test(querier): pin explicit context resolution under ambiguous names

One name can exist in more than one place. `name` is a span column and a
span attribute. `severity_text` is a log column and a log attribute. An
attribute can have two data types. `service.name` is a resource attribute
and a span or log attribute. These tests record what the query builder
does for each shape in a filter, EXISTS, a group by, an order by, an
aggregation argument, and a raw select. A change to name resolution then
fails here first.

- A key with an explicit context reads that context only. A bare key with
  more than one reading returns an ambiguity warning. An `attribute.` key
  returns the warning when the attribute has two data types.
- A bare key that is a column and an attribute reads both in a filter. It
  orders, groups, and counts by the column only. A string operand matches
  a number attribute through a text cast.
- A bare key that is a resource attribute and an attribute reads the
  resource attribute in a filter and in a raw select. The filter returns a
  warning.
- An `attribute.` key in an order by sorts by the attribute on traces and
  by the column on logs.
- A key under the signal's own context that exists only as an attribute
  reads the attribute. On logs it also reads the body JSON path. A
  `scope.` key on logs resolves through metadata only. When metadata does
  not report the key, the query fails with "key not found". This is also
  true for the declared path `scope.name`.

Assisted-by: Claude Fable 5.1
Claude-Session: https://claude.ai/code/session_01RSnZFLSfyi5S4QYQDcxHeW

pkg/modules/dashboard/impldashboard/listfilter.go

@@ -4,17 +4,41 @@ import (
 	"strings"
 
 	"github.com/SigNoz/signoz/pkg/errors"
-	"github.com/SigNoz/signoz/pkg/parser/filterquery/sqlcompiler"
 	"github.com/SigNoz/signoz/pkg/sqlstore"
 	"github.com/SigNoz/signoz/pkg/types/dashboardtypes"
 )
 
-// Compile wraps compiler errors in the dashboard list filter error code.
-func Compile(query string, formatter sqlstore.SQLFormatter) (*sqlcompiler.Compiled, error) {
-	compiled, errs := sqlcompiler.Compile(query, formatter, dashboardFieldResolver{})
+type Compiled struct {
+	SQL  string
+	Args []any
+}
+
+func (c Compiled) IsEmpty() bool {
+	return c.SQL == ""
+}
+
+// Compile always returns a non-nil *Compiled. An empty query (or one that
+// produces no SQL) yields a Compiled with an empty SQL — callers gate on
+// SQL != "" rather than a nil check.
+//
+// A `key OP value` term compiles to a DSL predicate; a bare word is a
+// case-insensitive substring search over the dashboard name, description, and tag
+// keys/values. They compose through AND/OR/NOT, so `prod payment` matches both
+// words (implicit AND) and `prod OR name = 'x'` mixes free text with a filter. A
+// quoted token matches literally, e.g. `"prod payment"`.
+func Compile(query string, formatter sqlstore.SQLFormatter) (*Compiled, error) {
+	if len(strings.TrimSpace(query)) == 0 {
+		return &Compiled{}, nil
+	}
+
+	sql, args, errs := newVisitor(formatter).compile(query)
 	if len(errs) > 0 {
 		return nil, errors.NewInvalidInputf(dashboardtypes.ErrCodeDashboardListFilterInvalid,
 			"invalid filter query: %s", strings.Join(errs, "; "))
 	}
-	return compiled, nil
+
+	return &Compiled{
+		SQL:  sql,
+		Args: args,
+	}, nil
 }

pkg/modules/dashboard/impldashboard/listfilter_resolver.go

@@ -1,125 +0,0 @@
-package impldashboard
-
-import (
-	"strings"
-
-	grammar "github.com/SigNoz/signoz/pkg/parser/filterquery/grammar"
-	"github.com/SigNoz/signoz/pkg/parser/filterquery/sqlcompiler"
-	"github.com/SigNoz/signoz/pkg/types/dashboardtypes"
-	qbtypesv5 "github.com/SigNoz/signoz/pkg/types/querybuildertypes/querybuildertypesv5"
-	sqlbuilder "github.com/huandu/go-sqlbuilder"
-)
-
-// dashboardFieldResolver maps dashboard list DSL keys; a non-reserved key is a tag key matched case-insensitively.
-type dashboardFieldResolver struct{}
-
-func (r dashboardFieldResolver) ResolveComparison(b *sqlcompiler.Builder, rawKey string, operation qbtypesv5.FilterOperator, ctx *grammar.ComparisonContext) string {
-	key := strings.ToLower(rawKey)
-
-	if allowedOperations, isReserved := dashboardtypes.ReservedOps[dashboardtypes.DSLKey(key)]; isReserved {
-		return r.resolveReservedKey(b, ctx, operation, dashboardtypes.DSLKey(key), allowedOperations)
-	}
-
-	if _, allowed := dashboardtypes.TagKeyOps[operation]; !allowed {
-		b.AddError("operator %s is not allowed on a tag-key filter", sqlcompiler.OperationName(operation))
-		return ""
-	}
-	return r.tagComparison(b, ctx, operation, key)
-}
-
-func (r dashboardFieldResolver) resolveReservedKey(b *sqlcompiler.Builder, ctx *grammar.ComparisonContext, operation qbtypesv5.FilterOperator, key dashboardtypes.DSLKey, allowedOperations map[qbtypesv5.FilterOperator]struct{}) string {
-	if _, allowed := allowedOperations[operation]; !allowed {
-		b.AddError("operator %s is not allowed for key %q", sqlcompiler.OperationName(operation), key)
-		return ""
-	}
-	switch key {
-	case dashboardtypes.DSLKeyName:
-		columnExpression := string(b.Formatter().JSONExtractString("dashboard.data", "$.spec.display.name"))
-		return b.StringOperation(b.SelectBuilder(), ctx, operation, columnExpression, string(key))
-	case dashboardtypes.DSLKeyDescription:
-		columnExpression := string(b.Formatter().JSONExtractString("dashboard.data", "$.spec.display.description"))
-		return b.StringOperation(b.SelectBuilder(), ctx, operation, columnExpression, string(key))
-	case dashboardtypes.DSLKeyCreatedAt:
-		return b.TimestampComparison(ctx, operation, "dashboard.created_at")
-	case dashboardtypes.DSLKeyUpdatedAt:
-		return b.TimestampComparison(ctx, operation, "dashboard.updated_at")
-	case dashboardtypes.DSLKeyCreatedBy:
-		return b.StringOperation(b.SelectBuilder(), ctx, operation, "dashboard.created_by", string(key))
-	case dashboardtypes.DSLKeyLocked:
-		return b.BoolComparison(ctx, operation, "dashboard.locked")
-	}
-	b.AddError("no handler for reserved key %q", key)
-	return ""
-}
-
-func (dashboardFieldResolver) tagComparison(b *sqlcompiler.Builder, ctx *grammar.ComparisonContext, operation qbtypesv5.FilterOperator, tagKey string) string {
-	subqueryBuilder := sqlbuilder.NewSelectBuilder()
-
-	if operation == qbtypesv5.FilterOperatorExists || operation == qbtypesv5.FilterOperatorNotExists {
-		buildSubqueryForTagKey(subqueryBuilder, tagKey)
-	} else {
-		// Value predicates take the positive operator; negation toggles the EXISTS wrapper.
-		positiveOperation := operation
-		if operation.IsNegativeOperator() {
-			positiveOperation = operation.Inverse()
-		}
-		valuePredicate := b.StringOperation(subqueryBuilder, ctx, positiveOperation, "t.value", tagKey)
-		if valuePredicate == "" {
-			return ""
-		}
-		buildSubqueryForTagKeyAndValue(subqueryBuilder, tagKey, valuePredicate)
-	}
-
-	if operation.IsNegativeOperator() {
-		return b.SelectBuilder().NotExists(subqueryBuilder)
-	}
-	return b.SelectBuilder().Exists(subqueryBuilder)
-}
-
-func buildSubqueryForTagKey(subqueryBuilder *sqlbuilder.SelectBuilder, tagKey string) *sqlbuilder.SelectBuilder {
-	const dashboardTagKind = `"dashboard"`
-
-	return subqueryBuilder.
-		Select("1").
-		From("tag_relation tr").
-		Join("tag t", "t.id = tr.tag_id").
-		Where(
-			subqueryBuilder.Equal("tr.kind", dashboardTagKind),
-			"tr.resource_id = dashboard.id",
-			"LOWER(t.key) = LOWER("+subqueryBuilder.Var(tagKey)+")",
-		)
-}
-
-func buildSubqueryForTagKeyAndValue(subqueryBuilder *sqlbuilder.SelectBuilder, tagKey, valuePredicate string) *sqlbuilder.SelectBuilder {
-	return buildSubqueryForTagKey(subqueryBuilder, tagKey).Where(valuePredicate)
-}
-
-// FreeText searches name, description and tag keys/values.
-func (dashboardFieldResolver) FreeText(b *sqlcompiler.Builder, value string) string {
-	nameColumn := string(b.Formatter().JSONExtractString("dashboard.data", "$.spec.display.name"))
-	descriptionColumn := string(b.Formatter().JSONExtractString("dashboard.data", "$.spec.display.description"))
-	namePredicate := b.FreeTextContains(b.SelectBuilder(), nameColumn, value)
-	descriptionPredicate := b.FreeTextContains(b.SelectBuilder(), descriptionColumn, value)
-
-	subqueryBuilder := sqlbuilder.NewSelectBuilder()
-	keyPredicate := b.FreeTextContains(subqueryBuilder, "t.key", value)
-	valuePredicate := b.FreeTextContains(subqueryBuilder, "t.value", value)
-	buildSubqueryForFreeTextTag(subqueryBuilder, keyPredicate, valuePredicate)
-	tagPredicate := b.SelectBuilder().Exists(subqueryBuilder)
-
-	return b.SelectBuilder().Or(namePredicate, descriptionPredicate, tagPredicate)
-}
-
-func buildSubqueryForFreeTextTag(subqueryBuilder *sqlbuilder.SelectBuilder, keyPredicate, valuePredicate string) *sqlbuilder.SelectBuilder {
-	const dashboardTagKind = `"dashboard"`
-
-	return subqueryBuilder.
-		Select("1").
-		From("tag_relation tr").
-		Join("tag t", "t.id = tr.tag_id").
-		Where(
-			subqueryBuilder.Equal("tr.kind", dashboardTagKind),
-			"tr.resource_id = dashboard.id",
-			subqueryBuilder.Or(keyPredicate, valuePredicate),
-		)
-}

pkg/modules/dashboard/impldashboard/listfilter_test.go

@@ -559,11 +559,6 @@ func TestCompile_Rejections(t *testing.T) {
 			dslQueryToCompile:        `created_at >= 'not-a-date'`,
 			expectedErrShouldContain: "RFC3339",
 		},
-		{
-			subtestName:              "rejects LIKE pattern ending in an unescaped backslash",
-			dslQueryToCompile:        `name LIKE 'prod\\'`,
-			expectedErrShouldContain: "must not end with an unescaped backslash",
-		},
 		{
 			subtestName:              "rejects REGEXP — not yet supported",
 			dslQueryToCompile:        `name REGEXP '.*'`,
@@ -578,7 +573,7 @@ func TestCompile_Rejections(t *testing.T) {
 }
 
 // Every key in dashboardtypes.ReservedOps must have a matching case in
-// resolveReservedKey; a key that's reserved but unhandled falls
+// visitComparisonForReservedKeys; a key that's reserved but unhandled falls
 // through to the "no handler for reserved key" error. Equal is accepted by all
 // reserved keys, so `key = 'x'` always reaches the dispatch switch — a missing
 // handler surfaces as that error regardless of whether the value type-checks.
@@ -588,7 +583,7 @@ func TestCompileReservedKeysAllHandled(t *testing.T) {
 			_, err := Compile(string(key)+` = 'x'`, formatter(t))
 			if err != nil {
 				assert.NotContains(t, err.Error(), "no handler for reserved key",
-					"reserved key %q has no handler in resolveReservedKey", key)
+					"reserved key %q has no handler in visitComparisonForReservedKeys", key)
 			}
 		})
 	}

pkg/modules/dashboard/impldashboard/listfilter_visitor.go

@@ -0,0 +1,631 @@
+package impldashboard
+
+import (
+	"fmt"
+	"strings"
+	"time"
+
+	"github.com/SigNoz/signoz/pkg/parser/filterquery"
+	grammar "github.com/SigNoz/signoz/pkg/parser/filterquery/grammar"
+	"github.com/SigNoz/signoz/pkg/sqlstore"
+	"github.com/SigNoz/signoz/pkg/types/dashboardtypes"
+	qbtypesv5 "github.com/SigNoz/signoz/pkg/types/querybuildertypes/querybuildertypesv5"
+	"github.com/antlr4-go/antlr/v4"
+	sqlbuilder "github.com/huandu/go-sqlbuilder"
+)
+
+// bunPlaceholderFlavor is any flavor that renders `?` placeholders, which bun
+// re-binds to the actual backend (e.g. `$1` for Postgres) at query time.
+const bunPlaceholderFlavor = sqlbuilder.SQLite
+
+type visitor struct {
+	grammar.BaseFilterQueryVisitor
+	selectBuilder *sqlbuilder.SelectBuilder
+	formatter     sqlstore.SQLFormatter
+	errors        []string
+}
+
+func newVisitor(formatter sqlstore.SQLFormatter) *visitor {
+	return &visitor{
+		selectBuilder: sqlbuilder.NewSelectBuilder(),
+		formatter:     formatter,
+	}
+}
+
+// compile builds `?`-placeholder WHERE SQL + args for bun. Each term is either a
+// `key OP value` comparison or a bare token that becomes a free-text search; the
+// two compose through the boolean grammar (AND/OR/NOT). Malformed input is
+// returned as errors.
+func (v *visitor) compile(query string) (string, []any, []string) {
+	tree, _, collector := filterquery.Parse(query)
+	if len(collector.Errors) > 0 {
+		return "", nil, collector.Errors
+	}
+	condition, _ := v.visit(tree).(string)
+	if len(v.errors) > 0 {
+		return "", nil, v.errors
+	}
+	if condition == "" {
+		return "", nil, nil
+	}
+	sql, arguments := v.selectBuilder.Args.CompileWithFlavor(condition, bunPlaceholderFlavor)
+	return sql, arguments, nil
+}
+
+func (v *visitor) visit(tree antlr.ParseTree) any {
+	if tree == nil {
+		return nil
+	}
+	return tree.Accept(v)
+}
+
+// ════════════════════════════════════════════════════════════════════════
+// methods from grammar.BaseFilterQueryVisitor that are overridden
+// ════════════════════════════════════════════════════════════════════════
+
+func (v *visitor) VisitQuery(ctx *grammar.QueryContext) any {
+	return v.visit(ctx.Expression())
+}
+
+func (v *visitor) VisitExpression(ctx *grammar.ExpressionContext) any {
+	return v.visit(ctx.OrExpression())
+}
+
+func (v *visitor) VisitOrExpression(ctx *grammar.OrExpressionContext) any {
+	parts := ctx.AllAndExpression()
+	conditions := make([]string, 0, len(parts))
+	for _, part := range parts {
+		if condition, ok := v.visit(part).(string); ok && condition != "" {
+			conditions = append(conditions, condition)
+		}
+	}
+	switch len(conditions) {
+	case 0:
+		return ""
+	case 1:
+		return conditions[0]
+	default:
+		return v.selectBuilder.Or(conditions...)
+	}
+}
+
+func (v *visitor) VisitAndExpression(ctx *grammar.AndExpressionContext) any {
+	parts := ctx.AllUnaryExpression()
+	conditions := make([]string, 0, len(parts))
+	for _, part := range parts {
+		if condition, ok := v.visit(part).(string); ok && condition != "" {
+			conditions = append(conditions, condition)
+		}
+	}
+	switch len(conditions) {
+	case 0:
+		return ""
+	case 1:
+		return conditions[0]
+	default:
+		return v.selectBuilder.And(conditions...)
+	}
+}
+
+func (v *visitor) VisitUnaryExpression(ctx *grammar.UnaryExpressionContext) any {
+	condition, _ := v.visit(ctx.Primary()).(string)
+	if condition == "" {
+		return ""
+	}
+	if ctx.NOT() != nil {
+		return fmt.Sprintf("NOT (%s)", condition)
+	}
+	return condition
+}
+
+func (v *visitor) VisitPrimary(ctx *grammar.PrimaryContext) any {
+	if ctx.OrExpression() != nil {
+		return v.visit(ctx.OrExpression())
+	}
+	if ctx.Comparison() != nil {
+		return v.visit(ctx.Comparison())
+	}
+	// A lone key/value/full-text token is a free-text term, composed with any
+	// comparisons through the boolean grammar. A quoted token matches its contents
+	// literally — the escape hatch for a phrase or a term that looks like DSL.
+	return v.buildFreeTextTerm(trimQuotes(ctx.GetText()))
+}
+
+// VisitComparison dispatches a single `key OP value` term. A key that matches
+// a reserved DSL key (name, description, etc.) becomes a column-level
+// predicate; any other identifier is treated as a tag key — the operator
+// applies to the tag's value, with a case-insensitive match on the tag's key.
+func (v *visitor) VisitComparison(ctx *grammar.ComparisonContext) any {
+	key := strings.ToLower(strings.TrimSpace(ctx.Key().GetText()))
+
+	operation, ok := v.extractOperation(ctx)
+	if !ok {
+		return ""
+	}
+
+	if allowedOperations, isReserved := dashboardtypes.ReservedOps[dashboardtypes.DSLKey(key)]; isReserved {
+		return v.visitComparisonForReservedKeys(ctx, operation, dashboardtypes.DSLKey(key), allowedOperations)
+	}
+	return v.visitComparisonForTags(ctx, operation, key)
+}
+
+func (v *visitor) visitComparisonForReservedKeys(ctx *grammar.ComparisonContext, operation qbtypesv5.FilterOperator, key dashboardtypes.DSLKey, allowedOperations map[qbtypesv5.FilterOperator]struct{}) string {
+	if _, allowed := allowedOperations[operation]; !allowed {
+		v.addError("operator %s is not allowed for key %q", operationName(operation), key)
+		return ""
+	}
+	switch key {
+	case dashboardtypes.DSLKeyName:
+		return v.buildJSONStringComparison(ctx, operation, dashboardtypes.DSLKeyName, "$.spec.display.name")
+	case dashboardtypes.DSLKeyDescription:
+		return v.buildJSONStringComparison(ctx, operation, dashboardtypes.DSLKeyDescription, "$.spec.display.description")
+	case dashboardtypes.DSLKeyCreatedAt:
+		return v.buildTimestampComparison(ctx, operation, "dashboard.created_at")
+	case dashboardtypes.DSLKeyUpdatedAt:
+		return v.buildTimestampComparison(ctx, operation, "dashboard.updated_at")
+	case dashboardtypes.DSLKeyCreatedBy:
+		return v.buildStringComparison(ctx, operation, dashboardtypes.DSLKeyCreatedBy, "dashboard.created_by")
+	case dashboardtypes.DSLKeyLocked:
+		return v.buildBoolComparison(ctx, operation, "dashboard.locked")
+	}
+	// Unreachable for real input: every dashboardtypes.ReservedOps key has a case above, and
+	// TestCompileReservedKeysAllHandled guards that the two stay in sync.
+	v.addError("no handler for reserved key %q", key)
+	return ""
+}
+
+func (v *visitor) visitComparisonForTags(ctx *grammar.ComparisonContext, operation qbtypesv5.FilterOperator, tagKey string) string {
+	if _, allowed := dashboardtypes.TagKeyOps[operation]; !allowed {
+		v.addError("operator %s is not allowed on a tag-key filter", operationName(operation))
+		return ""
+	}
+	return v.buildTagComparison(ctx, operation, tagKey)
+}
+
+func (v *visitor) extractOperation(ctx *grammar.ComparisonContext) (qbtypesv5.FilterOperator, bool) {
+	// For operators that take an optional leading NOT, Inverse() maps each to
+	// its Not<X> counterpart.
+	maybeNot := func(operation qbtypesv5.FilterOperator) qbtypesv5.FilterOperator {
+		if ctx.NOT() != nil {
+			return operation.Inverse()
+		}
+		return operation
+	}
+	switch {
+	case ctx.EQUALS() != nil:
+		return qbtypesv5.FilterOperatorEqual, true
+	case ctx.NOT_EQUALS() != nil, ctx.NEQ() != nil:
+		return qbtypesv5.FilterOperatorNotEqual, true
+	case ctx.LT() != nil:
+		return qbtypesv5.FilterOperatorLessThan, true
+	case ctx.LE() != nil:
+		return qbtypesv5.FilterOperatorLessThanOrEq, true
+	case ctx.GT() != nil:
+		return qbtypesv5.FilterOperatorGreaterThan, true
+	case ctx.GE() != nil:
+		return qbtypesv5.FilterOperatorGreaterThanOrEq, true
+	case ctx.BETWEEN() != nil:
+		return maybeNot(qbtypesv5.FilterOperatorBetween), true
+	case ctx.LIKE() != nil:
+		return maybeNot(qbtypesv5.FilterOperatorLike), true
+	case ctx.ILIKE() != nil:
+		return maybeNot(qbtypesv5.FilterOperatorILike), true
+	case ctx.CONTAINS() != nil:
+		return maybeNot(qbtypesv5.FilterOperatorContains), true
+	case ctx.REGEXP() != nil:
+		return maybeNot(qbtypesv5.FilterOperatorRegexp), true
+	case ctx.InClause() != nil:
+		return qbtypesv5.FilterOperatorIn, true
+	case ctx.NotInClause() != nil:
+		return qbtypesv5.FilterOperatorNotIn, true
+	case ctx.EXISTS() != nil:
+		return maybeNot(qbtypesv5.FilterOperatorExists), true
+	}
+	v.addError("could not determine operator in expression %q", ctx.GetText())
+	return qbtypesv5.FilterOperatorUnknown, false
+}
+
+// ─── per-key emitters ────────────────────────────────────────────────────────
+
+func (v *visitor) buildJSONStringComparison(ctx *grammar.ComparisonContext, operation qbtypesv5.FilterOperator, key dashboardtypes.DSLKey, jsonPath string) string {
+	columnExpression := string(v.formatter.JSONExtractString("dashboard.data", jsonPath))
+	return v.buildStringOperation(v.selectBuilder, ctx, operation, columnExpression, string(key))
+}
+
+func (v *visitor) buildStringComparison(ctx *grammar.ComparisonContext, operation qbtypesv5.FilterOperator, key dashboardtypes.DSLKey, columnExpression string) string {
+	return v.buildStringOperation(v.selectBuilder, ctx, operation, columnExpression, string(key))
+}
+
+// buildStringOperation covers all the operators the spec allows on text-shaped keys
+// (name, description, created_by, and a tag's value). Placeholders are interned
+// into builder — the outer builder for column predicates, the subquery builder for
+// tag-value predicates — so nested EXISTS arguments thread correctly.
+func (v *visitor) buildStringOperation(builder *sqlbuilder.SelectBuilder, ctx *grammar.ComparisonContext, operation qbtypesv5.FilterOperator, columnExpression, keyForError string) string {
+	switch operation {
+	case qbtypesv5.FilterOperatorEqual:
+		val, ok := v.extractSingleStringValue(ctx, keyForError)
+		if !ok {
+			return ""
+		}
+		return builder.Equal(columnExpression, val)
+	case qbtypesv5.FilterOperatorNotEqual:
+		val, ok := v.extractSingleStringValue(ctx, keyForError)
+		if !ok {
+			return ""
+		}
+		return builder.NotEqual(columnExpression, val)
+	case qbtypesv5.FilterOperatorLike, qbtypesv5.FilterOperatorNotLike:
+		val, ok := v.extractSingleStringValue(ctx, keyForError)
+		if !ok {
+			return ""
+		}
+		like := "LIKE"
+		if operation == qbtypesv5.FilterOperatorNotLike {
+			like = "NOT LIKE"
+		}
+		// The user's % and _ stay as wildcards; ESCAPE pins backslash as the escape
+		// char so a literal `\` in the pattern is read the same on both dialects —
+		// Postgres defaults to `\`, SQLite has no default escape.
+		return fmt.Sprintf("%s %s %s ESCAPE '\\'", columnExpression, like, builder.Var(val))
+	case qbtypesv5.FilterOperatorILike, qbtypesv5.FilterOperatorNotILike:
+		val, ok := v.extractSingleStringValue(ctx, keyForError)
+		if !ok {
+			return ""
+		}
+		// SQLite has no ILIKE keyword and Postgres LIKE is case-sensitive — emit
+		// LOWER(col) LIKE LOWER(?) so behavior is identical on both dialects. ESCAPE
+		// pins backslash as the escape char (Postgres default; SQLite has none).
+		lowerColumn := string(v.formatter.LowerExpression(columnExpression))
+		like := "LIKE"
+		if operation == qbtypesv5.FilterOperatorNotILike {
+			like = "NOT LIKE"
+		}
+		return fmt.Sprintf("%s %s LOWER(%s) ESCAPE '\\'", lowerColumn, like, builder.Var(val))
+	case qbtypesv5.FilterOperatorContains, qbtypesv5.FilterOperatorNotContains:
+		val, ok := v.extractSingleStringValue(ctx, keyForError)
+		if !ok {
+			return ""
+		}
+		like := "LIKE"
+		if operation == qbtypesv5.FilterOperatorNotContains {
+			like = "NOT LIKE"
+		}
+		// Escape the user's % and _ so they match literally, then wrap in wildcards.
+		// ESCAPE declares the backslash the escaper injected as the escape char —
+		// needed on SQLite (no default) and a harmless restatement of the Postgres default.
+		escaped := v.formatter.EscapeLikePattern(val)
+		return fmt.Sprintf("%s %s %s ESCAPE '\\'", columnExpression, like, builder.Var("%"+escaped+"%"))
+	case qbtypesv5.FilterOperatorRegexp, qbtypesv5.FilterOperatorNotRegexp:
+		v.addError("REGEXP filtering on %q is not yet supported", keyForError)
+		return ""
+	case qbtypesv5.FilterOperatorIn, qbtypesv5.FilterOperatorNotIn:
+		values, ok := v.extractStringValueList(ctx, keyForError)
+		if !ok {
+			return ""
+		}
+		arguments := make([]any, len(values))
+		for i, s := range values {
+			arguments[i] = s
+		}
+		if operation == qbtypesv5.FilterOperatorNotIn {
+			return builder.NotIn(columnExpression, arguments...)
+		}
+		return builder.In(columnExpression, arguments...)
+	}
+	v.addError("operator %s on %q is not implemented", operationName(operation), keyForError)
+	return ""
+}
+
+func (v *visitor) buildTimestampComparison(ctx *grammar.ComparisonContext, operation qbtypesv5.FilterOperator, columnExpression string) string {
+	switch operation {
+	case qbtypesv5.FilterOperatorEqual, qbtypesv5.FilterOperatorNotEqual,
+		qbtypesv5.FilterOperatorLessThan, qbtypesv5.FilterOperatorLessThanOrEq,
+		qbtypesv5.FilterOperatorGreaterThan, qbtypesv5.FilterOperatorGreaterThanOrEq:
+		t, ok := v.extractSingleTimestampValue(ctx)
+		if !ok {
+			return ""
+		}
+		switch operation {
+		case qbtypesv5.FilterOperatorEqual:
+			return v.selectBuilder.Equal(columnExpression, t)
+		case qbtypesv5.FilterOperatorNotEqual:
+			return v.selectBuilder.NotEqual(columnExpression, t)
+		case qbtypesv5.FilterOperatorLessThan:
+			return v.selectBuilder.LessThan(columnExpression, t)
+		case qbtypesv5.FilterOperatorLessThanOrEq:
+			return v.selectBuilder.LessEqualThan(columnExpression, t)
+		case qbtypesv5.FilterOperatorGreaterThan:
+			return v.selectBuilder.GreaterThan(columnExpression, t)
+		case qbtypesv5.FilterOperatorGreaterThanOrEq:
+			return v.selectBuilder.GreaterEqualThan(columnExpression, t)
+		}
+	case qbtypesv5.FilterOperatorBetween, qbtypesv5.FilterOperatorNotBetween:
+		timestamps, ok := v.extractTwoTimestampValues(ctx)
+		if !ok {
+			return ""
+		}
+		if operation == qbtypesv5.FilterOperatorNotBetween {
+			return v.selectBuilder.NotBetween(columnExpression, timestamps[0], timestamps[1])
+		}
+		return v.selectBuilder.Between(columnExpression, timestamps[0], timestamps[1])
+	}
+	v.addError("operator %s on timestamp is not implemented", operationName(operation))
+	return ""
+}
+
+func (v *visitor) buildBoolComparison(ctx *grammar.ComparisonContext, operation qbtypesv5.FilterOperator, columnExpression string) string {
+	b, ok := v.extractSingleBoolValue(ctx)
+	if !ok {
+		return ""
+	}
+	if operation == qbtypesv5.FilterOperatorNotEqual {
+		return v.selectBuilder.NotEqual(columnExpression, b)
+	}
+	return v.selectBuilder.Equal(columnExpression, b)
+}
+
+func (v *visitor) buildTagComparison(ctx *grammar.ComparisonContext, operation qbtypesv5.FilterOperator, tagKey string) string {
+	subqueryBuilder := sqlbuilder.NewSelectBuilder()
+
+	if operation == qbtypesv5.FilterOperatorExists || operation == qbtypesv5.FilterOperatorNotExists {
+		buildSubqueryForTagKey(subqueryBuilder, tagKey)
+	} else {
+		// All other tag operators take the positive form of the value predicate
+		// and toggle the EXISTS wrapper for negation. Inverse() flips Not<X> → <X>.
+		positiveOperation := operation
+		if operation.IsNegativeOperator() {
+			positiveOperation = operation.Inverse()
+		}
+		valuePredicate := v.buildStringOperation(subqueryBuilder, ctx, positiveOperation, "t.value", tagKey)
+		if valuePredicate == "" {
+			return ""
+		}
+		buildSubqueryForTagKeyAndValue(subqueryBuilder, tagKey, valuePredicate)
+	}
+
+	if operation.IsNegativeOperator() {
+		return v.selectBuilder.NotExists(subqueryBuilder)
+	}
+	return v.selectBuilder.Exists(subqueryBuilder)
+}
+
+func buildSubqueryForTagKey(subqueryBuilder *sqlbuilder.SelectBuilder, tagKey string) *sqlbuilder.SelectBuilder {
+	const dashboardTagKind = `"dashboard"`
+
+	return subqueryBuilder.
+		Select("1").
+		From("tag_relation tr").
+		Join("tag t", "t.id = tr.tag_id").
+		Where(
+			subqueryBuilder.Equal("tr.kind", dashboardTagKind),
+			"tr.resource_id = dashboard.id",
+			"LOWER(t.key) = LOWER("+subqueryBuilder.Var(tagKey)+")",
+		)
+}
+
+func buildSubqueryForTagKeyAndValue(subqueryBuilder *sqlbuilder.SelectBuilder, tagKey, valuePredicate string) *sqlbuilder.SelectBuilder {
+	return buildSubqueryForTagKey(subqueryBuilder, tagKey).Where(valuePredicate)
+}
+
+// ─── free-text search ────────────────────────────────────────────────────────
+
+// buildFreeTextTerm matches value as a case-insensitive substring of the
+// dashboard name, description, or any tag key/value.
+func (v *visitor) buildFreeTextTerm(value string) string {
+	nameColumn := string(v.formatter.JSONExtractString("dashboard.data", "$.spec.display.name"))
+	descriptionColumn := string(v.formatter.JSONExtractString("dashboard.data", "$.spec.display.description"))
+	namePredicate := v.buildFreeTextContains(v.selectBuilder, nameColumn, value)
+	descriptionPredicate := v.buildFreeTextContains(v.selectBuilder, descriptionColumn, value)
+
+	subqueryBuilder := sqlbuilder.NewSelectBuilder()
+	keyPredicate := v.buildFreeTextContains(subqueryBuilder, "t.key", value)
+	valuePredicate := v.buildFreeTextContains(subqueryBuilder, "t.value", value)
+	buildSubqueryForFreeTextTag(subqueryBuilder, keyPredicate, valuePredicate)
+	tagPredicate := v.selectBuilder.Exists(subqueryBuilder)
+
+	return v.selectBuilder.Or(namePredicate, descriptionPredicate, tagPredicate)
+}
+
+// buildFreeTextContains emits a case-insensitive contains as
+// LOWER(COALESCE(col, '')) LIKE LOWER(?), identical on SQLite and Postgres.
+// COALESCE keeps a NULL column (an absent description) false rather than NULL —
+// otherwise `NOT (…)` goes NULL and drops every description-less dashboard. The
+// value's % and _ are escaped, and ESCAPE pins backslash as the escape char.
+func (v *visitor) buildFreeTextContains(builder *sqlbuilder.SelectBuilder, columnExpression, value string) string {
+	lowerColumn := string(v.formatter.LowerExpression("COALESCE(" + columnExpression + ", '')"))
+	pattern := "%" + v.formatter.EscapeLikePattern(value) + "%"
+	return fmt.Sprintf("%s LIKE LOWER(%s) ESCAPE '\\'", lowerColumn, builder.Var(pattern))
+}
+
+func buildSubqueryForFreeTextTag(subqueryBuilder *sqlbuilder.SelectBuilder, keyPredicate, valuePredicate string) *sqlbuilder.SelectBuilder {
+	const dashboardTagKind = `"dashboard"`
+
+	return subqueryBuilder.
+		Select("1").
+		From("tag_relation tr").
+		Join("tag t", "t.id = tr.tag_id").
+		Where(
+			subqueryBuilder.Equal("tr.kind", dashboardTagKind),
+			"tr.resource_id = dashboard.id",
+			subqueryBuilder.Or(keyPredicate, valuePredicate),
+		)
+}
+
+// ─── value extraction helpers ───────────────────────────────────────────────
+
+func (v *visitor) addError(format string, arguments ...any) {
+	v.errors = append(v.errors, fmt.Sprintf(format, arguments...))
+}
+
+func (v *visitor) extractSingleStringValue(ctx *grammar.ComparisonContext, keyForError string) (string, bool) {
+	values := ctx.AllValue()
+	if len(values) != 1 {
+		v.addError("expected exactly one value for %q", keyForError)
+		return "", false
+	}
+	return v.extractStringValue(values[0], keyForError)
+}
+
+func (v *visitor) extractSingleBoolValue(ctx *grammar.ComparisonContext) (bool, bool) {
+	values := ctx.AllValue()
+	if len(values) != 1 {
+		v.addError("expected a single boolean (true/false)")
+		return false, false
+	}
+	return v.extractBoolValue(values[0])
+}
+
+func (v *visitor) extractSingleTimestampValue(ctx *grammar.ComparisonContext) (time.Time, bool) {
+	values := ctx.AllValue()
+	if len(values) != 1 {
+		v.addError("expected a single RFC3339 timestamp")
+		return time.Time{}, false
+	}
+	return v.extractTimestampValue(values[0])
+}
+
+func (v *visitor) extractTwoTimestampValues(ctx *grammar.ComparisonContext) ([2]time.Time, bool) {
+	values := ctx.AllValue()
+	if len(values) != 2 {
+		v.addError("BETWEEN expects two RFC3339 timestamps")
+		return [2]time.Time{}, false
+	}
+	a, ok1 := v.extractTimestampValue(values[0])
+	b, ok2 := v.extractTimestampValue(values[1])
+	if !ok1 || !ok2 {
+		return [2]time.Time{}, false
+	}
+	return [2]time.Time{a, b}, true
+}
+
+func (v *visitor) extractStringValueList(ctx *grammar.ComparisonContext, keyForError string) ([]string, bool) {
+	var valuesCtx []grammar.IValueContext
+	switch {
+	case ctx.InClause() != nil:
+		inClause := ctx.InClause()
+		if inClause.ValueList() != nil {
+			valuesCtx = inClause.ValueList().AllValue()
+		} else {
+			valuesCtx = []grammar.IValueContext{inClause.Value()}
+		}
+	case ctx.NotInClause() != nil:
+		notInClause := ctx.NotInClause()
+		if notInClause.ValueList() != nil {
+			valuesCtx = notInClause.ValueList().AllValue()
+		} else {
+			valuesCtx = []grammar.IValueContext{notInClause.Value()}
+		}
+	default:
+		v.addError("IN clause is missing for %q", keyForError)
+		return nil, false
+	}
+	if len(valuesCtx) == 0 {
+		v.addError("IN list for %q is empty", keyForError)
+		return nil, false
+	}
+	out := make([]string, 0, len(valuesCtx))
+	for _, valueContext := range valuesCtx {
+		s, ok := v.extractStringValue(valueContext, keyForError)
+		if !ok {
+			return nil, false
+		}
+		out = append(out, s)
+	}
+	return out, true
+}
+
+func (v *visitor) extractStringValue(ctx grammar.IValueContext, keyForError string) (string, bool) {
+	if ctx.QUOTED_TEXT() != nil {
+		return trimQuotes(ctx.QUOTED_TEXT().GetText()), true
+	}
+	if ctx.KEY() != nil {
+		// Bare tokens are accepted as strings, mirroring the FilterQuery lexer's
+		// treatment of unquoted identifiers on the value side.
+		return ctx.KEY().GetText(), true
+	}
+	v.addError("expected a string value for %q, got %q", keyForError, ctx.GetText())
+	return "", false
+}
+
+func (v *visitor) extractBoolValue(ctx grammar.IValueContext) (bool, bool) {
+	if ctx.BOOL() == nil {
+		v.addError("expected a boolean (true/false), got %q", ctx.GetText())
+		return false, false
+	}
+	return strings.EqualFold(ctx.BOOL().GetText(), "true"), true
+}
+
+func (v *visitor) extractTimestampValue(ctx grammar.IValueContext) (time.Time, bool) {
+	if ctx.QUOTED_TEXT() == nil {
+		v.addError("expected an RFC3339 timestamp string, got %q", ctx.GetText())
+		return time.Time{}, false
+	}
+	raw := trimQuotes(ctx.QUOTED_TEXT().GetText())
+	t, err := time.Parse(time.RFC3339, raw)
+	if err != nil {
+		v.addError("invalid RFC3339 timestamp %q: %s", raw, err.Error())
+		return time.Time{}, false
+	}
+	return t, true
+}
+
+// ─── operator spelling ───────────────────────────────────────────────────────
+
+// operationName returns the user-facing spelling of a FilterOperator, used only in
+// error messages — go-sqlbuilder's Cond helpers emit the SQL keywords.
+func operationName(operation qbtypesv5.FilterOperator) string {
+	switch operation {
+	case qbtypesv5.FilterOperatorEqual:
+		return "="
+	case qbtypesv5.FilterOperatorNotEqual:
+		return "!="
+	case qbtypesv5.FilterOperatorLessThan:
+		return "<"
+	case qbtypesv5.FilterOperatorLessThanOrEq:
+		return "<="
+	case qbtypesv5.FilterOperatorGreaterThan:
+		return ">"
+	case qbtypesv5.FilterOperatorGreaterThanOrEq:
+		return ">="
+	case qbtypesv5.FilterOperatorBetween:
+		return "BETWEEN"
+	case qbtypesv5.FilterOperatorNotBetween:
+		return "NOT BETWEEN"
+	case qbtypesv5.FilterOperatorLike:
+		return "LIKE"
+	case qbtypesv5.FilterOperatorNotLike:
+		return "NOT LIKE"
+	case qbtypesv5.FilterOperatorILike:
+		return "ILIKE"
+	case qbtypesv5.FilterOperatorNotILike:
+		return "NOT ILIKE"
+	case qbtypesv5.FilterOperatorContains:
+		return "CONTAINS"
+	case qbtypesv5.FilterOperatorNotContains:
+		return "NOT CONTAINS"
+	case qbtypesv5.FilterOperatorRegexp:
+		return "REGEXP"
+	case qbtypesv5.FilterOperatorNotRegexp:
+		return "NOT REGEXP"
+	case qbtypesv5.FilterOperatorIn:
+		return "IN"
+	case qbtypesv5.FilterOperatorNotIn:
+		return "NOT IN"
+	case qbtypesv5.FilterOperatorExists:
+		return "EXISTS"
+	case qbtypesv5.FilterOperatorNotExists:
+		return "NOT EXISTS"
+	}
+	return "?"
+}
+
+func trimQuotes(s string) string {
+	if len(s) >= 2 {
+		if (s[0] == '"' && s[len(s)-1] == '"') || (s[0] == '\'' && s[len(s)-1] == '\'') {
+			s = s[1 : len(s)-1]
+		}
+	}
+	s = strings.ReplaceAll(s, `\\`, `\`)
+	s = strings.ReplaceAll(s, `\'`, `'`)
+	return s
+}

pkg/parser/filterquery/sqlcompiler/compiler.go

@@ -1,521 +0,0 @@
-// Package sqlcompiler compiles list-page filter queries to relational-store WHERE clauses; telemetry queries stay on querybuilder's ClickHouse visitor.
-package sqlcompiler
-
-import (
-	"fmt"
-	"strings"
-	"time"
-
-	"github.com/SigNoz/signoz/pkg/parser/filterquery"
-	grammar "github.com/SigNoz/signoz/pkg/parser/filterquery/grammar"
-	"github.com/SigNoz/signoz/pkg/sqlstore"
-	qbtypesv5 "github.com/SigNoz/signoz/pkg/types/querybuildertypes/querybuildertypesv5"
-	"github.com/antlr4-go/antlr/v4"
-	sqlbuilder "github.com/huandu/go-sqlbuilder"
-)
-
-// bunPlaceholderFlavor is any flavor that renders the `?` placeholders bun expects.
-const bunPlaceholderFlavor = sqlbuilder.SQLite
-
-// FieldResolver is the per-feature policy: which keys exist and what each maps to.
-type FieldResolver interface {
-	// ResolveComparison builds the predicate for one `key OP value` term; key keeps the user's casing.
-	ResolveComparison(b *Builder, key string, operation qbtypesv5.FilterOperator, ctx *grammar.ComparisonContext) string
-	// FreeText builds the predicate for a bare token.
-	FreeText(b *Builder, value string) string
-}
-
-// Compiled is a `?`-placeholder WHERE clause with its bun bind args.
-type Compiled struct {
-	SQL  string
-	Args []any
-}
-
-func (c Compiled) IsEmpty() bool {
-	return c.SQL == ""
-}
-
-// Compile on success returns a non-nil *Compiled, empty for an empty query; callers gate on IsEmpty, not nil.
-func Compile(query string, formatter sqlstore.SQLFormatter, resolver FieldResolver) (*Compiled, []string) {
-	if len(strings.TrimSpace(query)) == 0 {
-		return &Compiled{}, nil
-	}
-
-	v := &visitor{
-		builder: &Builder{
-			selectBuilder: sqlbuilder.NewSelectBuilder(),
-			formatter:     formatter,
-		},
-		resolver: resolver,
-	}
-
-	tree, _, collector := filterquery.Parse(query)
-	if len(collector.Errors) > 0 {
-		return nil, collector.Errors
-	}
-	condition, _ := v.visit(tree).(string)
-	if len(v.builder.errors) > 0 {
-		return nil, v.builder.errors
-	}
-	if condition == "" {
-		return &Compiled{}, nil
-	}
-	sql, arguments := v.builder.selectBuilder.Args.CompileWithFlavor(condition, bunPlaceholderFlavor)
-	return &Compiled{SQL: sql, Args: arguments}, nil
-}
-
-// Builder is the per-compile toolbox handed to a FieldResolver.
-type Builder struct {
-	selectBuilder *sqlbuilder.SelectBuilder
-	formatter     sqlstore.SQLFormatter
-	errors        []string
-}
-
-func (b *Builder) SelectBuilder() *sqlbuilder.SelectBuilder {
-	return b.selectBuilder
-}
-
-func (b *Builder) Formatter() sqlstore.SQLFormatter {
-	return b.formatter
-}
-
-func (b *Builder) AddError(format string, arguments ...any) {
-	b.errors = append(b.errors, fmt.Sprintf(format, arguments...))
-}
-
-// StringOperation interns placeholders into sb so nested subquery arguments thread correctly.
-func (b *Builder) StringOperation(sb *sqlbuilder.SelectBuilder, ctx *grammar.ComparisonContext, operation qbtypesv5.FilterOperator, columnExpression, keyForError string) string {
-	switch operation {
-	case qbtypesv5.FilterOperatorEqual:
-		val, ok := b.ExtractSingleStringValue(ctx, keyForError)
-		if !ok {
-			return ""
-		}
-		return sb.Equal(columnExpression, val)
-	case qbtypesv5.FilterOperatorNotEqual:
-		val, ok := b.ExtractSingleStringValue(ctx, keyForError)
-		if !ok {
-			return ""
-		}
-		return sb.NotEqual(columnExpression, val)
-	case qbtypesv5.FilterOperatorLike, qbtypesv5.FilterOperatorNotLike:
-		val, ok := b.ExtractSingleStringValue(ctx, keyForError)
-		if !ok {
-			return ""
-		}
-		if endsWithDanglingEscape(val) {
-			b.AddError("LIKE pattern for %q must not end with an unescaped backslash, use \\\\ to match a literal backslash", keyForError)
-			return ""
-		}
-		like := "LIKE"
-		if operation == qbtypesv5.FilterOperatorNotLike {
-			like = "NOT LIKE"
-		}
-		// ESCAPE pins backslash as the escape char (the Postgres default, SQLite has none).
-		return fmt.Sprintf("%s %s %s ESCAPE '\\'", columnExpression, like, sb.Var(val))
-	case qbtypesv5.FilterOperatorILike, qbtypesv5.FilterOperatorNotILike:
-		val, ok := b.ExtractSingleStringValue(ctx, keyForError)
-		if !ok {
-			return ""
-		}
-		if endsWithDanglingEscape(val) {
-			b.AddError("ILIKE pattern for %q must not end with an unescaped backslash, use \\\\ to match a literal backslash", keyForError)
-			return ""
-		}
-		// SQLite has no ILIKE and Postgres LIKE is case-sensitive, so LOWER both sides.
-		lowerColumn := string(b.formatter.LowerExpression(columnExpression))
-		like := "LIKE"
-		if operation == qbtypesv5.FilterOperatorNotILike {
-			like = "NOT LIKE"
-		}
-		return fmt.Sprintf("%s %s LOWER(%s) ESCAPE '\\'", lowerColumn, like, sb.Var(val))
-	case qbtypesv5.FilterOperatorContains, qbtypesv5.FilterOperatorNotContains:
-		val, ok := b.ExtractSingleStringValue(ctx, keyForError)
-		if !ok {
-			return ""
-		}
-		like := "LIKE"
-		if operation == qbtypesv5.FilterOperatorNotContains {
-			like = "NOT LIKE"
-		}
-		// Escape the user's % and _ so they match literally, then wrap in wildcards.
-		escaped := b.formatter.EscapeLikePattern(val)
-		return fmt.Sprintf("%s %s %s ESCAPE '\\'", columnExpression, like, sb.Var(fmt.Sprintf("%%%s%%", escaped)))
-	case qbtypesv5.FilterOperatorRegexp, qbtypesv5.FilterOperatorNotRegexp:
-		b.AddError("REGEXP filtering on %q is not supported", keyForError)
-		return ""
-	case qbtypesv5.FilterOperatorIn, qbtypesv5.FilterOperatorNotIn:
-		values, ok := b.ExtractStringValueList(ctx, keyForError)
-		if !ok {
-			return ""
-		}
-		arguments := make([]any, len(values))
-		for i, s := range values {
-			arguments[i] = s
-		}
-		if operation == qbtypesv5.FilterOperatorNotIn {
-			return sb.NotIn(columnExpression, arguments...)
-		}
-		return sb.In(columnExpression, arguments...)
-	}
-	b.AddError("operator %s on %q is not implemented", OperationName(operation), keyForError)
-	return ""
-}
-
-func (b *Builder) TimestampComparison(ctx *grammar.ComparisonContext, operation qbtypesv5.FilterOperator, columnExpression string) string {
-	switch operation {
-	case qbtypesv5.FilterOperatorEqual, qbtypesv5.FilterOperatorNotEqual,
-		qbtypesv5.FilterOperatorLessThan, qbtypesv5.FilterOperatorLessThanOrEq,
-		qbtypesv5.FilterOperatorGreaterThan, qbtypesv5.FilterOperatorGreaterThanOrEq:
-		t, ok := b.extractSingleTimestampValue(ctx)
-		if !ok {
-			return ""
-		}
-		switch operation {
-		case qbtypesv5.FilterOperatorEqual:
-			return b.selectBuilder.Equal(columnExpression, t)
-		case qbtypesv5.FilterOperatorNotEqual:
-			return b.selectBuilder.NotEqual(columnExpression, t)
-		case qbtypesv5.FilterOperatorLessThan:
-			return b.selectBuilder.LessThan(columnExpression, t)
-		case qbtypesv5.FilterOperatorLessThanOrEq:
-			return b.selectBuilder.LessEqualThan(columnExpression, t)
-		case qbtypesv5.FilterOperatorGreaterThan:
-			return b.selectBuilder.GreaterThan(columnExpression, t)
-		case qbtypesv5.FilterOperatorGreaterThanOrEq:
-			return b.selectBuilder.GreaterEqualThan(columnExpression, t)
-		}
-	case qbtypesv5.FilterOperatorBetween, qbtypesv5.FilterOperatorNotBetween:
-		timestamps, ok := b.extractTwoTimestampValues(ctx)
-		if !ok {
-			return ""
-		}
-		if operation == qbtypesv5.FilterOperatorNotBetween {
-			return b.selectBuilder.NotBetween(columnExpression, timestamps[0], timestamps[1])
-		}
-		return b.selectBuilder.Between(columnExpression, timestamps[0], timestamps[1])
-	}
-	b.AddError("operator %s on timestamp is not implemented", OperationName(operation))
-	return ""
-}
-
-func (b *Builder) BoolComparison(ctx *grammar.ComparisonContext, operation qbtypesv5.FilterOperator, columnExpression string) string {
-	value, ok := b.extractSingleBoolValue(ctx)
-	if !ok {
-		return ""
-	}
-	if operation == qbtypesv5.FilterOperatorNotEqual {
-		return b.selectBuilder.NotEqual(columnExpression, value)
-	}
-	return b.selectBuilder.Equal(columnExpression, value)
-}
-
-// A pattern ending in an unescaped backslash never matches on sqlite and errors on Postgres.
-func endsWithDanglingEscape(value string) bool {
-	trailing := len(value) - len(strings.TrimRight(value, `\`))
-	return trailing%2 == 1
-}
-
-// FreeTextContains COALESCEs the column so NOT (...) does not go NULL and drop rows where it is absent.
-func (b *Builder) FreeTextContains(sb *sqlbuilder.SelectBuilder, columnExpression, value string) string {
-	lowerColumn := string(b.formatter.LowerExpression(fmt.Sprintf("COALESCE(%s, '')", columnExpression)))
-	pattern := fmt.Sprintf("%%%s%%", b.formatter.EscapeLikePattern(value))
-	return fmt.Sprintf("%s LIKE LOWER(%s) ESCAPE '\\'", lowerColumn, sb.Var(pattern))
-}
-
-func (b *Builder) ExtractSingleStringValue(ctx *grammar.ComparisonContext, keyForError string) (string, bool) {
-	values := ctx.AllValue()
-	if len(values) != 1 {
-		b.AddError("expected exactly one value for %q", keyForError)
-		return "", false
-	}
-	return b.extractStringValue(values[0], keyForError)
-}
-
-func (b *Builder) ExtractStringValueList(ctx *grammar.ComparisonContext, keyForError string) ([]string, bool) {
-	var valuesCtx []grammar.IValueContext
-	switch {
-	case ctx.InClause() != nil:
-		inClause := ctx.InClause()
-		if inClause.ValueList() != nil {
-			valuesCtx = inClause.ValueList().AllValue()
-		} else {
-			valuesCtx = []grammar.IValueContext{inClause.Value()}
-		}
-	case ctx.NotInClause() != nil:
-		notInClause := ctx.NotInClause()
-		if notInClause.ValueList() != nil {
-			valuesCtx = notInClause.ValueList().AllValue()
-		} else {
-			valuesCtx = []grammar.IValueContext{notInClause.Value()}
-		}
-	default:
-		b.AddError("IN clause is missing for %q", keyForError)
-		return nil, false
-	}
-	if len(valuesCtx) == 0 {
-		b.AddError("IN list for %q is empty", keyForError)
-		return nil, false
-	}
-	out := make([]string, 0, len(valuesCtx))
-	for _, valueContext := range valuesCtx {
-		s, ok := b.extractStringValue(valueContext, keyForError)
-		if !ok {
-			return nil, false
-		}
-		out = append(out, s)
-	}
-	return out, true
-}
-
-func (b *Builder) extractSingleBoolValue(ctx *grammar.ComparisonContext) (bool, bool) {
-	values := ctx.AllValue()
-	if len(values) != 1 {
-		b.AddError("expected a single boolean (true/false)")
-		return false, false
-	}
-	return b.extractBoolValue(values[0])
-}
-
-func (b *Builder) extractSingleTimestampValue(ctx *grammar.ComparisonContext) (time.Time, bool) {
-	values := ctx.AllValue()
-	if len(values) != 1 {
-		b.AddError("expected a single RFC3339 timestamp")
-		return time.Time{}, false
-	}
-	return b.extractTimestampValue(values[0])
-}
-
-func (b *Builder) extractTwoTimestampValues(ctx *grammar.ComparisonContext) ([2]time.Time, bool) {
-	values := ctx.AllValue()
-	if len(values) != 2 {
-		b.AddError("BETWEEN expects two RFC3339 timestamps")
-		return [2]time.Time{}, false
-	}
-	first, ok1 := b.extractTimestampValue(values[0])
-	second, ok2 := b.extractTimestampValue(values[1])
-	if !ok1 || !ok2 {
-		return [2]time.Time{}, false
-	}
-	return [2]time.Time{first, second}, true
-}
-
-func (b *Builder) extractStringValue(ctx grammar.IValueContext, keyForError string) (string, bool) {
-	if ctx.QUOTED_TEXT() != nil {
-		return trimQuotes(ctx.QUOTED_TEXT().GetText()), true
-	}
-	if ctx.KEY() != nil {
-		return ctx.KEY().GetText(), true
-	}
-	b.AddError("expected a string value for %q, got %q", keyForError, ctx.GetText())
-	return "", false
-}
-
-func (b *Builder) extractBoolValue(ctx grammar.IValueContext) (bool, bool) {
-	if ctx.BOOL() == nil {
-		b.AddError("expected a boolean (true/false), got %q", ctx.GetText())
-		return false, false
-	}
-	return strings.EqualFold(ctx.BOOL().GetText(), "true"), true
-}
-
-func (b *Builder) extractTimestampValue(ctx grammar.IValueContext) (time.Time, bool) {
-	if ctx.QUOTED_TEXT() == nil {
-		b.AddError("expected an RFC3339 timestamp string, got %q", ctx.GetText())
-		return time.Time{}, false
-	}
-	raw := trimQuotes(ctx.QUOTED_TEXT().GetText())
-	t, err := time.Parse(time.RFC3339, raw)
-	if err != nil {
-		b.AddError("invalid RFC3339 timestamp %q: %s", raw, err.Error())
-		return time.Time{}, false
-	}
-	return t, true
-}
-
-type visitor struct {
-	grammar.BaseFilterQueryVisitor
-	builder  *Builder
-	resolver FieldResolver
-}
-
-func (v *visitor) visit(tree antlr.ParseTree) any {
-	if tree == nil {
-		return nil
-	}
-	return tree.Accept(v)
-}
-
-func (v *visitor) VisitQuery(ctx *grammar.QueryContext) any {
-	return v.visit(ctx.Expression())
-}
-
-func (v *visitor) VisitExpression(ctx *grammar.ExpressionContext) any {
-	return v.visit(ctx.OrExpression())
-}
-
-func (v *visitor) VisitOrExpression(ctx *grammar.OrExpressionContext) any {
-	parts := ctx.AllAndExpression()
-	conditions := make([]string, 0, len(parts))
-	for _, part := range parts {
-		if condition, ok := v.visit(part).(string); ok && condition != "" {
-			conditions = append(conditions, condition)
-		}
-	}
-	switch len(conditions) {
-	case 0:
-		return ""
-	case 1:
-		return conditions[0]
-	default:
-		return v.builder.selectBuilder.Or(conditions...)
-	}
-}
-
-func (v *visitor) VisitAndExpression(ctx *grammar.AndExpressionContext) any {
-	parts := ctx.AllUnaryExpression()
-	conditions := make([]string, 0, len(parts))
-	for _, part := range parts {
-		if condition, ok := v.visit(part).(string); ok && condition != "" {
-			conditions = append(conditions, condition)
-		}
-	}
-	switch len(conditions) {
-	case 0:
-		return ""
-	case 1:
-		return conditions[0]
-	default:
-		return v.builder.selectBuilder.And(conditions...)
-	}
-}
-
-func (v *visitor) VisitUnaryExpression(ctx *grammar.UnaryExpressionContext) any {
-	condition, _ := v.visit(ctx.Primary()).(string)
-	if condition == "" {
-		return ""
-	}
-	if ctx.NOT() != nil {
-		return fmt.Sprintf("NOT (%s)", condition)
-	}
-	return condition
-}
-
-func (v *visitor) VisitPrimary(ctx *grammar.PrimaryContext) any {
-	if ctx.OrExpression() != nil {
-		return v.visit(ctx.OrExpression())
-	}
-	if ctx.Comparison() != nil {
-		return v.visit(ctx.Comparison())
-	}
-	// A quoted lone token matches its contents literally, the escape hatch for a phrase that looks like DSL.
-	return v.resolver.FreeText(v.builder, trimQuotes(ctx.GetText()))
-}
-
-func (v *visitor) VisitComparison(ctx *grammar.ComparisonContext) any {
-	key := strings.TrimSpace(ctx.Key().GetText())
-	operation, ok := v.extractOperation(ctx)
-	if !ok {
-		return ""
-	}
-	return v.resolver.ResolveComparison(v.builder, key, operation, ctx)
-}
-
-func (v *visitor) extractOperation(ctx *grammar.ComparisonContext) (qbtypesv5.FilterOperator, bool) {
-	maybeNot := func(operation qbtypesv5.FilterOperator) qbtypesv5.FilterOperator {
-		if ctx.NOT() != nil {
-			return operation.Inverse()
-		}
-		return operation
-	}
-	switch {
-	case ctx.EQUALS() != nil:
-		return qbtypesv5.FilterOperatorEqual, true
-	case ctx.NOT_EQUALS() != nil, ctx.NEQ() != nil:
-		return qbtypesv5.FilterOperatorNotEqual, true
-	case ctx.LT() != nil:
-		return qbtypesv5.FilterOperatorLessThan, true
-	case ctx.LE() != nil:
-		return qbtypesv5.FilterOperatorLessThanOrEq, true
-	case ctx.GT() != nil:
-		return qbtypesv5.FilterOperatorGreaterThan, true
-	case ctx.GE() != nil:
-		return qbtypesv5.FilterOperatorGreaterThanOrEq, true
-	case ctx.BETWEEN() != nil:
-		return maybeNot(qbtypesv5.FilterOperatorBetween), true
-	case ctx.LIKE() != nil:
-		return maybeNot(qbtypesv5.FilterOperatorLike), true
-	case ctx.ILIKE() != nil:
-		return maybeNot(qbtypesv5.FilterOperatorILike), true
-	case ctx.CONTAINS() != nil:
-		return maybeNot(qbtypesv5.FilterOperatorContains), true
-	case ctx.REGEXP() != nil:
-		return maybeNot(qbtypesv5.FilterOperatorRegexp), true
-	case ctx.InClause() != nil:
-		return qbtypesv5.FilterOperatorIn, true
-	case ctx.NotInClause() != nil:
-		return qbtypesv5.FilterOperatorNotIn, true
-	case ctx.EXISTS() != nil:
-		return maybeNot(qbtypesv5.FilterOperatorExists), true
-	}
-	v.builder.AddError("could not determine operator in expression %q", ctx.GetText())
-	return qbtypesv5.FilterOperatorUnknown, false
-}
-
-// OperationName is the user-facing spelling, used only in error messages.
-func OperationName(operation qbtypesv5.FilterOperator) string {
-	switch operation {
-	case qbtypesv5.FilterOperatorEqual:
-		return "="
-	case qbtypesv5.FilterOperatorNotEqual:
-		return "!="
-	case qbtypesv5.FilterOperatorLessThan:
-		return "<"
-	case qbtypesv5.FilterOperatorLessThanOrEq:
-		return "<="
-	case qbtypesv5.FilterOperatorGreaterThan:
-		return ">"
-	case qbtypesv5.FilterOperatorGreaterThanOrEq:
-		return ">="
-	case qbtypesv5.FilterOperatorBetween:
-		return "BETWEEN"
-	case qbtypesv5.FilterOperatorNotBetween:
-		return "NOT BETWEEN"
-	case qbtypesv5.FilterOperatorLike:
-		return "LIKE"
-	case qbtypesv5.FilterOperatorNotLike:
-		return "NOT LIKE"
-	case qbtypesv5.FilterOperatorILike:
-		return "ILIKE"
-	case qbtypesv5.FilterOperatorNotILike:
-		return "NOT ILIKE"
-	case qbtypesv5.FilterOperatorContains:
-		return "CONTAINS"
-	case qbtypesv5.FilterOperatorNotContains:
-		return "NOT CONTAINS"
-	case qbtypesv5.FilterOperatorRegexp:
-		return "REGEXP"
-	case qbtypesv5.FilterOperatorNotRegexp:
-		return "NOT REGEXP"
-	case qbtypesv5.FilterOperatorIn:
-		return "IN"
-	case qbtypesv5.FilterOperatorNotIn:
-		return "NOT IN"
-	case qbtypesv5.FilterOperatorExists:
-		return "EXISTS"
-	case qbtypesv5.FilterOperatorNotExists:
-		return "NOT EXISTS"
-	}
-	return "?"
-}
-
-func trimQuotes(s string) string {
-	if len(s) >= 2 {
-		if (s[0] == '"' && s[len(s)-1] == '"') || (s[0] == '\'' && s[len(s)-1] == '\'') {
-			s = s[1 : len(s)-1]
-		}
-	}
-	s = strings.ReplaceAll(s, `\\`, `\`)
-	s = strings.ReplaceAll(s, `\'`, `'`)
-	return s
-}

tests/fixtures/queriercommon.py

@@ -1,4 +1,4 @@
-"""Seed data for the queriercommon keyless-semantics tests.
+"""Seed data for the queriercommon keyless-semantics and explicit-context tests.
 
 Three identities exist in every signal. GOLD and SILVER carry the test keys.
 NONE carries no key at all. The tests assert which identities a filter
@@ -8,6 +8,7 @@ The attribute names are outside every semantic-convention family, so the
 seeded data pins base behavior with any semconv overlay state.
 """
 
+import json
 from collections.abc import Callable, Generator
 from datetime import UTC, datetime, timedelta
 
@@ -122,3 +123,103 @@ def keyless_series(insert_metrics: Callable[[list[Metrics]], None]) -> Generator
         ]
     )
     yield start, start + points * 60
+
+
+EXPLICIT_PREFIX = "explicit-ctx"
+# String attribute that identifies the row. It has one context only. Each
+# assertion reads it back.
+IDENTITY_KEY = "probe.id"
+# Attribute with no column of the same name. It tests a key under the
+# signal's own context that metadata does not know. On logs, the rows without
+# the attribute have the value nested in the body JSON.
+ATTRIBUTE_ONLY_KEY = "route.tag"
+CONTESTED_VALUE = "checkout"
+
+# Row identities. Each row shows where the contested value is:
+# - COLUMN_ONLY: in the column (`name` on spans, `severity_text` on logs).
+# - ATTRIBUTE_ONLY: in the string attribute with the same name.
+# - BOTH: in the column and in the string attribute.
+# - NEITHER: in none of them.
+# - NUMBER_ATTRIBUTE: in a number attribute with the same name. Its data
+#   type is different from the column.
+COLUMN_ONLY = f"{EXPLICIT_PREFIX}-column"
+ATTRIBUTE_ONLY = f"{EXPLICIT_PREFIX}-attribute"
+BOTH = f"{EXPLICIT_PREFIX}-both"
+NEITHER = f"{EXPLICIT_PREFIX}-neither"
+NUMBER_ATTRIBUTE = f"{EXPLICIT_PREFIX}-number"
+NUMBER_VALUE = 42
+
+# (identity, value in the column, value in the string attribute, value in
+#  the number attribute, resource service.name, attribute service.name,
+#  has route.tag, insert offset in seconds)
+ROWS = [
+    (COLUMN_ONLY, True, False, False, "svc-a", None, True, 1),
+    (ATTRIBUTE_ONLY, False, True, False, "svc-b", "svc-a", False, 2),
+    (BOTH, True, True, False, "svc-a", "svc-a", True, 3),
+    (NEITHER, False, False, False, "svc-b", "svc-b", False, 4),
+    (NUMBER_ATTRIBUTE, False, False, True, "svc-b", None, False, 5),
+]
+
+# Logs only. The scope name is a declared path. A scope attribute also has
+# the name `name`. A second scope attribute has a plain name.
+SCOPE_NAME = "scope-a"
+SCOPE_ATTRIBUTE_KEY = "env"
+SCOPE_ATTRIBUTE_VALUE = "prod"
+
+
+@pytest.fixture(name="ambiguous_rows", scope="function")
+def ambiguous_rows(
+    insert_logs: Callable[[list[Logs]], None],
+    insert_traces: Callable[[list[Traces]], None],
+) -> Generator[datetime]:
+    """Inserts one span and one log for each identity. Every row has a
+    resource `service.name`. Some rows also have a span or log attribute
+    `service.name` with a different value. On logs, the rows without the
+    `route.tag` attribute have the value in the body JSON. Logs with the
+    column value have the scope name. Logs with the attribute value have the
+    scope attributes. Yields the base timestamp."""
+    now = datetime.now(tz=UTC).replace(microsecond=0) - timedelta(minutes=1)
+
+    insert_traces(
+        [
+            Traces(
+                timestamp=now - timedelta(seconds=offset),
+                duration=timedelta(milliseconds=10),
+                trace_id=TraceIdGenerator.trace_id(),
+                span_id=TraceIdGenerator.span_id(),
+                name=CONTESTED_VALUE if column else "other",
+                kind=TracesKind.SPAN_KIND_SERVER,
+                status_code=TracesStatusCode.STATUS_CODE_OK,
+                resources={"service.name": resource_service},
+                attributes={
+                    IDENTITY_KEY: identity,
+                    **({"name": CONTESTED_VALUE} if attribute else {}),
+                    **({"name": NUMBER_VALUE} if number else {}),
+                    **({"service.name": attribute_service} if attribute_service else {}),
+                    **({ATTRIBUTE_ONLY_KEY: CONTESTED_VALUE} if tagged else {}),
+                },
+            )
+            for identity, column, attribute, number, resource_service, attribute_service, tagged, offset in ROWS
+        ]
+    )
+    insert_logs(
+        [
+            Logs(
+                timestamp=now - timedelta(seconds=offset),
+                body=json.dumps({} if tagged else {"route": {"tag": CONTESTED_VALUE}}),
+                severity_text="ERROR" if column else "INFO",
+                scope_name=SCOPE_NAME if column else "",
+                scope_attributes={"name": CONTESTED_VALUE, SCOPE_ATTRIBUTE_KEY: SCOPE_ATTRIBUTE_VALUE} if attribute else {},
+                resources={"service.name": resource_service},
+                attributes={
+                    IDENTITY_KEY: identity,
+                    **({"severity_text": "ERROR"} if attribute else {}),
+                    **({"severity_text": NUMBER_VALUE} if number else {}),
+                    **({"service.name": attribute_service} if attribute_service else {}),
+                    **({ATTRIBUTE_ONLY_KEY: CONTESTED_VALUE} if tagged else {}),
+                },
+            )
+            for identity, column, attribute, number, resource_service, attribute_service, tagged, offset in ROWS
+        ]
+    )
+    yield now

tests/integration/tests/queriercommon/07_explicit_context.py

@@ -0,0 +1,381 @@
+from collections.abc import Callable
+from datetime import datetime, timedelta
+from http import HTTPStatus
+
+import pytest
+
+from fixtures import types
+from fixtures.auth import USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD
+from fixtures.querier import (
+    RequestType,
+    assert_scalar_value,
+    build_aggregation,
+    build_group_by_field,
+    build_order_by,
+    build_raw_query,
+    build_scalar_query,
+    get_all_warnings,
+    get_column_data_from_response,
+    get_scalar_table_data,
+    make_query_request,
+)
+from fixtures.queriercommon import (
+    ATTRIBUTE_ONLY,
+    BOTH,
+    COLUMN_ONLY,
+    EXPLICIT_PREFIX,
+    IDENTITY_KEY,
+    NEITHER,
+    NUMBER_ATTRIBUTE,
+)
+
+# One name can exist in more than one place. `name` is a span column and a
+# span attribute. `severity_text` is a log column and a log attribute.
+# `service.name` is a resource attribute and a span or log attribute.
+#
+# Rules for a filter:
+# - A key with an explicit context reads that context only.
+# - A bare key that is a column and an attribute reads both. The query
+#   returns an ambiguity warning.
+# - A bare key that is a resource attribute and an attribute reads the
+#   resource attribute. The query returns an ambiguity warning.
+# - An `attribute.` key returns the warning when the attribute has two data
+#   types.
+# - A string operand matches a number attribute through a text cast.
+# - A key under the signal's own context (`span.`, `log.`) that exists only
+#   as an attribute reads the attribute. On logs it also reads the body JSON
+#   path.
+FILTER_MATRIX = [
+    pytest.param("{contested} = '{value}'", {COLUMN_ONLY, ATTRIBUTE_ONLY, BOTH}, True, id="bare_column_and_attribute"),
+    pytest.param("{own}.{contested} = '{value}'", {COLUMN_ONLY, BOTH}, False, id="own_context_column_only"),
+    pytest.param("attribute.{contested} = '{value}'", {ATTRIBUTE_ONLY, BOTH}, True, id="attribute_context_warns_about_two_types"),
+    pytest.param("{contested} != '{value}'", {NEITHER, NUMBER_ATTRIBUTE}, True, id="bare_negative_excludes_every_carrier"),
+    pytest.param("{contested} EXISTS", {COLUMN_ONLY, ATTRIBUTE_ONLY, BOTH, NEITHER, NUMBER_ATTRIBUTE}, True, id="bare_exists_is_the_column"),
+    pytest.param("{contested} NOT EXISTS", set(), True, id="bare_not_exists_is_never"),
+    pytest.param("attribute.{contested} EXISTS", {ATTRIBUTE_ONLY, BOTH, NUMBER_ATTRIBUTE}, True, id="attribute_exists_spans_both_types"),
+    pytest.param("attribute.{contested} NOT EXISTS", {COLUMN_ONLY, NEITHER}, True, id="attribute_not_exists"),
+    pytest.param("{contested} = '42'", {NUMBER_ATTRIBUTE}, True, id="bare_string_operand_reaches_the_number_attribute"),
+    pytest.param("attribute.{contested}:string = '{value}'", {ATTRIBUTE_ONLY, BOTH}, False, id="type_suffix_selects_the_string_attribute"),
+    pytest.param("attribute.{contested}:float64 = 42", {NUMBER_ATTRIBUTE}, False, id="type_suffix_selects_the_number_attribute"),
+    pytest.param("service.name = 'svc-a'", {COLUMN_ONLY, BOTH}, True, id="bare_resource_wins_with_warning"),
+    pytest.param("service.name != 'svc-a'", {ATTRIBUTE_ONLY, NEITHER, NUMBER_ATTRIBUTE}, True, id="bare_resource_negative"),
+    pytest.param("resource.service.name = 'svc-a'", {COLUMN_ONLY, BOTH}, False, id="resource_context_no_warning"),
+    pytest.param("resource.service.name != 'svc-a'", {ATTRIBUTE_ONLY, NEITHER, NUMBER_ATTRIBUTE}, False, id="resource_context_negative"),
+    pytest.param("attribute.service.name = 'svc-a'", {ATTRIBUTE_ONLY, BOTH}, False, id="attribute_context_no_warning"),
+    pytest.param(
+        "{own}.route.tag = 'checkout'",
+        {"traces": {COLUMN_ONLY, BOTH}, "logs": {COLUMN_ONLY, ATTRIBUTE_ONLY, BOTH, NEITHER, NUMBER_ATTRIBUTE}},
+        False,
+        id="own_context_miss_corrects_to_attribute_and_on_logs_to_body",
+    ),
+    pytest.param("route.tag = 'checkout'", {COLUMN_ONLY, BOTH}, False, id="bare_attribute_only_key"),
+]
+
+SIGNALS = [
+    pytest.param("traces", "span", "name", "checkout", "other", id="traces"),
+    pytest.param("logs", "log", "severity_text", "ERROR", "INFO", id="logs"),
+]
+
+
+@pytest.mark.parametrize("expression_template,expected,expects_ambiguity_warning", FILTER_MATRIX)
+@pytest.mark.parametrize("signal,own_context,contested,value,other_value", SIGNALS)
+def test_filter_resolution(
+    signoz: types.SigNoz,
+    create_user_admin: None,  # pylint: disable=unused-argument
+    get_token: Callable[[str, str], str],
+    ambiguous_rows: datetime,
+    signal: str,
+    own_context: str,
+    contested: str,
+    value: str,
+    other_value: str,  # pylint: disable=unused-argument
+    expression_template: str,
+    expected: set[str] | dict[str, set[str]],
+    expects_ambiguity_warning: bool,
+) -> None:
+    token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
+    expression = expression_template.format(own=own_context, contested=contested, value=value)
+
+    response = make_query_request(
+        signoz,
+        token,
+        start_ms=int((ambiguous_rows - timedelta(minutes=2)).timestamp() * 1000),
+        end_ms=int((ambiguous_rows + timedelta(minutes=1)).timestamp() * 1000),
+        request_type=RequestType.RAW,
+        queries=[
+            build_raw_query(
+                "A",
+                signal,
+                limit=100,
+                filter_expression=expression,
+                order=[build_order_by("timestamp", "asc")],
+                select_fields=[{"name": IDENTITY_KEY}],
+            )
+        ],
+    )
+    assert response.status_code == HTTPStatus.OK, response.text
+
+    matched = {row for row in get_column_data_from_response(response.json(), IDENTITY_KEY) if row.startswith(EXPLICIT_PREFIX)}
+    assert matched == (expected[signal] if isinstance(expected, dict) else expected), expression
+
+    warnings = [w["message"] for w in get_all_warnings(response.json())]
+    assert any("ambiguous" in w for w in warnings) == expects_ambiguity_warning, warnings
+
+
+# Rules for a group by:
+# - A bare key that is a column and an attribute groups by the column only.
+# - A key with an explicit context groups by that context only.
+GROUP_BY_MATRIX = [
+    pytest.param(None, {"{value}": 2, "{other}": 3}, id="bare_groups_by_the_column"),
+    pytest.param("own", {"{value}": 2, "{other}": 3}, id="own_context_groups_by_the_column"),
+    pytest.param("attribute", {"{value}": 2}, id="attribute_context_groups_by_the_attribute"),
+]
+
+
+@pytest.mark.parametrize("context,expected_template", GROUP_BY_MATRIX)
+@pytest.mark.parametrize("signal,own_context,contested,value,other_value", SIGNALS)
+def test_group_by_resolution(
+    signoz: types.SigNoz,
+    create_user_admin: None,  # pylint: disable=unused-argument
+    get_token: Callable[[str, str], str],
+    ambiguous_rows: datetime,
+    signal: str,
+    own_context: str,
+    contested: str,
+    value: str,
+    other_value: str,
+    context: str | None,
+    expected_template: dict[str, int],
+) -> None:
+    token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
+    field_context = own_context if context == "own" else context
+
+    response = make_query_request(
+        signoz,
+        token,
+        start_ms=int((ambiguous_rows - timedelta(minutes=2)).timestamp() * 1000),
+        end_ms=int((ambiguous_rows + timedelta(minutes=1)).timestamp() * 1000),
+        request_type=RequestType.SCALAR,
+        queries=[
+            build_scalar_query(
+                "A",
+                signal,
+                [build_aggregation("count()", "rows")],
+                group_by=[build_group_by_field(contested, "string", field_context) if field_context else {"name": contested}],
+                filter_expression=f"{IDENTITY_KEY} LIKE '{EXPLICIT_PREFIX}%'",
+            )
+        ],
+    )
+    assert response.status_code == HTTPStatus.OK, response.text
+
+    expected = {key.format(value=value, other=other_value): count for key, count in expected_template.items()}
+    groups = {row[0]: row[1] for row in get_scalar_table_data(response.json()) if row[0] in expected}
+    assert groups == expected, get_scalar_table_data(response.json())
+
+
+# Rule for a raw select of a bare key that is a resource attribute and an
+# attribute: each row shows the resource value. This is also true for a row
+# where the attribute has a different value.
+@pytest.mark.parametrize("signal", ["traces", "logs"])
+def test_select_of_ambiguous_name(
+    signoz: types.SigNoz,
+    create_user_admin: None,  # pylint: disable=unused-argument
+    get_token: Callable[[str, str], str],
+    ambiguous_rows: datetime,
+    signal: str,
+) -> None:
+    token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
+
+    response = make_query_request(
+        signoz,
+        token,
+        start_ms=int((ambiguous_rows - timedelta(minutes=2)).timestamp() * 1000),
+        end_ms=int((ambiguous_rows + timedelta(minutes=1)).timestamp() * 1000),
+        request_type=RequestType.RAW,
+        queries=[
+            build_raw_query(
+                "A",
+                signal,
+                limit=100,
+                filter_expression=f"{IDENTITY_KEY} LIKE '{EXPLICIT_PREFIX}%'",
+                order=[build_order_by("timestamp", "asc")],
+                select_fields=[{"name": IDENTITY_KEY}, {"name": "service.name"}],
+            )
+        ],
+    )
+    assert response.status_code == HTTPStatus.OK, response.text
+
+    rows = response.json()["data"]["data"]["results"][0]["rows"] or []
+    by_identity = {row["data"][IDENTITY_KEY]: row["data"]["service.name"] for row in rows if row["data"].get(IDENTITY_KEY, "").startswith(EXPLICIT_PREFIX)}
+    assert by_identity == {
+        COLUMN_ONLY: "svc-a",
+        ATTRIBUTE_ONLY: "svc-b",
+        BOTH: "svc-a",
+        NEITHER: "svc-b",
+        NUMBER_ATTRIBUTE: "svc-b",
+    }
+
+
+# Rules for an order by, descending, with the timestamp descending as the
+# second key:
+# - A bare key or a key under the signal's own context sorts by the column
+#   only.
+# - An `attribute.` key sorts by the attribute on traces. The number
+#   attribute sorts as text. Rows without the attribute come last.
+# - An `attribute.` key sorts by the column on logs.
+BY_COLUMN = [ATTRIBUTE_ONLY, NEITHER, NUMBER_ATTRIBUTE, COLUMN_ONLY, BOTH]
+ORDER_BY_MATRIX = [
+    pytest.param(None, {"traces": BY_COLUMN, "logs": BY_COLUMN}, id="bare_orders_by_the_column"),
+    pytest.param("own", {"traces": BY_COLUMN, "logs": BY_COLUMN}, id="own_context_orders_by_the_column"),
+    pytest.param(
+        "attribute",
+        {"traces": [ATTRIBUTE_ONLY, BOTH, NUMBER_ATTRIBUTE, COLUMN_ONLY, NEITHER], "logs": BY_COLUMN},
+        id="attribute_context_orders_by_the_attribute_on_traces_only",
+    ),
+]
+
+
+@pytest.mark.parametrize("context,expected", ORDER_BY_MATRIX)
+@pytest.mark.parametrize("signal,own_context,contested,value,other_value", SIGNALS)
+def test_order_by_resolution(
+    signoz: types.SigNoz,
+    create_user_admin: None,  # pylint: disable=unused-argument
+    get_token: Callable[[str, str], str],
+    ambiguous_rows: datetime,
+    signal: str,
+    own_context: str,
+    contested: str,
+    value: str,  # pylint: disable=unused-argument
+    other_value: str,  # pylint: disable=unused-argument
+    context: str | None,
+    expected: dict[str, list[str]],
+) -> None:
+    token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
+    prefix = f"{own_context}." if context == "own" else f"{context}." if context else ""
+
+    response = make_query_request(
+        signoz,
+        token,
+        start_ms=int((ambiguous_rows - timedelta(minutes=2)).timestamp() * 1000),
+        end_ms=int((ambiguous_rows + timedelta(minutes=1)).timestamp() * 1000),
+        request_type=RequestType.RAW,
+        queries=[
+            build_raw_query(
+                "A",
+                signal,
+                limit=100,
+                filter_expression=f"{IDENTITY_KEY} LIKE '{EXPLICIT_PREFIX}%'",
+                order=[build_order_by(f"{prefix}{contested}", "desc"), build_order_by("timestamp", "desc")],
+                select_fields=[{"name": IDENTITY_KEY}],
+            )
+        ],
+    )
+    assert response.status_code == HTTPStatus.OK, response.text
+
+    ordered = [row for row in get_column_data_from_response(response.json(), IDENTITY_KEY) if row.startswith(EXPLICIT_PREFIX)]
+    assert ordered == expected[signal]
+
+
+# Rules for an aggregation argument:
+# - A bare key counts the values of the column only.
+# - An `attribute.` key counts the attribute in both data types. The number
+#   attribute adds one distinct value.
+AGGREGATION_MATRIX = [
+    pytest.param(None, 2, id="bare_counts_the_column"),
+    pytest.param("own", 2, id="own_context_counts_the_column"),
+    pytest.param("attribute", 2, id="attribute_context_counts_both_attribute_types"),
+]
+
+
+@pytest.mark.parametrize("context,expected", AGGREGATION_MATRIX)
+@pytest.mark.parametrize("signal,own_context,contested,value,other_value", SIGNALS)
+def test_aggregation_argument_resolution(
+    signoz: types.SigNoz,
+    create_user_admin: None,  # pylint: disable=unused-argument
+    get_token: Callable[[str, str], str],
+    ambiguous_rows: datetime,
+    signal: str,
+    own_context: str,
+    contested: str,
+    value: str,  # pylint: disable=unused-argument
+    other_value: str,  # pylint: disable=unused-argument
+    context: str | None,
+    expected: int,
+) -> None:
+    token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
+    prefix = f"{own_context}." if context == "own" else f"{context}." if context else ""
+
+    response = make_query_request(
+        signoz,
+        token,
+        start_ms=int((ambiguous_rows - timedelta(minutes=2)).timestamp() * 1000),
+        end_ms=int((ambiguous_rows + timedelta(minutes=1)).timestamp() * 1000),
+        request_type=RequestType.SCALAR,
+        queries=[
+            build_scalar_query(
+                "A",
+                signal,
+                [build_aggregation(f"count_distinct({prefix}{contested})", "distinct")],
+                filter_expression=f"{IDENTITY_KEY} LIKE '{EXPLICIT_PREFIX}%'",
+            )
+        ],
+    )
+    assert response.status_code == HTTPStatus.OK, response.text
+    assert_scalar_value(response, "A", expected)
+
+
+# Rules for logs only:
+# - A `body.` key reads the body JSON path. It does not read the attribute
+#   with the same name.
+# - A `log.` key reads the attribute and the body JSON path together. This
+#   is also true when metadata reports the attribute.
+# - A `scope.` key resolves through metadata only. When metadata does not
+#   report the key, the query fails with "key not found". This is also true
+#   for the declared path `scope.name` and for rows that have the scope
+#   data.
+LOGS_ONLY_MATRIX = [
+    pytest.param("body.route.tag = 'checkout'", {ATTRIBUTE_ONLY, NEITHER, NUMBER_ATTRIBUTE}, id="body_context_reads_the_body_json"),
+    pytest.param("log.route.tag = 'checkout'", {COLUMN_ONLY, ATTRIBUTE_ONLY, BOTH, NEITHER, NUMBER_ATTRIBUTE}, id="log_context_reads_attribute_and_body"),
+    pytest.param("scope.name = 'scope-a'", "key `name` not found", id="scope_name_needs_metadata"),
+    pytest.param("scope.env = 'prod'", "key `env` not found", id="scope_attribute_needs_metadata"),
+    pytest.param("scope.env EXISTS", "key `env` not found", id="scope_attribute_exists_needs_metadata"),
+]
+
+
+@pytest.mark.parametrize("expression,expected", LOGS_ONLY_MATRIX)
+def test_logs_body_and_scope_contexts(
+    signoz: types.SigNoz,
+    create_user_admin: None,  # pylint: disable=unused-argument
+    get_token: Callable[[str, str], str],
+    ambiguous_rows: datetime,
+    expression: str,
+    expected: set[str] | str,
+) -> None:
+    token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
+
+    response = make_query_request(
+        signoz,
+        token,
+        start_ms=int((ambiguous_rows - timedelta(minutes=2)).timestamp() * 1000),
+        end_ms=int((ambiguous_rows + timedelta(minutes=1)).timestamp() * 1000),
+        request_type=RequestType.RAW,
+        queries=[
+            build_raw_query(
+                "A",
+                "logs",
+                limit=100,
+                filter_expression=expression,
+                order=[build_order_by("timestamp", "asc")],
+                select_fields=[{"name": IDENTITY_KEY}],
+            )
+        ],
+    )
+
+    if isinstance(expected, str):
+        assert response.status_code == HTTPStatus.BAD_REQUEST, response.text
+        assert expected in response.text, response.text
+        return
+
+    assert response.status_code == HTTPStatus.OK, response.text
+    matched = {row for row in get_column_data_from_response(response.json(), IDENTITY_KEY) if row.startswith(EXPLICIT_PREFIX)}
+    assert matched == expected, expression