Merge branch 'main' into test/uplot-config-builder

* fix: improve qbtoexpr test suite

* fix: assert eq order

---------

Co-authored-by: Nityananda Gohain <nityanandagohain@gmail.com>

frontend/__mocks__/uplotMock.ts

@@ -12,6 +12,8 @@ export interface MockUPlotInstance {
 export interface MockUPlotPaths {
 	spline: jest.Mock;
 	bars: jest.Mock;
+	linear: jest.Mock;
+	stepped: jest.Mock;
 }
 
 // Create mock instance methods
@@ -23,10 +25,20 @@ const createMockUPlotInstance = (): MockUPlotInstance => ({
 	setSeries: jest.fn(),
 });
 
-// Create mock paths
-const mockPaths: MockUPlotPaths = {
-	spline: jest.fn(),
-	bars: jest.fn(),
+// Path builder: (self, seriesIdx, idx0, idx1) => paths or null
+const createMockPathBuilder = (): jest.Mock =>
+	jest.fn(() => ({
+		stroke: jest.fn(),
+		fill: jest.fn(),
+		clip: jest.fn(),
+	}));
+
+// Create mock paths - linear, spline, stepped needed by UPlotSeriesBuilder.getPathBuilder
+const mockPaths = {
+	spline: jest.fn(() => createMockPathBuilder()),
+	bars: jest.fn(() => createMockPathBuilder()),
+	linear: jest.fn(() => createMockPathBuilder()),
+	stepped: jest.fn((opts?: { align?: number }) => createMockPathBuilder()),
 };
 
 // Mock static methods

frontend/src/lib/uPlotV2/config/__tests__/UPlotAxisBuilder.test.ts

@@ -0,0 +1,356 @@
+import { getToolTipValue } from 'components/Graph/yAxisConfig';
+import { PANEL_TYPES } from 'constants/queryBuilder';
+import { uPlotXAxisValuesFormat } from 'lib/uPlotLib/utils/constants';
+import getGridColor from 'lib/uPlotLib/utils/getGridColor';
+import type uPlot from 'uplot';
+
+import type { AxisProps } from '../types';
+import { UPlotAxisBuilder } from '../UPlotAxisBuilder';
+
+jest.mock('components/Graph/yAxisConfig', () => ({
+	getToolTipValue: jest.fn(),
+}));
+
+const createAxisProps = (overrides: Partial<AxisProps> = {}): AxisProps => ({
+	scaleKey: 'x',
+	label: 'Time',
+	isDarkMode: false,
+	show: true,
+	...overrides,
+});
+
+describe('UPlotAxisBuilder', () => {
+	beforeEach(() => {
+		jest.clearAllMocks();
+	});
+
+	it('builds basic axis config with defaults', () => {
+		const builder = new UPlotAxisBuilder(
+			createAxisProps({
+				scaleKey: 'x',
+				label: 'Time',
+			}),
+		);
+
+		const config = builder.getConfig();
+
+		expect(config.scale).toBe('x');
+		expect(config.label).toBe('Time');
+		expect(config.show).toBe(true);
+		expect(config.side).toBe(2);
+		expect(config.gap).toBe(5);
+
+		// Default grid and ticks are created
+		expect(config.grid).toEqual({
+			stroke: getGridColor(false),
+			width: 0.2,
+			show: true,
+		});
+		expect(config.ticks).toEqual({
+			width: 0.3,
+			show: true,
+		});
+	});
+
+	it('merges custom grid config over defaults and respects isDarkMode and isLogScale', () => {
+		const builder = new UPlotAxisBuilder(
+			createAxisProps({
+				isDarkMode: true,
+				isLogScale: true,
+				grid: {
+					width: 1,
+				},
+			}),
+		);
+
+		const config = builder.getConfig();
+
+		expect(config.grid).toEqual({
+			// stroke falls back to theme-based default when not provided
+			stroke: getGridColor(true),
+			// provided width overrides default
+			width: 1,
+			// show falls back to default when not provided
+			show: true,
+		});
+	});
+
+	it('uses provided ticks config when present and falls back to defaults otherwise', () => {
+		const customTicks = { width: 1, show: false };
+		const withTicks = new UPlotAxisBuilder(
+			createAxisProps({
+				ticks: customTicks,
+			}),
+		);
+		const withoutTicks = new UPlotAxisBuilder(createAxisProps());
+
+		expect(withTicks.getConfig().ticks).toBe(customTicks);
+		expect(withoutTicks.getConfig().ticks).toEqual({
+			width: 0.3,
+			show: true,
+		});
+	});
+
+	it('uses time-based X-axis values formatter for time-series like panels', () => {
+		const builder = new UPlotAxisBuilder(
+			createAxisProps({
+				scaleKey: 'x',
+				panelType: PANEL_TYPES.TIME_SERIES,
+			}),
+		);
+
+		const config = builder.getConfig();
+
+		expect(config.values).toBe(uPlotXAxisValuesFormat);
+	});
+
+	it('does not attach X-axis datetime formatter when panel type is not supported', () => {
+		const builder = new UPlotAxisBuilder(
+			createAxisProps({
+				scaleKey: 'x',
+				panelType: PANEL_TYPES.LIST, // not in PANEL_TYPES_WITH_X_AXIS_DATETIME_FORMAT
+			}),
+		);
+
+		const config = builder.getConfig();
+
+		expect(config.values).toBeUndefined();
+	});
+
+	it('builds Y-axis values formatter that delegates to getToolTipValue', () => {
+		const yBuilder = new UPlotAxisBuilder(
+			createAxisProps({
+				scaleKey: 'y',
+				yAxisUnit: 'ms',
+				decimalPrecision: 3,
+			}),
+		);
+
+		const config = yBuilder.getConfig();
+		expect(typeof config.values).toBe('function');
+
+		(getToolTipValue as jest.Mock).mockImplementation(
+			(value: string, unit?: string, precision?: unknown) =>
+				`formatted:${value}:${unit}:${precision}`,
+		);
+
+		// Simulate uPlot calling the values formatter
+		const valuesFn = (config.values as unknown) as (
+			self: uPlot,
+			vals: unknown[],
+		) => string[];
+		const result = valuesFn({} as uPlot, [1, null, 2, Number.NaN]);
+
+		expect(getToolTipValue).toHaveBeenCalledTimes(2);
+		expect(getToolTipValue).toHaveBeenNthCalledWith(1, '1', 'ms', 3);
+		expect(getToolTipValue).toHaveBeenNthCalledWith(2, '2', 'ms', 3);
+
+		// Null/NaN values should map to empty strings
+		expect(result).toEqual(['formatted:1:ms:3', '', 'formatted:2:ms:3', '']);
+	});
+
+	it('adds dynamic size calculator only for Y-axis when size is not provided', () => {
+		const yBuilder = new UPlotAxisBuilder(
+			createAxisProps({
+				scaleKey: 'y',
+			}),
+		);
+		const xBuilder = new UPlotAxisBuilder(
+			createAxisProps({
+				scaleKey: 'x',
+			}),
+		);
+
+		const yConfig = yBuilder.getConfig();
+		const xConfig = xBuilder.getConfig();
+
+		expect(typeof yConfig.size).toBe('function');
+		expect(xConfig.size).toBeUndefined();
+	});
+
+	it('uses explicit size function when provided', () => {
+		const sizeFn: uPlot.Axis.Size = jest.fn(() => 100) as uPlot.Axis.Size;
+
+		const builder = new UPlotAxisBuilder(
+			createAxisProps({
+				scaleKey: 'y',
+				size: sizeFn,
+			}),
+		);
+
+		const config = builder.getConfig();
+		expect(config.size).toBe(sizeFn);
+	});
+
+	it('builds stroke color based on stroke and isDarkMode', () => {
+		const explicitStroke = new UPlotAxisBuilder(
+			createAxisProps({
+				stroke: '#ff0000',
+			}),
+		);
+		const darkStroke = new UPlotAxisBuilder(
+			createAxisProps({
+				stroke: undefined,
+				isDarkMode: true,
+			}),
+		);
+		const lightStroke = new UPlotAxisBuilder(
+			createAxisProps({
+				stroke: undefined,
+				isDarkMode: false,
+			}),
+		);
+
+		expect(explicitStroke.getConfig().stroke).toBe('#ff0000');
+		expect(darkStroke.getConfig().stroke).toBe('white');
+		expect(lightStroke.getConfig().stroke).toBe('black');
+	});
+
+	it('uses explicit values formatter when provided', () => {
+		const customValues: uPlot.Axis.Values = jest.fn(() => ['a', 'b', 'c']);
+
+		const builder = new UPlotAxisBuilder(
+			createAxisProps({
+				scaleKey: 'y',
+				values: customValues,
+			}),
+		);
+
+		const config = builder.getConfig();
+
+		expect(config.values).toBe(customValues);
+	});
+
+	it('returns undefined values for scaleKey neither x nor y', () => {
+		const builder = new UPlotAxisBuilder(createAxisProps({ scaleKey: 'custom' }));
+
+		const config = builder.getConfig();
+
+		expect(config.values).toBeUndefined();
+	});
+
+	it('omits stroke when stroke and isDarkMode are both undefined', () => {
+		const builder = new UPlotAxisBuilder(
+			createAxisProps({
+				scaleKey: 'custom',
+				stroke: undefined,
+				isDarkMode: undefined,
+			}),
+		);
+
+		const config = builder.getConfig();
+
+		expect(config.stroke).toBeUndefined();
+	});
+
+	it('includes space in config when provided', () => {
+		const builder = new UPlotAxisBuilder(
+			createAxisProps({ scaleKey: 'y', space: 50 }),
+		);
+
+		const config = builder.getConfig();
+
+		expect(config.space).toBe(50);
+	});
+
+	it('includes PANEL_TYPES.BAR and PANEL_TYPES.PIE in X-axis datetime formatter', () => {
+		const barBuilder = new UPlotAxisBuilder(
+			createAxisProps({
+				scaleKey: 'x',
+				panelType: PANEL_TYPES.BAR,
+			}),
+		);
+		const pieBuilder = new UPlotAxisBuilder(
+			createAxisProps({
+				scaleKey: 'x',
+				panelType: PANEL_TYPES.PIE,
+			}),
+		);
+
+		expect(barBuilder.getConfig().values).toBe(uPlotXAxisValuesFormat);
+		expect(pieBuilder.getConfig().values).toBe(uPlotXAxisValuesFormat);
+	});
+
+	it('invokes Y-axis size calculator and delegates to getExistingAxisSize when cycleNum > 1', () => {
+		const builder = new UPlotAxisBuilder(createAxisProps({ scaleKey: 'y' }));
+
+		const config = builder.getConfig();
+		const sizeFn = config.size;
+		expect(typeof sizeFn).toBe('function');
+
+		const mockAxis = {
+			_size: 80,
+			ticks: { size: 10 },
+			font: ['12px sans-serif'],
+		};
+		const mockSelf = ({
+			axes: [mockAxis],
+			ctx: { measureText: jest.fn(() => ({ width: 60 })), font: '' },
+		} as unknown) as uPlot;
+
+		const result = (sizeFn as (
+			s: uPlot,
+			v: string[],
+			a: number,
+			c: number,
+		) => number)(
+			mockSelf,
+			['100', '200'],
+			0,
+			2, // cycleNum > 1
+		);
+
+		expect(result).toBe(80);
+	});
+
+	it('invokes Y-axis size calculator and computes from text width when cycleNum <= 1', () => {
+		const builder = new UPlotAxisBuilder(
+			createAxisProps({ scaleKey: 'y', gap: 8 }),
+		);
+
+		const config = builder.getConfig();
+		const sizeFn = config.size;
+		expect(typeof sizeFn).toBe('function');
+
+		const mockAxis = {
+			ticks: { size: 12 },
+			font: ['12px sans-serif'],
+		};
+		const measureText = jest.fn(() => ({ width: 48 }));
+		const mockSelf = ({
+			axes: [mockAxis],
+			ctx: {
+				measureText,
+				get font() {
+					return '';
+				},
+				set font(_v: string) {
+					/* noop */
+				},
+			},
+		} as unknown) as uPlot;
+
+		const result = (sizeFn as (
+			s: uPlot,
+			v: string[],
+			a: number,
+			c: number,
+		) => number)(mockSelf, ['10', '2000ms'], 0, 0);
+
+		expect(measureText).toHaveBeenCalledWith('2000ms');
+		expect(result).toBeGreaterThanOrEqual(12 + 8);
+	});
+
+	it('merge updates axis props', () => {
+		const builder = new UPlotAxisBuilder(
+			createAxisProps({ scaleKey: 'y', label: 'Original' }),
+		);
+
+		builder.merge({ label: 'Merged', yAxisUnit: 'bytes' });
+
+		const config = builder.getConfig();
+
+		expect(config.label).toBe('Merged');
+		expect(config.values).toBeDefined();
+	});
+});

frontend/src/lib/uPlotV2/config/__tests__/UPlotConfigBuilder.test.ts

@@ -0,0 +1,331 @@
+import uPlot from 'uplot';
+
+import type { SeriesProps } from '../types';
+import { DrawStyle, SelectionPreferencesSource } from '../types';
+import { UPlotConfigBuilder } from '../UPlotConfigBuilder';
+
+// Mock only the real boundary that hits localStorage
+jest.mock(
+	'container/DashboardContainer/visualization/panels/utils/legendVisibilityUtils',
+	() => ({
+		getStoredSeriesVisibility: jest.fn(),
+	}),
+);
+
+const getStoredSeriesVisibilityMock = jest.requireMock(
+	'container/DashboardContainer/visualization/panels/utils/legendVisibilityUtils',
+) as {
+	getStoredSeriesVisibility: jest.Mock;
+};
+
+describe('UPlotConfigBuilder', () => {
+	beforeEach(() => {
+		jest.clearAllMocks();
+	});
+
+	const createSeriesProps = (
+		overrides: Partial<SeriesProps> = {},
+	): SeriesProps => ({
+		scaleKey: 'y',
+		label: 'Requests',
+		colorMapping: {},
+		drawStyle: DrawStyle.Line,
+		...overrides,
+	});
+
+	it('returns correct save selection preference flag from constructor args', () => {
+		const builder = new UPlotConfigBuilder({
+			shouldSaveSelectionPreference: true,
+		});
+
+		expect(builder.getShouldSaveSelectionPreference()).toBe(true);
+	});
+
+	it('returns widgetId from constructor args', () => {
+		const builder = new UPlotConfigBuilder({ widgetId: 'widget-123' });
+
+		expect(builder.getWidgetId()).toBe('widget-123');
+	});
+
+	it('sets tzDate from constructor and includes it in config', () => {
+		const tzDate = (ts: number): Date => new Date(ts);
+		const builder = new UPlotConfigBuilder({ tzDate });
+
+		const config = builder.getConfig();
+
+		expect(config.tzDate).toBe(tzDate);
+	});
+
+	it('does not call onDragSelect for click without drag (width === 0)', () => {
+		const onDragSelect = jest.fn();
+		const builder = new UPlotConfigBuilder({ onDragSelect });
+
+		const config = builder.getConfig();
+		const setSelectHooks = config.hooks?.setSelect ?? [];
+		expect(setSelectHooks.length).toBe(1);
+
+		const uplotInstance = ({
+			select: { left: 10, width: 0 },
+			posToVal: jest.fn(),
+		} as unknown) as uPlot;
+
+		// Simulate uPlot calling the hook
+		const setSelectHook = setSelectHooks[0];
+		expect(setSelectHook).toBeDefined();
+		if (!setSelectHook) {
+			throw new Error('Expected setSelect hook to be registered');
+		}
+		setSelectHook(uplotInstance);
+
+		expect(onDragSelect).not.toHaveBeenCalled();
+	});
+
+	it('calls onDragSelect with start and end times in milliseconds for a drag selection', () => {
+		const onDragSelect = jest.fn();
+		const builder = new UPlotConfigBuilder({ onDragSelect });
+
+		const config = builder.getConfig();
+		const setSelectHooks = config.hooks?.setSelect ?? [];
+		expect(setSelectHooks.length).toBe(1);
+
+		const posToVal = jest
+			.fn()
+			// left position
+			.mockReturnValueOnce(100)
+			// left + width
+			.mockReturnValueOnce(110);
+
+		const uplotInstance = ({
+			select: { left: 50, width: 20 },
+			posToVal,
+		} as unknown) as uPlot;
+
+		const setSelectHook = setSelectHooks[0];
+		expect(setSelectHook).toBeDefined();
+		if (!setSelectHook) {
+			throw new Error('Expected setSelect hook to be registered');
+		}
+		setSelectHook(uplotInstance);
+
+		expect(onDragSelect).toHaveBeenCalledTimes(1);
+		// 100 and 110 seconds converted to milliseconds
+		expect(onDragSelect).toHaveBeenCalledWith(100_000, 110_000);
+	});
+
+	it('adds and removes hooks via addHook, and exposes them through getConfig', () => {
+		const builder = new UPlotConfigBuilder();
+		const drawHook = jest.fn();
+
+		const remove = builder.addHook('draw', drawHook as uPlot.Hooks.Defs['draw']);
+
+		let config = builder.getConfig();
+		expect(config.hooks?.draw).toContain(drawHook);
+
+		// Remove and ensure it no longer appears in config
+		remove();
+		config = builder.getConfig();
+		expect(config.hooks?.draw ?? []).not.toContain(drawHook);
+	});
+
+	it('adds axes, scales, and series and wires them into the final config', () => {
+		const builder = new UPlotConfigBuilder();
+
+		// Add axis and scale
+		builder.addAxis({ scaleKey: 'y', label: 'Requests' });
+		builder.addScale({ scaleKey: 'y' });
+
+		// Add two series – legend indices should start from 1 (0 is the timestamp series)
+		builder.addSeries(createSeriesProps({ label: 'Requests' }));
+		builder.addSeries(createSeriesProps({ label: 'Errors' }));
+
+		const config = builder.getConfig();
+
+		// Axes
+		expect(config.axes).toHaveLength(1);
+		expect(config.axes?.[0].scale).toBe('y');
+
+		// Scales are returned as an object keyed by scaleKey
+		expect(config.scales).toBeDefined();
+		expect(Object.keys(config.scales ?? {})).toContain('y');
+
+		// Series: base timestamp + 2 data series
+		expect(config.series).toHaveLength(3);
+		// Base series (index 0) has a value formatter that returns empty string
+		const baseSeries = config.series?.[0] as { value?: () => string };
+		expect(typeof baseSeries?.value).toBe('function');
+		expect(baseSeries?.value?.()).toBe('');
+
+		// Legend items align with series and carry label and color from series config
+		const legendItems = builder.getLegendItems();
+		expect(Object.keys(legendItems)).toEqual(['1', '2']);
+		expect(legendItems[1].seriesIndex).toBe(1);
+		expect(legendItems[1].label).toBe('Requests');
+		expect(legendItems[2].label).toBe('Errors');
+	});
+
+	it('merges axis when addAxis is called twice with same scaleKey', () => {
+		const builder = new UPlotConfigBuilder();
+
+		builder.addAxis({ scaleKey: 'y', label: 'Requests' });
+		builder.addAxis({ scaleKey: 'y', label: 'Updated Label', show: false });
+
+		const config = builder.getConfig();
+
+		expect(config.axes).toHaveLength(1);
+		expect(config.axes?.[0].label).toBe('Updated Label');
+		expect(config.axes?.[0].show).toBe(false);
+	});
+
+	it('merges scale when addScale is called twice with same scaleKey', () => {
+		const builder = new UPlotConfigBuilder();
+
+		builder.addScale({ scaleKey: 'y', min: 0 });
+		builder.addScale({ scaleKey: 'y', max: 100 });
+
+		const config = builder.getConfig();
+
+		// Only one scale entry for 'y' (merge path used, no duplicate added)
+		expect(config.scales).toBeDefined();
+		expect(Object.keys(config.scales ?? {})).toEqual(['y']);
+		expect(config.scales?.y?.range).toBeDefined();
+	});
+
+	it('restores visibility state from localStorage when selectionPreferencesSource is LOCAL_STORAGE', () => {
+		const visibilityMap = new Map<string, boolean>([
+			['Requests', true],
+			['Errors', false],
+		]);
+
+		getStoredSeriesVisibilityMock.getStoredSeriesVisibility.mockReturnValue(
+			visibilityMap,
+		);
+
+		const builder = new UPlotConfigBuilder({
+			widgetId: 'widget-1',
+			selectionPreferencesSource: SelectionPreferencesSource.LOCAL_STORAGE,
+		});
+
+		builder.addSeries(createSeriesProps({ label: 'Requests' }));
+		builder.addSeries(createSeriesProps({ label: 'Errors' }));
+
+		const legendItems = builder.getLegendItems();
+
+		// When any series is hidden, legend visibility is driven by the stored map
+		expect(legendItems[1].show).toBe(true);
+		expect(legendItems[2].show).toBe(false);
+
+		const config = builder.getConfig();
+		const [, firstSeries, secondSeries] = config.series ?? [];
+
+		expect(firstSeries?.show).toBe(true);
+		expect(secondSeries?.show).toBe(false);
+	});
+
+	it('does not attempt to read stored visibility when using in-memory preferences', () => {
+		const builder = new UPlotConfigBuilder({
+			widgetId: 'widget-1',
+			selectionPreferencesSource: SelectionPreferencesSource.IN_MEMORY,
+		});
+
+		builder.addSeries(createSeriesProps({ label: 'Requests' }));
+
+		builder.getLegendItems();
+		builder.getConfig();
+
+		expect(
+			getStoredSeriesVisibilityMock.getStoredSeriesVisibility,
+		).not.toHaveBeenCalled();
+	});
+
+	it('adds thresholds only once per scale key', () => {
+		const builder = new UPlotConfigBuilder();
+
+		const thresholdsOptions = {
+			scaleKey: 'y',
+			thresholds: [{ thresholdValue: 100 }],
+		};
+
+		builder.addThresholds(thresholdsOptions);
+		builder.addThresholds(thresholdsOptions);
+
+		const config = builder.getConfig();
+		const drawHooks = config.hooks?.draw ?? [];
+
+		// Only a single draw hook should be registered for the same scaleKey
+		expect(drawHooks.length).toBe(1);
+	});
+
+	it('merges cursor configuration with defaults instead of replacing them', () => {
+		const builder = new UPlotConfigBuilder();
+
+		builder.setCursor({
+			drag: { setScale: false },
+		});
+
+		const config = builder.getConfig();
+
+		expect(config.cursor?.drag?.setScale).toBe(false);
+		// Points configuration from DEFAULT_CURSOR_CONFIG should still be present
+		expect(config.cursor?.points).toBeDefined();
+	});
+
+	it('adds plugins and includes them in config', () => {
+		const builder = new UPlotConfigBuilder();
+		const plugin: uPlot.Plugin = {
+			opts: (): void => {},
+			hooks: {},
+		};
+
+		builder.addPlugin(plugin);
+
+		const config = builder.getConfig();
+
+		expect(config.plugins).toContain(plugin);
+	});
+
+	it('sets bands and includes them in config', () => {
+		const builder = new UPlotConfigBuilder();
+		const bands: uPlot.Band[] = [{ series: [1, 2], fill: (): string => '#000' }];
+
+		builder.setBands(bands);
+
+		const config = builder.getConfig();
+
+		expect(config.bands).toEqual(bands);
+	});
+
+	it('sets padding, legend, focus, select, tzDate and includes them in config', () => {
+		const tzDate = (ts: number): Date => new Date(ts);
+		const builder = new UPlotConfigBuilder();
+
+		builder.setPadding([10, 20, 30, 40]);
+		builder.setLegend({ show: true, live: true });
+		builder.setFocus({ alpha: 0.5 });
+		builder.setSelect({ left: 0, width: 0, top: 0, height: 0 });
+		builder.setTzDate(tzDate);
+
+		const config = builder.getConfig();
+
+		expect(config.padding).toEqual([10, 20, 30, 40]);
+		expect(config.legend).toEqual({ show: true, live: true });
+		expect(config.focus).toEqual({ alpha: 0.5 });
+		expect(config.select).toEqual({ left: 0, width: 0, top: 0, height: 0 });
+		expect(config.tzDate).toBe(tzDate);
+	});
+
+	it('does not include plugins when none added', () => {
+		const builder = new UPlotConfigBuilder();
+
+		const config = builder.getConfig();
+
+		expect(config.plugins).toBeUndefined();
+	});
+
+	it('does not include bands when empty', () => {
+		const builder = new UPlotConfigBuilder();
+
+		const config = builder.getConfig();
+
+		expect(config.bands).toBeUndefined();
+	});
+});

frontend/src/lib/uPlotV2/config/__tests__/UPlotScaleBuilder.test.ts

@@ -0,0 +1,235 @@
+import type uPlot from 'uplot';
+
+import * as scaleUtils from '../../utils/scale';
+import type { ScaleProps } from '../types';
+import { DistributionType } from '../types';
+import { UPlotScaleBuilder } from '../UPlotScaleBuilder';
+
+const createScaleProps = (overrides: Partial<ScaleProps> = {}): ScaleProps => ({
+	scaleKey: 'y',
+	time: false,
+	auto: undefined,
+	min: undefined,
+	max: undefined,
+	softMin: undefined,
+	softMax: undefined,
+	distribution: DistributionType.Linear,
+	...overrides,
+});
+
+describe('UPlotScaleBuilder', () => {
+	const getFallbackMinMaxSpy = jest.spyOn(
+		scaleUtils,
+		'getFallbackMinMaxTimeStamp',
+	);
+
+	beforeEach(() => {
+		jest.clearAllMocks();
+	});
+
+	it('initializes softMin/softMax correctly when both are 0 (treated as unset)', () => {
+		const builder = new UPlotScaleBuilder(
+			createScaleProps({
+				softMin: 0,
+				softMax: 0,
+			}),
+		);
+
+		// Non-time scale so config path uses thresholds pipeline; we just care that
+		// adjustSoftLimitsWithThresholds receives null soft limits instead of 0/0.
+		const adjustSpy = jest.spyOn(scaleUtils, 'adjustSoftLimitsWithThresholds');
+
+		builder.getConfig();
+
+		expect(adjustSpy).toHaveBeenCalledWith(null, null, undefined, undefined);
+	});
+
+	it('handles time scales using explicit min/max and rounds max down to the previous minute', () => {
+		const min = 1_700_000_000; // seconds
+		const max = 1_700_000_600; // seconds
+
+		const builder = new UPlotScaleBuilder(
+			createScaleProps({
+				scaleKey: 'x',
+				time: true,
+				min,
+				max,
+			}),
+		);
+
+		const config = builder.getConfig();
+		const xScale = config.x;
+
+		expect(xScale.time).toBe(true);
+		expect(xScale.auto).toBe(false);
+		expect(Array.isArray(xScale.range)).toBe(true);
+
+		const [resolvedMin, resolvedMax] = xScale.range as [number, number];
+
+		// min is passed through
+		expect(resolvedMin).toBe(min);
+
+		// max is coerced to "endTime - 1 minute" and rounded down to minute precision
+		const oneMinuteAgoTimestamp = (max - 60) * 1000;
+		const currentDate = new Date(oneMinuteAgoTimestamp);
+		currentDate.setSeconds(0);
+		currentDate.setMilliseconds(0);
+		const expectedMax = Math.floor(currentDate.getTime() / 1000);
+
+		expect(resolvedMax).toBe(expectedMax);
+	});
+
+	it('falls back to getFallbackMinMaxTimeStamp when time scale has no min/max', () => {
+		getFallbackMinMaxSpy.mockReturnValue({
+			fallbackMin: 100,
+			fallbackMax: 200,
+		});
+
+		const builder = new UPlotScaleBuilder(
+			createScaleProps({
+				scaleKey: 'x',
+				time: true,
+				min: undefined,
+				max: undefined,
+			}),
+		);
+
+		const config = builder.getConfig();
+		const [resolvedMin, resolvedMax] = config.x.range as [number, number];
+
+		expect(getFallbackMinMaxSpy).toHaveBeenCalled();
+		expect(resolvedMin).toBe(100);
+		// max is aligned to "fallbackMax - 60 seconds" minute boundary
+		expect(resolvedMax).toBeLessThanOrEqual(200);
+		expect(resolvedMax).toBeGreaterThan(100);
+	});
+
+	it('pipes limits through soft-limit adjustment and log-scale normalization before range config', () => {
+		const adjustSpy = jest.spyOn(scaleUtils, 'adjustSoftLimitsWithThresholds');
+		const normalizeSpy = jest.spyOn(scaleUtils, 'normalizeLogScaleLimits');
+		const getRangeConfigSpy = jest.spyOn(scaleUtils, 'getRangeConfig');
+
+		const thresholds = {
+			scaleKey: 'y',
+			thresholds: [{ thresholdValue: 10 }],
+			yAxisUnit: 'ms',
+		};
+
+		const builder = new UPlotScaleBuilder(
+			createScaleProps({
+				softMin: 1,
+				softMax: 5,
+				min: 0,
+				max: 100,
+				distribution: DistributionType.Logarithmic,
+				thresholds,
+				logBase: 2,
+				padMinBy: 0.1,
+				padMaxBy: 0.2,
+			}),
+		);
+
+		builder.getConfig();
+
+		expect(adjustSpy).toHaveBeenCalledWith(1, 5, thresholds.thresholds, 'ms');
+		expect(normalizeSpy).toHaveBeenCalledWith({
+			distr: DistributionType.Logarithmic,
+			logBase: 2,
+			limits: {
+				min: 0,
+				max: 100,
+				softMin: expect.anything(),
+				softMax: expect.anything(),
+			},
+		});
+		expect(getRangeConfigSpy).toHaveBeenCalled();
+	});
+
+	it('computes distribution config for non-time scales and wires range function when range is not provided', () => {
+		const createRangeFnSpy = jest.spyOn(scaleUtils, 'createRangeFunction');
+
+		const builder = new UPlotScaleBuilder(
+			createScaleProps({
+				scaleKey: 'y',
+				time: false,
+				distribution: DistributionType.Linear,
+			}),
+		);
+
+		const config = builder.getConfig();
+		const yScale = config.y;
+
+		expect(createRangeFnSpy).toHaveBeenCalled();
+
+		// range should be a function when not provided explicitly
+		expect(typeof yScale.range).toBe('function');
+
+		// distribution config should be applied
+		expect(yScale.distr).toBeDefined();
+		expect(yScale.log).toBeDefined();
+	});
+
+	it('respects explicit range function when provided on props', () => {
+		const explicitRange: uPlot.Scale.Range = jest.fn(() => [
+			0,
+			10,
+		]) as uPlot.Scale.Range;
+
+		const builder = new UPlotScaleBuilder(
+			createScaleProps({
+				scaleKey: 'y',
+				range: explicitRange,
+			}),
+		);
+
+		const config = builder.getConfig();
+		const yScale = config.y;
+
+		expect(yScale.range).toBe(explicitRange);
+	});
+
+	it('derives auto flag when not explicitly provided, based on hasFixedRange and time', () => {
+		const getRangeConfigSpy = jest.spyOn(scaleUtils, 'getRangeConfig');
+
+		const builder = new UPlotScaleBuilder(
+			createScaleProps({
+				min: 0,
+				max: 100,
+				time: false,
+			}),
+		);
+
+		const config = builder.getConfig();
+		const yScale = config.y;
+
+		expect(getRangeConfigSpy).toHaveBeenCalled();
+		// For non-time scale with fixed min/max, hasFixedRange is true → auto should remain false
+		expect(yScale.auto).toBe(false);
+	});
+
+	it('merge updates internal min/max/soft limits while preserving other props', () => {
+		const builder = new UPlotScaleBuilder(
+			createScaleProps({
+				scaleKey: 'y',
+				min: 0,
+				max: 10,
+				softMin: 1,
+				softMax: 9,
+				time: false,
+			}),
+		);
+
+		builder.merge({
+			min: 2,
+			softMax: undefined,
+		});
+
+		const config = builder.getConfig();
+		const yScale = config.y;
+
+		// We can't read private fields directly, but we can assert that rangeConfig
+		// has been recomputed using the merged values by checking that createRangeFunction
+		// is still called without throwing and returns a working range function.
+		expect(typeof yScale.range).toBe('function');
+	});
+});

frontend/src/lib/uPlotV2/config/__tests__/UPlotSeriesBuilder.test.ts

@@ -0,0 +1,309 @@
+import { themeColors } from 'constants/theme';
+import uPlot from 'uplot';
+
+import type { SeriesProps } from '../types';
+import {
+	DrawStyle,
+	LineInterpolation,
+	LineStyle,
+	VisibilityMode,
+} from '../types';
+import { UPlotSeriesBuilder } from '../UPlotSeriesBuilder';
+
+const createBaseProps = (
+	overrides: Partial<SeriesProps> = {},
+): SeriesProps => ({
+	scaleKey: 'y',
+	label: 'Requests',
+	colorMapping: {},
+	drawStyle: DrawStyle.Line,
+	isDarkMode: false,
+	...overrides,
+});
+
+describe('UPlotSeriesBuilder', () => {
+	it('maps basic props into uPlot series config', () => {
+		const builder = new UPlotSeriesBuilder(
+			createBaseProps({
+				label: 'Latency',
+				spanGaps: true,
+				show: false,
+			}),
+		);
+
+		const config = builder.getConfig();
+
+		expect(config.scale).toBe('y');
+		expect(config.label).toBe('Latency');
+		expect(config.spanGaps).toBe(true);
+		expect(config.show).toBe(false);
+		expect(config.pxAlign).toBe(true);
+		expect(typeof config.value).toBe('function');
+	});
+
+	it('uses explicit lineColor when provided, regardless of mapping', () => {
+		const builder = new UPlotSeriesBuilder(
+			createBaseProps({
+				lineColor: '#ff00ff',
+				colorMapping: { Requests: '#00ff00' },
+			}),
+		);
+
+		const config = builder.getConfig();
+
+		expect(config.stroke).toBe('#ff00ff');
+	});
+
+	it('falls back to theme colors when no label is provided', () => {
+		const darkBuilder = new UPlotSeriesBuilder(
+			createBaseProps({
+				label: undefined,
+				isDarkMode: true,
+				lineColor: undefined,
+			}),
+		);
+		const lightBuilder = new UPlotSeriesBuilder(
+			createBaseProps({
+				label: undefined,
+				isDarkMode: false,
+				lineColor: undefined,
+			}),
+		);
+
+		const darkConfig = darkBuilder.getConfig();
+		const lightConfig = lightBuilder.getConfig();
+
+		expect(darkConfig.stroke).toBe(themeColors.white);
+		expect(lightConfig.stroke).toBe(themeColors.black);
+	});
+
+	it('uses colorMapping when available and no explicit lineColor is provided', () => {
+		const builder = new UPlotSeriesBuilder(
+			createBaseProps({
+				label: 'Requests',
+				colorMapping: { Requests: '#123456' },
+				lineColor: undefined,
+			}),
+		);
+
+		const config = builder.getConfig();
+
+		expect(config.stroke).toBe('#123456');
+	});
+
+	it('passes through a custom pathBuilder when provided', () => {
+		const customPaths = (jest.fn() as unknown) as uPlot.Series.PathBuilder;
+
+		const builder = new UPlotSeriesBuilder(
+			createBaseProps({
+				pathBuilder: customPaths,
+			}),
+		);
+
+		const config = builder.getConfig();
+
+		expect(config.paths).toBe(customPaths);
+	});
+
+	it('disables line paths when drawStyle is Points, but still renders points', () => {
+		const builder = new UPlotSeriesBuilder(
+			createBaseProps({
+				drawStyle: DrawStyle.Points,
+				pointSize: 4,
+				lineWidth: 2,
+				lineColor: '#aa00aa',
+			}),
+		);
+
+		const config = builder.getConfig();
+
+		expect(typeof config.paths).toBe('function');
+		expect(config.paths && config.paths({} as uPlot, 1, 0, 10)).toBeNull();
+
+		expect(config.points).toBeDefined();
+		expect(config.points?.stroke).toBe('#aa00aa');
+		expect(config.points?.fill).toBe('#aa00aa');
+		expect(config.points?.show).toBe(true);
+		expect(config.points?.size).toBe(4);
+	});
+
+	it('derives point size based on lineWidth and pointSize', () => {
+		const smallPointsBuilder = new UPlotSeriesBuilder(
+			createBaseProps({
+				lineWidth: 4,
+				pointSize: 2,
+			}),
+		);
+		const largePointsBuilder = new UPlotSeriesBuilder(
+			createBaseProps({
+				lineWidth: 2,
+				pointSize: 4,
+			}),
+		);
+
+		const smallConfig = smallPointsBuilder.getConfig();
+		const largeConfig = largePointsBuilder.getConfig();
+
+		expect(smallConfig.points?.size).toBeUndefined();
+		expect(largeConfig.points?.size).toBe(4);
+	});
+
+	it('uses pointsBuilder when provided instead of default visibility logic', () => {
+		const pointsBuilder: uPlot.Series.Points.Show = jest.fn(
+			() => true,
+		) as uPlot.Series.Points.Show;
+
+		const builder = new UPlotSeriesBuilder(
+			createBaseProps({
+				pointsBuilder,
+				drawStyle: DrawStyle.Line,
+			}),
+		);
+
+		const config = builder.getConfig();
+
+		expect(config.points?.show).toBe(pointsBuilder);
+	});
+
+	it('respects VisibilityMode for point visibility when no custom pointsBuilder is given', () => {
+		const neverPointsBuilder = new UPlotSeriesBuilder(
+			createBaseProps({
+				drawStyle: DrawStyle.Line,
+				showPoints: VisibilityMode.Never,
+			}),
+		);
+		const alwaysPointsBuilder = new UPlotSeriesBuilder(
+			createBaseProps({
+				drawStyle: DrawStyle.Line,
+				showPoints: VisibilityMode.Always,
+			}),
+		);
+
+		const neverConfig = neverPointsBuilder.getConfig();
+		const alwaysConfig = alwaysPointsBuilder.getConfig();
+
+		expect(neverConfig.points?.show).toBe(false);
+		expect(alwaysConfig.points?.show).toBe(true);
+	});
+
+	it('applies LineStyle.Dashed and lineCap to line config', () => {
+		const builder = new UPlotSeriesBuilder(
+			createBaseProps({
+				lineStyle: LineStyle.Dashed,
+				lineCap: 'round' as CanvasLineCap,
+			}),
+		);
+
+		const config = builder.getConfig();
+
+		expect(config.dash).toEqual([10, 10]);
+		expect(config.cap).toBe('round');
+	});
+
+	it('builds default paths for Line drawStyle and invokes the path builder', () => {
+		const builder = new UPlotSeriesBuilder(
+			createBaseProps({
+				drawStyle: DrawStyle.Line,
+				lineInterpolation: LineInterpolation.Linear,
+			}),
+		);
+
+		const config = builder.getConfig();
+
+		expect(typeof config.paths).toBe('function');
+		const result = config.paths?.({} as uPlot, 1, 0, 10);
+		expect(result).toBeDefined();
+	});
+
+	it('uses StepBefore and StepAfter interpolation for line paths', () => {
+		const stepBeforeBuilder = new UPlotSeriesBuilder(
+			createBaseProps({
+				drawStyle: DrawStyle.Line,
+				lineInterpolation: LineInterpolation.StepBefore,
+			}),
+		);
+		const stepAfterBuilder = new UPlotSeriesBuilder(
+			createBaseProps({
+				drawStyle: DrawStyle.Line,
+				lineInterpolation: LineInterpolation.StepAfter,
+			}),
+		);
+
+		const stepBeforeConfig = stepBeforeBuilder.getConfig();
+		const stepAfterConfig = stepAfterBuilder.getConfig();
+
+		expect(typeof stepBeforeConfig.paths).toBe('function');
+		expect(typeof stepAfterConfig.paths).toBe('function');
+		expect(stepBeforeConfig.paths?.({} as uPlot, 1, 0, 5)).toBeDefined();
+		expect(stepAfterConfig.paths?.({} as uPlot, 1, 0, 5)).toBeDefined();
+	});
+
+	it('defaults to spline interpolation when lineInterpolation is Spline or undefined', () => {
+		const splineBuilder = new UPlotSeriesBuilder(
+			createBaseProps({
+				drawStyle: DrawStyle.Line,
+				lineInterpolation: LineInterpolation.Spline,
+			}),
+		);
+		const defaultBuilder = new UPlotSeriesBuilder(
+			createBaseProps({ drawStyle: DrawStyle.Line }),
+		);
+
+		const splineConfig = splineBuilder.getConfig();
+		const defaultConfig = defaultBuilder.getConfig();
+
+		expect(typeof splineConfig.paths).toBe('function');
+		expect(typeof defaultConfig.paths).toBe('function');
+	});
+
+	it('coerces non-boolean spanGaps to false', () => {
+		const builder = new UPlotSeriesBuilder(
+			createBaseProps({ spanGaps: undefined }),
+		);
+
+		const config = builder.getConfig();
+
+		expect(config.spanGaps).toBe(false);
+	});
+
+	it('preserves spanGaps true when provided as boolean', () => {
+		const builder = new UPlotSeriesBuilder(createBaseProps({ spanGaps: true }));
+
+		const config = builder.getConfig();
+
+		expect(config.spanGaps).toBe(true);
+	});
+
+	it('uses generateColor when label has no colorMapping and no lineColor', () => {
+		const builder = new UPlotSeriesBuilder(
+			createBaseProps({
+				label: 'CustomSeries',
+				colorMapping: {},
+				lineColor: undefined,
+			}),
+		);
+
+		const config = builder.getConfig();
+
+		expect(config.stroke).toBeDefined();
+		expect(typeof config.stroke).toBe('string');
+		expect((config.stroke as string).length).toBeGreaterThan(0);
+	});
+
+	it('passes through pointsFilter when provided', () => {
+		const pointsFilter: uPlot.Series.Points.Filter = jest.fn(
+			(_self, _seriesIdx, _show) => null,
+		);
+
+		const builder = new UPlotSeriesBuilder(
+			createBaseProps({
+				pointsFilter,
+				drawStyle: DrawStyle.Line,
+			}),
+		);
+
+		const config = builder.getConfig();
+
+		expect(config.points?.filter).toBe(pointsFilter);
+	});
+});

pkg/query-service/queryBuilderToExpr/queryBuilderToExpr.go

@@ -71,7 +71,18 @@ func Parse(filters *v3.FilterSet) (string, error) {
 			// accustom log filters like `body.log.message EXISTS` into EXPR language
 			// where User is attempting to check for keys present in JSON log body
 			if strings.HasPrefix(v.Key.Key, "body.") {
-				filter = fmt.Sprintf("%s %s %s", exprFormattedValue(strings.TrimPrefix(v.Key.Key, "body.")), logOperatorsToExpr[v.Operator], "fromJSON(body)")
+				// if body is a string and is a valid JSON, then check if the key exists in the JSON
+				filter = fmt.Sprintf(`((type(body) == "string" && isJSON(body)) && %s %s %s)`, exprFormattedValue(strings.TrimPrefix(v.Key.Key, "body.")), logOperatorsToExpr[v.Operator], "fromJSON(body)")
+
+				// if body is a map, then check if the key exists in the map
+				operator := v3.FilterOperatorNotEqual
+				if v.Operator == v3.FilterOperatorNotExists {
+					operator = v3.FilterOperatorEqual
+				}
+				nilCheckFilter := fmt.Sprintf("%s %s nil", v.Key.Key, logOperatorsToExpr[operator])
+
+				// join the two filters with OR
+				filter = fmt.Sprintf(`(%s or (type(body) == "map" && (%s)))`, filter, nilCheckFilter)
 			} else if typ := getTypeName(v.Key.Type); typ != "" {
 				filter = fmt.Sprintf("%s %s %s", exprFormattedValue(v.Key.Key), logOperatorsToExpr[v.Operator], typ)
 			} else {

pkg/query-service/queryBuilderToExpr/queryBuilderToExpr_test.go

@@ -3,203 +3,538 @@ package queryBuilderToExpr
 import (
 	"testing"
 
+	signozstanzahelper "github.com/SigNoz/signoz-otel-collector/processor/signozlogspipelineprocessor/stanza/operator/helper"
 	v3 "github.com/SigNoz/signoz/pkg/query-service/model/v3"
-	. "github.com/smartystreets/goconvey/convey"
+	"github.com/expr-lang/expr/vm"
+	"github.com/open-telemetry/opentelemetry-collector-contrib/pkg/stanza/entry"
+	"github.com/stretchr/testify/assert"
 )
 
-var testCases = []struct {
-	Name        string
-	Query       *v3.FilterSet
-	Expr        string
-	ExpectError bool
-}{
-	{
-		Name: "equal",
-		Query: &v3.FilterSet{Operator: "AND", Items: []v3.FilterItem{
-			{Key: v3.AttributeKey{Key: "key", DataType: v3.AttributeKeyDataTypeString, Type: v3.AttributeKeyTypeTag}, Value: "checkbody", Operator: "="},
-		}},
-		Expr: `attributes["key"] == "checkbody"`,
-	},
-	{
-		Name: "not equal",
-		Query: &v3.FilterSet{Operator: "AND", Items: []v3.FilterItem{
-			{Key: v3.AttributeKey{Key: "key", DataType: v3.AttributeKeyDataTypeString, Type: v3.AttributeKeyTypeTag}, Value: "checkbody", Operator: "!="},
-		}},
-		Expr: `attributes["key"] != "checkbody"`,
-	},
-	{
-		Name: "less than",
-		Query: &v3.FilterSet{Operator: "AND", Items: []v3.FilterItem{
-			{Key: v3.AttributeKey{Key: "key", DataType: v3.AttributeKeyDataTypeInt64, Type: v3.AttributeKeyTypeTag}, Value: 10, Operator: "<"},
-		}},
-		Expr: `attributes["key"] != nil && attributes["key"] < 10`,
-	},
-	{
-		Name: "greater than",
-		Query: &v3.FilterSet{Operator: "AND", Items: []v3.FilterItem{
-			{Key: v3.AttributeKey{Key: "key", DataType: v3.AttributeKeyDataTypeInt64, Type: v3.AttributeKeyTypeTag}, Value: 10, Operator: ">"},
-		}},
-		Expr: `attributes["key"] != nil && attributes["key"] > 10`,
-	},
-	{
-		Name: "less than equal",
-		Query: &v3.FilterSet{Operator: "AND", Items: []v3.FilterItem{
-			{Key: v3.AttributeKey{Key: "key", DataType: v3.AttributeKeyDataTypeString, Type: v3.AttributeKeyTypeTag}, Value: 10, Operator: "<="},
-		}},
-		Expr: `attributes["key"] != nil && attributes["key"] <= 10`,
-	},
-	{
-		Name: "greater than equal",
-		Query: &v3.FilterSet{Operator: "AND", Items: []v3.FilterItem{
-			{Key: v3.AttributeKey{Key: "key", DataType: v3.AttributeKeyDataTypeString, Type: v3.AttributeKeyTypeTag}, Value: 10, Operator: ">="},
-		}},
-		Expr: `attributes["key"] != nil && attributes["key"] >= 10`,
-	},
-	// case sensitive
-	{
-		Name: "body contains",
-		Query: &v3.FilterSet{Operator: "AND", Items: []v3.FilterItem{
-			{Key: v3.AttributeKey{Key: "body", DataType: v3.AttributeKeyDataTypeString, Type: v3.AttributeKeyTypeUnspecified, IsColumn: true}, Value: "checkbody", Operator: "contains"},
-		}},
-		Expr: `body != nil && lower(body) contains lower("checkbody")`,
-	},
-	{
-		Name: "body.log.message exists",
-		Query: &v3.FilterSet{Operator: "AND", Items: []v3.FilterItem{
-			{Key: v3.AttributeKey{Key: "body.log.message", DataType: v3.AttributeKeyDataTypeString, Type: v3.AttributeKeyTypeUnspecified, IsColumn: true}, Value: "", Operator: "exists"},
-		}},
-		Expr: `"log.message" in fromJSON(body)`,
-	},
-	{
-		Name: "body.log.message not exists",
-		Query: &v3.FilterSet{Operator: "AND", Items: []v3.FilterItem{
-			{Key: v3.AttributeKey{Key: "body.log.message", DataType: v3.AttributeKeyDataTypeString, Type: v3.AttributeKeyTypeUnspecified, IsColumn: true}, Value: "", Operator: "nexists"},
-		}},
-		Expr: `"log.message" not in fromJSON(body)`,
-	},
-	{
-		Name: "body ncontains",
-		Query: &v3.FilterSet{Operator: "AND", Items: []v3.FilterItem{
-			{Key: v3.AttributeKey{Key: "body", DataType: v3.AttributeKeyDataTypeString, Type: v3.AttributeKeyTypeUnspecified, IsColumn: true}, Value: "checkbody", Operator: "ncontains"},
-		}},
-		Expr: `body != nil && lower(body) not contains lower("checkbody")`,
-	},
-	{
-		Name: "body regex",
-		Query: &v3.FilterSet{Operator: "AND", Items: []v3.FilterItem{
-			{Key: v3.AttributeKey{Key: "body", DataType: v3.AttributeKeyDataTypeString, Type: v3.AttributeKeyTypeUnspecified, IsColumn: true}, Value: "[0-1]+regex$", Operator: "regex"},
-		}},
-		Expr: `body != nil && body matches "[0-1]+regex$"`,
-	},
-	{
-		Name: "body not regex",
-		Query: &v3.FilterSet{Operator: "AND", Items: []v3.FilterItem{
-			{Key: v3.AttributeKey{Key: "body", DataType: v3.AttributeKeyDataTypeString, Type: v3.AttributeKeyTypeUnspecified, IsColumn: true}, Value: "[0-1]+regex$", Operator: "nregex"},
-		}},
-		Expr: `body != nil && body not matches "[0-1]+regex$"`,
-	},
-	{
-		Name: "regex with escape characters",
-		Query: &v3.FilterSet{Operator: "AND", Items: []v3.FilterItem{
-			{Key: v3.AttributeKey{Key: "body", DataType: v3.AttributeKeyDataTypeString, Type: v3.AttributeKeyTypeUnspecified, IsColumn: true}, Value: `^Executing \[\S+@\S+:[0-9]+\] \S+".*`, Operator: "regex"},
-		}},
-		Expr: `body != nil && body matches "^Executing \\[\\S+@\\S+:[0-9]+\\] \\S+\".*"`,
-	},
-	{
-		Name: "invalid regex",
-		Query: &v3.FilterSet{Operator: "AND", Items: []v3.FilterItem{
-			{Key: v3.AttributeKey{Key: "body", DataType: v3.AttributeKeyDataTypeString, Type: v3.AttributeKeyTypeUnspecified, IsColumn: true}, Value: "[0-9]++", Operator: "nregex"},
-		}},
-		Expr:        `body != nil && lower(body) not matches "[0-9]++"`,
-		ExpectError: true,
-	},
-	{
-		Name: "in",
-		Query: &v3.FilterSet{Operator: "AND", Items: []v3.FilterItem{
-			{Key: v3.AttributeKey{Key: "key", DataType: v3.AttributeKeyDataTypeString, Type: v3.AttributeKeyTypeTag}, Value: []interface{}{1, 2, 3, 4}, Operator: "in"},
-		}},
-		Expr: `attributes["key"] != nil && attributes["key"] in [1,2,3,4]`,
-	},
-	{
-		Name: "not in",
-		Query: &v3.FilterSet{Operator: "AND", Items: []v3.FilterItem{
-			{Key: v3.AttributeKey{Key: "key", DataType: v3.AttributeKeyDataTypeString, Type: v3.AttributeKeyTypeTag}, Value: []interface{}{"1", "2"}, Operator: "nin"},
-		}},
-		Expr: `attributes["key"] != nil && attributes["key"] not in ['1','2']`,
-	},
-	{
-		Name: "exists",
-		Query: &v3.FilterSet{Operator: "AND", Items: []v3.FilterItem{
-			{Key: v3.AttributeKey{Key: "key", DataType: v3.AttributeKeyDataTypeString, Type: v3.AttributeKeyTypeTag}, Operator: "exists"},
-		}},
-		Expr: `"key" in attributes`,
-	},
-	{
-		Name: "not exists",
-		Query: &v3.FilterSet{Operator: "AND", Items: []v3.FilterItem{
-			{Key: v3.AttributeKey{Key: "key", DataType: v3.AttributeKeyDataTypeString, Type: v3.AttributeKeyTypeTag}, Operator: "nexists"},
-		}},
-		Expr: `"key" not in attributes`,
-	},
-	{
-		Name: "trace_id not exists",
-		Query: &v3.FilterSet{Operator: "AND", Items: []v3.FilterItem{
-			{Key: v3.AttributeKey{Key: "trace_id", DataType: v3.AttributeKeyDataTypeString, Type: v3.AttributeKeyTypeUnspecified, IsColumn: true}, Value: "", Operator: "nexists"},
-		}},
-		Expr: `trace_id == nil`,
-	},
-	{
-		Name: "trace_id exists",
-		Query: &v3.FilterSet{Operator: "AND", Items: []v3.FilterItem{
-			{Key: v3.AttributeKey{Key: "trace_id", DataType: v3.AttributeKeyDataTypeString, Type: v3.AttributeKeyTypeUnspecified, IsColumn: true}, Value: "", Operator: "exists"},
-		}},
-		Expr: `trace_id != nil`,
-	},
-	{
-		Name: "span_id not exists",
-		Query: &v3.FilterSet{Operator: "AND", Items: []v3.FilterItem{
-			{Key: v3.AttributeKey{Key: "span_id", DataType: v3.AttributeKeyDataTypeString, Type: v3.AttributeKeyTypeUnspecified, IsColumn: true}, Value: "", Operator: "nexists"},
-		}},
-		Expr: `span_id == nil`,
-	},
-	{
-		Name: "span_id exists",
-		Query: &v3.FilterSet{Operator: "AND", Items: []v3.FilterItem{
-			{Key: v3.AttributeKey{Key: "span_id", DataType: v3.AttributeKeyDataTypeString, Type: v3.AttributeKeyTypeUnspecified, IsColumn: true}, Value: "", Operator: "exists"},
-		}},
-		Expr: `span_id != nil`,
-	},
-	{
-		Name: "Multi filter",
-		Query: &v3.FilterSet{Operator: "AND", Items: []v3.FilterItem{
-			{Key: v3.AttributeKey{Key: "key", DataType: v3.AttributeKeyDataTypeString, Type: v3.AttributeKeyTypeTag}, Value: 10, Operator: "<="},
-			{Key: v3.AttributeKey{Key: "body", DataType: v3.AttributeKeyDataTypeString, Type: v3.AttributeKeyTypeUnspecified, IsColumn: true}, Value: "[0-1]+regex$", Operator: "nregex"},
-			{Key: v3.AttributeKey{Key: "key", DataType: v3.AttributeKeyDataTypeString, Type: v3.AttributeKeyTypeTag}, Operator: "nexists"},
-		}},
-		Expr: `attributes["key"] != nil && attributes["key"] <= 10 and body != nil && body not matches "[0-1]+regex$" and "key" not in attributes`,
-	},
-	{
-		Name: "incorrect multi filter",
-		Query: &v3.FilterSet{Operator: "AND", Items: []v3.FilterItem{
-			{Key: v3.AttributeKey{Key: "key", DataType: v3.AttributeKeyDataTypeString, Type: v3.AttributeKeyTypeTag}, Value: 10, Operator: "<="},
-			{Key: v3.AttributeKey{Key: "body", DataType: v3.AttributeKeyDataTypeString, Type: v3.AttributeKeyTypeUnspecified, IsColumn: true}, Value: "[0-9]++", Operator: "nregex"},
-			{Key: v3.AttributeKey{Key: "key", DataType: v3.AttributeKeyDataTypeString, Type: v3.AttributeKeyTypeTag}, Operator: "nexists"},
-		}},
-		Expr:        `attributes["key"] != nil && attributes["key"] <= 10 and body not matches "[0-9]++" and "key" not in attributes`,
-		ExpectError: true,
-	},
-}
+func TestParseExpression(t *testing.T) {
+	var testCases = []struct {
+		Name        string
+		Query       *v3.FilterSet
+		Expr        string
+		ExpectError bool
+	}{
+		{
+			Name: "equal",
+			Query: &v3.FilterSet{Operator: "AND", Items: []v3.FilterItem{
+				{Key: v3.AttributeKey{Key: "key", DataType: v3.AttributeKeyDataTypeString, Type: v3.AttributeKeyTypeTag}, Value: "checkbody", Operator: "="},
+			}},
+			Expr: `attributes["key"] == "checkbody"`,
+		},
+		{
+			Name: "not equal",
+			Query: &v3.FilterSet{Operator: "AND", Items: []v3.FilterItem{
+				{Key: v3.AttributeKey{Key: "key", DataType: v3.AttributeKeyDataTypeString, Type: v3.AttributeKeyTypeTag}, Value: "checkbody", Operator: "!="},
+			}},
+			Expr: `attributes["key"] != "checkbody"`,
+		},
+		{
+			Name: "less than",
+			Query: &v3.FilterSet{Operator: "AND", Items: []v3.FilterItem{
+				{Key: v3.AttributeKey{Key: "key", DataType: v3.AttributeKeyDataTypeInt64, Type: v3.AttributeKeyTypeTag}, Value: 10, Operator: "<"},
+			}},
+			Expr: `attributes["key"] != nil && attributes["key"] < 10`,
+		},
+		{
+			Name: "greater than",
+			Query: &v3.FilterSet{Operator: "AND", Items: []v3.FilterItem{
+				{Key: v3.AttributeKey{Key: "key", DataType: v3.AttributeKeyDataTypeInt64, Type: v3.AttributeKeyTypeTag}, Value: 10, Operator: ">"},
+			}},
+			Expr: `attributes["key"] != nil && attributes["key"] > 10`,
+		},
+		{
+			Name: "less than equal",
+			Query: &v3.FilterSet{Operator: "AND", Items: []v3.FilterItem{
+				{Key: v3.AttributeKey{Key: "key", DataType: v3.AttributeKeyDataTypeString, Type: v3.AttributeKeyTypeTag}, Value: 10, Operator: "<="},
+			}},
+			Expr: `attributes["key"] != nil && attributes["key"] <= 10`,
+		},
+		{
+			Name: "greater than equal",
+			Query: &v3.FilterSet{Operator: "AND", Items: []v3.FilterItem{
+				{Key: v3.AttributeKey{Key: "key", DataType: v3.AttributeKeyDataTypeString, Type: v3.AttributeKeyTypeTag}, Value: 10, Operator: ">="},
+			}},
+			Expr: `attributes["key"] != nil && attributes["key"] >= 10`,
+		},
+		// case sensitive
+		{
+			Name: "body contains",
+			Query: &v3.FilterSet{Operator: "AND", Items: []v3.FilterItem{
+				{Key: v3.AttributeKey{Key: "body", DataType: v3.AttributeKeyDataTypeString, Type: v3.AttributeKeyTypeUnspecified, IsColumn: true}, Value: "checkbody", Operator: "contains"},
+			}},
+			Expr: `body != nil && lower(body) contains lower("checkbody")`,
+		},
+		{
+			Name: "body.log.message exists",
+			Query: &v3.FilterSet{Operator: "AND", Items: []v3.FilterItem{
+				{Key: v3.AttributeKey{Key: "body.log.message", DataType: v3.AttributeKeyDataTypeString, Type: v3.AttributeKeyTypeUnspecified, IsColumn: true}, Value: "", Operator: "exists"},
+			}},
+			Expr: `(((type(body) == "string" && isJSON(body)) && "log.message" in fromJSON(body)) or (type(body) == "map" && (body.log.message != nil)))`,
+		},
+		{
+			Name: "body.log.message not exists",
+			Query: &v3.FilterSet{Operator: "AND", Items: []v3.FilterItem{
+				{Key: v3.AttributeKey{Key: "body.log.message", DataType: v3.AttributeKeyDataTypeString, Type: v3.AttributeKeyTypeUnspecified, IsColumn: true}, Value: "", Operator: "nexists"},
+			}},
+			Expr: `(((type(body) == "string" && isJSON(body)) && "log.message" not in fromJSON(body)) or (type(body) == "map" && (body.log.message == nil)))`,
+		},
+		{
+			Name: "body ncontains",
+			Query: &v3.FilterSet{Operator: "AND", Items: []v3.FilterItem{
+				{Key: v3.AttributeKey{Key: "body", DataType: v3.AttributeKeyDataTypeString, Type: v3.AttributeKeyTypeUnspecified, IsColumn: true}, Value: "checkbody", Operator: "ncontains"},
+			}},
+			Expr: `body != nil && lower(body) not contains lower("checkbody")`,
+		},
+		{
+			Name: "body regex",
+			Query: &v3.FilterSet{Operator: "AND", Items: []v3.FilterItem{
+				{Key: v3.AttributeKey{Key: "body", DataType: v3.AttributeKeyDataTypeString, Type: v3.AttributeKeyTypeUnspecified, IsColumn: true}, Value: "[0-1]+regex$", Operator: "regex"},
+			}},
+			Expr: `body != nil && body matches "[0-1]+regex$"`,
+		},
+		{
+			Name: "body not regex",
+			Query: &v3.FilterSet{Operator: "AND", Items: []v3.FilterItem{
+				{Key: v3.AttributeKey{Key: "body", DataType: v3.AttributeKeyDataTypeString, Type: v3.AttributeKeyTypeUnspecified, IsColumn: true}, Value: "[0-1]+regex$", Operator: "nregex"},
+			}},
+			Expr: `body != nil && body not matches "[0-1]+regex$"`,
+		},
+		{
+			Name: "regex with escape characters",
+			Query: &v3.FilterSet{Operator: "AND", Items: []v3.FilterItem{
+				{Key: v3.AttributeKey{Key: "body", DataType: v3.AttributeKeyDataTypeString, Type: v3.AttributeKeyTypeUnspecified, IsColumn: true}, Value: `^Executing \[\S+@\S+:[0-9]+\] \S+".*`, Operator: "regex"},
+			}},
+			Expr: `body != nil && body matches "^Executing \\[\\S+@\\S+:[0-9]+\\] \\S+\".*"`,
+		},
+		{
+			Name: "invalid regex",
+			Query: &v3.FilterSet{Operator: "AND", Items: []v3.FilterItem{
+				{Key: v3.AttributeKey{Key: "body", DataType: v3.AttributeKeyDataTypeString, Type: v3.AttributeKeyTypeUnspecified, IsColumn: true}, Value: "[0-9]++", Operator: "nregex"},
+			}},
+			Expr:        `body != nil && lower(body) not matches "[0-9]++"`,
+			ExpectError: true,
+		},
+		{
+			Name: "in",
+			Query: &v3.FilterSet{Operator: "AND", Items: []v3.FilterItem{
+				{Key: v3.AttributeKey{Key: "key", DataType: v3.AttributeKeyDataTypeString, Type: v3.AttributeKeyTypeTag}, Value: []any{1, 2, 3, 4}, Operator: "in"},
+			}},
+			Expr: `attributes["key"] != nil && attributes["key"] in [1,2,3,4]`,
+		},
+		{
+			Name: "not in",
+			Query: &v3.FilterSet{Operator: "AND", Items: []v3.FilterItem{
+				{Key: v3.AttributeKey{Key: "key", DataType: v3.AttributeKeyDataTypeString, Type: v3.AttributeKeyTypeTag}, Value: []any{"1", "2"}, Operator: "nin"},
+			}},
+			Expr: `attributes["key"] != nil && attributes["key"] not in ['1','2']`,
+		},
+		{
+			Name: "exists",
+			Query: &v3.FilterSet{Operator: "AND", Items: []v3.FilterItem{
+				{Key: v3.AttributeKey{Key: "key", DataType: v3.AttributeKeyDataTypeString, Type: v3.AttributeKeyTypeTag}, Operator: "exists"},
+			}},
+			Expr: `"key" in attributes`,
+		},
+		{
+			Name: "not exists",
+			Query: &v3.FilterSet{Operator: "AND", Items: []v3.FilterItem{
+				{Key: v3.AttributeKey{Key: "key", DataType: v3.AttributeKeyDataTypeString, Type: v3.AttributeKeyTypeTag}, Operator: "nexists"},
+			}},
+			Expr: `"key" not in attributes`,
+		},
+		{
+			Name: "trace_id not exists",
+			Query: &v3.FilterSet{Operator: "AND", Items: []v3.FilterItem{
+				{Key: v3.AttributeKey{Key: "trace_id", DataType: v3.AttributeKeyDataTypeString, Type: v3.AttributeKeyTypeUnspecified, IsColumn: true}, Value: "", Operator: "nexists"},
+			}},
+			Expr: `trace_id == nil`,
+		},
+		{
+			Name: "trace_id exists",
+			Query: &v3.FilterSet{Operator: "AND", Items: []v3.FilterItem{
+				{Key: v3.AttributeKey{Key: "trace_id", DataType: v3.AttributeKeyDataTypeString, Type: v3.AttributeKeyTypeUnspecified, IsColumn: true}, Value: "", Operator: "exists"},
+			}},
+			Expr: `trace_id != nil`,
+		},
+		{
+			Name: "span_id not exists",
+			Query: &v3.FilterSet{Operator: "AND", Items: []v3.FilterItem{
+				{Key: v3.AttributeKey{Key: "span_id", DataType: v3.AttributeKeyDataTypeString, Type: v3.AttributeKeyTypeUnspecified, IsColumn: true}, Value: "", Operator: "nexists"},
+			}},
+			Expr: `span_id == nil`,
+		},
+		{
+			Name: "span_id exists",
+			Query: &v3.FilterSet{Operator: "AND", Items: []v3.FilterItem{
+				{Key: v3.AttributeKey{Key: "span_id", DataType: v3.AttributeKeyDataTypeString, Type: v3.AttributeKeyTypeUnspecified, IsColumn: true}, Value: "", Operator: "exists"},
+			}},
+			Expr: `span_id != nil`,
+		},
+		{
+			Name: "Multi filter",
+			Query: &v3.FilterSet{Operator: "AND", Items: []v3.FilterItem{
+				{Key: v3.AttributeKey{Key: "key", DataType: v3.AttributeKeyDataTypeString, Type: v3.AttributeKeyTypeTag}, Value: 10, Operator: "<="},
+				{Key: v3.AttributeKey{Key: "body", DataType: v3.AttributeKeyDataTypeString, Type: v3.AttributeKeyTypeUnspecified, IsColumn: true}, Value: "[0-1]+regex$", Operator: "nregex"},
+				{Key: v3.AttributeKey{Key: "key", DataType: v3.AttributeKeyDataTypeString, Type: v3.AttributeKeyTypeTag}, Operator: "nexists"},
+			}},
+			Expr: `attributes["key"] != nil && attributes["key"] <= 10 and body != nil && body not matches "[0-1]+regex$" and "key" not in attributes`,
+		},
+		{
+			Name: "incorrect multi filter",
+			Query: &v3.FilterSet{Operator: "AND", Items: []v3.FilterItem{
+				{Key: v3.AttributeKey{Key: "key", DataType: v3.AttributeKeyDataTypeString, Type: v3.AttributeKeyTypeTag}, Value: 10, Operator: "<="},
+				{Key: v3.AttributeKey{Key: "body", DataType: v3.AttributeKeyDataTypeString, Type: v3.AttributeKeyTypeUnspecified, IsColumn: true}, Value: "[0-9]++", Operator: "nregex"},
+				{Key: v3.AttributeKey{Key: "key", DataType: v3.AttributeKeyDataTypeString, Type: v3.AttributeKeyTypeTag}, Operator: "nexists"},
+			}},
+			Expr:        `attributes["key"] != nil && attributes["key"] <= 10 and body not matches "[0-9]++" and "key" not in attributes`,
+			ExpectError: true,
+		},
+	}
 
-func TestParse(t *testing.T) {
 	for _, tt := range testCases {
-		Convey(tt.Name, t, func() {
+		t.Run(tt.Name, func(t *testing.T) {
 			x, err := Parse(tt.Query)
 			if tt.ExpectError {
-				So(err, ShouldNotBeNil)
+				assert.Error(t, err)
 			} else {
-				So(err, ShouldBeNil)
-				So(x, ShouldEqual, tt.Expr)
+				assert.NoError(t, err)
+				assert.Equal(t, tt.Expr, x)
 			}
 		})
 	}
 }
+
+type EntryComposite struct {
+	ID int
+	*entry.Entry
+}
+
+// makeEntry creates an EntryComposite for tests. Pass nil for traceID/spanID to mean "not set".
+func makeEntry(id int, body any, attributes, resource map[string]any, traceID, spanID []byte) EntryComposite {
+	e := entry.New()
+	e.Body = body
+	if attributes != nil {
+		e.Attributes = attributes
+	} else {
+		e.Attributes = make(map[string]any)
+	}
+	if resource != nil {
+		e.Resource = resource
+	} else {
+		e.Resource = make(map[string]any)
+	}
+	if traceID != nil {
+		e.TraceID = traceID
+	}
+	if spanID != nil {
+		e.SpanID = spanID
+	}
+	return EntryComposite{ID: id, Entry: e}
+}
+
+func TestExpressionVSEntry(t *testing.T) {
+	// Dataset: entries with varied body (JSON and plain text), attributes, trace_id, span_id for filter testing.
+	// IDs 0..12: JSON bodies (body.msg / body.log etc. work). IDs 13..17: simple text log bodies.
+	dataset := []EntryComposite{
+		// JSON body entries (0-12)
+		makeEntry(0, `{"msg":"hello world"}`, map[string]any{"level": "info"}, map[string]any{"env": "prod", "host": "node-0"}, nil, nil),
+		makeEntry(1, `{"msg":"error occurred", "missing": "value"}`, map[string]any{"level": "error"}, map[string]any{"env": "prod", "host": "node-1"}, []byte("trace1"), []byte("span1")),
+		makeEntry(2, `{"msg":"checkbody substring"}`, map[string]any{"level": "info"}, map[string]any{"env": "staging", "host": "node-2"}, []byte("trace2"), nil),
+		makeEntry(3, `{"msg":"no match here"}`, map[string]any{"level": "debug"}, map[string]any{"env": "staging", "host": "node-3"}, nil, []byte("span3")),
+		makeEntry(4, `{"msg":"101regex suffix"}`, map[string]any{"code": "200", "count": int64(5)}, map[string]any{"env": "prod", "host": "node-4"}, nil, nil),
+		makeEntry(5, `{"msg":"plain text only"}`, map[string]any{"code": "404", "count": int64(10)}, map[string]any{"env": "prod", "host": "node-5"}, []byte("trace5"), []byte("span5")),
+		makeEntry(6, `{"log":{"message":"user login"}}`, map[string]any{"service": "auth"}, map[string]any{"env": "dev", "host": "node-6"}, nil, nil),
+		makeEntry(7, `{"log":{"message":"user logout"}}`, map[string]any{"service": "auth", "user_id": "u1"}, map[string]any{"env": "dev", "host": "node-7"}, []byte("trace7"), nil),
+		makeEntry(8, `{"event":"click"}`, map[string]any{"service": "api"}, map[string]any{"env": "dev", "host": "node-8"}, nil, nil),
+		makeEntry(9, `{"msg":"checkbody"}`, map[string]any{"tag": "exact", "num": int64(9)}, map[string]any{"env": "prod", "host": "node-9"}, nil, nil),
+		makeEntry(10, `{"msg":"CHECKBODY case"}`, map[string]any{"tag": "case", "num": int64(10)}, map[string]any{"env": "staging", "host": "node-10"}, nil, nil),
+		makeEntry(11, `{"msg":"foo"}`, map[string]any{"status": "active", "score": int64(100)}, map[string]any{"env": "prod", "host": "node-11"}, nil, nil),
+		makeEntry(12, `{"msg":"bar"}`, map[string]any{"status": "inactive", "score": int64(50)}, map[string]any{"env": "staging", "host": "node-12"}, []byte("trace12"), []byte("span12")),
+		// Plain text log body entries (13-17)
+		makeEntry(13, "Server started on port 8080", map[string]any{"component": "server"}, map[string]any{"env": "prod", "host": "node-13"}, nil, nil),
+		makeEntry(14, "Connection refused to 10.0.0.1:5432", map[string]any{"level": "error"}, map[string]any{"env": "prod", "host": "node-14"}, nil, nil),
+		makeEntry(15, "User login failed for admin", map[string]any{"service": "auth", "level": "warn"}, map[string]any{"env": "dev", "host": "node-15"}, []byte("trace15"), nil),
+		makeEntry(16, "checkbody in text log", map[string]any{"level": "info"}, map[string]any{"env": "staging", "host": "node-16"}, nil, nil),
+		makeEntry(17, "WARN: disk full on /var", map[string]any{"level": "warn"}, map[string]any{"env": "prod", "host": "node-17"}, nil, []byte("span17")),
+		// Body as map (not string) entries (18-20)
+		makeEntry(18, map[string]any{"msg": "checkbody substring", "level": "info"}, map[string]any{"source": "map"}, map[string]any{"env": "prod", "host": "node-18"}, nil, nil),
+		makeEntry(19, map[string]any{"log": map[string]any{"message": "nested value in map body"}, "missing": true}, map[string]any{"source": "map"}, map[string]any{"env": "staging", "host": "node-19"}, []byte("trace19"), nil),
+		makeEntry(20, map[string]any{"event": "deploy", "version": "1.2.0"}, map[string]any{"source": "map", "level": "info"}, map[string]any{"env": "dev", "host": "node-20"}, nil, []byte("span20")),
+	}
+
+	var testCases = []struct {
+		Name            string
+		Query           *v3.FilterSet
+		ExpectedMatches []int
+	}{
+		{
+			Name: "resource equal (env)",
+			Query: &v3.FilterSet{Operator: "AND", Items: []v3.FilterItem{
+				{Key: v3.AttributeKey{Key: "env", DataType: v3.AttributeKeyDataTypeString, Type: v3.AttributeKeyTypeResource}, Value: "prod", Operator: "="},
+			}},
+			ExpectedMatches: []int{0, 1, 4, 5, 9, 11, 13, 14, 17, 18},
+		},
+		{
+			Name: "resource not equal (env)",
+			Query: &v3.FilterSet{Operator: "AND", Items: []v3.FilterItem{
+				{Key: v3.AttributeKey{Key: "env", DataType: v3.AttributeKeyDataTypeString, Type: v3.AttributeKeyTypeResource}, Value: "prod", Operator: "!="},
+			}},
+			ExpectedMatches: []int{2, 3, 6, 7, 8, 10, 12, 15, 16, 19, 20},
+		},
+		{
+			Name: "attribute less than (numeric)",
+			Query: &v3.FilterSet{Operator: "AND", Items: []v3.FilterItem{
+				{Key: v3.AttributeKey{Key: "count", DataType: v3.AttributeKeyDataTypeInt64, Type: v3.AttributeKeyTypeTag}, Value: 8, Operator: "<"},
+			}},
+			ExpectedMatches: []int{4},
+		},
+		{
+			Name: "attribute greater than (numeric)",
+			Query: &v3.FilterSet{Operator: "AND", Items: []v3.FilterItem{
+				{Key: v3.AttributeKey{Key: "count", DataType: v3.AttributeKeyDataTypeInt64, Type: v3.AttributeKeyTypeTag}, Value: 8, Operator: ">"},
+			}},
+			ExpectedMatches: []int{5},
+		},
+		{
+			Name: "body contains (case insensitive)",
+			Query: &v3.FilterSet{Operator: "AND", Items: []v3.FilterItem{
+				{Key: v3.AttributeKey{Key: "body", DataType: v3.AttributeKeyDataTypeString, Type: v3.AttributeKeyTypeUnspecified, IsColumn: true}, Value: "checkbody", Operator: "contains"},
+			}},
+			ExpectedMatches: []int{2, 9, 10, 16},
+		},
+		{
+			Name: "body ncontains",
+			Query: &v3.FilterSet{Operator: "AND", Items: []v3.FilterItem{
+				{Key: v3.AttributeKey{Key: "body", DataType: v3.AttributeKeyDataTypeString, Type: v3.AttributeKeyTypeUnspecified, IsColumn: true}, Value: "checkbody", Operator: "ncontains"},
+			}},
+			ExpectedMatches: []int{0, 1, 3, 4, 5, 6, 7, 8, 11, 12, 13, 14, 15, 17},
+		},
+		{
+			Name: "body.msg (case insensitive)",
+			Query: &v3.FilterSet{Operator: "AND", Items: []v3.FilterItem{
+				{Key: v3.AttributeKey{Key: "body.msg", DataType: v3.AttributeKeyDataTypeString, Type: v3.AttributeKeyTypeUnspecified, IsColumn: false}, Value: "checkbody", Operator: "contains"},
+			}},
+			ExpectedMatches: []int{2, 9, 10, 18},
+		},
+		{
+			Name: "body regex",
+			Query: &v3.FilterSet{Operator: "AND", Items: []v3.FilterItem{
+				{Key: v3.AttributeKey{Key: "body", DataType: v3.AttributeKeyDataTypeString, Type: v3.AttributeKeyTypeUnspecified, IsColumn: true}, Value: "[0-1]+regex", Operator: "regex"},
+			}},
+			ExpectedMatches: []int{4},
+		},
+		{
+			Name: "body not regex",
+			Query: &v3.FilterSet{Operator: "AND", Items: []v3.FilterItem{
+				{Key: v3.AttributeKey{Key: "body", DataType: v3.AttributeKeyDataTypeString, Type: v3.AttributeKeyTypeUnspecified, IsColumn: true}, Value: "[0-1]+regex", Operator: "nregex"},
+			}},
+			ExpectedMatches: []int{0, 1, 2, 3, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17},
+		},
+		// body.log.message exists/nexists: expr checks "log.message" in fromJSON(body); nested key
+		// semantics depend on signoz stanza helper. Omitted here to avoid coupling to env shape.
+		{
+			Name: "body top-level key exists (body.msg)",
+			Query: &v3.FilterSet{Operator: "AND", Items: []v3.FilterItem{
+				{Key: v3.AttributeKey{Key: "body.msg", DataType: v3.AttributeKeyDataTypeString, Type: v3.AttributeKeyTypeUnspecified, IsColumn: true}, Value: "", Operator: "exists"},
+			}},
+			ExpectedMatches: []int{0, 1, 2, 3, 4, 5, 9, 10, 11, 12, 18},
+		},
+		{
+			Name: "body top-level key not exists (body.missing)",
+			Query: &v3.FilterSet{Operator: "AND", Items: []v3.FilterItem{
+				{Key: v3.AttributeKey{Key: "body.missing", DataType: v3.AttributeKeyDataTypeString, Type: v3.AttributeKeyTypeUnspecified, IsColumn: true}, Value: "", Operator: "nexists"},
+			}},
+			ExpectedMatches: []int{0, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 18, 20},
+		},
+		{
+			Name: "attribute exists",
+			Query: &v3.FilterSet{Operator: "AND", Items: []v3.FilterItem{
+				{Key: v3.AttributeKey{Key: "service", DataType: v3.AttributeKeyDataTypeString, Type: v3.AttributeKeyTypeTag}, Operator: "exists"},
+			}},
+			ExpectedMatches: []int{6, 7, 8, 15},
+		},
+		{
+			Name: "attribute not exists",
+			Query: &v3.FilterSet{Operator: "AND", Items: []v3.FilterItem{
+				{Key: v3.AttributeKey{Key: "service", DataType: v3.AttributeKeyDataTypeString, Type: v3.AttributeKeyTypeTag}, Operator: "nexists"},
+			}},
+			ExpectedMatches: []int{0, 1, 2, 3, 4, 5, 9, 10, 11, 12, 13, 14, 16, 17, 18, 19, 20},
+		},
+		{
+			Name: "trace_id exists",
+			Query: &v3.FilterSet{Operator: "AND", Items: []v3.FilterItem{
+				{Key: v3.AttributeKey{Key: "trace_id", DataType: v3.AttributeKeyDataTypeString, Type: v3.AttributeKeyTypeUnspecified, IsColumn: true}, Value: "", Operator: "exists"},
+			}},
+			ExpectedMatches: []int{1, 2, 5, 7, 12, 15, 19},
+		},
+		{
+			Name: "trace_id not exists",
+			Query: &v3.FilterSet{Operator: "AND", Items: []v3.FilterItem{
+				{Key: v3.AttributeKey{Key: "trace_id", DataType: v3.AttributeKeyDataTypeString, Type: v3.AttributeKeyTypeUnspecified, IsColumn: true}, Value: "", Operator: "nexists"},
+			}},
+			ExpectedMatches: []int{0, 3, 4, 6, 8, 9, 10, 11, 13, 14, 16, 17, 18, 20},
+		},
+		{
+			Name: "span_id exists",
+			Query: &v3.FilterSet{Operator: "AND", Items: []v3.FilterItem{
+				{Key: v3.AttributeKey{Key: "span_id", DataType: v3.AttributeKeyDataTypeString, Type: v3.AttributeKeyTypeUnspecified, IsColumn: true}, Value: "", Operator: "exists"},
+			}},
+			ExpectedMatches: []int{1, 3, 5, 12, 17, 20},
+		},
+		{
+			Name: "span_id not exists",
+			Query: &v3.FilterSet{Operator: "AND", Items: []v3.FilterItem{
+				{Key: v3.AttributeKey{Key: "span_id", DataType: v3.AttributeKeyDataTypeString, Type: v3.AttributeKeyTypeUnspecified, IsColumn: true}, Value: "", Operator: "nexists"},
+			}},
+			ExpectedMatches: []int{0, 2, 4, 6, 7, 8, 9, 10, 11, 13, 14, 15, 16, 18, 19},
+		},
+		{
+			Name: "in (attribute in list)",
+			Query: &v3.FilterSet{Operator: "AND", Items: []v3.FilterItem{
+				{Key: v3.AttributeKey{Key: "level", DataType: v3.AttributeKeyDataTypeString, Type: v3.AttributeKeyTypeTag}, Value: []any{"info", "error"}, Operator: "in"},
+			}},
+			ExpectedMatches: []int{0, 1, 2, 14, 16, 20},
+		},
+		{
+			Name: "not in (attribute not in list)",
+			Query: &v3.FilterSet{Operator: "AND", Items: []v3.FilterItem{
+				{Key: v3.AttributeKey{Key: "level", DataType: v3.AttributeKeyDataTypeString, Type: v3.AttributeKeyTypeTag}, Value: []any{"error", "warn"}, Operator: "nin"},
+			}},
+			ExpectedMatches: []int{0, 2, 3, 16, 20},
+		},
+		{
+			Name: "multi filter AND",
+			Query: &v3.FilterSet{Operator: "AND", Items: []v3.FilterItem{
+				{Key: v3.AttributeKey{Key: "env", DataType: v3.AttributeKeyDataTypeString, Type: v3.AttributeKeyTypeResource}, Value: "staging", Operator: "="},
+				{Key: v3.AttributeKey{Key: "level", DataType: v3.AttributeKeyDataTypeString, Type: v3.AttributeKeyTypeTag}, Value: "info", Operator: "="},
+			}},
+			ExpectedMatches: []int{2, 16},
+		},
+		{
+			Name: "multi filter AND (two attributes)",
+			Query: &v3.FilterSet{Operator: "AND", Items: []v3.FilterItem{
+				{Key: v3.AttributeKey{Key: "service", DataType: v3.AttributeKeyDataTypeString, Type: v3.AttributeKeyTypeTag}, Value: "auth", Operator: "="},
+				{Key: v3.AttributeKey{Key: "level", DataType: v3.AttributeKeyDataTypeString, Type: v3.AttributeKeyTypeTag}, Operator: "nexists"},
+			}},
+			ExpectedMatches: []int{6, 7},
+		},
+		// Multi-filter variations: body + attribute, three conditions, trace/span + attribute
+		{
+			Name: "multi filter AND body contains + attribute",
+			Query: &v3.FilterSet{Operator: "AND", Items: []v3.FilterItem{
+				{Key: v3.AttributeKey{Key: "body", DataType: v3.AttributeKeyDataTypeString, Type: v3.AttributeKeyTypeUnspecified, IsColumn: true}, Value: "Connection", Operator: "contains"},
+				{Key: v3.AttributeKey{Key: "env", DataType: v3.AttributeKeyDataTypeString, Type: v3.AttributeKeyTypeResource}, Value: "prod", Operator: "="},
+			}},
+			ExpectedMatches: []int{14},
+		},
+		{
+			Name: "multi filter AND body contains + service",
+			Query: &v3.FilterSet{Operator: "AND", Items: []v3.FilterItem{
+				{Key: v3.AttributeKey{Key: "body", DataType: v3.AttributeKeyDataTypeString, Type: v3.AttributeKeyTypeUnspecified, IsColumn: true}, Value: "login", Operator: "contains"},
+				{Key: v3.AttributeKey{Key: "service", DataType: v3.AttributeKeyDataTypeString, Type: v3.AttributeKeyTypeTag}, Value: "auth", Operator: "="},
+			}},
+			ExpectedMatches: []int{6, 15},
+		},
+		{
+			Name: "multi filter AND env + level (prod error)",
+			Query: &v3.FilterSet{Operator: "AND", Items: []v3.FilterItem{
+				{Key: v3.AttributeKey{Key: "env", DataType: v3.AttributeKeyDataTypeString, Type: v3.AttributeKeyTypeResource}, Value: "prod", Operator: "="},
+				{Key: v3.AttributeKey{Key: "level", DataType: v3.AttributeKeyDataTypeString, Type: v3.AttributeKeyTypeTag}, Value: "error", Operator: "="},
+			}},
+			ExpectedMatches: []int{1, 14},
+		},
+		{
+			Name: "multi filter AND three conditions (staging + checkbody + info)",
+			Query: &v3.FilterSet{Operator: "AND", Items: []v3.FilterItem{
+				{Key: v3.AttributeKey{Key: "env", DataType: v3.AttributeKeyDataTypeString, Type: v3.AttributeKeyTypeResource}, Value: "staging", Operator: "="},
+				{Key: v3.AttributeKey{Key: "body", DataType: v3.AttributeKeyDataTypeString, Type: v3.AttributeKeyTypeUnspecified, IsColumn: true}, Value: "checkbody", Operator: "contains"},
+				{Key: v3.AttributeKey{Key: "level", DataType: v3.AttributeKeyDataTypeString, Type: v3.AttributeKeyTypeTag}, Value: "info", Operator: "="},
+			}},
+			ExpectedMatches: []int{2, 16},
+		},
+		{
+			Name: "multi filter AND trace_id exists + body contains",
+			Query: &v3.FilterSet{Operator: "AND", Items: []v3.FilterItem{
+				{Key: v3.AttributeKey{Key: "trace_id", DataType: v3.AttributeKeyDataTypeString, Type: v3.AttributeKeyTypeUnspecified, IsColumn: true}, Value: "", Operator: "exists"},
+				{Key: v3.AttributeKey{Key: "body", DataType: v3.AttributeKeyDataTypeString, Type: v3.AttributeKeyTypeUnspecified, IsColumn: true}, Value: "checkbody", Operator: "contains"},
+			}},
+			ExpectedMatches: []int{2},
+		},
+		{
+			Name: "multi filter AND span_id nexists + service auth",
+			Query: &v3.FilterSet{Operator: "AND", Items: []v3.FilterItem{
+				{Key: v3.AttributeKey{Key: "span_id", DataType: v3.AttributeKeyDataTypeString, Type: v3.AttributeKeyTypeUnspecified, IsColumn: true}, Value: "", Operator: "nexists"},
+				{Key: v3.AttributeKey{Key: "service", DataType: v3.AttributeKeyDataTypeString, Type: v3.AttributeKeyTypeTag}, Value: "auth", Operator: "="},
+			}},
+			ExpectedMatches: []int{6, 7, 15},
+		},
+		{
+			Name: "multi filter AND body regex + attribute",
+			Query: &v3.FilterSet{Operator: "AND", Items: []v3.FilterItem{
+				{Key: v3.AttributeKey{Key: "body", DataType: v3.AttributeKeyDataTypeString, Type: v3.AttributeKeyTypeUnspecified, IsColumn: true}, Value: "[0-1]+regex", Operator: "regex"},
+				{Key: v3.AttributeKey{Key: "code", DataType: v3.AttributeKeyDataTypeString, Type: v3.AttributeKeyTypeTag}, Value: "200", Operator: "="},
+			}},
+			ExpectedMatches: []int{4},
+		},
+		{
+			Name: "multi filter AND no trace_id + no span_id + env prod",
+			Query: &v3.FilterSet{Operator: "AND", Items: []v3.FilterItem{
+				{Key: v3.AttributeKey{Key: "trace_id", DataType: v3.AttributeKeyDataTypeString, Type: v3.AttributeKeyTypeUnspecified, IsColumn: true}, Value: "", Operator: "nexists"},
+				{Key: v3.AttributeKey{Key: "span_id", DataType: v3.AttributeKeyDataTypeString, Type: v3.AttributeKeyTypeUnspecified, IsColumn: true}, Value: "", Operator: "nexists"},
+				{Key: v3.AttributeKey{Key: "env", DataType: v3.AttributeKeyDataTypeString, Type: v3.AttributeKeyTypeResource}, Value: "prod", Operator: "="},
+			}},
+			ExpectedMatches: []int{0, 4, 9, 11, 13, 14, 18},
+		},
+		{
+			Name: "multi filter AND level warn + body contains",
+			Query: &v3.FilterSet{Operator: "AND", Items: []v3.FilterItem{
+				{Key: v3.AttributeKey{Key: "level", DataType: v3.AttributeKeyDataTypeString, Type: v3.AttributeKeyTypeTag}, Value: "warn", Operator: "="},
+				{Key: v3.AttributeKey{Key: "body", DataType: v3.AttributeKeyDataTypeString, Type: v3.AttributeKeyTypeUnspecified, IsColumn: true}, Value: "disk", Operator: "contains"},
+			}},
+			ExpectedMatches: []int{17},
+		},
+		{
+			Name: "no matches (attribute value not present)",
+			Query: &v3.FilterSet{Operator: "AND", Items: []v3.FilterItem{
+				{Key: v3.AttributeKey{Key: "env", DataType: v3.AttributeKeyDataTypeString, Type: v3.AttributeKeyTypeResource}, Value: "never", Operator: "="},
+			}},
+			ExpectedMatches: []int{},
+		},
+		{
+			Name: "attribute equal and trace_id exists",
+			Query: &v3.FilterSet{Operator: "AND", Items: []v3.FilterItem{
+				{Key: v3.AttributeKey{Key: "code", DataType: v3.AttributeKeyDataTypeString, Type: v3.AttributeKeyTypeTag}, Value: "404", Operator: "="},
+				{Key: v3.AttributeKey{Key: "trace_id", DataType: v3.AttributeKeyDataTypeString, Type: v3.AttributeKeyTypeUnspecified, IsColumn: true}, Value: "", Operator: "exists"},
+			}},
+			ExpectedMatches: []int{5},
+		},
+	}
+
+	for _, tt := range testCases {
+		t.Run(tt.Name, func(t *testing.T) {
+			expression, err := Parse(tt.Query)
+			assert.NoError(t, err)
+
+			compiled, hasBodyFieldRef, err := signozstanzahelper.ExprCompileBool(expression)
+			assert.NoError(t, err)
+
+			matchedIDs := []int{}
+			for _, d := range dataset {
+				env := signozstanzahelper.GetExprEnv(d.Entry, hasBodyFieldRef)
+				matches, err := vm.Run(compiled, env)
+				signozstanzahelper.PutExprEnv(env)
+				if err != nil {
+					// Eval error (e.g. fromJSON on non-JSON body) => treat as no match
+					continue
+				}
+				if matches != nil && matches.(bool) {
+					matchedIDs = append(matchedIDs, d.ID)
+				}
+			}
+			assert.Equal(t, tt.ExpectedMatches, matchedIDs, "query %q", tt.Name)
+		})
+	}
+}