,
+            lambda x: [
+                {
+                    **x[3].attribute_string,
+                    **x[3].attributes_number,
+                    **x[3].attributes_bool,
+                },  # attributes
+                x[3].db_name,
+                x[3].db_operation,
+                int(x[3].duration_nano),
+                x[3].events,
+                x[3].external_http_method,
+                x[3].external_http_url,
+                int(x[3].flags),
+                x[3].has_error,
+                x[3].http_host,
+                x[3].http_method,
+                x[3].http_url,
+                x[3].is_remote,
+                int(x[3].kind),
+                x[3].kind_string,
+                x[3].links,
+                x[3].name,
+                x[3].parent_span_id,
+                x[3].resources_string,
+                x[3].response_status_code,
+                x[3].span_id,
+                int(x[3].status_code),
+                x[3].status_code_string,
+                x[3].status_message,
+                format_timestamp(x[3].timestamp),
+                x[3].trace_id,
+                x[3].trace_state,
+            ],  # type: Callable[[List[Traces]], List[Any]]
+        ),
+        # Case 2: order by attribute.timestamp. The key resolves to the
+        # intrinsic span.timestamp column, so the latest span (x[3]) is
+        # returned with the same full response shape as Case 1.
+        pytest.param(
+            {
+                "type": "builder_query",
+                "spec": {
+                    "name": "A",
+                    "signal": "traces",
+                    "disabled": False,
+                    "order": [{"key": {"name": "attribute.timestamp"}, "direction": "desc"}],
+                    "limit": 1,
+                },
+            },
+            HTTPStatus.OK,
+            lambda x: [
+                {
+                    **x[3].attribute_string,
+                    **x[3].attributes_number,
+                    **x[3].attributes_bool,
+                },  # attributes
+                x[3].db_name,
+                x[3].db_operation,
+                int(x[3].duration_nano),
+                x[3].events,
+                x[3].external_http_method,
+                x[3].external_http_url,
+                int(x[3].flags),
+                x[3].has_error,
+                x[3].http_host,
+                x[3].http_method,
+                x[3].http_url,
+                x[3].is_remote,
+                int(x[3].kind),
+                x[3].kind_string,
+                x[3].links,
+                x[3].name,
+                x[3].parent_span_id,
+                x[3].resources_string,
+                x[3].response_status_code,
+                x[3].span_id,
+                int(x[3].status_code),
+                x[3].status_code_string,
+                x[3].status_message,
+                format_timestamp(x[3].timestamp),
+                x[3].trace_id,
+                x[3].trace_state,
+            ],  # type: Callable[[List[Traces]], List[Any]]
+        ),
+        # Case 3: select timestamp with empty order by
+        pytest.param(
+            {
+                "type": "builder_query",
+                "spec": {
+                    "name": "A",
+                    "signal": "traces",
+                    "disabled": False,
+                    "selectFields": [{"name": "timestamp"}],
+                    "limit": 1,
+                },
+            },
+            HTTPStatus.OK,
+            lambda x: [
+                x[2].span_id,
+                format_timestamp(x[2].timestamp),
+                x[2].trace_id,
+            ],  # type: Callable[[List[Traces]], List[Any]]
+        ),
+        # Case 4: select attribute.timestamp with empty order by
+        # This returns the one span which has attribute.timestamp
+        pytest.param(
+            {
+                "type": "builder_query",
+                "spec": {
+                    "name": "A",
+                    "signal": "traces",
+                    "filter": {"expression": "attribute.timestamp exists"},
+                    "disabled": False,
+                    "selectFields": [{"name": "attribute.timestamp"}],
+                    "limit": 1,
+                },
+            },
+            HTTPStatus.OK,
+            lambda x: [
+                x[0].span_id,
+                format_timestamp(x[0].timestamp),
+                x[0].trace_id,
+            ],  # type: Callable[[List[Traces]], List[Any]]
+        ),
+        # Case 5: select timestamp with timestamp order by
+        pytest.param(
+            {
+                "type": "builder_query",
+                "spec": {
+                    "name": "A",
+                    "signal": "traces",
+                    "disabled": False,
+                    "selectFields": [{"name": "timestamp"}],
+                    "limit": 1,
+                    "order": [{"key": {"name": "timestamp"}, "direction": "asc"}],
+                },
+            },
+            HTTPStatus.OK,
+            lambda x: [
+                x[0].span_id,
+                format_timestamp(x[0].timestamp),
+                x[0].trace_id,
+            ],  # type: Callable[[List[Traces]], List[Any]]
+        ),
+        # Case 6: select duration_nano with duration order by
+        pytest.param(
+            {
+                "type": "builder_query",
+                "spec": {
+                    "name": "A",
+                    "signal": "traces",
+                    "disabled": False,
+                    "selectFields": [{"name": "duration_nano"}],
+                    "limit": 1,
+                    "order": [{"key": {"name": "duration_nano"}, "direction": "desc"}],
+                },
+            },
+            HTTPStatus.OK,
+            lambda x: [
+                x[1].duration_nano,
+                x[1].span_id,
+                format_timestamp(x[1].timestamp),
+                x[1].trace_id,
+            ],  # type: Callable[[List[Traces]], List[Any]]
+        ),
+        # Case 7: select attribute.duration_nano with attribute.duration_nano order by
+        pytest.param(
+            {
+                "type": "builder_query",
+                "spec": {
+                    "name": "A",
+                    "signal": "traces",
+                    "disabled": False,
+                    "selectFields": [{"name": "attribute.duration_nano"}],
+                    "filter": {"expression": "attribute.duration_nano exists"},
+                    "limit": 1,
+                    "order": [
+                        {
+                            "key": {"name": "attribute.duration_nano"},
+                            "direction": "desc",
+                        }
+                    ],
+                },
+            },
+            HTTPStatus.OK,
+            lambda x: [
+                "corrupt_data",
+                x[3].span_id,
+                format_timestamp(x[3].timestamp),
+                x[3].trace_id,
+            ],  # type: Callable[[List[Traces]], List[Any]]
+        ),
+        # Case 8: select attribute.duration_nano with duration order by
+        pytest.param(
+            {
+                "type": "builder_query",
+                "spec": {
+                    "name": "A",
+                    "signal": "traces",
+                    "disabled": False,
+                    "selectFields": [{"name": "attribute.duration_nano"}],
+                    "limit": 1,
+                    "order": [{"key": {"name": "duration_nano"}, "direction": "desc"}],
+                },
+            },
+            HTTPStatus.OK,
+            lambda x: [
+                x[1].duration_nano,
+                x[1].span_id,
+                format_timestamp(x[1].timestamp),
+                x[1].trace_id,
+            ],  # type: Callable[[List[Traces]], List[Any]]
+        ),
+    ],
+)
+def test_traces_list_with_corrupt_data(
+    signoz: types.SigNoz,
+    create_user_admin: None,  # pylint: disable=unused-argument
+    get_token: Callable[[str, str], str],
+    insert_traces: Callable[[list[Traces]], None],
+    payload: dict[str, Any],
+    status_code: HTTPStatus,
+    results: Callable[[list[Traces]], list[Any]],
+) -> None:
+    """
+    Setup:
+    Insert 4 traces with corrupt attributes.
+    Tests:
+    """
+
+    traces = generate_traces_with_corrupt_metadata()
+    insert_traces(traces)
+    # 4 Traces with corrupt metadata inserted
+    # traces[i] occured before traces[j] where i < j
+
+    token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
+
+    response = make_query_request(
+        signoz,
+        token,
+        start_ms=int((datetime.now(tz=UTC) - timedelta(minutes=5)).timestamp() * 1000),
+        end_ms=int(datetime.now(tz=UTC).timestamp() * 1000),
+        request_type="raw",
+        queries=[payload],
+    )
+
+    assert response.status_code == status_code
+
+    if response.status_code == HTTPStatus.OK:
+        if not results(traces):
+            # No results expected
+            assert response.json()["data"]["data"]["results"][0]["rows"] is None
+        else:
+            data = response.json()["data"]["data"]["results"][0]["rows"][0]["data"]
+            # Cannot compare values as they are randomly generated
+            for key, value in zip(list(data.keys()), results(traces)):
+                assert data[key] == value
+
+
+def _verify_events_links_full(rows: list[dict], traces: list[Traces]) -> None:
+    """Empty-selectFields case: events/links arrive parsed into structured objects.
+    Every row's events/links should match the fixture's stored parsed shape
+    (the fixture's `.events`/`.links` mirror the API response shape directly).
+    """
+    for row, trace in zip(rows, traces, strict=True):
+        assert row["data"]["events"] == trace.events
+        assert row["data"]["links"] == trace.links
+        # Jaeger-era `refType` is dropped at the consume layer.
+        for link in row["data"]["links"]:
+            assert "refType" not in link
+
+
+def _verify_events_links_skip(rows: list[dict], traces: list[Traces]) -> None:
+    """Projected-selectFields case: nothing to verify beyond the key set."""
+
+
+@pytest.mark.parametrize(
+    "select_fields,status_code,expected_keys,verify_values",
+    [
+        pytest.param(
+            [],
+            HTTPStatus.OK,
+            ALL_SELECT_FIELDS,
+            _verify_events_links_full,
+        ),
+        pytest.param(
+            [
+                {"name": "service.name"},
+            ],
+            HTTPStatus.OK,
+            ["timestamp", "trace_id", "span_id", "service.name"],
+            _verify_events_links_skip,
+        ),
+    ],
+)
+def test_traces_list_with_select_fields(
+    signoz: types.SigNoz,
+    create_user_admin: None,  # pylint: disable=unused-argument
+    get_token: Callable[[str, str], str],
+    insert_traces: Callable[[list[Traces]], None],
+    select_fields: list[dict],
+    status_code: HTTPStatus,
+    expected_keys: list[str],
+    verify_values: Callable[[list[dict], list[Traces]], None],
+) -> None:
+    """
+    Setup:
+    Insert a root span with no events/links and a child span carrying two
+    events and one user-supplied link.
+
+    Tests:
+    1. Empty select fields should return all the fields, and the `events` /
+       `links` columns should arrive parsed into structured objects (events
+       carry `attributes`, links carry only `traceId`/`spanId` — refType is
+       dropped at the consume layer).
+    2. Non-empty select field should return the select field along with
+       timestamp, trace_id and span_id.
+    """
+    now = datetime.now(tz=UTC).replace(second=0, microsecond=0)
+
+    parent_trace_id = TraceIdGenerator.trace_id()
+    parent_span_id = TraceIdGenerator.span_id()
+    child_span_id = TraceIdGenerator.span_id()
+    linked_trace_id = TraceIdGenerator.trace_id()
+    linked_span_id = TraceIdGenerator.span_id()
+
+    event_one = TracesEvent(
+        name="request_received",
+        timestamp=now - timedelta(seconds=3, microseconds=500_000),
+        attribute_map={"http.method": "GET", "http.route": "/api/chat"},
+    )
+    event_two = TracesEvent(
+        name="cache_lookup",
+        timestamp=now - timedelta(seconds=3, microseconds=400_000),
+        attribute_map={"cache.hit": "true", "cache.key": "user:123:prompt"},
+    )
+    user_link = TracesLink(
+        trace_id=linked_trace_id,
+        span_id=linked_span_id,
+        ref_type=TracesRefType.REF_TYPE_FOLLOWS_FROM,
+    )
+
+    traces = [
+        # Root span: no events, no links. Verifies the empty-case parsed shape.
+        Traces(
+            timestamp=now - timedelta(seconds=4),
+            duration=timedelta(seconds=3),
+            trace_id=parent_trace_id,
+            span_id=parent_span_id,
+            parent_span_id="",
+            name="root span",
+            kind=TracesKind.SPAN_KIND_SERVER,
+            status_code=TracesStatusCode.STATUS_CODE_OK,
+            resources={"service.name": "events-links-service"},
+            attributes={"http.request.method": "GET"},
+        ),
+        # Child span: two events + one user-supplied link. The fixture
+        # auto-inserts a CHILD_OF link for the parent, so the parsed response
+        # contains two links total — the auto-inserted one first.
+        Traces(
+            timestamp=now - timedelta(seconds=3),
+            duration=timedelta(seconds=1),
+            trace_id=parent_trace_id,
+            span_id=child_span_id,
+            parent_span_id=parent_span_id,
+            name="child span",
+            kind=TracesKind.SPAN_KIND_INTERNAL,
+            status_code=TracesStatusCode.STATUS_CODE_OK,
+            resources={"service.name": "events-links-service"},
+            attributes={"http.request.method": "GET"},
+            events=[event_one, event_two],
+            links=[user_link],
+        ),
+    ]
+
+    insert_traces(traces)
+
+    token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
+
+    payload = {
+        "type": "builder_query",
+        "spec": {
+            "name": "A",
+            "signal": "traces",
+            "filter": {"expression": "resource.service.name = 'events-links-service'"},
+            "selectFields": select_fields,
+            "order": [{"key": {"name": "timestamp"}, "direction": "asc"}],
+            "limit": 10,
+        },
+    }
+
+    response = make_query_request(
+        signoz,
+        token,
+        start_ms=int((datetime.now(tz=UTC) - timedelta(minutes=5)).timestamp() * 1000),
+        end_ms=int(datetime.now(tz=UTC).timestamp() * 1000),
+        request_type="raw",
+        queries=[payload],
+    )
+    assert response.status_code == status_code
+
+    if response.status_code != HTTPStatus.OK:
+        return
+
+    rows = response.json()["data"]["data"]["results"][0]["rows"]
+    assert len(rows) == 2
+    for row in rows:
+        assert set(row["data"].keys()) == set(expected_keys)
+
+    verify_values(rows, traces)

tests/integration/tests/queriertraces/02_aggregation.py

@@ -0,0 +1,408 @@
+from collections.abc import Callable
+from datetime import UTC, datetime, timedelta
+from http import HTTPStatus
+
+import pytest
+
+from fixtures import types
+from fixtures.auth import USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD
+from fixtures.querier import (
+    make_query_request,
+)
+from fixtures.traces import (
+    TraceIdGenerator,
+    Traces,
+    TracesKind,
+    TracesStatusCode,
+)
+
+
+@pytest.mark.parametrize(
+    "order_by,aggregation_alias,expected_status",
+    [
+        # Case 1a: count by count()
+        pytest.param({"name": "count()"}, "count_", HTTPStatus.OK),
+        # Case 1b: count by count() with alias span.count_
+        pytest.param({"name": "count()"}, "span.count_", HTTPStatus.OK),
+        # Case 2a: count by count() with context specified in the key
+        pytest.param({"name": "count()", "fieldContext": "span"}, "count_", HTTPStatus.OK),
+        # Case 2b: count by count() with context specified in the key with alias span.count_
+        pytest.param({"name": "count()", "fieldContext": "span"}, "span.count_", HTTPStatus.OK),
+        # Case 3a: count by span.count() and context specified in the key [BAD REQUEST]
+        pytest.param(
+            {"name": "span.count()", "fieldContext": "span"},
+            "count_",
+            HTTPStatus.BAD_REQUEST,
+        ),
+        # Case 3b: count by span.count() and context specified in the key with alias span.count_ [BAD REQUEST]
+        pytest.param(
+            {"name": "span.count()", "fieldContext": "span"},
+            "span.count_",
+            HTTPStatus.BAD_REQUEST,
+        ),
+        # Case 4a: count by span.count() and context specified in the key
+        pytest.param({"name": "span.count()", "fieldContext": ""}, "count_", HTTPStatus.OK),
+        # Case 4b: count by span.count() and context specified in the key with alias span.count_
+        pytest.param({"name": "span.count()", "fieldContext": ""}, "span.count_", HTTPStatus.OK),
+        # Case 5a: count by count_
+        pytest.param({"name": "count_"}, "count_", HTTPStatus.OK),
+        # Case 5b: count by count_ with alias span.count_
+        pytest.param({"name": "count_"}, "count_", HTTPStatus.OK),
+        # Case 6a: count by span.count_
+        pytest.param({"name": "span.count_"}, "count_", HTTPStatus.OK),
+        # Case 6b: count by span.count_ with alias span.count_
+        pytest.param({"name": "span.count_"}, "span.count_", HTTPStatus.OK),
+        # Case 7a: count by span.count_ and context specified in the key [BAD REQUEST]
+        pytest.param(
+            {"name": "span.count_", "fieldContext": "span"},
+            "count_",
+            HTTPStatus.BAD_REQUEST,
+        ),
+        # Case 7b: count by span.count_ and context specified in the key with alias span.count_
+        pytest.param(
+            {"name": "span.count_", "fieldContext": "span"},
+            "span.count_",
+            HTTPStatus.OK,
+        ),
+    ],
+)
+def test_traces_aggergate_order_by_count(
+    signoz: types.SigNoz,
+    create_user_admin: None,  # pylint: disable=unused-argument
+    get_token: Callable[[str, str], str],
+    insert_traces: Callable[[list[Traces]], None],
+    order_by: dict[str, str],
+    aggregation_alias: str,
+    expected_status: HTTPStatus,
+) -> None:
+    """
+    Setup:
+    Insert 4 traces with different attributes.
+    http-service: POST /integration -> SELECT, HTTP PATCH
+    topic-service: topic publish
+
+    Tests:
+    1. Query traces count for spans grouped by service.name and host.name
+    """
+    http_service_trace_id = TraceIdGenerator.trace_id()
+    http_service_span_id = TraceIdGenerator.span_id()
+    http_service_db_span_id = TraceIdGenerator.span_id()
+    http_service_patch_span_id = TraceIdGenerator.span_id()
+    topic_service_trace_id = TraceIdGenerator.trace_id()
+    topic_service_span_id = TraceIdGenerator.span_id()
+
+    now = datetime.now(tz=UTC).replace(second=0, microsecond=0)
+
+    insert_traces(
+        [
+            Traces(
+                timestamp=now - timedelta(seconds=4),
+                duration=timedelta(seconds=3),
+                trace_id=http_service_trace_id,
+                span_id=http_service_span_id,
+                parent_span_id="",
+                name="POST /integration",
+                kind=TracesKind.SPAN_KIND_SERVER,
+                status_code=TracesStatusCode.STATUS_CODE_OK,
+                status_message="",
+                resources={
+                    "deployment.environment": "production",
+                    "service.name": "http-service",
+                    "os.type": "linux",
+                    "host.name": "linux-000",
+                    "cloud.provider": "integration",
+                    "cloud.account.id": "000",
+                },
+                attributes={
+                    "net.transport": "IP.TCP",
+                    "http.scheme": "http",
+                    "http.user_agent": "Integration Test",
+                    "http.request.method": "POST",
+                    "http.response.status_code": "200",
+                },
+            ),
+            Traces(
+                timestamp=now - timedelta(seconds=3.5),
+                duration=timedelta(seconds=0.5),
+                trace_id=http_service_trace_id,
+                span_id=http_service_db_span_id,
+                parent_span_id=http_service_span_id,
+                name="SELECT",
+                kind=TracesKind.SPAN_KIND_CLIENT,
+                status_code=TracesStatusCode.STATUS_CODE_OK,
+                status_message="",
+                resources={
+                    "deployment.environment": "production",
+                    "service.name": "http-service",
+                    "os.type": "linux",
+                    "host.name": "linux-000",
+                    "cloud.provider": "integration",
+                    "cloud.account.id": "000",
+                },
+                attributes={
+                    "db.name": "integration",
+                    "db.operation": "SELECT",
+                    "db.statement": "SELECT * FROM integration",
+                },
+            ),
+            Traces(
+                timestamp=now - timedelta(seconds=3),
+                duration=timedelta(seconds=1),
+                trace_id=http_service_trace_id,
+                span_id=http_service_patch_span_id,
+                parent_span_id=http_service_span_id,
+                name="HTTP PATCH",
+                kind=TracesKind.SPAN_KIND_CLIENT,
+                status_code=TracesStatusCode.STATUS_CODE_OK,
+                status_message="",
+                resources={
+                    "deployment.environment": "production",
+                    "service.name": "http-service",
+                    "os.type": "linux",
+                    "host.name": "linux-000",
+                    "cloud.provider": "integration",
+                    "cloud.account.id": "000",
+                },
+                attributes={
+                    "http.request.method": "PATCH",
+                    "http.status_code": "404",
+                },
+            ),
+            Traces(
+                timestamp=now - timedelta(seconds=1),
+                duration=timedelta(seconds=4),
+                trace_id=topic_service_trace_id,
+                span_id=topic_service_span_id,
+                parent_span_id="",
+                name="topic publish",
+                kind=TracesKind.SPAN_KIND_PRODUCER,
+                status_code=TracesStatusCode.STATUS_CODE_OK,
+                status_message="",
+                resources={
+                    "deployment.environment": "production",
+                    "service.name": "topic-service",
+                    "os.type": "linux",
+                    "host.name": "linux-001",
+                    "cloud.provider": "integration",
+                    "cloud.account.id": "001",
+                },
+                attributes={
+                    "message.type": "SENT",
+                    "messaging.operation": "publish",
+                    "messaging.message.id": "001",
+                },
+            ),
+        ]
+    )
+
+    token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
+
+    query = {
+        "type": "builder_query",
+        "spec": {
+            "name": "A",
+            "signal": "traces",
+            "disabled": False,
+            "order": [{"key": {"name": "count()"}, "direction": "desc"}],
+            "aggregations": [{"expression": "count()", "alias": "count_"}],
+        },
+    }
+
+    # Query traces count for spans
+
+    query["spec"]["order"][0]["key"] = order_by
+    query["spec"]["aggregations"][0]["alias"] = aggregation_alias
+    response = make_query_request(
+        signoz,
+        token,
+        start_ms=int((datetime.now(tz=UTC) - timedelta(minutes=5)).timestamp() * 1000),
+        end_ms=int(datetime.now(tz=UTC).timestamp() * 1000),
+        request_type="time_series",
+        queries=[query],
+    )
+
+    assert response.status_code == expected_status
+    if expected_status != HTTPStatus.OK:
+        return
+    assert response.json()["status"] == "success"
+
+    results = response.json()["data"]["data"]["results"]
+    assert len(results) == 1
+    aggregations = results[0]["aggregations"]
+    assert len(aggregations) == 1
+    series = aggregations[0]["series"]
+    assert len(series) == 1
+    assert series[0]["values"][0]["value"] == 4
+
+
+def test_traces_aggregate_with_mixed_field_selectors(
+    signoz: types.SigNoz,
+    create_user_admin: None,  # pylint: disable=unused-argument
+    get_token: Callable[[str, str], str],
+    insert_traces: Callable[[list[Traces]], None],
+) -> None:
+    """
+    Setup:
+    Insert 4 traces with different attributes.
+    http-service: POST /integration -> SELECT, HTTP PATCH
+    topic-service: topic publish
+
+    Tests:
+    1. Query traces count for spans grouped by service.name
+    """
+    http_service_trace_id = TraceIdGenerator.trace_id()
+    http_service_span_id = TraceIdGenerator.span_id()
+    http_service_db_span_id = TraceIdGenerator.span_id()
+    http_service_patch_span_id = TraceIdGenerator.span_id()
+    topic_service_trace_id = TraceIdGenerator.trace_id()
+    topic_service_span_id = TraceIdGenerator.span_id()
+
+    now = datetime.now(tz=UTC).replace(second=0, microsecond=0)
+
+    insert_traces(
+        [
+            Traces(
+                timestamp=now - timedelta(seconds=4),
+                duration=timedelta(seconds=3),
+                trace_id=http_service_trace_id,
+                span_id=http_service_span_id,
+                parent_span_id="",
+                name="POST /integration",
+                kind=TracesKind.SPAN_KIND_SERVER,
+                status_code=TracesStatusCode.STATUS_CODE_OK,
+                status_message="",
+                resources={
+                    "deployment.environment": "production",
+                    "service.name": "http-service",
+                    "os.type": "linux",
+                    "host.name": "linux-000",
+                    "cloud.provider": "integration",
+                    "cloud.account.id": "000",
+                },
+                attributes={
+                    "net.transport": "IP.TCP",
+                    "http.scheme": "http",
+                    "http.user_agent": "Integration Test",
+                    "http.request.method": "POST",
+                    "http.response.status_code": "200",
+                },
+            ),
+            Traces(
+                timestamp=now - timedelta(seconds=3.5),
+                duration=timedelta(seconds=0.5),
+                trace_id=http_service_trace_id,
+                span_id=http_service_db_span_id,
+                parent_span_id=http_service_span_id,
+                name="SELECT",
+                kind=TracesKind.SPAN_KIND_CLIENT,
+                status_code=TracesStatusCode.STATUS_CODE_OK,
+                status_message="",
+                resources={
+                    "deployment.environment": "production",
+                    "service.name": "http-service",
+                    "os.type": "linux",
+                    "host.name": "linux-000",
+                    "cloud.provider": "integration",
+                    "cloud.account.id": "000",
+                },
+                attributes={
+                    "db.name": "integration",
+                    "db.operation": "SELECT",
+                    "db.statement": "SELECT * FROM integration",
+                },
+            ),
+            Traces(
+                timestamp=now - timedelta(seconds=3),
+                duration=timedelta(seconds=1),
+                trace_id=http_service_trace_id,
+                span_id=http_service_patch_span_id,
+                parent_span_id=http_service_span_id,
+                name="HTTP PATCH",
+                kind=TracesKind.SPAN_KIND_CLIENT,
+                status_code=TracesStatusCode.STATUS_CODE_OK,
+                status_message="",
+                resources={
+                    "deployment.environment": "production",
+                    "service.name": "http-service",
+                    "os.type": "linux",
+                    "host.name": "linux-000",
+                    "cloud.provider": "integration",
+                    "cloud.account.id": "000",
+                },
+                attributes={
+                    "http.request.method": "PATCH",
+                    "http.status_code": "404",
+                },
+            ),
+            Traces(
+                timestamp=now - timedelta(seconds=1),
+                duration=timedelta(seconds=4),
+                trace_id=topic_service_trace_id,
+                span_id=topic_service_span_id,
+                parent_span_id="",
+                name="topic publish",
+                kind=TracesKind.SPAN_KIND_PRODUCER,
+                status_code=TracesStatusCode.STATUS_CODE_OK,
+                status_message="",
+                resources={
+                    "deployment.environment": "production",
+                    "service.name": "topic-service",
+                    "os.type": "linux",
+                    "host.name": "linux-001",
+                    "cloud.provider": "integration",
+                    "cloud.account.id": "001",
+                },
+                attributes={
+                    "message.type": "SENT",
+                    "messaging.operation": "publish",
+                    "messaging.message.id": "001",
+                },
+            ),
+        ]
+    )
+
+    token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
+
+    query = {
+        "type": "builder_query",
+        "spec": {
+            "name": "A",
+            "signal": "traces",
+            "groupBy": [
+                {
+                    "name": "service.name",
+                    "fieldContext": "resource",
+                    "fieldDataType": "string",
+                }
+            ],
+            "aggregations": [
+                {"expression": "p99(duration_nano)", "alias": "p99"},
+                {"expression": "avg(duration_nano)", "alias": "avgDuration"},
+                {"expression": "count()", "alias": "numCalls"},
+                {"expression": "countIf(status_code = 2)", "alias": "numErrors"},
+                {
+                    "expression": "countIf(response_status_code >= 400 AND response_status_code < 500)",
+                    "alias": "num4XX",
+                },
+            ],
+            "order": [{"key": {"name": "count()"}, "direction": "desc"}],
+        },
+    }
+
+    # Query traces count for spans
+    response = make_query_request(
+        signoz,
+        token,
+        start_ms=int((datetime.now(tz=UTC) - timedelta(minutes=5)).timestamp() * 1000),
+        end_ms=int(datetime.now(tz=UTC).timestamp() * 1000),
+        request_type="time_series",
+        queries=[query],
+    )
+
+    assert response.status_code == HTTPStatus.OK
+    assert response.json()["status"] == "success"
+    results = response.json()["data"]["data"]["results"]
+    assert len(results) == 1
+    aggregations = results[0]["aggregations"]
+
+    assert aggregations[0]["series"][0]["values"][0]["value"] >= 2.5 * 1e9  # p99 for http-service

tests/integration/tests/queriertraces/03_fill.py

@@ -0,0 +1,935 @@
+from collections.abc import Callable
+from datetime import UTC, datetime, timedelta
+from http import HTTPStatus
+
+import requests
+
+from fixtures import types
+from fixtures.auth import USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD
+from fixtures.querier import (
+    assert_minutely_bucket_values,
+    find_named_result,
+    index_series_by_label,
+)
+from fixtures.traces import (
+    TraceIdGenerator,
+    Traces,
+    TracesKind,
+    TracesStatusCode,
+)
+
+
+def test_traces_fill_gaps(
+    signoz: types.SigNoz,
+    create_user_admin: None,  # pylint: disable=unused-argument
+    get_token: Callable[[str, str], str],
+    insert_traces: Callable[[list[Traces]], None],
+) -> None:
+    """
+    Test fillGaps for traces without groupBy.
+    """
+    now = datetime.now(tz=UTC).replace(second=0, microsecond=0)
+    trace_id = TraceIdGenerator.trace_id()
+
+    traces: list[Traces] = [
+        Traces(
+            timestamp=now - timedelta(minutes=3),
+            duration=timedelta(seconds=1),
+            trace_id=trace_id,
+            span_id=TraceIdGenerator.span_id(),
+            parent_span_id="",
+            name="test-span",
+            kind=TracesKind.SPAN_KIND_SERVER,
+            status_code=TracesStatusCode.STATUS_CODE_OK,
+            status_message="",
+            resources={"service.name": "test-service"},
+            attributes={"http.method": "GET"},
+        ),
+    ]
+    insert_traces(traces)
+
+    token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
+
+    start_ms = int((now - timedelta(minutes=5)).timestamp() * 1000)
+    end_ms = int(now.timestamp() * 1000)
+
+    response = requests.post(
+        signoz.self.host_configs["8080"].get("/api/v5/query_range"),
+        timeout=5,
+        headers={"authorization": f"Bearer {token}"},
+        json={
+            "schemaVersion": "v1",
+            "start": start_ms,
+            "end": end_ms,
+            "requestType": "time_series",
+            "compositeQuery": {
+                "queries": [
+                    {
+                        "type": "builder_query",
+                        "spec": {
+                            "name": "A",
+                            "signal": "traces",
+                            "stepInterval": 60,
+                            "disabled": False,
+                            "having": {"expression": ""},
+                            "aggregations": [{"expression": "count()"}],
+                        },
+                    }
+                ]
+            },
+            "formatOptions": {"formatTableResultForUI": False, "fillGaps": True},
+        },
+    )
+
+    assert response.status_code == HTTPStatus.OK
+    assert response.json()["status"] == "success"
+
+    results = response.json()["data"]["data"]["results"]
+    assert len(results) == 1
+
+    aggregations = results[0]["aggregations"]
+    assert len(aggregations) == 1
+
+    series = aggregations[0]["series"]
+    assert len(series) >= 1
+
+    values = series[0]["values"]
+    ts_min_3 = int((now - timedelta(minutes=3)).timestamp() * 1000)
+    assert_minutely_bucket_values(
+        values,
+        now,
+        expected_by_ts={ts_min_3: 1},
+        context="traces/fillGaps",
+    )
+
+
+def test_traces_fill_gaps_with_group_by(
+    signoz: types.SigNoz,
+    create_user_admin: None,  # pylint: disable=unused-argument
+    get_token: Callable[[str, str], str],
+    insert_traces: Callable[[list[Traces]], None],
+) -> None:
+    """
+    Test fillGaps for traces with groupBy.
+    """
+    now = datetime.now(tz=UTC).replace(second=0, microsecond=0)
+
+    traces: list[Traces] = [
+        Traces(
+            timestamp=now - timedelta(minutes=3),
+            duration=timedelta(seconds=1),
+            trace_id=TraceIdGenerator.trace_id(),
+            span_id=TraceIdGenerator.span_id(),
+            parent_span_id="",
+            name="span-a",
+            kind=TracesKind.SPAN_KIND_SERVER,
+            status_code=TracesStatusCode.STATUS_CODE_OK,
+            status_message="",
+            resources={"service.name": "service-a"},
+            attributes={"http.method": "GET"},
+        ),
+        Traces(
+            timestamp=now - timedelta(minutes=2),
+            duration=timedelta(seconds=1),
+            trace_id=TraceIdGenerator.trace_id(),
+            span_id=TraceIdGenerator.span_id(),
+            parent_span_id="",
+            name="span-b",
+            kind=TracesKind.SPAN_KIND_SERVER,
+            status_code=TracesStatusCode.STATUS_CODE_OK,
+            status_message="",
+            resources={"service.name": "service-b"},
+            attributes={"http.method": "POST"},
+        ),
+    ]
+    insert_traces(traces)
+
+    token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
+
+    start_ms = int((now - timedelta(minutes=5)).timestamp() * 1000)
+    end_ms = int(now.timestamp() * 1000)
+
+    response = requests.post(
+        signoz.self.host_configs["8080"].get("/api/v5/query_range"),
+        timeout=5,
+        headers={"authorization": f"Bearer {token}"},
+        json={
+            "schemaVersion": "v1",
+            "start": start_ms,
+            "end": end_ms,
+            "requestType": "time_series",
+            "compositeQuery": {
+                "queries": [
+                    {
+                        "type": "builder_query",
+                        "spec": {
+                            "name": "A",
+                            "signal": "traces",
+                            "stepInterval": 60,
+                            "disabled": False,
+                            "groupBy": [
+                                {
+                                    "name": "service.name",
+                                    "fieldDataType": "string",
+                                    "fieldContext": "resource",
+                                }
+                            ],
+                            "having": {"expression": ""},
+                            "aggregations": [{"expression": "count()"}],
+                        },
+                    }
+                ]
+            },
+            "formatOptions": {"formatTableResultForUI": False, "fillGaps": True},
+        },
+    )
+
+    assert response.status_code == HTTPStatus.OK
+    assert response.json()["status"] == "success"
+
+    results = response.json()["data"]["data"]["results"]
+    assert len(results) == 1
+
+    aggregations = results[0]["aggregations"]
+    assert len(aggregations) == 1
+
+    series = aggregations[0]["series"]
+    assert len(series) == 2, "Expected 2 series for 2 service groups"
+
+    ts_min_2 = int((now - timedelta(minutes=2)).timestamp() * 1000)
+    ts_min_3 = int((now - timedelta(minutes=3)).timestamp() * 1000)
+
+    series_by_service = index_series_by_label(series, "service.name")
+    assert set(series_by_service.keys()) == {"service-a", "service-b"}
+
+    expectations: dict[str, dict[int, float]] = {
+        "service-a": {ts_min_3: 1},
+        "service-b": {ts_min_2: 1},
+    }
+
+    for service_name, s in series_by_service.items():
+        assert_minutely_bucket_values(
+            s["values"],
+            now,
+            expected_by_ts=expectations[service_name],
+            context=f"traces/fillGaps/{service_name}",
+        )
+
+
+def test_traces_fill_gaps_formula(
+    signoz: types.SigNoz,
+    create_user_admin: None,  # pylint: disable=unused-argument
+    get_token: Callable[[str, str], str],
+    insert_traces: Callable[[list[Traces]], None],
+) -> None:
+    """
+    Test fillGaps for traces with formula.
+    """
+    now = datetime.now(tz=UTC).replace(second=0, microsecond=0)
+
+    traces: list[Traces] = [
+        Traces(
+            timestamp=now - timedelta(minutes=3),
+            duration=timedelta(seconds=1),
+            trace_id=TraceIdGenerator.trace_id(),
+            span_id=TraceIdGenerator.span_id(),
+            parent_span_id="",
+            name="test-span",
+            kind=TracesKind.SPAN_KIND_SERVER,
+            status_code=TracesStatusCode.STATUS_CODE_OK,
+            status_message="",
+            resources={"service.name": "test"},
+            attributes={"http.method": "GET"},
+        ),
+        Traces(
+            timestamp=now - timedelta(minutes=2),
+            duration=timedelta(seconds=1),
+            trace_id=TraceIdGenerator.trace_id(),
+            span_id=TraceIdGenerator.span_id(),
+            parent_span_id="",
+            name="another-test-span",
+            kind=TracesKind.SPAN_KIND_SERVER,
+            status_code=TracesStatusCode.STATUS_CODE_OK,
+            status_message="",
+            resources={"service.name": "another-test"},
+            attributes={"http.method": "POST"},
+        ),
+    ]
+    insert_traces(traces)
+
+    token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
+
+    start_ms = int((now - timedelta(minutes=5)).timestamp() * 1000)
+    end_ms = int(now.timestamp() * 1000)
+
+    response = requests.post(
+        signoz.self.host_configs["8080"].get("/api/v5/query_range"),
+        timeout=5,
+        headers={"authorization": f"Bearer {token}"},
+        json={
+            "schemaVersion": "v1",
+            "start": start_ms,
+            "end": end_ms,
+            "requestType": "time_series",
+            "compositeQuery": {
+                "queries": [
+                    {
+                        "type": "builder_query",
+                        "spec": {
+                            "name": "A",
+                            "signal": "traces",
+                            "stepInterval": 60,
+                            "disabled": True,
+                            "filter": {"expression": "service.name = 'test'"},
+                            "having": {"expression": ""},
+                            "aggregations": [{"expression": "count()"}],
+                        },
+                    },
+                    {
+                        "type": "builder_query",
+                        "spec": {
+                            "name": "B",
+                            "signal": "traces",
+                            "stepInterval": 60,
+                            "disabled": True,
+                            "filter": {"expression": "service.name = 'another-test'"},
+                            "having": {"expression": ""},
+                            "aggregations": [{"expression": "count()"}],
+                        },
+                    },
+                    {
+                        "type": "builder_formula",
+                        "spec": {
+                            "name": "F1",
+                            "expression": "A + B",
+                            "disabled": False,
+                        },
+                    },
+                ]
+            },
+            "formatOptions": {"formatTableResultForUI": False, "fillGaps": True},
+        },
+    )
+
+    assert response.status_code == HTTPStatus.OK
+    assert response.json()["status"] == "success"
+
+    results = response.json()["data"]["data"]["results"]
+    assert len(results) == 1
+
+    ts_min_2 = int((now - timedelta(minutes=2)).timestamp() * 1000)
+    ts_min_3 = int((now - timedelta(minutes=3)).timestamp() * 1000)
+
+    f1 = find_named_result(results, "F1")
+    assert f1 is not None, "Expected formula result named F1"
+
+    aggregations = f1.get("aggregations") or []
+    assert len(aggregations) == 1
+    series = aggregations[0]["series"]
+    assert len(series) >= 1
+
+    assert_minutely_bucket_values(
+        series[0]["values"],
+        now,
+        expected_by_ts={ts_min_3: 1, ts_min_2: 1},
+        context="traces/fillGaps/F1",
+    )
+
+
+def test_traces_fill_gaps_formula_with_group_by(
+    signoz: types.SigNoz,
+    create_user_admin: None,  # pylint: disable=unused-argument
+    get_token: Callable[[str, str], str],
+    insert_traces: Callable[[list[Traces]], None],
+) -> None:
+    """
+    Test fillGaps for traces with formula and groupBy.
+    """
+    now = datetime.now(tz=UTC).replace(second=0, microsecond=0)
+
+    traces: list[Traces] = [
+        Traces(
+            timestamp=now - timedelta(minutes=3),
+            duration=timedelta(seconds=1),
+            trace_id=TraceIdGenerator.trace_id(),
+            span_id=TraceIdGenerator.span_id(),
+            parent_span_id="",
+            name="span-group1",
+            kind=TracesKind.SPAN_KIND_SERVER,
+            status_code=TracesStatusCode.STATUS_CODE_OK,
+            status_message="",
+            resources={"service.name": "group1"},
+            attributes={"http.method": "GET"},
+        ),
+        Traces(
+            timestamp=now - timedelta(minutes=2),
+            duration=timedelta(seconds=1),
+            trace_id=TraceIdGenerator.trace_id(),
+            span_id=TraceIdGenerator.span_id(),
+            parent_span_id="",
+            name="span-group2",
+            kind=TracesKind.SPAN_KIND_SERVER,
+            status_code=TracesStatusCode.STATUS_CODE_OK,
+            status_message="",
+            resources={"service.name": "group2"},
+            attributes={"http.method": "POST"},
+        ),
+    ]
+    insert_traces(traces)
+
+    token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
+
+    start_ms = int((now - timedelta(minutes=5)).timestamp() * 1000)
+    end_ms = int(now.timestamp() * 1000)
+
+    response = requests.post(
+        signoz.self.host_configs["8080"].get("/api/v5/query_range"),
+        timeout=5,
+        headers={"authorization": f"Bearer {token}"},
+        json={
+            "schemaVersion": "v1",
+            "start": start_ms,
+            "end": end_ms,
+            "requestType": "time_series",
+            "compositeQuery": {
+                "queries": [
+                    {
+                        "type": "builder_query",
+                        "spec": {
+                            "name": "A",
+                            "signal": "traces",
+                            "stepInterval": 60,
+                            "disabled": True,
+                            "groupBy": [
+                                {
+                                    "name": "service.name",
+                                    "fieldDataType": "string",
+                                    "fieldContext": "resource",
+                                }
+                            ],
+                            "having": {"expression": ""},
+                            "aggregations": [{"expression": "count()"}],
+                        },
+                    },
+                    {
+                        "type": "builder_query",
+                        "spec": {
+                            "name": "B",
+                            "signal": "traces",
+                            "stepInterval": 60,
+                            "disabled": True,
+                            "groupBy": [
+                                {
+                                    "name": "service.name",
+                                    "fieldDataType": "string",
+                                    "fieldContext": "resource",
+                                }
+                            ],
+                            "having": {"expression": ""},
+                            "aggregations": [{"expression": "count()"}],
+                        },
+                    },
+                    {
+                        "type": "builder_formula",
+                        "spec": {
+                            "name": "F1",
+                            "expression": "A + B",
+                            "disabled": False,
+                        },
+                    },
+                ]
+            },
+            "formatOptions": {"formatTableResultForUI": False, "fillGaps": True},
+        },
+    )
+
+    assert response.status_code == HTTPStatus.OK
+    assert response.json()["status"] == "success"
+
+    results = response.json()["data"]["data"]["results"]
+    assert len(results) == 1
+
+    ts_min_2 = int((now - timedelta(minutes=2)).timestamp() * 1000)
+    ts_min_3 = int((now - timedelta(minutes=3)).timestamp() * 1000)
+
+    f1 = find_named_result(results, "F1")
+    assert f1 is not None, "Expected formula result named F1"
+
+    aggregations = f1.get("aggregations") or []
+    assert len(aggregations) == 1
+    series = aggregations[0]["series"]
+    assert len(series) == 2
+
+    series_by_service = index_series_by_label(series, "service.name")
+    assert set(series_by_service.keys()) == {"group1", "group2"}
+
+    expectations: dict[str, dict[int, float]] = {
+        "group1": {ts_min_3: 2},
+        "group2": {ts_min_2: 2},
+    }
+
+    for service_name, s in series_by_service.items():
+        assert_minutely_bucket_values(
+            s["values"],
+            now,
+            expected_by_ts=expectations[service_name],
+            context=f"traces/fillGaps/F1/{service_name}",
+        )
+
+
+def test_traces_fill_zero(
+    signoz: types.SigNoz,
+    create_user_admin: None,  # pylint: disable=unused-argument
+    get_token: Callable[[str, str], str],
+    insert_traces: Callable[[list[Traces]], None],
+) -> None:
+    """
+    Test fillZero function for traces without groupBy.
+    """
+    now = datetime.now(tz=UTC).replace(second=0, microsecond=0)
+
+    traces: list[Traces] = [
+        Traces(
+            timestamp=now - timedelta(minutes=3),
+            duration=timedelta(seconds=1),
+            trace_id=TraceIdGenerator.trace_id(),
+            span_id=TraceIdGenerator.span_id(),
+            parent_span_id="",
+            name="test-span",
+            kind=TracesKind.SPAN_KIND_SERVER,
+            status_code=TracesStatusCode.STATUS_CODE_OK,
+            status_message="",
+            resources={"service.name": "test"},
+            attributes={"http.method": "GET"},
+        ),
+    ]
+    insert_traces(traces)
+
+    token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
+
+    start_ms = int((now - timedelta(minutes=5)).timestamp() * 1000)
+    end_ms = int(now.timestamp() * 1000)
+
+    response = requests.post(
+        signoz.self.host_configs["8080"].get("/api/v5/query_range"),
+        timeout=5,
+        headers={"authorization": f"Bearer {token}"},
+        json={
+            "schemaVersion": "v1",
+            "start": start_ms,
+            "end": end_ms,
+            "requestType": "time_series",
+            "compositeQuery": {
+                "queries": [
+                    {
+                        "type": "builder_query",
+                        "spec": {
+                            "name": "A",
+                            "signal": "traces",
+                            "stepInterval": 60,
+                            "disabled": False,
+                            "having": {"expression": ""},
+                            "aggregations": [{"expression": "count()"}],
+                            "functions": [{"name": "fillZero"}],
+                        },
+                    }
+                ]
+            },
+            "formatOptions": {"formatTableResultForUI": False, "fillGaps": False},
+        },
+    )
+
+    assert response.status_code == HTTPStatus.OK
+    assert response.json()["status"] == "success"
+
+    results = response.json()["data"]["data"]["results"]
+    assert len(results) == 1
+
+    aggregations = results[0].get("aggregations") or []
+    assert len(aggregations) == 1
+    series = aggregations[0]["series"]
+    assert len(series) >= 1
+    values = series[0]["values"]
+
+    ts_min_3 = int((now - timedelta(minutes=3)).timestamp() * 1000)
+    assert_minutely_bucket_values(
+        values,
+        now,
+        expected_by_ts={ts_min_3: 1},
+        context="traces/fillZero",
+    )
+
+
+def test_traces_fill_zero_with_group_by(
+    signoz: types.SigNoz,
+    create_user_admin: None,  # pylint: disable=unused-argument
+    get_token: Callable[[str, str], str],
+    insert_traces: Callable[[list[Traces]], None],
+) -> None:
+    """
+    Test fillZero function for traces with groupBy.
+    """
+    now = datetime.now(tz=UTC).replace(second=0, microsecond=0)
+
+    traces: list[Traces] = [
+        Traces(
+            timestamp=now - timedelta(minutes=3),
+            duration=timedelta(seconds=1),
+            trace_id=TraceIdGenerator.trace_id(),
+            span_id=TraceIdGenerator.span_id(),
+            parent_span_id="",
+            name="span-a",
+            kind=TracesKind.SPAN_KIND_SERVER,
+            status_code=TracesStatusCode.STATUS_CODE_OK,
+            status_message="",
+            resources={"service.name": "service-a"},
+            attributes={"http.method": "GET"},
+        ),
+        Traces(
+            timestamp=now - timedelta(minutes=2),
+            duration=timedelta(seconds=1),
+            trace_id=TraceIdGenerator.trace_id(),
+            span_id=TraceIdGenerator.span_id(),
+            parent_span_id="",
+            name="span-b",
+            kind=TracesKind.SPAN_KIND_SERVER,
+            status_code=TracesStatusCode.STATUS_CODE_OK,
+            status_message="",
+            resources={"service.name": "service-b"},
+            attributes={"http.method": "POST"},
+        ),
+    ]
+    insert_traces(traces)
+
+    token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
+
+    start_ms = int((now - timedelta(minutes=5)).timestamp() * 1000)
+    end_ms = int(now.timestamp() * 1000)
+
+    response = requests.post(
+        signoz.self.host_configs["8080"].get("/api/v5/query_range"),
+        timeout=5,
+        headers={"authorization": f"Bearer {token}"},
+        json={
+            "schemaVersion": "v1",
+            "start": start_ms,
+            "end": end_ms,
+            "requestType": "time_series",
+            "compositeQuery": {
+                "queries": [
+                    {
+                        "type": "builder_query",
+                        "spec": {
+                            "name": "A",
+                            "signal": "traces",
+                            "stepInterval": 60,
+                            "disabled": False,
+                            "groupBy": [
+                                {
+                                    "name": "service.name",
+                                    "fieldDataType": "string",
+                                    "fieldContext": "resource",
+                                }
+                            ],
+                            "having": {"expression": ""},
+                            "aggregations": [{"expression": "count()"}],
+                            "functions": [{"name": "fillZero"}],
+                        },
+                    }
+                ]
+            },
+            "formatOptions": {"formatTableResultForUI": False, "fillGaps": False},
+        },
+    )
+
+    assert response.status_code == HTTPStatus.OK
+    assert response.json()["status"] == "success"
+
+    results = response.json()["data"]["data"]["results"]
+    assert len(results) == 1
+
+    aggregations = results[0]["aggregations"]
+    assert len(aggregations) == 1
+
+    series = aggregations[0]["series"]
+    assert len(series) == 2, "Expected 2 series for 2 service groups"
+
+    ts_min_2 = int((now - timedelta(minutes=2)).timestamp() * 1000)
+    ts_min_3 = int((now - timedelta(minutes=3)).timestamp() * 1000)
+
+    series_by_service = index_series_by_label(series, "service.name")
+    assert set(series_by_service.keys()) == {"service-a", "service-b"}
+
+    expectations: dict[str, dict[int, float]] = {
+        "service-a": {ts_min_3: 1},
+        "service-b": {ts_min_2: 1},
+    }
+
+    for service_name, s in series_by_service.items():
+        assert_minutely_bucket_values(
+            s["values"],
+            now,
+            expected_by_ts=expectations[service_name],
+            context=f"traces/fillZero/{service_name}",
+        )
+
+
+def test_traces_fill_zero_formula(
+    signoz: types.SigNoz,
+    create_user_admin: None,  # pylint: disable=unused-argument
+    get_token: Callable[[str, str], str],
+    insert_traces: Callable[[list[Traces]], None],
+) -> None:
+    """
+    Test fillZero function for traces with formula.
+    """
+    now = datetime.now(tz=UTC).replace(second=0, microsecond=0)
+
+    traces: list[Traces] = [
+        Traces(
+            timestamp=now - timedelta(minutes=3),
+            duration=timedelta(seconds=1),
+            trace_id=TraceIdGenerator.trace_id(),
+            span_id=TraceIdGenerator.span_id(),
+            parent_span_id="",
+            name="test-span",
+            kind=TracesKind.SPAN_KIND_SERVER,
+            status_code=TracesStatusCode.STATUS_CODE_OK,
+            status_message="",
+            resources={"service.name": "test"},
+            attributes={"http.method": "GET"},
+        ),
+        Traces(
+            timestamp=now - timedelta(minutes=2),
+            duration=timedelta(seconds=1),
+            trace_id=TraceIdGenerator.trace_id(),
+            span_id=TraceIdGenerator.span_id(),
+            parent_span_id="",
+            name="another-test-span",
+            kind=TracesKind.SPAN_KIND_SERVER,
+            status_code=TracesStatusCode.STATUS_CODE_OK,
+            status_message="",
+            resources={"service.name": "another-test"},
+            attributes={"http.method": "POST"},
+        ),
+    ]
+    insert_traces(traces)
+
+    token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
+
+    start_ms = int((now - timedelta(minutes=5)).timestamp() * 1000)
+    end_ms = int(now.timestamp() * 1000)
+
+    response = requests.post(
+        signoz.self.host_configs["8080"].get("/api/v5/query_range"),
+        timeout=5,
+        headers={"authorization": f"Bearer {token}"},
+        json={
+            "schemaVersion": "v1",
+            "start": start_ms,
+            "end": end_ms,
+            "requestType": "time_series",
+            "compositeQuery": {
+                "queries": [
+                    {
+                        "type": "builder_query",
+                        "spec": {
+                            "name": "A",
+                            "signal": "traces",
+                            "stepInterval": 60,
+                            "disabled": True,
+                            "filter": {"expression": "service.name = 'test'"},
+                            "having": {"expression": ""},
+                            "aggregations": [{"expression": "count()"}],
+                        },
+                    },
+                    {
+                        "type": "builder_query",
+                        "spec": {
+                            "name": "B",
+                            "signal": "traces",
+                            "stepInterval": 60,
+                            "disabled": True,
+                            "filter": {"expression": "service.name = 'another-test'"},
+                            "having": {"expression": ""},
+                            "aggregations": [{"expression": "count()"}],
+                        },
+                    },
+                    {
+                        "type": "builder_formula",
+                        "spec": {
+                            "name": "F1",
+                            "expression": "A + B",
+                            "disabled": False,
+                            "functions": [{"name": "fillZero"}],
+                        },
+                    },
+                ]
+            },
+            "formatOptions": {"formatTableResultForUI": False, "fillGaps": False},
+        },
+    )
+
+    assert response.status_code == HTTPStatus.OK
+    assert response.json()["status"] == "success"
+
+    results = response.json()["data"]["data"]["results"]
+    assert len(results) == 1
+
+    ts_min_2 = int((now - timedelta(minutes=2)).timestamp() * 1000)
+    ts_min_3 = int((now - timedelta(minutes=3)).timestamp() * 1000)
+
+    f1 = find_named_result(results, "F1")
+    assert f1 is not None, "Expected formula result named F1"
+    aggregations = f1.get("aggregations") or []
+    assert len(aggregations) == 1
+    series = aggregations[0]["series"]
+    assert len(series) >= 1
+
+    assert_minutely_bucket_values(
+        series[0]["values"],
+        now,
+        expected_by_ts={ts_min_3: 1, ts_min_2: 1},
+        context="traces/fillZero/F1",
+    )
+
+
+def test_traces_fill_zero_formula_with_group_by(
+    signoz: types.SigNoz,
+    create_user_admin: None,  # pylint: disable=unused-argument
+    get_token: Callable[[str, str], str],
+    insert_traces: Callable[[list[Traces]], None],
+) -> None:
+    """
+    Test fillZero function for traces with formula and groupBy.
+    """
+    now = datetime.now(tz=UTC).replace(second=0, microsecond=0)
+
+    traces: list[Traces] = [
+        Traces(
+            timestamp=now - timedelta(minutes=3),
+            duration=timedelta(seconds=1),
+            trace_id=TraceIdGenerator.trace_id(),
+            span_id=TraceIdGenerator.span_id(),
+            parent_span_id="",
+            name="span-group1",
+            kind=TracesKind.SPAN_KIND_SERVER,
+            status_code=TracesStatusCode.STATUS_CODE_OK,
+            status_message="",
+            resources={"service.name": "group1"},
+            attributes={"http.method": "GET"},
+        ),
+        Traces(
+            timestamp=now - timedelta(minutes=2),
+            duration=timedelta(seconds=1),
+            trace_id=TraceIdGenerator.trace_id(),
+            span_id=TraceIdGenerator.span_id(),
+            parent_span_id="",
+            name="span-group2",
+            kind=TracesKind.SPAN_KIND_SERVER,
+            status_code=TracesStatusCode.STATUS_CODE_OK,
+            status_message="",
+            resources={"service.name": "group2"},
+            attributes={"http.method": "POST"},
+        ),
+    ]
+    insert_traces(traces)
+
+    token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
+
+    start_ms = int((now - timedelta(minutes=5)).timestamp() * 1000)
+    end_ms = int(now.timestamp() * 1000)
+
+    response = requests.post(
+        signoz.self.host_configs["8080"].get("/api/v5/query_range"),
+        timeout=5,
+        headers={"authorization": f"Bearer {token}"},
+        json={
+            "schemaVersion": "v1",
+            "start": start_ms,
+            "end": end_ms,
+            "requestType": "time_series",
+            "compositeQuery": {
+                "queries": [
+                    {
+                        "type": "builder_query",
+                        "spec": {
+                            "name": "A",
+                            "signal": "traces",
+                            "stepInterval": 60,
+                            "disabled": True,
+                            "groupBy": [
+                                {
+                                    "name": "service.name",
+                                    "fieldDataType": "string",
+                                    "fieldContext": "resource",
+                                }
+                            ],
+                            "having": {"expression": ""},
+                            "aggregations": [{"expression": "count()"}],
+                        },
+                    },
+                    {
+                        "type": "builder_query",
+                        "spec": {
+                            "name": "B",
+                            "signal": "traces",
+                            "stepInterval": 60,
+                            "disabled": True,
+                            "groupBy": [
+                                {
+                                    "name": "service.name",
+                                    "fieldDataType": "string",
+                                    "fieldContext": "resource",
+                                }
+                            ],
+                            "having": {"expression": ""},
+                            "aggregations": [{"expression": "count()"}],
+                        },
+                    },
+                    {
+                        "type": "builder_formula",
+                        "spec": {
+                            "name": "F1",
+                            "expression": "A + B",
+                            "disabled": False,
+                            "functions": [{"name": "fillZero"}],
+                        },
+                    },
+                ]
+            },
+            "formatOptions": {"formatTableResultForUI": False, "fillGaps": False},
+        },
+    )
+
+    assert response.status_code == HTTPStatus.OK
+    assert response.json()["status"] == "success"
+
+    results = response.json()["data"]["data"]["results"]
+    assert len(results) == 1
+
+    ts_min_2 = int((now - timedelta(minutes=2)).timestamp() * 1000)
+    ts_min_3 = int((now - timedelta(minutes=3)).timestamp() * 1000)
+
+    f1 = find_named_result(results, "F1")
+    assert f1 is not None, "Expected formula result named F1"
+    aggregations = f1.get("aggregations") or []
+    assert len(aggregations) == 1
+    series = aggregations[0]["series"]
+    assert len(series) == 2
+
+    series_by_service = index_series_by_label(series, "service.name")
+    assert set(series_by_service.keys()) == {"group1", "group2"}
+
+    expectations: dict[str, dict[int, float]] = {
+        "group1": {ts_min_3: 2},
+        "group2": {ts_min_2: 2},
+    }
+
+    for service_name, s in series_by_service.items():
+        assert_minutely_bucket_values(
+            s["values"],
+            now,
+            expected_by_ts=expectations[service_name],
+            context=f"traces/fillZero/F1/{service_name}",
+        )

tests/integration/tests/queriertraces/04_trace_id_filter.py

@@ -0,0 +1,267 @@
+from collections.abc import Callable
+from datetime import UTC, datetime, timedelta
+from http import HTTPStatus
+
+from fixtures import types
+from fixtures.auth import USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD
+from fixtures.querier import (
+    make_query_request,
+)
+from fixtures.traces import (
+    TraceIdGenerator,
+    Traces,
+    TracesKind,
+    TracesStatusCode,
+)
+
+
+def test_traces_list_filter_by_trace_id(
+    signoz: types.SigNoz,
+    create_user_admin: None,  # pylint: disable=unused-argument
+    get_token: Callable[[str, str], str],
+    insert_traces: Callable[[list[Traces]], None],
+) -> None:
+    """
+    Tests that filtering by trace_id:
+    1. Returns the matching span (narrow window, single bucket).
+    2. Does not return duplicate spans when the query window spans multiple
+       exponential buckets (>1 h)
+    3. Returns no results when the query window does not contain the trace.
+    """
+    target_trace_id = TraceIdGenerator.trace_id()
+    other_trace_id = TraceIdGenerator.trace_id()
+    span_id_root = TraceIdGenerator.span_id()
+    other_span_id = TraceIdGenerator.span_id()
+
+    now = datetime.now(tz=UTC).replace(second=0, microsecond=0)
+
+    common_resources = {
+        "deployment.environment": "production",
+        "service.name": "trace-filter-service",
+        "cloud.provider": "integration",
+    }
+
+    insert_traces(
+        [
+            Traces(
+                timestamp=now - timedelta(seconds=10),
+                duration=timedelta(seconds=5),
+                trace_id=target_trace_id,
+                span_id=span_id_root,
+                parent_span_id="",
+                name="root-span",
+                kind=TracesKind.SPAN_KIND_SERVER,
+                status_code=TracesStatusCode.STATUS_CODE_OK,
+                status_message="",
+                resources=common_resources,
+                attributes={"http.request.method": "GET"},
+            ),
+            # span from a different trace — must not appear in results
+            Traces(
+                timestamp=now - timedelta(seconds=5),
+                duration=timedelta(seconds=1),
+                trace_id=other_trace_id,
+                span_id=other_span_id,
+                parent_span_id="",
+                name="other-root-span",
+                kind=TracesKind.SPAN_KIND_SERVER,
+                status_code=TracesStatusCode.STATUS_CODE_OK,
+                status_message="",
+                resources=common_resources,
+                attributes={},
+            ),
+        ]
+    )
+
+    token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
+
+    trace_filter = f"trace_id = '{target_trace_id}'"
+
+    def _query(start_ms: int, end_ms: int) -> tuple[list, list[str]]:
+        response = make_query_request(
+            signoz,
+            token,
+            start_ms=start_ms,
+            end_ms=end_ms,
+            request_type="raw",
+            queries=[
+                {
+                    "type": "builder_query",
+                    "spec": {
+                        "name": "A",
+                        "signal": "traces",
+                        "disabled": False,
+                        "limit": 100,
+                        "offset": 0,
+                        "filter": {"expression": trace_filter},
+                        "order": [{"key": {"name": "timestamp"}, "direction": "desc"}],
+                        "selectFields": [
+                            {
+                                "name": "name",
+                                "fieldDataType": "string",
+                                "fieldContext": "span",
+                                "signal": "traces",
+                            }
+                        ],
+                        "having": {"expression": ""},
+                        "aggregations": [{"expression": "count()"}],
+                    },
+                }
+            ],
+        )
+        assert response.status_code == HTTPStatus.OK
+        assert response.json()["status"] == "success"
+        rows = response.json()["data"]["data"]["results"][0]["rows"] or []
+        warning = (response.json().get("data") or {}).get("warning") or {}
+        messages = [w.get("message", "") for w in (warning.get("warnings") or [])]
+        return rows, messages
+
+    outside_range_msg = "lies outside the selected time range"
+
+    now_ms = int(now.timestamp() * 1000)
+
+    # --- Test 1: narrow window (single bucket, <1 h) ---
+    narrow_start_ms = int((now - timedelta(minutes=5)).timestamp() * 1000)
+    narrow_rows, narrow_warnings = _query(narrow_start_ms, now_ms)
+
+    assert len(narrow_rows) == 1, f"Expected 1 span for trace_id filter (narrow window), got {len(narrow_rows)}"
+    assert narrow_rows[0]["data"]["span_id"] == span_id_root
+    assert narrow_rows[0]["data"]["trace_id"] == target_trace_id
+    assert not any(outside_range_msg in m for m in narrow_warnings), f"Did not expect outside-range warning, got {narrow_warnings}"
+
+    # --- Test 2: wide window (>1 h, triggers multiple exponential buckets) ---
+    # should just return 1 span, not duplicate
+    wide_start_ms = int((now - timedelta(hours=12)).timestamp() * 1000)
+    wide_rows, wide_warnings = _query(wide_start_ms, now_ms)
+
+    assert len(wide_rows) == 1, f"Expected 1 span for trace_id filter (wide window, multi-bucket), got {len(wide_rows)} — possible duplicate-span regression"
+    assert wide_rows[0]["data"]["span_id"] == span_id_root
+    assert wide_rows[0]["data"]["trace_id"] == target_trace_id
+    assert not any(outside_range_msg in m for m in wide_warnings), f"Did not expect outside-range warning, got {wide_warnings}"
+
+    # --- Test 3: window that does not contain the trace returns no results + warning ---
+    past_start_ms = int((now - timedelta(hours=6)).timestamp() * 1000)
+    past_end_ms = int((now - timedelta(hours=2)).timestamp() * 1000)
+    past_rows, past_warnings = _query(past_start_ms, past_end_ms)
+
+    assert len(past_rows) == 0, f"Expected 0 spans for trace_id filter outside time window, got {len(past_rows)}"
+    assert any(outside_range_msg in m for m in past_warnings), f"Expected outside-range warning, got warnings={past_warnings}"
+
+
+def test_traces_aggregation_filter_by_trace_id(
+    signoz: types.SigNoz,
+    create_user_admin: None,  # pylint: disable=unused-argument
+    get_token: Callable[[str, str], str],
+    insert_traces: Callable[[list[Traces]], None],
+) -> None:
+    """
+    Tests that the trace_id time-range optimization also applies to
+    non-window-list (time_series / aggregation) traces queries:
+    1. Wide query window containing the trace returns the correct count.
+    2. Query window outside the trace's time range short-circuits to empty.
+    3. Filter referencing a trace_id with no row in trace_summary
+       short-circuits to empty (trace_summary is authoritative for traces).
+    """
+    target_trace_id = TraceIdGenerator.trace_id()
+    target_root_span_id = TraceIdGenerator.span_id()
+    target_child_span_id = TraceIdGenerator.span_id()
+    missing_trace_id = TraceIdGenerator.trace_id()
+
+    now = datetime.now(tz=UTC).replace(second=0, microsecond=0)
+
+    common_resources = {
+        "deployment.environment": "production",
+        "service.name": "traces-agg-filter-service",
+        "cloud.provider": "integration",
+    }
+
+    insert_traces(
+        [
+            Traces(
+                timestamp=now - timedelta(seconds=10),
+                duration=timedelta(seconds=5),
+                trace_id=target_trace_id,
+                span_id=target_root_span_id,
+                parent_span_id="",
+                name="root-span",
+                kind=TracesKind.SPAN_KIND_SERVER,
+                status_code=TracesStatusCode.STATUS_CODE_OK,
+                status_message="",
+                resources=common_resources,
+                attributes={"http.request.method": "GET"},
+            ),
+            Traces(
+                timestamp=now - timedelta(seconds=9),
+                duration=timedelta(seconds=1),
+                trace_id=target_trace_id,
+                span_id=target_child_span_id,
+                parent_span_id=target_root_span_id,
+                name="child-span",
+                kind=TracesKind.SPAN_KIND_CLIENT,
+                status_code=TracesStatusCode.STATUS_CODE_OK,
+                status_message="",
+                resources=common_resources,
+                attributes={},
+            ),
+        ]
+    )
+
+    token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
+
+    def _count(start_ms: int, end_ms: int, trace_id: str) -> tuple[float, list[str]]:
+        response = make_query_request(
+            signoz,
+            token,
+            start_ms=start_ms,
+            end_ms=end_ms,
+            request_type="time_series",
+            queries=[
+                {
+                    "type": "builder_query",
+                    "spec": {
+                        "name": "A",
+                        "signal": "traces",
+                        "stepInterval": 60,
+                        "disabled": False,
+                        "filter": {"expression": f"trace_id = '{trace_id}'"},
+                        "aggregations": [{"expression": "count()"}],
+                    },
+                }
+            ],
+        )
+        assert response.status_code == HTTPStatus.OK
+        assert response.json()["status"] == "success"
+        results = response.json()["data"]["data"]["results"]
+        assert len(results) == 1
+        warning = (response.json().get("data") or {}).get("warning") or {}
+        messages = [w.get("message", "") for w in (warning.get("warnings") or [])]
+        aggregations = results[0].get("aggregations") or []
+        if not aggregations:
+            return 0, messages
+        series = aggregations[0].get("series") or []
+        if not series:
+            return 0, messages
+        return sum(v["value"] for v in series[0]["values"]), messages
+
+    outside_range_msg = "lies outside the selected time range"
+
+    now_ms = int(now.timestamp() * 1000)
+
+    # --- Test 1: wide window (>1 h) containing the trace returns both spans ---
+    wide_start_ms = int((now - timedelta(hours=12)).timestamp() * 1000)
+    wide_count, wide_warnings = _count(wide_start_ms, now_ms, target_trace_id)
+    assert wide_count == 2, f"Expected count=2 for trace_id aggregation (wide window), got {wide_count}"
+    assert not any(outside_range_msg in m for m in wide_warnings), f"Did not expect outside-range warning, got {wide_warnings}"
+
+    # --- Test 2: window outside the trace short-circuits to empty + warning ---
+    past_start_ms = int((now - timedelta(hours=6)).timestamp() * 1000)
+    past_end_ms = int((now - timedelta(hours=2)).timestamp() * 1000)
+    past_count, past_warnings = _count(past_start_ms, past_end_ms, target_trace_id)
+    assert past_count == 0, f"Expected count=0 for trace_id aggregation outside time window, got {past_count}"
+    assert any(outside_range_msg in m for m in past_warnings), f"Expected outside-range warning, got warnings={past_warnings}"
+
+    # --- Test 3: trace_id with no entry in trace_summary short-circuits (no warning) ---
+    missing_start_ms = int((now - timedelta(minutes=5)).timestamp() * 1000)
+    missing_count, missing_warnings = _count(missing_start_ms, now_ms, missing_trace_id)
+    assert missing_count == 0, f"Expected count=0 for trace_id absent from trace_summary, got {missing_count}"
+    assert not any(outside_range_msg in m for m in missing_warnings), f"Did not expect outside-range warning for missing trace_id, got {missing_warnings}"

tests/integration/tests/queriertraces/07_filter_errors.py

@@ -0,0 +1,53 @@
+from collections.abc import Callable
+from datetime import UTC, datetime, timedelta
+from http import HTTPStatus
+
+import pytest
+
+from fixtures import types
+from fixtures.auth import USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD
+from fixtures.querier import make_query_request
+
+# Traces filter validation: a truly-unknown key is rejected, and the body-JSON
+# functions has()/hasToken() are not valid on the traces signal. All are pre-query
+# validation errors (400) independent of ingested data.
+
+
+@pytest.mark.parametrize(
+    "expression",
+    [
+        # unknown key. NOTE: current HEAD rejects (400); the parked
+        # convert-not-found-to-warning change will make this a 200 + warning.
+        pytest.param('totally.unknown.key = "x"', id="key_not_found"),
+        # has()/hasToken() support only the logs body JSON field.
+        pytest.param('has(service.name, "x")', id="has_on_traces"),
+        pytest.param('hasToken(name, "x")', id="hastoken_on_traces"),
+    ],
+)
+def test_traces_filter_validation_errors(
+    signoz: types.SigNoz,
+    create_user_admin: None,  # pylint: disable=unused-argument
+    get_token: Callable[[str, str], str],
+    expression: str,
+) -> None:
+    now = datetime.now(tz=UTC)
+    token = get_token(email=USER_ADMIN_EMAIL, password=USER_ADMIN_PASSWORD)
+    response = make_query_request(
+        signoz,
+        token,
+        start_ms=int((now - timedelta(seconds=30)).timestamp() * 1000),
+        end_ms=int(now.timestamp() * 1000),
+        request_type="scalar",
+        queries=[
+            {
+                "type": "builder_query",
+                "spec": {
+                    "name": "A",
+                    "signal": "traces",
+                    "filter": {"expression": expression},
+                    "aggregations": [{"expression": "count()"}],
+                },
+            }
+        ],
+    )
+    assert response.status_code == HTTPStatus.BAD_REQUEST

tests/integration/tests/queriertraces/08_aggregation_min_max.py

@@ -0,0 +1,98 @@
+from collections.abc import Callable
+from datetime import UTC, datetime, timedelta
+from http import HTTPStatus
+
+from fixtures import types
+from fixtures.auth import USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD
+from fixtures.querier import index_series_by_label, make_query_request
+from fixtures.traces import TraceIdGenerator, Traces, TracesKind, TracesStatusCode
+
+# min()/max() aggregation expressions over a span field. The traces aggregation
+# suite (02_aggregation.py) covers count/countIf/avg/p99 but not min/max.
+
+
+def test_traces_aggregate_min_max(
+    signoz: types.SigNoz,
+    create_user_admin: None,  # pylint: disable=unused-argument
+    get_token: Callable[[str, str], str],
+    insert_traces: Callable[[list[Traces]], None],
+) -> None:
+    """max(duration_nano)/min(duration_nano) grouped by service.name return the extremes."""
+    now = datetime.now(tz=UTC).replace(second=0, microsecond=0)
+    insert_traces(
+        [
+            Traces(
+                timestamp=now - timedelta(seconds=4),
+                duration=timedelta(seconds=3),  # 3e9
+                trace_id=TraceIdGenerator.trace_id(),
+                span_id=TraceIdGenerator.span_id(),
+                name="POST /x",
+                kind=TracesKind.SPAN_KIND_SERVER,
+                status_code=TracesStatusCode.STATUS_CODE_OK,
+                resources={"service.name": "http-service"},
+            ),
+            Traces(
+                timestamp=now - timedelta(seconds=3),
+                duration=timedelta(milliseconds=500),  # 0.5e9 (min)
+                trace_id=TraceIdGenerator.trace_id(),
+                span_id=TraceIdGenerator.span_id(),
+                name="SELECT",
+                kind=TracesKind.SPAN_KIND_CLIENT,
+                status_code=TracesStatusCode.STATUS_CODE_OK,
+                resources={"service.name": "http-service"},
+            ),
+            Traces(
+                timestamp=now - timedelta(seconds=2),
+                duration=timedelta(seconds=1),  # 1e9
+                trace_id=TraceIdGenerator.trace_id(),
+                span_id=TraceIdGenerator.span_id(),
+                name="PATCH",
+                kind=TracesKind.SPAN_KIND_CLIENT,
+                status_code=TracesStatusCode.STATUS_CODE_OK,
+                resources={"service.name": "http-service"},
+            ),
+            Traces(
+                timestamp=now - timedelta(seconds=1),
+                duration=timedelta(seconds=4),  # 4e9
+                trace_id=TraceIdGenerator.trace_id(),
+                span_id=TraceIdGenerator.span_id(),
+                name="topic publish",
+                kind=TracesKind.SPAN_KIND_PRODUCER,
+                status_code=TracesStatusCode.STATUS_CODE_OK,
+                resources={"service.name": "topic-service"},
+            ),
+        ]
+    )
+    token = get_token(email=USER_ADMIN_EMAIL, password=USER_ADMIN_PASSWORD)
+
+    response = make_query_request(
+        signoz,
+        token,
+        start_ms=int((now - timedelta(minutes=5)).timestamp() * 1000),
+        end_ms=int((now + timedelta(seconds=5)).timestamp() * 1000),
+        request_type="time_series",
+        queries=[
+            {
+                "type": "builder_query",
+                "spec": {
+                    "name": "A",
+                    "signal": "traces",
+                    "groupBy": [{"name": "service.name", "fieldContext": "resource", "fieldDataType": "string"}],
+                    "aggregations": [
+                        {"expression": "max(duration_nano)", "alias": "maxDuration"},
+                        {"expression": "min(duration_nano)", "alias": "minDuration"},
+                    ],
+                },
+            }
+        ],
+    )
+    assert response.status_code == HTTPStatus.OK
+    assert response.json()["status"] == "success"
+    aggregations = response.json()["data"]["data"]["results"][0]["aggregations"]
+
+    max_by_svc = index_series_by_label(aggregations[0]["series"], "service.name")
+    min_by_svc = index_series_by_label(aggregations[1]["series"], "service.name")
+    assert max_by_svc["http-service"]["values"][0]["value"] == 3_000_000_000.0
+    assert min_by_svc["http-service"]["values"][0]["value"] == 500_000_000.0
+    assert max_by_svc["topic-service"]["values"][0]["value"] == 4_000_000_000.0
+    assert min_by_svc["topic-service"]["values"][0]["value"] == 4_000_000_000.0