chore: combining two functions into a common flow

* fix: skip resource filter if it exceeds a threshold

* fix: test cleanup

* fix: test cleanup

* fix: more cleanup

* fix: tests

.github/workflows/integrationci.yaml

@@ -52,6 +52,7 @@ jobs:
           - rootuser
           - serviceaccount
           - querier_json_body
+          - querier_skip_resource_fingerprint
           - ttl
         sqlstore-provider:
           - postgres

frontend/src/components/FieldsSelector/AddedFields.tsx

@@ -144,10 +144,7 @@ function AddedFields({
 										field={field}
 										onRemove={handleRemove}
 										allowDrag={allowDrag}
-										isRequired={
-											requiredFields.includes(field.name) ||
-											requiredFields.includes(field.key as string)
-										}
+										isRequired={requiredFields.includes(field.key as string)}
 									/>
 								))}
 							</SortableContext>

frontend/src/components/FieldsSelector/__tests__/AddedFields.test.tsx

@@ -25,7 +25,7 @@ describe('AddedFields — requiredFields', () => {
 		expect(screen.getAllByRole('button', { name: /remove/i })).toHaveLength(3);
 	});
 
-	it('hides the Remove button for fields whose name is in requiredFields', () => {
+	it('hides the Remove button for fields whose composite key is in requiredFields', () => {
 		const fields = [makeField('a'), makeField('b'), makeField('c')];
 
 		render(
@@ -33,7 +33,7 @@ describe('AddedFields — requiredFields', () => {
 				inputValue=""
 				fields={fields}
 				onFieldsChange={jest.fn()}
-				requiredFields={['a', 'c']}
+				requiredFields={['log.a', 'log.c']}
 			/>,
 		);
 
@@ -50,7 +50,7 @@ describe('AddedFields — requiredFields', () => {
 				inputValue=""
 				fields={fields}
 				onFieldsChange={jest.fn()}
-				requiredFields={['a']}
+				requiredFields={['log.a']}
 			/>,
 		);
 
@@ -58,9 +58,9 @@ describe('AddedFields — requiredFields', () => {
 		expect(screen.getByText('b')).toBeInTheDocument();
 	});
 
-	it('locks all variants of a required name regardless of fieldContext', () => {
-		// Two `body` fields with different contexts — both should lock when
-		// `body` is in requiredFields.
+	it('locks ONLY the canonical variant — a same-name field from another context stays removable', () => {
+		// Two `body` fields with different contexts. requiredFields holds the
+		// canonical composite key only, so the attribute variant is deletable.
 		const fields = [makeField('body', 'log'), makeField('body', 'attribute')];
 
 		render(
@@ -68,41 +68,6 @@ describe('AddedFields — requiredFields', () => {
 				inputValue=""
 				fields={fields}
 				onFieldsChange={jest.fn()}
-				requiredFields={['body']}
-			/>,
-		);
-
-		// Both 'body' variants locked → zero Remove buttons.
-		expect(screen.queryAllByRole('button', { name: /remove/i })).toHaveLength(0);
-	});
-
-	it('treats requiredFields as exact-name match (substring does not lock)', () => {
-		const fields = [makeField('body'), makeField('body_extra')];
-
-		render(
-			<AddedFields
-				inputValue=""
-				fields={fields}
-				onFieldsChange={jest.fn()}
-				requiredFields={['body']}
-			/>,
-		);
-
-		// 'body' locked, 'body_extra' removable.
-		expect(screen.getAllByRole('button', { name: /remove/i })).toHaveLength(1);
-	});
-
-	it('also accepts composite IDs in requiredFields (locks a specific variant)', () => {
-		// Two `body` fields with different contexts.
-		const fields = [makeField('body', 'log'), makeField('body', 'attribute')];
-
-		render(
-			<AddedFields
-				inputValue=""
-				fields={fields}
-				onFieldsChange={jest.fn()}
-				// Composite ID — locks ONLY the log variant, attribute variant stays
-				// removable.
 				requiredFields={['log.body']}
 			/>,
 		);
@@ -110,4 +75,37 @@ describe('AddedFields — requiredFields', () => {
 		// One Remove button: the attribute variant. log variant is locked.
 		expect(screen.getAllByRole('button', { name: /remove/i })).toHaveLength(1);
 	});
+
+	it('does not lock anything when a bare name is passed (composite key required)', () => {
+		// Bare `body` no longer matches — matching is composite-key only now.
+		const fields = [makeField('body', 'log'), makeField('body', 'attribute')];
+
+		render(
+			<AddedFields
+				inputValue=""
+				fields={fields}
+				onFieldsChange={jest.fn()}
+				requiredFields={['body']}
+			/>,
+		);
+
+		// Neither variant locked → both removable.
+		expect(screen.getAllByRole('button', { name: /remove/i })).toHaveLength(2);
+	});
+
+	it('treats requiredFields as exact composite-key match (substring does not lock)', () => {
+		const fields = [makeField('body'), makeField('body_extra')];
+
+		render(
+			<AddedFields
+				inputValue=""
+				fields={fields}
+				onFieldsChange={jest.fn()}
+				requiredFields={['log.body']}
+			/>,
+		);
+
+		// 'log.body' locked, 'log.body_extra' removable.
+		expect(screen.getAllByRole('button', { name: /remove/i })).toHaveLength(1);
+	});
 });

frontend/src/components/Logs/TableView/__tests__/useLogsTableColumns.test.tsx

@@ -10,9 +10,9 @@ jest.mock('providers/Timezone', () => ({
 	}),
 }));
 
-const field = (name: string): IField => ({
+const field = (name: string, type = ''): IField => ({
 	name,
-	type: '',
+	type,
 	dataType: 'string',
 });
 
@@ -38,18 +38,16 @@ describe('useLogsTableColumns — selectColumns-order respected', () => {
 			useLogsTableColumns({
 				fields: [
 					field('service.name'),
-					field('body'),
+					field('body', 'log'),
 					field('request.id'),
-					field('timestamp'),
+					field('timestamp', 'log'),
 				],
 				fontSize: FontSize.SMALL,
 			}),
 		);
 
-		// body/timestamp are NOT pinned to fixed positions — they appear where the
-		// caller placed them in `fields`. body/timestamp use composite IDs
-		// ('log.body', 'log.timestamp') since their fieldContext is fixed; user
-		// fields here have empty `type` so their composite collapses to bare name.
+		// body/timestamp appear where the caller placed them, keyed by their
+		// composite IDs ('log.*'); contextless user fields collapse to bare name.
 		expect(result.current.map((c) => c.id)).toStrictEqual([
 			'state-indicator',
 			'service.name',
@@ -59,6 +57,43 @@ describe('useLogsTableColumns — selectColumns-order respected', () => {
 		]);
 	});
 
+	it('renders a same-name field from another context as a DISTINCT column (no collision)', () => {
+		const { result } = renderHook(() =>
+			useLogsTableColumns({
+				fields: [field('body', 'log'), field('body', 'attribute')],
+				fontSize: FontSize.SMALL,
+			}),
+		);
+
+		const byId = new Map(result.current.map((c) => [c.id, c]));
+		// Attribute variant is its own column, not a duplicate 'log.body'.
+		expect(result.current.map((c) => c.id)).toStrictEqual([
+			'state-indicator',
+			'log.body',
+			'attribute.body',
+		]);
+		expect(byId.get('log.body')?.enableRemove).toBe(false);
+		expect(byId.get('attribute.body')?.enableRemove).toBe(true);
+	});
+
+	it('applies the same distinct-column treatment to timestamp variants', () => {
+		const { result } = renderHook(() =>
+			useLogsTableColumns({
+				fields: [field('timestamp', 'log'), field('timestamp', 'attribute')],
+				fontSize: FontSize.SMALL,
+			}),
+		);
+
+		const byId = new Map(result.current.map((c) => [c.id, c]));
+		expect(result.current.map((c) => c.id)).toStrictEqual([
+			'state-indicator',
+			'log.timestamp',
+			'attribute.timestamp',
+		]);
+		expect(byId.get('log.timestamp')?.enableRemove).toBe(false);
+		expect(byId.get('attribute.timestamp')?.enableRemove).toBe(true);
+	});
+
 	it('skips the synthetic "id" field name', () => {
 		const { result } = renderHook(() =>
 			useLogsTableColumns({
@@ -77,7 +112,11 @@ describe('useLogsTableColumns — selectColumns-order respected', () => {
 	it('uses the special body/timestamp coldefs (canBeHidden=false), not the generic user field def', () => {
 		const { result } = renderHook(() =>
 			useLogsTableColumns({
-				fields: [field('body'), field('timestamp'), field('user_field')],
+				fields: [
+					field('body', 'log'),
+					field('timestamp', 'log'),
+					field('user_field'),
+				],
 				fontSize: FontSize.SMALL,
 			}),
 		);

frontend/src/components/Logs/TableView/useLogsTableColumns.tsx

@@ -96,15 +96,18 @@ export function useLogsTableColumns({
 			),
 		});
 
+		// Match body/timestamp by composite key, not bare name — else a variant
+		// like `attribute.body` collapses onto `log.body`, duplicating the column.
 		const fieldCols = fields
 			.map((f): TableColumnDef<ILog> | null => {
 				if (f.name === 'id') {
 					return null;
 				}
-				if (f.name === 'timestamp') {
+				const compositeKey = buildCompositeKey(f.name, f.type);
+				if (compositeKey === timestampCol.id) {
 					return timestampCol;
 				}
-				if (f.name === 'body') {
+				if (compositeKey === bodyCol.id) {
 					return bodyCol;
 				}
 				return makeUserFieldCol(f);

frontend/src/container/OptionsMenu/__test__/ensureLogsRequiredColumns.test.ts

@@ -67,13 +67,23 @@ describe('ensureLogsRequiredColumns', () => {
 		]);
 	});
 
-	it('does not duplicate if a required column appears twice in the input', () => {
-		// Tolerant of malformed input — invariant only adds *missing* required
-		// columns; it does not deduplicate existing entries (that's a separate
-		// concern, not its job).
+	it('collapses composite-key duplicates in the input', () => {
+		// Two identical `body` entries → deduped to one, then timestamp prepended.
 		const input = [BODY, BODY, ATTR_A];
 		const result = ensureLogsRequiredColumns(input);
-		expect(result.filter((c) => c.name === 'timestamp')).toHaveLength(1);
-		expect(result[0]).toStrictEqual(TIMESTAMP);
+		expect(result).toStrictEqual([TIMESTAMP, BODY, ATTR_A]);
+		expect(result.filter((c) => c.name === 'body')).toHaveLength(1);
+	});
+
+	it('keeps same-name fields with different contexts as distinct columns', () => {
+		// Different composite keys → both legitimate, neither deduped.
+		const ATTR_BODY: TelemetryFieldKey = {
+			name: 'body',
+			signal: 'logs',
+			fieldContext: 'attribute',
+			fieldDataType: 'string',
+		};
+		const input = [TIMESTAMP, BODY, ATTR_BODY];
+		expect(ensureLogsRequiredColumns(input)).toStrictEqual(input);
 	});
 });

frontend/src/container/OptionsMenu/constants.ts

@@ -2,6 +2,7 @@ import { TelemetryFieldKey } from 'api/v5/v5';
 import { DataSource } from 'types/common/queryBuilder';
 
 import { FontSize, OptionsQuery } from './types';
+import { buildCompositeKey } from './utils';
 
 export const URL_OPTIONS = 'options';
 
@@ -35,22 +36,48 @@ export const defaultLogsSelectedColumns: TelemetryFieldKey[] = [
 	},
 ];
 
-export const LOGS_REQUIRED_COLUMNS = ['timestamp', 'body'] as const;
+// Names that must always be present in logs selectColumns (writer invariant).
+const LOGS_REQUIRED_COLUMN_NAMES = defaultLogsSelectedColumns.map(
+	(c) => c.name,
+);
 
-/**
- * Always-on invariant: every logs selectColumns array must contain `body` and
- * `timestamp`. Applied at both loader and writer boundaries so the picker, the
- * table, and persisted state can never diverge into a "missing required
- * column" state.
- */
+// Composite keys (not bare names) so the picker locks ONLY the canonical
+// `log.body`/`log.timestamp` — a same-name variant like `attribute.body` stays
+// removable.
+export const LOGS_REQUIRED_COLUMNS = defaultLogsSelectedColumns.map((c) =>
+	buildCompositeKey(c.name, c.fieldContext),
+);
+
+// Drop composite-key duplicates (never legitimate — they only come from
+// corrupted state). Returns the same array reference when nothing to dedupe.
+export function dedupeColumnsByCompositeKey(
+	columns: TelemetryFieldKey[],
+): TelemetryFieldKey[] {
+	const seen = new Set<string>();
+	let hasDuplicate = false;
+	const deduped = columns.filter((c) => {
+		const key = buildCompositeKey(c.name, c.fieldContext);
+		if (seen.has(key)) {
+			hasDuplicate = true;
+			return false;
+		}
+		seen.add(key);
+		return true;
+	});
+	return hasDuplicate ? deduped : columns;
+}
+
+// Logs selectColumns invariant: no composite-key duplicates, and body +
+// timestamp always present. Applied at loader + writer boundaries.
 export function ensureLogsRequiredColumns(
 	columns: TelemetryFieldKey[],
 ): TelemetryFieldKey[] {
-	const missing = LOGS_REQUIRED_COLUMNS.filter(
-		(name) => !columns.some((c) => c.name === name),
+	const deduped = dedupeColumnsByCompositeKey(columns);
+	const missing = LOGS_REQUIRED_COLUMN_NAMES.filter(
+		(name) => !deduped.some((c) => c.name === name),
 	);
 	if (missing.length === 0) {
-		return columns;
+		return deduped;
 	}
 	const defaultsByName = new Map(
 		defaultLogsSelectedColumns.map((c) => [c.name, c]),
@@ -58,7 +85,7 @@ export function ensureLogsRequiredColumns(
 	const prepended = missing
 		.map((name) => defaultsByName.get(name))
 		.filter((c): c is TelemetryFieldKey => c !== undefined);
-	return [...prepended, ...columns];
+	return [...prepended, ...deduped];
 }
 
 export const defaultTraceSelectedColumns: TelemetryFieldKey[] = [

frontend/src/container/OrganizationSettings/AuthDomain/CreateEdit/CreateEdit.tsx

@@ -103,7 +103,7 @@ function CreateOrEdit(props: CreateOrEditProps): JSX.Element {
 
 		return {
 			...rest,
-			...(domainToAdminEmail && { domainToAdminEmail }),
+			domainToAdminEmail: domainToAdminEmail ?? {},
 		};
 	}, [form]);
 
@@ -129,7 +129,7 @@ function CreateOrEdit(props: CreateOrEditProps): JSX.Element {
 
 		return {
 			...rest,
-			...(groupMappings && { groupMappings }),
+			groupMappings: groupMappings ?? {},
 		};
 	}, [form]);
 

frontend/src/container/OrganizationSettings/AuthDomain/CreateEdit/CreateEdit.utils.test.ts

@@ -0,0 +1,144 @@
+import { AuthtypesAuthNProviderDTO } from 'api/generated/services/sigNoz.schemas';
+
+import {
+	convertDomainMappingsToList,
+	convertDomainMappingsToRecord,
+	convertGroupMappingsToList,
+	convertGroupMappingsToRecord,
+	prepareInitialValues,
+} from './CreateEdit.utils';
+
+describe('convertGroupMappingsToRecord', () => {
+	it('returns undefined for an empty list', () => {
+		expect(convertGroupMappingsToRecord([])).toBeUndefined();
+	});
+
+	it('returns undefined when input is undefined', () => {
+		expect(convertGroupMappingsToRecord(undefined)).toBeUndefined();
+	});
+
+	it('converts entries to a Record', () => {
+		expect(
+			convertGroupMappingsToRecord([
+				{ groupName: 'admins', role: 'ADMIN' },
+				{ groupName: 'viewers', role: 'VIEWER' },
+			]),
+		).toStrictEqual({ admins: 'ADMIN', viewers: 'VIEWER' });
+	});
+
+	it('skips entries with missing groupName or role', () => {
+		expect(
+			convertGroupMappingsToRecord([
+				{ groupName: 'admins', role: 'ADMIN' },
+				{ groupName: '', role: 'VIEWER' },
+				{ role: 'EDITOR' },
+			]),
+		).toStrictEqual({ admins: 'ADMIN' });
+	});
+});
+
+describe('convertDomainMappingsToRecord', () => {
+	it('returns undefined for an empty list', () => {
+		expect(convertDomainMappingsToRecord([])).toBeUndefined();
+	});
+
+	it('returns undefined when input is undefined', () => {
+		expect(convertDomainMappingsToRecord(undefined)).toBeUndefined();
+	});
+
+	it('converts entries to a Record', () => {
+		expect(
+			convertDomainMappingsToRecord([
+				{ domain: 'example.com', adminEmail: 'admin@example.com' },
+				{ domain: 'corp.io', adminEmail: 'it@corp.io' },
+			]),
+		).toStrictEqual({
+			'example.com': 'admin@example.com',
+			'corp.io': 'it@corp.io',
+		});
+	});
+});
+
+describe('round-trip fidelity', () => {
+	it('Record → list → Record preserves group mappings', () => {
+		const original = { admins: 'ADMIN', devs: 'EDITOR', viewers: 'VIEWER' };
+		expect(
+			convertGroupMappingsToRecord(convertGroupMappingsToList(original)),
+		).toStrictEqual(original);
+	});
+
+	it('Record → list → Record preserves domain mappings', () => {
+		const original = {
+			'example.com': 'admin@example.com',
+			'corp.io': 'it@corp.io',
+		};
+		expect(
+			convertDomainMappingsToRecord(convertDomainMappingsToList(original)),
+		).toStrictEqual(original);
+	});
+});
+
+describe('prepareInitialValues', () => {
+	it('returns empty defaults when no record is provided', () => {
+		expect(prepareInitialValues(undefined)).toStrictEqual({
+			name: '',
+			ssoEnabled: false,
+			ssoType: '',
+		});
+	});
+
+	it('hydrates groupMappings Record into groupMappingsList for the form', () => {
+		const result = prepareInitialValues({
+			id: 'domain-1',
+			name: 'example.com',
+			config: {
+				ssoEnabled: true,
+				ssoType: AuthtypesAuthNProviderDTO.saml,
+				roleMapping: {
+					defaultRole: 'VIEWER',
+					useRoleAttribute: false,
+					groupMappings: { admins: 'ADMIN', viewers: 'VIEWER' },
+				},
+			},
+		});
+
+		expect(result.roleMapping?.groupMappingsList).toStrictEqual([
+			{ groupName: 'admins', role: 'ADMIN' },
+			{ groupName: 'viewers', role: 'VIEWER' },
+		]);
+	});
+
+	it('hydrates domainToAdminEmail Record into domainToAdminEmailList for the form', () => {
+		const result = prepareInitialValues({
+			id: 'domain-1',
+			name: 'example.com',
+			config: {
+				ssoEnabled: true,
+				ssoType: AuthtypesAuthNProviderDTO.google_auth,
+				googleAuthConfig: {
+					clientId: 'id',
+					clientSecret: 'secret',
+					domainToAdminEmail: { 'example.com': 'admin@example.com' },
+				},
+			},
+		});
+
+		expect(result.googleAuthConfig?.domainToAdminEmailList).toStrictEqual([
+			{ domain: 'example.com', adminEmail: 'admin@example.com' },
+		]);
+	});
+
+	it('sets groupMappingsList to empty array when roleMapping has no groupMappings', () => {
+		const result = prepareInitialValues({
+			id: 'domain-1',
+			name: 'example.com',
+			config: {
+				ssoEnabled: true,
+				ssoType: AuthtypesAuthNProviderDTO.oidc,
+				roleMapping: { defaultRole: 'VIEWER', useRoleAttribute: true },
+			},
+		});
+
+		expect(result.roleMapping?.groupMappingsList).toStrictEqual([]);
+	});
+});

frontend/src/container/OrganizationSettings/AuthDomain/__tests__/CreateEdit.payload.test.tsx

@@ -0,0 +1,169 @@
+import { fireEvent, render, screen, waitFor } from 'tests/test-utils';
+import { rest, server } from 'mocks-server/server';
+
+import CreateEdit from '../CreateEdit/CreateEdit';
+import {
+	AUTH_DOMAINS_UPDATE_ENDPOINT,
+	mockDomainWithRoleMapping,
+	mockGoogleAuthWithWorkspaceGroups,
+	mockUpdateSuccessResponse,
+} from './mocks';
+
+// The real @signozhq/ui/button has internal effects that prevent form.validateFields()
+// from resolving inside act(). Mirror the pattern from SSOEnforcementToggle.test.tsx
+// which mocks @signozhq/ui/switch for the same reason.
+jest.mock('@signozhq/ui/button', () => ({
+	...jest.requireActual('@signozhq/ui/button'),
+	Button: ({
+		children,
+		onClick,
+		loading,
+		disabled,
+		'aria-label': ariaLabel,
+		prefix,
+		suffix,
+	}: {
+		children?: React.ReactNode;
+		onClick?: React.MouseEventHandler<HTMLButtonElement>;
+		loading?: boolean;
+		disabled?: boolean;
+		'aria-label'?: string;
+		prefix?: React.ReactNode;
+		suffix?: React.ReactNode;
+	}) => (
+		<button
+			type="button"
+			onClick={onClick}
+			disabled={disabled || loading}
+			aria-label={ariaLabel}
+		>
+			{prefix}
+			{children}
+			{suffix}
+		</button>
+	),
+}));
+
+describe('CreateEdit — save payload correctness', () => {
+	afterEach(() => {
+		server.resetHandlers();
+	});
+
+	it('sends groupMappings: {} when all group mappings are deleted', async () => {
+		let capturedPayload: unknown = null;
+
+		server.use(
+			rest.put(AUTH_DOMAINS_UPDATE_ENDPOINT, async (req, res, ctx) => {
+				capturedPayload = await req.json();
+				return res(ctx.status(200), ctx.json(mockUpdateSuccessResponse));
+			}),
+		);
+
+		render(
+			<CreateEdit
+				isCreate={false}
+				record={mockDomainWithRoleMapping}
+				onClose={jest.fn()}
+			/>,
+		);
+
+		// Open the Role Mapping collapse (Ant Design Collapse responds to click events)
+		fireEvent.click(screen.getByText(/role mapping \(advanced\)/i));
+
+		// Wait for the 3 group mapping rows to appear
+		await waitFor(() =>
+			expect(
+				screen.getAllByRole('button', { name: /remove mapping/i }),
+			).toHaveLength(3),
+		);
+
+		// Delete each row; re-query after each removal
+		fireEvent.click(
+			screen.getAllByRole('button', { name: /remove mapping/i })[0],
+		);
+		await waitFor(() =>
+			expect(
+				screen.getAllByRole('button', { name: /remove mapping/i }),
+			).toHaveLength(2),
+		);
+
+		fireEvent.click(
+			screen.getAllByRole('button', { name: /remove mapping/i })[0],
+		);
+		await waitFor(() =>
+			expect(
+				screen.getAllByRole('button', { name: /remove mapping/i }),
+			).toHaveLength(1),
+		);
+
+		fireEvent.click(
+			screen.getAllByRole('button', { name: /remove mapping/i })[0],
+		);
+		await waitFor(() =>
+			expect(
+				screen.queryAllByRole('button', { name: /remove mapping/i }),
+			).toHaveLength(0),
+		);
+
+		// Submit — MSW intercepts the PUT request
+		fireEvent.click(screen.getByRole('button', { name: /save changes/i }));
+
+		await waitFor(() => expect(capturedPayload).not.toBeNull());
+
+		expect(capturedPayload).toMatchObject({
+			config: expect.objectContaining({
+				roleMapping: expect.objectContaining({ groupMappings: {} }),
+			}),
+		});
+	});
+
+	it('sends domainToAdminEmail: {} when all domain mappings are deleted', async () => {
+		let capturedPayload: unknown = null;
+
+		server.use(
+			rest.put(AUTH_DOMAINS_UPDATE_ENDPOINT, async (req, res, ctx) => {
+				capturedPayload = await req.json();
+				return res(ctx.status(200), ctx.json(mockUpdateSuccessResponse));
+			}),
+		);
+
+		render(
+			<CreateEdit
+				isCreate={false}
+				record={mockGoogleAuthWithWorkspaceGroups}
+				onClose={jest.fn()}
+			/>,
+		);
+
+		// Open the Google Workspace Groups collapse
+		fireEvent.click(screen.getByText(/google workspace groups/i));
+
+		// Wait for the single domain mapping row
+		await waitFor(() =>
+			expect(
+				screen.getByRole('button', { name: /remove mapping/i }),
+			).toBeInTheDocument(),
+		);
+
+		// Delete the row
+		fireEvent.click(screen.getByRole('button', { name: /remove mapping/i }));
+		await waitFor(() =>
+			expect(
+				screen.queryAllByRole('button', { name: /remove mapping/i }),
+			).toHaveLength(0),
+		);
+
+		// Submit
+		fireEvent.click(screen.getByRole('button', { name: /save changes/i }));
+
+		await waitFor(() => expect(capturedPayload).not.toBeNull());
+
+		expect(capturedPayload).toMatchObject({
+			config: expect.objectContaining({
+				googleAuthConfig: expect.objectContaining({
+					domainToAdminEmail: {},
+				}),
+			}),
+		});
+	});
+});

pkg/modules/cloudintegration/implcloudintegration/fs/definitions/azure/appservice/icon.svg

@@ -1 +0,0 @@
-<svg id="b70acf0a-34b4-4bdf-9024-7496043ff915" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 18 18"><defs><radialGradient id="e2cf8746-c9a8-4eee-86c2-4951983c6032" cx="13428.81" cy="3518.86" r="56.67" gradientTransform="translate(-2005.33 -518.83) scale(0.15)" gradientUnits="userSpaceOnUse"><stop offset="0.18" stop-color="#5ea0ef"/><stop offset="1" stop-color="#0078d4"/></radialGradient><linearGradient id="bdd213dd-d313-473c-8ff4-0133fd3a9033" x1="4.4" y1="11.48" x2="4.37" y2="7.53" gradientUnits="userSpaceOnUse"><stop offset="0" stop-color="#ccc"/><stop offset="1" stop-color="#fcfcfc"/></linearGradient><linearGradient id="afcc63c5-3649-4476-a742-bcb53a569f3c" x1="10.13" y1="15.45" x2="10.13" y2="11.9" gradientUnits="userSpaceOnUse"><stop offset="0" stop-color="#ccc"/><stop offset="1" stop-color="#fcfcfc"/></linearGradient><linearGradient id="bd873f0b-9954-4aa5-a3df-9f4c64e8729d" x1="14.18" y1="11.15" x2="14.18" y2="7.38" gradientUnits="userSpaceOnUse"><stop offset="0" stop-color="#ccc"/><stop offset="1" stop-color="#fcfcfc"/></linearGradient></defs><title>Icon-web-41</title><path id="ee75dd06-1aca-4f76-9d11-d05a284020ad" d="M14.21,15.72A8.5,8.5,0,0,1,3.79,2.28l.09-.06a8.5,8.5,0,0,1,10.33,13.5" fill="url(#e2cf8746-c9a8-4eee-86c2-4951983c6032)"/><path d="M6.69,7.23A13,13,0,0,1,15.6,3.65a8.47,8.47,0,0,0-1.49-1.44,14.34,14.34,0,0,0-4.69,1.1A12.54,12.54,0,0,0,5.34,6.13,2.76,2.76,0,0,1,6.69,7.23Z" fill="#fff" opacity="0.6"/><path d="M2.48,10.65a17.86,17.86,0,0,0-.83,2.62,7.82,7.82,0,0,0,.62.92c.18.23.35.44.55.65A17.94,17.94,0,0,1,3.9,11.37,2.76,2.76,0,0,1,2.48,10.65Z" fill="#fff" opacity="0.6"/><path d="M3.46,6.11a12,12,0,0,1-.69-2.94,8.15,8.15,0,0,0-1.1,1.45A12.69,12.69,0,0,0,2.24,7,2.69,2.69,0,0,1,3.46,6.11Z" fill="#f2f2f2" opacity="0.55"/><circle cx="4.38" cy="8.68" r="2.73" fill="url(#bdd213dd-d313-473c-8ff4-0133fd3a9033)"/><path d="M8.36,13.67A1.77,1.77,0,0,1,8.9,12.4a11.88,11.88,0,0,1-2.53-1.86,2.74,2.74,0,0,1-1.49.83,13.1,13.1,0,0,0,1.45,1.28A12.12,12.12,0,0,0,8.38,13.9,1.79,1.79,0,0,1,8.36,13.67Z" fill="#f2f2f2" opacity="0.55"/><path d="M14.66,13.88a12,12,0,0,1-2.76-.32.41.41,0,0,1,0,.11,1.75,1.75,0,0,1-.51,1.24,13.69,13.69,0,0,0,3.42.24A8.21,8.21,0,0,0,16,13.81,11.5,11.5,0,0,1,14.66,13.88Z" fill="#f2f2f2" opacity="0.55"/><circle cx="10.13" cy="13.67" r="1.78" fill="url(#afcc63c5-3649-4476-a742-bcb53a569f3c)"/><path d="M12.32,8.93a1.83,1.83,0,0,1,.61-1A25.5,25.5,0,0,1,8.47,3.79a16.91,16.91,0,0,1-2-2.92,7.64,7.64,0,0,0-1.09.42A18.14,18.14,0,0,0,7.53,4.47,26.44,26.44,0,0,0,12.32,8.93Z" fill="#f2f2f2" opacity="0.7"/><circle cx="14.18" cy="9.27" r="1.89" fill="url(#bd873f0b-9954-4aa5-a3df-9f4c64e8729d)"/><path d="M17.35,10.54,17,10.37l0,0-.3-.16-.06,0L16.38,10l-.07,0L16,9.8a1.76,1.76,0,0,1-.64.92c.12.08.25.15.38.22l.08.05.35.19,0,0,.86.45h0a8.63,8.63,0,0,0,.29-1.11Z" fill="#f2f2f2" opacity="0.55"/><circle cx="4.38" cy="8.68" r="2.73" fill="url(#bdd213dd-d313-473c-8ff4-0133fd3a9033)"/><circle cx="10.13" cy="13.67" r="1.78" fill="url(#afcc63c5-3649-4476-a742-bcb53a569f3c)"/></svg>

pkg/modules/cloudintegration/implcloudintegration/fs/definitions/azure/appservice/integration.json

@@ -1,185 +0,0 @@
-{
-  "id": "appservice",
-  "title": "App Services",
-  "icon": "file://icon.svg",
-  "overview": "file://overview.md",
-  "supportedSignals": {
-    "metrics": true,
-    "logs": true
-  },
-  "dataCollected": {
-    "metrics": [
-      {
-        "name": "azure_activewebsocketconnections_total",
-        "unit": "Count",
-        "type": "Gauge",
-        "description": ""
-      },
-      {
-        "name": "azure_averagewebsocketconnectionduration_average",
-        "unit": "Milliseconds",
-        "type": "Gauge",
-        "description": ""
-      },
-      {
-        "name": "azure_backendhealthpercentage_average",
-        "unit": "Percent",
-        "type": "Gauge",
-        "description": ""
-      },
-      {
-        "name": "azure_backendrequestcount_total",
-        "unit": "Count",
-        "type": "Gauge",
-        "description": ""
-      },
-      {
-        "name": "azure_backendrequestlatency_average",
-        "unit": "Milliseconds",
-        "type": "Gauge",
-        "description": ""
-      },
-      {
-        "name": "azure_billableresponsesize_total",
-        "unit": "Bytes",
-        "type": "Gauge",
-        "description": ""
-      },
-      {
-        "name": "azure_bytehitratio_average",
-        "unit": "Percent",
-        "type": "Gauge",
-        "description": ""
-      },
-      {
-        "name": "azure_originhealthpercentage_average",
-        "unit": "Percent",
-        "type": "Gauge",
-        "description": ""
-      },
-      {
-        "name": "azure_originlatency_average",
-        "unit": "Milliseconds",
-        "type": "Gauge",
-        "description": ""
-      },
-      {
-        "name": "azure_originrequestcount_total",
-        "unit": "Count",
-        "type": "Gauge",
-        "description": ""
-      },
-      {
-        "name": "azure_originshieldoriginrequestcount_total",
-        "unit": "Count",
-        "type": "Gauge",
-        "description": ""
-      },
-      {
-        "name": "azure_originshieldratelimitrequestcount_total",
-        "unit": "Count",
-        "type": "Gauge",
-        "description": ""
-      },
-      {
-        "name": "azure_originshieldrequestcount_total",
-        "unit": "Count",
-        "type": "Gauge",
-        "description": ""
-      },
-      {
-        "name": "azure_originshieldrequestsize_total",
-        "unit": "Bytes",
-        "type": "Gauge",
-        "description": ""
-      },
-      {
-        "name": "azure_percentage4xx_average",
-        "unit": "Percent",
-        "type": "Gauge",
-        "description": ""
-      },
-      {
-        "name": "azure_percentage5xx_average",
-        "unit": "Percent",
-        "type": "Gauge",
-        "description": ""
-      },
-      {
-        "name": "azure_requestcount_total",
-        "unit": "Count",
-        "type": "Gauge",
-        "description": ""
-      },
-      {
-        "name": "azure_requestsize_total",
-        "unit": "Bytes",
-        "type": "Gauge",
-        "description": ""
-      },
-      {
-        "name": "azure_responsesize_total",
-        "unit": "Bytes",
-        "type": "Gauge",
-        "description": ""
-      },
-      {
-        "name": "azure_totallatency_average",
-        "unit": "Milliseconds",
-        "type": "Gauge",
-        "description": ""
-      },
-      {
-        "name": "azure_webapplicationfirewallrequestcount_total",
-        "unit": "Count",
-        "type": "Gauge",
-        "description": ""
-      },
-      {
-        "name": "azure_webapplicationfirewallcaptcharequestcount_total",
-        "unit": "Count",
-        "type": "Gauge",
-        "description": ""
-      },
-      {
-        "name": "azure_webapplicationfirewalljsrequestcount_total",
-        "unit": "Count",
-        "type": "Gauge",
-        "description": ""
-      },
-      {
-        "name": "azure_websocketconnections_total",
-        "unit": "Count",
-        "type": "Gauge",
-        "description": ""
-      }
-    ],
-    "logs": [
-      {
-        "name": "Resource ID",
-        "path": "resources.azure.resource.id",
-        "type": "string"
-      }
-    ]
-  },
-  "telemetryCollectionStrategy": {
-    "azure": {
-      "resourceProvider": "Microsoft.Web",
-      "resourceType": "sites",
-      "metrics": {},
-      "logs": {
-        "categoryGroups": ["allLogs"]
-      }
-    }
-  },
-  "assets": {
-    "dashboards": [
-      {
-        "id": "overview",
-        "title": "App Services Overview",
-        "description": "Overview of App Services metrics",
-        "definition": "file://assets/dashboards/overview.json"
-      }
-    ]
-  }
-}

pkg/modules/cloudintegration/implcloudintegration/fs/definitions/azure/appservice/overview.md

@@ -1,5 +0,0 @@
-### Monitor Azure App Services with SigNoz
-
-Collect key App Services metrics and view them with an out of the box dashboard.
-
-Note: This integration DO NOT collect metrics for any database that was setup with your App Service (if any).

pkg/modules/metricsexplorer/implmetricsexplorer/module.go

@@ -219,19 +219,7 @@ func (m *module) GetStats(ctx context.Context, orgID valuer.UUID, req *metricsex
 		return nil, err
 	}
 
-	filterWhereClause, err := m.buildFilterClause(ctx, req.Filter, req.Start, req.End)
-	if err != nil {
-		return nil, err
-	}
-
-	// Single query to get stats with samples, timeseries counts in required sorting order
-	metricStats, total, err := m.fetchMetricsStatsWithSamples(
-		ctx,
-		req,
-		filterWhereClause,
-		false,
-		req.OrderBy,
-	)
+	metricStats, total, err := m.fetchMetricsStatsWithSamples(ctx, req, false)
 	if err != nil {
 		return nil, err
 	}
@@ -974,12 +962,20 @@ func (m *module) buildFilterClause(ctx context.Context, filter *qbtypes.Filter,
 func (m *module) fetchMetricsStatsWithSamples(
 	ctx context.Context,
 	req *metricsexplorertypes.StatsRequest,
-	filterWhereClause *sqlbuilder.WhereClause,
 	normalized bool,
-	orderBy *qbtypes.OrderBy,
 ) ([]metricsexplorertypes.Stat, uint64, error) {
 	ctx = m.withMetricsExplorerContext(ctx, "fetchMetricsStatsWithSamples")
 
+	hasFilter := req.Filter != nil && strings.TrimSpace(req.Filter.Expression) != ""
+	var filterWhereClause *sqlbuilder.WhereClause
+	if hasFilter {
+		var err error
+		filterWhereClause, err = m.buildFilterClause(ctx, req.Filter, req.Start, req.End)
+		if err != nil {
+			return nil, 0, err
+		}
+	}
+
 	start, end, distributedTsTable, localTsTable := telemetrymetrics.WhichTSTableToUse(uint64(req.Start), uint64(req.End), nil)
 	samplesTable, _ := telemetrymetrics.WhichSamplesTableToUse(uint64(req.Start), uint64(req.End), metrictypes.UnspecifiedType, metrictypes.TimeAggregationUnspecified, nil)
 	countExp := telemetrymetrics.CountExpressionForSamplesTable(samplesTable)
@@ -1013,6 +1009,8 @@ func (m *module) fetchMetricsStatsWithSamples(
 		sqlbuilder.CTEQuery("__time_series_counts").As(tsSB),
 	}
 
+	// Narrow samples scan. With filter: fingerprint IN (per-fingerprint label preds can't fold to metric_name).
+	// No filter (fast path): metric_name IN — aligns with samples table's leading sort key, orders of magnitude cheaper.
 	if filterWhereClause != nil {
 		fingerprintSB := sqlbuilder.NewSelectBuilder()
 		fingerprintSB.Select("fingerprint")
@@ -1025,6 +1023,15 @@ func (m *module) fetchMetricsStatsWithSamples(
 
 		ctes = append(ctes, sqlbuilder.CTEQuery("__filtered_fingerprints").As(fingerprintSB))
 		samplesSB.Where("fingerprint IN (SELECT fingerprint FROM __filtered_fingerprints)")
+	} else {
+		metricNamesSB := sqlbuilder.NewSelectBuilder()
+		metricNamesSB.Select("DISTINCT metric_name")
+		metricNamesSB.From(fmt.Sprintf("%s.%s", telemetrymetrics.DBName, localTsTable))
+		metricNamesSB.Where(metricNamesSB.Between("unix_milli", start, end))
+		metricNamesSB.Where("NOT startsWith(metric_name, 'signoz')")
+		metricNamesSB.Where(metricNamesSB.E("__normalized", normalized))
+
+		samplesSB.Where(fmt.Sprintf("metric_name IN (%s)", samplesSB.Var(metricNamesSB)))
 	}
 	samplesSB.GroupBy("metric_name")
 
@@ -1041,7 +1048,7 @@ func (m *module) fetchMetricsStatsWithSamples(
 	finalSB.JoinWithOption(sqlbuilder.FullOuterJoin, "__sample_counts s", "ts.metric_name = s.metric_name")
 	finalSB.Where("(COALESCE(ts.timeseries, 0) > 0 OR COALESCE(s.samples, 0) > 0)")
 
-	orderByColumn, orderDirection, err := getStatsOrderByColumn(orderBy)
+	orderByColumn, orderDirection, err := getStatsOrderByColumn(req.OrderBy)
 	if err != nil {
 		return nil, 0, err
 	}

pkg/querier/config.go

@@ -7,6 +7,12 @@ import (
 	"github.com/SigNoz/signoz/pkg/factory"
 )
 
+type SkipResourceFingerprint struct {
+	Enabled bool `yaml:"enabled" mapstructure:"enabled"`
+	// If count of fingerprint is above threshold, skip the fingerprint subquery and filter on main table instead.
+	Threshold uint64 `yaml:"threshold" mapstructure:"threshold"`
+}
+
 // Config represents the configuration for the querier.
 type Config struct {
 	// CacheTTL is the TTL for cached query results
@@ -15,6 +21,8 @@ type Config struct {
 	FluxInterval time.Duration `yaml:"flux_interval" mapstructure:"flux_interval"`
 	// MaxConcurrentQueries is the maximum number of concurrent queries for missing ranges
 	MaxConcurrentQueries int `yaml:"max_concurrent_queries" mapstructure:"max_concurrent_queries"`
+	// SkipResourceFingerprint configures when the resource fingerprint subquery is skipped in favor of main-table filtering.
+	SkipResourceFingerprint SkipResourceFingerprint `yaml:"skip_resource_fingerprint" mapstructure:"skip_resource_fingerprint"`
 }
 
 // NewConfigFactory creates a new config factory for querier.
@@ -28,6 +36,10 @@ func newConfig() factory.Config {
 		CacheTTL:             168 * time.Hour,
 		FluxInterval:         5 * time.Minute,
 		MaxConcurrentQueries: 4,
+		SkipResourceFingerprint: SkipResourceFingerprint{
+			Enabled:   false,
+			Threshold: 100000,
+		},
 	}
 }
 
@@ -42,6 +54,9 @@ func (c Config) Validate() error {
 	if c.MaxConcurrentQueries <= 0 {
 		return errors.NewInvalidInputf(errors.CodeInvalidInput, "max_concurrent_queries must be positive, got %v", c.MaxConcurrentQueries)
 	}
+	if c.SkipResourceFingerprint.Enabled && c.SkipResourceFingerprint.Threshold == 0 {
+		return errors.NewInvalidInputf(errors.CodeInvalidInput, "skip_resource_fingerprint.threshold must be > 0 when enabled")
+	}
 	return nil
 }
 

pkg/querier/signozquerier/provider.go

@@ -88,6 +88,8 @@ func newProvider(
 		traceAggExprRewriter,
 		telemetryStore,
 		flagger,
+		cfg.SkipResourceFingerprint.Enabled,
+		cfg.SkipResourceFingerprint.Threshold,
 	)
 
 	// Create trace operator statement builder
@@ -121,6 +123,9 @@ func newProvider(
 		telemetrylogs.DefaultFullTextColumn,
 		telemetrylogs.GetBodyJSONKey,
 		flagger,
+		telemetryStore,
+		cfg.SkipResourceFingerprint.Enabled,
+		cfg.SkipResourceFingerprint.Threshold,
 	)
 
 	// Create audit statement builder

pkg/query-service/rules/setups_test.go

@@ -89,6 +89,9 @@ func prepareQuerierForLogs(t *testing.T, telemetryStore telemetrystore.Telemetry
 		telemetrylogs.DefaultFullTextColumn,
 		telemetrylogs.GetBodyJSONKey,
 		fl,
+		nil,
+		false,
+		100000,
 	)
 
 	return querier.New(
@@ -134,6 +137,8 @@ func prepareQuerierForTraces(t *testing.T, telemetryStore telemetrystore.Telemet
 		traceAggExprRewriter,
 		telemetryStore,
 		fl,
+		false,
+		100000,
 	)
 
 	return querier.New(

pkg/telemetrylogs/json_stmt_builder_test.go

@@ -1205,6 +1205,9 @@ func buildJSONTestStatementBuilder(t *testing.T, addIndexes bool) (*logQueryStat
 		DefaultFullTextColumn,
 		GetBodyJSONKey,
 		fl,
+		nil,
+		false,
+		100000,
 	)
 
 	return statementBuilder, mockMetadataStore

pkg/telemetrylogs/statement_builder.go

@@ -11,6 +11,7 @@ import (
 	"github.com/SigNoz/signoz/pkg/flagger"
 	"github.com/SigNoz/signoz/pkg/querybuilder"
 	"github.com/SigNoz/signoz/pkg/telemetryresourcefilter"
+	"github.com/SigNoz/signoz/pkg/telemetrystore"
 	"github.com/SigNoz/signoz/pkg/types/featuretypes"
 	qbtypes "github.com/SigNoz/signoz/pkg/types/querybuildertypes/querybuildertypesv5"
 	"github.com/SigNoz/signoz/pkg/types/telemetrytypes"
@@ -19,13 +20,14 @@ import (
 )
 
 type logQueryStatementBuilder struct {
-	logger                    *slog.Logger
-	metadataStore             telemetrytypes.MetadataStore
-	fm                        qbtypes.FieldMapper
-	cb                        qbtypes.ConditionBuilder
-	resourceFilterStmtBuilder qbtypes.StatementBuilder[qbtypes.LogAggregation]
-	aggExprRewriter           qbtypes.AggExprRewriter
-	fl                        flagger.Flagger
+	logger                         *slog.Logger
+	metadataStore                  telemetrytypes.MetadataStore
+	fm                             qbtypes.FieldMapper
+	cb                             qbtypes.ConditionBuilder
+	resourceFilterResolver         *telemetryresourcefilter.ResourceFingerprintResolver[qbtypes.LogAggregation]
+	aggExprRewriter                qbtypes.AggExprRewriter
+	fl                             flagger.Flagger
+	skipResourceFingerprintEnabled bool
 
 	fullTextColumn *telemetrytypes.TelemetryFieldKey
 	jsonKeyToKey   qbtypes.JsonKeyToFieldFunc
@@ -42,10 +44,13 @@ func NewLogQueryStatementBuilder(
 	fullTextColumn *telemetrytypes.TelemetryFieldKey,
 	jsonKeyToKey qbtypes.JsonKeyToFieldFunc,
 	fl flagger.Flagger,
+	telemetryStore telemetrystore.TelemetryStore,
+	skipResourceFingerprintEnable bool,
+	skipResourceFingerprintThreshold uint64,
 ) *logQueryStatementBuilder {
 	logsSettings := factory.NewScopedProviderSettings(settings, "github.com/SigNoz/signoz/pkg/telemetrylogs")
 
-	resourceFilterStmtBuilder := telemetryresourcefilter.New[qbtypes.LogAggregation](
+	resourceFilterResolver := telemetryresourcefilter.NewResolver[qbtypes.LogAggregation](
 		settings,
 		DBName,
 		LogsResourceV2TableName,
@@ -55,18 +60,21 @@ func NewLogQueryStatementBuilder(
 		fullTextColumn,
 		jsonKeyToKey,
 		fl,
+		telemetryStore,
+		skipResourceFingerprintThreshold,
 	)
 
 	return &logQueryStatementBuilder{
-		logger:                    logsSettings.Logger(),
-		metadataStore:             metadataStore,
-		fm:                        fieldMapper,
-		cb:                        conditionBuilder,
-		resourceFilterStmtBuilder: resourceFilterStmtBuilder,
-		aggExprRewriter:           aggExprRewriter,
-		fl:                        fl,
-		fullTextColumn:            fullTextColumn,
-		jsonKeyToKey:              jsonKeyToKey,
+		logger:                         logsSettings.Logger(),
+		metadataStore:                  metadataStore,
+		fm:                             fieldMapper,
+		cb:                             conditionBuilder,
+		resourceFilterResolver:         resourceFilterResolver,
+		aggExprRewriter:                aggExprRewriter,
+		fl:                             fl,
+		skipResourceFingerprintEnabled: skipResourceFingerprintEnable,
+		fullTextColumn:                 fullTextColumn,
+		jsonKeyToKey:                   jsonKeyToKey,
 	}
 }
 
@@ -271,9 +279,11 @@ func (b *logQueryStatementBuilder) buildListQuery(
 		bodyJSONEnabled = b.fl.BooleanOrEmpty(ctx, flagger.FeatureUseJSONBody, featuretypes.NewFlaggerEvaluationContext(valuer.UUID{}))
 	)
 
-	if frag, args, err := b.maybeAttachResourceFilter(ctx, sb, query, start, end, variables); err != nil {
+	frag, args, skipResourceFilter, err := b.maybeAttachResourceFilter(ctx, sb, query, start, end, variables)
+	if err != nil {
 		return nil, err
-	} else if frag != "" {
+	}
+	if frag != "" {
 		cteFragments = append(cteFragments, frag)
 		cteArgs = append(cteArgs, args)
 	}
@@ -315,7 +325,7 @@ func (b *logQueryStatementBuilder) buildListQuery(
 
 	sb.From(fmt.Sprintf("%s.%s", DBName, LogsV2TableName))
 	// Add filter conditions
-	preparedWhereClause, err := b.addFilterCondition(ctx, sb, start, end, query, keys, variables)
+	preparedWhereClause, err := b.addFilterCondition(ctx, sb, start, end, query, keys, variables, skipResourceFilter)
 
 	if err != nil {
 		return nil, err
@@ -373,9 +383,11 @@ func (b *logQueryStatementBuilder) buildTimeSeriesQuery(
 		bodyJSONEnabled = b.fl.BooleanOrEmpty(ctx, flagger.FeatureUseJSONBody, featuretypes.NewFlaggerEvaluationContext(valuer.UUID{}))
 	)
 
-	if frag, args, err := b.maybeAttachResourceFilter(ctx, sb, query, start, end, variables); err != nil {
+	frag, args, skipResourceFilter, err := b.maybeAttachResourceFilter(ctx, sb, query, start, end, variables)
+	if err != nil {
 		return nil, err
-	} else if frag != "" {
+	}
+	if frag != "" {
 		cteFragments = append(cteFragments, frag)
 		cteArgs = append(cteArgs, args)
 	}
@@ -419,7 +431,7 @@ func (b *logQueryStatementBuilder) buildTimeSeriesQuery(
 	// Add FROM clause
 	sb.From(fmt.Sprintf("%s.%s", DBName, LogsV2TableName))
 
-	preparedWhereClause, err := b.addFilterCondition(ctx, sb, start, end, query, keys, variables)
+	preparedWhereClause, err := b.addFilterCondition(ctx, sb, start, end, query, keys, variables, skipResourceFilter)
 
 	if err != nil {
 		return nil, err
@@ -531,9 +543,11 @@ func (b *logQueryStatementBuilder) buildScalarQuery(
 		bodyJSONEnabled = b.fl.BooleanOrEmpty(ctx, flagger.FeatureUseJSONBody, featuretypes.NewFlaggerEvaluationContext(valuer.UUID{}))
 	)
 
-	if frag, args, err := b.maybeAttachResourceFilter(ctx, sb, query, start, end, variables); err != nil {
+	frag, args, skipResourceFilter, err := b.maybeAttachResourceFilter(ctx, sb, query, start, end, variables)
+	if err != nil {
 		return nil, err
-	} else if frag != "" && !skipResourceCTE {
+	}
+	if frag != "" && !skipResourceCTE {
 		cteFragments = append(cteFragments, frag)
 		cteArgs = append(cteArgs, args)
 	}
@@ -576,7 +590,7 @@ func (b *logQueryStatementBuilder) buildScalarQuery(
 	sb.From(fmt.Sprintf("%s.%s", DBName, LogsV2TableName))
 
 	// Add filter conditions
-	preparedWhereClause, err := b.addFilterCondition(ctx, sb, start, end, query, keys, variables)
+	preparedWhereClause, err := b.addFilterCondition(ctx, sb, start, end, query, keys, variables, skipResourceFilter)
 
 	if err != nil {
 		return nil, err
@@ -640,6 +654,7 @@ func (b *logQueryStatementBuilder) addFilterCondition(
 	query qbtypes.QueryBuilderQuery[qbtypes.LogAggregation],
 	keys map[string][]*telemetrytypes.TelemetryFieldKey,
 	variables map[string]qbtypes.VariableItem,
+	skipResourceFilter bool,
 ) (querybuilder.PreparedWhereClause, error) {
 
 	var preparedWhereClause querybuilder.PreparedWhereClause
@@ -656,7 +671,7 @@ func (b *logQueryStatementBuilder) addFilterCondition(
 			ConditionBuilder:   b.cb,
 			FieldKeys:          keys,
 			BodyJSONEnabled:    bodyJSONEnabled,
-			SkipResourceFilter: true,
+			SkipResourceFilter: skipResourceFilter,
 			FullTextColumn:     b.fullTextColumn,
 			JsonKeyToKey:       b.jsonKeyToKey,
 			Variables:          variables,
@@ -707,33 +722,30 @@ func (b *logQueryStatementBuilder) maybeAttachResourceFilter(
 	query qbtypes.QueryBuilderQuery[qbtypes.LogAggregation],
 	start, end uint64,
 	variables map[string]qbtypes.VariableItem,
-) (cteSQL string, cteArgs []any, err error) {
+) (cteSQL string, cteArgs []any, skipResourceFilter bool, err error) {
 
-	stmt, err := b.buildResourceFilterCTE(ctx, query, start, end, variables)
+	if b.skipResourceFingerprintEnabled {
+		decision, err := b.resourceFilterResolver.Resolve(ctx, query, start, end, variables)
+		if err != nil {
+			return "", nil, true, err
+		}
+		switch decision {
+		case qbtypes.ResourceFilterResolveKindNoOp:
+			return "", nil, true, nil
+		case qbtypes.ResourceFilterResolveKindFallback:
+			return "", nil, false, nil
+		}
+	}
+
+	stmt, err := b.resourceFilterResolver.StatementBuilder().Build(
+		ctx, start, end, qbtypes.RequestTypeRaw, query, variables,
+	)
 	if err != nil {
-		return "", nil, err
+		return "", nil, true, err
 	}
 	if stmt == nil {
-		return "", nil, nil
+		return "", nil, true, nil
 	}
-
 	sb.Where("resource_fingerprint GLOBAL IN (SELECT fingerprint FROM __resource_filter)")
-
-	return fmt.Sprintf("__resource_filter AS (%s)", stmt.Query), stmt.Args, nil
-}
-
-func (b *logQueryStatementBuilder) buildResourceFilterCTE(
-	ctx context.Context,
-	query qbtypes.QueryBuilderQuery[qbtypes.LogAggregation],
-	start, end uint64,
-	variables map[string]qbtypes.VariableItem,
-) (*qbtypes.Statement, error) {
-	return b.resourceFilterStmtBuilder.Build(
-		ctx,
-		start,
-		end,
-		qbtypes.RequestTypeRaw,
-		query,
-		variables,
-	)
+	return fmt.Sprintf("__resource_filter AS (%s)", stmt.Query), stmt.Args, true, nil
 }

pkg/telemetrylogs/stmt_builder_test.go

@@ -2,19 +2,36 @@ package telemetrylogs
 
 import (
 	"context"
+	"regexp"
 	"testing"
 	"time"
 
+	cmock "github.com/SigNoz/clickhouse-go-mock"
 	"github.com/SigNoz/signoz/pkg/errors"
 	"github.com/SigNoz/signoz/pkg/flagger/flaggertest"
 	"github.com/SigNoz/signoz/pkg/instrumentation/instrumentationtest"
 	"github.com/SigNoz/signoz/pkg/querybuilder"
+	"github.com/SigNoz/signoz/pkg/telemetrystore"
+	"github.com/SigNoz/signoz/pkg/telemetrystore/telemetrystoretest"
 	qbtypes "github.com/SigNoz/signoz/pkg/types/querybuildertypes/querybuildertypesv5"
 	"github.com/SigNoz/signoz/pkg/types/telemetrytypes"
 	"github.com/SigNoz/signoz/pkg/types/telemetrytypes/telemetrytypestest"
 	"github.com/stretchr/testify/require"
 )
 
+type regexQueryMatcher struct{}
+
+func (m *regexQueryMatcher) Match(expectedSQL, actualSQL string) error {
+	re, err := regexp.Compile(expectedSQL)
+	if err != nil {
+		return err
+	}
+	if !re.MatchString(actualSQL) {
+		return errors.NewInvalidInputf(errors.CodeInvalidInput, "expected query to match %s, got %s", expectedSQL, actualSQL)
+	}
+	return nil
+}
+
 func TestStatementBuilderTimeSeries(t *testing.T) {
 	// Create a test release time
 	releaseTime := time.Date(2024, 1, 15, 10, 0, 0, 0, time.UTC)
@@ -212,6 +229,9 @@ func TestStatementBuilderTimeSeries(t *testing.T) {
 		DefaultFullTextColumn,
 		GetBodyJSONKey,
 		fl,
+		nil,
+		false,
+		100000,
 	)
 
 	for _, c := range cases {
@@ -353,6 +373,9 @@ func TestStatementBuilderListQuery(t *testing.T) {
 		DefaultFullTextColumn,
 		GetBodyJSONKey,
 		fl,
+		nil,
+		false,
+		100000,
 	)
 
 	for _, c := range cases {
@@ -499,6 +522,9 @@ func TestStatementBuilderListQueryResourceTests(t *testing.T) {
 		DefaultFullTextColumn,
 		GetBodyJSONKey,
 		fl,
+		nil,
+		false,
+		100000,
 	)
 
 	for _, c := range cases {
@@ -575,6 +601,9 @@ func TestStatementBuilderTimeSeriesBodyGroupBy(t *testing.T) {
 		DefaultFullTextColumn,
 		GetBodyJSONKey,
 		fl,
+		nil,
+		false,
+		100000,
 	)
 
 	for _, c := range cases {
@@ -670,6 +699,9 @@ func TestStatementBuilderListQueryServiceCollision(t *testing.T) {
 		DefaultFullTextColumn,
 		GetBodyJSONKey,
 		fl,
+		nil,
+		false,
+		100000,
 	)
 
 	for _, c := range cases {
@@ -894,6 +926,9 @@ func TestAdjustKey(t *testing.T) {
 		DefaultFullTextColumn,
 		GetBodyJSONKey,
 		fl,
+		nil,
+		false,
+		100000,
 	)
 
 	for _, c := range cases {
@@ -1039,6 +1074,9 @@ func TestStmtBuilderBodyField(t *testing.T) {
 				DefaultFullTextColumn,
 				GetBodyJSONKey,
 				fl,
+				nil,
+				false,
+				100000,
 			)
 
 			q, err := statementBuilder.Build(context.Background(), 1747947419000, 1747983448000, c.requestType, c.query, nil)
@@ -1138,6 +1176,9 @@ func TestStmtBuilderBodyFullTextSearch(t *testing.T) {
 				DefaultFullTextColumn,
 				GetBodyJSONKey,
 				fl,
+				nil,
+				false,
+				100000,
 			)
 
 			q, err := statementBuilder.Build(context.Background(), 1747947419000, 1747983448000, c.requestType, c.query, nil)
@@ -1157,3 +1198,110 @@ func TestStmtBuilderBodyFullTextSearch(t *testing.T) {
 		})
 	}
 }
+
+// TestSkipResourceFingerprintLogs exercises the three resolver outcomes for
+// logs: use-CTE (count < threshold), fallback (count >= threshold), and the
+// legacy path (feature disabled).
+func TestSkipResourceFingerprintLogs(t *testing.T) {
+	const (
+		startMs   = uint64(1747947419000)
+		endMs     = uint64(1747983448000)
+		threshold = uint64(10)
+	)
+
+	query := qbtypes.QueryBuilderQuery[qbtypes.LogAggregation]{
+		Signal: telemetrytypes.SignalLogs,
+		Filter: &qbtypes.Filter{
+			Expression: "service.name = 'redis-manual'",
+		},
+		Limit: 5,
+	}
+
+	t.Run("disabled uses the legacy CTE", func(t *testing.T) {
+		sb := newSkipResourceFingerprintLogsBuilder(t, nil, false, threshold)
+
+		stmt, err := sb.Build(context.Background(), startMs, endMs, qbtypes.RequestTypeRaw, query, nil)
+		require.NoError(t, err)
+		require.Contains(t, stmt.Query, "__resource_filter AS (SELECT fingerprint")
+		require.Contains(t, stmt.Query, "resource_fingerprint GLOBAL IN (SELECT fingerprint FROM __resource_filter)")
+	})
+
+	t.Run("CTE attached when count below threshold", func(t *testing.T) {
+		mockStore := telemetrystoretest.New(telemetrystore.Config{}, &regexQueryMatcher{})
+		mock := mockStore.Mock()
+
+		mock.ExpectQueryRow(`SELECT count\(\) FROM \(SELECT fingerprint FROM signoz_logs\.distributed_logs_v2_resource`).
+			WillReturnRow(cmock.NewRow([]cmock.ColumnType{
+				{Name: "count", Type: "UInt64"},
+			}, []any{uint64(2)}))
+
+		sb := newSkipResourceFingerprintLogsBuilder(t, mockStore, true, threshold)
+
+		stmt, err := sb.Build(context.Background(), startMs, endMs, qbtypes.RequestTypeRaw, query, nil)
+		require.NoError(t, err)
+
+		require.Contains(t, stmt.Query, "__resource_filter AS (SELECT fingerprint")
+		require.Contains(t, stmt.Query, "resource_fingerprint GLOBAL IN (SELECT fingerprint FROM __resource_filter)")
+
+		require.NoError(t, mock.ExpectationsWereMet())
+	})
+
+	t.Run("fallback when count at or above threshold", func(t *testing.T) {
+		mockStore := telemetrystoretest.New(telemetrystore.Config{}, &regexQueryMatcher{})
+		mock := mockStore.Mock()
+
+		mock.ExpectQueryRow(`SELECT count\(\) FROM \(SELECT fingerprint FROM signoz_logs\.distributed_logs_v2_resource`).
+			WillReturnRow(cmock.NewRow([]cmock.ColumnType{
+				{Name: "count", Type: "UInt64"},
+			}, []any{threshold}))
+
+		sb := newSkipResourceFingerprintLogsBuilder(t, mockStore, true, threshold)
+
+		stmt, err := sb.Build(context.Background(), startMs, endMs, qbtypes.RequestTypeRaw, query, nil)
+		require.NoError(t, err)
+
+		require.NotContains(t, stmt.Query, "__resource_filter AS")
+		require.NotContains(t, stmt.Query, "resource_fingerprint")
+		require.Contains(t, stmt.Query, "service.name")
+
+		require.NoError(t, mock.ExpectationsWereMet())
+	})
+}
+
+func newSkipResourceFingerprintLogsBuilder(
+	t *testing.T,
+	telemetryStore telemetrystore.TelemetryStore,
+	skipEnable bool,
+	threshold uint64,
+) *logQueryStatementBuilder {
+	t.Helper()
+
+	fl := flaggertest.New(t)
+	fm := NewFieldMapper(fl)
+	cb := NewConditionBuilder(fm, fl)
+	mockMetadataStore := telemetrytypestest.NewMockMetadataStore()
+	mockMetadataStore.KeysMap = buildCompleteFieldKeyMap(time.Date(2024, 1, 15, 10, 0, 0, 0, time.UTC))
+
+	aggExprRewriter := querybuilder.NewAggExprRewriter(
+		instrumentationtest.New().ToProviderSettings(),
+		DefaultFullTextColumn,
+		fm,
+		cb,
+		GetBodyJSONKey,
+		fl,
+	)
+
+	return NewLogQueryStatementBuilder(
+		instrumentationtest.New().ToProviderSettings(),
+		mockMetadataStore,
+		fm,
+		cb,
+		aggExprRewriter,
+		DefaultFullTextColumn,
+		GetBodyJSONKey,
+		fl,
+		telemetryStore,
+		skipEnable,
+		threshold,
+	)
+}

pkg/telemetryresourcefilter/fingerprint_resolver.go

@@ -0,0 +1,77 @@
+package telemetryresourcefilter
+
+import (
+	"context"
+
+	"github.com/SigNoz/signoz/pkg/factory"
+	"github.com/SigNoz/signoz/pkg/flagger"
+	"github.com/SigNoz/signoz/pkg/telemetrystore"
+	qbtypes "github.com/SigNoz/signoz/pkg/types/querybuildertypes/querybuildertypesv5"
+	"github.com/SigNoz/signoz/pkg/types/telemetrytypes"
+)
+
+type ResourceFingerprintResolver[T any] struct {
+	stmtBuilder    *resourceFilterStatementBuilder[T]
+	telemetryStore telemetrystore.TelemetryStore
+	threshold      uint64
+}
+
+func NewResolver[T any](
+	settings factory.ProviderSettings,
+	dbName string,
+	tableName string,
+	signal telemetrytypes.Signal,
+	source telemetrytypes.Source,
+	metadataStore telemetrytypes.MetadataStore,
+	fullTextColumn *telemetrytypes.TelemetryFieldKey,
+	jsonKeyToKey qbtypes.JsonKeyToFieldFunc,
+	fl flagger.Flagger,
+	telemetryStore telemetrystore.TelemetryStore,
+	threshold uint64,
+) *ResourceFingerprintResolver[T] {
+	return &ResourceFingerprintResolver[T]{
+		stmtBuilder: New[T](
+			settings,
+			dbName,
+			tableName,
+			signal,
+			source,
+			metadataStore,
+			fullTextColumn,
+			jsonKeyToKey,
+			fl,
+		),
+		telemetryStore: telemetryStore,
+		threshold:      threshold,
+	}
+}
+
+func (r *ResourceFingerprintResolver[T]) StatementBuilder() qbtypes.StatementBuilder[T] {
+	return r.stmtBuilder
+}
+
+func (r *ResourceFingerprintResolver[T]) Resolve(
+	ctx context.Context,
+	query qbtypes.QueryBuilderQuery[T],
+	start, end uint64,
+	variables map[string]qbtypes.VariableItem,
+) (qbtypes.ResourceFilterResolveKind, error) {
+	countStmt, err := r.stmtBuilder.BuildCount(ctx, start, end, query, variables)
+	if err != nil {
+		return qbtypes.ResourceFilterResolveKindNoOp, err
+	}
+	if countStmt == nil {
+		return qbtypes.ResourceFilterResolveKindNoOp, nil
+	}
+
+	var count uint64
+	row := r.telemetryStore.ClickhouseDB().QueryRow(ctx, countStmt.Query, countStmt.Args...)
+	if err := row.Scan(&count); err != nil {
+		return qbtypes.ResourceFilterResolveKindNoOp, err
+	}
+
+	if count >= r.threshold {
+		return qbtypes.ResourceFilterResolveKindFallback, nil
+	}
+	return qbtypes.ResourceFilterResolveKindUseCTE, nil
+}

pkg/telemetryresourcefilter/statement_builder.go

@@ -127,6 +127,25 @@ func (b *resourceFilterStatementBuilder[T]) Build(
 	}, nil
 }
 
+// BuildCount returns a statement that counts the distinct fingerprints matching
+// the resource filter. Returns (nil, nil) when the filter is a no-op.
+func (b *resourceFilterStatementBuilder[T]) BuildCount(
+	ctx context.Context,
+	start uint64,
+	end uint64,
+	query qbtypes.QueryBuilderQuery[T],
+	variables map[string]qbtypes.VariableItem,
+) (*qbtypes.Statement, error) {
+	inner, err := b.Build(ctx, start, end, qbtypes.RequestTypeRaw, query, variables)
+	if err != nil || inner == nil {
+		return nil, err
+	}
+	return &qbtypes.Statement{
+		Query: fmt.Sprintf("SELECT count() FROM (%s)", inner.Query),
+		Args:  inner.Args,
+	}, nil
+}
+
 // addConditions adds both filter and time conditions to the query.
 // Returns true (isNoOp) when the filter expression evaluated to no resource conditions,
 // meaning the CTE would select all fingerprints and should be skipped entirely.

pkg/telemetrytraces/statement_builder.go

@@ -24,13 +24,13 @@ var (
 )
 
 type traceQueryStatementBuilder struct {
-	logger                    *slog.Logger
-	metadataStore             telemetrytypes.MetadataStore
-	fm                        qbtypes.FieldMapper
-	cb                        qbtypes.ConditionBuilder
-	resourceFilterStmtBuilder qbtypes.StatementBuilder[qbtypes.TraceAggregation]
-	aggExprRewriter           qbtypes.AggExprRewriter
-	telemetryStore            telemetrystore.TelemetryStore
+	logger                         *slog.Logger
+	metadataStore                  telemetrytypes.MetadataStore
+	fm                             qbtypes.FieldMapper
+	cb                             qbtypes.ConditionBuilder
+	resourceFilterResolver         *telemetryresourcefilter.ResourceFingerprintResolver[qbtypes.TraceAggregation]
+	aggExprRewriter                qbtypes.AggExprRewriter
+	skipResourceFingerprintEnabled bool
 }
 
 var _ qbtypes.StatementBuilder[qbtypes.TraceAggregation] = (*traceQueryStatementBuilder)(nil)
@@ -43,10 +43,12 @@ func NewTraceQueryStatementBuilder(
 	aggExprRewriter qbtypes.AggExprRewriter,
 	telemetryStore telemetrystore.TelemetryStore,
 	flagger flagger.Flagger,
+	skipResourceFingerprintEnable bool,
+	skipResourceFingerprintThreshold uint64,
 ) *traceQueryStatementBuilder {
 	tracesSettings := factory.NewScopedProviderSettings(settings, "github.com/SigNoz/signoz/pkg/telemetrytraces")
 
-	resourceFilterStmtBuilder := telemetryresourcefilter.New[qbtypes.TraceAggregation](
+	resourceFilterResolver := telemetryresourcefilter.NewResolver[qbtypes.TraceAggregation](
 		settings,
 		DBName,
 		TracesResourceV3TableName,
@@ -56,16 +58,18 @@ func NewTraceQueryStatementBuilder(
 		nil,
 		nil,
 		flagger,
+		telemetryStore,
+		skipResourceFingerprintThreshold,
 	)
 
 	return &traceQueryStatementBuilder{
-		logger:                    tracesSettings.Logger(),
-		metadataStore:             metadataStore,
-		fm:                        fieldMapper,
-		cb:                        conditionBuilder,
-		resourceFilterStmtBuilder: resourceFilterStmtBuilder,
-		aggExprRewriter:           aggExprRewriter,
-		telemetryStore:            telemetryStore,
+		logger:                         tracesSettings.Logger(),
+		metadataStore:                  metadataStore,
+		fm:                             fieldMapper,
+		cb:                             conditionBuilder,
+		resourceFilterResolver:         resourceFilterResolver,
+		aggExprRewriter:                aggExprRewriter,
+		skipResourceFingerprintEnabled: skipResourceFingerprintEnable,
 	}
 }
 
@@ -308,9 +312,11 @@ func (b *traceQueryStatementBuilder) buildListQuery(
 		cteArgs      [][]any
 	)
 
-	if frag, args, err := b.maybeAttachResourceFilter(ctx, sb, query, start, end, variables); err != nil {
+	frag, args, skipResourceFilter, err := b.maybeAttachResourceFilter(ctx, sb, query, start, end, variables)
+	if err != nil {
 		return nil, err
-	} else if frag != "" {
+	}
+	if frag != "" {
 		cteFragments = append(cteFragments, frag)
 		cteArgs = append(cteArgs, args)
 	}
@@ -328,7 +334,7 @@ func (b *traceQueryStatementBuilder) buildListQuery(
 	sb.From(fmt.Sprintf("%s.%s", DBName, SpanIndexV3TableName))
 
 	// Add filter conditions
-	preparedWhereClause, err := b.addFilterCondition(ctx, sb, start, end, query, keys, variables)
+	preparedWhereClause, err := b.addFilterCondition(ctx, sb, start, end, query, keys, variables, skipResourceFilter)
 	if err != nil {
 		return nil, err
 	}
@@ -389,15 +395,17 @@ func (b *traceQueryStatementBuilder) buildTraceQuery(
 		cteArgs      [][]any
 	)
 
-	if frag, args, err := b.maybeAttachResourceFilter(ctx, distSB, query, start, end, variables); err != nil {
+	frag, args, skipResourceFilter, err := b.maybeAttachResourceFilter(ctx, distSB, query, start, end, variables)
+	if err != nil {
 		return nil, err
-	} else if frag != "" {
+	}
+	if frag != "" {
 		cteFragments = append(cteFragments, frag)
 		cteArgs = append(cteArgs, args)
 	}
 
 	// Add filter conditions
-	preparedWhereClause, err := b.addFilterCondition(ctx, distSB, start, end, query, keys, variables)
+	preparedWhereClause, err := b.addFilterCondition(ctx, distSB, start, end, query, keys, variables, skipResourceFilter)
 	if err != nil {
 		return nil, err
 	}
@@ -498,9 +506,11 @@ func (b *traceQueryStatementBuilder) buildTimeSeriesQuery(
 		cteArgs      [][]any
 	)
 
-	if frag, args, err := b.maybeAttachResourceFilter(ctx, sb, query, start, end, variables); err != nil {
+	frag, args, skipResourceFilter, err := b.maybeAttachResourceFilter(ctx, sb, query, start, end, variables)
+	if err != nil {
 		return nil, err
-	} else if frag != "" {
+	}
+	if frag != "" {
 		cteFragments = append(cteFragments, frag)
 		cteArgs = append(cteArgs, args)
 	}
@@ -541,7 +551,7 @@ func (b *traceQueryStatementBuilder) buildTimeSeriesQuery(
 	}
 
 	sb.From(fmt.Sprintf("%s.%s", DBName, SpanIndexV3TableName))
-	preparedWhereClause, err := b.addFilterCondition(ctx, sb, start, end, query, keys, variables)
+	preparedWhereClause, err := b.addFilterCondition(ctx, sb, start, end, query, keys, variables, skipResourceFilter)
 	if err != nil {
 		return nil, err
 	}
@@ -650,9 +660,11 @@ func (b *traceQueryStatementBuilder) buildScalarQuery(
 		cteArgs      [][]any
 	)
 
-	if frag, args, err := b.maybeAttachResourceFilter(ctx, sb, query, start, end, variables); err != nil {
+	frag, args, skipResourceFilter, err := b.maybeAttachResourceFilter(ctx, sb, query, start, end, variables)
+	if err != nil {
 		return nil, err
-	} else if frag != "" && !skipResourceCTE {
+	}
+	if frag != "" && !skipResourceCTE {
 		cteFragments = append(cteFragments, frag)
 		cteArgs = append(cteArgs, args)
 	}
@@ -694,7 +706,7 @@ func (b *traceQueryStatementBuilder) buildScalarQuery(
 	sb.From(fmt.Sprintf("%s.%s", DBName, SpanIndexV3TableName))
 
 	// Add filter conditions
-	preparedWhereClause, err := b.addFilterCondition(ctx, sb, start, end, query, keys, variables)
+	preparedWhereClause, err := b.addFilterCondition(ctx, sb, start, end, query, keys, variables, skipResourceFilter)
 	if err != nil {
 		return nil, err
 	}
@@ -757,6 +769,7 @@ func (b *traceQueryStatementBuilder) addFilterCondition(
 	query qbtypes.QueryBuilderQuery[qbtypes.TraceAggregation],
 	keys map[string][]*telemetrytypes.TelemetryFieldKey,
 	variables map[string]qbtypes.VariableItem,
+	skipResourceFilter bool,
 ) (querybuilder.PreparedWhereClause, error) {
 
 	var preparedWhereClause querybuilder.PreparedWhereClause
@@ -770,7 +783,7 @@ func (b *traceQueryStatementBuilder) addFilterCondition(
 			FieldMapper:        b.fm,
 			ConditionBuilder:   b.cb,
 			FieldKeys:          keys,
-			SkipResourceFilter: true,
+			SkipResourceFilter: skipResourceFilter,
 			Variables:          variables,
 			StartNs:            start,
 			EndNs:              end,
@@ -811,34 +824,30 @@ func (b *traceQueryStatementBuilder) maybeAttachResourceFilter(
 	query qbtypes.QueryBuilderQuery[qbtypes.TraceAggregation],
 	start, end uint64,
 	variables map[string]qbtypes.VariableItem,
-) (cteSQL string, cteArgs []any, err error) {
+) (cteSQL string, cteArgs []any, skipResourceFilter bool, err error) {
 
-	stmt, err := b.buildResourceFilterCTE(ctx, query, start, end, variables)
+	if b.skipResourceFingerprintEnabled {
+		decision, err := b.resourceFilterResolver.Resolve(ctx, query, start, end, variables)
+		if err != nil {
+			return "", nil, true, err
+		}
+		switch decision {
+		case qbtypes.ResourceFilterResolveKindNoOp:
+			return "", nil, true, nil
+		case qbtypes.ResourceFilterResolveKindFallback:
+			return "", nil, false, nil
+		}
+	}
+
+	stmt, err := b.resourceFilterResolver.StatementBuilder().Build(
+		ctx, start, end, qbtypes.RequestTypeRaw, query, variables,
+	)
 	if err != nil {
-		return "", nil, err
+		return "", nil, true, err
 	}
 	if stmt == nil {
-		return "", nil, nil
+		return "", nil, true, nil
 	}
-
 	sb.Where("resource_fingerprint GLOBAL IN (SELECT fingerprint FROM __resource_filter)")
-
-	return fmt.Sprintf("__resource_filter AS (%s)", stmt.Query), stmt.Args, nil
-}
-
-func (b *traceQueryStatementBuilder) buildResourceFilterCTE(
-	ctx context.Context,
-	query qbtypes.QueryBuilderQuery[qbtypes.TraceAggregation],
-	start, end uint64,
-	variables map[string]qbtypes.VariableItem,
-) (*qbtypes.Statement, error) {
-
-	return b.resourceFilterStmtBuilder.Build(
-		ctx,
-		start,
-		end,
-		qbtypes.RequestTypeRaw,
-		query,
-		variables,
-	)
+	return fmt.Sprintf("__resource_filter AS (%s)", stmt.Query), stmt.Args, true, nil
 }

pkg/telemetrytraces/stmt_builder_test.go

@@ -2,19 +2,36 @@ package telemetrytraces
 
 import (
 	"context"
+	"regexp"
 	"testing"
 	"time"
 
+	cmock "github.com/SigNoz/clickhouse-go-mock"
 	"github.com/SigNoz/signoz/pkg/errors"
 	"github.com/SigNoz/signoz/pkg/flagger/flaggertest"
 	"github.com/SigNoz/signoz/pkg/instrumentation/instrumentationtest"
 	"github.com/SigNoz/signoz/pkg/querybuilder"
+	"github.com/SigNoz/signoz/pkg/telemetrystore"
+	"github.com/SigNoz/signoz/pkg/telemetrystore/telemetrystoretest"
 	qbtypes "github.com/SigNoz/signoz/pkg/types/querybuildertypes/querybuildertypesv5"
 	"github.com/SigNoz/signoz/pkg/types/telemetrytypes"
 	"github.com/SigNoz/signoz/pkg/types/telemetrytypes/telemetrytypestest"
 	"github.com/stretchr/testify/require"
 )
 
+type regexQueryMatcher struct{}
+
+func (m *regexQueryMatcher) Match(expectedSQL, actualSQL string) error {
+	re, err := regexp.Compile(expectedSQL)
+	if err != nil {
+		return err
+	}
+	if !re.MatchString(actualSQL) {
+		return errors.NewInvalidInputf(errors.CodeInvalidInput, "expected query to match %s, got %s", expectedSQL, actualSQL)
+	}
+	return nil
+}
+
 func TestStatementBuilder(t *testing.T) {
 	// releaseTime is chosen so it lands inside the standard [1747947419000, 1747983448000]ms
 	// test window, keeping the multiIf SQL form for resource fields.
@@ -370,6 +387,8 @@ func TestStatementBuilder(t *testing.T) {
 		aggExprRewriter,
 		nil,
 		fl,
+		false,
+		100000,
 	)
 
 	vars := map[string]qbtypes.VariableItem{
@@ -666,6 +685,8 @@ func TestStatementBuilderListQuery(t *testing.T) {
 		aggExprRewriter,
 		nil,
 		fl,
+		false,
+		100000,
 	)
 
 	for _, c := range cases {
@@ -794,6 +815,8 @@ func TestStatementBuilderListQueryWithCorruptData(t *testing.T) {
 				aggExprRewriter,
 				nil,
 				fl,
+				false,
+				100000,
 			)
 
 			q, err := statementBuilder.Build(context.Background(), 1747947419000, 1747983448000, c.requestType, c.query, nil)
@@ -864,6 +887,8 @@ func TestStatementBuilderGroupByResourceEvolution(t *testing.T) {
 		aggExprRewriter,
 		nil,
 		fl,
+		false,
+		100000,
 	)
 
 	query := qbtypes.QueryBuilderQuery[qbtypes.TraceAggregation]{
@@ -1029,6 +1054,8 @@ func TestStatementBuilderTraceQuery(t *testing.T) {
 		aggExprRewriter,
 		nil,
 		fl,
+		false,
+		100000,
 	)
 
 	for _, c := range cases {
@@ -1561,3 +1588,115 @@ func TestAdjustKeys(t *testing.T) {
 		})
 	}
 }
+
+// TestSkipResourceFingerprint exercises the three resolver outcomes when
+// skip_resource_fingerprint is enabled: use-CTE (count < threshold),
+// fallback (count >= threshold), and the legacy path (feature disabled).
+func TestSkipResourceFingerprint(t *testing.T) {
+	const (
+		startMs   = uint64(1747947419000)
+		endMs     = uint64(1747983448000)
+		threshold = uint64(10)
+	)
+
+	query := qbtypes.QueryBuilderQuery[qbtypes.TraceAggregation]{
+		Signal: telemetrytypes.SignalTraces,
+		Filter: &qbtypes.Filter{
+			Expression: "service.name = 'redis-manual'",
+		},
+		SelectFields: []telemetrytypes.TelemetryFieldKey{
+			{
+				Name:          "name",
+				FieldContext:  telemetrytypes.FieldContextSpan,
+				FieldDataType: telemetrytypes.FieldDataTypeString,
+			},
+		},
+		Limit: 5,
+	}
+
+	t.Run("disabled uses the legacy CTE", func(t *testing.T) {
+		sb := newSkipResourceFingerprintBuilder(t, nil, false, threshold)
+
+		stmt, err := sb.Build(context.Background(), startMs, endMs, qbtypes.RequestTypeRaw, query, nil)
+		require.NoError(t, err)
+		require.Contains(t, stmt.Query, "__resource_filter AS (SELECT fingerprint")
+		require.Contains(t, stmt.Query, "resource_fingerprint GLOBAL IN (SELECT fingerprint FROM __resource_filter)")
+	})
+
+	t.Run("CTE attached when count below threshold", func(t *testing.T) {
+		mockStore := telemetrystoretest.New(telemetrystore.Config{}, &regexQueryMatcher{})
+		mock := mockStore.Mock()
+
+		// Only the count query runs against the telemetry store; the CTE
+		// itself is embedded as SQL in the main query (no extra round trip).
+		mock.ExpectQueryRow(`SELECT count\(\) FROM \(SELECT fingerprint FROM signoz_traces\.distributed_traces_v3_resource`).
+			WillReturnRow(cmock.NewRow([]cmock.ColumnType{
+				{Name: "count", Type: "UInt64"},
+			}, []any{uint64(2)}))
+
+		sb := newSkipResourceFingerprintBuilder(t, mockStore, true, threshold)
+
+		stmt, err := sb.Build(context.Background(), startMs, endMs, qbtypes.RequestTypeRaw, query, nil)
+		require.NoError(t, err)
+
+		require.Contains(t, stmt.Query, "__resource_filter AS (SELECT fingerprint")
+		require.Contains(t, stmt.Query, "resource_fingerprint GLOBAL IN (SELECT fingerprint FROM __resource_filter)")
+
+		require.NoError(t, mock.ExpectationsWereMet())
+	})
+
+	t.Run("fallback when count at or above threshold", func(t *testing.T) {
+		mockStore := telemetrystoretest.New(telemetrystore.Config{}, &regexQueryMatcher{})
+		mock := mockStore.Mock()
+
+		mock.ExpectQueryRow(`SELECT count\(\) FROM \(SELECT fingerprint FROM signoz_traces\.distributed_traces_v3_resource`).
+			WillReturnRow(cmock.NewRow([]cmock.ColumnType{
+				{Name: "count", Type: "UInt64"},
+			}, []any{threshold}))
+
+		sb := newSkipResourceFingerprintBuilder(t, mockStore, true, threshold)
+
+		stmt, err := sb.Build(context.Background(), startMs, endMs, qbtypes.RequestTypeRaw, query, nil)
+		require.NoError(t, err)
+
+		require.NotContains(t, stmt.Query, "__resource_filter AS")
+		require.NotContains(t, stmt.Query, "resource_fingerprint")
+		// resource conditions are pushed onto the main table via the
+		// resource.`service.name` / resources_string lookup
+		require.Contains(t, stmt.Query, "service.name")
+
+		require.NoError(t, mock.ExpectationsWereMet())
+	})
+}
+
+func newSkipResourceFingerprintBuilder(
+	t *testing.T,
+	telemetryStore telemetrystore.TelemetryStore,
+	skipEnable bool,
+	threshold uint64,
+) *traceQueryStatementBuilder {
+	t.Helper()
+
+	fm := NewFieldMapper()
+	cb := NewConditionBuilder(fm)
+	mockMetadataStore := telemetrytypestest.NewMockMetadataStore()
+	releaseTime := time.Date(2025, 5, 22, 22, 0, 0, 0, time.UTC)
+	mockMetadataStore.KeysMap = buildCompleteFieldKeyMap(releaseTime)
+
+	fl := flaggertest.New(t)
+	aggExprRewriter := querybuilder.NewAggExprRewriter(
+		instrumentationtest.New().ToProviderSettings(), nil, fm, cb, nil, fl,
+	)
+
+	return NewTraceQueryStatementBuilder(
+		instrumentationtest.New().ToProviderSettings(),
+		mockMetadataStore,
+		fm,
+		cb,
+		aggExprRewriter,
+		telemetryStore,
+		fl,
+		skipEnable,
+		threshold,
+	)
+}

pkg/telemetrytraces/trace_operator_cte_builder_test.go

@@ -25,7 +25,7 @@ func newTestTraceOperatorStatementBuilder(t *testing.T) *traceOperatorStatementB
 	aggExprRewriter := querybuilder.NewAggExprRewriter(instrumentationtest.New().ToProviderSettings(), nil, fm, cb, nil, fl)
 	traceStmtBuilder := NewTraceQueryStatementBuilder(
 		instrumentationtest.New().ToProviderSettings(),
-		mockMetadataStore, fm, cb, aggExprRewriter, nil, fl,
+		mockMetadataStore, fm, cb, aggExprRewriter, nil, fl, false, 100000,
 	)
 	return NewTraceOperatorStatementBuilder(
 		instrumentationtest.New().ToProviderSettings(),

pkg/telemetrytraces/trace_time_range_test.go

@@ -6,13 +6,13 @@ import (
 	"testing"
 	"time"
 
+	"github.com/SigNoz/signoz/pkg/flagger/flaggertest"
 	"github.com/SigNoz/signoz/pkg/instrumentation/instrumentationtest"
 	"github.com/SigNoz/signoz/pkg/querybuilder"
 	qbtypes "github.com/SigNoz/signoz/pkg/types/querybuildertypes/querybuildertypesv5"
 	"github.com/SigNoz/signoz/pkg/types/telemetrytypes"
 	"github.com/SigNoz/signoz/pkg/types/telemetrytypes/telemetrytypestest"
 	"github.com/stretchr/testify/assert"
-	"github.com/SigNoz/signoz/pkg/flagger/flaggertest"
 	"github.com/stretchr/testify/require"
 )
 
@@ -46,8 +46,10 @@ func TestTraceTimeRangeOptimization(t *testing.T) {
 		fm,
 		cb,
 		aggExprRewriter,
-		nil, // telemetryStore is nil - optimization won't happen but code path is tested
+		nil, // telemetryStore is nil - adaptive path is disabled
 		fl,
+		false,
+		100000,
 	)
 
 	tests := []struct {

pkg/types/cloudintegrationtypes/serviceid.go

@@ -27,7 +27,6 @@ var (
 	// Azure services.
 	AzureServiceStorageAccountsBlob = ServiceID{valuer.NewString("storageaccountsblob")}
 	AzureServiceCDNProfile          = ServiceID{valuer.NewString("cdnprofile")}
-	AzureServiceAppService          = ServiceID{valuer.NewString("appservice")}
 )
 
 func (ServiceID) Enum() []any {
@@ -47,7 +46,6 @@ func (ServiceID) Enum() []any {
 		AWSServiceSQS,
 		AzureServiceStorageAccountsBlob,
 		AzureServiceCDNProfile,
-		AzureServiceAppService,
 	}
 }
 
@@ -71,7 +69,6 @@ var SupportedServices = map[CloudProviderType][]ServiceID{
 	CloudProviderTypeAzure: {
 		AzureServiceStorageAccountsBlob,
 		AzureServiceCDNProfile,
-		AzureServiceAppService,
 	},
 }
 

pkg/types/querybuildertypes/querybuildertypesv5/resource_filter_resolve.go

@@ -0,0 +1,9 @@
+package querybuildertypesv5
+
+type ResourceFilterResolveKind int
+
+const (
+	ResourceFilterResolveKindNoOp ResourceFilterResolveKind = iota
+	ResourceFilterResolveKindUseCTE
+	ResourceFilterResolveKindFallback
+)

tests/integration/tests/querier_skip_resource_fingerprint/01_skip_resource_fingerprint.py

@@ -0,0 +1,105 @@
+"""
+Transparency check for the skip_resource_fingerprint optimization (traces and logs).
+
+At or above the configured fingerprint threshold the optimization pushes resource
+conditions onto the main spans/logs table instead of the fingerprint CTE. That
+rewrite must change ClickHouse performance, never the rows: each test runs the same
+query against the primary instance (optimization on, threshold=2) and
+`signoz_fingerprint` (optimization off) and asserts the responses are identical.
+"""
+
+from collections.abc import Callable
+from datetime import UTC, datetime, timedelta
+
+from fixtures import types
+from fixtures.auth import USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD
+from fixtures.logs import Logs
+from fixtures.querier import (
+    BuilderQuery,
+    OrderBy,
+    TelemetryFieldKey,
+    assert_identical_query_response,
+    get_rows,
+    make_query_request,
+)
+from fixtures.traces import Traces
+
+
+def test_skip_resource_fingerprint_traces_fallback_matches_fingerprint(
+    signoz: types.SigNoz,
+    signoz_fingerprint: types.SigNoz,
+    create_user_admin: None,  # pylint: disable=unused-argument
+    get_token: Callable[[str, str], str],
+    insert_traces: Callable[[list[Traces]], None],
+) -> None:
+    """A >= 2-fingerprint filter drives the fallback path; rows must match the fingerprint baseline."""
+    now = datetime.now(tz=UTC).replace(second=0, microsecond=0)
+
+    # 3 distinct services share one env (3 fingerprints > threshold 2 -> fallback);
+    # the 4th has a different env and must be excluded.
+    env = {"deployment.environment": "skip-fallback"}
+    insert_traces(
+        [
+            Traces(timestamp=now - timedelta(seconds=10), resources={"service.name": "skip-fb-svc-a", **env}),
+            Traces(timestamp=now - timedelta(seconds=9), resources={"service.name": "skip-fb-svc-b", **env}),
+            Traces(timestamp=now - timedelta(seconds=8), resources={"service.name": "skip-fb-svc-c", **env}),
+            Traces(timestamp=now - timedelta(seconds=7), resources={"service.name": "skip-fb-other", "deployment.environment": "skip-other"}),
+        ]
+    )
+
+    token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
+    query = BuilderQuery(
+        signal="traces",
+        limit=50,
+        order=[OrderBy(TelemetryFieldKey("timestamp"), "asc")],
+        filter_expression="deployment.environment = 'skip-fallback'",
+        select_fields=[TelemetryFieldKey("service.name", "string", "resource")],
+    ).to_dict()
+
+    start_ms = int((datetime.now(tz=UTC) - timedelta(minutes=5)).timestamp() * 1000)
+    end_ms = int(datetime.now(tz=UTC).timestamp() * 1000)
+    optimized = make_query_request(signoz, token, start_ms=start_ms, end_ms=end_ms, request_type="raw", queries=[query])
+    fingerprint = make_query_request(signoz_fingerprint, token, start_ms=start_ms, end_ms=end_ms, request_type="raw", queries=[query])
+
+    assert len(get_rows(optimized)) == 3
+    assert_identical_query_response(optimized, fingerprint)
+
+
+def test_skip_resource_fingerprint_logs_fallback_matches_fingerprint(
+    signoz: types.SigNoz,
+    signoz_fingerprint: types.SigNoz,
+    create_user_admin: None,  # pylint: disable=unused-argument
+    get_token: Callable[[str, str], str],
+    insert_logs: Callable[[list[Logs]], None],
+) -> None:
+    """A >= 2-fingerprint filter drives the fallback path; rows must match the fingerprint baseline."""
+    now = datetime.now(tz=UTC)
+
+    # 3 distinct services share one env (3 fingerprints > threshold 2 -> fallback);
+    # the 4th has a different env and must be excluded.
+    env = {"deployment.environment": "skip-logs-fallback"}
+    insert_logs(
+        [
+            Logs(timestamp=now - timedelta(seconds=10), resources={"service.name": "skip-logs-fb-svc-a", **env}, body="a"),
+            Logs(timestamp=now - timedelta(seconds=9), resources={"service.name": "skip-logs-fb-svc-b", **env}, body="b"),
+            Logs(timestamp=now - timedelta(seconds=8), resources={"service.name": "skip-logs-fb-svc-c", **env}, body="c"),
+            Logs(timestamp=now - timedelta(seconds=7), resources={"service.name": "skip-logs-fb-other", "deployment.environment": "skip-logs-other"}, body="noise"),
+        ]
+    )
+
+    token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
+    query = BuilderQuery(
+        signal="logs",
+        limit=50,
+        order=[OrderBy(TelemetryFieldKey("timestamp"), "asc")],
+        filter_expression="deployment.environment = 'skip-logs-fallback'",
+        select_fields=[TelemetryFieldKey("service.name", "string", "resource"), TelemetryFieldKey("body")],
+    ).to_dict()
+
+    start_ms = int((datetime.now(tz=UTC) - timedelta(minutes=5)).timestamp() * 1000)
+    end_ms = int(datetime.now(tz=UTC).timestamp() * 1000)
+    optimized = make_query_request(signoz, token, start_ms=start_ms, end_ms=end_ms, request_type="raw", queries=[query])
+    fingerprint = make_query_request(signoz_fingerprint, token, start_ms=start_ms, end_ms=end_ms, request_type="raw", queries=[query])
+
+    assert len(get_rows(optimized)) == 3
+    assert_identical_query_response(optimized, fingerprint)

tests/integration/tests/querier_skip_resource_fingerprint/conftest.py

@@ -0,0 +1,71 @@
+import pytest
+from testcontainers.core.container import Network
+
+from fixtures import types
+from fixtures.signoz import create_signoz
+
+
+@pytest.fixture(name="signoz", scope="package")
+def signoz_skip_resource_fingerprint(
+    network: Network,
+    migrator: types.Operation,  # pylint: disable=unused-argument
+    zeus: types.TestContainerDocker,
+    gateway: types.TestContainerDocker,
+    sqlstore: types.TestContainerSQL,
+    clickhouse: types.TestContainerClickhouse,
+    request: pytest.FixtureRequest,
+    pytestconfig: pytest.Config,
+) -> types.SigNoz:
+    """
+    Package-scoped SigNoz instance with the skip_resource_fingerprint
+    optimization enabled and a low threshold so the fallback resolver path is
+    exercised (filters matching >= 2 fingerprints skip the fingerprint CTE).
+    """
+    return create_signoz(
+        network=network,
+        zeus=zeus,
+        gateway=gateway,
+        sqlstore=sqlstore,
+        clickhouse=clickhouse,
+        request=request,
+        pytestconfig=pytestconfig,
+        cache_key="signoz-skip-resource-fingerprint",
+        env_overrides={
+            "SIGNOZ_QUERIER_SKIP__RESOURCE__FINGERPRINT_ENABLED": True,
+            "SIGNOZ_QUERIER_SKIP__RESOURCE__FINGERPRINT_THRESHOLD": 2,
+        },
+    )
+
+
+@pytest.fixture(name="signoz_fingerprint", scope="package")
+def signoz_fingerprint(
+    network: Network,
+    migrator: types.Operation,  # pylint: disable=unused-argument
+    zeus: types.TestContainerDocker,
+    gateway: types.TestContainerDocker,
+    sqlstore: types.TestContainerSQL,
+    clickhouse: types.TestContainerClickhouse,
+    request: pytest.FixtureRequest,
+    pytestconfig: pytest.Config,
+) -> types.SigNoz:
+    """
+    A second SigNoz instance with the optimization disabled, so every query
+    resolves resource filters through the fingerprint CTE (the path the primary
+    also takes below the threshold). It shares the same ClickHouse (telemetry)
+    and sqlstore (users) as the primary instance, which lets a single admin
+    token authenticate against both and lets the tests diff the optimized
+    result against this fingerprint baseline for the same query and data.
+    """
+    return create_signoz(
+        network=network,
+        zeus=zeus,
+        gateway=gateway,
+        sqlstore=sqlstore,
+        clickhouse=clickhouse,
+        request=request,
+        pytestconfig=pytestconfig,
+        cache_key="signoz-skip-resource-fingerprint-baseline",
+        env_overrides={
+            "SIGNOZ_QUERIER_SKIP__RESOURCE__FINGERPRINT_ENABLED": False,
+        },
+    )