feat(authz): enable FGA for telemetry resources (#12095)

* feat(authz): enable FGA for telemetry resources on v5 query_range

Authorize /api/v5/query_range and /preview at the telemetry-resource level,
derived from the request body:

- coretypes: ResourceWithID + ResourceExtractor as the resource-level analogue
  of the id extractors; NewResolvedResourceWithID/NewResolvedResourceWithError;
  telemetryresource selector regex widened to query-type selectors with up to
  two hashed segments (metric name, where clause) or wildcards
- telemetrytypes: QueryRangeResources maps each query to its telemetry
  resource (signal/source aware: audit-logs, meter-metrics) with a hierarchical
  selector id (query_type/<hash(metric)>/<hash(where)>); PrefixSelector expands
  the id into the grant ladder [exact, prefix/*..., *]
- handler: generic TelemetryResourceDef fans out an injected ResourceExtractor;
  fails closed when extraction errors or resolves nothing
- audit: log and skip resolved resources that carry a resolution error
- querier routes: ViewAccess -> CheckResources with telemetry read scopes;
  substitute_vars stays ViewAccess (no telemetry access)
- sqlmigration 099: backfill telemetry read tuples for existing orgs
  (admin: logs/traces/metrics/audit-logs/meter-metrics; editor/viewer:
  logs/traces/metrics)

* feat(authz): widen telemetry selector segments to 128 bits

64-bit truncation permits chosen-collision attacks at ~2^32 work; 128 bits
pushes this to 2^64. No hashed selector is persisted yet, so the change is
free.

* chore(docs): regenerate openapi spec with telemetry read scopes

* feat(telemetry): add where clause visitor

* refactor(telemetry): restructure normalizer file and quote bare values

* feat(authz): gate v5 query_range on service.name telemetry selectors

* feat(authz): encode telemetry grants as query-type qualified atom selectors

* feat(authz): move telemetry grant key to plaintext selector segment

* feat(authz): use escaped plaintext telemetry selectors with mechanical ladder

* revert(authz): restore transaction group diff in role update

* test(authz): add querierauthz integration suite for telemetry query_range gating

* test(authz): seed logs so service.name resolves in allowed querierauthz cases

* feat(authz): backfill telemetry read tuples for existing orgs

* chore(authz): reword empty composite query error message

* feat(authz): add meter metrics and audit logs to clickhouse sql

* Revert "feat(authz): add meter metrics and audit logs to clickhouse sql"

This reverts commit c9d870e0ee.

* feat(authz): grant meter-metrics to editor/viewer, keep clickhouse admin-only

* feat(authz): remove the audit logs from clickhouse check altogether until it's introduced

.github/workflows/integrationci.yaml

@@ -54,6 +54,7 @@ jobs:
           - querierscalar
           - queriercommon
           - rawexportdata
+          - querierauthz
           - role
           - rootuser
           - serviceaccount

docs/api/openapi.yml

@@ -7571,6 +7571,7 @@ components:
         groupBy:
           items:
             type: string
+          nullable: true
           type: array
         newGroupEvalDelay:
           type: string
@@ -7642,6 +7643,7 @@ components:
         alertStates:
           items:
             $ref: '#/components/schemas/RuletypesAlertState'
+          nullable: true
           type: array
         enabled:
           type: boolean
@@ -24464,9 +24466,17 @@ paths:
           description: Internal Server Error
       security:
       - api_key:
-        - VIEWER
+        - logs:read
+        - traces:read
+        - metrics:read
+        - audit-logs:read
+        - meter-metrics:read
       - tokenizer:
-        - VIEWER
+        - logs:read
+        - traces:read
+        - metrics:read
+        - audit-logs:read
+        - meter-metrics:read
       summary: Query range
       tags:
       - querier
@@ -24533,9 +24543,17 @@ paths:
           description: Internal Server Error
       security:
       - api_key:
-        - VIEWER
+        - logs:read
+        - traces:read
+        - metrics:read
+        - audit-logs:read
+        - meter-metrics:read
       - tokenizer:
-        - VIEWER
+        - logs:read
+        - traces:read
+        - metrics:read
+        - audit-logs:read
+        - meter-metrics:read
       summary: Query range preview
       tags:
       - querier

frontend/src/api/generated/services/sigNoz.schemas.ts

@@ -8675,9 +8675,9 @@ export interface RuletypesGettableTestRuleDTO {
 
 export interface RuletypesRenotifyDTO {
 	/**
-	 * @type array
+	 * @type array,null
 	 */
-	alertStates?: RuletypesAlertStateDTO[];
+	alertStates?: RuletypesAlertStateDTO[] | null;
 	/**
 	 * @type boolean
 	 */
@@ -8690,9 +8690,9 @@ export interface RuletypesRenotifyDTO {
 
 export interface RuletypesNotificationSettingsDTO {
 	/**
-	 * @type array
+	 * @type array,null
 	 */
-	groupBy?: string[];
+	groupBy?: string[] | null;
 	/**
 	 * @type string
 	 */

frontend/src/components/ExportMenu/ExportMenu.styles.scss

@@ -1,4 +1,4 @@
-.timeseries-export-popover {
+.export-menu-popover {
 	width: 240px;
 	padding: 0 12px 12px 12px;
 

frontend/src/components/ExportMenu/ExportMenu.tsx

@@ -4,42 +4,43 @@ import { Popover, PopoverContent, PopoverTrigger } from '@signozhq/ui/popover';
 import { RadioGroup, RadioGroupItem } from '@signozhq/ui/radio-group';
 import { TooltipSimple } from '@signozhq/ui/tooltip';
 import { Typography } from '@signozhq/ui/typography';
-import { useClientExport } from 'hooks/useExportData/useClientExport';
+import {
+	ClientExportData,
+	useClientExport,
+} from 'hooks/useExportData/useClientExport';
 import { ExportFormat } from 'lib/exportData/types';
 import { useCallback, useState } from 'react';
 import { Query } from 'types/api/queryBuilder/queryBuilderData';
-import { QueryRangeResponseV5 } from 'types/api/v5/queryRange';
 import { DataSource } from 'types/common/queryBuilder';
 
-import './TimeseriesExportMenu.styles.scss';
+import './ExportMenu.styles.scss';
 
-interface TimeseriesExportMenuProps {
+interface ExportMenuProps {
 	dataSource: DataSource;
-	queryResponse: QueryRangeResponseV5;
+	// The queryRange response object the view holds — the hook picks the
+	// serializer (timeseries / table) from what it carries.
+	data: ClientExportData;
 	query?: Query;
 	yAxisUnit?: string;
-	legendMap?: Record<string, string>;
 	fileName?: string;
 }
 
-// Download menu for in-memory timeseries data (client-side serialization).
+// Download menu for in-memory query results (client-side serialization).
 // The raw/list backend export keeps its own menu in DownloadOptionsMenu.
-export default function TimeseriesExportMenu({
+export default function ExportMenu({
 	dataSource,
-	queryResponse,
+	data,
 	query,
 	yAxisUnit,
-	legendMap,
 	fileName,
-}: TimeseriesExportMenuProps): JSX.Element {
+}: ExportMenuProps): JSX.Element {
 	const [exportFormat, setExportFormat] = useState<string>(ExportFormat.Csv);
 	const [isPopoverOpen, setIsPopoverOpen] = useState<boolean>(false);
 
 	const { isExporting, handleExport: handleClientExport } = useClientExport({
-		response: queryResponse,
+		data,
 		query,
 		yAxisUnit,
-		legendMap,
 		fileName,
 	});
 
@@ -57,7 +58,7 @@ export default function TimeseriesExportMenu({
 						color="secondary"
 						size="icon"
 						aria-label="Download"
-						data-testid={`timeseries-export-${dataSource}`}
+						data-testid={`export-menu-${dataSource}`}
 						disabled={isExporting}
 						loading={isExporting}
 					>
@@ -65,7 +66,7 @@ export default function TimeseriesExportMenu({
 					</Button>
 				</PopoverTrigger>
 			</TooltipSimple>
-			<PopoverContent align="end" className="timeseries-export-popover">
+			<PopoverContent align="end" className="export-menu-popover">
 				<div className="export-format">
 					<Typography.Text className="title">FORMAT</Typography.Text>
 					<RadioGroup value={exportFormat} onChange={setExportFormat}>

frontend/src/components/ExportMenu/__tests__/ExportMenu.test.tsx

@@ -1,8 +1,8 @@
+import { MetricQueryRangeSuccessResponse } from 'types/api/metrics/getQueryRange';
 import { fireEvent, render, screen } from 'tests/test-utils';
-import { QueryRangeResponseV5 } from 'types/api/v5/queryRange';
 import { DataSource } from 'types/common/queryBuilder';
 
-import TimeseriesExportMenu from '../TimeseriesExportMenu';
+import ExportMenu from '../ExportMenu';
 
 const mockHandleExport = jest.fn();
 let mockIsExporting = false;
@@ -14,25 +14,26 @@ jest.mock('hooks/useExportData/useClientExport', () => ({
 	}),
 }));
 
-const response = {
-	type: 'time_series',
-	data: { results: [] },
-	meta: {},
-} as unknown as QueryRangeResponseV5;
+const data = {
+	statusCode: 200,
+	error: null,
+	message: '',
+	payload: { data: { result: [], resultType: 'time_series' } },
+} as unknown as MetricQueryRangeSuccessResponse;
 
-const TEST_ID = `timeseries-export-${DataSource.LOGS}`;
+const TEST_ID = `export-menu-${DataSource.LOGS}`;
 
 function renderMenu(): void {
 	render(
-		<TimeseriesExportMenu
+		<ExportMenu
 			dataSource={DataSource.LOGS}
-			queryResponse={response}
+			data={data}
 			fileName="logs-timeseries"
 		/>,
 	);
 }
 
-describe('TimeseriesExportMenu', () => {
+describe('ExportMenu', () => {
 	beforeEach(() => {
 		mockHandleExport.mockReset();
 		mockIsExporting = false;

frontend/src/components/QuickFilters/FilterRenderers/Checkbox/checkboxFilterQuery.ts

@@ -11,6 +11,8 @@ import { Query, TagFilterItem } from 'types/api/queryBuilder/queryBuilderData';
 import { v4 as uuid } from 'uuid';
 
 import { isKeyMatch } from './utils';
+import { CheckedState } from '../../types';
+import { SectionType } from './v2/itemRules';
 
 export const SELECTED_OPERATORS = [OPERATORS['='], 'in'];
 export const NON_SELECTED_OPERATORS = [OPERATORS['!='], 'not in', 'nin'];
@@ -148,6 +150,8 @@ export function applyCheckboxToggle({
 	value,
 	checked,
 	isOnlyOrAllClicked,
+	previousState,
+	sectionType,
 }: {
 	currentQuery: Query;
 	activeQueryIndex: number;
@@ -157,6 +161,8 @@ export function applyCheckboxToggle({
 	value: string;
 	checked: boolean;
 	isOnlyOrAllClicked: boolean;
+	previousState?: CheckedState;
+	sectionType?: SectionType;
 }): Query {
 	const activeItems =
 		currentQuery.builder.queryData?.[activeQueryIndex]?.filters?.items;
@@ -216,6 +222,7 @@ export function applyCheckboxToggle({
 			);
 			if (currentFilter) {
 				const runningOperator = currentFilter?.op;
+
 				switch (runningOperator) {
 					case 'in':
 						if (checked) {
@@ -246,9 +253,29 @@ export function applyCheckboxToggle({
 								});
 							}
 						} else if (!checked) {
-							// if we are removing some value when the running operator is IN we filter.
-							// example - key IN [value1,currentSelectedValue] becomes key IN [value1] in case of array
-							if (isArray(currentFilter.value)) {
+							// Related section: clicking to exclude creates NOT_IN for just this value
+							if (sectionType === SectionType.RELATED) {
+								const newFilter: TagFilterItem = {
+									id: uuid(),
+									op: getNotInOperator(source),
+									key: filter.attributeKey,
+									value,
+								};
+								query.filters.items = query.filters.items.map((item) => {
+									if (isKeyMatch(item.key?.key, filter.attributeKey.key)) {
+										return newFilter;
+									}
+									return item;
+								});
+								if (query.filter?.expression) {
+									query.filter.expression = removeKeysFromExpression(
+										query.filter.expression,
+										[filter.attributeKey.key],
+									);
+								}
+							} else if (isArray(currentFilter.value)) {
+								// if we are removing some value when the running operator is IN we filter.
+								// example - key IN [value1,currentSelectedValue] becomes key IN [value1] in case of array
 								const newFilter = {
 									...currentFilter,
 									value: currentFilter.value.filter((val) => val !== value),
@@ -275,11 +302,38 @@ export function applyCheckboxToggle({
 						}
 						break;
 					case 'nin':
-					case 'not in':
-						// if the current running operator is NIN then when unchecking the value it gets
-						// added to the clause like key NIN [value1 , currentUnselectedValue]
-						if (!checked) {
-							// in case of array add the currentUnselectedValue to the list.
+					case 'not in': {
+						// NOT IN means "exclude these values"
+						// Check if value is currently in the exclusion list
+						const isValueInFilter = isArray(currentFilter.value)
+							? currentFilter.value.includes(value)
+							: currentFilter.value === value;
+
+						// When clicking unchecked "Other" item, user wants to SELECT it
+						// Replace NOT IN filter with IN [value]
+						if (previousState === 'unchecked' && checked) {
+							const newFilter: TagFilterItem = {
+								id: uuid(),
+								op: getOperatorValue(OPERATORS.IN),
+								key: filter.attributeKey,
+								value,
+							};
+							query.filters.items = query.filters.items.map((item) => {
+								if (isKeyMatch(item.key?.key, filter.attributeKey.key)) {
+									return newFilter;
+								}
+								return item;
+							});
+							if (query.filter?.expression) {
+								query.filter.expression = removeKeysFromExpression(
+									query.filter.expression,
+									[filter.attributeKey.key],
+								);
+							}
+						} else if (!checked || !isValueInFilter) {
+							// Add to NOT IN when:
+							// - checked=false (user explicitly unchecked to exclude)
+							// - checked=true but value not in filter (clicking "other" value to exclude)
 							if (isArray(currentFilter.value)) {
 								const newFilter = {
 									...currentFilter,
@@ -292,7 +346,6 @@ export function applyCheckboxToggle({
 									return item;
 								});
 							} else {
-								// in case of not an array make it one!
 								const newFilter = {
 									...currentFilter,
 									value: [currentFilter.value as string, value],
@@ -304,8 +357,9 @@ export function applyCheckboxToggle({
 									return item;
 								});
 							}
-						} else if (checked) {
-							// opposite of above!
+						} else {
+							// Remove from NOT IN when value IS in filter and checked=true
+							// (user wants to include this value back)
 							if (isArray(currentFilter.value)) {
 								const newFilter = {
 									...currentFilter,
@@ -346,6 +400,7 @@ export function applyCheckboxToggle({
 							}
 						}
 						break;
+					}
 					case '=':
 						if (checked) {
 							const newFilter = {
@@ -389,10 +444,11 @@ export function applyCheckboxToggle({
 				}
 			}
 		} else {
-			// case  - when there is no filter for the current key that means all are selected right now.
+			// No filter for this key - all are visually selected.
+			// checked=true → user wants to select (IN), checked=false → exclude (NOT IN)
 			const newFilterItem: TagFilterItem = {
 				id: uuid(),
-				op: getNotInOperator(source),
+				op: checked ? getOperatorValue(OPERATORS.IN) : getNotInOperator(source),
 				key: filter.attributeKey,
 				value,
 			};

frontend/src/components/QuickFilters/FilterRenderers/Checkbox/useCheckboxFilterActions.ts

@@ -10,6 +10,8 @@ import {
 	applyCheckboxToggle,
 	clearFilterFromQuery,
 } from './checkboxFilterQuery';
+import { CheckedState } from '../../types';
+import { SectionType } from './v2/itemRules';
 
 interface UseCheckboxFilterActionsProps {
 	filter: IQuickFiltersConfig;
@@ -24,6 +26,8 @@ interface UseCheckboxFilterActionsReturn {
 		value: string,
 		checked: boolean,
 		isOnlyOrAllClicked: boolean,
+		previousState?: CheckedState,
+		sectionType?: SectionType,
 	) => void;
 	onClear: () => void;
 }
@@ -53,6 +57,8 @@ function useCheckboxFilterActions({
 		value: string,
 		checked: boolean,
 		isOnlyOrAllClicked: boolean,
+		previousState?: CheckedState,
+		sectionType?: SectionType,
 	): void => {
 		dispatch(
 			applyCheckboxToggle({
@@ -64,6 +70,8 @@ function useCheckboxFilterActions({
 				value,
 				checked,
 				isOnlyOrAllClicked,
+				previousState,
+				sectionType,
 			}),
 		);
 	};

frontend/src/components/QuickFilters/FilterRenderers/Checkbox/v2/CheckboxFilterV2.module.scss

@@ -0,0 +1,103 @@
+.checkboxFilter {
+	display: flex;
+	flex-direction: column;
+	padding: var(--spacing-6);
+	gap: var(--spacing-6);
+	border-bottom: 1px solid var(--l1-border);
+}
+
+.search {
+	--input-background: var(--l2-background);
+	--input-hover-background: var(--l2-background);
+	--input-focus-background: var(--l2-background);
+	--input-border-color: var(--l2-border);
+	--input-focus-border-color: var(--l2-border);
+}
+
+.searchSpinner {
+	color: var(--l2-foreground);
+	animation: spin 0.8s linear infinite;
+}
+
+@keyframes spin {
+	from {
+		transform: rotate(0deg);
+	}
+
+	to {
+		transform: rotate(360deg);
+	}
+}
+
+.values {
+	display: flex;
+	flex-direction: column;
+}
+
+.sectionValues {
+	display: flex;
+	flex-direction: column;
+	gap: var(--spacing-4);
+}
+
+.loadingValues {
+	display: flex;
+	align-items: center;
+	justify-content: center;
+	padding: var(--spacing-6) 0;
+}
+
+.loadingMore {
+	align-self: center;
+}
+
+.noData {
+	align-self: center;
+}
+
+.showMore {
+	display: flex;
+	align-items: center;
+	justify-content: center;
+}
+
+.showMoreText {
+	color: var(--accent-primary);
+	cursor: pointer;
+}
+
+.goToDocs {
+	display: flex;
+	flex-direction: column;
+	gap: 44px;
+}
+
+.goToDocsContainer {
+	display: flex;
+	flex-direction: column;
+	gap: var(--spacing-2);
+	margin-top: var(--spacing-2);
+}
+
+.goToDocsMessage {
+	color: var(--l2-foreground);
+	font-size: 14px;
+	line-height: 20px;
+	letter-spacing: -0.07px;
+}
+
+.goToDocsButton {
+	display: flex;
+	align-items: center;
+	gap: var(--spacing-2);
+	cursor: pointer;
+	margin: 0 0 var(--spacing-2);
+	padding: 0;
+}
+
+.goToDocsButtonText {
+	color: var(--bg-robin-400);
+	font-size: 14px;
+	line-height: 20px;
+	letter-spacing: -0.07px;
+}

frontend/src/components/QuickFilters/FilterRenderers/Checkbox/v2/CheckboxFilterV2.testUtils.tsx

@@ -0,0 +1,126 @@
+import { render, RenderResult } from 'tests/test-utils';
+import { server, rest } from 'mocks-server/server';
+import { DataTypes } from 'types/api/queryBuilder/queryAutocompleteResponse';
+import { DataSource } from 'types/common/queryBuilder';
+import { Query, TagFilterItem } from 'types/api/queryBuilder/queryBuilderData';
+
+import {
+	FiltersType,
+	IQuickFiltersConfig,
+	QuickFilterCheckboxUseFieldApis,
+	QuickFiltersSource,
+} from '../../../types';
+import CheckboxFilterV2 from './CheckboxFilterV2';
+
+export const DEFAULT_FILTER: IQuickFiltersConfig = {
+	type: FiltersType.CHECKBOX,
+	title: 'Environment',
+	attributeKey: {
+		key: 'deployment.environment',
+		dataType: DataTypes.String,
+		type: 'tag',
+	},
+	dataSource: DataSource.TRACES,
+	defaultOpen: true,
+};
+
+export const DEFAULT_USE_FIELD_APIS: QuickFilterCheckboxUseFieldApis = {
+	startUnixMilli: 1700000000000,
+	endUnixMilli: 1700003600000,
+	existingQuery: null,
+};
+
+export function mockFieldsValuesAPI(response: {
+	relatedValues?: (string | null)[];
+	stringValues?: (string | null)[];
+	numberValues?: (number | null)[];
+}): void {
+	server.use(
+		rest.get('http://localhost/api/v1/fields/values', (_, res, ctx) =>
+			res(
+				ctx.status(200),
+				ctx.json({
+					status: 'success',
+					data: {
+						values: {
+							relatedValues: response.relatedValues ?? [],
+							stringValues: response.stringValues ?? [],
+							numberValues: response.numberValues ?? [],
+						},
+					},
+				}),
+			),
+		),
+	);
+}
+
+export function mockFieldsValuesAPILoading(): void {
+	server.use(
+		rest.get('http://localhost/api/v1/fields/values', (_, res, ctx) =>
+			res(ctx.delay(10000)),
+		),
+	);
+}
+
+export function setupServer(): void {
+	beforeAll(() => server.listen({ onUnhandledRequest: 'bypass' }));
+	afterEach(() => server.resetHandlers());
+	afterAll(() => server.close());
+}
+
+export interface FilterItemConfig {
+	op: string;
+	value: string | string[];
+}
+
+export function renderWithFilter(
+	onFilterChange: jest.Mock,
+	filterItem?: FilterItemConfig,
+): RenderResult {
+	const items: TagFilterItem[] = filterItem
+		? [
+				{
+					key: { key: 'deployment.environment' },
+					op: filterItem.op,
+					value: filterItem.value,
+				} as TagFilterItem,
+			]
+		: [];
+
+	return render(
+		<CheckboxFilterV2
+			filter={DEFAULT_FILTER}
+			source={QuickFiltersSource.TRACES_EXPLORER}
+			useFieldApis={{
+				...DEFAULT_USE_FIELD_APIS,
+				existingQuery: 'service.name = "api"',
+			}}
+			onFilterChange={onFilterChange}
+		/>,
+		undefined,
+		{
+			queryBuilderOverrides: {
+				currentQuery: {
+					builder: {
+						queryData: [
+							{
+								filters: { items, op: 'AND' },
+								filter: { expression: 'service.name = "api"' },
+							},
+						],
+					},
+				},
+			} as never,
+		},
+	);
+}
+
+export function getFilterFromCall(
+	onFilterChange: jest.Mock,
+	callIndex = 0,
+): TagFilterItem | undefined {
+	const query = onFilterChange.mock.calls[callIndex]?.[0] as Query | undefined;
+	return query?.builder.queryData[0]?.filters?.items?.find(
+		(item) => item.key?.key === 'deployment.environment',
+	);
+}

frontend/src/components/QuickFilters/FilterRenderers/Checkbox/v2/CheckboxFilterV2.tsx

@@ -0,0 +1,241 @@
+import { useEffect, useMemo, useRef, useState } from 'react';
+import { Input } from '@signozhq/ui/input';
+import { Skeleton } from 'antd';
+import { Typography } from '@signozhq/ui/typography';
+import { LoaderCircle } from '@signozhq/icons';
+import {
+	IQuickFiltersConfig,
+	QuickFilterCheckboxUseFieldApis,
+	QuickFiltersSource,
+} from 'components/QuickFilters/types';
+import { DEBOUNCE_DELAY } from 'constants/queryBuilderFilterConfig';
+import { useQueryBuilder } from 'hooks/queryBuilder/useQueryBuilder';
+import useDebouncedFn from 'hooks/useDebouncedFunction';
+import { Query } from 'types/api/queryBuilder/queryBuilderData';
+
+import { NON_SELECTED_OPERATORS } from '../checkboxFilterQuery';
+import useActiveQueryIndex from '../useActiveQueryIndex';
+import useCheckboxDisclosure from '../useCheckboxDisclosure';
+import useCheckboxFilterActions from '../useCheckboxFilterActions';
+import useCheckboxFilterState from '../useCheckboxFilterState';
+import { useFieldValues } from './useFieldValues';
+import { useExistingQuery } from './useExistingQuery';
+import { isKeyMatch } from '../utils';
+
+import { CheckboxFilterV2Header } from './CheckboxFilterV2Header';
+import { CheckboxFilterV2Section } from './CheckboxFilterV2Section';
+import { buildSelectedSet, useSectionedValues } from './useSectionedValues';
+import { useStaleRelatedExclusions } from './useStaleRelatedExclusions';
+
+import styles from './CheckboxFilterV2.module.scss';
+
+interface CheckboxFilterV2Props {
+	filter: IQuickFiltersConfig;
+	source: QuickFiltersSource;
+	onFilterChange?: (query: Query) => void;
+	useFieldApis: QuickFilterCheckboxUseFieldApis;
+}
+
+export default function CheckboxFilterV2(
+	props: CheckboxFilterV2Props,
+): JSX.Element {
+	const { source, filter, onFilterChange, useFieldApis } = props;
+	const [searchText, setSearchText] = useState<string>('');
+	const [userToggleState, setUserToggleState] = useState<boolean | null>(null);
+
+	const { currentQuery } = useQueryBuilder();
+	const activeQueryIndex = useActiveQueryIndex(source);
+
+	const {
+		isOpen,
+		isSomeFilterPresentForCurrentAttribute,
+		visibleItemsCount,
+		onToggleOpen,
+		onShowMore,
+	} = useCheckboxDisclosure({ filter, activeQueryIndex });
+
+	// Auto-preserve open state when filter is present
+	useEffect(() => {
+		if (isSomeFilterPresentForCurrentAttribute && userToggleState === null) {
+			setUserToggleState(true);
+		}
+	}, [isSomeFilterPresentForCurrentAttribute, userToggleState]);
+
+	const { existingQuery, hasExistingQuery } = useExistingQuery({
+		useFieldApis,
+		activeQueryIndex,
+	});
+
+	const { relatedValues, allValues, isLoading, isFetching } = useFieldValues({
+		filter,
+		searchText,
+		existingQuery,
+		metricNamespace: useFieldApis.metricNamespace,
+		startUnixMilli: useFieldApis.startUnixMilli,
+		endUnixMilli: useFieldApis.endUnixMilli,
+		enabled: isOpen,
+	});
+
+	// Track if initial load completed (don't show skeleton after first load)
+	// Must track if loading ever started, otherwise hasLoadedOnce gets set
+	// immediately on first render when query is disabled (isLoading=false)
+	const hasLoadedOnce = useRef(false);
+	const wasLoading = useRef(false);
+	if (isLoading) {
+		wasLoading.current = true;
+	}
+	if (!isLoading && wasLoading.current && !hasLoadedOnce.current) {
+		hasLoadedOnce.current = true;
+	}
+
+	// Combine for state derivation
+	const attributeValues = useMemo(() => {
+		const combined = [...relatedValues, ...allValues];
+		return [...new Set(combined)];
+	}, [relatedValues, allValues]);
+
+	const { currentFilterState, isFilterDisabled, isMultipleValuesTrueForTheKey } =
+		useCheckboxFilterState({ filter, attributeValues, activeQueryIndex });
+
+	const { onChange, onClear } = useCheckboxFilterActions({
+		filter,
+		source,
+		attributeValues,
+		activeQueryIndex,
+		onFilterChange,
+	});
+
+	const setSearchTextDebounced = useDebouncedFn((...args) => {
+		setSearchText(args[0] as string);
+	}, DEBOUNCE_DELAY);
+
+	const currentFilterOp = useMemo(() => {
+		const filterSync = currentQuery?.builder.queryData?.[
+			activeQueryIndex
+		]?.filters?.items.find((item) =>
+			isKeyMatch(item.key?.key, filter.attributeKey.key),
+		);
+		return filterSync?.op;
+	}, [
+		currentQuery?.builder.queryData,
+		activeQueryIndex,
+		filter.attributeKey.key,
+	]);
+
+	const isNotInOperator = NON_SELECTED_OPERATORS.includes(currentFilterOp || '');
+
+	const selectedValues = useMemo(
+		() => [
+			...buildSelectedSet(
+				currentFilterState,
+				isSomeFilterPresentForCurrentAttribute,
+				isNotInOperator,
+			),
+		],
+		[currentFilterState, isSomeFilterPresentForCurrentAttribute, isNotInOperator],
+	);
+
+	const isRefreshing = isFetching && !isLoading && searchText === '';
+	const relatedExclusions = useStaleRelatedExclusions({
+		selectedValues,
+		isFetching,
+		isRefreshing,
+	});
+
+	const { sections, totalCount } = useSectionedValues({
+		relatedValues,
+		allValues,
+		currentFilterState,
+		isSomeFilterPresentForCurrentAttribute,
+		isNotInOperator,
+		hasExistingQuery,
+		visibleItemsCount,
+		relatedExclusions,
+	});
+
+	return (
+		<div className={styles.checkboxFilter} data-testid="checkbox-filter-v2">
+			<CheckboxFilterV2Header
+				title={filter.title}
+				isOpen={isOpen}
+				showClearAll={!!attributeValues.length}
+				onToggleOpen={onToggleOpen}
+				onClear={onClear}
+				isSomeFilterPresentForCurrentAttribute={
+					isSomeFilterPresentForCurrentAttribute
+				}
+			/>
+			{isOpen && isLoading && !hasLoadedOnce.current && (
+				<section>
+					<Skeleton paragraph={{ rows: 4 }} />
+				</section>
+			)}
+			{isOpen && (!isLoading || hasLoadedOnce.current) && (
+				<>
+					<section className={styles.search}>
+						<Input
+							placeholder="Filter values"
+							onChange={(e): void => setSearchTextDebounced(e.target.value)}
+							disabled={isFilterDisabled}
+							data-testid="checkbox-filter-search"
+							suffix={
+								isFetching ? (
+									<LoaderCircle
+										size={14}
+										className={styles.searchSpinner}
+										data-testid="checkbox-filter-search-loading"
+									/>
+								) : null
+							}
+						/>
+					</section>
+
+					{totalCount > 0 && (
+						<section className={styles.values}>
+							{sections.map((section, index) => (
+								<CheckboxFilterV2Section
+									key={section.type}
+									section={section}
+									index={index}
+									isFilterDisabled={isFilterDisabled}
+									filter={filter}
+									isSomeFilterPresentForCurrentAttribute={
+										isSomeFilterPresentForCurrentAttribute
+									}
+									isMultipleValuesTrueForTheKey={isMultipleValuesTrueForTheKey}
+									onChange={onChange}
+								/>
+							))}
+						</section>
+					)}
+
+					{totalCount === 0 && hasLoadedOnce.current && !isFetching && (
+						<section
+							className={styles.noData}
+							data-testid={
+								searchText
+									? 'checkbox-filter-no-search-results'
+									: 'checkbox-filter-empty'
+							}
+						>
+							<Typography.Text>No values found</Typography.Text>
+						</section>
+					)}
+
+					{visibleItemsCount < totalCount &&
+						!(searchText && (isLoading || isFetching)) && (
+							<section className={styles.showMore}>
+								<Typography.Text
+									className={styles.showMoreText}
+									onClick={onShowMore}
+									data-testid="checkbox-filter-show-more"
+								>
+									Show More...
+								</Typography.Text>
+							</section>
+						)}
+				</>
+			)}
+		</div>
+	);
+}

frontend/src/components/QuickFilters/FilterRenderers/Checkbox/v2/CheckboxFilterV2Header.module.scss

@@ -0,0 +1,33 @@
+.header {
+	display: flex;
+	align-items: center;
+	justify-content: space-between;
+	cursor: pointer;
+}
+
+.leftAction {
+	display: flex;
+	align-items: center;
+	gap: var(--spacing-3);
+}
+
+.title {
+	color: var(--l2-foreground);
+	font-size: 14px;
+	font-weight: 400;
+	line-height: 18px;
+	letter-spacing: -0.07px;
+	text-transform: capitalize;
+}
+
+.rightAction {
+	display: flex;
+	align-items: center;
+	min-width: 48px;
+}
+
+.clearAll {
+	font-size: 12px;
+	color: var(--accent-primary);
+	cursor: pointer;
+}

frontend/src/components/QuickFilters/FilterRenderers/Checkbox/v2/CheckboxFilterV2Header.tsx

@@ -0,0 +1,62 @@
+import { Typography } from '@signozhq/ui/typography';
+import { ChevronDown, ChevronRight } from '@signozhq/icons';
+
+import styles from './CheckboxFilterV2Header.module.scss';
+
+interface CheckboxFilterHeaderProps {
+	title: string;
+	isOpen: boolean;
+	showClearAll: boolean;
+	onToggleOpen: () => void;
+	onClear: () => void;
+	isSomeFilterPresentForCurrentAttribute: boolean;
+}
+
+export function CheckboxFilterV2Header({
+	title,
+	isOpen,
+	showClearAll,
+	onToggleOpen,
+	onClear,
+	isSomeFilterPresentForCurrentAttribute,
+}: CheckboxFilterHeaderProps): JSX.Element {
+	return (
+		<section
+			role="button"
+			tabIndex={0}
+			className={styles.header}
+			onClick={onToggleOpen}
+			onKeyDown={(e): void => {
+				if (e.key === 'Enter' || e.key === ' ') {
+					onToggleOpen();
+				}
+			}}
+			data-testid="checkbox-filter-header"
+			data-state={isOpen ? 'open' : 'closed'}
+		>
+			<section className={styles.leftAction}>
+				{isOpen ? (
+					<ChevronDown size={13} cursor="pointer" />
+				) : (
+					<ChevronRight size={13} cursor="pointer" />
+				)}
+				<Typography.Text className={styles.title}>{title}</Typography.Text>
+			</section>
+			<section className={styles.rightAction}>
+				{isOpen && showClearAll && isSomeFilterPresentForCurrentAttribute && (
+					<Typography.Text
+						className={styles.clearAll}
+						onClick={(e): void => {
+							e.stopPropagation();
+							e.preventDefault();
+							onClear();
+						}}
+						data-testid="checkbox-filter-clear-all"
+					>
+						Clear
+					</Typography.Text>
+				)}
+			</section>
+		</section>
+	);
+}

frontend/src/components/QuickFilters/FilterRenderers/Checkbox/v2/CheckboxFilterV2Section.tsx

@@ -0,0 +1,106 @@
+import {
+	IQuickFiltersConfig,
+	CheckedState,
+} from 'components/QuickFilters/types';
+
+import { CheckboxFilterV2ValueRow } from './CheckboxFilterV2ValueRow';
+import { SectionDivider } from './SectionDivider';
+import { Section } from './useSectionedValues';
+import { SectionType } from './itemRules';
+
+import styles from './CheckboxFilterV2.module.scss';
+
+interface SectionConfig {
+	label: string;
+	tooltip?: string;
+}
+
+function getSectionConfig(type: SectionType): SectionConfig | null {
+	switch (type) {
+		case SectionType.SELECTED:
+			return { label: 'Selected' };
+		case SectionType.RELATED:
+			return {
+				label: 'Related',
+				tooltip: 'Values that are filtered by your current selection.',
+			};
+		case SectionType.ALL_VALUES:
+			return { label: 'All values' };
+		default:
+			return null;
+	}
+}
+
+interface CheckboxFilterV2SectionProps {
+	section: Section;
+	index: number;
+	isFilterDisabled: boolean;
+	filter: IQuickFiltersConfig;
+	isSomeFilterPresentForCurrentAttribute: boolean;
+	isMultipleValuesTrueForTheKey: boolean;
+	onChange: (
+		value: string,
+		checked: boolean,
+		isOnly: boolean,
+		previousState?: CheckedState,
+		sectionType?: SectionType,
+	) => void;
+}
+
+export function CheckboxFilterV2Section(
+	props: CheckboxFilterV2SectionProps,
+): JSX.Element | null {
+	const {
+		section,
+		index,
+		isFilterDisabled,
+		filter,
+		isSomeFilterPresentForCurrentAttribute,
+		isMultipleValuesTrueForTheKey,
+		onChange,
+	} = props;
+
+	if (section.items.length === 0) {
+		return null;
+	}
+
+	const config = getSectionConfig(section.type);
+
+	// Show divider for all sections except first SELECTED section
+	const showDivider =
+		config !== null && (index > 0 || section.type !== SectionType.SELECTED);
+
+	return (
+		<div data-testid={`section-${section.type}`} className={styles.sectionValues}>
+			{showDivider && config && (
+				<SectionDivider label={config.label} tooltip={config.tooltip} />
+			)}
+			{section.items.map(({ value, badge, checkedState }) => {
+				const isChecked = checkedState === 'checked';
+
+				return (
+					<CheckboxFilterV2ValueRow
+						key={value}
+						value={value}
+						checkedState={checkedState}
+						disabled={isFilterDisabled}
+						title={filter.title}
+						badge={badge}
+						onlyButtonLabel={
+							isSomeFilterPresentForCurrentAttribute
+								? isChecked && !isMultipleValuesTrueForTheKey
+									? 'All'
+									: 'Only'
+								: 'Only'
+						}
+						customRendererForValue={filter.customRendererForValue}
+						onCheckboxChange={(checked, previousState): void =>
+							onChange(value, checked, false, previousState, section.type)
+						}
+						onOnlyOrAllClick={(): void => onChange(value, isChecked, true)}
+					/>
+				);
+			})}
+		</div>
+	);
+}

frontend/src/components/QuickFilters/FilterRenderers/Checkbox/v2/CheckboxFilterV2ValueRow.module.scss

@@ -0,0 +1,164 @@
+.valueRow {
+	display: flex;
+	align-items: center;
+	gap: var(--spacing-4);
+	min-height: 24px;
+}
+
+.checkbox {
+	display: inline-flex;
+	align-items: center;
+}
+
+.valueButton {
+	display: grid;
+	grid-template-columns: minmax(0, 1fr) auto;
+	align-items: center;
+	gap: var(--spacing-2);
+	width: calc(100% - 24px);
+	cursor: pointer;
+}
+
+.content {
+	display: flex;
+	align-items: center;
+	gap: var(--spacing-2);
+	min-width: 0;
+}
+
+.valueLabel {
+	text-overflow: ellipsis;
+	white-space: nowrap;
+	overflow: hidden;
+}
+
+.actions {
+	display: grid;
+	align-items: center;
+	justify-items: end;
+
+	// Stack badge / only / toggle in a single cell so the crossfade overlaps
+	// instead of laying them side-by-side mid-transition.
+	> * {
+		grid-area: 1 / 1;
+	}
+}
+
+.badge {
+	opacity: 1;
+	transition:
+		opacity 0.16s ease,
+		display 0.16s allow-discrete;
+}
+
+.onlyButton {
+	display: none;
+	align-items: center;
+	justify-content: center;
+	opacity: 0;
+	transform: translateX(4px);
+	transition:
+		opacity 0.16s ease,
+		transform 0.16s ease,
+		display 0.16s allow-discrete;
+	--button-height: 21px;
+	--button-padding: var(--spacing-5);
+
+	&:hover {
+		background-color: unset;
+	}
+}
+
+.toggleButton {
+	display: none;
+	align-items: center;
+	justify-content: center;
+	opacity: 0;
+	transform: translateX(4px);
+	transition:
+		opacity 0.16s ease,
+		transform 0.16s ease,
+		display 0.16s allow-discrete;
+	--button-height: 21px;
+	--button-padding: var(--spacing-5);
+
+	&:hover {
+		background-color: unset;
+	}
+}
+
+.isDisabled {
+	cursor: not-allowed;
+
+	.valueLabel {
+		color: var(--l3-foreground);
+	}
+
+	.onlyButton {
+		cursor: not-allowed;
+		color: var(--l3-foreground);
+	}
+
+	.toggleButton {
+		cursor: not-allowed;
+		color: var(--l3-foreground);
+	}
+}
+
+.valueButton:hover {
+	.onlyButton {
+		display: flex;
+		opacity: 1;
+		transform: translateX(0);
+
+		@starting-style {
+			opacity: 0;
+			transform: translateX(4px);
+		}
+	}
+
+	.badge {
+		display: none;
+		opacity: 0;
+	}
+}
+
+.checkbox:hover ~ .valueButton {
+	.toggleButton {
+		display: flex;
+		opacity: 1;
+		transform: translateX(0);
+
+		@starting-style {
+			opacity: 0;
+			transform: translateX(4px);
+		}
+	}
+
+	.badge {
+		display: none;
+		opacity: 0;
+	}
+}
+
+@media (prefers-reduced-motion: reduce) {
+	.badge,
+	.onlyButton,
+	.toggleButton {
+		transition: none;
+	}
+}
+
+.indicatorFalse {
+	width: 2px;
+	height: 11px;
+	border-radius: 2px;
+	background: var(--danger-background);
+}
+
+.indicatorTrue {
+	width: 2px;
+	height: 11px;
+	border-radius: 2px;
+	background: var(--bg-forest-500);
+}

frontend/src/components/QuickFilters/FilterRenderers/Checkbox/v2/CheckboxFilterV2ValueRow.tsx

@@ -0,0 +1,118 @@
+import { Badge } from '@signozhq/ui/badge';
+import { Button } from '@signozhq/ui/button';
+import { Checkbox } from '@signozhq/ui/checkbox';
+import { Typography } from '@signozhq/ui/typography';
+import cx from 'classnames';
+
+import { BadgeConfig } from './itemRules';
+import { CheckedState } from '../../../types';
+import styles from './CheckboxFilterV2ValueRow.module.scss';
+
+interface ValueRowProps {
+	value: string;
+	checkedState: CheckedState;
+	disabled: boolean;
+	title: string;
+	onlyButtonLabel: string;
+	customRendererForValue?: (value: string) => JSX.Element;
+	onCheckboxChange: (checked: boolean, previousState: CheckedState) => void;
+	onOnlyOrAllClick: () => void;
+	badge: BadgeConfig | null;
+}
+
+function toCheckboxValue(state: CheckedState): boolean | 'indeterminate' {
+	if (state === 'indeterminate') {
+		return 'indeterminate';
+	}
+	return state === 'checked';
+}
+
+const INDICATOR_CLASS_MAP = {
+	false: styles.indicatorFalse,
+	true: styles.indicatorTrue,
+} as Record<string, string>;
+
+export function CheckboxFilterV2ValueRow({
+	value,
+	checkedState,
+	disabled,
+	title,
+	onlyButtonLabel,
+	customRendererForValue,
+	onCheckboxChange,
+	onOnlyOrAllClick,
+	badge,
+}: ValueRowProps): JSX.Element {
+	const indicatorClass = INDICATOR_CLASS_MAP[value];
+
+	return (
+		<div
+			className={styles.valueRow}
+			data-testid={`checkbox-value-row-${value}`}
+			data-state={checkedState}
+			data-disabled={disabled}
+		>
+			<div className={styles.checkbox}>
+				<Checkbox
+					onChange={(isChecked): void =>
+						onCheckboxChange(isChecked === true, checkedState)
+					}
+					value={toCheckboxValue(checkedState)}
+					disabled={disabled}
+					color="primary"
+					testId={`checkbox-${title}-${value}`}
+				/>
+			</div>
+
+			<div
+				role="button"
+				tabIndex={disabled ? -1 : 0}
+				className={cx(styles.valueButton, disabled && styles.isDisabled)}
+				onClick={(): void => {
+					if (disabled) {
+						return;
+					}
+					onOnlyOrAllClick();
+				}}
+				onKeyDown={(e): void => {
+					if (disabled) {
+						return;
+					}
+					if (e.key === 'Enter' || e.key === ' ') {
+						onOnlyOrAllClick();
+					}
+				}}
+			>
+				<div className={styles.content}>
+					{indicatorClass && <div className={indicatorClass} />}
+					{customRendererForValue ? (
+						customRendererForValue(value)
+					) : (
+						<Typography.Text title={value} className={styles.valueLabel}>
+							{value}
+						</Typography.Text>
+					)}
+				</div>
+
+				<div className={styles.actions}>
+					{badge && (
+						<Badge
+							variant="outline"
+							color={badge.color}
+							className={styles.badge}
+							testId={`badge-${badge.key}`}
+						>
+							{badge.label}
+						</Badge>
+					)}
+					<Button variant="ghost" color="secondary" className={styles.onlyButton}>
+						{onlyButtonLabel}
+					</Button>
+					<Button variant="ghost" color="secondary" className={styles.toggleButton}>
+						Toggle
+					</Button>
+				</div>
+			</div>
+		</div>
+	);
+}

frontend/src/components/QuickFilters/FilterRenderers/Checkbox/v2/SectionDivider.module.scss

@@ -0,0 +1,29 @@
+.divider {
+	display: flex;
+	align-items: center;
+	gap: var(--spacing-4);
+	padding: var(--spacing-2) 0;
+
+	margin-bottom: calc(-1 * var(--spacing-4));
+}
+
+.line {
+	flex: 1;
+	height: 1px;
+	background: var(--l1-border);
+}
+
+.label {
+	font-size: var(--periscope-font-size-small);
+	font-weight: var(--font-weight-semibold);
+	text-transform: uppercase;
+	letter-spacing: 0.5px;
+	color: var(--l3-foreground);
+	white-space: nowrap;
+}
+
+.infoIcon {
+	color: var(--l3-foreground);
+	cursor: help;
+	flex-shrink: 0;
+}

frontend/src/components/QuickFilters/FilterRenderers/Checkbox/v2/SectionDivider.tsx

@@ -0,0 +1,33 @@
+import { Tooltip } from 'antd';
+import { Typography } from '@signozhq/ui/typography';
+import { Info } from '@signozhq/icons';
+
+import styles from './SectionDivider.module.scss';
+
+interface SectionDividerProps {
+	label: string;
+	tooltip?: string;
+}
+
+export function SectionDivider({
+	label,
+	tooltip,
+}: SectionDividerProps): JSX.Element {
+	const testId = label.toLowerCase().replace(/\s+/g, '-');
+	return (
+		<div className={styles.divider} data-testid={`section-divider-${testId}`}>
+			<div className={styles.line} />
+			<Typography.Text className={styles.label}>{label}</Typography.Text>
+			{tooltip && (
+				<Tooltip title={tooltip}>
+					<Info
+						size={12}
+						className={styles.infoIcon}
+						data-testid="section-divider-info"
+					/>
+				</Tooltip>
+			)}
+			<div className={styles.line} />
+		</div>
+	);
+}

frontend/src/components/QuickFilters/FilterRenderers/Checkbox/v2/__tests__/CheckboxFilterV2.existingQuery.test.tsx

@@ -0,0 +1,302 @@
+import { screen } from '@testing-library/react';
+import { server, rest } from 'mocks-server/server';
+import { render } from 'tests/test-utils';
+
+import { QuickFiltersSource } from '../../../../types';
+
+import CheckboxFilterV2 from '../CheckboxFilterV2';
+import {
+	DEFAULT_FILTER,
+	DEFAULT_USE_FIELD_APIS,
+	setupServer,
+} from '../CheckboxFilterV2.testUtils';
+
+const USE_FIELD_APIS_AUTO_DERIVE = {
+	...DEFAULT_USE_FIELD_APIS,
+	existingQuery: undefined,
+};
+
+setupServer();
+
+describe('CheckboxFilterV2 - existingQuery calculation', () => {
+	const captureExistingQuery = (): Promise<string | null> =>
+		new Promise((resolve) => {
+			server.use(
+				rest.get('http://localhost/api/v1/fields/values', (req, res, ctx) => {
+					const existingQuery = req.url.searchParams.get('existingQuery');
+					resolve(existingQuery);
+					return res(
+						ctx.status(200),
+						ctx.json({
+							status: 'success',
+							data: {
+								values: {
+									relatedValues: [],
+									stringValues: ['test'],
+									numberValues: [],
+								},
+							},
+						}),
+					);
+				}),
+			);
+		});
+
+	describe('useFieldApis.existingQuery takes precedence', () => {
+		it('uses useFieldApis.existingQuery when provided', async () => {
+			const queryPromise = captureExistingQuery();
+
+			render(
+				<CheckboxFilterV2
+					filter={DEFAULT_FILTER}
+					source={QuickFiltersSource.TRACES_EXPLORER}
+					useFieldApis={{
+						...DEFAULT_USE_FIELD_APIS,
+						existingQuery: 'custom.query = "value"',
+					}}
+				/>,
+				undefined,
+				{
+					queryBuilderOverrides: {
+						currentQuery: {
+							builder: {
+								queryData: [
+									{
+										filters: { items: [], op: 'AND' },
+										filter: { expression: 'should.be.ignored = "yes"' },
+									},
+								],
+							},
+						},
+					} as never,
+				},
+			);
+
+			await screen.findByTestId('checkbox-value-row-test');
+			const capturedQuery = await queryPromise;
+			expect(capturedQuery).toBe('custom.query = "value"');
+		});
+
+		it('returns undefined when useFieldApis.existingQuery is null', async () => {
+			const queryPromise = captureExistingQuery();
+
+			render(
+				<CheckboxFilterV2
+					filter={DEFAULT_FILTER}
+					source={QuickFiltersSource.TRACES_EXPLORER}
+					useFieldApis={{
+						...DEFAULT_USE_FIELD_APIS,
+						existingQuery: null,
+					}}
+				/>,
+				undefined,
+				{
+					queryBuilderOverrides: {
+						currentQuery: {
+							builder: {
+								queryData: [
+									{
+										filters: { items: [], op: 'AND' },
+										filter: { expression: 'should.be.ignored = "yes"' },
+									},
+								],
+							},
+						},
+					} as never,
+				},
+			);
+
+			await screen.findByTestId('checkbox-value-row-test');
+			const capturedQuery = await queryPromise;
+			expect(capturedQuery).toBeNull();
+		});
+	});
+
+	describe('V5 filter.expression preferred over V3 filters.items', () => {
+		it('uses V5 filter.expression when both exist', async () => {
+			const queryPromise = captureExistingQuery();
+
+			render(
+				<CheckboxFilterV2
+					filter={DEFAULT_FILTER}
+					source={QuickFiltersSource.TRACES_EXPLORER}
+					useFieldApis={USE_FIELD_APIS_AUTO_DERIVE}
+				/>,
+				undefined,
+				{
+					queryBuilderOverrides: {
+						currentQuery: {
+							builder: {
+								queryData: [
+									{
+										filters: {
+											items: [
+												{
+													key: { key: 'service.name', dataType: 'string', type: 'tag' },
+													op: '=',
+													value: 'from-v3-items',
+												},
+											],
+											op: 'AND',
+										},
+										filter: { expression: 'v5.expression = "preferred"' },
+									},
+								],
+							},
+						},
+					} as never,
+				},
+			);
+
+			await screen.findByTestId('checkbox-value-row-test');
+			const capturedQuery = await queryPromise;
+			expect(capturedQuery).toBe('v5.expression = "preferred"');
+		});
+
+		it('uses V5 filter.expression when no V3 items exist', async () => {
+			const queryPromise = captureExistingQuery();
+
+			render(
+				<CheckboxFilterV2
+					filter={DEFAULT_FILTER}
+					source={QuickFiltersSource.TRACES_EXPLORER}
+					useFieldApis={USE_FIELD_APIS_AUTO_DERIVE}
+				/>,
+				undefined,
+				{
+					queryBuilderOverrides: {
+						currentQuery: {
+							builder: {
+								queryData: [
+									{
+										filters: { items: [], op: 'AND' },
+										filter: { expression: 'only.v5 = "expression"' },
+									},
+								],
+							},
+						},
+					} as never,
+				},
+			);
+
+			await screen.findByTestId('checkbox-value-row-test');
+			const capturedQuery = await queryPromise;
+			expect(capturedQuery).toBe('only.v5 = "expression"');
+		});
+	});
+
+	describe('V3 filters.items fallback', () => {
+		it('converts V3 filters.items to expression when no V5 expression exists', async () => {
+			const queryPromise = captureExistingQuery();
+
+			render(
+				<CheckboxFilterV2
+					filter={DEFAULT_FILTER}
+					source={QuickFiltersSource.TRACES_EXPLORER}
+					useFieldApis={USE_FIELD_APIS_AUTO_DERIVE}
+				/>,
+				undefined,
+				{
+					queryBuilderOverrides: {
+						currentQuery: {
+							builder: {
+								queryData: [
+									{
+										filters: {
+											items: [
+												{
+													key: { key: 'service.name', dataType: 'string', type: 'tag' },
+													op: '=',
+													value: 'api-service',
+												},
+											],
+											op: 'AND',
+										},
+									},
+								],
+							},
+						},
+					} as never,
+				},
+			);
+
+			await screen.findByTestId('checkbox-value-row-test');
+			const capturedQuery = await queryPromise;
+			expect(capturedQuery).toBe("service.name = 'api-service'");
+		});
+
+		it('converts multiple V3 filters.items with AND operator', async () => {
+			const queryPromise = captureExistingQuery();
+
+			render(
+				<CheckboxFilterV2
+					filter={DEFAULT_FILTER}
+					source={QuickFiltersSource.TRACES_EXPLORER}
+					useFieldApis={USE_FIELD_APIS_AUTO_DERIVE}
+				/>,
+				undefined,
+				{
+					queryBuilderOverrides: {
+						currentQuery: {
+							builder: {
+								queryData: [
+									{
+										filters: {
+											items: [
+												{
+													key: { key: 'service.name', dataType: 'string', type: 'tag' },
+													op: '=',
+													value: 'api',
+												},
+												{
+													key: { key: 'env', dataType: 'string', type: 'tag' },
+													op: '=',
+													value: 'prod',
+												},
+											],
+											op: 'AND',
+										},
+									},
+								],
+							},
+						},
+					} as never,
+				},
+			);
+
+			await screen.findByTestId('checkbox-value-row-test');
+			const capturedQuery = await queryPromise;
+			expect(capturedQuery).toBe("service.name = 'api' AND env = 'prod'");
+		});
+
+		it('returns undefined when no filters exist', async () => {
+			const queryPromise = captureExistingQuery();
+
+			render(
+				<CheckboxFilterV2
+					filter={DEFAULT_FILTER}
+					source={QuickFiltersSource.TRACES_EXPLORER}
+					useFieldApis={USE_FIELD_APIS_AUTO_DERIVE}
+				/>,
+				undefined,
+				{
+					queryBuilderOverrides: {
+						currentQuery: {
+							builder: {
+								queryData: [
+									{
+										filters: { items: [], op: 'AND' },
+									},
+								],
+							},
+						},
+					} as never,
+				},
+			);
+
+			await screen.findByTestId('checkbox-value-row-test');
+			const capturedQuery = await queryPromise;
+			expect(capturedQuery).toBeNull();
+		});
+	});
+});

frontend/src/components/QuickFilters/FilterRenderers/Checkbox/v2/__tests__/CheckboxFilterV2.interactions.test.tsx

@@ -0,0 +1,768 @@
+import { screen, waitFor, within } from '@testing-library/react';
+import userEvent from '@testing-library/user-event';
+import { server, rest } from 'mocks-server/server';
+import { render } from 'tests/test-utils';
+
+import { QuickFiltersSource } from '../../../../types';
+
+import CheckboxFilterV2 from '../CheckboxFilterV2';
+import {
+	DEFAULT_FILTER,
+	DEFAULT_USE_FIELD_APIS,
+	getFilterFromCall,
+	mockFieldsValuesAPI,
+	renderWithFilter,
+	setupServer,
+} from '../CheckboxFilterV2.testUtils';
+
+setupServer();
+
+describe('CheckboxFilterV2 - interactions', () => {
+	describe('search functionality', () => {
+		it('filters values based on search text', async () => {
+			const user = userEvent.setup();
+
+			let searchTextReceived = '';
+			server.use(
+				rest.get('http://localhost/api/v1/fields/values', (req, res, ctx) => {
+					searchTextReceived = req.url.searchParams.get('searchText') || '';
+
+					const values =
+						searchTextReceived === ''
+							? ['production', 'staging', 'development']
+							: ['production'];
+
+					return res(
+						ctx.status(200),
+						ctx.json({
+							status: 'success',
+							data: {
+								values: {
+									relatedValues: [],
+									stringValues: values,
+									numberValues: [],
+								},
+							},
+						}),
+					);
+				}),
+			);
+
+			render(
+				<CheckboxFilterV2
+					filter={DEFAULT_FILTER}
+					source={QuickFiltersSource.TRACES_EXPLORER}
+					useFieldApis={DEFAULT_USE_FIELD_APIS}
+				/>,
+			);
+
+			await screen.findByTestId('checkbox-value-row-production');
+			expect(screen.getByTestId('checkbox-value-row-staging')).toBeInTheDocument();
+
+			const searchInput = screen.getByTestId('checkbox-filter-search');
+			await user.type(searchInput, 'prod');
+
+			await waitFor(() => {
+				expect(searchTextReceived).toBe('prod');
+			});
+
+			await waitFor(() => {
+				expect(
+					screen.queryByTestId('checkbox-value-row-staging'),
+				).not.toBeInTheDocument();
+			});
+		});
+
+		it('filters values via search while preserving existingQuery context', async () => {
+			const user = userEvent.setup();
+
+			let requestCount = 0;
+			server.use(
+				rest.get('http://localhost/api/v1/fields/values', (req, res, ctx) => {
+					requestCount += 1;
+					const searchText = req.url.searchParams.get('searchText') || '';
+
+					if (requestCount === 1) {
+						return res(
+							ctx.status(200),
+							ctx.json({
+								status: 'success',
+								data: {
+									values: {
+										relatedValues: ['production'],
+										stringValues: ['staging', 'development'],
+										numberValues: [],
+									},
+								},
+							}),
+						);
+					}
+
+					return res(
+						ctx.status(200),
+						ctx.json({
+							status: 'success',
+							data: {
+								values: {
+									relatedValues: searchText === 'prod' ? ['production'] : [],
+									stringValues: searchText === 'prod' ? ['production'] : ['staging'],
+									numberValues: [],
+								},
+							},
+						}),
+					);
+				}),
+			);
+
+			render(
+				<CheckboxFilterV2
+					filter={DEFAULT_FILTER}
+					source={QuickFiltersSource.TRACES_EXPLORER}
+					useFieldApis={{
+						...DEFAULT_USE_FIELD_APIS,
+						existingQuery: 'service.name = "api"',
+					}}
+				/>,
+				undefined,
+				{
+					queryBuilderOverrides: {
+						currentQuery: {
+							builder: {
+								queryData: [
+									{
+										filters: { items: [], op: 'AND' },
+										filter: { expression: 'service.name = "api"' },
+									},
+								],
+							},
+						},
+					} as never,
+				},
+			);
+
+			await screen.findByTestId('checkbox-value-row-production');
+			// Related values now appear in "Related" section (no badge, uses divider instead)
+			expect(screen.getByTestId('section-divider-related')).toBeInTheDocument();
+
+			const searchInput = screen.getByTestId('checkbox-filter-search');
+			await user.type(searchInput, 'prod');
+
+			await waitFor(() => {
+				expect(
+					screen.queryByTestId('checkbox-value-row-staging'),
+				).not.toBeInTheDocument();
+				expect(
+					screen.getByTestId('checkbox-value-row-production'),
+				).toBeInTheDocument();
+			});
+		});
+
+		it('shows filtered results in all_values section when searching with existingQuery', async () => {
+			const user = userEvent.setup();
+
+			server.use(
+				rest.get('http://localhost/api/v1/fields/values', (req, res, ctx) => {
+					const searchText = req.url.searchParams.get('searchText') || '';
+
+					return res(
+						ctx.status(200),
+						ctx.json({
+							status: 'success',
+							data: {
+								values: {
+									relatedValues: [],
+									stringValues: searchText === '' ? ['prod', 'staging'] : ['prod-match'],
+									numberValues: [],
+								},
+							},
+						}),
+					);
+				}),
+			);
+
+			render(
+				<CheckboxFilterV2
+					filter={DEFAULT_FILTER}
+					source={QuickFiltersSource.TRACES_EXPLORER}
+					useFieldApis={{
+						...DEFAULT_USE_FIELD_APIS,
+						existingQuery: 'service.name = "api"',
+					}}
+				/>,
+			);
+
+			await screen.findByTestId('checkbox-value-row-prod');
+
+			const searchInput = screen.getByTestId('checkbox-filter-search');
+			await user.type(searchInput, 'prod');
+
+			await waitFor(() => {
+				expect(screen.getByTestId('section-all_values')).toBeInTheDocument();
+				expect(
+					screen.getByTestId('checkbox-value-row-prod-match'),
+				).toBeInTheDocument();
+			});
+		});
+
+		it('shows empty search results message when no matches found', async () => {
+			const user = userEvent.setup();
+
+			server.use(
+				rest.get('http://localhost/api/v1/fields/values', (req, res, ctx) => {
+					const searchText = req.url.searchParams.get('searchText') || '';
+
+					return res(
+						ctx.status(200),
+						ctx.json({
+							status: 'success',
+							data: {
+								values: {
+									relatedValues: [],
+									stringValues: searchText === '' ? ['prod', 'staging'] : [],
+									numberValues: [],
+								},
+							},
+						}),
+					);
+				}),
+			);
+
+			render(
+				<CheckboxFilterV2
+					filter={DEFAULT_FILTER}
+					source={QuickFiltersSource.TRACES_EXPLORER}
+					useFieldApis={DEFAULT_USE_FIELD_APIS}
+				/>,
+			);
+
+			await screen.findByTestId('checkbox-value-row-prod');
+
+			const searchInput = screen.getByTestId('checkbox-filter-search');
+			await user.type(searchInput, 'xyz-no-match');
+
+			await waitFor(() => {
+				expect(
+					screen.getByTestId('checkbox-filter-no-search-results'),
+				).toBeInTheDocument();
+			});
+		});
+
+		it('shows both RELATED and ALL_VALUES sections with non-overlapping values', async () => {
+			// This tests the bug fix where different pod names in relatedValues vs stringValues
+			// caused all items to go to ALL_VALUES instead of showing RELATED section
+			server.use(
+				rest.get('http://localhost/api/v1/fields/values', (req, res, ctx) =>
+					res(
+						ctx.status(200),
+						ctx.json({
+							status: 'success',
+							data: {
+								values: {
+									// Non-overlapping: different pod instances
+									relatedValues: ['pod-a-instance-1', 'pod-b-instance-1'],
+									stringValues: ['pod-a-instance-2', 'pod-b-instance-2'],
+									numberValues: [],
+								},
+							},
+						}),
+					),
+				),
+			);
+
+			render(
+				<CheckboxFilterV2
+					filter={DEFAULT_FILTER}
+					source={QuickFiltersSource.TRACES_EXPLORER}
+					useFieldApis={{
+						...DEFAULT_USE_FIELD_APIS,
+						existingQuery: 'service.name = "api"',
+					}}
+				/>,
+			);
+
+			// Wait for values to load
+			await screen.findByTestId('checkbox-value-row-pod-a-instance-1');
+
+			// RELATED section should exist with relatedValues
+			expect(screen.getByTestId('section-related')).toBeInTheDocument();
+			expect(
+				screen.getByTestId('checkbox-value-row-pod-a-instance-1'),
+			).toBeInTheDocument();
+			expect(
+				screen.getByTestId('checkbox-value-row-pod-b-instance-1'),
+			).toBeInTheDocument();
+
+			// ALL_VALUES section should exist with stringValues
+			expect(screen.getByTestId('section-all_values')).toBeInTheDocument();
+			expect(
+				screen.getByTestId('checkbox-value-row-pod-a-instance-2'),
+			).toBeInTheDocument();
+			expect(
+				screen.getByTestId('checkbox-value-row-pod-b-instance-2'),
+			).toBeInTheDocument();
+		});
+
+		it('shows both sections during search with filtered non-overlapping values', async () => {
+			const user = userEvent.setup();
+
+			server.use(
+				rest.get('http://localhost/api/v1/fields/values', (req, res, ctx) => {
+					const searchText = req.url.searchParams.get('searchText') || '';
+
+					// Simulate API filtering - both arrays filtered but remain non-overlapping
+					const relatedValues =
+						searchText === '' ? ['pod-a-v1', 'pod-b-v1', 'pod-c-v1'] : ['pod-a-v1']; // filtered to match 'pod-a'
+					const stringValues =
+						searchText === '' ? ['pod-a-v2', 'pod-b-v2', 'pod-c-v2'] : ['pod-a-v2']; // filtered to match 'pod-a'
+
+					return res(
+						ctx.status(200),
+						ctx.json({
+							status: 'success',
+							data: {
+								values: {
+									relatedValues,
+									stringValues,
+									numberValues: [],
+								},
+							},
+						}),
+					);
+				}),
+			);
+
+			render(
+				<CheckboxFilterV2
+					filter={DEFAULT_FILTER}
+					source={QuickFiltersSource.TRACES_EXPLORER}
+					useFieldApis={{
+						...DEFAULT_USE_FIELD_APIS,
+						existingQuery: 'service.name = "api"',
+					}}
+				/>,
+			);
+
+			await screen.findByTestId('checkbox-value-row-pod-a-v1');
+
+			const searchInput = screen.getByTestId('checkbox-filter-search');
+			await user.type(searchInput, 'pod-a');
+
+			// After search, both sections should still appear with filtered results
+			await waitFor(() => {
+				// RELATED section with filtered relatedValues
+				expect(screen.getByTestId('section-related')).toBeInTheDocument();
+				expect(
+					screen.getByTestId('checkbox-value-row-pod-a-v1'),
+				).toBeInTheDocument();
+
+				// ALL_VALUES section with filtered stringValues
+				expect(screen.getByTestId('section-all_values')).toBeInTheDocument();
+				expect(
+					screen.getByTestId('checkbox-value-row-pod-a-v2'),
+				).toBeInTheDocument();
+
+				// Other values should be filtered out
+				expect(
+					screen.queryByTestId('checkbox-value-row-pod-b-v1'),
+				).not.toBeInTheDocument();
+			});
+		});
+	});
+
+	describe('header interactions', () => {
+		it('collapses when header clicked on open filter', async () => {
+			const user = userEvent.setup();
+
+			mockFieldsValuesAPI({
+				stringValues: ['production'],
+			});
+
+			render(
+				<CheckboxFilterV2
+					filter={DEFAULT_FILTER}
+					source={QuickFiltersSource.TRACES_EXPLORER}
+					useFieldApis={DEFAULT_USE_FIELD_APIS}
+				/>,
+			);
+
+			await screen.findByTestId('checkbox-value-row-production');
+
+			const header = screen.getByTestId('checkbox-filter-header');
+			expect(header).toHaveAttribute('data-state', 'open');
+
+			await user.click(header);
+
+			expect(header).toHaveAttribute('data-state', 'closed');
+			expect(
+				screen.queryByTestId('checkbox-value-row-production'),
+			).not.toBeInTheDocument();
+		});
+
+		it('expands when header clicked on closed filter', async () => {
+			const user = userEvent.setup();
+
+			mockFieldsValuesAPI({
+				stringValues: ['production'],
+			});
+
+			render(
+				<CheckboxFilterV2
+					filter={{ ...DEFAULT_FILTER, defaultOpen: false }}
+					source={QuickFiltersSource.TRACES_EXPLORER}
+					useFieldApis={DEFAULT_USE_FIELD_APIS}
+				/>,
+			);
+
+			const header = screen.getByTestId('checkbox-filter-header');
+			expect(header).toHaveAttribute('data-state', 'closed');
+
+			await user.click(header);
+
+			expect(header).toHaveAttribute('data-state', 'open');
+			await screen.findByTestId('checkbox-value-row-production');
+		});
+	});
+
+	describe('show more functionality', () => {
+		it('shows "Show More..." when more than 10 values', async () => {
+			const values = Array.from(
+				{ length: 15 },
+				(_, i) => `value-${String(i).padStart(2, '0')}`,
+			);
+			mockFieldsValuesAPI({ stringValues: values });
+
+			render(
+				<CheckboxFilterV2
+					filter={DEFAULT_FILTER}
+					source={QuickFiltersSource.TRACES_EXPLORER}
+					useFieldApis={DEFAULT_USE_FIELD_APIS}
+				/>,
+			);
+
+			await screen.findByTestId('checkbox-value-row-value-00');
+
+			expect(screen.getByTestId('checkbox-filter-show-more')).toBeInTheDocument();
+
+			expect(
+				screen.queryByTestId('checkbox-value-row-value-10'),
+			).not.toBeInTheDocument();
+		});
+
+		it('loads more values when "Show More..." clicked', async () => {
+			const user = userEvent.setup();
+
+			const values = Array.from(
+				{ length: 15 },
+				(_, i) => `value-${String(i).padStart(2, '0')}`,
+			);
+			mockFieldsValuesAPI({ stringValues: values });
+
+			render(
+				<CheckboxFilterV2
+					filter={DEFAULT_FILTER}
+					source={QuickFiltersSource.TRACES_EXPLORER}
+					useFieldApis={DEFAULT_USE_FIELD_APIS}
+				/>,
+			);
+
+			await screen.findByTestId('checkbox-value-row-value-00');
+
+			await user.click(screen.getByTestId('checkbox-filter-show-more'));
+
+			await screen.findByTestId('checkbox-value-row-value-10');
+			expect(
+				screen.getByTestId('checkbox-value-row-value-14'),
+			).toBeInTheDocument();
+		});
+	});
+
+	describe('clear functionality', () => {
+		it('shows clear button when filter is open and has filter applied', async () => {
+			mockFieldsValuesAPI({
+				stringValues: ['production'],
+			});
+
+			render(
+				<CheckboxFilterV2
+					filter={DEFAULT_FILTER}
+					source={QuickFiltersSource.TRACES_EXPLORER}
+					useFieldApis={DEFAULT_USE_FIELD_APIS}
+				/>,
+				undefined,
+				{
+					queryBuilderOverrides: {
+						currentQuery: {
+							builder: {
+								queryData: [
+									{
+										filters: {
+											items: [
+												{
+													key: { key: 'deployment.environment' },
+													op: 'in',
+													value: ['production'],
+												},
+											],
+											op: 'AND',
+										},
+									},
+								],
+							},
+						},
+					} as never,
+				},
+			);
+
+			await screen.findByTestId('checkbox-value-row-production');
+
+			expect(screen.getByTestId('checkbox-filter-clear-all')).toBeInTheDocument();
+		});
+
+		it('hides clear button when no filter applied for attribute', async () => {
+			mockFieldsValuesAPI({
+				stringValues: ['production'],
+			});
+
+			render(
+				<CheckboxFilterV2
+					filter={DEFAULT_FILTER}
+					source={QuickFiltersSource.TRACES_EXPLORER}
+					useFieldApis={DEFAULT_USE_FIELD_APIS}
+				/>,
+			);
+
+			await screen.findByTestId('checkbox-value-row-production');
+
+			expect(
+				screen.queryByTestId('checkbox-filter-clear-all'),
+			).not.toBeInTheDocument();
+		});
+
+		it('calls onFilterChange when clear clicked', async () => {
+			const user = userEvent.setup();
+			const onFilterChange = jest.fn();
+
+			mockFieldsValuesAPI({
+				stringValues: ['production'],
+			});
+
+			render(
+				<CheckboxFilterV2
+					filter={DEFAULT_FILTER}
+					source={QuickFiltersSource.TRACES_EXPLORER}
+					useFieldApis={DEFAULT_USE_FIELD_APIS}
+					onFilterChange={onFilterChange}
+				/>,
+				undefined,
+				{
+					queryBuilderOverrides: {
+						currentQuery: {
+							builder: {
+								queryData: [
+									{
+										filters: {
+											items: [
+												{
+													key: { key: 'deployment.environment' },
+													op: 'in',
+													value: ['production'],
+												},
+											],
+											op: 'AND',
+										},
+									},
+								],
+							},
+						},
+					} as never,
+				},
+			);
+
+			await screen.findByTestId('checkbox-value-row-production');
+
+			await user.click(screen.getByTestId('checkbox-filter-clear-all'));
+
+			expect(onFilterChange).toHaveBeenCalled();
+		});
+	});
+
+	describe('value row interactions', () => {
+		it('calls onFilterChange when checkbox value clicked', async () => {
+			const user = userEvent.setup();
+			const onFilterChange = jest.fn();
+
+			mockFieldsValuesAPI({
+				stringValues: ['production', 'staging'],
+			});
+
+			render(
+				<CheckboxFilterV2
+					filter={DEFAULT_FILTER}
+					source={QuickFiltersSource.TRACES_EXPLORER}
+					useFieldApis={DEFAULT_USE_FIELD_APIS}
+					onFilterChange={onFilterChange}
+				/>,
+			);
+
+			const productionRow = await screen.findByTestId(
+				'checkbox-value-row-production',
+			);
+
+			await user.click(within(productionRow).getByText('production'));
+
+			expect(onFilterChange).toHaveBeenCalled();
+		});
+
+		it('creates NOT IN filter when unchecking related item with no existing filter', async () => {
+			const user = userEvent.setup();
+			const onFilterChange = jest.fn();
+
+			mockFieldsValuesAPI({
+				relatedValues: ['valueA'],
+				stringValues: ['valueB'],
+			});
+
+			// Start with no filter, related items show as checked
+			// Clicking unchecks them → creates NOT IN filter to exclude
+			renderWithFilter(onFilterChange);
+
+			const rowA = await screen.findByTestId('checkbox-value-row-valueA');
+			expect(rowA).toHaveAttribute('data-state', 'checked');
+
+			await user.click(within(rowA).getByRole('checkbox'));
+
+			expect(onFilterChange).toHaveBeenCalledTimes(1);
+			const filter = getFilterFromCall(onFilterChange);
+			expect(filter?.op).toBe('not in');
+			expect(filter?.value).toBe('valueA');
+		});
+
+		it('converts NOT IN to IN when toggling unchecked (other) item', async () => {
+			const user = userEvent.setup();
+			const onFilterChange = jest.fn();
+
+			mockFieldsValuesAPI({
+				relatedValues: ['valueA'],
+				stringValues: ['valueB'],
+			});
+
+			// Clicking unchecked "Other" item with NOT IN filter should convert to IN [B]
+			renderWithFilter(onFilterChange, { op: 'not in', value: ['valueA'] });
+
+			const rowB = await screen.findByTestId('checkbox-value-row-valueB');
+			expect(rowB).toHaveAttribute('data-state', 'unchecked');
+
+			await user.click(within(rowB).getByRole('checkbox'));
+
+			expect(onFilterChange).toHaveBeenCalledTimes(1);
+			const filter = getFilterFromCall(onFilterChange);
+			expect(filter?.op).toBe('in');
+			expect(filter?.value).toBe('valueB');
+		});
+
+		it('accumulates both values in IN when toggling checked (related) then unchecked (other)', async () => {
+			const user = userEvent.setup();
+			const onFilterChange = jest.fn();
+
+			mockFieldsValuesAPI({
+				relatedValues: ['valueA'],
+				stringValues: ['valueB'],
+			});
+
+			// Start with IN filter for valueA
+			renderWithFilter(onFilterChange, { op: 'in', value: ['valueA'] });
+
+			const rowA = await screen.findByTestId('checkbox-value-row-valueA');
+			expect(rowA).toHaveAttribute('data-state', 'checked');
+
+			const rowB = screen.getByTestId('checkbox-value-row-valueB');
+			expect(rowB).toHaveAttribute('data-state', 'unchecked');
+
+			// Toggle B (unchecked -> should add to IN)
+			await user.click(within(rowB).getByRole('checkbox'));
+
+			expect(onFilterChange).toHaveBeenCalledTimes(1);
+			const filter = getFilterFromCall(onFilterChange);
+			expect(filter?.op).toBe('in');
+			expect(filter?.value).toStrictEqual(['valueA', 'valueB']);
+		});
+
+		it('adds to NOT IN when toggling checked (related) with existing NOT IN filter', async () => {
+			const user = userEvent.setup();
+			const onFilterChange = jest.fn();
+
+			mockFieldsValuesAPI({
+				relatedValues: ['valueA'],
+				stringValues: ['valueB'],
+			});
+
+			// Start with NOT IN filter for valueB
+			renderWithFilter(onFilterChange, { op: 'not in', value: ['valueB'] });
+
+			const rowA = await screen.findByTestId('checkbox-value-row-valueA');
+			// Related values show as checked
+			expect(rowA).toHaveAttribute('data-state', 'checked');
+
+			// Toggle A (checked -> should add to NOT IN)
+			await user.click(within(rowA).getByRole('checkbox'));
+
+			expect(onFilterChange).toHaveBeenCalledTimes(1);
+			const filter = getFilterFromCall(onFilterChange);
+			expect(filter?.op).toBe('not in');
+			expect(filter?.value).toStrictEqual(['valueB', 'valueA']);
+		});
+
+		it('creates NOT IN for single value when toggling related item with existing IN filter', async () => {
+			const user = userEvent.setup();
+			const onFilterChange = jest.fn();
+
+			mockFieldsValuesAPI({
+				relatedValues: ['relatedValue'],
+				stringValues: ['otherValue'],
+			});
+
+			// Start with IN filter for otherValue (Selected section)
+			// relatedValue is in Related section (checked visually)
+			renderWithFilter(onFilterChange, { op: 'in', value: ['otherValue'] });
+
+			const selectedRow = await screen.findByTestId(
+				'checkbox-value-row-otherValue',
+			);
+			expect(selectedRow).toHaveAttribute('data-state', 'checked');
+
+			const relatedRow = screen.getByTestId('checkbox-value-row-relatedValue');
+			expect(relatedRow).toHaveAttribute('data-state', 'checked');
+
+			// Toggle related item (checked -> should create NOT IN with just this value)
+			await user.click(within(relatedRow).getByRole('checkbox'));
+
+			expect(onFilterChange).toHaveBeenCalledTimes(1);
+			const filter = getFilterFromCall(onFilterChange);
+			expect(filter?.op).toBe('not in');
+			expect(filter?.value).toBe('relatedValue');
+		});
+	});
+
+	describe('custom renderer', () => {
+		it('uses customRendererForValue when provided', async () => {
+			mockFieldsValuesAPI({
+				stringValues: ['production'],
+			});
+
+			const customRenderer = (value: string): JSX.Element => (
+				<span data-testid="custom-rendered">{`ENV: ${value}`}</span>
+			);
+
+			render(
+				<CheckboxFilterV2
+					filter={{ ...DEFAULT_FILTER, customRendererForValue: customRenderer }}
+					source={QuickFiltersSource.TRACES_EXPLORER}
+					useFieldApis={DEFAULT_USE_FIELD_APIS}
+				/>,
+			);
+
+			await screen.findByTestId('custom-rendered');
+			expect(screen.getByText('ENV: production')).toBeInTheDocument();
+		});
+	});
+});

frontend/src/components/QuickFilters/FilterRenderers/Checkbox/v2/__tests__/CheckboxFilterV2.itemRules.test.tsx

@@ -0,0 +1,499 @@
+import { screen, within } from '@testing-library/react';
+import { render } from 'tests/test-utils';
+
+import { QuickFiltersSource } from '../../../../types';
+
+import CheckboxFilterV2 from '../CheckboxFilterV2';
+import {
+	DEFAULT_FILTER,
+	DEFAULT_USE_FIELD_APIS,
+	mockFieldsValuesAPI,
+	setupServer,
+} from '../CheckboxFilterV2.testUtils';
+
+setupServer();
+
+describe('CheckboxFilterV2 - item rules', () => {
+	describe('no existing query', () => {
+		it('all values show as checked with no badge when no query exists', async () => {
+			mockFieldsValuesAPI({
+				stringValues: ['production', 'staging'],
+			});
+
+			render(
+				<CheckboxFilterV2
+					filter={DEFAULT_FILTER}
+					source={QuickFiltersSource.TRACES_EXPLORER}
+					useFieldApis={DEFAULT_USE_FIELD_APIS}
+				/>,
+			);
+
+			const productionRow = await screen.findByTestId(
+				'checkbox-value-row-production',
+			);
+			expect(within(productionRow).getByText('production')).toBeInTheDocument();
+			const stagingRow = screen.getByTestId('checkbox-value-row-staging');
+
+			expect(productionRow).toHaveAttribute('data-state', 'checked');
+			expect(stagingRow).toHaveAttribute('data-state', 'checked');
+
+			// No section dividers when no existing query (all in "selected" section)
+			expect(
+				screen.queryByTestId('section-divider-related'),
+			).not.toBeInTheDocument();
+			expect(
+				screen.queryByTestId('section-divider-all-values'),
+			).not.toBeInTheDocument();
+		});
+	});
+
+	describe('with existing query (related values)', () => {
+		it('shows related values in "Related" section with checked state', async () => {
+			mockFieldsValuesAPI({
+				relatedValues: ['production'],
+				stringValues: ['staging', 'development'],
+			});
+
+			render(
+				<CheckboxFilterV2
+					filter={DEFAULT_FILTER}
+					source={QuickFiltersSource.TRACES_EXPLORER}
+					useFieldApis={{
+						...DEFAULT_USE_FIELD_APIS,
+						existingQuery: 'service.name = "api"',
+					}}
+				/>,
+				undefined,
+				{
+					queryBuilderOverrides: {
+						currentQuery: {
+							builder: {
+								queryData: [
+									{
+										filters: { items: [], op: 'AND' },
+										filter: { expression: 'service.name = "api"' },
+									},
+								],
+							},
+						},
+					} as never,
+				},
+			);
+
+			const productionRow = await screen.findByTestId(
+				'checkbox-value-row-production',
+			);
+			expect(within(productionRow).getByText('production')).toBeInTheDocument();
+
+			// Related values show as checked in "Related" section
+			expect(screen.getByTestId('section-divider-related')).toBeInTheDocument();
+			expect(productionRow).toHaveAttribute('data-state', 'checked');
+
+			// Other values show as unchecked in "All values" section
+			expect(screen.getByTestId('section-divider-all-values')).toBeInTheDocument();
+			const stagingRow = screen.getByTestId('checkbox-value-row-staging');
+			expect(stagingRow).toHaveAttribute('data-state', 'unchecked');
+		});
+
+		it('shows no badge for values not in relatedValues (unchecked state in All values section)', async () => {
+			mockFieldsValuesAPI({
+				relatedValues: ['production'],
+				stringValues: ['staging'],
+			});
+
+			render(
+				<CheckboxFilterV2
+					filter={DEFAULT_FILTER}
+					source={QuickFiltersSource.TRACES_EXPLORER}
+					useFieldApis={{
+						...DEFAULT_USE_FIELD_APIS,
+						existingQuery: 'service.name = "api"',
+					}}
+				/>,
+				undefined,
+				{
+					queryBuilderOverrides: {
+						currentQuery: {
+							builder: {
+								queryData: [
+									{
+										filters: { items: [], op: 'AND' },
+										filter: { expression: 'service.name = "api"' },
+									},
+								],
+							},
+						},
+					} as never,
+				},
+			);
+
+			const stagingRow = await screen.findByTestId('checkbox-value-row-staging');
+			expect(within(stagingRow).getByText('staging')).toBeInTheDocument();
+			expect(stagingRow).toHaveAttribute('data-state', 'unchecked');
+			expect(within(stagingRow).queryByTestId(/^badge-/)).not.toBeInTheDocument();
+		});
+
+		it('shows related values as checked when hasFilterForThisKey=true and isInRelatedValues=true', async () => {
+			mockFieldsValuesAPI({
+				relatedValues: ['production', 'staging'],
+				stringValues: ['development'],
+			});
+
+			render(
+				<CheckboxFilterV2
+					filter={DEFAULT_FILTER}
+					source={QuickFiltersSource.TRACES_EXPLORER}
+					useFieldApis={{
+						...DEFAULT_USE_FIELD_APIS,
+						existingQuery: 'service.name = "api"',
+					}}
+				/>,
+				undefined,
+				{
+					queryBuilderOverrides: {
+						currentQuery: {
+							builder: {
+								queryData: [
+									{
+										filters: {
+											items: [
+												{
+													key: { key: 'deployment.environment' },
+													op: 'in',
+													value: ['production'],
+												},
+											],
+											op: 'AND',
+										},
+										filter: { expression: 'service.name = "api"' },
+									},
+								],
+							},
+						},
+					} as never,
+				},
+			);
+
+			// production is selected - in selected section
+			const productionRow = await screen.findByTestId(
+				'checkbox-value-row-production',
+			);
+			expect(productionRow).toHaveAttribute('data-state', 'checked');
+
+			// staging is related - in related section with checked state
+			const stagingRow = screen.getByTestId('checkbox-value-row-staging');
+			expect(stagingRow).toHaveAttribute('data-state', 'checked');
+			expect(screen.getByTestId('section-divider-related')).toBeInTheDocument();
+		});
+	});
+
+	describe('selected values with IN operator', () => {
+		it('shows checked state with no badge for IN-selected values', async () => {
+			mockFieldsValuesAPI({
+				stringValues: ['production', 'staging'],
+			});
+
+			render(
+				<CheckboxFilterV2
+					filter={DEFAULT_FILTER}
+					source={QuickFiltersSource.TRACES_EXPLORER}
+					useFieldApis={DEFAULT_USE_FIELD_APIS}
+				/>,
+				undefined,
+				{
+					queryBuilderOverrides: {
+						currentQuery: {
+							builder: {
+								queryData: [
+									{
+										filters: {
+											items: [
+												{
+													key: { key: 'deployment.environment' },
+													op: 'in',
+													value: ['production'],
+												},
+											],
+											op: 'AND',
+										},
+									},
+								],
+							},
+						},
+					} as never,
+				},
+			);
+
+			const productionRow = await screen.findByTestId(
+				'checkbox-value-row-production',
+			);
+			expect(productionRow).toHaveAttribute('data-state', 'checked');
+			expect(
+				within(productionRow).queryByTestId(/^badge-/),
+			).not.toBeInTheDocument();
+
+			const stagingRow = screen.getByTestId('checkbox-value-row-staging');
+			expect(stagingRow).toHaveAttribute('data-state', 'unchecked');
+		});
+	});
+
+	describe('selected values with NOT IN operator', () => {
+		it('shows unchecked state with no badge for NOT_IN-selected values', async () => {
+			mockFieldsValuesAPI({
+				stringValues: ['production', 'staging'],
+			});
+
+			render(
+				<CheckboxFilterV2
+					filter={DEFAULT_FILTER}
+					source={QuickFiltersSource.TRACES_EXPLORER}
+					useFieldApis={DEFAULT_USE_FIELD_APIS}
+				/>,
+				undefined,
+				{
+					queryBuilderOverrides: {
+						currentQuery: {
+							builder: {
+								queryData: [
+									{
+										filters: {
+											items: [
+												{
+													key: { key: 'deployment.environment' },
+													op: 'not in',
+													value: ['production'],
+												},
+											],
+											op: 'AND',
+										},
+									},
+								],
+							},
+						},
+					} as never,
+				},
+			);
+
+			const productionRow = await screen.findByTestId(
+				'checkbox-value-row-production',
+			);
+			expect(productionRow).toHaveAttribute('data-state', 'unchecked');
+			expect(
+				within(productionRow).queryByTestId(/^badge-/),
+			).not.toBeInTheDocument();
+
+			const stagingRow = screen.getByTestId('checkbox-value-row-staging');
+			expect(stagingRow).toHaveAttribute('data-state', 'unchecked');
+			expect(within(stagingRow).queryByTestId(/^badge-/)).not.toBeInTheDocument();
+		});
+	});
+
+	describe('section ordering', () => {
+		it('orders selected section before related section before other section', async () => {
+			mockFieldsValuesAPI({
+				relatedValues: ['related-value'],
+				stringValues: ['other-value', 'selected-value'],
+			});
+
+			render(
+				<CheckboxFilterV2
+					filter={DEFAULT_FILTER}
+					source={QuickFiltersSource.TRACES_EXPLORER}
+					useFieldApis={{
+						...DEFAULT_USE_FIELD_APIS,
+						existingQuery: 'service.name = "api"',
+					}}
+				/>,
+				undefined,
+				{
+					queryBuilderOverrides: {
+						currentQuery: {
+							builder: {
+								queryData: [
+									{
+										filters: {
+											items: [
+												{
+													key: { key: 'deployment.environment' },
+													op: 'in',
+													value: ['selected-value'],
+												},
+											],
+											op: 'AND',
+										},
+										filter: { expression: 'service.name = "api"' },
+									},
+								],
+							},
+						},
+					} as never,
+				},
+			);
+
+			await screen.findByTestId('checkbox-value-row-selected-value');
+
+			const allRows = screen.getAllByTestId(/^checkbox-value-row-/);
+			const values = allRows.map((row) =>
+				row.getAttribute('data-testid')?.replace('checkbox-value-row-', ''),
+			);
+
+			expect(values[0]).toBe('selected-value');
+			expect(values[1]).toBe('related-value');
+			expect(values[2]).toBe('other-value');
+		});
+
+		it('sorts alphabetically within same section', async () => {
+			mockFieldsValuesAPI({
+				relatedValues: ['zebra', 'alpha', 'mike'],
+				stringValues: [],
+			});
+
+			render(
+				<CheckboxFilterV2
+					filter={DEFAULT_FILTER}
+					source={QuickFiltersSource.TRACES_EXPLORER}
+					useFieldApis={{
+						...DEFAULT_USE_FIELD_APIS,
+						existingQuery: 'service.name = "api"',
+					}}
+				/>,
+				undefined,
+				{
+					queryBuilderOverrides: {
+						currentQuery: {
+							builder: {
+								queryData: [
+									{
+										filters: { items: [], op: 'AND' },
+										filter: { expression: 'service.name = "api"' },
+									},
+								],
+							},
+						},
+					} as never,
+				},
+			);
+
+			await screen.findByTestId('checkbox-value-row-alpha');
+
+			const allRows = screen.getAllByTestId(/^checkbox-value-row-/);
+			const values = allRows.map((row) =>
+				row.getAttribute('data-testid')?.replace('checkbox-value-row-', ''),
+			);
+
+			expect(values).toStrictEqual(['alpha', 'mike', 'zebra']);
+		});
+	});
+
+	describe('mixed state scenarios', () => {
+		it('handles mixed state: IN-selected + related + other in same list', async () => {
+			mockFieldsValuesAPI({
+				relatedValues: ['related-env'],
+				stringValues: ['other-env', 'selected-env'],
+			});
+
+			render(
+				<CheckboxFilterV2
+					filter={DEFAULT_FILTER}
+					source={QuickFiltersSource.TRACES_EXPLORER}
+					useFieldApis={{
+						...DEFAULT_USE_FIELD_APIS,
+						existingQuery: 'service.name = "api"',
+					}}
+				/>,
+				undefined,
+				{
+					queryBuilderOverrides: {
+						currentQuery: {
+							builder: {
+								queryData: [
+									{
+										filters: {
+											items: [
+												{
+													key: { key: 'deployment.environment' },
+													op: 'in',
+													value: ['selected-env'],
+												},
+											],
+											op: 'AND',
+										},
+										filter: { expression: 'service.name = "api"' },
+									},
+								],
+							},
+						},
+					} as never,
+				},
+			);
+
+			const selectedRow = await screen.findByTestId(
+				'checkbox-value-row-selected-env',
+			);
+			expect(selectedRow).toHaveAttribute('data-state', 'checked');
+			expect(within(selectedRow).queryByTestId(/^badge-/)).not.toBeInTheDocument();
+
+			// Related values now show as checked
+			const relatedRow = screen.getByTestId('checkbox-value-row-related-env');
+			expect(relatedRow).toHaveAttribute('data-state', 'checked');
+			expect(screen.getByTestId('section-divider-related')).toBeInTheDocument();
+
+			const otherRow = screen.getByTestId('checkbox-value-row-other-env');
+			expect(otherRow).toHaveAttribute('data-state', 'unchecked');
+			expect(within(otherRow).queryByTestId(/^badge-/)).not.toBeInTheDocument();
+		});
+
+		it('handles NOT_IN-selected alongside related values', async () => {
+			mockFieldsValuesAPI({
+				relatedValues: ['related-env'],
+				stringValues: ['other-env', 'excluded-env'],
+			});
+
+			render(
+				<CheckboxFilterV2
+					filter={DEFAULT_FILTER}
+					source={QuickFiltersSource.TRACES_EXPLORER}
+					useFieldApis={{
+						...DEFAULT_USE_FIELD_APIS,
+						existingQuery: 'service.name = "api"',
+					}}
+				/>,
+				undefined,
+				{
+					queryBuilderOverrides: {
+						currentQuery: {
+							builder: {
+								queryData: [
+									{
+										filters: {
+											items: [
+												{
+													key: { key: 'deployment.environment' },
+													op: 'not in',
+													value: ['excluded-env'],
+												},
+											],
+											op: 'AND',
+										},
+										filter: { expression: 'service.name = "api"' },
+									},
+								],
+							},
+						},
+					} as never,
+				},
+			);
+
+			const excludedRow = await screen.findByTestId(
+				'checkbox-value-row-excluded-env',
+			);
+			expect(excludedRow).toHaveAttribute('data-state', 'unchecked');
+			expect(within(excludedRow).queryByTestId(/^badge-/)).not.toBeInTheDocument();
+
+			// Related values show as checked
+			const relatedRow = screen.getByTestId('checkbox-value-row-related-env');
+			expect(relatedRow).toHaveAttribute('data-state', 'checked');
+			expect(screen.getByTestId('section-divider-related')).toBeInTheDocument();
+		});
+	});
+});

frontend/src/components/QuickFilters/FilterRenderers/Checkbox/v2/__tests__/CheckboxFilterV2.states.test.tsx

@@ -0,0 +1,207 @@
+import { screen, waitFor, within } from '@testing-library/react';
+import userEvent from '@testing-library/user-event';
+import { server, rest } from 'mocks-server/server';
+import { render } from 'tests/test-utils';
+
+import { QuickFiltersSource } from '../../../../types';
+
+import CheckboxFilterV2 from '../CheckboxFilterV2';
+import {
+	DEFAULT_FILTER,
+	DEFAULT_USE_FIELD_APIS,
+	mockFieldsValuesAPI,
+	mockFieldsValuesAPILoading,
+	setupServer,
+} from '../CheckboxFilterV2.testUtils';
+
+setupServer();
+
+describe('CheckboxFilterV2 - states', () => {
+	describe('loading states', () => {
+		it('shows skeleton while loading initial data', async () => {
+			mockFieldsValuesAPILoading();
+
+			render(
+				<CheckboxFilterV2
+					filter={DEFAULT_FILTER}
+					source={QuickFiltersSource.TRACES_EXPLORER}
+					useFieldApis={DEFAULT_USE_FIELD_APIS}
+				/>,
+			);
+
+			expect(screen.getByTestId('checkbox-filter-v2')).toBeInTheDocument();
+			await waitFor(() => {
+				expect(
+					screen.getByTestId('checkbox-filter-v2').querySelector('.ant-skeleton'),
+				).toBeInTheDocument();
+			});
+		});
+
+		it('shows skeleton when initially closed filter is opened for the first time', async () => {
+			const user = userEvent.setup();
+			mockFieldsValuesAPILoading();
+
+			const closedFilter = { ...DEFAULT_FILTER, defaultOpen: false };
+
+			render(
+				<CheckboxFilterV2
+					filter={closedFilter}
+					source={QuickFiltersSource.TRACES_EXPLORER}
+					useFieldApis={DEFAULT_USE_FIELD_APIS}
+				/>,
+			);
+
+			// Filter starts closed - no skeleton, no content
+			expect(
+				screen.getByTestId('checkbox-filter-v2').querySelector('.ant-skeleton'),
+			).not.toBeInTheDocument();
+			expect(
+				screen.queryByTestId('checkbox-filter-empty'),
+			).not.toBeInTheDocument();
+
+			// Click header to open
+			const header = screen.getByTestId('checkbox-filter-header');
+			await user.click(header);
+
+			// Should show skeleton while loading, NOT "No values found"
+			await waitFor(() => {
+				expect(
+					screen.getByTestId('checkbox-filter-v2').querySelector('.ant-skeleton'),
+				).toBeInTheDocument();
+			});
+			expect(
+				screen.queryByTestId('checkbox-filter-empty'),
+			).not.toBeInTheDocument();
+		});
+
+		it('shows search spinner when fetching after initial load', async () => {
+			const user = userEvent.setup();
+
+			let requestCount = 0;
+			server.use(
+				rest.get('http://localhost/api/v1/fields/values', (req, res, ctx) => {
+					requestCount += 1;
+					if (requestCount === 1) {
+						return res(
+							ctx.status(200),
+							ctx.json({
+								status: 'success',
+								data: {
+									values: {
+										relatedValues: [],
+										stringValues: ['production', 'staging'],
+										numberValues: [],
+									},
+								},
+							}),
+						);
+					}
+					return res(ctx.delay(10000));
+				}),
+			);
+
+			render(
+				<CheckboxFilterV2
+					filter={DEFAULT_FILTER}
+					source={QuickFiltersSource.TRACES_EXPLORER}
+					useFieldApis={DEFAULT_USE_FIELD_APIS}
+				/>,
+			);
+
+			await screen.findByTestId('checkbox-value-row-production');
+
+			const searchInput = screen.getByTestId('checkbox-filter-search');
+			await user.type(searchInput, 'prod');
+
+			await waitFor(() => {
+				expect(
+					screen.getByTestId('checkbox-filter-search-loading'),
+				).toBeInTheDocument();
+			});
+		});
+	});
+
+	describe('empty states', () => {
+		it('shows "No values found" when API returns empty arrays', async () => {
+			mockFieldsValuesAPI({
+				relatedValues: [],
+				stringValues: [],
+				numberValues: [],
+			});
+
+			render(
+				<CheckboxFilterV2
+					filter={DEFAULT_FILTER}
+					source={QuickFiltersSource.TRACES_EXPLORER}
+					useFieldApis={DEFAULT_USE_FIELD_APIS}
+				/>,
+			);
+
+			const emptySection = await screen.findByTestId('checkbox-filter-empty');
+			expect(emptySection).toBeInTheDocument();
+		});
+	});
+
+	describe('value rendering', () => {
+		it('renders values from API response', async () => {
+			mockFieldsValuesAPI({
+				stringValues: ['production', 'staging', 'development'],
+			});
+
+			render(
+				<CheckboxFilterV2
+					filter={DEFAULT_FILTER}
+					source={QuickFiltersSource.TRACES_EXPLORER}
+					useFieldApis={DEFAULT_USE_FIELD_APIS}
+				/>,
+			);
+
+			await screen.findByTestId('checkbox-value-row-production');
+			expect(screen.getByTestId('checkbox-value-row-staging')).toBeInTheDocument();
+			expect(
+				screen.getByTestId('checkbox-value-row-development'),
+			).toBeInTheDocument();
+		});
+
+		it('renders number values converted to strings', async () => {
+			mockFieldsValuesAPI({
+				numberValues: [200, 404, 500],
+			});
+
+			render(
+				<CheckboxFilterV2
+					filter={DEFAULT_FILTER}
+					source={QuickFiltersSource.TRACES_EXPLORER}
+					useFieldApis={DEFAULT_USE_FIELD_APIS}
+				/>,
+			);
+
+			const row200 = await screen.findByTestId('checkbox-value-row-200');
+			expect(within(row200).getByText('200')).toBeInTheDocument();
+			expect(
+				within(screen.getByTestId('checkbox-value-row-404')).getByText('404'),
+			).toBeInTheDocument();
+			expect(
+				within(screen.getByTestId('checkbox-value-row-500')).getByText('500'),
+			).toBeInTheDocument();
+		});
+
+		it('filters null/undefined values from response', async () => {
+			mockFieldsValuesAPI({
+				stringValues: ['valid', null, '', undefined as unknown as string],
+			});
+
+			render(
+				<CheckboxFilterV2
+					filter={DEFAULT_FILTER}
+					source={QuickFiltersSource.TRACES_EXPLORER}
+					useFieldApis={DEFAULT_USE_FIELD_APIS}
+				/>,
+			);
+
+			const validRow = await screen.findByTestId('checkbox-value-row-valid');
+			expect(within(validRow).getByText('valid')).toBeInTheDocument();
+			expect(screen.queryAllByTestId(/^checkbox-value-row-/)).toHaveLength(1);
+		});
+	});
+});

frontend/src/components/QuickFilters/FilterRenderers/Checkbox/v2/__tests__/CheckboxFilterV2Header.test.tsx

@@ -0,0 +1,156 @@
+import { render, screen } from '@testing-library/react';
+import userEvent from '@testing-library/user-event';
+
+import { CheckboxFilterV2Header } from '../CheckboxFilterV2Header';
+
+describe('CheckboxFilterV2Header', () => {
+	const defaultProps = {
+		title: 'Environment',
+		isOpen: false,
+		showClearAll: true,
+		isSomeFilterPresentForCurrentAttribute: true,
+		onToggleOpen: jest.fn(),
+		onClear: jest.fn(),
+	};
+
+	beforeEach(() => {
+		jest.clearAllMocks();
+	});
+
+	describe('collapsed state', () => {
+		it('renders title', () => {
+			render(<CheckboxFilterV2Header {...defaultProps} isOpen={false} />);
+
+			expect(screen.getByText('Environment')).toBeInTheDocument();
+		});
+
+		it('sets data-state="closed" when collapsed', () => {
+			render(<CheckboxFilterV2Header {...defaultProps} isOpen={false} />);
+
+			const header = screen.getByTestId('checkbox-filter-header');
+			expect(header).toHaveAttribute('data-state', 'closed');
+		});
+
+		it('does not show clear button when collapsed', () => {
+			render(
+				<CheckboxFilterV2Header {...defaultProps} isOpen={false} showClearAll />,
+			);
+
+			expect(
+				screen.queryByTestId('checkbox-filter-clear-all'),
+			).not.toBeInTheDocument();
+		});
+	});
+
+	describe('expanded state', () => {
+		it('sets data-state="open" when expanded', () => {
+			render(<CheckboxFilterV2Header {...defaultProps} isOpen />);
+
+			const header = screen.getByTestId('checkbox-filter-header');
+			expect(header).toHaveAttribute('data-state', 'open');
+		});
+
+		it('shows clear button when expanded + showClearAll=true', () => {
+			render(<CheckboxFilterV2Header {...defaultProps} isOpen showClearAll />);
+
+			expect(screen.getByTestId('checkbox-filter-clear-all')).toBeInTheDocument();
+			expect(screen.getByText('Clear')).toBeInTheDocument();
+		});
+
+		it('hides clear button when showClearAll=false', () => {
+			render(
+				<CheckboxFilterV2Header {...defaultProps} isOpen showClearAll={false} />,
+			);
+
+			expect(
+				screen.queryByTestId('checkbox-filter-clear-all'),
+			).not.toBeInTheDocument();
+		});
+
+		it('hides clear button when no filter present for attribute', () => {
+			render(
+				<CheckboxFilterV2Header
+					{...defaultProps}
+					isOpen
+					showClearAll
+					isSomeFilterPresentForCurrentAttribute={false}
+				/>,
+			);
+
+			expect(
+				screen.queryByTestId('checkbox-filter-clear-all'),
+			).not.toBeInTheDocument();
+		});
+	});
+
+	describe('interactions', () => {
+		it('calls onToggleOpen on header click', async () => {
+			const user = userEvent.setup();
+			const onToggleOpen = jest.fn();
+			render(
+				<CheckboxFilterV2Header {...defaultProps} onToggleOpen={onToggleOpen} />,
+			);
+
+			await user.click(screen.getByTestId('checkbox-filter-header'));
+
+			expect(onToggleOpen).toHaveBeenCalledTimes(1);
+		});
+
+		it('calls onToggleOpen on Enter key', async () => {
+			const user = userEvent.setup();
+			const onToggleOpen = jest.fn();
+			render(
+				<CheckboxFilterV2Header {...defaultProps} onToggleOpen={onToggleOpen} />,
+			);
+
+			screen.getByTestId('checkbox-filter-header').focus();
+			await user.keyboard('{Enter}');
+
+			expect(onToggleOpen).toHaveBeenCalledTimes(1);
+		});
+
+		it('calls onToggleOpen on Space key', async () => {
+			const user = userEvent.setup();
+			const onToggleOpen = jest.fn();
+			render(
+				<CheckboxFilterV2Header {...defaultProps} onToggleOpen={onToggleOpen} />,
+			);
+
+			screen.getByTestId('checkbox-filter-header').focus();
+			await user.keyboard(' ');
+
+			expect(onToggleOpen).toHaveBeenCalledTimes(1);
+		});
+
+		it('calls onClear on clear button click', async () => {
+			const user = userEvent.setup();
+			const onClear = jest.fn();
+			render(
+				<CheckboxFilterV2Header {...defaultProps} isOpen onClear={onClear} />,
+			);
+
+			await user.click(screen.getByTestId('checkbox-filter-clear-all'));
+
+			expect(onClear).toHaveBeenCalledTimes(1);
+		});
+
+		it('clear button click does not trigger onToggleOpen', async () => {
+			const user = userEvent.setup();
+			const onToggleOpen = jest.fn();
+			const onClear = jest.fn();
+			render(
+				<CheckboxFilterV2Header
+					{...defaultProps}
+					isOpen
+					onToggleOpen={onToggleOpen}
+					onClear={onClear}
+				/>,
+			);
+
+			await user.click(screen.getByTestId('checkbox-filter-clear-all'));
+
+			expect(onClear).toHaveBeenCalledTimes(1);
+			expect(onToggleOpen).not.toHaveBeenCalled();
+		});
+	});
+});

frontend/src/components/QuickFilters/FilterRenderers/Checkbox/v2/__tests__/CheckboxFilterV2ValueRow.test.tsx

@@ -0,0 +1,297 @@
+import { render, screen } from '@testing-library/react';
+import userEvent from '@testing-library/user-event';
+
+import { BadgeConfig } from '../itemRules';
+import { CheckedState } from '../../../../types';
+import { CheckboxFilterV2ValueRow } from '../CheckboxFilterV2ValueRow';
+
+describe('CheckboxFilterV2ValueRow', () => {
+	const defaultProps = {
+		value: 'production',
+		checkedState: 'unchecked' as CheckedState,
+		disabled: false,
+		title: 'Environment',
+		onlyButtonLabel: 'Only',
+		onCheckboxChange: jest.fn(),
+		onOnlyOrAllClick: jest.fn(),
+		badge: null as BadgeConfig | null,
+	};
+
+	beforeEach(() => {
+		jest.clearAllMocks();
+	});
+
+	describe('checked states', () => {
+		it('sets data-state="unchecked" for unchecked state', () => {
+			render(
+				<CheckboxFilterV2ValueRow {...defaultProps} checkedState="unchecked" />,
+			);
+
+			const row = screen.getByTestId('checkbox-value-row-production');
+			expect(row).toHaveAttribute('data-state', 'unchecked');
+		});
+
+		it('sets data-state="checked" for checked state', () => {
+			render(
+				<CheckboxFilterV2ValueRow {...defaultProps} checkedState="checked" />,
+			);
+
+			const row = screen.getByTestId('checkbox-value-row-production');
+			expect(row).toHaveAttribute('data-state', 'checked');
+		});
+	});
+
+	describe('badge variations', () => {
+		it('renders no badge when badge=null', () => {
+			render(<CheckboxFilterV2ValueRow {...defaultProps} badge={null} />);
+
+			expect(screen.queryByTestId(/^badge-/)).not.toBeInTheDocument();
+		});
+
+		it('renders "Not in" warning badge', () => {
+			render(
+				<CheckboxFilterV2ValueRow
+					{...defaultProps}
+					badge={{ key: 'not_in', label: 'Not in', color: 'warning' }}
+				/>,
+			);
+
+			expect(screen.getByTestId('badge-not_in')).toBeInTheDocument();
+			expect(screen.getByText('Not in')).toBeInTheDocument();
+		});
+
+		it('renders "Related" robin badge', () => {
+			render(
+				<CheckboxFilterV2ValueRow
+					{...defaultProps}
+					badge={{ key: 'related', label: 'Related', color: 'robin' }}
+				/>,
+			);
+
+			expect(screen.getByTestId('badge-related')).toBeInTheDocument();
+			expect(screen.getByText('Related')).toBeInTheDocument();
+		});
+
+		it('renders "Other" secondary badge', () => {
+			render(
+				<CheckboxFilterV2ValueRow
+					{...defaultProps}
+					badge={{ key: 'other', label: 'Other', color: 'secondary' }}
+				/>,
+			);
+
+			expect(screen.getByTestId('badge-other')).toBeInTheDocument();
+			expect(screen.getByText('Other')).toBeInTheDocument();
+		});
+	});
+
+	describe('only/all button label', () => {
+		it('shows "Only" label by default', () => {
+			render(
+				<CheckboxFilterV2ValueRow {...defaultProps} onlyButtonLabel="Only" />,
+			);
+
+			expect(screen.getByText('Only')).toBeInTheDocument();
+		});
+
+		it('shows "All" label when appropriate', () => {
+			render(<CheckboxFilterV2ValueRow {...defaultProps} onlyButtonLabel="All" />);
+
+			expect(screen.getByText('All')).toBeInTheDocument();
+		});
+	});
+
+	describe('disabled state', () => {
+		it('sets data-disabled=true when disabled', () => {
+			render(<CheckboxFilterV2ValueRow {...defaultProps} disabled />);
+
+			const row = screen.getByTestId('checkbox-value-row-production');
+			expect(row).toHaveAttribute('data-disabled', 'true');
+		});
+
+		it('does not call onOnlyOrAllClick when disabled + clicked', async () => {
+			const user = userEvent.setup();
+			const onOnlyOrAllClick = jest.fn();
+			render(
+				<CheckboxFilterV2ValueRow
+					{...defaultProps}
+					disabled
+					onOnlyOrAllClick={onOnlyOrAllClick}
+				/>,
+			);
+
+			await user.click(screen.getByText('production'));
+
+			expect(onOnlyOrAllClick).not.toHaveBeenCalled();
+		});
+
+		it('does not call onOnlyOrAllClick on keydown when disabled', async () => {
+			const user = userEvent.setup();
+			const onOnlyOrAllClick = jest.fn();
+			render(
+				<CheckboxFilterV2ValueRow
+					{...defaultProps}
+					disabled
+					onOnlyOrAllClick={onOnlyOrAllClick}
+				/>,
+			);
+
+			screen.getByText('production').focus();
+			await user.keyboard('{Enter}');
+
+			expect(onOnlyOrAllClick).not.toHaveBeenCalled();
+		});
+	});
+
+	describe('special value indicators', () => {
+		it('renders row for "true" value', () => {
+			render(<CheckboxFilterV2ValueRow {...defaultProps} value="true" />);
+
+			expect(screen.getByTestId('checkbox-value-row-true')).toBeInTheDocument();
+			expect(screen.getByText('true')).toBeInTheDocument();
+		});
+
+		it('renders row for "false" value', () => {
+			render(<CheckboxFilterV2ValueRow {...defaultProps} value="false" />);
+
+			expect(screen.getByTestId('checkbox-value-row-false')).toBeInTheDocument();
+			expect(screen.getByText('false')).toBeInTheDocument();
+		});
+
+		it('renders row for regular values', () => {
+			render(<CheckboxFilterV2ValueRow {...defaultProps} value="production" />);
+
+			expect(
+				screen.getByTestId('checkbox-value-row-production'),
+			).toBeInTheDocument();
+			expect(screen.getByText('production')).toBeInTheDocument();
+		});
+	});
+
+	describe('interactions', () => {
+		it('renders checkbox with correct testId', () => {
+			render(
+				<CheckboxFilterV2ValueRow {...defaultProps} checkedState="unchecked" />,
+			);
+
+			expect(
+				screen.getByTestId('checkbox-Environment-production'),
+			).toBeInTheDocument();
+		});
+
+		it('calls onOnlyOrAllClick on value text click', async () => {
+			const user = userEvent.setup();
+			const onOnlyOrAllClick = jest.fn();
+			render(
+				<CheckboxFilterV2ValueRow
+					{...defaultProps}
+					onOnlyOrAllClick={onOnlyOrAllClick}
+				/>,
+			);
+
+			await user.click(screen.getByText('production'));
+
+			expect(onOnlyOrAllClick).toHaveBeenCalledTimes(1);
+		});
+
+		it('calls onOnlyOrAllClick on Enter key', async () => {
+			const user = userEvent.setup();
+			const onOnlyOrAllClick = jest.fn();
+			render(
+				<CheckboxFilterV2ValueRow
+					{...defaultProps}
+					onOnlyOrAllClick={onOnlyOrAllClick}
+				/>,
+			);
+
+			const valueButton = screen
+				.getByText('production')
+				.closest('[role="button"]');
+			await user.tab();
+			await user.tab();
+			if (valueButton && document.activeElement === valueButton) {
+				await user.keyboard('{Enter}');
+			}
+
+			expect(onOnlyOrAllClick).toHaveBeenCalled();
+		});
+
+		it('calls onOnlyOrAllClick on Space key', async () => {
+			const user = userEvent.setup();
+			const onOnlyOrAllClick = jest.fn();
+			render(
+				<CheckboxFilterV2ValueRow
+					{...defaultProps}
+					onOnlyOrAllClick={onOnlyOrAllClick}
+				/>,
+			);
+
+			const valueButton = screen
+				.getByText('production')
+				.closest('[role="button"]');
+			await user.tab();
+			await user.tab();
+			if (valueButton && document.activeElement === valueButton) {
+				await user.keyboard(' ');
+			}
+
+			expect(onOnlyOrAllClick).toHaveBeenCalled();
+		});
+
+		it('shows Toggle button', () => {
+			render(<CheckboxFilterV2ValueRow {...defaultProps} />);
+
+			expect(screen.getByText('Toggle')).toBeInTheDocument();
+		});
+	});
+
+	describe('custom renderer', () => {
+		it('uses customRendererForValue when provided', () => {
+			const customRenderer = (value: string): JSX.Element => (
+				<span data-testid="custom-render">{`Custom: ${value}`}</span>
+			);
+
+			render(
+				<CheckboxFilterV2ValueRow
+					{...defaultProps}
+					customRendererForValue={customRenderer}
+				/>,
+			);
+
+			expect(screen.getByTestId('custom-render')).toBeInTheDocument();
+			expect(screen.getByText('Custom: production')).toBeInTheDocument();
+		});
+
+		it('shows default value text when no custom renderer', () => {
+			render(<CheckboxFilterV2ValueRow {...defaultProps} />);
+
+			expect(screen.getByText('production')).toBeInTheDocument();
+		});
+	});
+
+	describe('state combinations', () => {
+		it('checked + not_in badge', () => {
+			render(
+				<CheckboxFilterV2ValueRow
+					{...defaultProps}
+					checkedState="unchecked"
+					badge={{ key: 'not_in', label: 'Not in', color: 'warning' }}
+				/>,
+			);
+
+			expect(screen.getByTestId('badge-not_in')).toBeInTheDocument();
+		});
+
+		it('disabled + badge still shows badge', () => {
+			render(
+				<CheckboxFilterV2ValueRow
+					{...defaultProps}
+					disabled
+					badge={{ key: 'other', label: 'Other', color: 'secondary' }}
+				/>,
+			);
+
+			expect(screen.getByTestId('badge-other')).toBeInTheDocument();
+		});
+	});
+});

frontend/src/components/QuickFilters/FilterRenderers/Checkbox/v2/__tests__/itemRules.test.ts

@@ -0,0 +1,131 @@
+import { deriveItemConfig, ItemContext, SectionType } from '../itemRules';
+
+describe('itemRules', () => {
+	describe('deriveItemConfig', () => {
+		it('no query at all → section selected, no badge', () => {
+			const ctx: ItemContext = {
+				isSelectedOnFilter: false,
+				isInRelatedValues: true,
+				isNotInOperator: false,
+				hasExistingQuery: false,
+				hasFilterForThisKey: false,
+			};
+
+			const result = deriveItemConfig(ctx);
+
+			expect(result.section).toBe(SectionType.SELECTED);
+			expect(result.badge).toBeNull();
+		});
+
+		it('selected + IN operator → section selected, no badge', () => {
+			const ctx: ItemContext = {
+				isSelectedOnFilter: true,
+				isInRelatedValues: true,
+				isNotInOperator: false,
+				hasExistingQuery: true,
+				hasFilterForThisKey: true,
+			};
+
+			const result = deriveItemConfig(ctx);
+
+			expect(result.section).toBe(SectionType.SELECTED);
+			expect(result.badge).toBeNull();
+		});
+
+		it('selected + NOT IN operator → section selected, no badge, unchecked', () => {
+			const ctx: ItemContext = {
+				isSelectedOnFilter: true,
+				isInRelatedValues: false,
+				isNotInOperator: true,
+				hasExistingQuery: true,
+				hasFilterForThisKey: true,
+			};
+
+			const result = deriveItemConfig(ctx);
+
+			expect(result.section).toBe(SectionType.SELECTED);
+			expect(result.badge).toBeNull();
+			expect(result.checkedState).toBe('unchecked');
+		});
+
+		it('has query, not selected, in related → section related, checked', () => {
+			const ctx: ItemContext = {
+				isSelectedOnFilter: false,
+				isInRelatedValues: true,
+				isNotInOperator: false,
+				hasExistingQuery: true,
+				hasFilterForThisKey: false,
+			};
+
+			const result = deriveItemConfig(ctx);
+
+			expect(result.section).toBe(SectionType.RELATED);
+			expect(result.badge).toBeNull();
+			expect(result.checkedState).toBe('checked');
+		});
+
+		it('has query, has filter for this key, in related → section related, checked', () => {
+			const ctx: ItemContext = {
+				isSelectedOnFilter: false,
+				isInRelatedValues: true,
+				isNotInOperator: false,
+				hasExistingQuery: true,
+				hasFilterForThisKey: true,
+			};
+
+			const result = deriveItemConfig(ctx);
+
+			expect(result.section).toBe(SectionType.RELATED);
+			expect(result.badge).toBeNull();
+			expect(result.checkedState).toBe('checked');
+		});
+
+		it('has query, not in related → section all_values, unchecked', () => {
+			const ctx: ItemContext = {
+				isSelectedOnFilter: false,
+				isInRelatedValues: false,
+				isNotInOperator: false,
+				hasExistingQuery: true,
+				hasFilterForThisKey: false,
+			};
+
+			const result = deriveItemConfig(ctx);
+
+			expect(result.section).toBe(SectionType.ALL_VALUES);
+			expect(result.badge).toBeNull();
+			expect(result.checkedState).toBe('unchecked');
+		});
+
+		it('has query + filter for key, not selected, not in related → section all_values, unchecked', () => {
+			const ctx: ItemContext = {
+				isSelectedOnFilter: false,
+				isInRelatedValues: false,
+				isNotInOperator: false,
+				hasExistingQuery: true,
+				hasFilterForThisKey: true,
+			};
+
+			const result = deriveItemConfig(ctx);
+
+			expect(result.section).toBe(SectionType.ALL_VALUES);
+			expect(result.badge).toBeNull();
+			expect(result.checkedState).toBe('unchecked');
+		});
+
+		it('no query but has filter for key, not selected → fallback to checked (DEFAULT_CONFIG)', () => {
+			const ctx: ItemContext = {
+				isSelectedOnFilter: false,
+				isInRelatedValues: false,
+				isNotInOperator: false,
+				hasExistingQuery: false,
+				hasFilterForThisKey: true,
+			};
+
+			const result = deriveItemConfig(ctx);
+
+			expect(result.section).toBe(SectionType.SELECTED);
+			expect(result.badge).toBeNull();
+			expect(result.checkedState).toBe('checked');
+		});
+	});
+});

frontend/src/components/QuickFilters/FilterRenderers/Checkbox/v2/__tests__/useSectionedValues.test.ts

@@ -0,0 +1,382 @@
+import { renderHook } from '@testing-library/react';
+
+import { SectionType } from '../itemRules';
+import { useSectionedValues, SectionedItem } from '../useSectionedValues';
+
+function flattenSections(
+	sections: { type: SectionType; items: SectionedItem[] }[],
+): SectionedItem[] {
+	return sections.flatMap((s) => s.items);
+}
+
+describe('useSectionedValues', () => {
+	const baseInput = {
+		relatedValues: ['val1', 'val2'],
+		allValues: ['val1', 'val2', 'val3'],
+		currentFilterState: {},
+		isSomeFilterPresentForCurrentAttribute: false,
+		isNotInOperator: false,
+		hasExistingQuery: false,
+		visibleItemsCount: 10,
+		relatedExclusions: [] as string[],
+	};
+
+	it('no query at all → all items in selected section, no badges', () => {
+		const { result } = renderHook(() =>
+			useSectionedValues({
+				...baseInput,
+				hasExistingQuery: false,
+				isSomeFilterPresentForCurrentAttribute: false,
+			}),
+		);
+
+		expect(result.current.sections).toHaveLength(1);
+		expect(result.current.sections[0].type).toBe(SectionType.SELECTED);
+		expect(result.current.sections[0].items).toHaveLength(3);
+		result.current.sections[0].items.forEach((item) => {
+			expect(item.badge).toBeNull();
+		});
+	});
+
+	it('has query, no filter for key → related and all_values sections', () => {
+		const { result } = renderHook(() =>
+			useSectionedValues({
+				...baseInput,
+				hasExistingQuery: true,
+				isSomeFilterPresentForCurrentAttribute: false,
+			}),
+		);
+
+		const allItems = flattenSections(result.current.sections);
+		const relatedItems = allItems.filter(
+			(item) => item.value === 'val1' || item.value === 'val2',
+		);
+		const otherItems = allItems.filter((item) => item.value === 'val3');
+
+		// Related values should be in related section, checked
+		relatedItems.forEach((item) => {
+			expect(item.section).toBe(SectionType.RELATED);
+			expect(item.checkedState).toBe('checked');
+		});
+
+		// Other values should be in all_values section, unchecked
+		otherItems.forEach((item) => {
+			expect(item.section).toBe(SectionType.ALL_VALUES);
+			expect(item.checkedState).toBe('unchecked');
+		});
+	});
+
+	it('has query + filter for key, selected value → in selected section', () => {
+		const { result } = renderHook(() =>
+			useSectionedValues({
+				...baseInput,
+				hasExistingQuery: true,
+				isSomeFilterPresentForCurrentAttribute: true,
+				currentFilterState: { val1: true, val2: false, val3: false },
+			}),
+		);
+
+		const allItems = flattenSections(result.current.sections);
+		const selectedItem = allItems.find((item) => item.value === 'val1');
+
+		expect(selectedItem?.section).toBe(SectionType.SELECTED);
+		expect(selectedItem?.badge).toBeNull();
+	});
+
+	it('has query + filter for key, NOT IN operator → excluded values in selected section, no badge', () => {
+		const { result } = renderHook(() =>
+			useSectionedValues({
+				...baseInput,
+				hasExistingQuery: true,
+				isSomeFilterPresentForCurrentAttribute: true,
+				isNotInOperator: true,
+				currentFilterState: { val1: false, val2: true, val3: true },
+			}),
+		);
+
+		const allItems = flattenSections(result.current.sections);
+		// val1 is unchecked + NOT IN = excluded
+		const excludedItem = allItems.find((item) => item.value === 'val1');
+
+		expect(excludedItem?.section).toBe(SectionType.SELECTED);
+		expect(excludedItem?.badge).toBeNull();
+		expect(excludedItem?.checkedState).toBe('unchecked');
+	});
+
+	it('items within same section sorted alphabetically', () => {
+		const { result } = renderHook(() =>
+			useSectionedValues({
+				...baseInput,
+				relatedValues: ['zebra', 'apple', 'mango'],
+				allValues: ['zebra', 'apple', 'mango'],
+				hasExistingQuery: false,
+				isSomeFilterPresentForCurrentAttribute: false,
+			}),
+		);
+
+		// All items have section selected, should be sorted alphabetically
+		const allItems = flattenSections(result.current.sections);
+		const values = allItems.map((item) => item.value);
+		expect(values).toStrictEqual(['apple', 'mango', 'zebra']);
+	});
+
+	describe('filtered results from API', () => {
+		it('keeps items in their natural sections with filtered API results', () => {
+			const { result } = renderHook(() =>
+				useSectionedValues({
+					...baseInput,
+					hasExistingQuery: true,
+					isSomeFilterPresentForCurrentAttribute: true,
+					currentFilterState: { val1: true },
+				}),
+			);
+
+			const sectionTypes = result.current.sections.map((s) => s.type);
+			expect(sectionTypes).toContain(SectionType.SELECTED);
+			expect(sectionTypes).toContain(SectionType.RELATED);
+		});
+
+		it('returns empty sections array when no values', () => {
+			const { result } = renderHook(() =>
+				useSectionedValues({
+					...baseInput,
+					relatedValues: [],
+					allValues: [],
+					hasExistingQuery: true,
+					isSomeFilterPresentForCurrentAttribute: false,
+					currentFilterState: {},
+				}),
+			);
+
+			expect(result.current.sections).toHaveLength(0);
+			expect(result.current.totalCount).toBe(0);
+		});
+
+		it('non-related items go to ALL_VALUES section', () => {
+			const { result } = renderHook(() =>
+				useSectionedValues({
+					...baseInput,
+					relatedValues: [],
+					allValues: ['other1', 'other2', 'other3'],
+					hasExistingQuery: true,
+					isSomeFilterPresentForCurrentAttribute: false,
+				}),
+			);
+
+			const allValuesSection = result.current.sections.find(
+				(s) => s.type === SectionType.ALL_VALUES,
+			);
+			expect(allValuesSection?.items).toHaveLength(3);
+		});
+
+		it('handles non-overlapping relatedValues and allValues correctly', () => {
+			// This tests the bug where different pod names in relatedValues vs allValues
+			// caused all items to go to ALL_VALUES instead of RELATED
+			const { result } = renderHook(() =>
+				useSectionedValues({
+					...baseInput,
+					relatedValues: ['pod-a-1', 'pod-b-1', 'pod-c-1'],
+					allValues: ['pod-a-2', 'pod-b-2', 'pod-c-2'],
+					hasExistingQuery: true,
+					isSomeFilterPresentForCurrentAttribute: false,
+				}),
+			);
+
+			const sectionTypes = result.current.sections.map((s) => s.type);
+
+			// RELATED section should exist with relatedValues items
+			expect(sectionTypes).toContain(SectionType.RELATED);
+			const relatedSection = result.current.sections.find(
+				(s) => s.type === SectionType.RELATED,
+			);
+			expect(relatedSection?.items).toHaveLength(3);
+			expect(relatedSection?.items.map((i) => i.value)).toStrictEqual(
+				expect.arrayContaining(['pod-a-1', 'pod-b-1', 'pod-c-1']),
+			);
+
+			// ALL_VALUES section should exist with allValues items
+			expect(sectionTypes).toContain(SectionType.ALL_VALUES);
+			const allValuesSection = result.current.sections.find(
+				(s) => s.type === SectionType.ALL_VALUES,
+			);
+			expect(allValuesSection?.items).toHaveLength(3);
+			expect(allValuesSection?.items.map((i) => i.value)).toStrictEqual(
+				expect.arrayContaining(['pod-a-2', 'pod-b-2', 'pod-c-2']),
+			);
+		});
+	});
+
+	describe('stale related values during refresh (relatedExclusions)', () => {
+		// Scenario: key A selected (existing query) + key B had value "oldSelected".
+		// User selects a different value on key B -> "oldSelected" is de-selected.
+		// keepPreviousData keeps the stale response where "oldSelected" is still in
+		// relatedValues, so it would wrongly render as "related". It is excluded.
+		it('subtracts only the excluded value from the RELATED section', () => {
+			const { result } = renderHook(() =>
+				useSectionedValues({
+					...baseInput,
+					currentFilterState: { newValue: true },
+					isSomeFilterPresentForCurrentAttribute: true,
+					hasExistingQuery: true,
+					// stale API data kept via keepPreviousData
+					relatedValues: ['oldSelected', 'otherRelated'],
+					allValues: ['newValue'],
+					relatedExclusions: ['oldSelected'],
+				}),
+			);
+
+			const allItems = flattenSections(result.current.sections);
+
+			// oldSelected must NOT render as related (dropped entirely - not in
+			// allValues nor selected)
+			expect(
+				allItems.find((item) => item.value === 'oldSelected'),
+			).toBeUndefined();
+
+			// other related values are kept
+			expect(allItems.find((item) => item.value === 'otherRelated')?.section).toBe(
+				SectionType.RELATED,
+			);
+		});
+
+		it('preserves every related value that is not the excluded (previously selected) one', () => {
+			const { result } = renderHook(() =>
+				useSectionedValues({
+					...baseInput,
+					currentFilterState: { newValue: true },
+					isSomeFilterPresentForCurrentAttribute: true,
+					hasExistingQuery: true,
+					// oldSelected was just de-selected; the rest are genuinely related
+					relatedValues: ['oldSelected', 'relatedA', 'relatedB', 'relatedC'],
+					allValues: ['newValue'],
+					relatedExclusions: ['oldSelected'],
+				}),
+			);
+
+			const relatedSection = result.current.sections.find(
+				(s) => s.type === SectionType.RELATED,
+			);
+			const relatedValues = relatedSection?.items.map((i) => i.value) ?? [];
+
+			// all non-excluded related values are kept
+			expect(relatedValues).toStrictEqual(['relatedA', 'relatedB', 'relatedC']);
+			// and they stay checked
+			relatedSection?.items.forEach((item) => {
+				expect(item.checkedState).toBe('checked');
+			});
+			// the excluded value is gone
+			expect(relatedValues).not.toContain('oldSelected');
+		});
+
+		it('keeps the RELATED section when other related values remain', () => {
+			const { result } = renderHook(() =>
+				useSectionedValues({
+					...baseInput,
+					currentFilterState: { newValue: true },
+					isSomeFilterPresentForCurrentAttribute: true,
+					hasExistingQuery: true,
+					relatedValues: ['oldSelected', 'otherRelated'],
+					allValues: ['newValue'],
+					relatedExclusions: ['oldSelected'],
+				}),
+			);
+
+			const sectionTypes = result.current.sections.map((s) => s.type);
+			expect(sectionTypes).toContain(SectionType.RELATED);
+			expect(sectionTypes).toContain(SectionType.SELECTED);
+		});
+
+		it('shows the excluded value normally when exclusions are empty', () => {
+			const { result } = renderHook(() =>
+				useSectionedValues({
+					...baseInput,
+					currentFilterState: { newValue: true },
+					isSomeFilterPresentForCurrentAttribute: true,
+					hasExistingQuery: true,
+					relatedValues: ['oldSelected', 'otherRelated'],
+					allValues: ['newValue'],
+					relatedExclusions: [],
+				}),
+			);
+
+			const allItems = flattenSections(result.current.sections);
+			expect(allItems.find((item) => item.value === 'oldSelected')?.section).toBe(
+				SectionType.RELATED,
+			);
+		});
+	});
+
+	describe('section ordering', () => {
+		it('sections appear in order: SELECTED → RELATED → ALL_VALUES', () => {
+			const { result } = renderHook(() =>
+				useSectionedValues({
+					...baseInput,
+					relatedValues: ['related1'],
+					allValues: ['all1'],
+					hasExistingQuery: true,
+					isSomeFilterPresentForCurrentAttribute: true,
+					currentFilterState: { selected1: true },
+				}),
+			);
+
+			const sectionTypes = result.current.sections.map((s) => s.type);
+
+			// Verify order
+			const selectedIdx = sectionTypes.indexOf(SectionType.SELECTED);
+			const relatedIdx = sectionTypes.indexOf(SectionType.RELATED);
+			const allValuesIdx = sectionTypes.indexOf(SectionType.ALL_VALUES);
+
+			expect(selectedIdx).toBeLessThan(relatedIdx);
+			expect(relatedIdx).toBeLessThan(allValuesIdx);
+		});
+
+		it('RELATED section appears before ALL_VALUES even with many items', () => {
+			const { result } = renderHook(() =>
+				useSectionedValues({
+					...baseInput,
+					relatedValues: ['r1', 'r2', 'r3', 'r4', 'r5'],
+					allValues: ['a1', 'a2', 'a3', 'a4', 'a5'],
+					hasExistingQuery: true,
+					isSomeFilterPresentForCurrentAttribute: false,
+					visibleItemsCount: 100,
+				}),
+			);
+
+			const sectionTypes = result.current.sections.map((s) => s.type);
+
+			expect(sectionTypes[0]).toBe(SectionType.RELATED);
+			expect(sectionTypes[1]).toBe(SectionType.ALL_VALUES);
+		});
+
+		it('visibleItemsCount limits total items across sections', () => {
+			const { result } = renderHook(() =>
+				useSectionedValues({
+					...baseInput,
+					relatedValues: ['r1', 'r2', 'r3'],
+					allValues: ['a1', 'a2', 'a3'],
+					hasExistingQuery: true,
+					isSomeFilterPresentForCurrentAttribute: false,
+					visibleItemsCount: 4,
+				}),
+			);
+
+			const totalItems = result.current.sections.reduce(
+				(sum, s) => sum + s.items.length,
+				0,
+			);
+			expect(totalItems).toBe(4);
+
+			// RELATED section should get priority (3 items)
+			const relatedSection = result.current.sections.find(
+				(s) => s.type === SectionType.RELATED,
+			);
+			expect(relatedSection?.items).toHaveLength(3);
+
+			// ALL_VALUES gets remaining (1 item)
+			const allValuesSection = result.current.sections.find(
+				(s) => s.type === SectionType.ALL_VALUES,
+			);
+			expect(allValuesSection?.items).toHaveLength(1);
+		});
+	});
+});

frontend/src/components/QuickFilters/FilterRenderers/Checkbox/v2/itemRules.ts

@@ -0,0 +1,118 @@
+import { CheckedState } from '../../../types';
+
+export enum SectionType {
+	SELECTED = 'selected',
+	RELATED = 'related',
+	ALL_VALUES = 'all_values',
+}
+
+export interface BadgeConfig {
+	key: string;
+	label: string;
+	color: 'robin' | 'warning' | 'secondary';
+}
+
+export interface ItemConfig {
+	section: SectionType;
+	badge: BadgeConfig | null;
+	checkedState: CheckedState;
+}
+
+export interface ItemContext {
+	isSelectedOnFilter: boolean;
+	isInRelatedValues: boolean;
+	isNotInOperator: boolean;
+	hasExistingQuery: boolean;
+	hasFilterForThisKey: boolean;
+}
+
+export interface DerivedItem extends ItemConfig {
+	value: string;
+}
+
+interface ItemRule {
+	condition: (ctx: ItemContext) => boolean;
+	config: ItemConfig;
+}
+
+const ITEM_RULES: ItemRule[] = [
+	// No existing query and no filter → all checked (selected section)
+	{
+		condition: (ctx): boolean =>
+			!ctx.hasExistingQuery && !ctx.hasFilterForThisKey,
+		config: {
+			section: SectionType.SELECTED,
+			badge: null,
+			checkedState: 'checked',
+		},
+	},
+	// Selected with NOT IN operator → unchecked, no badge
+	{
+		condition: (ctx): boolean => ctx.isSelectedOnFilter && ctx.isNotInOperator,
+		config: {
+			section: SectionType.SELECTED,
+			badge: null,
+			checkedState: 'unchecked',
+		},
+	},
+	// Selected with IN operator → checked
+	{
+		condition: (ctx): boolean => ctx.isSelectedOnFilter && !ctx.isNotInOperator,
+		config: {
+			section: SectionType.SELECTED,
+			badge: null,
+			checkedState: 'checked',
+		},
+	},
+	// Related values (from existing query) → checked
+	{
+		condition: (ctx): boolean => ctx.hasExistingQuery && ctx.isInRelatedValues,
+		config: {
+			section: SectionType.RELATED,
+			badge: null,
+			checkedState: 'checked',
+		},
+	},
+	// All values (has existing query but not related) → unchecked
+	{
+		condition: (ctx): boolean => ctx.hasExistingQuery,
+		config: {
+			section: SectionType.ALL_VALUES,
+			badge: null,
+			checkedState: 'unchecked',
+		},
+	},
+];
+
+// Fallback when no rule matches
+const DEFAULT_CONFIG: ItemConfig = {
+	section: SectionType.SELECTED,
+	badge: null,
+	checkedState: 'checked',
+};
+
+export function deriveItemConfig(ctx: ItemContext): ItemConfig {
+	for (const rule of ITEM_RULES) {
+		if (rule.condition(ctx)) {
+			return rule.config;
+		}
+	}
+	return DEFAULT_CONFIG;
+}
+
+export function deriveItems(
+	values: string[],
+	relatedSet: Set<string>,
+	selectedOnFilterSet: Set<string>,
+	ctx: Omit<ItemContext, 'isSelectedOnFilter' | 'isInRelatedValues'>,
+): DerivedItem[] {
+	return values.map((value) => {
+		const itemCtx: ItemContext = {
+			...ctx,
+			isSelectedOnFilter: selectedOnFilterSet.has(value),
+			isInRelatedValues: relatedSet.has(value),
+		};
+		const config = deriveItemConfig(itemCtx);
+		return { value, ...config };
+	});
+}

frontend/src/components/QuickFilters/FilterRenderers/Checkbox/v2/useExistingQuery.tsx

@@ -0,0 +1,61 @@
+import { useMemo } from 'react';
+import { useQueryBuilder } from 'hooks/queryBuilder/useQueryBuilder';
+import { convertFiltersToExpression } from 'components/QueryBuilderV2/utils';
+import { QuickFilterCheckboxUseFieldApis } from 'components/QuickFilters/types';
+
+interface UseExistingQueryParams {
+	useFieldApis: QuickFilterCheckboxUseFieldApis;
+	activeQueryIndex: number;
+}
+
+interface UseExistingQueryResult {
+	existingQuery: string | undefined;
+	hasExistingQuery: boolean;
+}
+
+export function useExistingQuery({
+	useFieldApis,
+	activeQueryIndex,
+}: UseExistingQueryParams): UseExistingQueryResult {
+	const { currentQuery } = useQueryBuilder();
+
+	const existingQuery = useMemo(() => {
+		if (useFieldApis.existingQuery === null) {
+			return undefined;
+		}
+
+		if (useFieldApis.existingQuery) {
+			return useFieldApis.existingQuery;
+		}
+
+		const queryData = currentQuery.builder.queryData?.[activeQueryIndex];
+
+		// Prefer V5 filter.expression
+		if (queryData?.filter?.expression) {
+			return queryData.filter.expression;
+		}
+
+		// Fall back to V3 filters.items
+		if (queryData?.filters?.items?.length) {
+			return convertFiltersToExpression(queryData.filters).expression;
+		}
+
+		return undefined;
+	}, [
+		useFieldApis.existingQuery,
+		currentQuery.builder.queryData,
+		activeQueryIndex,
+	]);
+
+	// Check if ANY filters exist in query (V3 items or V5 expression)
+	// This is separate from existingQuery because existingQuery can be explicitly
+	// disabled (null) while filters still exist in the query for UI purposes
+	const hasExistingQuery = useMemo(() => {
+		const queryData = currentQuery.builder.queryData?.[activeQueryIndex];
+		const hasV3Items = (queryData?.filters?.items?.length ?? 0) > 0;
+		const hasV5Expression = !!queryData?.filter?.expression;
+		return hasV3Items || hasV5Expression || !!existingQuery;
+	}, [currentQuery.builder.queryData, activeQueryIndex, existingQuery]);
+
+	return { existingQuery, hasExistingQuery };
+}

frontend/src/components/QuickFilters/FilterRenderers/Checkbox/v2/useFieldValues.tsx

@@ -0,0 +1,97 @@
+import { useMemo } from 'react';
+import { useGetFieldsValues } from 'api/generated/services/fields';
+import { TelemetrytypesSignalDTO } from 'api/generated/services/sigNoz.schemas';
+import { IQuickFiltersConfig } from 'components/QuickFilters/types';
+import { DataSource } from 'types/common/queryBuilder';
+import { FIELD_API_CACHE_TIME } from 'constants/queryCacheTime';
+
+interface UseFieldValuesProps {
+	filter: IQuickFiltersConfig;
+	searchText: string;
+	existingQuery?: string;
+	metricNamespace?: string;
+	startUnixMilli?: number;
+	endUnixMilli?: number;
+	enabled: boolean;
+}
+
+interface UseFieldValuesReturn {
+	relatedValues: string[];
+	allValues: string[];
+	isLoading: boolean;
+	isFetching: boolean;
+}
+
+const DATA_SOURCE_TO_SIGNAL: Record<DataSource, TelemetrytypesSignalDTO> = {
+	[DataSource.METRICS]: TelemetrytypesSignalDTO.metrics,
+	[DataSource.TRACES]: TelemetrytypesSignalDTO.traces,
+	[DataSource.LOGS]: TelemetrytypesSignalDTO.logs,
+};
+
+export function useFieldValues({
+	filter,
+	searchText,
+	existingQuery,
+	metricNamespace,
+	startUnixMilli,
+	endUnixMilli,
+	enabled,
+}: UseFieldValuesProps): UseFieldValuesReturn {
+	const { data, isLoading, isFetching } = useGetFieldsValues(
+		{
+			signal: filter.dataSource
+				? DATA_SOURCE_TO_SIGNAL[filter.dataSource]
+				: undefined,
+			name: filter.attributeKey.key,
+			searchText,
+			existingQuery,
+			metricNamespace,
+			startUnixMilli,
+			// This field does not affect the backend but I wanted to keep it here
+			// in case we add the support in the future
+			endUnixMilli,
+		},
+		{
+			query: {
+				enabled,
+				cacheTime: FIELD_API_CACHE_TIME,
+				keepPreviousData: true,
+			},
+		},
+	);
+
+	const relatedValues: string[] = useMemo(() => {
+		const values = data?.data?.values;
+		if (!values) {
+			return [];
+		}
+
+		return (
+			values.relatedValues?.filter(
+				(value): value is string =>
+					value !== null && value !== undefined && value !== '',
+			) || []
+		);
+	}, [data]);
+
+	const allValues: string[] = useMemo(() => {
+		const values = data?.data?.values;
+		if (!values) {
+			return [];
+		}
+
+		const stringValues =
+			values.stringValues?.filter(
+				(value): value is string =>
+					value !== null && value !== undefined && value !== '',
+			) || [];
+		const numberValues =
+			values.numberValues
+				?.filter((value): value is number => value !== null && value !== undefined)
+				.map((value) => value.toString()) || [];
+
+		return [...stringValues, ...numberValues];
+	}, [data]);
+
+	return { relatedValues, allValues, isLoading, isFetching };
+}

frontend/src/components/QuickFilters/FilterRenderers/Checkbox/v2/useSectionedValues.ts

@@ -0,0 +1,152 @@
+import { useMemo } from 'react';
+
+import { BadgeConfig, deriveItems, SectionType } from './itemRules';
+import { CheckedState } from '../../../types';
+
+interface SectionedValuesInput {
+	relatedValues: string[];
+	allValues: string[];
+	currentFilterState: Record<string, boolean>;
+	isSomeFilterPresentForCurrentAttribute: boolean;
+	isNotInOperator: boolean;
+	hasExistingQuery: boolean;
+	visibleItemsCount: number;
+	relatedExclusions: string[];
+}
+
+export interface SectionedItem {
+	value: string;
+	section: SectionType;
+	badge: BadgeConfig | null;
+	checkedState: CheckedState;
+}
+
+export interface Section {
+	type: SectionType;
+	items: SectionedItem[];
+}
+
+interface SectionedValuesOutput {
+	sections: Section[];
+	totalCount: number;
+}
+
+const SECTION_ORDER: SectionType[] = [
+	SectionType.SELECTED,
+	SectionType.RELATED,
+	SectionType.ALL_VALUES,
+];
+
+export function buildSelectedSet(
+	currentFilterState: Record<string, boolean>,
+	isSomeFilterPresentForCurrentAttribute: boolean,
+	isNotInOperator: boolean,
+): Set<string> {
+	const selectedSet = new Set<string>();
+	if (!isSomeFilterPresentForCurrentAttribute) {
+		return selectedSet;
+	}
+
+	for (const [val, isChecked] of Object.entries(currentFilterState)) {
+		// NOT IN: unchecked = explicitly excluded
+		// IN: checked = explicitly selected
+		const shouldAdd = isNotInOperator ? !isChecked : isChecked;
+		if (shouldAdd) {
+			selectedSet.add(val);
+		}
+	}
+	return selectedSet;
+}
+
+export function useSectionedValues({
+	relatedValues,
+	allValues,
+	currentFilterState,
+	isSomeFilterPresentForCurrentAttribute,
+	isNotInOperator,
+	hasExistingQuery,
+	visibleItemsCount,
+	relatedExclusions,
+}: SectionedValuesInput): SectionedValuesOutput {
+	const items = useMemo(() => {
+		const selectedSet = buildSelectedSet(
+			currentFilterState,
+			isSomeFilterPresentForCurrentAttribute,
+			isNotInOperator,
+		);
+
+		const exclusionSet = new Set(relatedExclusions);
+		const effectiveRelatedValues = relatedValues.filter(
+			(value) => !exclusionSet.has(value),
+		);
+
+		// Combine all values - API already filters both arrays by searchText
+		const allUniqueValues = Array.from(
+			new Set([...effectiveRelatedValues, ...allValues]),
+		);
+
+		// Include selected values at top - may not be in API response
+		const finalValues = [
+			...new Set([...Array.from(selectedSet), ...allUniqueValues]),
+		];
+		const relatedSet = new Set(effectiveRelatedValues);
+
+		return deriveItems(finalValues, relatedSet, selectedSet, {
+			isNotInOperator,
+			hasExistingQuery,
+			hasFilterForThisKey: isSomeFilterPresentForCurrentAttribute,
+		});
+	}, [
+		relatedValues,
+		allValues,
+		currentFilterState,
+		isSomeFilterPresentForCurrentAttribute,
+		isNotInOperator,
+		hasExistingQuery,
+		relatedExclusions,
+	]);
+
+	const sections = useMemo(() => {
+		// Group items by section
+		const sectionMap = new Map<SectionType, SectionedItem[]>();
+		for (const sectionType of SECTION_ORDER) {
+			sectionMap.set(sectionType, []);
+		}
+
+		for (const item of items) {
+			sectionMap.get(item.section)?.push(item);
+		}
+
+		// Sort items within each section alphabetically
+		for (const sectionItems of sectionMap.values()) {
+			sectionItems.sort((a, b) => a.value.localeCompare(b.value));
+		}
+
+		// Apply visibleItemsCount across all sections
+		let remaining = visibleItemsCount;
+		const result: Section[] = [];
+
+		for (const sectionType of SECTION_ORDER) {
+			const sectionItems = sectionMap.get(sectionType) || [];
+
+			if (sectionItems.length === 0) {
+				continue;
+			}
+
+			const itemsToTake = Math.min(sectionItems.length, remaining);
+			if (itemsToTake === 0) {
+				break;
+			}
+
+			result.push({
+				type: sectionType,
+				items: sectionItems.slice(0, itemsToTake),
+			});
+			remaining -= itemsToTake;
+		}
+
+		return result;
+	}, [items, visibleItemsCount]);
+
+	return { sections, totalCount: items.length };
+}

frontend/src/components/QuickFilters/FilterRenderers/Checkbox/v2/useStaleRelatedExclusions.ts

@@ -0,0 +1,36 @@
+import { useEffect, useMemo, useRef } from 'react';
+
+const EMPTY: string[] = [];
+
+interface UseStaleRelatedExclusionsParams {
+	selectedValues: string[];
+	isFetching: boolean;
+	isRefreshing: boolean;
+}
+
+export function useStaleRelatedExclusions({
+	selectedValues,
+	isFetching,
+	isRefreshing,
+}: UseStaleRelatedExclusionsParams): string[] {
+	const selectionAtLastFetchRef = useRef<string[]>(selectedValues);
+
+	useEffect(() => {
+		if (!isFetching) {
+			selectionAtLastFetchRef.current = selectedValues;
+		}
+	}, [isFetching, selectedValues]);
+
+	return useMemo(() => {
+		if (!isRefreshing) {
+			return EMPTY;
+		}
+
+		const current = new Set(selectedValues);
+		const removed = selectionAtLastFetchRef.current.filter(
+			(value) => !current.has(value),
+		);
+
+		return removed.length ? removed : EMPTY;
+	}, [isRefreshing, selectedValues]);
+}

frontend/src/components/QuickFilters/QuickFilters.tsx

@@ -32,6 +32,7 @@ import { Query } from 'types/api/queryBuilder/queryBuilderData';
 import { USER_ROLES } from 'types/roles';
 
 import Checkbox from './FilterRenderers/Checkbox/Checkbox';
+import CheckboxV2 from './FilterRenderers/Checkbox/v2/CheckboxFilterV2';
 import Duration from './FilterRenderers/Duration/Duration';
 import Slider from './FilterRenderers/Slider/Slider';
 import useFilterConfig from './hooks/useFilterConfig';
@@ -51,6 +52,7 @@ export default function QuickFilters(props: IQuickFiltersProps): JSX.Element {
 		signal,
 		showFilterCollapse = true,
 		showQueryName = true,
+		useFieldApis,
 	} = props;
 	const { user } = useAppContext();
 	const [isSettingsOpen, setIsSettingsOpen] = useState(false);
@@ -297,21 +299,45 @@ export default function QuickFilters(props: IQuickFiltersProps): JSX.Element {
 				{filterConfig.map((filter) => {
 					switch (filter.type) {
 						case FiltersType.CHECKBOX:
-							return (
+							return useFieldApis ? (
+								<CheckboxV2
+									key={filter.attributeKey.key}
+									source={source}
+									filter={filter}
+									onFilterChange={onFilterChange}
+									useFieldApis={useFieldApis}
+								/>
+							) : (
 								<Checkbox
+									key={filter.attributeKey.key}
 									source={source}
 									filter={filter}
 									onFilterChange={onFilterChange}
 								/>
 							);
 						case FiltersType.DURATION:
-							return <Duration filter={filter} onFilterChange={onFilterChange} />;
+							return (
+								<Duration
+									key={filter.attributeKey.key}
+									filter={filter}
+									onFilterChange={onFilterChange}
+								/>
+							);
 						case FiltersType.SLIDER:
-							return <Slider />;
+							return <Slider key={filter.attributeKey.key} />;
 						// eslint-disable-next-line sonarjs/no-duplicated-branches
 						default:
-							return (
+							return useFieldApis ? (
+								<CheckboxV2
+									key={filter.attributeKey.key}
+									source={source}
+									filter={filter}
+									onFilterChange={onFilterChange}
+									useFieldApis={useFieldApis}
+								/>
+							) : (
 								<Checkbox
+									key={filter.attributeKey.key}
 									source={source}
 									filter={filter}
 									onFilterChange={onFilterChange}
@@ -381,4 +407,5 @@ QuickFilters.defaultProps = {
 	config: [],
 	showFilterCollapse: true,
 	showQueryName: true,
+	useFieldApis: undefined,
 };

frontend/src/components/QuickFilters/types.ts

@@ -26,6 +26,11 @@ export enum SignalType {
 	METER_EXPLORER = 'meter',
 }
 
+/**
+ * Missing export from signozhq/ui/checkbox, TODO(H4ad): Add and remove this type definition
+ */
+export type CheckedState = 'checked' | 'unchecked' | 'indeterminate';
+
 export interface IQuickFiltersConfig {
 	type: FiltersType;
 	title: string;
@@ -46,6 +51,7 @@ export interface IQuickFiltersProps {
 	className?: string;
 	showFilterCollapse?: boolean;
 	showQueryName?: boolean;
+	useFieldApis?: QuickFilterCheckboxUseFieldApis;
 }
 
 export enum QuickFiltersSource {
@@ -56,3 +62,19 @@ export enum QuickFiltersSource {
 	EXCEPTIONS = 'exceptions',
 	METER_EXPLORER = 'meter',
 }
+
+/**
+ * Opt-in: fetch values from the /v1/fields/values API instead of /v3/autocomplete/attribute_values
+ */
+export type QuickFilterCheckboxUseFieldApis = {
+	startUnixMilli: number;
+	endUnixMilli: number;
+	/**
+	 * If you didn't specify a string, we automatically try to extract this from the currentQuery,
+	 * from the filter.expression or filter.items.
+	 *
+	 * Use null to ignore/disable this behavior.
+	 */
+	existingQuery?: string | null;
+	metricNamespace?: string;
+};

frontend/src/constants/query.ts

@@ -57,4 +57,7 @@ export enum QueryParams {
 	isTestAlert = 'isTestAlert',
 	yAxisUnit = 'yAxisUnit',
 	ruleName = 'ruleName',
+	matchType = 'matchType',
+	compareOp = 'compareOp',
+	evaluationWindowPreset = 'evaluationWindowPreset',
 }

frontend/src/constants/queryCacheTime.ts

@@ -1,3 +1,5 @@
 export const DASHBOARD_CACHE_TIME = 30_000;
 // keep it low or zero, otherwise, when enabled auto-refresh, this causes OOM due to accumulated queries in cache
 export const DASHBOARD_CACHE_TIME_ON_REFRESH_ENABLED = 0;
+
+export const FIELD_API_CACHE_TIME = 60_000;

frontend/src/container/CreateAlertV2/context/__tests__/CreateAlertProvider.prefill.test.tsx

@@ -0,0 +1,110 @@
+import { QueryClient, QueryClientProvider } from 'react-query';
+import { MemoryRouter } from 'react-router-dom';
+import { render, screen } from '@testing-library/react';
+import { AlertTypes } from 'types/api/alerts/alertTypes';
+
+import { CreateAlertProvider, useCreateAlertState } from '../index';
+
+// The provider only needs a query with a unit + empty builder for these assertions.
+jest.mock('hooks/queryBuilder/useQueryBuilder', () => ({
+	useQueryBuilder: (): unknown => ({
+		currentQuery: {
+			unit: 'bytes',
+			builder: { queryData: [], queryFormulas: [] },
+		},
+		redirectWithQueryBuilderData: jest.fn(),
+	}),
+}));
+
+const mutation = { mutate: jest.fn(), isLoading: false };
+jest.mock('api/generated/services/rules', () => ({
+	useCreateRule: (): unknown => mutation,
+	useTestRule: (): unknown => mutation,
+	useUpdateRuleByID: (): unknown => mutation,
+}));
+
+function Probe(): JSX.Element {
+	const { thresholdState, evaluationWindow } = useCreateAlertState();
+	return (
+		<div>
+			<span data-testid="match-type">{thresholdState.matchType}</span>
+			<span data-testid="operator">{thresholdState.operator}</span>
+			<span data-testid="threshold-count">{thresholdState.thresholds.length}</span>
+			<span data-testid="threshold-value">
+				{thresholdState.thresholds[0]?.thresholdValue}
+			</span>
+			<span data-testid="window-type">{evaluationWindow.windowType}</span>
+		</div>
+	);
+}
+
+function renderWithSearch(search: string): void {
+	const queryClient = new QueryClient({
+		defaultOptions: { queries: { retry: false } },
+	});
+	render(
+		<MemoryRouter initialEntries={[`/alerts/new${search}`]}>
+			<QueryClientProvider client={queryClient}>
+				<CreateAlertProvider initialAlertType={AlertTypes.METRICS_BASED_ALERT}>
+					<Probe />
+				</CreateAlertProvider>
+			</QueryClientProvider>
+		</MemoryRouter>,
+	);
+}
+
+function serializeThreshold(thresholdValue: number): string {
+	return encodeURIComponent(
+		JSON.stringify([
+			{
+				id: 't1',
+				label: 'critical',
+				thresholdValue,
+				recoveryThresholdValue: null,
+				unit: 'bytes',
+				channels: [],
+				color: '#F1575F',
+			},
+		]),
+	);
+}
+
+describe('CreateAlertProvider — URL-declared prefill (issue #5291)', () => {
+	it('applies matchType, operator, and thresholds without the meter window', () => {
+		// Dashboard-style prefill: no evaluationWindowPreset → default window.
+		renderWithSearch(
+			`?matchType=on_average&compareOp=below&thresholds=${serializeThreshold(90)}`,
+		);
+
+		expect(screen.getByTestId('match-type')).toHaveTextContent('on_average');
+		expect(screen.getByTestId('operator')).toHaveTextContent('below');
+		expect(screen.getByTestId('threshold-count')).toHaveTextContent('1');
+		expect(screen.getByTestId('threshold-value')).toHaveTextContent('90');
+		// The meter evaluation-window preset must NOT fire.
+		expect(screen.getByTestId('window-type')).toHaveTextContent('rolling');
+	});
+
+	it('adjusts only the occurrence type when no thresholds are supplied', () => {
+		renderWithSearch(`?matchType=in_total`);
+
+		expect(screen.getByTestId('match-type')).toHaveTextContent('in_total');
+		// The default single critical threshold and operator are retained.
+		expect(screen.getByTestId('threshold-count')).toHaveTextContent('1');
+		expect(screen.getByTestId('threshold-value')).toHaveTextContent('0');
+		expect(screen.getByTestId('operator')).toHaveTextContent('above');
+		expect(screen.getByTestId('window-type')).toHaveTextContent('rolling');
+	});
+
+	it('applies the meter evaluation window when the preset is declared', () => {
+		// Ingestion-style prefill: explicit in_total + meter preset.
+		renderWithSearch(
+			`?matchType=in_total&evaluationWindowPreset=meter&thresholds=${serializeThreshold(
+				500,
+			)}`,
+		);
+
+		expect(screen.getByTestId('match-type')).toHaveTextContent('in_total');
+		expect(screen.getByTestId('threshold-value')).toHaveTextContent('500');
+		expect(screen.getByTestId('window-type')).toHaveTextContent('cumulative');
+	});
+});

frontend/src/container/CreateAlertV2/context/__tests__/resolveUrlAlertPrefill.test.ts

@@ -0,0 +1,71 @@
+import { AlertThresholdMatchType, AlertThresholdOperator } from '../types';
+import {
+	EvaluationWindowPreset,
+	resolveUrlAlertPrefill,
+} from '../resolveUrlAlertPrefill';
+
+function resolve(search: string): ReturnType<typeof resolveUrlAlertPrefill> {
+	return resolveUrlAlertPrefill(new URLSearchParams(search));
+}
+
+describe('resolveUrlAlertPrefill', () => {
+	it('returns an empty plan when no params are present', () => {
+		expect(resolve('')).toStrictEqual({
+			thresholds: undefined,
+			matchType: undefined,
+			operator: undefined,
+			evaluationWindowPreset: undefined,
+		});
+	});
+
+	it('parses a thresholds array', () => {
+		const thresholds = [{ id: 't1', thresholdValue: 90 }];
+		const { thresholds: parsed } = resolve(
+			`thresholds=${encodeURIComponent(JSON.stringify(thresholds))}`,
+		);
+		expect(parsed).toStrictEqual(thresholds);
+	});
+
+	it('ignores malformed or non-array thresholds without throwing', () => {
+		const consoleError = jest
+			.spyOn(console, 'error')
+			.mockImplementation(() => undefined);
+
+		expect(resolve('thresholds=not-json').thresholds).toBeUndefined();
+		expect(
+			resolve(`thresholds=${encodeURIComponent('{"a":1}')}`).thresholds,
+		).toBeUndefined();
+
+		consoleError.mockRestore();
+	});
+
+	it('normalizes matchType aliases', () => {
+		expect(resolve('matchType=on_average').matchType).toBe(
+			AlertThresholdMatchType.ON_AVERAGE,
+		);
+		expect(resolve('matchType=sum').matchType).toBe(
+			AlertThresholdMatchType.IN_TOTAL,
+		);
+		expect(resolve('matchType=nonsense').matchType).toBeUndefined();
+	});
+
+	it('normalizes operator aliases', () => {
+		expect(resolve('compareOp=above').operator).toBe(
+			AlertThresholdOperator.IS_ABOVE,
+		);
+		expect(resolve('compareOp=%3E').operator).toBe(
+			AlertThresholdOperator.IS_ABOVE,
+		);
+		expect(resolve('compareOp=nonsense').operator).toBeUndefined();
+	});
+
+	it('recognizes the meter evaluation-window preset only', () => {
+		expect(resolve('evaluationWindowPreset=meter').evaluationWindowPreset).toBe(
+			EvaluationWindowPreset.METER,
+		);
+		expect(
+			resolve('evaluationWindowPreset=rolling').evaluationWindowPreset,
+		).toBeUndefined();
+		expect(resolve('').evaluationWindowPreset).toBeUndefined();
+	});
+});

frontend/src/container/CreateAlertV2/context/conditionNormalizers.ts

@@ -0,0 +1,63 @@
+import { AlertThresholdMatchType, AlertThresholdOperator } from './types';
+
+// Mirrors the backend's CompareOperator.Normalize() in
+// pkg/types/ruletypes/compare.go. Maps any accepted alias to the enum value
+// the dropdown understands. Returns undefined for aliases the UI does not
+// expose (e.g. above_or_equal, below_or_equal) so callers can keep the raw
+// value on screen instead of silently rewriting it.
+export function normalizeOperator(
+	raw: string | undefined,
+): AlertThresholdOperator | undefined {
+	switch (raw) {
+		case '1':
+		case 'above':
+		case '>':
+			return AlertThresholdOperator.IS_ABOVE;
+		case '2':
+		case 'below':
+		case '<':
+			return AlertThresholdOperator.IS_BELOW;
+		case '3':
+		case 'equal':
+		case 'eq':
+		case '=':
+			return AlertThresholdOperator.IS_EQUAL_TO;
+		case '4':
+		case 'not_equal':
+		case 'not_eq':
+		case '!=':
+			return AlertThresholdOperator.IS_NOT_EQUAL_TO;
+		case '7':
+		case 'outside_bounds':
+			return AlertThresholdOperator.ABOVE_BELOW;
+		default:
+			return undefined;
+	}
+}
+
+// Mirrors the backend's MatchType.Normalize() in pkg/types/ruletypes/match.go.
+export function normalizeMatchType(
+	raw: string | undefined,
+): AlertThresholdMatchType | undefined {
+	switch (raw) {
+		case '1':
+		case 'at_least_once':
+			return AlertThresholdMatchType.AT_LEAST_ONCE;
+		case '2':
+		case 'all_the_times':
+			return AlertThresholdMatchType.ALL_THE_TIME;
+		case '3':
+		case 'on_average':
+		case 'avg':
+			return AlertThresholdMatchType.ON_AVERAGE;
+		case '4':
+		case 'in_total':
+		case 'sum':
+			return AlertThresholdMatchType.IN_TOTAL;
+		case '5':
+		case 'last':
+			return AlertThresholdMatchType.LAST;
+		default:
+			return undefined;
+	}
+}

frontend/src/container/CreateAlertV2/context/index.tsx

@@ -23,10 +23,13 @@ import { mapQueryDataFromApi } from 'lib/newQueryBuilder/queryBuilderMappers/map
 import { AlertTypes } from 'types/api/alerts/alertTypes';
 
 import { INITIAL_CREATE_ALERT_STATE } from './constants';
+import {
+	EvaluationWindowPreset,
+	resolveUrlAlertPrefill,
+} from './resolveUrlAlertPrefill';
 import {
 	AdvancedOptionsAction,
 	AlertThresholdAction,
-	AlertThresholdMatchType,
 	CreateAlertAction,
 	CreateAlertSlice,
 	EvaluationWindowAction,
@@ -123,9 +126,13 @@ export function CreateAlertProvider(
 
 	const location = useLocation();
 	const queryParams = new URLSearchParams(location.search);
-	const thresholdsFromURL = queryParams.get(QueryParams.thresholds);
 	const ruleNameFromURL = queryParams.get(QueryParams.ruleName);
 	const yAxisUnitFromURL = queryParams.get(QueryParams.yAxisUnit);
+	// Prefill declared in the URL; applied verbatim, agnostic of the producer.
+	const urlPrefill = useMemo(
+		() => resolveUrlAlertPrefill(new URLSearchParams(location.search)),
+		[location.search],
+	);
 
 	const [alertType, setAlertType] = useState<AlertTypes>(() => {
 		if (isEditMode) {
@@ -168,32 +175,41 @@ export function CreateAlertProvider(
 			},
 		});
 
-		if (thresholdsFromURL) {
-			try {
-				const thresholds = JSON.parse(thresholdsFromURL);
-				setCreateAlertState({
-					slice: CreateAlertSlice.THRESHOLD,
-					action: {
-						type: 'SET_THRESHOLDS',
-						payload: thresholds,
-					},
-				});
-			} catch (error) {
-				console.error('Error parsing thresholds from URL:', error);
-			}
-
+		if (urlPrefill.thresholds) {
 			setCreateAlertState({
-				slice: CreateAlertSlice.EVALUATION_WINDOW,
+				slice: CreateAlertSlice.THRESHOLD,
 				action: {
-					type: 'SET_INITIAL_STATE_FOR_METER',
+					type: 'SET_THRESHOLDS',
+					payload: urlPrefill.thresholds,
 				},
 			});
+		}
 
+		if (urlPrefill.matchType) {
 			setCreateAlertState({
 				slice: CreateAlertSlice.THRESHOLD,
 				action: {
 					type: 'SET_MATCH_TYPE',
-					payload: AlertThresholdMatchType.IN_TOTAL,
+					payload: urlPrefill.matchType,
+				},
+			});
+		}
+
+		if (urlPrefill.operator) {
+			setCreateAlertState({
+				slice: CreateAlertSlice.THRESHOLD,
+				action: {
+					type: 'SET_OPERATOR',
+					payload: urlPrefill.operator,
+				},
+			});
+		}
+
+		if (urlPrefill.evaluationWindowPreset === EvaluationWindowPreset.METER) {
+			setCreateAlertState({
+				slice: CreateAlertSlice.EVALUATION_WINDOW,
+				action: {
+					type: 'SET_INITIAL_STATE_FOR_METER',
 				},
 			});
 		}
@@ -219,7 +235,7 @@ export function CreateAlertProvider(
 				},
 			});
 		}
-	}, [alertType, thresholdsFromURL, ruleNameFromURL, yAxisUnitFromURL]);
+	}, [alertType, urlPrefill, ruleNameFromURL, yAxisUnitFromURL]);
 
 	useEffect(() => {
 		if (isEditMode && initialAlertState) {

frontend/src/container/CreateAlertV2/context/resolveUrlAlertPrefill.ts

@@ -0,0 +1,54 @@
+import { QueryParams } from 'constants/query';
+
+import { normalizeMatchType, normalizeOperator } from './conditionNormalizers';
+import {
+	AlertThresholdMatchType,
+	AlertThresholdOperator,
+	Threshold,
+} from './types';
+
+export enum EvaluationWindowPreset {
+	METER = 'meter',
+}
+
+export interface ResolvedAlertPrefill {
+	thresholds?: Threshold[];
+	matchType?: AlertThresholdMatchType;
+	operator?: AlertThresholdOperator;
+	evaluationWindowPreset?: EvaluationWindowPreset;
+}
+
+function parseThresholds(raw: string | null): Threshold[] | undefined {
+	if (!raw) {
+		return undefined;
+	}
+	try {
+		const parsed = JSON.parse(raw);
+		return Array.isArray(parsed) ? (parsed as Threshold[]) : undefined;
+	} catch (error) {
+		console.error('Error parsing thresholds from URL:', error);
+		return undefined;
+	}
+}
+
+function parseEvaluationWindowPreset(
+	raw: string | null,
+): EvaluationWindowPreset | undefined {
+	return raw === EvaluationWindowPreset.METER
+		? EvaluationWindowPreset.METER
+		: undefined;
+}
+
+/** URL → declarative prefill plan; the consumer applies it without knowing the producer. */
+export function resolveUrlAlertPrefill(
+	params: URLSearchParams,
+): ResolvedAlertPrefill {
+	return {
+		thresholds: parseThresholds(params.get(QueryParams.thresholds)),
+		matchType: normalizeMatchType(params.get(QueryParams.matchType) ?? undefined),
+		operator: normalizeOperator(params.get(QueryParams.compareOp) ?? undefined),
+		evaluationWindowPreset: parseEvaluationWindowPreset(
+			params.get(QueryParams.evaluationWindowPreset),
+		),
+	};
+}

frontend/src/container/CreateAlertV2/utils.tsx

@@ -238,67 +238,12 @@ export function getAdvancedOptionsStateFromAlertDef(
 	};
 }
 
-// Mirrors the backend's CompareOperator.Normalize() in
-// pkg/types/ruletypes/compare.go. Maps any accepted alias to the enum value
-// the dropdown understands. Returns undefined for aliases the UI does not
-// expose (e.g. above_or_equal, below_or_equal) so callers can keep the raw
-// value on screen instead of silently rewriting it.
-export function normalizeOperator(
-	raw: string | undefined,
-): AlertThresholdOperator | undefined {
-	switch (raw) {
-		case '1':
-		case 'above':
-		case '>':
-			return AlertThresholdOperator.IS_ABOVE;
-		case '2':
-		case 'below':
-		case '<':
-			return AlertThresholdOperator.IS_BELOW;
-		case '3':
-		case 'equal':
-		case 'eq':
-		case '=':
-			return AlertThresholdOperator.IS_EQUAL_TO;
-		case '4':
-		case 'not_equal':
-		case 'not_eq':
-		case '!=':
-			return AlertThresholdOperator.IS_NOT_EQUAL_TO;
-		case '7':
-		case 'outside_bounds':
-			return AlertThresholdOperator.ABOVE_BELOW;
-		default:
-			return undefined;
-	}
-}
-
-// Mirrors the backend's MatchType.Normalize() in pkg/types/ruletypes/match.go.
-export function normalizeMatchType(
-	raw: string | undefined,
-): AlertThresholdMatchType | undefined {
-	switch (raw) {
-		case '1':
-		case 'at_least_once':
-			return AlertThresholdMatchType.AT_LEAST_ONCE;
-		case '2':
-		case 'all_the_times':
-			return AlertThresholdMatchType.ALL_THE_TIME;
-		case '3':
-		case 'on_average':
-		case 'avg':
-			return AlertThresholdMatchType.ON_AVERAGE;
-		case '4':
-		case 'in_total':
-		case 'sum':
-			return AlertThresholdMatchType.IN_TOTAL;
-		case '5':
-		case 'last':
-			return AlertThresholdMatchType.LAST;
-		default:
-			return undefined;
-	}
-}
+// Condition-alias normalizers live in a leaf module (they depend only on the
+// enums) so `context/index` can consume them without an index↔utils cycle.
+export {
+	normalizeOperator,
+	normalizeMatchType,
+} from './context/conditionNormalizers';
 
 export function getThresholdStateFromAlertDef(
 	alertDef: PostableAlertRuleV2,

frontend/src/container/InfraMonitoringHostsV2/Hosts.tsx

@@ -1,4 +1,4 @@
-import { useCallback, useEffect, useRef, useState } from 'react';
+import { useCallback, useEffect, useMemo, useRef, useState } from 'react';
 import { Button, Tooltip } from 'antd';
 import { Typography } from '@signozhq/ui/typography';
 import { convertToApiError } from 'api/ErrorResponseHandlerForGeneratedAPIs';
@@ -23,7 +23,10 @@ import K8sBaseDetails, {
 import { K8sBaseList } from 'container/InfraMonitoringK8sV2/Base/K8sBaseList';
 import StatusFilter from 'container/InfraMonitoringHostsV2/StatusFilter';
 import { K8sBaseFilters } from 'container/InfraMonitoringK8sV2/Base/types';
-import { InfraMonitoringEntity } from 'container/InfraMonitoringK8sV2/constants';
+import {
+	InfraMonitoringEntity,
+	METRIC_NAMESPACE_BY_ENTITY,
+} from 'container/InfraMonitoringK8sV2/constants';
 import { useGetCompositeQueryParam } from 'hooks/queryBuilder/useGetCompositeQueryParam';
 import { useQueryBuilder } from 'hooks/queryBuilder/useQueryBuilder';
 import { useAppContext } from 'providers/App/App';
@@ -47,6 +50,7 @@ import { getHostsQuickFiltersConfig } from './utils';
 
 import styles from './InfraMonitoringHosts.module.scss';
 import { ArrowUpToLine, Filter } from '@signozhq/icons';
+import { NANO_SECOND_MULTIPLIER, useGlobalTimeStore } from 'store/globalTime';
 
 function Hosts(): JSX.Element {
 	const [showFilters, setShowFilters] = useState(true);
@@ -55,6 +59,17 @@ function Hosts(): JSX.Element {
 	const { redirectWithQueryBuilderData } = useQueryBuilder();
 	const isInitialized = useRef(false);
 
+	const selectedTime = useGlobalTimeStore((state) => state.selectedTime);
+	const getMinMaxTime = useGlobalTimeStore((state) => state.getMinMaxTime);
+	const { startUnixMilli, endUnixMilli } = useMemo(() => {
+		const { minTime, maxTime } = getMinMaxTime();
+		return {
+			startUnixMilli: Math.floor(minTime / NANO_SECOND_MULTIPLIER),
+			endUnixMilli: Math.floor(maxTime / NANO_SECOND_MULTIPLIER),
+		};
+		// eslint-disable-next-line react-hooks/exhaustive-deps
+	}, [selectedTime, getMinMaxTime]);
+
 	useEffect(() => {
 		if (isInitialized.current) {
 			return;
@@ -210,6 +225,12 @@ function Hosts(): JSX.Element {
 								source={QuickFiltersSource.INFRA_MONITORING}
 								config={getHostsQuickFiltersConfig(dotMetricsEnabled)}
 								handleFilterVisibilityChange={handleFilterVisibilityChange}
+								useFieldApis={{
+									metricNamespace:
+										METRIC_NAMESPACE_BY_ENTITY[InfraMonitoringEntity.HOSTS],
+									startUnixMilli,
+									endUnixMilli,
+								}}
 							/>
 						</div>
 					)}

frontend/src/container/InfraMonitoringK8sV2/InfraMonitoringK8s.tsx

@@ -3,7 +3,10 @@ import * as Sentry from '@sentry/react';
 import { Button, Tooltip } from 'antd';
 import { Typography } from '@signozhq/ui/typography';
 import QuickFilters from 'components/QuickFilters/QuickFilters';
-import { QuickFiltersSource } from 'components/QuickFilters/types';
+import {
+	QuickFilterCheckboxUseFieldApis,
+	QuickFiltersSource,
+} from 'components/QuickFilters/types';
 import { initialQueriesMap } from 'constants/queryBuilder';
 import { useGetCompositeQueryParam } from 'hooks/queryBuilder/useGetCompositeQueryParam';
 import { useQueryBuilder } from 'hooks/queryBuilder/useQueryBuilder';
@@ -36,7 +39,9 @@ import {
 	GetPodsQuickFiltersConfig,
 	GetStatefulsetsQuickFiltersConfig,
 	GetVolumesQuickFiltersConfig,
+	InfraMonitoringEntity,
 	K8sCategories,
+	METRIC_NAMESPACE_BY_ENTITY,
 } from './constants';
 import K8sDaemonSetsList from './DaemonSets/K8sDaemonSetsList';
 import K8sDeploymentsList from './Deployments/K8sDeploymentsList';
@@ -56,6 +61,7 @@ import K8sVolumesList from './Volumes/K8sVolumesList';
 import styles from './InfraMonitoringK8s.module.scss';
 import { InfraMonitoringEvents } from 'constants/events';
 import logEvent from 'api/common/logEvent';
+import { NANO_SECOND_MULTIPLIER, useGlobalTimeStore } from 'store/globalTime';
 
 export default function InfraMonitoringK8s(): JSX.Element {
 	const [showFilters, setShowFilters] = useState(true);
@@ -69,6 +75,31 @@ export default function InfraMonitoringK8s(): JSX.Element {
 	const { currentQuery, redirectWithQueryBuilderData } = useQueryBuilder();
 	const isInitialized = useRef(false);
 
+	const selectedTime = useGlobalTimeStore((state) => state.selectedTime);
+	const getMinMaxTime = useGlobalTimeStore((state) => state.getMinMaxTime);
+	const { startUnixMilli, endUnixMilli } = useMemo(() => {
+		const { minTime, maxTime } = getMinMaxTime();
+		return {
+			startUnixMilli: Math.floor(minTime / NANO_SECOND_MULTIPLIER),
+			endUnixMilli: Math.floor(maxTime / NANO_SECOND_MULTIPLIER),
+		};
+		// eslint-disable-next-line react-hooks/exhaustive-deps
+	}, [selectedTime, getMinMaxTime]);
+
+	const getUseFieldApis = useCallback(
+		(entity: InfraMonitoringEntity): QuickFilterCheckboxUseFieldApis => ({
+			metricNamespace: METRIC_NAMESPACE_BY_ENTITY[entity],
+			startUnixMilli,
+			endUnixMilli,
+		}),
+		[startUnixMilli, endUnixMilli],
+	);
+
+	const selectedCategoryUseFieldApis = useMemo(
+		() => getUseFieldApis(selectedCategory as InfraMonitoringEntity),
+		[getUseFieldApis, selectedCategory],
+	);
+
 	useEffect(() => {
 		if (isInitialized.current) {
 			return;
@@ -269,6 +300,7 @@ export default function InfraMonitoringK8s(): JSX.Element {
 										source={QuickFiltersSource.INFRA_MONITORING}
 										config={selectedCategoryConfig}
 										handleFilterVisibilityChange={handleFilterVisibilityChange}
+										useFieldApis={selectedCategoryUseFieldApis}
 									/>
 								)}
 							</div>

frontend/src/container/IngestionSettings/MultiIngestionSettings.tsx

@@ -48,6 +48,8 @@ import { QueryParams } from 'constants/query';
 import { initialQueryMeterWithType } from 'constants/queryBuilder';
 import ROUTES from 'constants/routes';
 import { INITIAL_ALERT_THRESHOLD_STATE } from 'container/CreateAlertV2/context/constants';
+import { EvaluationWindowPreset } from 'container/CreateAlertV2/context/resolveUrlAlertPrefill';
+import { AlertThresholdMatchType } from 'container/CreateAlertV2/context/types';
 import dayjs from 'dayjs';
 import { convertToApiError } from 'api/ErrorResponseHandlerForGeneratedAPIs';
 import { useGetGlobalConfig } from 'api/generated/services/global';
@@ -907,6 +909,7 @@ function MultiIngestionSettings(): JSX.Element {
 			? `[ingestion][${signal.signal}] ${keyName} has exceeded daily ingestion limit`
 			: `[ingestion][${signal.signal}] ${signal.signal} has exceeded daily ingestion limit`;
 
+		// Declare the metering prefill explicitly: "in total" + the meter window.
 		const URL = `${ROUTES.ALERTS_NEW}?${
 			QueryParams.compositeQuery
 		}=${encodeURIComponent(stringifiedQuery)}&${
@@ -915,7 +918,9 @@ function MultiIngestionSettings(): JSX.Element {
 			QueryParams.ruleName
 		}=${encodeURIComponent(ruleName)}&${
 			QueryParams.yAxisUnit
-		}=${encodeURIComponent(yAxisUnit)}`;
+		}=${encodeURIComponent(yAxisUnit)}&${QueryParams.matchType}=${
+			AlertThresholdMatchType.IN_TOTAL
+		}&${QueryParams.evaluationWindowPreset}=${EvaluationWindowPreset.METER}`;
 
 		history.push(URL);
 	};

frontend/src/container/LogsExplorerViews/LogsExplorerViews.styles.scss

@@ -182,6 +182,14 @@
 				flex: 1;
 				min-height: 0;
 				overflow-y: visible;
+
+				.table-view-container-header {
+					display: flex;
+					justify-content: flex-end;
+					align-items: center;
+					padding: 12px;
+					flex-shrink: 0;
+				}
 			}
 
 			.time-series-view-container {

frontend/src/container/LogsExplorerViews/index.tsx

@@ -18,13 +18,18 @@ import { ENTITY_VERSION_V5 } from 'constants/app';
 import { LOCALSTORAGE } from 'constants/localStorage';
 import { AVAILABLE_EXPORT_PANEL_TYPES } from 'constants/panelTypes';
 import { QueryParams } from 'constants/query';
-import { initialFilters, PANEL_TYPES } from 'constants/queryBuilder';
+import {
+	initialFilters,
+	initialQueriesMap,
+	PANEL_TYPES,
+} from 'constants/queryBuilder';
 import { DEFAULT_PER_PAGE_VALUE } from 'container/Controls/config';
 import ExplorerOptionWrapper from 'container/ExplorerOptions/ExplorerOptionWrapper';
 import { ChangeViewFunctionType } from 'container/ExplorerOptions/types';
 import GoToTop from 'container/GoToTop';
 import LogsExplorerChart from 'container/LogsExplorerChart';
 import LogsExplorerList from 'container/LogsExplorerList';
+import ExportMenu from 'components/ExportMenu/ExportMenu';
 import LogsExplorerTable from 'container/LogsExplorerTable';
 import {
 	getExportQueryData,
@@ -484,6 +489,16 @@ function LogsExplorerViewsContainer({
 					)}
 					{selectedPanelType === PANEL_TYPES.TABLE && !showLiveLogs && (
 						<div className="table-view-container">
+							{data && !isError && (
+								<div className="table-view-container-header">
+									<ExportMenu
+										dataSource={DataSource.LOGS}
+										data={data}
+										query={stagedQuery || initialQueriesMap.metrics}
+										fileName="logs-table"
+									/>
+								</div>
+							)}
 							<LogsExplorerTable
 								data={
 									(data?.payload?.data?.newResult?.data?.result ||

frontend/src/container/TimeSeriesView/TimeSeriesView.tsx

@@ -48,7 +48,7 @@ import { GlobalReducer } from 'types/reducer/globalTime';
 import uPlot from 'uplot';
 import { getTimeRange } from 'utils/getTimeRange';
 
-import TimeseriesExportMenu from './TimeseriesExportMenu';
+import ExportMenu from 'components/ExportMenu/ExportMenu';
 
 import './TimeSeriesView.styles.scss';
 
@@ -265,12 +265,11 @@ function TimeSeriesView({
 						)}
 					</div>
 					{showExport && data?.rawV5Response && (
-						<TimeseriesExportMenu
+						<ExportMenu
 							dataSource={dataSource}
 							yAxisUnit={yAxisUnit}
-							queryResponse={data.rawV5Response}
+							data={data}
 							query={currentQuery}
-							legendMap={data.legendMap}
 							fileName={`${dataSource}-timeseries`}
 						/>
 					)}

frontend/src/container/TimeSeriesView/__tests__/TimeSeriesView.test.tsx

@@ -13,7 +13,7 @@ jest.mock('components/Uplot', () => ({
 	default: (): JSX.Element => <div data-testid="uplot-chart" />,
 }));
 
-jest.mock('../TimeseriesExportMenu', () => ({
+jest.mock('components/ExportMenu/ExportMenu', () => ({
 	__esModule: true,
 	default: (): JSX.Element => <div data-testid="timeseries-export-menu" />,
 }));

frontend/src/container/TracesExplorer/TableView/TableView.styles.scss

@@ -0,0 +1,7 @@
+.traces-table-view-header {
+	display: flex;
+	justify-content: flex-end;
+	align-items: center;
+	padding: 12px;
+	flex-shrink: 0;
+}

frontend/src/container/TracesExplorer/TableView/index.tsx

@@ -10,6 +10,7 @@ import {
 import { useSelector } from 'react-redux';
 import { Space } from 'antd';
 import ErrorInPlace from 'components/ErrorInPlace/ErrorInPlace';
+import ExportMenu from 'components/ExportMenu/ExportMenu';
 import { ENTITY_VERSION_V5 } from 'constants/app';
 import { initialQueriesMap, PANEL_TYPES } from 'constants/queryBuilder';
 import { REACT_QUERY_KEY } from 'constants/reactQueryKeys';
@@ -20,8 +21,11 @@ import { AppState } from 'store/reducers';
 import { Warning } from 'types/api';
 import APIError from 'types/api/error';
 import { QueryDataV3 } from 'types/api/widgets/getQuery';
+import { DataSource } from 'types/common/queryBuilder';
 import { GlobalReducer } from 'types/reducer/globalTime';
 
+import './TableView.styles.scss';
+
 function TableView({
 	setWarning,
 	setIsLoadingQueries,
@@ -97,6 +101,16 @@ function TableView({
 	return (
 		<Space.Compact block direction="vertical">
 			{isError && error && <ErrorInPlace error={error as APIError} />}
+			{!isError && data && (
+				<div className="traces-table-view-header">
+					<ExportMenu
+						dataSource={DataSource.TRACES}
+						data={data}
+						query={stagedQuery || initialQueriesMap.traces}
+						fileName="traces-table"
+					/>
+				</div>
+			)}
 			{!isError && (
 				<QueryTable
 					query={stagedQuery || initialQueriesMap.traces}

frontend/src/hooks/useExportData/__tests__/useClientExport.test.ts

@@ -4,7 +4,8 @@ import {
 	getTimestampedFileName,
 } from 'lib/exportData/downloadFile';
 import { ExportFormat } from 'lib/exportData/types';
-import { QueryRangeResponseV5 } from 'types/api/v5/queryRange';
+import { MetricQueryRangeSuccessResponse } from 'types/api/metrics/getQueryRange';
+import { Query } from 'types/api/queryBuilder/queryBuilderData';
 
 import { useClientExport } from '../useClientExport';
 
@@ -24,31 +25,87 @@ jest.mock('antd', () => {
 
 const mockDownloadFile = downloadFile as jest.Mock;
 
-function timeSeriesResponse(): QueryRangeResponseV5 {
+const query = {
+	queryType: 'builder',
+	builder: {
+		queryData: [
+			{
+				queryName: 'A',
+				dataSource: 'logs',
+				aggregations: [{ expression: 'count()' }],
+				groupBy: [],
+				legend: '',
+			},
+		],
+		queryFormulas: [],
+	},
+} as unknown as Query;
+
+function timeSeriesData(): MetricQueryRangeSuccessResponse {
 	return {
-		type: 'time_series',
-		data: {
-			results: [
-				{
-					queryName: 'A',
-					aggregations: [
-						{
-							index: 0,
-							alias: '',
-							meta: {},
-							series: [
-								{
-									labels: [{ key: { name: 'service' }, value: 'a' }],
-									values: [{ timestamp: 1000, value: 12 }],
-								},
-							],
-						},
-					],
-				},
-			],
+		statusCode: 200,
+		error: null,
+		message: '',
+		payload: { data: { result: [], resultType: 'time_series' } },
+		legendMap: { A: '{{service}}' },
+		rawV5Response: {
+			type: 'time_series',
+			data: {
+				results: [
+					{
+						queryName: 'A',
+						aggregations: [
+							{
+								index: 0,
+								alias: '',
+								meta: {},
+								series: [
+									{
+										labels: [{ key: { name: 'service' }, value: 'a' }],
+										values: [{ timestamp: 1000, value: 12 }],
+									},
+								],
+							},
+						],
+					},
+				],
+			},
+			meta: {},
 		},
-		meta: {},
-	} as unknown as QueryRangeResponseV5;
+	} as unknown as MetricQueryRangeSuccessResponse;
+}
+
+function scalarData(): MetricQueryRangeSuccessResponse {
+	return {
+		statusCode: 200,
+		error: null,
+		message: '',
+		payload: {
+			data: {
+				resultType: 'scalar',
+				result: [
+					{
+						queryName: 'A',
+						legend: '',
+						series: null,
+						list: null,
+						table: {
+							columns: [
+								{
+									name: 'service.name',
+									id: 'service.name',
+									queryName: 'A',
+									isValueColumn: false,
+								},
+								{ name: 'count()', id: 'A', queryName: 'A', isValueColumn: true },
+							],
+							rows: [{ data: { 'service.name': 'frontend', A: 120 } }],
+						},
+					},
+				],
+			},
+		},
+	} as unknown as MetricQueryRangeSuccessResponse;
 }
 
 describe('useClientExport', () => {
@@ -64,13 +121,9 @@ describe('useClientExport', () => {
 		jest.useRealTimers();
 	});
 
-	it('exports time_series as CSV to a timestamped <fileName>.csv', () => {
+	it('dispatches timeseries data to the timeseries serializer (csv)', () => {
 		const { result } = renderHook(() =>
-			useClientExport({
-				response: timeSeriesResponse(),
-				fileName: 'chart',
-				legendMap: { A: '{{service}}' },
-			}),
+			useClientExport({ data: timeSeriesData(), query, fileName: 'chart' }),
 		);
 
 		act(() => {
@@ -83,12 +136,28 @@ describe('useClientExport', () => {
 		expect(name).toBe(getTimestampedFileName('chart', 'csv'));
 		expect(mime).toContain('text/csv');
 		expect(content).toContain('service');
-		expect(content).toContain('a');
 	});
 
-	it('exports as JSONL to a timestamped <fileName>.jsonl with the ndjson mime', () => {
+	it('dispatches scalar (table) data to the table serializer', () => {
 		const { result } = renderHook(() =>
-			useClientExport({ response: timeSeriesResponse() }),
+			useClientExport({ data: scalarData(), query, fileName: 'table' }),
+		);
+
+		act(() => {
+			result.current.handleExport({ format: ExportFormat.Csv });
+		});
+
+		expect(mockDownloadFile).toHaveBeenCalledTimes(1);
+		const [content, name] = mockDownloadFile.mock.calls[0];
+		expect(name).toBe(getTimestampedFileName('table', 'csv'));
+		expect(content).toContain('service.name');
+		expect(content).toContain('frontend');
+		expect(content).toContain('120');
+	});
+
+	it('exports as JSONL with the ndjson mime', () => {
+		const { result } = renderHook(() =>
+			useClientExport({ data: timeSeriesData(), query }),
 		);
 
 		act(() => {
@@ -101,8 +170,8 @@ describe('useClientExport', () => {
 		expect(content).toContain('"series"');
 	});
 
-	it('does nothing when there is no response', () => {
-		const { result } = renderHook(() => useClientExport({}));
+	it('does nothing when there is no data', () => {
+		const { result } = renderHook(() => useClientExport({ query }));
 
 		act(() => {
 			result.current.handleExport({ format: ExportFormat.Csv });
@@ -112,13 +181,14 @@ describe('useClientExport', () => {
 		expect(mockMessageError).not.toHaveBeenCalled();
 	});
 
-	it('shows an error and does not download for unsupported result types', () => {
+	it('shows an error for unsupported result types', () => {
 		const raw = {
-			type: 'raw',
-			data: { results: [] },
-			meta: {},
-		} as unknown as QueryRangeResponseV5;
-		const { result } = renderHook(() => useClientExport({ response: raw }));
+			statusCode: 200,
+			error: null,
+			message: '',
+			payload: { data: { result: [], resultType: '' } },
+		} as unknown as MetricQueryRangeSuccessResponse;
+		const { result } = renderHook(() => useClientExport({ data: raw, query }));
 
 		act(() => {
 			result.current.handleExport({ format: ExportFormat.Csv });

frontend/src/hooks/useExportData/useClientExport.ts

@@ -4,11 +4,14 @@ import {
 	downloadFile,
 	getTimestampedFileName,
 } from 'lib/exportData/downloadFile';
+import { exportScalarData } from 'lib/exportData/exportScalarData';
 import { exportTimeseriesData } from 'lib/exportData/exportTimeseriesData';
 import { toCsv } from 'lib/exportData/toCsv';
 import { toJsonl } from 'lib/exportData/toJsonl';
 import { ExportFormat, SerializedTable } from 'lib/exportData/types';
 import { useCallback, useState } from 'react';
+import { SuccessResponse } from 'types/api';
+import { MetricRangePayloadProps } from 'types/api/metrics/getQueryRange';
 import { Query } from 'types/api/queryBuilder/queryBuilderData';
 import { QueryRangeResponseV5, TimeSeriesData } from 'types/api/v5/queryRange';
 
@@ -20,33 +23,44 @@ const FORMAT_META: Record<ExportFormat, { mime: string; extension: string }> = {
 	},
 };
 
-// Picks the serializer for the response's request type. Narrows the results
-// union via the response discriminant. scalar lands with #5591; raw/trace are
-// server-exported, distribution is never emitted.
+/** The queryRange response object views hold — structural (params left
+ * unconstrained) so both explorer variants assign cleanly. */
+export type ClientExportData = SuccessResponse<MetricRangePayloadProps> & {
+	rawV5Response?: QueryRangeResponseV5;
+	legendMap?: Record<string, string>;
+};
+
+// Picks the serializer from what the queryRange response carries: timeseries
+// queries surface the raw V5 tree (rawV5Response); table queries carry the
+// formatForWeb webTables payload (resultType 'scalar'). raw/trace stay
+// server-exported via useServerExport.
 function serialize(
-	response: QueryRangeResponseV5,
+	data: ClientExportData,
 	yAxisUnit?: string,
-	legendMap?: Record<string, string>,
 	query?: Query,
 ): SerializedTable {
-	if (response.type === REQUEST_TYPES.TIME_SERIES) {
+	if (data.rawV5Response?.type === REQUEST_TYPES.TIME_SERIES) {
 		return exportTimeseriesData({
-			data: response.data.results as TimeSeriesData[],
+			data: data.rawV5Response.data.results as TimeSeriesData[],
 			yAxisUnit,
-			legendMap,
+			legendMap: data.legendMap,
 			query,
 		});
 	}
 
-	throw new Error(`Export is not supported for "${response.type}" results`);
+	if (data.payload?.data?.resultType === 'scalar' && query) {
+		return exportScalarData({ data, query });
+	}
+
+	throw new Error('Export is not supported for this result type');
 }
 
 interface UseClientExportProps {
-	response?: QueryRangeResponseV5;
+	// currently supports only qb v5 responses. Can extend to support future responses.
+	data?: ClientExportData;
 	query?: Query;
 	yAxisUnit?: string;
 	fileName?: string;
-	legendMap?: Record<string, string>;
 }
 
 interface ClientExportOptions {
@@ -59,23 +73,22 @@ interface UseClientExportReturn {
 }
 
 export function useClientExport({
-	response, // currently supports only qb v5 response. Can extend to support future responses.
+	data,
 	query,
 	yAxisUnit,
 	fileName = 'export',
-	legendMap,
 }: UseClientExportProps): UseClientExportReturn {
 	const [isExporting, setIsExporting] = useState<boolean>(false);
 
 	const handleExport = useCallback(
 		({ format }: ClientExportOptions): void => {
-			if (!response) {
+			if (!data) {
 				return;
 			}
 
 			setIsExporting(true);
 			try {
-				const table = serialize(response, yAxisUnit, legendMap, query);
+				const table = serialize(data, yAxisUnit, query);
 				const content =
 					format === ExportFormat.Jsonl ? toJsonl(table) : toCsv(table);
 				const { mime, extension } = FORMAT_META[format];
@@ -86,7 +99,7 @@ export function useClientExport({
 				setIsExporting(false);
 			}
 		},
-		[response, query, yAxisUnit, fileName, legendMap],
+		[data, query, yAxisUnit, fileName],
 	);
 
 	return { isExporting, handleExport };

frontend/src/pages/DashboardPageV2/DashboardContainer/PanelsAndSectionsLayout/Panel/hooks/__tests__/useCreateAlertFromPanel.test.ts

@@ -37,12 +37,22 @@ jest.mock('api/generated/services/querier', () => ({
 }));
 
 // Stub the builders so this asserts only the hook's orchestration.
+const mockBuildAlertUrl = jest.fn(
+	(..._args: unknown[]) => '/alerts/new?composite=substituted',
+);
 jest.mock('../../utils/buildCreateAlertUrl', () => ({
 	buildCreateAlertUrl: (): string => '/alerts/new?composite=sync',
-	buildAlertUrl: (): string => '/alerts/new?composite=substituted',
+	buildAlertUrl: (...args: unknown[]): string => mockBuildAlertUrl(...args),
 	readPanelUnit: (): string | undefined => undefined,
 }));
 
+// Prefill derivation has its own coverage; return a sentinel so the hook test can
+// assert it is threaded into the resolved-alert URL.
+const mockPrefill = { matchType: 'in_total' };
+jest.mock('../../utils/deriveAlertPrefill', () => ({
+	deriveAlertPrefill: (): unknown => mockPrefill,
+}));
+
 // Keep the real exports (getPanelQueryType reads them); stub only the builder.
 const mockBuildQueryRangeRequest = jest.fn((_args?: unknown) => ({
 	request: 'payload',
@@ -155,6 +165,13 @@ describe('useCreateAlertFromPanel', () => {
 			const { onSuccess } = mockSubstituteVars.mock.calls[0][1];
 			onSuccess({ data: { compositeQuery: { queries: [{ type: 'builder' }] } } });
 
+			// The resolved query is seeded with the panel-derived alert prefill.
+			expect(mockBuildAlertUrl).toHaveBeenCalledWith(
+				{ resolved: 'query' },
+				PANEL_TYPES.TIME_SERIES,
+				undefined,
+				mockPrefill,
+			);
 			expect(mockSafeNavigate).toHaveBeenCalledWith(
 				'/alerts/new?composite=substituted',
 				{ newTab: true },

frontend/src/pages/DashboardPageV2/DashboardContainer/PanelsAndSectionsLayout/Panel/hooks/useCreateAlertFromPanel.ts

@@ -16,6 +16,7 @@ import { useDashboardStore } from 'pages/DashboardPageV2/DashboardContainer/stor
 import { AppState } from 'store/reducers';
 import { GlobalReducer } from 'types/reducer/globalTime';
 
+import { deriveAlertPrefill } from '../utils/deriveAlertPrefill';
 import {
 	buildAlertUrl,
 	buildCreateAlertUrl,
@@ -75,10 +76,12 @@ export function useCreateAlertFromPanel(): (
 							response.data.compositeQuery?.queries ?? [],
 							panelType,
 						);
+						const unit = readPanelUnit(panel.spec.plugin);
 						const url = buildAlertUrl(
 							query,
 							panelType,
-							readPanelUnit(panel.spec.plugin),
+							unit,
+							deriveAlertPrefill(panel, query, unit),
 						);
 						safeNavigate(url, { newTab: true });
 					},

frontend/src/pages/DashboardPageV2/DashboardContainer/PanelsAndSectionsLayout/Panel/utils/__tests__/buildCreateAlertUrl.test.ts

@@ -100,4 +100,47 @@ describe('buildCreateAlertUrl', () => {
 		);
 		expect(decoded.unit).toBeUndefined();
 	});
+
+	it('omits the alert-condition params when the panel has no reduceTo or thresholds', () => {
+		const params = parse(buildCreateAlertUrl(makePanel()));
+
+		expect(params.get(QueryParams.thresholds)).toBeNull();
+		expect(params.get(QueryParams.matchType)).toBeNull();
+		expect(params.get(QueryParams.compareOp)).toBeNull();
+	});
+
+	it('seeds the alert condition from the panel Reduce To + highest-danger threshold', () => {
+		mockFromPerses.mockReturnValue({
+			...translatedQuery,
+			builder: {
+				queryData: [{ aggregations: [{ reduceTo: 'sum' }] }],
+				queryFormulas: [],
+				queryTraceOperator: [],
+			},
+		});
+		const numberPanel = {
+			kind: 'Panel',
+			spec: {
+				display: { name: 'CPU' },
+				plugin: {
+					kind: 'signoz/NumberPanel',
+					spec: {
+						thresholds: [{ color: '#F1575F', value: 90, operator: 'above' }],
+					},
+				},
+				queries: [{ some: 'query' }],
+			},
+		} as unknown as DashboardtypesPanelDTO;
+
+		const params = parse(buildCreateAlertUrl(numberPanel));
+
+		expect(params.get(QueryParams.matchType)).toBe('in_total');
+		expect(params.get(QueryParams.compareOp)).toBe('above');
+		// The alert page parses this param directly (no decodeURIComponent), so it
+		// must be single-encoded — reading it the same way guards against
+		// double-encoding regressions.
+		const thresholds = JSON.parse(params.get(QueryParams.thresholds) as string);
+		expect(thresholds).toHaveLength(1);
+		expect(thresholds[0].thresholdValue).toBe(90);
+	});
 });

frontend/src/pages/DashboardPageV2/DashboardContainer/PanelsAndSectionsLayout/Panel/utils/__tests__/deriveAlertPrefill.test.ts

@@ -0,0 +1,226 @@
+import type { DashboardtypesPanelDTO } from 'api/generated/services/sigNoz.schemas';
+import {
+	AlertThresholdMatchType,
+	AlertThresholdOperator,
+} from 'container/CreateAlertV2/context/types';
+import type { Query } from 'types/api/queryBuilder/queryBuilderData';
+import { ReduceOperators } from 'types/common/queryBuilder';
+
+import { deriveAlertPrefill } from '../deriveAlertPrefill';
+
+const RED = '#F1575F';
+const ORANGE = '#F5B225';
+const GREEN = '#2BB673';
+
+/** Query with one metric builder query per supplied reduceTo (on the V5 aggregation). */
+function makeQuery(...reduceTos: (ReduceOperators | undefined)[]): Query {
+	return {
+		builder: {
+			queryData: reduceTos.map((reduceTo) => ({
+				aggregations: [{ reduceTo }],
+			})),
+			queryFormulas: [],
+		},
+	} as unknown as Query;
+}
+
+/** Query carrying reduceTo on the legacy V1 field instead of the aggregation. */
+function makeLegacyQuery(reduceTo: ReduceOperators): Query {
+	return {
+		builder: {
+			queryData: [{ reduceTo }],
+			queryFormulas: [],
+		},
+	} as unknown as Query;
+}
+
+type ComparisonThreshold = {
+	color: string;
+	value: number;
+	unit?: string;
+	operator?: string;
+};
+
+type LabelThreshold = { color: string; value: number; unit?: string };
+
+function makeNumberPanel(
+	thresholds: ComparisonThreshold[],
+): DashboardtypesPanelDTO {
+	return {
+		spec: { plugin: { kind: 'signoz/NumberPanel', spec: { thresholds } } },
+	} as unknown as DashboardtypesPanelDTO;
+}
+
+function makeTimeSeriesPanel(
+	thresholds: LabelThreshold[],
+): DashboardtypesPanelDTO {
+	return {
+		spec: { plugin: { kind: 'signoz/TimeSeriesPanel', spec: { thresholds } } },
+	} as unknown as DashboardtypesPanelDTO;
+}
+
+const emptyNumberPanel = makeNumberPanel([]);
+
+describe('deriveAlertPrefill', () => {
+	describe('Reduce To → matchType', () => {
+		it('maps sum → in total', () => {
+			expect(
+				deriveAlertPrefill(emptyNumberPanel, makeQuery(ReduceOperators.SUM))
+					.matchType,
+			).toBe(AlertThresholdMatchType.IN_TOTAL);
+		});
+
+		it('maps avg → on average', () => {
+			expect(
+				deriveAlertPrefill(emptyNumberPanel, makeQuery(ReduceOperators.AVG))
+					.matchType,
+			).toBe(AlertThresholdMatchType.ON_AVERAGE);
+		});
+
+		it.each([ReduceOperators.MAX, ReduceOperators.MIN, ReduceOperators.LAST])(
+			'leaves matchType undefined for %s (no occurrence-type equivalent per issue #5291)',
+			(reduceTo) => {
+				expect(
+					deriveAlertPrefill(emptyNumberPanel, makeQuery(reduceTo)).matchType,
+				).toBeUndefined();
+			},
+		);
+
+		it('ignores reduceTo on non-Value panels (only the Value panel drives occurrence)', () => {
+			const { matchType } = deriveAlertPrefill(
+				makeTimeSeriesPanel([{ color: RED, value: 100 }]),
+				makeQuery(ReduceOperators.AVG),
+			);
+			expect(matchType).toBeUndefined();
+		});
+
+		it('reads reduceTo from the legacy V1 field too', () => {
+			expect(
+				deriveAlertPrefill(emptyNumberPanel, makeLegacyQuery(ReduceOperators.SUM))
+					.matchType,
+			).toBe(AlertThresholdMatchType.IN_TOTAL);
+		});
+
+		it('falls back to the legacy field when the aggregation reduceTo is empty', () => {
+			const query = {
+				builder: {
+					queryData: [
+						{ aggregations: [{ reduceTo: '' }], reduceTo: ReduceOperators.AVG },
+					],
+					queryFormulas: [],
+				},
+			} as unknown as Query;
+
+			expect(deriveAlertPrefill(emptyNumberPanel, query).matchType).toBe(
+				AlertThresholdMatchType.ON_AVERAGE,
+			);
+		});
+	});
+
+	describe('formula panels (multiple builder queries)', () => {
+		it('applies the reduce value when every query agrees', () => {
+			expect(
+				deriveAlertPrefill(
+					emptyNumberPanel,
+					makeQuery(ReduceOperators.AVG, ReduceOperators.AVG),
+				).matchType,
+			).toBe(AlertThresholdMatchType.ON_AVERAGE);
+		});
+
+		it('keeps the default when queries disagree', () => {
+			expect(
+				deriveAlertPrefill(
+					emptyNumberPanel,
+					makeQuery(ReduceOperators.AVG, ReduceOperators.SUM),
+				).matchType,
+			).toBeUndefined();
+		});
+	});
+
+	describe('thresholds → operator + target + unit', () => {
+		it('picks the highest-danger threshold (red over orange over green)', () => {
+			const { threshold, operator } = deriveAlertPrefill(
+				makeNumberPanel([
+					{ color: GREEN, value: 10, operator: 'below' },
+					{ color: RED, value: 90, operator: 'above' },
+					{ color: ORANGE, value: 80, operator: 'above' },
+				]),
+				makeQuery(),
+			);
+
+			expect(threshold?.thresholdValue).toBe(90);
+			expect(threshold?.color).toBe(RED);
+			expect(operator).toBe(AlertThresholdOperator.IS_ABOVE);
+		});
+
+		it('sorts unknown/custom colors last', () => {
+			const { threshold } = deriveAlertPrefill(
+				makeNumberPanel([
+					{ color: '#123456', value: 5, operator: 'above' },
+					{ color: ORANGE, value: 80, operator: 'above' },
+				]),
+				makeQuery(),
+			);
+
+			expect(threshold?.thresholdValue).toBe(80);
+		});
+
+		it.each([
+			['above', AlertThresholdOperator.IS_ABOVE],
+			['above_or_equal', AlertThresholdOperator.IS_ABOVE],
+			['below', AlertThresholdOperator.IS_BELOW],
+			['below_or_equal', AlertThresholdOperator.IS_BELOW],
+			['equal', AlertThresholdOperator.IS_EQUAL_TO],
+			['not_equal', AlertThresholdOperator.IS_NOT_EQUAL_TO],
+		])('maps panel operator %s → %s', (op, expected) => {
+			const { operator } = deriveAlertPrefill(
+				makeNumberPanel([{ color: RED, value: 1, operator: op }]),
+				makeQuery(),
+			);
+			expect(operator).toBe(expected);
+		});
+
+		it('builds an alert-shaped critical threshold', () => {
+			const { threshold } = deriveAlertPrefill(
+				makeNumberPanel([{ color: RED, value: 90, unit: 'ms', operator: 'above' }]),
+				makeQuery(),
+			);
+
+			expect(threshold).toMatchObject({
+				label: 'critical',
+				thresholdValue: 90,
+				recoveryThresholdValue: null,
+				unit: 'ms',
+				channels: [],
+				color: RED,
+			});
+			expect(typeof threshold?.id).toBe('string');
+		});
+
+		it('falls back to the panel unit when the threshold has none', () => {
+			const { threshold } = deriveAlertPrefill(
+				makeNumberPanel([{ color: RED, value: 90, operator: 'above' }]),
+				makeQuery(),
+				'bytes',
+			);
+			expect(threshold?.unit).toBe('bytes');
+		});
+	});
+
+	describe('label-variant thresholds (TimeSeries/Bar)', () => {
+		it('seeds the target but leaves operator/matchType default (no operator, no reduceTo)', () => {
+			const { threshold, operator, matchType } = deriveAlertPrefill(
+				makeTimeSeriesPanel([{ color: RED, value: 100 }]),
+				makeQuery(),
+			);
+
+			expect(threshold?.thresholdValue).toBe(100);
+			expect(operator).toBeUndefined();
+			expect(matchType).toBeUndefined();
+		});
+	});
+
+	it('returns an empty prefill for a panel with neither reduceTo nor thresholds', () => {
+		expect(deriveAlertPrefill(emptyNumberPanel, makeQuery())).toStrictEqual({});
+	});
+});

frontend/src/pages/DashboardPageV2/DashboardContainer/PanelsAndSectionsLayout/Panel/utils/buildCreateAlertUrl.ts

@@ -11,6 +11,8 @@ import { PANEL_KIND_TO_PANEL_TYPE } from 'pages/DashboardPageV2/DashboardContain
 import { fromPerses } from 'pages/DashboardPageV2/DashboardContainer/queryV5/persesQueryAdapters';
 import type { Query } from 'types/api/queryBuilder/queryBuilderData';
 
+import { deriveAlertPrefill, PanelAlertPrefill } from './deriveAlertPrefill';
+
 /** The panel's configured y-axis unit, for the kinds that carry one. */
 export function readPanelUnit(
 	plugin: DashboardtypesPanelPluginDTO,
@@ -27,14 +29,14 @@ export function readPanelUnit(
 }
 
 /**
- * Assembles the `/alerts/new` URL from a ready V1 `Query`: the alert page reads it
- * from `compositeQuery`, tagged with the panel type, entity version, and a
- * `dashboards` source.
+ * Assembles the `/alerts/new` URL from a ready V1 `Query`. An optional `prefill`
+ * (issue #5291) also seeds the alert condition — occurrence, operator, threshold.
  */
 export function buildAlertUrl(
 	query: Query,
 	panelType: PANEL_TYPES,
 	unit?: string,
+	prefill?: PanelAlertPrefill,
 ): string {
 	if (unit) {
 		// eslint-disable-next-line no-param-reassign
@@ -50,6 +52,17 @@ export function buildAlertUrl(
 	params.set(QueryParams.version, ENTITY_VERSION_V5);
 	params.set(QueryParams.source, YAxisSource.DASHBOARDS);
 
+	if (prefill?.threshold) {
+		// Raw JSON: URLSearchParams encodes once; the alert page uses a bare JSON.parse.
+		params.set(QueryParams.thresholds, JSON.stringify([prefill.threshold]));
+	}
+	if (prefill?.matchType) {
+		params.set(QueryParams.matchType, prefill.matchType);
+	}
+	if (prefill?.operator) {
+		params.set(QueryParams.compareOp, prefill.operator);
+	}
+
 	return `${ROUTES.ALERTS_NEW}?${params.toString()}`;
 }
 
@@ -62,5 +75,11 @@ export function buildAlertUrl(
 export function buildCreateAlertUrl(panel: DashboardtypesPanelDTO): string {
 	const panelType = PANEL_KIND_TO_PANEL_TYPE[panel.spec.plugin.kind];
 	const query = fromPerses(panel.spec.queries, panelType);
-	return buildAlertUrl(query, panelType, readPanelUnit(panel.spec.plugin));
+	const unit = readPanelUnit(panel.spec.plugin);
+	return buildAlertUrl(
+		query,
+		panelType,
+		unit,
+		deriveAlertPrefill(panel, query, unit),
+	);
 }

frontend/src/pages/DashboardPageV2/DashboardContainer/PanelsAndSectionsLayout/Panel/utils/deriveAlertPrefill.ts

@@ -0,0 +1,158 @@
+/** Derives an alert-condition seed from a panel's Reduce To + Thresholds (issue #5291). */
+
+import type {
+	DashboardtypesComparisonOperatorDTO,
+	DashboardtypesPanelDTO,
+	DashboardtypesPanelPluginDTO,
+} from 'api/generated/services/sigNoz.schemas';
+import {
+	AlertThresholdMatchType,
+	AlertThresholdOperator,
+	Threshold,
+} from 'container/CreateAlertV2/context/types';
+import type { MetricAggregation } from 'types/api/v5/queryRange';
+import type { Query } from 'types/api/queryBuilder/queryBuilderData';
+import { ReduceOperators } from 'types/common/queryBuilder';
+import { v4 as uuid } from 'uuid';
+
+export interface PanelAlertPrefill {
+	matchType?: AlertThresholdMatchType;
+	operator?: AlertThresholdOperator;
+	threshold?: Threshold;
+}
+
+// Most-dangerous first, matching the panel editor palette; unknown colors sort last.
+const THRESHOLD_COLOR_DANGER_ORDER = [
+	'#f1575f',
+	'#f5b225',
+	'#2bb673',
+	'#4e74f8',
+];
+
+interface NormalizedPanelThreshold {
+	color: string;
+	value: number;
+	unit?: string;
+	operator?: DashboardtypesComparisonOperatorDTO;
+}
+
+export function reduceToMatchType(
+	reduceTo: ReduceOperators | undefined,
+): AlertThresholdMatchType | undefined {
+	switch (reduceTo) {
+		case ReduceOperators.SUM:
+			return AlertThresholdMatchType.IN_TOTAL;
+		case ReduceOperators.AVG:
+			return AlertThresholdMatchType.ON_AVERAGE;
+		default:
+			return undefined;
+	}
+}
+
+function readReduceTo(
+	queryData: Query['builder']['queryData'][number],
+): ReduceOperators | undefined {
+	const aggregationReduceTo = (
+		queryData.aggregations?.[0] as MetricAggregation | undefined
+	)?.reduceTo;
+	// `||` not `??`: the aggregation often holds an empty-string placeholder.
+	return aggregationReduceTo || queryData.reduceTo || undefined;
+}
+
+export function uniformReduceTo(query: Query): ReduceOperators | undefined {
+	const { queryData } = query.builder;
+	const first = queryData[0] && readReduceTo(queryData[0]);
+	if (!first) {
+		return undefined;
+	}
+	return queryData.every((data) => readReduceTo(data) === first)
+		? first
+		: undefined;
+}
+
+function readPanelThresholds(
+	plugin: DashboardtypesPanelPluginDTO,
+): NormalizedPanelThreshold[] {
+	switch (plugin.kind) {
+		case 'signoz/TimeSeriesPanel':
+		case 'signoz/BarChartPanel':
+			return (plugin.spec.thresholds ?? []).map((t) => ({
+				color: t.color,
+				value: t.value,
+				unit: t.unit,
+			}));
+		case 'signoz/NumberPanel':
+			return (plugin.spec.thresholds ?? []).map((t) => ({
+				color: t.color,
+				value: t.value,
+				unit: t.unit,
+				operator: t.operator,
+			}));
+		default:
+			return [];
+	}
+}
+
+function colorRank(color: string): number {
+	const index = THRESHOLD_COLOR_DANGER_ORDER.indexOf(color.toLowerCase());
+	return index === -1 ? THRESHOLD_COLOR_DANGER_ORDER.length : index;
+}
+
+function pickHighestDanger(
+	thresholds: NormalizedPanelThreshold[],
+): NormalizedPanelThreshold | undefined {
+	return [...thresholds].sort(
+		(a, b) => colorRank(a.color) - colorRank(b.color),
+	)[0];
+}
+
+function panelOperatorToAlertOperator(
+	operator: DashboardtypesComparisonOperatorDTO | undefined,
+): AlertThresholdOperator | undefined {
+	switch (operator) {
+		case 'above':
+		case 'above_or_equal':
+			return AlertThresholdOperator.IS_ABOVE;
+		case 'below':
+		case 'below_or_equal':
+			return AlertThresholdOperator.IS_BELOW;
+		case 'equal':
+			return AlertThresholdOperator.IS_EQUAL_TO;
+		case 'not_equal':
+			return AlertThresholdOperator.IS_NOT_EQUAL_TO;
+		default:
+			return undefined;
+	}
+}
+
+export function deriveAlertPrefill(
+	panel: DashboardtypesPanelDTO,
+	query: Query,
+	panelUnit?: string,
+): PanelAlertPrefill {
+	const prefill: PanelAlertPrefill = {};
+
+	// Reduce To is user-facing only on the Value panel; elsewhere it's a default.
+	if (panel.spec.plugin.kind === 'signoz/NumberPanel') {
+		const matchType = reduceToMatchType(uniformReduceTo(query));
+		if (matchType) {
+			prefill.matchType = matchType;
+		}
+	}
+
+	const top = pickHighestDanger(readPanelThresholds(panel.spec.plugin));
+	if (top) {
+		prefill.operator = panelOperatorToAlertOperator(top.operator);
+		prefill.threshold = {
+			id: uuid(),
+			label: 'critical',
+			thresholdValue: top.value,
+			recoveryThresholdValue: null,
+			unit: top.unit ?? panelUnit ?? '',
+			channels: [],
+			color: top.color,
+		};
+	}
+
+	return prefill;
+}

pkg/apiserver/signozapiserver/querier.go

@@ -4,13 +4,26 @@ import (
 	"net/http"
 
 	"github.com/SigNoz/signoz/pkg/http/handler"
+	"github.com/SigNoz/signoz/pkg/querybuilder"
 	"github.com/SigNoz/signoz/pkg/types"
+	"github.com/SigNoz/signoz/pkg/types/authtypes"
+	"github.com/SigNoz/signoz/pkg/types/coretypes"
 	qbtypes "github.com/SigNoz/signoz/pkg/types/querybuildertypes/querybuildertypesv5"
 	"github.com/gorilla/mux"
 )
 
+func telemetryReadScopes() []string {
+	return []string{
+		coretypes.ResourceTelemetryResourceLogs.Scope(coretypes.VerbRead),
+		coretypes.ResourceTelemetryResourceTraces.Scope(coretypes.VerbRead),
+		coretypes.ResourceTelemetryResourceMetrics.Scope(coretypes.VerbRead),
+		coretypes.ResourceTelemetryResourceAuditLogs.Scope(coretypes.VerbRead),
+		coretypes.ResourceTelemetryResourceMeterMetrics.Scope(coretypes.VerbRead),
+	}
+}
+
 func (provider *provider) addQuerierRoutes(router *mux.Router) error {
-	if err := router.Handle("/api/v5/query_range", handler.New(provider.authzMiddleware.ViewAccess(provider.querierHandler.QueryRange), handler.OpenAPIDef{
+	if err := router.Handle("/api/v5/query_range", handler.New(provider.authzMiddleware.CheckResources(provider.querierHandler.QueryRange, authtypes.SigNozAdminRoleName, authtypes.SigNozEditorRoleName, authtypes.SigNozViewerRoleName), handler.OpenAPIDef{
 		ID:                 "QueryRangeV5",
 		Tags:               []string{"querier"},
 		Summary:            "Query range",
@@ -446,12 +459,17 @@ func (provider *provider) addQuerierRoutes(router *mux.Router) error {
 		ResponseContentType: "application/json",
 		SuccessStatusCode:   http.StatusOK,
 		ErrorStatusCodes:    []int{http.StatusBadRequest},
-		SecuritySchemes:     newSecuritySchemes(types.RoleViewer),
-	})).Methods(http.MethodPost).GetError(); err != nil {
+		SecuritySchemes:     newScopedSecuritySchemes(telemetryReadScopes()),
+	}, handler.WithResourceDefs(handler.TelemetryResourceDef{
+		Verb:      coretypes.VerbRead,
+		Category:  coretypes.ActionCategoryDataAccess,
+		Selector:  querybuilder.TelemetrySelector,
+		Resources: querybuilder.QueryRangeResources,
+	}))).Methods(http.MethodPost).GetError(); err != nil {
 		return err
 	}
 
-	if err := router.Handle("/api/v5/query_range/preview", handler.New(provider.authzMiddleware.ViewAccess(provider.querierHandler.QueryRangePreview), handler.OpenAPIDef{
+	if err := router.Handle("/api/v5/query_range/preview", handler.New(provider.authzMiddleware.CheckResources(provider.querierHandler.QueryRangePreview, authtypes.SigNozAdminRoleName, authtypes.SigNozEditorRoleName, authtypes.SigNozViewerRoleName), handler.OpenAPIDef{
 		ID:                  "QueryRangePreviewV5",
 		Tags:                []string{"querier"},
 		Summary:             "Query range preview",
@@ -463,8 +481,13 @@ func (provider *provider) addQuerierRoutes(router *mux.Router) error {
 		ResponseContentType: "application/json",
 		SuccessStatusCode:   http.StatusOK,
 		ErrorStatusCodes:    []int{http.StatusBadRequest},
-		SecuritySchemes:     newSecuritySchemes(types.RoleViewer),
-	})).Methods(http.MethodPost).GetError(); err != nil {
+		SecuritySchemes:     newScopedSecuritySchemes(telemetryReadScopes()),
+	}, handler.WithResourceDefs(handler.TelemetryResourceDef{
+		Verb:      coretypes.VerbRead,
+		Category:  coretypes.ActionCategoryDataAccess,
+		Selector:  querybuilder.TelemetrySelector,
+		Resources: querybuilder.QueryRangeResources,
+	}))).Methods(http.MethodPost).GetError(); err != nil {
 		return err
 	}
 

pkg/http/handler/resourcedef.go

@@ -1,6 +1,9 @@
 package handler
 
-import "github.com/SigNoz/signoz/pkg/types/coretypes"
+import (
+	"github.com/SigNoz/signoz/pkg/errors"
+	"github.com/SigNoz/signoz/pkg/types/coretypes"
+)
 
 type ResourceDef interface {
 	// resolveRequest is unexported to seal the interface. It returns a slice so a
@@ -97,3 +100,31 @@ func (def AttachDetachParentChildResourceDef) resolveRequest(ec coretypes.Extrac
 		),
 	}
 }
+
+type TelemetryResourceDef struct {
+	Verb      coretypes.Verb
+	Category  coretypes.ActionCategory
+	Selector  coretypes.SelectorFunc
+	Resources coretypes.ResourceExtractor
+}
+
+func (def TelemetryResourceDef) resolveRequest(ec coretypes.ExtractorContext) []coretypes.ResolvedResource {
+	refs, err := def.Resources(ec)
+	if err != nil {
+		return []coretypes.ResolvedResource{coretypes.NewResolvedResourceWithError(def.Verb, def.Category, err)}
+	}
+	if len(refs) == 0 {
+		return []coretypes.ResolvedResource{coretypes.NewResolvedResourceWithError(
+			def.Verb,
+			def.Category,
+			errors.NewInvalidInputf(errors.CodeInvalidInput, "request resolved to no resources"),
+		)}
+	}
+
+	resolved := make([]coretypes.ResolvedResource, 0, len(refs))
+	for _, ref := range refs {
+		resolved = append(resolved, coretypes.NewResolvedResourceWithID(def.Verb, def.Category, ref.Resource, ref.ID, def.Selector))
+	}
+
+	return resolved
+}

pkg/http/middleware/audit.go

@@ -118,6 +118,10 @@ func (middleware *Audit) emitAuditEvent(req *http.Request, writer responseCaptur
 	extractorCtx := coretypes.ExtractorContext{Request: req, ResponseBody: writer.BodyBytes()}
 
 	for _, resource := range resolved {
+		if err := resource.Err(); err != nil {
+			continue
+		}
+
 		resource.ResolveResponse(extractorCtx)
 		verb, category := resource.Verb(), resource.Category()
 

pkg/modules/rawdataexport/implrawdataexport/handler.go

@@ -6,7 +6,6 @@ import (
 	"fmt"
 	"io"
 	"net/http"
-	"reflect"
 	"slices"
 	"strconv"
 	"time"
@@ -286,13 +285,6 @@ func constructCSVRecordFromQueryResponse(data map[string]any, headerToIndexMappi
 	for key, value := range data {
 		if index, exists := headerToIndexMapping[key]; exists && value != nil {
 
-			if rv := reflect.ValueOf(value); rv.Kind() == reflect.Pointer {
-				if rv.IsNil() {
-					continue
-				}
-				value = rv.Elem().Interface()
-			}
-
 			var valueStr string
 			switch v := value.(type) {
 			case string:

pkg/modules/rulestatehistory/implrulestatehistory/condition_builder.go

@@ -21,15 +21,13 @@ func newConditionBuilder(fm qbtypes.FieldMapper) qbtypes.ConditionBuilder {
 	return &conditionBuilder{fm: fm}
 }
 
-// Rule state history has no resource sub-query, so options are unused.
-func (c *conditionBuilder) ConditionForKeys(
+func (c *conditionBuilder) ConditionFor(
 	ctx context.Context,
 	orgID valuer.UUID,
 	startNs uint64,
 	endNs uint64,
 	key *telemetrytypes.TelemetryFieldKey,
-	fieldKeys map[string][]*telemetrytypes.TelemetryFieldKey,
-	_ qbtypes.ConditionBuilderOptions,
+	fieldKeysForName []*telemetrytypes.TelemetryFieldKey,
 	operator qbtypes.FilterOperator,
 	value any,
 	sb *sqlbuilder.SelectBuilder,
@@ -40,7 +38,7 @@ func (c *conditionBuilder) ConditionForKeys(
 		return nil, nil, err
 	}
 
-	keys, warning := querybuilder.ResolveKeys(key, querybuilder.MatchingFieldKeys(key, fieldKeys))
+	keys, warning := querybuilder.ResolveKeys(key, fieldKeysForName)
 	var warnings []string
 	if warning != "" {
 		warnings = append(warnings, warning)

pkg/modules/rulestatehistory/implrulestatehistory/field_mapper.go

@@ -64,7 +64,7 @@ func (m *fieldMapper) ColumnFor(ctx context.Context, _ valuer.UUID, _, _ uint64,
 	return []*schema.Column{col}, nil
 }
 
-func (m *fieldMapper) ColumnExpressionFor(ctx context.Context, orgID valuer.UUID, tsStart, tsEnd uint64, field *telemetrytypes.TelemetryFieldKey, _ telemetrytypes.FieldDataType, _ map[string][]*telemetrytypes.TelemetryFieldKey) (string, error) {
+func (m *fieldMapper) ColumnExpressionFor(ctx context.Context, orgID valuer.UUID, tsStart, tsEnd uint64, field *telemetrytypes.TelemetryFieldKey, _ map[string][]*telemetrytypes.TelemetryFieldKey) (string, error) {
 	colName, err := m.FieldFor(ctx, orgID, tsStart, tsEnd, field)
 	if err != nil {
 		return "", err

pkg/querier/signozquerier/provider.go

@@ -79,7 +79,7 @@ func newProvider(
 	traceFieldMapper := telemetrytraces.NewFieldMapper()
 	traceConditionBuilder := telemetrytraces.NewConditionBuilder(traceFieldMapper)
 
-	traceAggExprRewriter := querybuilder.NewAggExprRewriter(settings, nil, traceFieldMapper, traceConditionBuilder, flagger)
+	traceAggExprRewriter := querybuilder.NewAggExprRewriter(settings, nil, traceFieldMapper, traceConditionBuilder, nil, flagger)
 	traceStmtBuilder := telemetrytraces.NewTraceQueryStatementBuilder(
 		settings,
 		telemetryMetadataStore,
@@ -111,6 +111,7 @@ func newProvider(
 		telemetrylogs.DefaultFullTextColumn,
 		logFieldMapper,
 		logConditionBuilder,
+		telemetrylogs.GetBodyJSONKey,
 		flagger,
 	)
 	logStmtBuilder := telemetrylogs.NewLogQueryStatementBuilder(
@@ -135,6 +136,7 @@ func newProvider(
 		telemetryaudit.DefaultFullTextColumn,
 		auditFieldMapper,
 		auditConditionBuilder,
+		nil,
 		flagger,
 	)
 	auditStmtBuilder := telemetryaudit.NewAuditQueryStatementBuilder(

pkg/query-service/rules/setups_test.go

@@ -80,6 +80,7 @@ func prepareQuerierForLogs(t *testing.T, telemetryStore telemetrystore.Telemetry
 		telemetrylogs.DefaultFullTextColumn,
 		logFieldMapper,
 		logConditionBuilder,
+		telemetrylogs.GetBodyJSONKey,
 		fl,
 	)
 	logStmtBuilder := telemetrylogs.NewLogQueryStatementBuilder(
@@ -132,7 +133,7 @@ func prepareQuerierForTraces(t *testing.T, telemetryStore telemetrystore.Telemet
 	traceConditionBuilder := telemetrytraces.NewConditionBuilder(traceFieldMapper)
 
 	fl := flaggertest.New(t)
-	traceAggExprRewriter := querybuilder.NewAggExprRewriter(providerSettings, nil, traceFieldMapper, traceConditionBuilder, fl)
+	traceAggExprRewriter := querybuilder.NewAggExprRewriter(providerSettings, nil, traceFieldMapper, traceConditionBuilder, nil, fl)
 	traceStmtBuilder := telemetrytraces.NewTraceQueryStatementBuilder(
 		providerSettings,
 		metadataStore,

pkg/query-service/rules/threshold_rule_test.go

@@ -839,7 +839,7 @@ func TestThresholdRuleTracesLink(t *testing.T) {
 		queryString := "SELECT any"
 		telemetryStore.Mock().
 			ExpectQuery(queryString).
-			WithArgs(nil, nil, nil, nil, nil).
+			WithArgs(nil, nil, nil, nil, nil, nil, nil).
 			WillReturnRows(rows)
 
 		querier := prepareQuerierForTraces(t, telemetryStore, keysMap)
@@ -957,7 +957,7 @@ func TestThresholdRuleLogsLink(t *testing.T) {
 		queryString := "SELECT any"
 		telemetryStore.Mock().
 			ExpectQuery(queryString).
-			WithArgs(nil, nil, nil, nil, nil, nil, nil, nil, nil).
+			WithArgs(nil, nil, nil, nil, nil, nil, nil, nil, nil, nil).
 			WillReturnRows(rows)
 
 		querier := prepareQuerierForLogs(t, telemetryStore, keysMap)

pkg/querybuilder/agg_rewrite.go

@@ -10,6 +10,7 @@ import (
 	"github.com/SigNoz/signoz/pkg/errors"
 	"github.com/SigNoz/signoz/pkg/factory"
 	"github.com/SigNoz/signoz/pkg/flagger"
+	"github.com/SigNoz/signoz/pkg/types/featuretypes"
 	qbtypes "github.com/SigNoz/signoz/pkg/types/querybuildertypes/querybuildertypesv5"
 	"github.com/SigNoz/signoz/pkg/types/telemetrytypes"
 	"github.com/SigNoz/signoz/pkg/valuer"
@@ -21,6 +22,7 @@ type aggExprRewriter struct {
 	fullTextColumn   *telemetrytypes.TelemetryFieldKey
 	fieldMapper      qbtypes.FieldMapper
 	conditionBuilder qbtypes.ConditionBuilder
+	jsonKeyToKey     qbtypes.JsonKeyToFieldFunc
 	flagger          flagger.Flagger
 }
 
@@ -31,6 +33,7 @@ func NewAggExprRewriter(
 	fullTextColumn *telemetrytypes.TelemetryFieldKey,
 	fieldMapper qbtypes.FieldMapper,
 	conditionBuilder qbtypes.ConditionBuilder,
+	jsonKeyToKey qbtypes.JsonKeyToFieldFunc,
 	fl flagger.Flagger,
 ) *aggExprRewriter {
 	set := factory.NewScopedProviderSettings(settings, "github.com/SigNoz/signoz/pkg/querybuilder/agg_rewrite")
@@ -40,6 +43,7 @@ func NewAggExprRewriter(
 		fullTextColumn:   fullTextColumn,
 		fieldMapper:      fieldMapper,
 		conditionBuilder: conditionBuilder,
+		jsonKeyToKey:     jsonKeyToKey,
 		flagger:          fl,
 	}
 }
@@ -88,6 +92,7 @@ func (r *aggExprRewriter) Rewrite(
 		r.fullTextColumn,
 		r.fieldMapper,
 		r.conditionBuilder,
+		r.jsonKeyToKey,
 		r.flagger,
 	)
 	// Rewrite the first select item (our expression)
@@ -142,6 +147,7 @@ type exprVisitor struct {
 	fullTextColumn   *telemetrytypes.TelemetryFieldKey
 	fieldMapper      qbtypes.FieldMapper
 	conditionBuilder qbtypes.ConditionBuilder
+	jsonKeyToKey     qbtypes.JsonKeyToFieldFunc
 	flagger          flagger.Flagger
 	Modified         bool
 	chArgs           []any
@@ -158,6 +164,7 @@ func newExprVisitor(
 	fullTextColumn *telemetrytypes.TelemetryFieldKey,
 	fieldMapper qbtypes.FieldMapper,
 	conditionBuilder qbtypes.ConditionBuilder,
+	jsonKeyToKey qbtypes.JsonKeyToFieldFunc,
 	fl flagger.Flagger,
 ) *exprVisitor {
 	return &exprVisitor{
@@ -170,6 +177,7 @@ func newExprVisitor(
 		fullTextColumn:   fullTextColumn,
 		fieldMapper:      fieldMapper,
 		conditionBuilder: conditionBuilder,
+		jsonKeyToKey:     jsonKeyToKey,
 		flagger:          fl,
 	}
 }
@@ -204,6 +212,8 @@ func (v *exprVisitor) VisitFunctionExpr(fn *chparser.FunctionExpr) error {
 		dataType = telemetrytypes.FieldDataTypeFloat64
 	}
 
+	bodyJSONEnabled := v.flagger.BooleanOrEmpty(v.ctx, flagger.FeatureUseJSONBody, featuretypes.NewFlaggerEvaluationContext(v.orgID))
+
 	// Handle *If functions with predicate + values
 	if aggFunc.FuncCombinator {
 		// Map the predicate (last argument)
@@ -244,11 +254,12 @@ func (v *exprVisitor) VisitFunctionExpr(fn *chparser.FunctionExpr) error {
 		for i := 0; i < len(args)-1; i++ {
 			origVal := args[i].String()
 			fieldKey := telemetrytypes.GetFieldKeyFromKeyText(origVal)
-			expr, err := v.fieldMapper.ColumnExpressionFor(v.ctx, v.orgID, v.startNs, v.endNs, &fieldKey, dataType, v.fieldKeys)
+			expr, exprArgs, err := CollisionHandledFinalExpr(v.ctx, v.orgID, v.startNs, v.endNs, &fieldKey, v.fieldMapper, v.conditionBuilder, v.fieldKeys, dataType, v.jsonKeyToKey, bodyJSONEnabled)
 			if err != nil {
 				return errors.WrapInvalidInputf(err, errors.CodeInvalidInput, "failed to get table field name for %q", origVal)
 			}
-			newVal := sqlbuilder.Escape(expr)
+			v.chArgs = append(v.chArgs, exprArgs...)
+			newVal := expr
 			parsedVal, err := parseFragment(newVal)
 			if err != nil {
 				return err
@@ -261,11 +272,12 @@ func (v *exprVisitor) VisitFunctionExpr(fn *chparser.FunctionExpr) error {
 		for i, arg := range args {
 			orig := arg.String()
 			fieldKey := telemetrytypes.GetFieldKeyFromKeyText(orig)
-			expr, err := v.fieldMapper.ColumnExpressionFor(v.ctx, v.orgID, v.startNs, v.endNs, &fieldKey, dataType, v.fieldKeys)
+			expr, exprArgs, err := CollisionHandledFinalExpr(v.ctx, v.orgID, v.startNs, v.endNs, &fieldKey, v.fieldMapper, v.conditionBuilder, v.fieldKeys, dataType, v.jsonKeyToKey, bodyJSONEnabled)
 			if err != nil {
 				return err
 			}
-			newCol := sqlbuilder.Escape(expr)
+			v.chArgs = append(v.chArgs, exprArgs...)
+			newCol := expr
 			parsed, err := parseFragment(newCol)
 			if err != nil {
 				return err

pkg/querybuilder/exists_expr.go

@@ -1,100 +0,0 @@
-package querybuilder
-
-import (
-	"fmt"
-
-	schema "github.com/SigNoz/signoz-otel-collector/cmd/signozschemamigrator/schema_migrator"
-	"github.com/SigNoz/signoz/pkg/errors"
-	qbtypes "github.com/SigNoz/signoz/pkg/types/querybuildertypes/querybuildertypesv5"
-	"github.com/SigNoz/signoz/pkg/types/telemetrytypes"
-)
-
-// ExistsExpression renders the existence predicate for a key resolved to the given
-// columns (negated when exists is false). Comparisons are against constants rendered
-// as literals, so the expression carries no bind args and can guard column expressions
-// directly. Signal-specific presence checks (body JSON paths, label maps) are handled
-// by the field mappers before falling through to this.
-func ExistsExpression(columns []*schema.Column, key *telemetrytypes.TelemetryFieldKey, tsStart, tsEnd uint64, fieldExpression string, exists bool) (string, error) {
-	newColumns, evolutionsEntries, err := qbtypes.SelectEvolutionsForColumns(columns, key.Evolutions, tsStart, tsEnd)
-	if err != nil {
-		return "", err
-	}
-	if len(newColumns) == 0 {
-		return "", errors.NewInvalidInputf(errors.CodeInvalidInput, "no valid evolution found for field %s in the given time range", key.Name)
-	}
-
-	comparison := func(operator string, value string) string {
-		return fmt.Sprintf("%s %s %s", fieldExpression, operator, value)
-	}
-
-	if len(newColumns) > 1 {
-		if exists {
-			return fieldExpression + " IS NOT NULL", nil
-		}
-		return fieldExpression + " IS NULL", nil
-	}
-
-	column := newColumns[0]
-	switch column.Type.GetType() {
-	case schema.ColumnTypeEnumJSON:
-		// the ::String cast in the value expression folds NULL to '', so the
-		// presence check must address the raw JSON path
-		columnName := column.Name
-		if len(evolutionsEntries) > 0 && evolutionsEntries[0] != nil {
-			columnName = evolutionsEntries[0].ColumnName
-		}
-		rawPath := fmt.Sprintf("%s.`%s`", columnName, key.Name)
-		if exists {
-			return rawPath + " IS NOT NULL", nil
-		}
-		return rawPath + " IS NULL", nil
-	case schema.ColumnTypeEnumString,
-		schema.ColumnTypeEnumFixedString,
-		schema.ColumnTypeEnumDateTime64:
-		if exists {
-			return comparison("<>", "''"), nil
-		}
-		return comparison("=", "''"), nil
-	case schema.ColumnTypeEnumLowCardinality:
-		switch elementType := column.Type.(schema.LowCardinalityColumnType).ElementType; elementType.GetType() {
-		case schema.ColumnTypeEnumString:
-			if exists {
-				return comparison("<>", "''"), nil
-			}
-			return comparison("=", "''"), nil
-		default:
-			return "", errors.NewInvalidInputf(errors.CodeInvalidInput, "exists operator is not supported for low cardinality column type %s", elementType)
-		}
-	case schema.ColumnTypeEnumUInt64,
-		schema.ColumnTypeEnumUInt32,
-		schema.ColumnTypeEnumUInt8,
-		schema.ColumnTypeEnumInt8,
-		schema.ColumnTypeEnumInt16,
-		schema.ColumnTypeEnumBool:
-		if exists {
-			return comparison("<>", "0"), nil
-		}
-		return comparison("=", "0"), nil
-	case schema.ColumnTypeEnumMap:
-		keyType := column.Type.(schema.MapColumnType).KeyType
-		if _, ok := keyType.(schema.LowCardinalityColumnType); !ok {
-			return "", errors.NewInvalidInputf(errors.CodeInvalidInput, "key type %s is not supported for map column type %s", keyType, column.Type)
-		}
-
-		switch valueType := column.Type.(schema.MapColumnType).ValueType; valueType.GetType() {
-		case schema.ColumnTypeEnumString, schema.ColumnTypeEnumBool, schema.ColumnTypeEnumFloat64:
-			leftOperand := fmt.Sprintf("mapContains(%s, '%s')", column.Name, key.Name)
-			if key.Materialized {
-				leftOperand = telemetrytypes.FieldKeyToMaterializedColumnNameForExists(key)
-			}
-			if exists {
-				return leftOperand, nil
-			}
-			return "NOT " + leftOperand, nil
-		default:
-			return "", errors.NewInvalidInputf(errors.CodeInvalidInput, "exists operator is not supported for map column type %s", valueType)
-		}
-	default:
-		return "", errors.NewInvalidInputf(errors.CodeInvalidInput, "exists operator is not supported for column type %s", column.Type)
-	}
-}

pkg/querybuilder/fallback_expr.go

@@ -1,17 +1,128 @@
 package querybuilder
 
 import (
+	"context"
 	"encoding/json"
 	"fmt"
 	"math"
 	"reflect"
 	"regexp"
 	"strconv"
+	"strings"
 
+	"github.com/SigNoz/signoz/pkg/errors"
 	qbtypes "github.com/SigNoz/signoz/pkg/types/querybuildertypes/querybuildertypesv5"
 	"github.com/SigNoz/signoz/pkg/types/telemetrytypes"
+	"github.com/SigNoz/signoz/pkg/valuer"
+	"github.com/huandu/go-sqlbuilder"
+	"golang.org/x/exp/maps"
 )
 
+func CollisionHandledFinalExpr(
+	ctx context.Context,
+	orgID valuer.UUID,
+	startNs uint64,
+	endNs uint64,
+	field *telemetrytypes.TelemetryFieldKey,
+	fm qbtypes.FieldMapper,
+	cb qbtypes.ConditionBuilder,
+	keys map[string][]*telemetrytypes.TelemetryFieldKey,
+	requiredDataType telemetrytypes.FieldDataType,
+	jsonKeyToKey qbtypes.JsonKeyToFieldFunc,
+	bodyJSONEnabled bool,
+) (string, []any, error) {
+
+	if requiredDataType != telemetrytypes.FieldDataTypeString &&
+		requiredDataType != telemetrytypes.FieldDataTypeFloat64 {
+		return "", nil, errors.NewInvalidInputf(errors.CodeInvalidInput, "unsupported data type %s", requiredDataType)
+	}
+
+	var dummyValue any
+	if requiredDataType == telemetrytypes.FieldDataTypeFloat64 {
+		dummyValue = 0.0
+	} else {
+		dummyValue = ""
+	}
+
+	var stmts []string
+	var allArgs []any
+
+	addCondition := func(key *telemetrytypes.TelemetryFieldKey) error {
+		sb := sqlbuilder.NewSelectBuilder()
+		conds, _, err := cb.ConditionFor(ctx, orgID, startNs, endNs, key, []*telemetrytypes.TelemetryFieldKey{key}, qbtypes.FilterOperatorExists, nil, sb)
+		if err != nil {
+			return err
+		}
+		sb.Where(conds[0])
+
+		expr, args := sb.BuildWithFlavor(sqlbuilder.ClickHouse)
+		expr = strings.TrimPrefix(expr, "WHERE ")
+		stmts = append(stmts, expr)
+		allArgs = append(allArgs, args...)
+		return nil
+	}
+
+	fieldExpression, fieldForErr := fm.FieldFor(ctx, orgID, startNs, endNs, field)
+	if errors.Is(fieldForErr, qbtypes.ErrColumnNotFound) {
+		// the key didn't have the right context to be added to the query
+		// we try to use the context we know of
+		keysForField := keys[field.Name]
+
+		if len(keysForField) == 0 {
+			// check if the key exists with {fieldContext}.{key}
+			// because the context could be legitimate prefix in user data, example `metric.max`
+			keyWithContext := fmt.Sprintf("%s.%s", field.FieldContext.StringValue(), field.Name)
+			if len(keys[keyWithContext]) > 0 {
+				keysForField = keys[keyWithContext]
+			}
+		}
+
+		if len(keysForField) == 0 {
+			// No metadata match: let the field mapper synthesize type-variant keys.
+			// keys were already checked above, so pass nil here.
+			keysForField = fm.CandidateKeys(ctx, orgID, field, nil, nil)
+		}
+		if len(keysForField) == 0 {
+			// The mapper can't synthesize (e.g. metrics): fall back to the typo suggestion.
+			wrappedErr := errors.WithSuggestiveAdditionalf(fieldForErr, errors.NewSuggestionsOnLevenshteinDistance(field.Name, errors.NounKeys, maps.Keys(keys)), "field `%s` not found", field.Name)
+			return "", nil, wrappedErr
+		}
+		for _, key := range keysForField {
+			err := addCondition(key)
+			if err != nil {
+				return "", nil, err
+			}
+			fieldExpression, _ = fm.FieldFor(ctx, orgID, startNs, endNs, key)
+			fieldExpression, _ = DataTypeCollisionHandledFieldName(key, dummyValue, fieldExpression, qbtypes.FilterOperatorUnknown)
+			stmts = append(stmts, fieldExpression)
+		}
+	} else {
+		err := addCondition(field)
+		if err != nil {
+			return "", nil, err
+		}
+
+		// first if condition covers the older tests and second if condition covers the array conditions
+		if !bodyJSONEnabled && field.FieldContext == telemetrytypes.FieldContextBody && jsonKeyToKey != nil {
+			return "", nil, errors.NewInvalidInputf(errors.CodeInvalidInput, "Group by/Aggregation isn't available for the body column")
+		} else if strings.Contains(field.Name, telemetrytypes.ArraySep) || strings.Contains(field.Name, telemetrytypes.ArrayAnyIndex) {
+			return "", nil, errors.NewInvalidInputf(errors.CodeInvalidInput, "Group by/Aggregation isn't available for the Array Paths: %s", field.Name)
+		} else {
+			fieldExpression, _ = DataTypeCollisionHandledFieldName(field, dummyValue, fieldExpression, qbtypes.FilterOperatorUnknown)
+		}
+
+		stmts = append(stmts, fieldExpression)
+	}
+
+	for idx := range stmts {
+		stmts[idx] = sqlbuilder.Escape(stmts[idx])
+	}
+
+	multiIfStmt := fmt.Sprintf("multiIf(%s, NULL)", strings.Join(stmts, ", "))
+
+	return multiIfStmt, allArgs, nil
+}
+
 func GroupByKeys(keys []qbtypes.GroupByKey) []string {
 	k := []string{}
 	for _, key := range keys {

pkg/querybuilder/query_range_resources.go

@@ -0,0 +1,220 @@
+package querybuilder
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"strings"
+
+	"github.com/SigNoz/signoz/pkg/errors"
+	"github.com/SigNoz/signoz/pkg/types/coretypes"
+	qbtypes "github.com/SigNoz/signoz/pkg/types/querybuildertypes/querybuildertypesv5"
+	"github.com/SigNoz/signoz/pkg/types/telemetrytypes"
+	"github.com/SigNoz/signoz/pkg/valuer"
+	"github.com/tidwall/gjson"
+)
+
+var telemetryGrantKeys = map[string]struct{}{
+	"service.name": {},
+}
+
+const telemetryValueSafeBytes = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789._-"
+
+func EscapeTelemetryValue(value string) string {
+	var escaped strings.Builder
+	for _, character := range []byte(value) {
+		if strings.IndexByte(telemetryValueSafeBytes, character) >= 0 {
+			escaped.WriteByte(character)
+			continue
+		}
+		escaped.WriteString(fmt.Sprintf("%%%02X", character))
+	}
+
+	return escaped.String()
+}
+
+func TelemetrySelector(_ context.Context, resource coretypes.Resource, id string, _ valuer.UUID) ([]coretypes.Selector, error) {
+	values := []string{id}
+	segments := strings.Split(id, "/")
+	for level := len(segments) - 1; level >= 1; level-- {
+		value := strings.Join(segments[:level], "/") + "/" + coretypes.WildCardSelectorString
+		if value == id {
+			continue
+		}
+		values = append(values, value)
+	}
+	if id != coretypes.WildCardSelectorString {
+		values = append(values, coretypes.WildCardSelectorString)
+	}
+
+	selectors := make([]coretypes.Selector, 0, len(values))
+	for _, value := range values {
+		selector, err := resource.Type().Selector(value)
+		if err != nil {
+			return nil, err
+		}
+		selectors = append(selectors, selector)
+	}
+
+	return selectors, nil
+}
+
+func QueryRangeResources(ec coretypes.ExtractorContext) ([]coretypes.ResourceWithID, error) {
+	queries := gjson.GetBytes(ec.RequestBody, "compositeQuery.queries")
+	if !queries.IsArray() || len(queries.Array()) == 0 {
+		return nil, errors.NewInvalidInputf(errors.CodeInvalidInput, "atleast one query is required")
+	}
+
+	variables, err := queryRangeVariables(ec.RequestBody)
+	if err != nil {
+		return nil, err
+	}
+
+	refs := make([]coretypes.ResourceWithID, 0, len(queries.Array()))
+	seen := make(map[string]struct{})
+	for _, query := range queries.Array() {
+		queryRefs, err := resourcesForQuery(query, variables)
+		if err != nil {
+			return nil, err
+		}
+
+		for _, ref := range queryRefs {
+			key := ref.Resource.Kind().String() + ":" + ref.ID
+			if _, ok := seen[key]; ok {
+				continue
+			}
+			seen[key] = struct{}{}
+			refs = append(refs, ref)
+		}
+	}
+
+	return refs, nil
+}
+
+func queryRangeVariables(body []byte) (map[string]qbtypes.VariableItem, error) {
+	variables := make(map[string]qbtypes.VariableItem)
+
+	raw := gjson.GetBytes(body, "variables")
+	if !raw.Exists() {
+		return variables, nil
+	}
+
+	if err := json.Unmarshal([]byte(raw.Raw), &variables); err != nil {
+		return nil, errors.NewInvalidInputf(errors.CodeInvalidInput, "invalid variables in query range request")
+	}
+
+	return variables, nil
+}
+
+func resourcesForQuery(query gjson.Result, variables map[string]qbtypes.VariableItem) ([]coretypes.ResourceWithID, error) {
+	queryType := query.Get("type").String()
+	typeWildcard := queryType + "/" + coretypes.WildCardSelectorString
+
+	switch queryType {
+	case qbtypes.QueryTypeBuilder.StringValue(), qbtypes.QueryTypeSubQuery.StringValue():
+		return resourcesForBuilderQuery(queryType, query.Get("spec"), variables)
+	case qbtypes.QueryTypePromQL.StringValue():
+		return []coretypes.ResourceWithID{{Resource: coretypes.ResourceTelemetryResourceMetrics, ID: typeWildcard}}, nil
+	case qbtypes.QueryTypeClickHouseSQL.StringValue():
+		return []coretypes.ResourceWithID{
+			{Resource: coretypes.ResourceTelemetryResourceLogs, ID: typeWildcard},
+			{Resource: coretypes.ResourceTelemetryResourceTraces, ID: typeWildcard},
+			{Resource: coretypes.ResourceTelemetryResourceMetrics, ID: typeWildcard},
+			{Resource: coretypes.ResourceTelemetryResourceMeterMetrics, ID: typeWildcard},
+		}, nil
+	case qbtypes.QueryTypeFormula.StringValue(), qbtypes.QueryTypeJoin.StringValue(), qbtypes.QueryTypeTraceOperator.StringValue():
+		return nil, nil
+	default:
+		return nil, errors.NewInvalidInputf(errors.CodeInvalidInput, "unsupported query type %q", queryType)
+	}
+}
+
+func resourcesForBuilderQuery(queryType string, spec gjson.Result, variables map[string]qbtypes.VariableItem) ([]coretypes.ResourceWithID, error) {
+	resource, err := builderQueryResource(spec)
+	if err != nil {
+		return nil, err
+	}
+
+	ids, err := builderQuerySelectors(queryType, spec.Get("filter.expression").String(), variables)
+	if err != nil {
+		return nil, err
+	}
+
+	refs := make([]coretypes.ResourceWithID, 0, len(ids))
+	for _, id := range ids {
+		refs = append(refs, coretypes.ResourceWithID{Resource: resource, ID: id})
+	}
+
+	return refs, nil
+}
+
+func builderQueryResource(spec gjson.Result) (coretypes.Resource, error) {
+	source := spec.Get("source").String()
+
+	switch spec.Get("signal").String() {
+	case telemetrytypes.SignalTraces.StringValue():
+		return coretypes.ResourceTelemetryResourceTraces, nil
+	case telemetrytypes.SignalLogs.StringValue():
+		if source == telemetrytypes.SourceAudit.StringValue() {
+			return coretypes.ResourceTelemetryResourceAuditLogs, nil
+		}
+		return coretypes.ResourceTelemetryResourceLogs, nil
+	case telemetrytypes.SignalMetrics.StringValue():
+		if source == telemetrytypes.SourceMeter.StringValue() {
+			return coretypes.ResourceTelemetryResourceMeterMetrics, nil
+		}
+		return coretypes.ResourceTelemetryResourceMetrics, nil
+	default:
+		return nil, errors.NewInvalidInputf(errors.CodeInvalidInput, "unsupported signal %q", spec.Get("signal").String())
+	}
+}
+
+func builderQuerySelectors(queryType, expression string, variables map[string]qbtypes.VariableItem) ([]string, error) {
+	typeWildcard := queryType + "/" + coretypes.WildCardSelectorString
+
+	if strings.TrimSpace(expression) == "" {
+		return []string{typeWildcard}, nil
+	}
+
+	normalized, err := NormalizeWhereClause(expression, variables)
+	if err != nil {
+		return nil, err
+	}
+
+	ids := make([]string, 0)
+	for _, condition := range normalized.Conditions {
+		if !condition.TopLevel {
+			continue
+		}
+
+		key, ok := canonicalTelemetryGrantKey(condition.Key)
+		if !ok {
+			continue
+		}
+
+		if condition.Operator == "=" || condition.Operator == "IN" {
+			for _, value := range condition.Values {
+				ids = append(ids, queryType+"/"+key+"/"+EscapeTelemetryValue(value))
+			}
+		}
+	}
+
+	if len(ids) == 0 {
+		return []string{typeWildcard}, nil
+	}
+
+	return ids, nil
+}
+
+func canonicalTelemetryGrantKey(keyText string) (string, bool) {
+	fieldKey := telemetrytypes.GetFieldKeyFromKeyText(keyText)
+	if fieldKey.FieldContext != telemetrytypes.FieldContextUnspecified && fieldKey.FieldContext != telemetrytypes.FieldContextResource {
+		return "", false
+	}
+
+	if _, ok := telemetryGrantKeys[fieldKey.Name]; !ok {
+		return "", false
+	}
+
+	return fieldKey.Name, true
+}

pkg/querybuilder/query_range_resources_test.go

@@ -0,0 +1,184 @@
+package querybuilder
+
+import (
+	"context"
+	"strings"
+	"testing"
+
+	"github.com/SigNoz/signoz/pkg/types/coretypes"
+	"github.com/SigNoz/signoz/pkg/valuer"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func builderQueryBody(signal, filterExpression string) string {
+	return `{"compositeQuery":{"queries":[{"type":"builder_query","spec":{"signal":"` + signal + `","filter":{"expression":"` + filterExpression + `"}}}]}}`
+}
+
+func TestQueryRangeResources(t *testing.T) {
+	testCases := []struct {
+		name     string
+		body     string
+		expected []coretypes.ResourceWithID
+	}{
+		{
+			name: "top level service equality",
+			body: builderQueryBody("logs", "service.name = 'checkout' AND status = 500"),
+			expected: []coretypes.ResourceWithID{
+				{Resource: coretypes.ResourceTelemetryResourceLogs, ID: "builder_query/service.name/checkout"},
+			},
+		},
+		{
+			name: "resource prefixed service key",
+			body: builderQueryBody("traces", "resource.service.name = 'checkout'"),
+			expected: []coretypes.ResourceWithID{
+				{Resource: coretypes.ResourceTelemetryResourceTraces, ID: "builder_query/service.name/checkout"},
+			},
+		},
+		{
+			name: "in atom requires every value",
+			body: builderQueryBody("logs", "service.name IN ('b', 'a')"),
+			expected: []coretypes.ResourceWithID{
+				{Resource: coretypes.ResourceTelemetryResourceLogs, ID: "builder_query/service.name/a"},
+				{Resource: coretypes.ResourceTelemetryResourceLogs, ID: "builder_query/service.name/b"},
+			},
+		},
+		{
+			name: "multiple equality atoms each require a grant",
+			body: builderQueryBody("logs", "service.name = 'b' AND service.name = 'a'"),
+			expected: []coretypes.ResourceWithID{
+				{Resource: coretypes.ResourceTelemetryResourceLogs, ID: "builder_query/service.name/a"},
+				{Resource: coretypes.ResourceTelemetryResourceLogs, ID: "builder_query/service.name/b"},
+			},
+		},
+		{
+			name: "no filter expression",
+			body: `{"compositeQuery":{"queries":[{"type":"builder_query","spec":{"signal":"logs"}}]}}`,
+			expected: []coretypes.ResourceWithID{
+				{Resource: coretypes.ResourceTelemetryResourceLogs, ID: "builder_query/*"},
+			},
+		},
+		{
+			name: "service atom under or does not qualify",
+			body: builderQueryBody("logs", "service.name = 'a' OR status = 500"),
+			expected: []coretypes.ResourceWithID{
+				{Resource: coretypes.ResourceTelemetryResourceLogs, ID: "builder_query/*"},
+			},
+		},
+		{
+			name: "negated service atom does not qualify",
+			body: builderQueryBody("logs", "NOT service.name = 'a'"),
+			expected: []coretypes.ResourceWithID{
+				{Resource: coretypes.ResourceTelemetryResourceLogs, ID: "builder_query/*"},
+			},
+		},
+		{
+			name: "service inequality does not qualify",
+			body: builderQueryBody("logs", "service.name != 'a'"),
+			expected: []coretypes.ResourceWithID{
+				{Resource: coretypes.ResourceTelemetryResourceLogs, ID: "builder_query/*"},
+			},
+		},
+		{
+			name: "unsafe value bytes are escaped",
+			body: builderQueryBody("logs", "service.name = 'check out/2'"),
+			expected: []coretypes.ResourceWithID{
+				{Resource: coretypes.ResourceTelemetryResourceLogs, ID: "builder_query/service.name/check%20out%2F2"},
+			},
+		},
+		{
+			name: "audit source maps to audit logs resource",
+			body: `{"compositeQuery":{"queries":[{"type":"builder_query","spec":{"signal":"logs","source":"audit","filter":{"expression":"service.name = 'a'"}}}]}}`,
+			expected: []coretypes.ResourceWithID{
+				{Resource: coretypes.ResourceTelemetryResourceAuditLogs, ID: "builder_query/service.name/a"},
+			},
+		},
+		{
+			name: "promql is wildcard only",
+			body: `{"compositeQuery":{"queries":[{"type":"promql","spec":{"query":"up"}}]}}`,
+			expected: []coretypes.ResourceWithID{
+				{Resource: coretypes.ResourceTelemetryResourceMetrics, ID: "promql/*"},
+			},
+		},
+		{
+			name: "clickhouse sql covers all signals",
+			body: `{"compositeQuery":{"queries":[{"type":"clickhouse_sql","spec":{"query":"SELECT 1"}}]}}`,
+			expected: []coretypes.ResourceWithID{
+				{Resource: coretypes.ResourceTelemetryResourceLogs, ID: "clickhouse_sql/*"},
+				{Resource: coretypes.ResourceTelemetryResourceTraces, ID: "clickhouse_sql/*"},
+				{Resource: coretypes.ResourceTelemetryResourceMetrics, ID: "clickhouse_sql/*"},
+				{Resource: coretypes.ResourceTelemetryResourceMeterMetrics, ID: "clickhouse_sql/*"},
+			},
+		},
+		{
+			name:     "formula produces no resources",
+			body:     `{"compositeQuery":{"queries":[{"type":"builder_formula","spec":{"expression":"A/B"}}]}}`,
+			expected: []coretypes.ResourceWithID{},
+		},
+		{
+			name: "trace operator rides on its referenced queries",
+			body: `{"compositeQuery":{"queries":[{"type":"builder_query","spec":{"name":"A","signal":"traces","disabled":true,"filter":{"expression":"service.name = 'checkout'"}}},{"type":"builder_query","spec":{"name":"B","signal":"traces","disabled":true,"filter":{"expression":"service.name = 'checkout' AND has_error = true"}}},{"type":"builder_trace_operator","spec":{"name":"T1","expression":"A => B","returnSpansFrom":"A"}}]}}`,
+			expected: []coretypes.ResourceWithID{
+				{Resource: coretypes.ResourceTelemetryResourceTraces, ID: "builder_query/service.name/checkout"},
+			},
+		},
+		{
+			name: "variable substitution qualifies",
+			body: `{"variables":{"svc":{"value":"checkout"}},"compositeQuery":{"queries":[{"type":"builder_query","spec":{"signal":"logs","filter":{"expression":"service.name = $svc"}}}]}}`,
+			expected: []coretypes.ResourceWithID{
+				{Resource: coretypes.ResourceTelemetryResourceLogs, ID: "builder_query/service.name/checkout"},
+			},
+		},
+		{
+			name: "duplicate queries dedupe",
+			body: `{"compositeQuery":{"queries":[{"type":"builder_query","spec":{"signal":"logs","filter":{"expression":"service.name = 'a'"}}},{"type":"builder_query","spec":{"signal":"logs","filter":{"expression":"service.name='a'"}}}]}}`,
+			expected: []coretypes.ResourceWithID{
+				{Resource: coretypes.ResourceTelemetryResourceLogs, ID: "builder_query/service.name/a"},
+			},
+		},
+	}
+
+	for _, testCase := range testCases {
+		t.Run(testCase.name, func(t *testing.T) {
+			refs, err := QueryRangeResources(coretypes.ExtractorContext{RequestBody: []byte(testCase.body)})
+			require.NoError(t, err)
+			assert.Equal(t, testCase.expected, refs)
+		})
+	}
+}
+
+func TestQueryRangeResourcesErrors(t *testing.T) {
+	bodies := []string{
+		`{"compositeQuery":{"queries":[]}}`,
+		`{}`,
+		builderQueryBody("logs", "service.name = "),
+		`{"compositeQuery":{"queries":[{"type":"builder_query","spec":{"signal":"unknown"}}]}}`,
+		`{"compositeQuery":{"queries":[{"type":"unknown_type"}]}}`,
+	}
+
+	for _, body := range bodies {
+		_, err := QueryRangeResources(coretypes.ExtractorContext{RequestBody: []byte(body)})
+		assert.Error(t, err, "body %s", body)
+	}
+}
+
+func TestTelemetrySelector(t *testing.T) {
+	orgID := valuer.GenerateUUID()
+
+	selectorValues := func(id string) []string {
+		selectors, err := TelemetrySelector(context.Background(), coretypes.ResourceTelemetryResourceLogs, id, orgID)
+		require.NoError(t, err)
+		values := make([]string, 0, len(selectors))
+		for _, selector := range selectors {
+			values = append(values, selector.String())
+		}
+		return values
+	}
+
+	assert.Equal(t, []string{"builder_query/service.name/a", "builder_query/service.name/*", "builder_query/*", "*"}, selectorValues("builder_query/service.name/a"))
+	assert.Equal(t, []string{"builder_query/*", "*"}, selectorValues("builder_query/*"))
+	assert.Equal(t, []string{"promql/*", "*"}, selectorValues("promql/*"))
+
+	_, err := TelemetrySelector(context.Background(), coretypes.ResourceTelemetryResourceLogs, strings.Repeat("a", 256), orgID)
+	assert.Error(t, err)
+}

pkg/querybuilder/where_clause_normalizer.go

@@ -0,0 +1,558 @@
+package querybuilder
+
+import (
+	"fmt"
+	"sort"
+	"strconv"
+	"strings"
+
+	"github.com/SigNoz/signoz/pkg/errors"
+	grammar "github.com/SigNoz/signoz/pkg/parser/filterquery/grammar"
+	qbtypes "github.com/SigNoz/signoz/pkg/types/querybuildertypes/querybuildertypesv5"
+	"github.com/SigNoz/signoz/pkg/types/telemetrytypes"
+	"github.com/antlr4-go/antlr/v4"
+)
+
+const WhereClauseOperatorFullText = "FULLTEXT"
+
+type NormalizedWhereClause struct {
+	Expression string
+	Conditions []WhereClauseCondition
+}
+
+type WhereClauseCondition struct {
+	Key      string
+	Operator string
+	Values   []string
+	Negated  bool
+	TopLevel bool
+}
+
+type joinKind int
+
+const (
+	joinKindNone joinKind = iota
+	joinKindAnd
+	joinKindOr
+)
+
+type normalizedPart struct {
+	text    string
+	join    joinKind
+	skipped bool
+}
+
+type normalizedValue struct {
+	text string
+	raw  string
+}
+
+type whereClauseNormalizer struct {
+	variables  map[string]qbtypes.VariableItem
+	conditions []WhereClauseCondition
+	negated    bool
+	orDepth    int
+	errors     []string
+}
+
+func NormalizeWhereClause(expression string, variables map[string]qbtypes.VariableItem) (*NormalizedWhereClause, error) {
+	input := antlr.NewInputStream(expression)
+	lexer := grammar.NewFilterQueryLexer(input)
+
+	lexerErrorListener := NewErrorListener()
+	lexer.RemoveErrorListeners()
+	lexer.AddErrorListener(lexerErrorListener)
+
+	tokens := antlr.NewCommonTokenStream(lexer, 0)
+	parser := grammar.NewFilterQueryParser(tokens)
+
+	parserErrorListener := NewErrorListener()
+	parser.RemoveErrorListeners()
+	parser.AddErrorListener(parserErrorListener)
+
+	tree := parser.Query()
+
+	syntaxErrors := append(lexerErrorListener.SyntaxErrors, parserErrorListener.SyntaxErrors...)
+	if len(syntaxErrors) > 0 {
+		combinedErrors := errors.Newf(
+			errors.TypeInvalidInput,
+			errors.CodeInvalidInput,
+			"Found %d syntax errors while parsing the filter expression.",
+			len(syntaxErrors),
+		)
+		additionals := make([]string, 0, len(syntaxErrors))
+		for _, syntaxError := range syntaxErrors {
+			if syntaxError.Error() != "" {
+				additionals = append(additionals, syntaxError.Error())
+			}
+		}
+
+		return nil, combinedErrors.WithAdditional(additionals...).WithUrl(searchTroubleshootingGuideURL)
+	}
+
+	visitor := &whereClauseNormalizer{
+		variables:  variables,
+		conditions: make([]WhereClauseCondition, 0),
+	}
+	part := visitor.visitQuery(tree)
+
+	if len(visitor.errors) > 0 {
+		combinedErrors := errors.Newf(
+			errors.TypeInvalidInput,
+			errors.CodeInvalidInput,
+			"Found %d errors while parsing the filter expression.",
+			len(visitor.errors),
+		)
+		return nil, combinedErrors.WithAdditional(visitor.errors...).WithUrl(searchTroubleshootingGuideURL)
+	}
+
+	if part.skipped {
+		return &NormalizedWhereClause{Expression: "", Conditions: make([]WhereClauseCondition, 0)}, nil
+	}
+
+	sort.Slice(visitor.conditions, func(i, j int) bool {
+		return visitor.conditions[i].sortKey() < visitor.conditions[j].sortKey()
+	})
+
+	return &NormalizedWhereClause{Expression: part.text, Conditions: visitor.conditions}, nil
+}
+
+func (condition WhereClauseCondition) sortKey() string {
+	return condition.Key + "|" + condition.Operator + "|" + strings.Join(condition.Values, ",") + "|" + strconv.FormatBool(condition.Negated) + "|" + strconv.FormatBool(condition.TopLevel)
+}
+
+func (visitor *whereClauseNormalizer) visitQuery(ctx grammar.IQueryContext) normalizedPart {
+	if ctx.Expression() == nil {
+		return normalizedPart{skipped: true}
+	}
+
+	return visitor.visitOrExpression(ctx.Expression().OrExpression())
+}
+
+func (visitor *whereClauseNormalizer) visitOrExpression(ctx grammar.IOrExpressionContext) normalizedPart {
+	andExpressions := ctx.AllAndExpression()
+	if len(andExpressions) > 1 {
+		visitor.orDepth++
+		defer func() { visitor.orDepth-- }()
+	}
+
+	parts := make([]normalizedPart, 0, len(andExpressions))
+	for _, andExpression := range andExpressions {
+		part := visitor.visitAndExpression(andExpression)
+		if part.skipped {
+			continue
+		}
+		parts = append(parts, part)
+	}
+
+	if len(parts) == 0 {
+		return normalizedPart{skipped: true}
+	}
+
+	parts = sortAndDedupeNormalizedParts(parts)
+	if len(parts) == 1 {
+		return parts[0]
+	}
+
+	texts := make([]string, len(parts))
+	for index, part := range parts {
+		texts[index] = part.text
+	}
+
+	return normalizedPart{text: strings.Join(texts, " OR "), join: joinKindOr}
+}
+
+func (visitor *whereClauseNormalizer) visitAndExpression(ctx grammar.IAndExpressionContext) normalizedPart {
+	unaryExpressions := ctx.AllUnaryExpression()
+	parts := make([]normalizedPart, 0, len(unaryExpressions))
+	for _, unaryExpression := range unaryExpressions {
+		part := visitor.visitUnaryExpression(unaryExpression)
+		if part.skipped {
+			continue
+		}
+		if part.join == joinKindOr {
+			part = normalizedPart{text: "(" + part.text + ")", join: joinKindNone}
+		}
+		parts = append(parts, part)
+	}
+
+	if len(parts) == 0 {
+		return normalizedPart{skipped: true}
+	}
+
+	parts = sortAndDedupeNormalizedParts(parts)
+	if len(parts) == 1 {
+		return parts[0]
+	}
+
+	texts := make([]string, len(parts))
+	for index, part := range parts {
+		texts[index] = part.text
+	}
+
+	return normalizedPart{text: strings.Join(texts, " AND "), join: joinKindAnd}
+}
+
+func (visitor *whereClauseNormalizer) visitUnaryExpression(ctx grammar.IUnaryExpressionContext) normalizedPart {
+	negated := ctx.NOT() != nil
+	if negated {
+		visitor.negated = !visitor.negated
+	}
+
+	part := visitor.visitPrimary(ctx.Primary())
+
+	if negated {
+		visitor.negated = !visitor.negated
+
+		if part.skipped {
+			return part
+		}
+		if part.join != joinKindNone {
+			return normalizedPart{text: "NOT (" + part.text + ")", join: joinKindNone}
+		}
+		return normalizedPart{text: "NOT " + part.text, join: joinKindNone}
+	}
+
+	return part
+}
+
+func (visitor *whereClauseNormalizer) visitPrimary(ctx grammar.IPrimaryContext) normalizedPart {
+	if ctx.OrExpression() != nil {
+		return visitor.visitOrExpression(ctx.OrExpression())
+	}
+	if ctx.Comparison() != nil {
+		return visitor.visitComparison(ctx.Comparison())
+	}
+	if ctx.FunctionCall() != nil {
+		return normalizedPart{text: visitor.visitFunctionCall(ctx.FunctionCall())}
+	}
+	if ctx.FullText() != nil {
+		return normalizedPart{text: visitor.visitFullText(ctx.FullText())}
+	}
+	if ctx.Key() != nil {
+		return normalizedPart{text: visitor.fullTextTerm(ctx.Key().GetText())}
+	}
+	if ctx.Value() != nil {
+		value := visitor.normalizeValue(ctx.Value())
+		return normalizedPart{text: visitor.fullTextTerm(value.raw)}
+	}
+
+	return normalizedPart{skipped: true}
+}
+
+func (visitor *whereClauseNormalizer) visitComparison(ctx grammar.IComparisonContext) normalizedPart {
+	key := normalizeKeyText(ctx.Key().GetText())
+
+	if ctx.EXISTS() != nil {
+		operator := "EXISTS"
+		if ctx.NOT() != nil {
+			operator = "NOT EXISTS"
+		}
+		visitor.appendCondition(key, operator, nil)
+		return normalizedPart{text: key + " " + operator}
+	}
+
+	if ctx.InClause() != nil {
+		return visitor.visitInComparison(key, "IN", visitor.visitInValues(ctx.InClause().ValueList(), ctx.InClause().Value()))
+	}
+
+	if ctx.NotInClause() != nil {
+		return visitor.visitInComparison(key, "NOT IN", visitor.visitInValues(ctx.NotInClause().ValueList(), ctx.NotInClause().Value()))
+	}
+
+	if ctx.BETWEEN() != nil {
+		operator := "BETWEEN"
+		if ctx.NOT() != nil {
+			operator = "NOT BETWEEN"
+		}
+
+		values := ctx.AllValue()
+		low := visitor.normalizeValue(values[0])
+		high := visitor.normalizeValue(values[1])
+		visitor.appendCondition(key, operator, []string{low.raw, high.raw})
+		return normalizedPart{text: key + " " + operator + " " + low.text + " AND " + high.text}
+	}
+
+	operator := ""
+	switch {
+	case ctx.EQUALS() != nil:
+		operator = "="
+	case ctx.NOT_EQUALS() != nil, ctx.NEQ() != nil:
+		operator = "!="
+	case ctx.LT() != nil:
+		operator = "<"
+	case ctx.LE() != nil:
+		operator = "<="
+	case ctx.GT() != nil:
+		operator = ">"
+	case ctx.GE() != nil:
+		operator = ">="
+	case ctx.LIKE() != nil:
+		operator = "LIKE"
+	case ctx.ILIKE() != nil:
+		operator = "ILIKE"
+	case ctx.REGEXP() != nil:
+		operator = "REGEXP"
+	case ctx.CONTAINS() != nil:
+		operator = "CONTAINS"
+	}
+	if ctx.NOT() != nil {
+		operator = "NOT " + operator
+	}
+
+	value, skipped := visitor.substituteScalarVariable(visitor.normalizeValue(ctx.AllValue()[0]))
+	if skipped {
+		return normalizedPart{skipped: true}
+	}
+
+	visitor.appendCondition(key, operator, []string{value.raw})
+	return normalizedPart{text: key + " " + operator + " " + value.text}
+}
+
+func (visitor *whereClauseNormalizer) visitInComparison(key, operator string, values []normalizedValue) normalizedPart {
+	values, skipped := visitor.substituteListVariable(values)
+	if skipped {
+		return normalizedPart{skipped: true}
+	}
+
+	sort.Slice(values, func(i, j int) bool { return values[i].text < values[j].text })
+
+	texts := make([]string, 0, len(values))
+	raws := make([]string, 0, len(values))
+	for index, value := range values {
+		if index > 0 && value.text == values[index-1].text {
+			continue
+		}
+		texts = append(texts, value.text)
+		raws = append(raws, value.raw)
+	}
+
+	visitor.appendCondition(key, operator, raws)
+	return normalizedPart{text: key + " " + operator + " (" + strings.Join(texts, ", ") + ")"}
+}
+
+func (visitor *whereClauseNormalizer) visitInValues(valueList grammar.IValueListContext, value grammar.IValueContext) []normalizedValue {
+	values := make([]normalizedValue, 0)
+	if valueList != nil {
+		for _, valueCtx := range valueList.AllValue() {
+			values = append(values, visitor.normalizeValue(valueCtx))
+		}
+		return values
+	}
+
+	return append(values, visitor.normalizeValue(value))
+}
+
+func (visitor *whereClauseNormalizer) visitFunctionCall(ctx grammar.IFunctionCallContext) string {
+	functionName := ""
+	switch {
+	case ctx.HAS() != nil:
+		functionName = "has"
+	case ctx.HASANY() != nil:
+		functionName = "hasAny"
+	case ctx.HASALL() != nil:
+		functionName = "hasAll"
+	case ctx.HASTOKEN() != nil:
+		functionName = "hasToken"
+	}
+
+	key := ""
+	texts := make([]string, 0)
+	raws := make([]string, 0)
+	for index, param := range ctx.FunctionParamList().AllFunctionParam() {
+		switch {
+		case param.Key() != nil:
+			keyText := normalizeKeyText(param.Key().GetText())
+			if index == 0 {
+				key = keyText
+			} else {
+				raws = append(raws, keyText)
+			}
+			texts = append(texts, keyText)
+		case param.Value() != nil:
+			value := visitor.normalizeValue(param.Value())
+			texts = append(texts, value.text)
+			raws = append(raws, value.raw)
+		case param.Array() != nil:
+			arrayText, arrayRaws := visitor.visitArray(param.Array())
+			texts = append(texts, arrayText)
+			raws = append(raws, arrayRaws...)
+		}
+	}
+
+	visitor.appendCondition(key, functionName, raws)
+	return functionName + "(" + strings.Join(texts, ", ") + ")"
+}
+
+func (visitor *whereClauseNormalizer) visitArray(ctx grammar.IArrayContext) (string, []string) {
+	texts := make([]string, 0)
+	raws := make([]string, 0)
+	for _, valueCtx := range ctx.ValueList().AllValue() {
+		value := visitor.normalizeValue(valueCtx)
+		texts = append(texts, value.text)
+		raws = append(raws, value.raw)
+	}
+
+	return "[" + strings.Join(texts, ", ") + "]", raws
+}
+
+func (visitor *whereClauseNormalizer) visitFullText(ctx grammar.IFullTextContext) string {
+	if ctx.QUOTED_TEXT() != nil {
+		return visitor.fullTextTerm(trimQuotes(ctx.QUOTED_TEXT().GetText()))
+	}
+
+	return visitor.fullTextTerm(ctx.FREETEXT().GetText())
+}
+
+func (visitor *whereClauseNormalizer) fullTextTerm(term string) string {
+	visitor.appendCondition("", WhereClauseOperatorFullText, []string{term})
+	return quoteValue(term)
+}
+
+func (visitor *whereClauseNormalizer) normalizeValue(ctx grammar.IValueContext) normalizedValue {
+	switch {
+	case ctx.QUOTED_TEXT() != nil:
+		raw := trimQuotes(ctx.QUOTED_TEXT().GetText())
+		return normalizedValue{text: quoteValue(raw), raw: raw}
+	case ctx.NUMBER() != nil:
+		text := ctx.NUMBER().GetText()
+		return normalizedValue{text: text, raw: text}
+	case ctx.BOOL() != nil:
+		text := strings.ToLower(ctx.BOOL().GetText())
+		return normalizedValue{text: text, raw: text}
+	default:
+		raw := ctx.KEY().GetText()
+		if strings.HasPrefix(raw, "$") {
+			return normalizedValue{text: raw, raw: raw}
+		}
+		return normalizedValue{text: quoteValue(raw), raw: raw}
+	}
+}
+
+func (visitor *whereClauseNormalizer) appendCondition(key, operator string, values []string) {
+	if values == nil {
+		values = make([]string, 0)
+	}
+
+	visitor.conditions = append(visitor.conditions, WhereClauseCondition{
+		Key:      key,
+		Operator: operator,
+		Values:   values,
+		Negated:  visitor.negated,
+		TopLevel: visitor.orDepth == 0 && !visitor.negated,
+	})
+}
+
+func (visitor *whereClauseNormalizer) substituteScalarVariable(value normalizedValue) (normalizedValue, bool) {
+	variableItem, ok := visitor.resolveVariable(value.raw)
+	if !ok {
+		return value, false
+	}
+
+	if skipped := visitor.errIfSkippedOrEmpty(variableItem, value.raw); skipped {
+		return normalizedValue{}, true
+	}
+
+	switch variableValues := variableItem.Value.(type) {
+	case []any:
+		return formatVariableValue(variableValues[0]), false
+	case any:
+		return formatVariableValue(variableValues), false
+	}
+
+	return value, false
+}
+
+func (visitor *whereClauseNormalizer) substituteListVariable(values []normalizedValue) ([]normalizedValue, bool) {
+	if len(values) != 1 {
+		return values, false
+	}
+
+	variableItem, ok := visitor.resolveVariable(values[0].raw)
+	if !ok {
+		return values, false
+	}
+
+	if skipped := visitor.errIfSkippedOrEmpty(variableItem, values[0].raw); skipped {
+		return nil, true
+	}
+
+	switch variableValues := variableItem.Value.(type) {
+	case []any:
+		substituted := make([]normalizedValue, 0, len(variableValues))
+		for _, variableValue := range variableValues {
+			substituted = append(substituted, formatVariableValue(variableValue))
+		}
+		return substituted, false
+	case any:
+		return []normalizedValue{formatVariableValue(variableValues)}, false
+	}
+
+	return values, false
+}
+
+func (visitor *whereClauseNormalizer) errIfSkippedOrEmpty(variableItem qbtypes.VariableItem, raw string) bool {
+	if variableItem.Type == qbtypes.DynamicVariableType {
+		if allValue, ok := variableItem.Value.(string); ok && allValue == "__all__" {
+			return true
+		}
+	}
+
+	if variableValues, ok := variableItem.Value.([]any); ok && len(variableValues) == 0 {
+		visitor.errors = append(visitor.errors, fmt.Sprintf("malformed request payload: variable `%s` used in expression has an empty list value", strings.TrimPrefix(raw, "$")))
+		return true
+	}
+
+	return false
+}
+
+func (visitor *whereClauseNormalizer) resolveVariable(raw string) (qbtypes.VariableItem, bool) {
+	if len(visitor.variables) == 0 {
+		return qbtypes.VariableItem{}, false
+	}
+
+	variableItem, ok := visitor.variables[raw]
+	if !ok && len(raw) > 0 {
+		variableItem, ok = visitor.variables[raw[1:]]
+	}
+
+	return variableItem, ok
+}
+
+func formatVariableValue(value any) normalizedValue {
+	switch typed := value.(type) {
+	case string:
+		return normalizedValue{text: quoteValue(typed), raw: typed}
+	case bool:
+		text := strconv.FormatBool(typed)
+		return normalizedValue{text: text, raw: text}
+	default:
+		text := fmt.Sprintf("%v", typed)
+		return normalizedValue{text: text, raw: text}
+	}
+}
+
+func normalizeKeyText(keyText string) string {
+	fieldKey := telemetrytypes.GetFieldKeyFromKeyText(keyText)
+	return telemetrytypes.TelemetryFieldKeyToText(&fieldKey)
+}
+
+func quoteValue(value string) string {
+	escaped := strings.ReplaceAll(value, `\`, `\\`)
+	escaped = strings.ReplaceAll(escaped, `'`, `\'`)
+	return "'" + escaped + "'"
+}
+
+func sortAndDedupeNormalizedParts(parts []normalizedPart) []normalizedPart {
+	sort.Slice(parts, func(i, j int) bool { return parts[i].text < parts[j].text })
+
+	deduped := parts[:0]
+	for index, part := range parts {
+		if index > 0 && part.text == parts[index-1].text {
+			continue
+		}
+		deduped = append(deduped, part)
+	}
+
+	return deduped
+}

pkg/querybuilder/where_clause_normalizer_test.go

@@ -0,0 +1,421 @@
+package querybuilder
+
+import (
+	"testing"
+
+	qbtypes "github.com/SigNoz/signoz/pkg/types/querybuildertypes/querybuildertypesv5"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestNormalizeWhereClauseEquivalenceClasses(t *testing.T) {
+	testCases := []struct {
+		name        string
+		expressions []string
+		expected    string
+	}{
+		{
+			name: "spacing and keyword case",
+			expressions: []string{
+				"service.name = 'frontend' AND status = 200",
+				"service.name='frontend' and status=200",
+				"service.name  =  'frontend'  AND  status  =  200",
+				"service.name  =  frontend  AND  status  =  200",
+			},
+			expected: "service.name = 'frontend' AND status = 200",
+		},
+		{
+			name: "operand order",
+			expressions: []string{
+				"a = 1 AND b = 2",
+				"b = 2 AND a = 1",
+			},
+			expected: "a = 1 AND b = 2",
+		},
+		{
+			name: "implicit and explicit AND",
+			expressions: []string{
+				"a = 1 b = 2",
+				"a = 1 AND b = 2",
+			},
+			expected: "a = 1 AND b = 2",
+		},
+		{
+			name: "quote styles",
+			expressions: []string{
+				`a = "frontend"`,
+				"a = 'frontend'",
+			},
+			expected: "a = 'frontend'",
+		},
+		{
+			name: "redundant parentheses",
+			expressions: []string{
+				"(a = 1)",
+				"a = 1",
+				"((a = 1))",
+			},
+			expected: "a = 1",
+		},
+		{
+			name: "in clause forms and value order",
+			expressions: []string{
+				"a IN (1, 2)",
+				"a IN [2, 1]",
+				"a in (2, 1, 1)",
+			},
+			expected: "a IN (1, 2)",
+		},
+		{
+			name: "single value in",
+			expressions: []string{
+				"a IN 1",
+				"a IN (1)",
+				"a IN [1]",
+			},
+			expected: "a IN (1)",
+		},
+		{
+			name: "operator aliases",
+			expressions: []string{
+				"a == 1",
+				"a = 1",
+			},
+			expected: "a = 1",
+		},
+		{
+			name: "not equals aliases",
+			expressions: []string{
+				"a <> 1",
+				"a != 1",
+			},
+			expected: "a != 1",
+		},
+		{
+			name: "duplicate siblings",
+			expressions: []string{
+				"a = 1 AND a = 1",
+				"a = 1",
+			},
+			expected: "a = 1",
+		},
+		{
+			name: "grouped or under and",
+			expressions: []string{
+				"a = 1 AND (b = 2 OR c = 3)",
+				"(c = 3 OR b = 2) AND a = 1",
+			},
+			expected: "(b = 2 OR c = 3) AND a = 1",
+		},
+		{
+			name: "exists spellings",
+			expressions: []string{
+				"service.name EXISTS",
+				"service.name exists",
+				"service.name EXIST",
+			},
+			expected: "service.name EXISTS",
+		},
+		{
+			name: "contains spellings",
+			expressions: []string{
+				"body CONTAINS 'error'",
+				"body contain 'error'",
+			},
+			expected: "body CONTAINS 'error'",
+		},
+		{
+			name: "full text term forms",
+			expressions: []string{
+				`"panic"`,
+				"'panic'",
+				"panic",
+			},
+			expected: "'panic'",
+		},
+		{
+			name: "not without parens",
+			expressions: []string{
+				"NOT a = 1",
+				"not (a = 1)",
+			},
+			expected: "NOT a = 1",
+		},
+		{
+			name: "not over grouped or",
+			expressions: []string{
+				"NOT (b = 2 OR a = 1)",
+				"not (a = 1 or b = 2)",
+			},
+			expected: "NOT (a = 1 OR b = 2)",
+		},
+		{
+			name: "function name case",
+			expressions: []string{
+				"HAS(tags, 'x')",
+				"has(tags, 'x')",
+			},
+			expected: "has(tags, 'x')",
+		},
+		{
+			name: "boolean case",
+			expressions: []string{
+				"a = TRUE",
+				"a = true",
+			},
+			expected: "a = true",
+		},
+		{
+			name: "between",
+			expressions: []string{
+				"duration BETWEEN 1 AND 10",
+				"duration between 1 and 10",
+			},
+			expected: "duration BETWEEN 1 AND 10",
+		},
+		{
+			name: "not in",
+			expressions: []string{
+				"a NOT IN (2, 1)",
+				"a not in [1, 2]",
+			},
+			expected: "a NOT IN (1, 2)",
+		},
+		{
+			name: "key with datatype annotation",
+			expressions: []string{
+				"resource.service.name:string = 'x'",
+			},
+			expected: "resource.service.name:string = 'x'",
+		},
+	}
+
+	for _, testCase := range testCases {
+		t.Run(testCase.name, func(t *testing.T) {
+			for _, expression := range testCase.expressions {
+				canonical, err := NormalizeWhereClause(expression, nil)
+				require.NoError(t, err, "expression %q", expression)
+				assert.Equal(t, testCase.expected, canonical.Expression, "expression %q", expression)
+			}
+		})
+	}
+}
+
+func TestNormalizeWhereClauseNonEquivalence(t *testing.T) {
+	testCases := []struct {
+		name  string
+		left  string
+		right string
+	}{
+		{name: "different values", left: "a = 1", right: "a = 2"},
+		{name: "different keys", left: "a = 1", right: "b = 1"},
+		{name: "different operators", left: "a = 1", right: "a != 1"},
+		{name: "no semantic rewrite of not", left: "NOT a = 1", right: "a != 1"},
+		{name: "number literals as authored", left: "a = 1.0", right: "a = 1"},
+		{name: "between bounds are ordered", left: "a BETWEEN 1 AND 10", right: "a BETWEEN 10 AND 1"},
+		{name: "function params are ordered", left: "has(tags, 'x')", right: "has('x', tags)"},
+		{name: "and vs or", left: "a = 1 AND b = 2", right: "a = 1 OR b = 2"},
+	}
+
+	for _, testCase := range testCases {
+		t.Run(testCase.name, func(t *testing.T) {
+			left, err := NormalizeWhereClause(testCase.left, nil)
+			require.NoError(t, err)
+			right, err := NormalizeWhereClause(testCase.right, nil)
+			require.NoError(t, err)
+			assert.NotEqual(t, left.Expression, right.Expression)
+		})
+	}
+}
+
+func TestNormalizeWhereClauseAtoms(t *testing.T) {
+	canonical, err := NormalizeWhereClause("NOT (a = 1 OR b IN ('y', 'x')) AND service.name EXISTS AND hasAny(tags, ['p', 'q']) AND \"panic\"", nil)
+	require.NoError(t, err)
+
+	expected := []WhereClauseCondition{
+		{Key: "a", Operator: "=", Values: []string{"1"}, Negated: true},
+		{Key: "b", Operator: "IN", Values: []string{"x", "y"}, Negated: true},
+		{Key: "service.name", Operator: "EXISTS", Values: []string{}, Negated: false, TopLevel: true},
+		{Key: "tags", Operator: "hasAny", Values: []string{"p", "q"}, Negated: false, TopLevel: true},
+		{Key: "", Operator: WhereClauseOperatorFullText, Values: []string{"panic"}, Negated: false, TopLevel: true},
+	}
+	assert.ElementsMatch(t, expected, canonical.Conditions)
+}
+
+func TestNormalizeWhereClauseTopLevel(t *testing.T) {
+	testCases := []struct {
+		name       string
+		expression string
+		expected   map[string]bool
+	}{
+		{
+			name:       "and siblings are top level",
+			expression: "service.name = 'a' AND status = 500",
+			expected:   map[string]bool{"service.name": true, "status": true},
+		},
+		{
+			name:       "or branches are not top level",
+			expression: "service.name = 'a' OR status = 500",
+			expected:   map[string]bool{"service.name": false, "status": false},
+		},
+		{
+			name:       "and sibling stays top level next to a grouped or",
+			expression: "service.name = 'a' AND (x = 1 OR y = 2)",
+			expected:   map[string]bool{"service.name": true, "x": false, "y": false},
+		},
+		{
+			name:       "parenthesized pure and group stays top level",
+			expression: "(service.name = 'a' AND b = 2) AND c = 3",
+			expected:   map[string]bool{"service.name": true, "b": true, "c": true},
+		},
+		{
+			name:       "negated condition is not top level",
+			expression: "NOT service.name = 'a' AND status = 500",
+			expected:   map[string]bool{"service.name": false, "status": true},
+		},
+		{
+			name:       "double negation restores top level",
+			expression: "NOT (NOT (service.name = 'a'))",
+			expected:   map[string]bool{"service.name": true},
+		},
+		{
+			name:       "in condition under and is top level",
+			expression: "service.name IN ('a', 'b') AND x = 1",
+			expected:   map[string]bool{"service.name": true, "x": true},
+		},
+	}
+
+	for _, testCase := range testCases {
+		t.Run(testCase.name, func(t *testing.T) {
+			normalized, err := NormalizeWhereClause(testCase.expression, nil)
+			require.NoError(t, err)
+
+			actual := make(map[string]bool)
+			for _, condition := range normalized.Conditions {
+				actual[condition.Key] = condition.TopLevel
+			}
+			assert.Equal(t, testCase.expected, actual)
+		})
+	}
+}
+
+func TestNormalizeWhereClauseEscaping(t *testing.T) {
+	canonical, err := NormalizeWhereClause(`a = "it's fine"`, nil)
+	require.NoError(t, err)
+	assert.Equal(t, `a = 'it\'s fine'`, canonical.Expression)
+	require.Len(t, canonical.Conditions, 1)
+	assert.Equal(t, []string{"it's fine"}, canonical.Conditions[0].Values)
+
+	equivalent, err := NormalizeWhereClause(canonical.Expression, nil)
+	require.NoError(t, err)
+	assert.Equal(t, canonical.Expression, equivalent.Expression)
+	assert.Equal(t, canonical.Conditions, equivalent.Conditions)
+}
+
+func TestNormalizeWhereClauseSyntaxError(t *testing.T) {
+	_, err := NormalizeWhereClause("a = ", nil)
+	require.Error(t, err)
+
+	_, err = NormalizeWhereClause("AND a = 1", nil)
+	require.Error(t, err)
+}
+
+func TestNormalizeWhereClauseIdempotence(t *testing.T) {
+	expressions := []string{
+		"service.name='frontend' and (status = 500 or status=502) not retired k8s.pod.name exists",
+		"a IN [3, 1, 2] AND hasAll(tags, ['a', 'b']) AND body CONTAINS 'x'",
+		"duration BETWEEN 1 AND 10 OR duration > 100",
+		`msg = 'with \'escapes\' and "quotes"'`,
+	}
+
+	for _, expression := range expressions {
+		first, err := NormalizeWhereClause(expression, nil)
+		require.NoError(t, err, "expression %q", expression)
+
+		second, err := NormalizeWhereClause(first.Expression, nil)
+		require.NoError(t, err, "canonical output %q must re-parse", first.Expression)
+		assert.Equal(t, first.Expression, second.Expression, "canonicalization must be idempotent for %q", expression)
+	}
+}
+
+func TestNormalizeWhereClauseVariables(t *testing.T) {
+	variables := map[string]qbtypes.VariableItem{
+		"service":  {Value: "frontend"},
+		"statuses": {Value: []any{float64(502), float64(500)}},
+		"env":      {Type: qbtypes.DynamicVariableType, Value: "__all__"},
+		"limit":    {Value: float64(100)},
+	}
+
+	testCases := []struct {
+		name       string
+		expression string
+		expected   string
+	}{
+		{
+			name:       "scalar substitution",
+			expression: "service.name = $service",
+			expected:   "service.name = 'frontend'",
+		},
+		{
+			name:       "array substitution in IN is sorted",
+			expression: "status IN $statuses",
+			expected:   "status IN (500, 502)",
+		},
+		{
+			name:       "numeric substitution",
+			expression: "duration > $limit",
+			expected:   "duration > 100",
+		},
+		{
+			name:       "dynamic all prunes the condition",
+			expression: "a = 1 AND deployment.environment IN $env",
+			expected:   "a = 1",
+		},
+		{
+			name:       "unknown variable stays a token",
+			expression: "service.name = $unknown",
+			expected:   "service.name = $unknown",
+		},
+		{
+			name:       "substituted forms hash-equal to concrete forms",
+			expression: "status IN (502, 500) AND service.name = 'frontend'",
+			expected:   "service.name = 'frontend' AND status IN (500, 502)",
+		},
+	}
+
+	for _, testCase := range testCases {
+		t.Run(testCase.name, func(t *testing.T) {
+			normalized, err := NormalizeWhereClause(testCase.expression, variables)
+			require.NoError(t, err, "expression %q", testCase.expression)
+			assert.Equal(t, testCase.expected, normalized.Expression)
+		})
+	}
+
+	substituted, err := NormalizeWhereClause("service.name = $service AND status IN $statuses", variables)
+	require.NoError(t, err)
+	concrete, err := NormalizeWhereClause("status IN (500, 502) AND service.name = 'frontend'", nil)
+	require.NoError(t, err)
+	assert.Equal(t, concrete.Expression, substituted.Expression)
+	assert.Equal(t, concrete.Conditions, substituted.Conditions)
+}
+
+func TestNormalizeWhereClauseVariablesFullyPruned(t *testing.T) {
+	variables := map[string]qbtypes.VariableItem{
+		"env": {Type: qbtypes.DynamicVariableType, Value: "__all__"},
+	}
+
+	normalized, err := NormalizeWhereClause("deployment.environment IN $env", variables)
+	require.NoError(t, err)
+	assert.Equal(t, "", normalized.Expression)
+	assert.Empty(t, normalized.Conditions)
+}
+
+func TestNormalizeWhereClauseVariablesEmptyList(t *testing.T) {
+	variables := map[string]qbtypes.VariableItem{
+		"statuses": {Value: []any{}},
+	}
+
+	_, err := NormalizeWhereClause("status IN $statuses", variables)
+	require.Error(t, err)
+}

pkg/querybuilder/where_clause_visitor.go

@@ -371,6 +371,24 @@ func (v *filterExpressionVisitor) VisitComparison(ctx *grammar.ComparisonContext
 	key := v.Visit(ctx.Key()).(*telemetrytypes.TelemetryFieldKey)
 	matching := MatchingFieldKeys(key, v.fieldKeys)
 
+	// Skip resource filtering on the main table when a sub-query covers it; a resolving
+	// condition builder applies this itself in ConditionForKeys.
+	if _, resolvesKeys := v.conditionBuilder.(qbtypes.ResolvingConditionBuilder); v.skipResourceFilter && len(matching) > 0 && !resolvesKeys {
+		resolved, warning := ResolveKeys(key, matching)
+		// emit the ambiguity warning even when the term is skipped below
+		v.addWarnings([]string{warning}, len(matching) > 1)
+		filtered := []*telemetrytypes.TelemetryFieldKey{}
+		for _, k := range resolved {
+			if k.FieldContext != telemetrytypes.FieldContextResource {
+				filtered = append(filtered, k)
+			}
+		}
+		if len(filtered) == 0 {
+			return SkipConditionLiteral
+		}
+		matching = filtered
+	}
+
 	// Handle EXISTS specially
 	if ctx.EXISTS() != nil {
 		op := qbtypes.FilterOperatorExists
@@ -798,7 +816,18 @@ func (v *filterExpressionVisitor) VisitKey(ctx *grammar.KeyContext) any {
 // buildConditions invokes the condition builder for a filter term, folding its
 // warnings/errors into visitor state; returns false if an error was recorded.
 func (v *filterExpressionVisitor) buildConditions(key *telemetrytypes.TelemetryFieldKey, matching []*telemetrytypes.TelemetryFieldKey, op qbtypes.FilterOperator, value any) ([]string, bool) {
-	conds, warns, err := v.conditionBuilder.ConditionForKeys(v.context, v.orgID, v.startNs, v.endNs, key, v.fieldKeys, qbtypes.ConditionBuilderOptions{SkipResourceFilter: v.skipResourceFilter}, op, value, v.builder)
+	var (
+		conds []string
+		warns []string
+		err   error
+	)
+	// A resolving condition builder owns key resolution, so hand it the raw key + full map;
+	// other signals use the pre-matched ConditionFor path.
+	if rcb, ok := v.conditionBuilder.(qbtypes.ResolvingConditionBuilder); ok {
+		conds, warns, err = rcb.ConditionForKeys(v.context, v.orgID, v.startNs, v.endNs, key, v.fieldKeys, qbtypes.ConditionBuilderOptions{SkipResourceFilter: v.skipResourceFilter}, op, value, v.builder)
+	} else {
+		conds, warns, err = v.conditionBuilder.ConditionFor(v.context, v.orgID, v.startNs, v.endNs, key, matching, op, value, v.builder)
+	}
 	if err != nil {
 		_, _, _, _, errURL, _ := errors.Unwrapb(err)
 		assignIfEmpty(&v.mainErrorURL, errURL)

pkg/querybuilder/where_clause_visitor_test.go

@@ -741,21 +741,17 @@ var visitTestKeys = map[string][]*telemetrytypes.TelemetryFieldKey{
 		{Name: "by", FieldContext: telemetrytypes.FieldContextResource, FieldDataType: telemetrytypes.FieldDataTypeString}},
 	"cz": {{Name: "cz", FieldContext: telemetrytypes.FieldContextAttribute, FieldDataType: telemetrytypes.FieldDataTypeNumber},
 		{Name: "cz", FieldContext: telemetrytypes.FieldContextResource, FieldDataType: telemetrytypes.FieldDataTypeString}},
-	// full-text column: a real intrinsic (log context, never resource) so it resolves via the
-	// map and is not dropped under SkipResourceFilter — mirrors logs' DefaultFullTextColumn.
-	"body": {{Name: "body", FieldContext: telemetrytypes.FieldContextLog, FieldDataType: telemetrytypes.FieldDataTypeString}},
 }
 
 type resourceConditionBuilder struct{}
 
-func (b *resourceConditionBuilder) ConditionForKeys(
+func (b *resourceConditionBuilder) ConditionFor(
 	_ context.Context,
 	_ valuer.UUID,
 	_ uint64,
 	_ uint64,
 	key *telemetrytypes.TelemetryFieldKey,
-	fieldKeys map[string][]*telemetrytypes.TelemetryFieldKey,
-	_ qbtypes.ConditionBuilderOptions,
+	fieldKeysForName []*telemetrytypes.TelemetryFieldKey,
 	operator qbtypes.FilterOperator,
 	_ any,
 	_ *sqlbuilder.SelectBuilder,
@@ -766,7 +762,7 @@ func (b *resourceConditionBuilder) ConditionForKeys(
 		return nil, nil, nil
 	}
 
-	keys, warning := ResolveKeys(key, MatchingFieldKeys(key, fieldKeys))
+	keys, warning := ResolveKeys(key, fieldKeysForName)
 	var warnings []string
 	if warning != "" {
 		warnings = append(warnings, warning)
@@ -785,14 +781,13 @@ func (b *resourceConditionBuilder) ConditionForKeys(
 
 type conditionBuilder struct{}
 
-func (b *conditionBuilder) ConditionForKeys(
+func (b *conditionBuilder) ConditionFor(
 	_ context.Context,
 	_ valuer.UUID,
 	_ uint64,
 	_ uint64,
 	key *telemetrytypes.TelemetryFieldKey,
-	fieldKeys map[string][]*telemetrytypes.TelemetryFieldKey,
-	options qbtypes.ConditionBuilderOptions,
+	fieldKeysForName []*telemetrytypes.TelemetryFieldKey,
 	operator qbtypes.FilterOperator,
 	_ any,
 	_ *sqlbuilder.SelectBuilder,
@@ -808,7 +803,7 @@ func (b *conditionBuilder) ConditionForKeys(
 		return []string{fmt.Sprintf("%s_cond", key.Name)}, nil, nil
 	}
 
-	keys, warning := ResolveKeys(key, MatchingFieldKeys(key, fieldKeys))
+	keys, warning := ResolveKeys(key, fieldKeysForName)
 	var warnings []string
 	if warning != "" {
 		warnings = append(warnings, warning)
@@ -818,20 +813,6 @@ func (b *conditionBuilder) ConditionForKeys(
 		return nil, warnings, NewKeyNotFoundError(key.Name)
 	}
 
-	// A resource sub-query already covers the term; drop resource keys from the main query.
-	if options.SkipResourceFilter {
-		filtered := make([]*telemetrytypes.TelemetryFieldKey, 0, len(keys))
-		for _, k := range keys {
-			if k.FieldContext != telemetrytypes.FieldContextResource {
-				filtered = append(filtered, k)
-			}
-		}
-		if len(filtered) == 0 {
-			return nil, warnings, nil
-		}
-		keys = filtered
-	}
-
 	conds := make([]string, 0, len(keys))
 	for _, k := range keys {
 		conds = append(conds, fmt.Sprintf("%s_cond", k.Name))
@@ -869,7 +850,7 @@ func visitComparisonOpts(t *testing.T) (rsbOpts, sbOpts FilterExprVisitorOpts) {
 	// bodyCol is the full-text column; conditionBuilder returns "body_cond" for it.
 	bodyCol := &telemetrytypes.TelemetryFieldKey{
 		Name:          "body",
-		FieldContext:  telemetrytypes.FieldContextLog,
+		FieldContext:  telemetrytypes.FieldContextResource,
 		FieldDataType: telemetrytypes.FieldDataTypeString,
 	}
 	rsbOpts = FilterExprVisitorOpts{

pkg/signoz/provider.go

@@ -220,6 +220,7 @@ func NewSQLMigrationProviderFactories(
 		sqlmigration.NewRemoveOrganizationTuplesFactory(sqlstore),
 		sqlmigration.NewAddRoleTransactionGroupsFactory(sqlstore, sqlschema),
 		sqlmigration.NewAddTagUniqueIndexFactory(sqlstore, sqlschema),
+		sqlmigration.NewAddTelemetryTuplesFactory(sqlstore),
 	)
 }
 

pkg/sqlmigration/101_add_telemetry_tuples.go

@@ -0,0 +1,146 @@
+package sqlmigration
+
+import (
+	"context"
+	"time"
+
+	"github.com/SigNoz/signoz/pkg/factory"
+	"github.com/SigNoz/signoz/pkg/sqlstore"
+	"github.com/SigNoz/signoz/pkg/types/authtypes"
+	"github.com/oklog/ulid/v2"
+	"github.com/uptrace/bun"
+	"github.com/uptrace/bun/dialect"
+	"github.com/uptrace/bun/migrate"
+)
+
+type addTelemetryTuples struct {
+	sqlstore sqlstore.SQLStore
+}
+
+func NewAddTelemetryTuplesFactory(sqlstore sqlstore.SQLStore) factory.ProviderFactory[SQLMigration, Config] {
+	return factory.NewProviderFactory(factory.MustNewName("add_telemetry_tuples"), func(ctx context.Context, ps factory.ProviderSettings, c Config) (SQLMigration, error) {
+		return &addTelemetryTuples{sqlstore: sqlstore}, nil
+	})
+}
+
+func (migration *addTelemetryTuples) Register(migrations *migrate.Migrations) error {
+	return migrations.Register(migration.Up, migration.Down)
+}
+
+func (migration *addTelemetryTuples) Up(ctx context.Context, db *bun.DB) error {
+	tx, err := db.BeginTx(ctx, nil)
+	if err != nil {
+		return err
+	}
+	defer func() { _ = tx.Rollback() }()
+
+	var storeID string
+	err = tx.QueryRowContext(ctx, `SELECT id FROM store WHERE name = ? LIMIT 1`, "signoz").Scan(&storeID)
+	if err != nil {
+		return err
+	}
+
+	var orgIDs []string
+	rows, err := tx.QueryContext(ctx, `SELECT id FROM organizations`)
+	if err != nil {
+		return err
+	}
+	defer rows.Close()
+	for rows.Next() {
+		var orgID string
+		if err := rows.Scan(&orgID); err != nil {
+			return err
+		}
+		orgIDs = append(orgIDs, orgID)
+	}
+
+	isPG := migration.sqlstore.BunDB().Dialect().Name() == dialect.PG
+
+	tuples := []migrationTuple{
+		{authtypes.SigNozAdminRoleName, "telemetryresource", "logs", "read"},
+		{authtypes.SigNozAdminRoleName, "telemetryresource", "traces", "read"},
+		{authtypes.SigNozAdminRoleName, "telemetryresource", "metrics", "read"},
+		{authtypes.SigNozAdminRoleName, "telemetryresource", "audit-logs", "read"},
+		{authtypes.SigNozAdminRoleName, "telemetryresource", "meter-metrics", "read"},
+		{authtypes.SigNozEditorRoleName, "telemetryresource", "logs", "read"},
+		{authtypes.SigNozEditorRoleName, "telemetryresource", "traces", "read"},
+		{authtypes.SigNozEditorRoleName, "telemetryresource", "metrics", "read"},
+		{authtypes.SigNozEditorRoleName, "telemetryresource", "meter-metrics", "read"},
+		{authtypes.SigNozViewerRoleName, "telemetryresource", "logs", "read"},
+		{authtypes.SigNozViewerRoleName, "telemetryresource", "traces", "read"},
+		{authtypes.SigNozViewerRoleName, "telemetryresource", "metrics", "read"},
+		{authtypes.SigNozViewerRoleName, "telemetryresource", "meter-metrics", "read"},
+	}
+
+	for _, orgID := range orgIDs {
+		for _, tuple := range tuples {
+			entropy := ulid.DefaultEntropy()
+			now := time.Now().UTC()
+			tupleID := ulid.MustNew(ulid.Timestamp(now), entropy).String()
+
+			objectID := "organization/" + orgID + "/" + tuple.objectName + "/*"
+			roleSubject := "organization/" + orgID + "/role/" + tuple.roleName
+
+			if isPG {
+				user := "role:" + roleSubject + "#assignee"
+				result, err := tx.ExecContext(ctx, `
+					INSERT INTO tuple (store, object_type, object_id, relation, _user, user_type, ulid, inserted_at)
+					VALUES (?, ?, ?, ?, ?, ?, ?, ?)
+					ON CONFLICT (store, object_type, object_id, relation, _user) DO NOTHING`,
+					storeID, tuple.objectType, objectID, tuple.relation, user, "userset", tupleID, now,
+				)
+				if err != nil {
+					return err
+				}
+				rowsAffected, err := result.RowsAffected()
+				if err != nil {
+					return err
+				}
+				if rowsAffected == 0 {
+					continue
+				}
+				_, err = tx.ExecContext(ctx, `
+					INSERT INTO changelog (store, object_type, object_id, relation, _user, operation, ulid, inserted_at)
+					VALUES (?, ?, ?, ?, ?, ?, ?, ?)
+					ON CONFLICT (store, ulid, object_type) DO NOTHING`,
+					storeID, tuple.objectType, objectID, tuple.relation, user, "TUPLE_OPERATION_WRITE", tupleID, now,
+				)
+				if err != nil {
+					return err
+				}
+			} else {
+				result, err := tx.ExecContext(ctx, `
+					INSERT INTO tuple (store, object_type, object_id, relation, user_object_type, user_object_id, user_relation, user_type, ulid, inserted_at)
+					VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+					ON CONFLICT (store, object_type, object_id, relation, user_object_type, user_object_id, user_relation) DO NOTHING`,
+					storeID, tuple.objectType, objectID, tuple.relation, "role", roleSubject, "assignee", "userset", tupleID, now,
+				)
+				if err != nil {
+					return err
+				}
+				rowsAffected, err := result.RowsAffected()
+				if err != nil {
+					return err
+				}
+				if rowsAffected == 0 {
+					continue
+				}
+				_, err = tx.ExecContext(ctx, `
+					INSERT INTO changelog (store, object_type, object_id, relation, user_object_type, user_object_id, user_relation, operation, ulid, inserted_at)
+					VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+					ON CONFLICT (store, ulid, object_type) DO NOTHING`,
+					storeID, tuple.objectType, objectID, tuple.relation, "role", roleSubject, "assignee", 0, tupleID, now,
+				)
+				if err != nil {
+					return err
+				}
+			}
+		}
+	}
+
+	return tx.Commit()
+}
+
+func (migration *addTelemetryTuples) Down(context.Context, *bun.DB) error {
+	return nil
+}

pkg/telemetryaudit/condition_builder.go

@@ -4,6 +4,7 @@ import (
 	"context"
 	"fmt"
 
+	schema "github.com/SigNoz/signoz-otel-collector/cmd/signozschemamigrator/schema_migrator"
 	"github.com/SigNoz/signoz/pkg/errors"
 	"github.com/SigNoz/signoz/pkg/querybuilder"
 	qbtypes "github.com/SigNoz/signoz/pkg/types/querybuildertypes/querybuildertypesv5"
@@ -29,6 +30,11 @@ func (c *conditionBuilder) conditionFor(
 	value any,
 	sb *sqlbuilder.SelectBuilder,
 ) (string, error) {
+	columns, err := c.fm.ColumnFor(ctx, orgID, startNs, endNs, key)
+	if err != nil {
+		return "", err
+	}
+
 	if operator.IsStringSearchOperator() {
 		value = querybuilder.FormatValueForContains(value)
 	}
@@ -108,27 +114,71 @@ func (c *conditionBuilder) conditionFor(
 		}
 		return sb.And(conditions...), nil
 	case qbtypes.FilterOperatorExists, qbtypes.FilterOperatorNotExists:
-		columns, err := c.fm.ColumnFor(ctx, orgID, startNs, endNs, key)
-		if err != nil {
-			return "", err
+		var value any
+		column := columns[0]
+
+		switch column.Type.GetType() {
+		case schema.ColumnTypeEnumJSON:
+			if operator == qbtypes.FilterOperatorExists {
+				return sb.IsNotNull(fieldExpression), nil
+			}
+			return sb.IsNull(fieldExpression), nil
+		case schema.ColumnTypeEnumLowCardinality:
+			switch elementType := column.Type.(schema.LowCardinalityColumnType).ElementType; elementType.GetType() {
+			case schema.ColumnTypeEnumString:
+				value = ""
+				if operator == qbtypes.FilterOperatorExists {
+					return sb.NE(fieldExpression, value), nil
+				}
+				return sb.E(fieldExpression, value), nil
+			default:
+				return "", errors.NewInvalidInputf(errors.CodeInvalidInput, "exists operator is not supported for low cardinality column type %s", elementType)
+			}
+		case schema.ColumnTypeEnumString:
+			value = ""
+			if operator == qbtypes.FilterOperatorExists {
+				return sb.NE(fieldExpression, value), nil
+			}
+			return sb.E(fieldExpression, value), nil
+		case schema.ColumnTypeEnumUInt64, schema.ColumnTypeEnumUInt32, schema.ColumnTypeEnumUInt8:
+			value = 0
+			if operator == qbtypes.FilterOperatorExists {
+				return sb.NE(fieldExpression, value), nil
+			}
+			return sb.E(fieldExpression, value), nil
+		case schema.ColumnTypeEnumMap:
+			keyType := column.Type.(schema.MapColumnType).KeyType
+			if _, ok := keyType.(schema.LowCardinalityColumnType); !ok {
+				return "", errors.NewInvalidInputf(errors.CodeInvalidInput, "key type %s is not supported for map column type %s", keyType, column.Type)
+			}
+
+			switch valueType := column.Type.(schema.MapColumnType).ValueType; valueType.GetType() {
+			case schema.ColumnTypeEnumString, schema.ColumnTypeEnumBool, schema.ColumnTypeEnumFloat64:
+				leftOperand := fmt.Sprintf("mapContains(%s, '%s')", column.Name, key.Name)
+				if key.Materialized {
+					leftOperand = telemetrytypes.FieldKeyToMaterializedColumnNameForExists(key)
+				}
+				if operator == qbtypes.FilterOperatorExists {
+					return sb.E(leftOperand, true), nil
+				}
+				return sb.NE(leftOperand, true), nil
+			default:
+				return "", errors.NewInvalidInputf(errors.CodeInvalidInput, "exists operator is not supported for map column type %s", valueType)
+			}
+		default:
+			return "", errors.NewInvalidInputf(errors.CodeInvalidInput, "exists operator is not supported for column type %s", column.Type)
 		}
-		pred, err := querybuilder.ExistsExpression(columns, key, startNs, endNs, fieldExpression, operator == qbtypes.FilterOperatorExists)
-		if err != nil {
-			return "", err
-		}
-		return sqlbuilder.Escape(pred), nil
 	}
 	return "", errors.NewInvalidInputf(errors.CodeInvalidInput, "unsupported operator: %v", operator)
 }
 
-func (c *conditionBuilder) ConditionForKeys(
+func (c *conditionBuilder) ConditionFor(
 	ctx context.Context,
 	orgID valuer.UUID,
 	startNs uint64,
 	endNs uint64,
 	key *telemetrytypes.TelemetryFieldKey,
-	fieldKeys map[string][]*telemetrytypes.TelemetryFieldKey,
-	options qbtypes.ConditionBuilderOptions,
+	fieldKeysForName []*telemetrytypes.TelemetryFieldKey,
 	operator qbtypes.FilterOperator,
 	value any,
 	sb *sqlbuilder.SelectBuilder,
@@ -139,7 +189,7 @@ func (c *conditionBuilder) ConditionForKeys(
 		return nil, nil, err
 	}
 
-	keys, warning := querybuilder.ResolveKeys(key, querybuilder.MatchingFieldKeys(key, fieldKeys))
+	keys, warning := querybuilder.ResolveKeys(key, fieldKeysForName)
 	var warnings []string
 	if warning != "" {
 		warnings = append(warnings, warning)
@@ -148,20 +198,6 @@ func (c *conditionBuilder) ConditionForKeys(
 		return nil, warnings, querybuilder.NewKeyNotFoundError(key.Name)
 	}
 
-	// Drop resource keys the sub-query already covers; if none remain, skip the term (not an error).
-	if options.SkipResourceFilter {
-		filtered := make([]*telemetrytypes.TelemetryFieldKey, 0, len(keys))
-		for _, k := range keys {
-			if k.FieldContext != telemetrytypes.FieldContextResource {
-				filtered = append(filtered, k)
-			}
-		}
-		if len(filtered) == 0 {
-			return nil, warnings, nil
-		}
-		keys = filtered
-	}
-
 	conds := make([]string, 0, len(keys))
 	for _, k := range keys {
 		cond, err := c.conditionForKey(ctx, orgID, startNs, endNs, k, operator, value, sb)

pkg/telemetryaudit/field_mapper.go

@@ -6,7 +6,6 @@ import (
 
 	schema "github.com/SigNoz/signoz-otel-collector/cmd/signozschemamigrator/schema_migrator"
 	"github.com/SigNoz/signoz/pkg/errors"
-	"github.com/SigNoz/signoz/pkg/querybuilder"
 	qbtypes "github.com/SigNoz/signoz/pkg/types/querybuildertypes/querybuildertypesv5"
 	"github.com/SigNoz/signoz/pkg/types/telemetrytypes"
 	"github.com/SigNoz/signoz/pkg/valuer"
@@ -102,10 +101,8 @@ func (m *fieldMapper) ColumnExpressionFor(
 	orgID valuer.UUID,
 	tsStart, tsEnd uint64,
 	field *telemetrytypes.TelemetryFieldKey,
-	requiredDataType telemetrytypes.FieldDataType,
 	keys map[string][]*telemetrytypes.TelemetryFieldKey,
 ) (string, error) {
-	resolved := field
 	fieldExpression, err := m.FieldFor(ctx, orgID, tsStart, tsEnd, field)
 	if errors.Is(err, qbtypes.ErrColumnNotFound) {
 		keysForField := keys[field.Name]
@@ -118,31 +115,10 @@ func (m *fieldMapper) ColumnExpressionFor(
 				return "", wrappedErr
 			}
 		} else {
-			resolved = keysForField[0]
 			fieldExpression, _ = m.FieldFor(ctx, orgID, tsStart, tsEnd, keysForField[0])
 		}
 	}
 
-	// Group-by/order (String) and aggregation (String/Float64): exists-guarded and coerced
-	// to requiredDataType, returned bare (the caller adds any alias). Raw select
-	// (Unspecified) returns the aliased column expression.
-	if requiredDataType != telemetrytypes.FieldDataTypeUnspecified {
-		var dummyValue any = ""
-		if requiredDataType == telemetrytypes.FieldDataTypeFloat64 {
-			dummyValue = 0.0
-		}
-		columns, err := m.getColumn(ctx, resolved)
-		if err != nil {
-			return "", err
-		}
-		guard, err := querybuilder.ExistsExpression(columns, resolved, tsStart, tsEnd, fieldExpression, true)
-		if err != nil {
-			return "", err
-		}
-		coerced, _ := querybuilder.DataTypeCollisionHandledFieldName(resolved, dummyValue, fieldExpression, qbtypes.FilterOperatorUnknown)
-		return fmt.Sprintf("multiIf(%s, %s, NULL)", guard, coerced), nil
-	}
-
 	return fmt.Sprintf("%s AS `%s`", sqlbuilder.Escape(fieldExpression), field.Name), nil
 }
 

pkg/telemetryaudit/statement_builder.go

@@ -245,7 +245,7 @@ func (b *auditQueryStatementBuilder) buildListQuery(
 				continue
 			}
 
-			colExpr, err := b.fm.ColumnExpressionFor(ctx, orgID, start, end, &query.SelectFields[index], telemetrytypes.FieldDataTypeUnspecified, keys)
+			colExpr, err := b.fm.ColumnExpressionFor(ctx, orgID, start, end, &query.SelectFields[index], keys)
 			if err != nil {
 				return nil, err
 			}
@@ -261,7 +261,7 @@ func (b *auditQueryStatementBuilder) buildListQuery(
 	}
 
 	for _, orderBy := range query.Order {
-		colExpr, err := b.fm.ColumnExpressionFor(ctx, orgID, start, end, &orderBy.Key.TelemetryFieldKey, telemetrytypes.FieldDataTypeUnspecified, keys)
+		colExpr, err := b.fm.ColumnExpressionFor(ctx, orgID, start, end, &orderBy.Key.TelemetryFieldKey, keys)
 		if err != nil {
 			return nil, err
 		}
@@ -323,12 +323,13 @@ func (b *auditQueryStatementBuilder) buildTimeSeriesQuery(
 
 	fieldNames := make([]string, 0, len(query.GroupBy))
 	for _, gb := range query.GroupBy {
-		expr, err := b.fm.ColumnExpressionFor(ctx, orgID, start, end, &gb.TelemetryFieldKey, telemetrytypes.FieldDataTypeString, keys)
+		expr, args, err := querybuilder.CollisionHandledFinalExpr(ctx, orgID, start, end, &gb.TelemetryFieldKey, b.fm, b.cb, keys, telemetrytypes.FieldDataTypeString, b.jsonKeyToKey, false)
 		if err != nil {
 			return nil, err
 		}
 
-		colExpr := fmt.Sprintf("toString(%s) AS `%s`", sqlbuilder.Escape(expr), gb.Name)
+		colExpr := fmt.Sprintf("toString(%s) AS `%s`", expr, gb.Name)
+		allGroupByArgs = append(allGroupByArgs, args...)
 		sb.SelectMore(colExpr)
 		fieldNames = append(fieldNames, fmt.Sprintf("`%s`", gb.Name))
 	}
@@ -458,12 +459,13 @@ func (b *auditQueryStatementBuilder) buildScalarQuery(
 	var allGroupByArgs []any
 
 	for _, gb := range query.GroupBy {
-		expr, err := b.fm.ColumnExpressionFor(ctx, orgID, start, end, &gb.TelemetryFieldKey, telemetrytypes.FieldDataTypeString, keys)
+		expr, args, err := querybuilder.CollisionHandledFinalExpr(ctx, orgID, start, end, &gb.TelemetryFieldKey, b.fm, b.cb, keys, telemetrytypes.FieldDataTypeString, b.jsonKeyToKey, false)
 		if err != nil {
 			return nil, err
 		}
 
-		colExpr := fmt.Sprintf("toString(%s) AS `%s`", sqlbuilder.Escape(expr), gb.Name)
+		colExpr := fmt.Sprintf("toString(%s) AS `%s`", expr, gb.Name)
+		allGroupByArgs = append(allGroupByArgs, args...)
 		sb.SelectMore(colExpr)
 	}
 

pkg/telemetryaudit/statement_builder_test.go

@@ -56,7 +56,7 @@ func newTestAuditStatementBuilder(t *testing.T) *auditQueryStatementBuilder {
 
 	fm := NewFieldMapper()
 	cb := NewConditionBuilder(fm)
-	aggExprRewriter := querybuilder.NewAggExprRewriter(instrumentationtest.New().ToProviderSettings(), nil, fm, cb, fl)
+	aggExprRewriter := querybuilder.NewAggExprRewriter(instrumentationtest.New().ToProviderSettings(), nil, fm, cb, nil, fl)
 
 	return NewAuditQueryStatementBuilder(
 		instrumentationtest.New().ToProviderSettings(),
@@ -94,8 +94,8 @@ func TestStatementBuilder(t *testing.T) {
 				Limit: 100,
 			},
 			expected: qbtypes.Statement{
-				Query: "SELECT timestamp, id, trace_id, span_id, trace_flags, severity_text, severity_number, scope_name, scope_version, body, event_name, attributes_string, attributes_number, attributes_bool, resource, scope_string FROM signoz_audit.distributed_logs WHERE (`attribute_string_signoz$$audit$$principal$$id` = ? AND `attribute_string_signoz$$audit$$principal$$id_exists`) AND timestamp >= ? AND ts_bucket_start >= ? AND timestamp < ? AND ts_bucket_start <= ? LIMIT ?",
-				Args:  []any{"019a-1234-abcd-5678", "1747947419000000000", uint64(1747945619), "1747983448000000000", uint64(1747983448), 100},
+				Query: "SELECT timestamp, id, trace_id, span_id, trace_flags, severity_text, severity_number, scope_name, scope_version, body, event_name, attributes_string, attributes_number, attributes_bool, resource, scope_string FROM signoz_audit.distributed_logs WHERE (`attribute_string_signoz$$audit$$principal$$id` = ? AND `attribute_string_signoz$$audit$$principal$$id_exists` = ?) AND timestamp >= ? AND ts_bucket_start >= ? AND timestamp < ? AND ts_bucket_start <= ? LIMIT ?",
+				Args:  []any{"019a-1234-abcd-5678", true, "1747947419000000000", uint64(1747945619), "1747983448000000000", uint64(1747983448), 100},
 			},
 		},
 		// List: all failed actions (materialized outcome filter)
@@ -111,8 +111,8 @@ func TestStatementBuilder(t *testing.T) {
 				Limit: 100,
 			},
 			expected: qbtypes.Statement{
-				Query: "SELECT timestamp, id, trace_id, span_id, trace_flags, severity_text, severity_number, scope_name, scope_version, body, event_name, attributes_string, attributes_number, attributes_bool, resource, scope_string FROM signoz_audit.distributed_logs WHERE (`attribute_string_signoz$$audit$$outcome` = ? AND `attribute_string_signoz$$audit$$outcome_exists`) AND timestamp >= ? AND ts_bucket_start >= ? AND timestamp < ? AND ts_bucket_start <= ? LIMIT ?",
-				Args:  []any{"failure", "1747947419000000000", uint64(1747945619), "1747983448000000000", uint64(1747983448), 100},
+				Query: "SELECT timestamp, id, trace_id, span_id, trace_flags, severity_text, severity_number, scope_name, scope_version, body, event_name, attributes_string, attributes_number, attributes_bool, resource, scope_string FROM signoz_audit.distributed_logs WHERE (`attribute_string_signoz$$audit$$outcome` = ? AND `attribute_string_signoz$$audit$$outcome_exists` = ?) AND timestamp >= ? AND ts_bucket_start >= ? AND timestamp < ? AND ts_bucket_start <= ? LIMIT ?",
+				Args:  []any{"failure", true, "1747947419000000000", uint64(1747945619), "1747983448000000000", uint64(1747983448), 100},
 			},
 		},
 		// List: change history of a specific dashboard (two materialized column AND)
@@ -145,8 +145,8 @@ func TestStatementBuilder(t *testing.T) {
 				Limit: 100,
 			},
 			expected: qbtypes.Statement{
-				Query: "WITH __resource_filter AS (SELECT fingerprint FROM signoz_audit.distributed_logs_resource WHERE (simpleJSONExtractString(labels, 'signoz.audit.resource.kind') = ? AND labels LIKE ? AND labels LIKE ?) AND seen_at_ts_bucket_start >= ? AND seen_at_ts_bucket_start <= ? GROUP BY fingerprint) SELECT timestamp, id, trace_id, span_id, trace_flags, severity_text, severity_number, scope_name, scope_version, body, event_name, attributes_string, attributes_number, attributes_bool, resource, scope_string FROM signoz_audit.distributed_logs WHERE resource_fingerprint GLOBAL IN (SELECT fingerprint FROM __resource_filter) AND (`attribute_string_signoz$$audit$$action` = ? AND `attribute_string_signoz$$audit$$action_exists`) AND timestamp >= ? AND ts_bucket_start >= ? AND timestamp < ? AND ts_bucket_start <= ? LIMIT ?",
-				Args:  []any{"dashboard", "%signoz.audit.resource.kind%", "%signoz.audit.resource.kind\":\"dashboard%", uint64(1747945619), uint64(1747983448), "delete", "1747947419000000000", uint64(1747945619), "1747983448000000000", uint64(1747983448), 100},
+				Query: "WITH __resource_filter AS (SELECT fingerprint FROM signoz_audit.distributed_logs_resource WHERE (simpleJSONExtractString(labels, 'signoz.audit.resource.kind') = ? AND labels LIKE ? AND labels LIKE ?) AND seen_at_ts_bucket_start >= ? AND seen_at_ts_bucket_start <= ? GROUP BY fingerprint) SELECT timestamp, id, trace_id, span_id, trace_flags, severity_text, severity_number, scope_name, scope_version, body, event_name, attributes_string, attributes_number, attributes_bool, resource, scope_string FROM signoz_audit.distributed_logs WHERE resource_fingerprint GLOBAL IN (SELECT fingerprint FROM __resource_filter) AND (`attribute_string_signoz$$audit$$action` = ? AND `attribute_string_signoz$$audit$$action_exists` = ?) AND timestamp >= ? AND ts_bucket_start >= ? AND timestamp < ? AND ts_bucket_start <= ? LIMIT ?",
+				Args:  []any{"dashboard", "%signoz.audit.resource.kind%", "%signoz.audit.resource.kind\":\"dashboard%", uint64(1747945619), uint64(1747983448), "delete", true, "1747947419000000000", uint64(1747945619), "1747983448000000000", uint64(1747983448), 100},
 			},
 		},
 		// List: all actions by service accounts (materialized principal.type)
@@ -162,8 +162,8 @@ func TestStatementBuilder(t *testing.T) {
 				Limit: 100,
 			},
 			expected: qbtypes.Statement{
-				Query: "SELECT timestamp, id, trace_id, span_id, trace_flags, severity_text, severity_number, scope_name, scope_version, body, event_name, attributes_string, attributes_number, attributes_bool, resource, scope_string FROM signoz_audit.distributed_logs WHERE (`attribute_string_signoz$$audit$$principal$$type` = ? AND `attribute_string_signoz$$audit$$principal$$type_exists`) AND timestamp >= ? AND ts_bucket_start >= ? AND timestamp < ? AND ts_bucket_start <= ? LIMIT ?",
-				Args:  []any{"service_account", "1747947419000000000", uint64(1747945619), "1747983448000000000", uint64(1747983448), 100},
+				Query: "SELECT timestamp, id, trace_id, span_id, trace_flags, severity_text, severity_number, scope_name, scope_version, body, event_name, attributes_string, attributes_number, attributes_bool, resource, scope_string FROM signoz_audit.distributed_logs WHERE (`attribute_string_signoz$$audit$$principal$$type` = ? AND `attribute_string_signoz$$audit$$principal$$type_exists` = ?) AND timestamp >= ? AND ts_bucket_start >= ? AND timestamp < ? AND ts_bucket_start <= ? LIMIT ?",
+				Args:  []any{"service_account", true, "1747947419000000000", uint64(1747945619), "1747983448000000000", uint64(1747983448), 100},
 			},
 		},
 		// Scalar: alert — count forbidden errors (outcome + action AND)
@@ -182,8 +182,8 @@ func TestStatementBuilder(t *testing.T) {
 				},
 			},
 			expected: qbtypes.Statement{
-				Query: "SELECT count() AS __result_0 FROM signoz_audit.distributed_logs WHERE ((`attribute_string_signoz$$audit$$outcome` = ? AND `attribute_string_signoz$$audit$$outcome_exists`) AND (`attribute_string_signoz$$audit$$action` = ? AND `attribute_string_signoz$$audit$$action_exists`)) AND timestamp >= ? AND ts_bucket_start >= ? AND timestamp < ? AND ts_bucket_start <= ? ORDER BY __result_0 DESC",
-				Args:  []any{"failure", "update", "1747947419000000000", uint64(1747945619), "1747983448000000000", uint64(1747983448)},
+				Query: "SELECT count() AS __result_0 FROM signoz_audit.distributed_logs WHERE ((`attribute_string_signoz$$audit$$outcome` = ? AND `attribute_string_signoz$$audit$$outcome_exists` = ?) AND (`attribute_string_signoz$$audit$$action` = ? AND `attribute_string_signoz$$audit$$action_exists` = ?)) AND timestamp >= ? AND ts_bucket_start >= ? AND timestamp < ? AND ts_bucket_start <= ? ORDER BY __result_0 DESC",
+				Args:  []any{"failure", true, "update", true, "1747947419000000000", uint64(1747945619), "1747983448000000000", uint64(1747983448)},
 			},
 		},
 		// TimeSeries: failures grouped by principal email with top-N limit
@@ -206,8 +206,8 @@ func TestStatementBuilder(t *testing.T) {
 				Limit: 5,
 			},
 			expected: qbtypes.Statement{
-				Query: "WITH __limit_cte AS (SELECT toString(multiIf(`attribute_string_signoz$$audit$$principal$$email_exists`, `attribute_string_signoz$$audit$$principal$$email`, NULL)) AS `signoz.audit.principal.email`, count() AS __result_0 FROM signoz_audit.distributed_logs WHERE (`attribute_string_signoz$$audit$$outcome` = ? AND `attribute_string_signoz$$audit$$outcome_exists`) AND timestamp >= ? AND ts_bucket_start >= ? AND timestamp < ? AND ts_bucket_start <= ? GROUP BY `signoz.audit.principal.email` ORDER BY __result_0 DESC LIMIT ?) SELECT toStartOfInterval(fromUnixTimestamp64Nano(timestamp), INTERVAL 60 SECOND) AS ts, toString(multiIf(`attribute_string_signoz$$audit$$principal$$email_exists`, `attribute_string_signoz$$audit$$principal$$email`, NULL)) AS `signoz.audit.principal.email`, count() AS __result_0 FROM signoz_audit.distributed_logs WHERE (`attribute_string_signoz$$audit$$outcome` = ? AND `attribute_string_signoz$$audit$$outcome_exists`) AND timestamp >= ? AND ts_bucket_start >= ? AND timestamp < ? AND ts_bucket_start <= ? AND (`signoz.audit.principal.email`) GLOBAL IN (SELECT `signoz.audit.principal.email` FROM __limit_cte) GROUP BY ts, `signoz.audit.principal.email`",
-				Args:  []any{"failure", "1747947419000000000", uint64(1747945619), "1747983448000000000", uint64(1747983448), 5, "failure", "1747947419000000000", uint64(1747945619), "1747983448000000000", uint64(1747983448)},
+				Query: "WITH __limit_cte AS (SELECT toString(multiIf(`attribute_string_signoz$$audit$$principal$$email_exists` = ?, `attribute_string_signoz$$audit$$principal$$email`, NULL)) AS `signoz.audit.principal.email`, count() AS __result_0 FROM signoz_audit.distributed_logs WHERE (`attribute_string_signoz$$audit$$outcome` = ? AND `attribute_string_signoz$$audit$$outcome_exists` = ?) AND timestamp >= ? AND ts_bucket_start >= ? AND timestamp < ? AND ts_bucket_start <= ? GROUP BY `signoz.audit.principal.email` ORDER BY __result_0 DESC LIMIT ?) SELECT toStartOfInterval(fromUnixTimestamp64Nano(timestamp), INTERVAL 60 SECOND) AS ts, toString(multiIf(`attribute_string_signoz$$audit$$principal$$email_exists` = ?, `attribute_string_signoz$$audit$$principal$$email`, NULL)) AS `signoz.audit.principal.email`, count() AS __result_0 FROM signoz_audit.distributed_logs WHERE (`attribute_string_signoz$$audit$$outcome` = ? AND `attribute_string_signoz$$audit$$outcome_exists` = ?) AND timestamp >= ? AND ts_bucket_start >= ? AND timestamp < ? AND ts_bucket_start <= ? AND (`signoz.audit.principal.email`) GLOBAL IN (SELECT `signoz.audit.principal.email` FROM __limit_cte) GROUP BY ts, `signoz.audit.principal.email`",
+				Args:  []any{true, "failure", true, "1747947419000000000", uint64(1747945619), "1747983448000000000", uint64(1747983448), 5, true, "failure", true, "1747947419000000000", uint64(1747945619), "1747983448000000000", uint64(1747983448)},
 			},
 		},
 	}

pkg/telemetrylogs/condition_builder.go

@@ -21,8 +21,6 @@ type conditionBuilder struct {
 	fl flagger.Flagger
 }
 
-var _ qbtypes.ConditionBuilder = (*conditionBuilder)(nil)
-
 func NewConditionBuilder(fm qbtypes.FieldMapper, fl flagger.Flagger) *conditionBuilder {
 	return &conditionBuilder{fm: fm, fl: fl}
 }
@@ -135,12 +133,6 @@ func (c *conditionBuilder) conditionFor(
 	}
 
 	columns, err := c.fm.ColumnFor(ctx, orgID, startNs, endNs, key)
-	if errors.Is(err, qbtypes.ErrColumnNotFound) && key.FieldContext == telemetrytypes.FieldContextUnspecified {
-		bodyKey := *key
-		bodyKey.FieldContext = telemetrytypes.FieldContextBody
-		key = &bodyKey
-		columns, err = c.fm.ColumnFor(ctx, orgID, startNs, endNs, key)
-	}
 	if err != nil {
 		return "", err
 	}
@@ -155,15 +147,6 @@ func (c *conditionBuilder) conditionFor(
 	for _, column := range columns {
 		if column.Type.GetType() == schema.ColumnTypeEnumJSON && isBodyJSONSearch(key, columns) && c.fl.BooleanOrEmpty(ctx, flagger.FeatureUseJSONBody, featuretypes.NewFlaggerEvaluationContext(orgID)) && key.Name != messageSubField {
 			valueType, value := InferDataType(value, operator, key)
-			if len(key.JSONPlan) == 0 {
-				keyCopy := *key
-				if err := keyCopy.SetExhaustiveJSONAccessPlan(
-					telemetrytypes.JSONColumnMetadata{BaseColumn: LogsV2BodyV2Column}, valueType,
-				); err != nil {
-					return "", err
-				}
-				key = &keyCopy
-			}
 			cond, err := NewJSONConditionBuilder(key, valueType).buildJSONCondition(operator, value, sb)
 			if err != nil {
 				return "", err
@@ -232,19 +215,6 @@ func (c *conditionBuilder) conditionFor(
 	case qbtypes.FilterOperatorNotILike:
 		return sb.NotILike(fieldExpression, value), nil
 
-	case qbtypes.FilterOperatorExists, qbtypes.FilterOperatorNotExists:
-		if isBodyJSONSearch(key, columns) && !c.fl.BooleanOrEmpty(ctx, flagger.FeatureUseJSONBody, featuretypes.NewFlaggerEvaluationContext(orgID)) {
-			if operator == qbtypes.FilterOperatorExists {
-				return GetBodyJSONKeyForExists(ctx, key, operator, value), nil
-			}
-			return "NOT " + GetBodyJSONKeyForExists(ctx, key, operator, value), nil
-		}
-		pred, err := querybuilder.ExistsExpression(columns, key, startNs, endNs, fieldExpression, operator == qbtypes.FilterOperatorExists)
-		if err != nil {
-			return "", err
-		}
-		return sqlbuilder.Escape(pred), nil
-
 	case qbtypes.FilterOperatorContains:
 		return sb.ILike(fieldExpression, fmt.Sprintf("%%%s%%", value)), nil
 	case qbtypes.FilterOperatorNotContains:
@@ -302,110 +272,142 @@ func (c *conditionBuilder) conditionFor(
 		}
 		return sb.And(conditions...), nil
 
+	// exists and not exists
+	// in the UI based query builder, `exists` and `not exists` are used for
+	// key membership checks, so depending on the column type, the condition changes
+	case qbtypes.FilterOperatorExists, qbtypes.FilterOperatorNotExists:
+		if isBodyJSONSearch(key, columns) && !c.fl.BooleanOrEmpty(ctx, flagger.FeatureUseJSONBody, featuretypes.NewFlaggerEvaluationContext(orgID)) {
+			if operator == qbtypes.FilterOperatorExists {
+				return GetBodyJSONKeyForExists(ctx, key, operator, value), nil
+			} else {
+				return "NOT " + GetBodyJSONKeyForExists(ctx, key, operator, value), nil
+			}
+		}
+
+		var value any
+		column := columns[0]
+		if len(key.Evolutions) > 0 {
+			// we will use the corresponding column and its evolution entry for the query
+			newColumns, _, err := qbtypes.SelectEvolutionsForColumns(columns, key.Evolutions, startNs, endNs)
+			if err != nil {
+				return "", err
+			}
+
+			if len(newColumns) == 0 {
+				return "", errors.NewInvalidInputf(errors.CodeInvalidInput, "no valid evolution found for field %s in the given time range", key.Name)
+			}
+
+			// This mean tblFieldName is with multiIf, we just need to do a null check.
+			if len(newColumns) > 1 {
+				if operator == qbtypes.FilterOperatorExists {
+					return sb.IsNotNull(fieldExpression), nil
+				} else {
+					return sb.IsNull(fieldExpression), nil
+				}
+			}
+
+			// otherwise we have to find the correct exist operator based on the column type
+			column = newColumns[0]
+		}
+
+		switch column.Type.GetType() {
+		case schema.ColumnTypeEnumJSON:
+			if operator == qbtypes.FilterOperatorExists {
+				return sb.IsNotNull(fieldExpression), nil
+			}
+			return sb.IsNull(fieldExpression), nil
+		case schema.ColumnTypeEnumLowCardinality:
+			switch elementType := column.Type.(schema.LowCardinalityColumnType).ElementType; elementType.GetType() {
+			case schema.ColumnTypeEnumString:
+				value = ""
+				if operator == qbtypes.FilterOperatorExists {
+					return sb.NE(fieldExpression, value), nil
+				}
+				return sb.E(fieldExpression, value), nil
+			default:
+				return "", errors.NewInvalidInputf(errors.CodeInvalidInput, "exists operator is not supported for low cardinality column type %s", elementType)
+			}
+		case schema.ColumnTypeEnumString:
+			value = ""
+			if operator == qbtypes.FilterOperatorExists {
+				return sb.NE(fieldExpression, value), nil
+			} else {
+				return sb.E(fieldExpression, value), nil
+			}
+		case schema.ColumnTypeEnumUInt64, schema.ColumnTypeEnumUInt32, schema.ColumnTypeEnumUInt8:
+			value = 0
+			if operator == qbtypes.FilterOperatorExists {
+				return sb.NE(fieldExpression, value), nil
+			} else {
+				return sb.E(fieldExpression, value), nil
+			}
+		case schema.ColumnTypeEnumMap:
+			keyType := column.Type.(schema.MapColumnType).KeyType
+			if _, ok := keyType.(schema.LowCardinalityColumnType); !ok {
+				return "", errors.NewInvalidInputf(errors.CodeInvalidInput, "key type %s is not supported for map column type %s", keyType, column.Type)
+			}
+
+			switch valueType := column.Type.(schema.MapColumnType).ValueType; valueType.GetType() {
+			case schema.ColumnTypeEnumString, schema.ColumnTypeEnumBool, schema.ColumnTypeEnumFloat64:
+				leftOperand := fmt.Sprintf("mapContains(%s, '%s')", column.Name, key.Name)
+				if key.Materialized {
+					leftOperand = telemetrytypes.FieldKeyToMaterializedColumnNameForExists(key)
+				}
+				if operator == qbtypes.FilterOperatorExists {
+					return sb.E(leftOperand, true), nil
+				} else {
+					return sb.NE(leftOperand, true), nil
+				}
+			default:
+				return "", errors.NewInvalidInputf(errors.CodeInvalidInput, "exists operator is not supported for map column type %s", valueType)
+			}
+		default:
+			return "", errors.NewInvalidInputf(errors.CodeInvalidInput, "exists operator is not supported for column type %s", column.Type)
+
+		}
 	}
 	return "", errors.NewInvalidInputf(errors.CodeInvalidInput, "unsupported operator: %v", operator)
 }
 
-func (c *conditionBuilder) ConditionForKeys(
+func (c *conditionBuilder) ConditionFor(
 	ctx context.Context,
 	orgID valuer.UUID,
 	startNs uint64,
 	endNs uint64,
 	key *telemetrytypes.TelemetryFieldKey,
-	keys map[string][]*telemetrytypes.TelemetryFieldKey,
-	options qbtypes.ConditionBuilderOptions,
-	operator qbtypes.FilterOperator,
-	value any,
-	sb *sqlbuilder.SelectBuilder,
-) ([]string, []string, error) {
-	return c.conditionsForKeys(ctx, orgID, startNs, endNs, key, querybuilder.MatchingFieldKeys(key, keys), keys, options.SkipResourceFilter, operator, value, sb)
-}
-
-// candidateLookupKeys returns the metadata map only for fold-contexts, where CandidateKeys
-// would otherwise fold the prefix into the key name. Handing it the map lets a same-named
-// key under another context resolve first (as ColumnExpressionFor does). Strict contexts
-// (resource/attribute/scope) get nil so their explicit context is always honored.
-func candidateLookupKeys(key *telemetrytypes.TelemetryFieldKey, fieldKeys map[string][]*telemetrytypes.TelemetryFieldKey) map[string][]*telemetrytypes.TelemetryFieldKey {
-	if key.FieldContext == telemetrytypes.FieldContextLog {
-		return fieldKeys
-	}
-	return nil
-}
-
-func (c *conditionBuilder) conditionsForKeys(
-	ctx context.Context,
-	orgID valuer.UUID,
-	startNs uint64,
-	endNs uint64,
-	key *telemetrytypes.TelemetryFieldKey,
-	matches []*telemetrytypes.TelemetryFieldKey,
-	fieldKeys map[string][]*telemetrytypes.TelemetryFieldKey,
-	skipResourceFilter bool,
+	fieldKeysForName []*telemetrytypes.TelemetryFieldKey,
 	operator qbtypes.FilterOperator,
 	value any,
 	sb *sqlbuilder.SelectBuilder,
 ) ([]string, []string, error) {
 
-	keys, warning := querybuilder.ResolveKeys(key, matches)
+	keys, warning := querybuilder.ResolveKeys(key, fieldKeysForName)
 	var warnings []string
 	if warning != "" {
 		warnings = append(warnings, warning)
 	}
 
-	synthesized := false
 	if len(keys) == 0 {
-		_, isIntrinsicColumn := logsV2Columns[key.Name]
+		// No known field key matched. Legacy string-body mode still searches unknown
+		// Body-context keys as body JSON paths; JSON-body mode requires a metadata match.
 		switch {
 		case key.FieldContext == telemetrytypes.FieldContextBody && key.Name == "":
 			return nil, warnings, errors.NewInvalidInputf(errors.CodeInvalidInput, "missing key for body json search - expected key of the form `body.key` (ex: `body.status`)")
-		case key.FieldContext == telemetrytypes.FieldContextLog && isIntrinsicColumn:
+		case key.FieldContext == telemetrytypes.FieldContextBody &&
+			!c.fl.BooleanOrEmpty(ctx, flagger.FeatureUseJSONBody, featuretypes.NewFlaggerEvaluationContext(orgID)):
 			keys = []*telemetrytypes.TelemetryFieldKey{key}
 		default:
-			// Fold-contexts get the metadata map so a same-named key under another context
-			// wins before the prefix folds into the key name (matching ColumnExpressionFor);
-			// strict contexts pass nil and stay honored as-is.
-			keys = c.fm.CandidateKeys(ctx, orgID, key, value, candidateLookupKeys(key, fieldKeys))
-			if operator.IsFunctionOperator() {
-				if key.FieldContext != telemetrytypes.FieldContextBody &&
-					!c.fl.BooleanOrEmpty(ctx, flagger.FeatureUseJSONBody, featuretypes.NewFlaggerEvaluationContext(orgID)) {
-					return nil, warnings, querybuilder.NewKeyNotFoundError(key.Name)
-				}
-				bodyKeys := make([]*telemetrytypes.TelemetryFieldKey, 0, len(keys))
-				for _, k := range keys {
-					if k.FieldContext == telemetrytypes.FieldContextBody {
-						bodyKeys = append(bodyKeys, k)
-					}
-				}
-				keys = bodyKeys
-			}
-			if len(keys) == 0 {
-				return nil, warnings, querybuilder.NewKeyNotFoundError(key.Name)
-			}
-			synthesized = true
-			warnings = append(warnings, querybuilder.NewKeyNotFoundWarning(key.Name))
+			return nil, warnings, querybuilder.NewKeyNotFoundError(key.Name)
 		}
 	}
 
-	if skipResourceFilter && !synthesized {
-		filtered := make([]*telemetrytypes.TelemetryFieldKey, 0, len(keys))
-		for _, k := range keys {
-			if k.FieldContext != telemetrytypes.FieldContextResource {
-				filtered = append(filtered, k)
-			}
-		}
-		if len(filtered) == 0 {
-			return nil, warnings, nil
-		}
-		keys = filtered
-	}
-
 	// has/hasAny/hasAll need an array field: in JSON-body mode drop non-array matches so a
 	// scalar errors clearly instead of failing at ClickHouse runtime (legacy mode skips this).
 	if operator.IsArrayFunctionOperator() &&
 		c.fl.BooleanOrEmpty(ctx, flagger.FeatureUseJSONBody, featuretypes.NewFlaggerEvaluationContext(orgID)) {
 		arrayKeys := make([]*telemetrytypes.TelemetryFieldKey, 0, len(keys))
 		for _, k := range keys {
-			if k.FieldDataType == telemetrytypes.FieldDataTypeUnspecified || k.FieldDataType.IsArray() {
+			if k.FieldDataType.IsArray() {
 				arrayKeys = append(arrayKeys, k)
 			}
 		}

pkg/telemetrylogs/condition_builder_test.go

@@ -55,7 +55,7 @@ func TestExistsConditionForWithEvolutions(t *testing.T) {
 			},
 			operator:      qbtypes.FilterOperatorExists,
 			value:         nil,
-			expectedSQL:   "WHERE resource.`service.name` IS NOT NULL",
+			expectedSQL:   "WHERE resource.`service.name`::String IS NOT NULL",
 			expectedError: nil,
 		},
 		{
@@ -87,8 +87,8 @@ func TestExistsConditionForWithEvolutions(t *testing.T) {
 			},
 			operator:      qbtypes.FilterOperatorExists,
 			value:         nil,
-			expectedSQL:   "WHERE mapContains(resources_string, 'service.name')",
-			expectedArgs:  nil,
+			expectedSQL:   "WHERE mapContains(resources_string, 'service.name') = ?",
+			expectedArgs:  []any{true},
 			expectedError: nil,
 		},
 		{
@@ -132,7 +132,7 @@ func TestExistsConditionForWithEvolutions(t *testing.T) {
 	for _, tc := range testCases {
 		sb := sqlbuilder.NewSelectBuilder()
 		t.Run(tc.name, func(t *testing.T) {
-			cond, _, err := conditionBuilder.ConditionForKeys(ctx, valuer.UUID{}, tc.startTs, tc.endTs, &tc.key, map[string][]*telemetrytypes.TelemetryFieldKey{tc.key.Name: {&tc.key}}, qbtypes.ConditionBuilderOptions{}, tc.operator, tc.value, sb)
+			cond, _, err := conditionBuilder.ConditionFor(ctx, valuer.UUID{}, tc.startTs, tc.endTs, &tc.key, []*telemetrytypes.TelemetryFieldKey{&tc.key}, tc.operator, tc.value, sb)
 			sb.Where(cond...)
 
 			if tc.expectedError != nil {
@@ -182,8 +182,8 @@ func TestConditionFor(t *testing.T) {
 			},
 			operator:      qbtypes.FilterOperatorGreaterThan,
 			value:         float64(100),
-			expectedSQL:   "(toFloat64(attributes_number['request.duration']) > ? AND mapContains(attributes_number, 'request.duration'))",
-			expectedArgs:  []any{float64(100)},
+			expectedSQL:   "(toFloat64(attributes_number['request.duration']) > ? AND mapContains(attributes_number, 'request.duration') = ?)",
+			expectedArgs:  []any{float64(100), true},
 			expectedError: nil,
 		},
 		{
@@ -195,8 +195,8 @@ func TestConditionFor(t *testing.T) {
 			},
 			operator:      qbtypes.FilterOperatorLessThan,
 			value:         float64(1024),
-			expectedSQL:   "(toFloat64(attributes_number['request.size']) < ? AND mapContains(attributes_number, 'request.size'))",
-			expectedArgs:  []any{float64(1024)},
+			expectedSQL:   "(toFloat64(attributes_number['request.size']) < ? AND mapContains(attributes_number, 'request.size') = ?)",
+			expectedArgs:  []any{float64(1024), true},
 			expectedError: nil,
 		},
 		{
@@ -232,8 +232,8 @@ func TestConditionFor(t *testing.T) {
 			},
 			operator:      qbtypes.FilterOperatorILike,
 			value:         "%admin%",
-			expectedSQL:   "(LOWER(attributes_string['user.id']) LIKE LOWER(?) AND mapContains(attributes_string, 'user.id'))",
-			expectedArgs:  []any{"%admin%"},
+			expectedSQL:   "(LOWER(attributes_string['user.id']) LIKE LOWER(?) AND mapContains(attributes_string, 'user.id') = ?)",
+			expectedArgs:  []any{"%admin%", true},
 			expectedError: nil,
 		},
 		{
@@ -259,7 +259,7 @@ func TestConditionFor(t *testing.T) {
 			operator:      qbtypes.FilterOperatorContains,
 			value:         521509198310,
 			expectedSQL:   "LOWER(attributes_string['user.id']) LIKE LOWER(?)",
-			expectedArgs:  []any{"%521509198310%"},
+			expectedArgs:  []any{"%521509198310%", true},
 			expectedError: nil,
 		},
 		{
@@ -283,8 +283,8 @@ func TestConditionFor(t *testing.T) {
 			},
 			operator:      qbtypes.FilterOperatorContains,
 			value:         "admin",
-			expectedSQL:   "(LOWER(attributes_string['user.id']) LIKE LOWER(?) AND mapContains(attributes_string, 'user.id'))",
-			expectedArgs:  []any{"%admin%"},
+			expectedSQL:   "(LOWER(attributes_string['user.id']) LIKE LOWER(?) AND mapContains(attributes_string, 'user.id') = ?)",
+			expectedArgs:  []any{"%admin%", true},
 			expectedError: nil,
 		},
 		{
@@ -330,8 +330,8 @@ func TestConditionFor(t *testing.T) {
 			},
 			operator:      qbtypes.FilterOperatorExists,
 			value:         nil,
-			expectedSQL:   "WHERE body <> ''",
-			expectedArgs:  nil,
+			expectedSQL:   "WHERE body <> ?",
+			expectedArgs:  []any{""},
 			expectedError: nil,
 		},
 		{
@@ -342,8 +342,8 @@ func TestConditionFor(t *testing.T) {
 			},
 			operator:      qbtypes.FilterOperatorNotExists,
 			value:         nil,
-			expectedSQL:   "WHERE body = ''",
-			expectedArgs:  nil,
+			expectedSQL:   "WHERE body = ?",
+			expectedArgs:  []any{""},
 			expectedError: nil,
 		},
 		{
@@ -355,8 +355,8 @@ func TestConditionFor(t *testing.T) {
 			},
 			operator:      qbtypes.FilterOperatorExists,
 			value:         nil,
-			expectedSQL:   "mapContains(attributes_string, 'user.id')",
-			expectedArgs:  nil,
+			expectedSQL:   "mapContains(attributes_string, 'user.id') = ?",
+			expectedArgs:  []any{true},
 			expectedError: nil,
 		},
 		{
@@ -368,8 +368,8 @@ func TestConditionFor(t *testing.T) {
 			},
 			operator:      qbtypes.FilterOperatorNotExists,
 			value:         nil,
-			expectedSQL:   "NOT mapContains(attributes_string, 'user.id')",
-			expectedArgs:  nil,
+			expectedSQL:   "mapContains(attributes_string, 'user.id') <> ?",
+			expectedArgs:  []any{true},
 			expectedError: nil,
 		},
 		{
@@ -382,8 +382,8 @@ func TestConditionFor(t *testing.T) {
 			evolutions:    mockEvolution,
 			operator:      qbtypes.FilterOperatorExists,
 			value:         nil,
-			expectedSQL:   "mapContains(resources_string, 'service.name')",
-			expectedArgs:  nil,
+			expectedSQL:   "mapContains(resources_string, 'service.name') = ?",
+			expectedArgs:  []any{true},
 			expectedError: nil,
 		},
 		{
@@ -396,8 +396,8 @@ func TestConditionFor(t *testing.T) {
 			evolutions:    mockEvolution,
 			operator:      qbtypes.FilterOperatorNotExists,
 			value:         nil,
-			expectedSQL:   "NOT mapContains(resources_string, 'service.name')",
-			expectedArgs:  nil,
+			expectedSQL:   "mapContains(resources_string, 'service.name') <> ?",
+			expectedArgs:  []any{true},
 			expectedError: nil,
 		},
 		{
@@ -433,8 +433,8 @@ func TestConditionFor(t *testing.T) {
 			},
 			operator:      qbtypes.FilterOperatorRegexp,
 			value:         "^https://.*\\.example\\.com.*$",
-			expectedSQL:   "(match(attributes_string['http.url'], ?) AND mapContains(attributes_string, 'http.url'))",
-			expectedArgs:  []any{"^https://.*\\.example\\.com.*$"},
+			expectedSQL:   "(match(attributes_string['http.url'], ?) AND mapContains(attributes_string, 'http.url') = ?)",
+			expectedArgs:  []any{"^https://.*\\.example\\.com.*$", true},
 			expectedError: nil,
 		},
 		{
@@ -461,8 +461,8 @@ func TestConditionFor(t *testing.T) {
 			evolutions:    mockEvolution,
 			operator:      qbtypes.FilterOperatorRegexp,
 			value:         "frontend-.*",
-			expectedSQL:   "WHERE (match(`resource_string_service$$name`, ?) AND `resource_string_service$$name_exists`)",
-			expectedArgs:  []any{"frontend-.*"},
+			expectedSQL:   "WHERE (match(`resource_string_service$$name`, ?) AND `resource_string_service$$name_exists` = ?)",
+			expectedArgs:  []any{"frontend-.*", true},
 			expectedError: nil,
 		},
 		{
@@ -523,7 +523,7 @@ func TestConditionFor(t *testing.T) {
 		sb := sqlbuilder.NewSelectBuilder()
 		t.Run(tc.name, func(t *testing.T) {
 			tc.key.Evolutions = tc.evolutions
-			cond, _, err := conditionBuilder.ConditionForKeys(ctx, valuer.UUID{}, 0, 0, &tc.key, map[string][]*telemetrytypes.TelemetryFieldKey{tc.key.Name: {&tc.key}}, qbtypes.ConditionBuilderOptions{}, tc.operator, tc.value, sb)
+			cond, _, err := conditionBuilder.ConditionFor(ctx, valuer.UUID{}, 0, 0, &tc.key, []*telemetrytypes.TelemetryFieldKey{&tc.key}, tc.operator, tc.value, sb)
 			sb.Where(cond...)
 
 			if tc.expectedError != nil {
@@ -538,61 +538,6 @@ func TestConditionFor(t *testing.T) {
 	}
 }
 
-// A prefixed key absent from metadata synthesizes both spellings: the stripped
-// interpretation first, the literal `{context}.{name}` spelling second.
-func TestConditionForSynthesizedPrefixedKeys(t *testing.T) {
-	ctx := context.Background()
-	fl := flaggertest.New(t)
-	cb := NewConditionBuilder(NewFieldMapper(fl), fl)
-
-	t.Run("bare intrinsic column resolves to the column, not synthesized attributes", func(t *testing.T) {
-		sb := sqlbuilder.NewSelectBuilder()
-		key := telemetrytypes.TelemetryFieldKey{Name: "severity_text"}
-		conds, _, err := cb.ConditionForKeys(ctx, valuer.UUID{}, 0, 0, &key, nil, qbtypes.ConditionBuilderOptions{},qbtypes.FilterOperatorEqual, "ERROR", sb)
-		require.NoError(t, err)
-		require.Len(t, conds, 1)
-		sb.Where(conds...)
-		sql, _ := sb.BuildWithFlavor(sqlbuilder.ClickHouse)
-		assert.Contains(t, sql, "severity_text = ?")
-		assert.NotContains(t, sql, "mapContains")
-	})
-
-	t.Run("attribute context", func(t *testing.T) {
-		sb := sqlbuilder.NewSelectBuilder()
-		key := telemetrytypes.TelemetryFieldKey{Name: "custom.key", FieldContext: telemetrytypes.FieldContextAttribute}
-		conds, warnings, err := cb.ConditionForKeys(ctx, valuer.UUID{}, 0, 0, &key, nil, qbtypes.ConditionBuilderOptions{},qbtypes.FilterOperatorEqual, "v", sb)
-		require.NoError(t, err)
-		assert.NotEmpty(t, warnings)
-		require.Len(t, conds, 2)
-		assert.Contains(t, conds[0], "mapContains(attributes_string, 'custom.key')")
-		assert.Contains(t, conds[1], "mapContains(attributes_string, 'attribute.custom.key')")
-	})
-
-	t.Run("resource context", func(t *testing.T) {
-		sb := sqlbuilder.NewSelectBuilder()
-		key := telemetrytypes.TelemetryFieldKey{Name: "custom.key", FieldContext: telemetrytypes.FieldContextResource}
-		conds, warnings, err := cb.ConditionForKeys(ctx, valuer.UUID{}, 0, 0, &key, nil, qbtypes.ConditionBuilderOptions{},qbtypes.FilterOperatorEqual, "v", sb)
-		require.NoError(t, err)
-		assert.NotEmpty(t, warnings)
-		require.Len(t, conds, 2)
-		assert.Contains(t, conds[0], "mapContains(resources_string, 'custom.key')")
-		assert.Contains(t, conds[1], "mapContains(resources_string, 'resource.custom.key')")
-	})
-
-	t.Run("log context folds to attributes then body", func(t *testing.T) {
-		sb := sqlbuilder.NewSelectBuilder()
-		key := telemetrytypes.TelemetryFieldKey{Name: "custom.key", FieldContext: telemetrytypes.FieldContextLog}
-		conds, warnings, err := cb.ConditionForKeys(ctx, valuer.UUID{}, 0, 0, &key, nil, qbtypes.ConditionBuilderOptions{},qbtypes.FilterOperatorEqual, "v", sb)
-		require.NoError(t, err)
-		assert.NotEmpty(t, warnings)
-		require.Len(t, conds, 4)
-		assert.Contains(t, conds[0], "mapContains(attributes_string, 'custom.key')")
-		assert.Contains(t, conds[1], "mapContains(attributes_string, 'log.custom.key')")
-		assert.Contains(t, conds[2], `"custom"."key"`)
-		assert.Contains(t, conds[3], `"log"."custom"."key"`)
-	})
-}
-
 func TestConditionForMultipleKeys(t *testing.T) {
 	ctx := context.Background()
 

pkg/telemetrylogs/field_mapper.go

@@ -9,7 +9,6 @@ import (
 	"github.com/SigNoz/signoz-otel-collector/utils"
 	"github.com/SigNoz/signoz/pkg/errors"
 	"github.com/SigNoz/signoz/pkg/flagger"
-	"github.com/SigNoz/signoz/pkg/querybuilder"
 	"github.com/SigNoz/signoz/pkg/types/featuretypes"
 	qbtypes "github.com/SigNoz/signoz/pkg/types/querybuildertypes/querybuildertypesv5"
 	"github.com/SigNoz/signoz/pkg/types/telemetrytypes"
@@ -76,7 +75,7 @@ func NewFieldMapper(fl flagger.Flagger) qbtypes.FieldMapper {
 func (m *fieldMapper) getColumn(ctx context.Context, orgID valuer.UUID, key *telemetrytypes.TelemetryFieldKey) ([]*schema.Column, error) {
 	switch key.FieldContext {
 	case telemetrytypes.FieldContextResource:
-		columns := []*schema.Column{logsV2Columns["resource"], logsV2Columns["resources_string"]}
+		columns := []*schema.Column{logsV2Columns["resources_string"], logsV2Columns["resource"]}
 		return columns, nil
 	case telemetrytypes.FieldContextScope:
 		switch key.Name {
@@ -105,12 +104,24 @@ func (m *fieldMapper) getColumn(ctx context.Context, orgID valuer.UUID, key *tel
 		}
 		// Fall back to legacy body column
 		return []*schema.Column{logsV2Columns["body"]}, nil
-	case telemetrytypes.FieldContextLog:
+	case telemetrytypes.FieldContextLog, telemetrytypes.FieldContextUnspecified:
 		if key.Name == LogsV2BodyColumn && m.fl.BooleanOrEmpty(ctx, flagger.FeatureUseJSONBody, featuretypes.NewFlaggerEvaluationContext(orgID)) {
 			return []*schema.Column{logsV2Columns[messageSubColumn]}, nil
 		}
 		col, ok := logsV2Columns[key.Name]
 		if !ok {
+			// check if the key has body JSON search
+			if strings.HasPrefix(key.Name, telemetrytypes.BodyJSONStringSearchPrefix) {
+				// Use body_v2 if feature flag is enabled and we have a body condition builder
+				if m.fl.BooleanOrEmpty(ctx, flagger.FeatureUseJSONBody, featuretypes.NewFlaggerEvaluationContext(orgID)) {
+					// TODO(Piyush): Update this to support multiple JSON columns based on evolutions
+					// i.e return both the body json and body json promoted and let the evolutions decide which one to use
+					// based on the query range time.
+					return []*schema.Column{logsV2Columns[LogsV2BodyV2Column]}, nil
+				}
+				// Fall back to legacy body column
+				return []*schema.Column{logsV2Columns["body"]}, nil
+			}
 			return nil, qbtypes.ErrColumnNotFound
 		}
 		return []*schema.Column{col}, nil
@@ -125,9 +136,16 @@ func (m *fieldMapper) FieldFor(ctx context.Context, orgID valuer.UUID, tsStart,
 		return "", err
 	}
 
-	newColumns, evolutionsEntries, err := qbtypes.SelectEvolutionsForColumns(columns, key.Evolutions, tsStart, tsEnd)
-	if err != nil {
-		return "", err
+	var newColumns []*schema.Column
+	var evolutionsEntries []*telemetrytypes.EvolutionEntry
+	if len(key.Evolutions) > 0 {
+		// we will use the corresponding column and its evolution entry for the query
+		newColumns, evolutionsEntries, err = qbtypes.SelectEvolutionsForColumns(columns, key.Evolutions, tsStart, tsEnd)
+		if err != nil {
+			return "", err
+		}
+	} else {
+		newColumns = columns
 	}
 
 	exprs := []string{}
@@ -186,7 +204,7 @@ func (m *fieldMapper) FieldFor(ctx context.Context, orgID valuer.UUID, tsStart,
 				// a key could have been materialized, if so return the materialized column name
 				if key.Materialized {
 					exprs = append(exprs, telemetrytypes.FieldKeyToMaterializedColumnName(key))
-					existExpr = append(existExpr, telemetrytypes.FieldKeyToMaterializedColumnNameForExists(key))
+					existExpr = append(existExpr, fmt.Sprintf("%s==true", telemetrytypes.FieldKeyToMaterializedColumnNameForExists(key)))
 				} else {
 					exprs = append(exprs, fmt.Sprintf("%s['%s']", columnName, key.Name))
 					existExpr = append(existExpr, fmt.Sprintf("mapContains(%s, '%s')", columnName, key.Name))
@@ -224,187 +242,50 @@ func (m *fieldMapper) ColumnExpressionFor(
 	orgID valuer.UUID,
 	tsStart, tsEnd uint64,
 	field *telemetrytypes.TelemetryFieldKey,
-	requiredDataType telemetrytypes.FieldDataType,
 	keys map[string][]*telemetrytypes.TelemetryFieldKey,
 ) (string, error) {
-
-	bodyJSONEnabled := m.fl.BooleanOrEmpty(ctx, flagger.FeatureUseJSONBody, featuretypes.NewFlaggerEvaluationContext(orgID))
-
-	var candidates []*telemetrytypes.TelemetryFieldKey
-	switch _, err := m.FieldFor(ctx, orgID, tsStart, tsEnd, field); {
-	case err == nil:
-		if field.FieldContext == telemetrytypes.FieldContextBody && !bodyJSONEnabled {
-			return "", errors.NewInvalidInputf(errors.CodeInvalidInput, "Group by/Aggregation isn't available for the body column")
-		}
-		candidates = []*telemetrytypes.TelemetryFieldKey{field}
-	case errors.Is(err, qbtypes.ErrColumnNotFound):
-		if _, ok := logsV2Columns[field.Name]; ok {
-			field.FieldContext = telemetrytypes.FieldContextLog
-			candidates = []*telemetrytypes.TelemetryFieldKey{field}
-			break
-		}
-		candidates = keys[field.Name]
-		if len(candidates) == 0 {
-			candidates = keys[fmt.Sprintf("%s.%s", field.FieldContext.StringValue(), field.Name)]
-		}
-		if len(candidates) == 0 {
-			// synthesized attribute candidates first, body path last; legacy body
-			// doesn't support group by/select, so bare keys keep attributes only
-			for _, key := range m.CandidateKeys(ctx, orgID, field, nil, nil) {
-				if !bodyJSONEnabled && field.FieldContext == telemetrytypes.FieldContextUnspecified &&
-					key.FieldContext == telemetrytypes.FieldContextBody {
-					continue
-				}
-				candidates = append(candidates, key)
+	fieldExpression, err := m.FieldFor(ctx, orgID, tsStart, tsEnd, field)
+	if errors.Is(err, qbtypes.ErrColumnNotFound) {
+		// the key didn't have the right context to be added to the query
+		// we try to use the context we know of
+		keysForField := keys[field.Name]
+		if len(keysForField) == 0 {
+			// is it a static field?
+			if _, ok := logsV2Columns[field.Name]; ok {
+				// if it is, attach the column name directly
+				field.FieldContext = telemetrytypes.FieldContextLog
+				fieldExpression, _ = m.FieldFor(ctx, orgID, tsStart, tsEnd, field)
+			} else {
+				// - the context is not provided
+				// - there are not keys for the field
+				// - it is not a static field
+				// - the next best thing to do is see if there is a typo
+				// and suggest a correction
+				wrappedErr := errors.Wrapf(err, errors.TypeInvalidInput, errors.CodeInvalidInput, "field `%s` not found", field.Name).WithSuggestions(errors.NewSuggestionsOnLevenshteinDistance(field.Name, errors.NounKeys, maps.Keys(keys))...)
+				return "", wrappedErr
 			}
+		} else if len(keysForField) == 1 {
+			// we have a single key for the field, use it
+			fieldExpression, _ = m.FieldFor(ctx, orgID, tsStart, tsEnd, keysForField[0])
+		} else {
+			// select any non-empty value from the keys
+			args := []string{}
+			for _, key := range keysForField {
+				fieldExpression, _ = m.FieldFor(ctx, orgID, tsStart, tsEnd, key)
+				args = append(args, fmt.Sprintf("toString(%s) != '', toString(%s)", fieldExpression, fieldExpression))
+			}
+			fieldExpression = fmt.Sprintf("multiIf(%s, NULL)", strings.Join(args, ", "))
 		}
-		if len(candidates) == 0 {
-			return "", errors.WithSuggestiveAdditionalf(err, errors.NewSuggestionsOnLevenshteinDistance(field.Name, errors.NounKeys, maps.Keys(keys)), "field `%s` not found", field.Name)
-		}
-	default:
+	} else if err != nil {
 		return "", err
 	}
 
-	// Group-by/order (String) and aggregation (String/Float64): every candidate is
-	// exists-guarded and coerced to requiredDataType, in a single multiIf. Raw select
-	// (Unspecified) keeps the lighter native shape below.
-	if requiredDataType != telemetrytypes.FieldDataTypeUnspecified {
-		// arrays cannot sit inside Nullable/multiIf, so a lone array candidate stays bare
-		if len(candidates) == 1 && (strings.Contains(candidates[0].Name, telemetrytypes.ArraySep) ||
-			strings.Contains(candidates[0].Name, telemetrytypes.ArrayAnyIndex) ||
-			candidates[0].FieldDataType.IsArray()) {
-			return m.FieldFor(ctx, orgID, tsStart, tsEnd, candidates[0])
-		}
-		var dummyValue any = ""
-		if requiredDataType == telemetrytypes.FieldDataTypeFloat64 {
-			dummyValue = 0.0
-		}
-		var stmts []string
-		for _, key := range candidates {
-			guard, err := m.existsExpressionFor(ctx, orgID, tsStart, tsEnd, key, true)
-			if err != nil {
-				return "", err
-			}
-			var fieldExpression string
-			if key.FieldContext == telemetrytypes.FieldContextBody && !bodyJSONEnabled {
-				fieldExpression, _ = GetBodyJSONKey(ctx, key, qbtypes.FilterOperatorUnknown, dummyValue)
-			} else {
-				fieldExpression, err = m.FieldFor(ctx, orgID, tsStart, tsEnd, key)
-				if err != nil {
-					return "", err
-				}
-				fieldExpression, _ = querybuilder.DataTypeCollisionHandledFieldName(key, dummyValue, fieldExpression, qbtypes.FilterOperatorUnknown)
-			}
-			stmts = append(stmts, guard, fieldExpression)
-		}
-		return fmt.Sprintf("multiIf(%s, NULL)", strings.Join(stmts, ", ")), nil
-	}
-
-	if len(candidates) == 1 {
-		// arrays cannot sit inside Nullable, so array candidates stay bare
-		if strings.Contains(candidates[0].Name, telemetrytypes.ArraySep) ||
-			strings.Contains(candidates[0].Name, telemetrytypes.ArrayAnyIndex) ||
-			candidates[0].FieldDataType.IsArray() {
-			return m.FieldFor(ctx, orgID, tsStart, tsEnd, candidates[0])
-		}
-		if !m.membershipGuarded(ctx, orgID, tsStart, tsEnd, candidates[0]) {
-			return m.FieldFor(ctx, orgID, tsStart, tsEnd, candidates[0])
-		}
-		guard, err := m.existsExpressionFor(ctx, orgID, tsStart, tsEnd, candidates[0], true)
-		if err != nil {
-			return "", err
-		}
-		var fieldExpression string
-		if candidates[0].FieldContext == telemetrytypes.FieldContextBody && !bodyJSONEnabled {
-			fieldExpression, _ = GetBodyJSONKey(ctx, candidates[0], qbtypes.FilterOperatorUnknown, "")
-		} else {
-			fieldExpression, err = m.FieldFor(ctx, orgID, tsStart, tsEnd, candidates[0])
-			if err != nil {
-				return "", err
-			}
-		}
-		return fmt.Sprintf("multiIf(%s, %s, NULL)", guard, fieldExpression), nil
-	}
-
-	var stmts []string
-	for _, key := range candidates {
-		guard, err := m.existsExpressionFor(ctx, orgID, tsStart, tsEnd, key, true)
-		if err != nil {
-			return "", err
-		}
-		stmts = append(stmts, guard)
-
-		var fieldExpression string
-		if key.FieldContext == telemetrytypes.FieldContextBody && !bodyJSONEnabled {
-			fieldExpression, _ = GetBodyJSONKey(ctx, key, qbtypes.FilterOperatorUnknown, "")
-		} else {
-			fieldExpression, err = m.FieldFor(ctx, orgID, tsStart, tsEnd, key)
-			if err != nil {
-				return "", err
-			}
-			fieldExpression, _ = querybuilder.DataTypeCollisionHandledFieldName(key, "", fieldExpression, qbtypes.FilterOperatorUnknown)
-		}
-		stmts = append(stmts, fieldExpression)
-	}
-
-	return fmt.Sprintf("multiIf(%s, NULL)", strings.Join(stmts, ", ")), nil
+	return fmt.Sprintf("%s AS `%s`", sqlbuilder.Escape(fieldExpression), field.Name), nil
 }
 
-func (m *fieldMapper) CandidateKeys(_ context.Context, _ valuer.UUID, field *telemetrytypes.TelemetryFieldKey, value any, keys map[string][]*telemetrytypes.TelemetryFieldKey) []*telemetrytypes.TelemetryFieldKey {
-	if matches := keys[field.Name]; len(matches) > 0 {
-		return matches
-	}
-	if matches := keys[fmt.Sprintf("%s.%s", field.FieldContext.StringValue(), field.Name)]; len(matches) > 0 {
-		return matches
-	}
-
-	switch field.FieldContext {
-	case telemetrytypes.FieldContextBody:
-		if field.Name == "" {
-			return nil
-		}
-		clone := *field
-		return []*telemetrytypes.TelemetryFieldKey{&clone}
-	case telemetrytypes.FieldContextUnspecified:
-		// a real column wins before synthesis (so adjustKeys is not needed to resolve these)
-		if _, ok := logsV2Columns[field.Name]; ok {
-			clone := *field
-			clone.FieldContext = telemetrytypes.FieldContextLog
-			return []*telemetrytypes.TelemetryFieldKey{&clone}
-		}
-		bodyKey := *field
-		bodyKey.FieldContext = telemetrytypes.FieldContextBody
-		if value == nil && bodyKey.FieldDataType == telemetrytypes.FieldDataTypeUnspecified {
-			bodyKey.FieldDataType = telemetrytypes.FieldDataTypeString
-		}
-		return append(querybuilder.SynthesizeKeys(field, value), &bodyKey)
-	case telemetrytypes.FieldContextAttribute, telemetrytypes.FieldContextResource:
-		// stripped interpretation first, the literal `{context}.{name}` spelling second
-		literal := *field
-		literal.Name = field.FieldContext.StringValue() + "." + field.Name
-		return append(querybuilder.SynthesizeKeys(field, value), querybuilder.SynthesizeKeys(&literal, value)...)
-	case telemetrytypes.FieldContextLog:
-		if _, ok := logsV2Columns[field.Name]; ok {
-			clone := *field
-			return []*telemetrytypes.TelemetryFieldKey{&clone}
-		}
-		stripped := *field
-		stripped.FieldContext = telemetrytypes.FieldContextUnspecified
-		literal := *field
-		literal.Name = field.FieldContext.StringValue() + "." + field.Name
-		literal.FieldContext = telemetrytypes.FieldContextUnspecified
-		// attribute candidates first (stripped, then literal), body paths last
-		candidates := append(querybuilder.SynthesizeKeys(&stripped, value), querybuilder.SynthesizeKeys(&literal, value)...)
-		for _, key := range []telemetrytypes.TelemetryFieldKey{stripped, literal} {
-			bodyKey := key
-			bodyKey.FieldContext = telemetrytypes.FieldContextBody
-			if value == nil && bodyKey.FieldDataType == telemetrytypes.FieldDataTypeUnspecified {
-				bodyKey.FieldDataType = telemetrytypes.FieldDataTypeString
-			}
-			candidates = append(candidates, &bodyKey)
-		}
-		return candidates
-	}
+// CandidateKeys returns nil: logs has no synthesize-on-unknown-key fallback, so an
+// unknown key stays unresolved and the caller errors.
+func (m *fieldMapper) CandidateKeys(_ context.Context, _ valuer.UUID, _ *telemetrytypes.TelemetryFieldKey, _ any, _ map[string][]*telemetrytypes.TelemetryFieldKey) []*telemetrytypes.TelemetryFieldKey {
 	return nil
 }
 
@@ -412,23 +293,8 @@ func (m *fieldMapper) CandidateKeys(_ context.Context, _ valuer.UUID, field *tel
 func (m *fieldMapper) buildFieldForJSON(key *telemetrytypes.TelemetryFieldKey) (string, error) {
 	plan := key.JSONPlan
 	if len(plan) == 0 {
-		if key.KeyNameContainsArray() {
-			keyCopy := *key
-			if err := keyCopy.SetExhaustiveJSONAccessPlan(
-				telemetrytypes.JSONColumnMetadata{BaseColumn: LogsV2BodyV2Column}, key.FieldDataType,
-			); err != nil {
-				return "", err
-			}
-			return m.buildArrayConcat(keyCopy.JSONPlan)
-		}
-
-		elemType := key.GetJSONDataType()
-		if elemType.StringValue() == "" {
-			elemType = telemetrytypes.String
-		}
-
-		fieldPath := fmt.Sprintf("%s.`%s`", LogsV2BodyV2Column, key.Name)
-		return fmt.Sprintf("dynamicElement(%s, '%s')", fieldPath, elemType.StringValue()), nil
+		return "", errors.NewInvalidInputf(errors.CodeInvalidInput,
+			"Could not find any valid paths for: %s", key.Name)
 	}
 
 	if plan[0].IsTerminal {
@@ -564,88 +430,3 @@ func (m *fieldMapper) buildArrayMap(currentNode *telemetrytypes.JSONAccessNode,
 
 	return fmt.Sprintf("arrayMap(%s->%s, %s)", currentNode.Alias(), nestedExpr, arrayExpr), nil
 }
-
-func (m *fieldMapper) membershipGuarded(ctx context.Context, orgID valuer.UUID, tsStart, tsEnd uint64, key *telemetrytypes.TelemetryFieldKey) bool {
-	if key.FieldContext == telemetrytypes.FieldContextBody {
-		return true
-	}
-	columns, err := m.getColumn(ctx, orgID, key)
-	if err != nil {
-		return false
-	}
-	newColumns, _, err := qbtypes.SelectEvolutionsForColumns(columns, key.Evolutions, tsStart, tsEnd)
-	if err != nil || len(newColumns) != 1 {
-		return false
-	}
-	columnType := newColumns[0].Type.GetType()
-	return columnType == schema.ColumnTypeEnumMap || columnType == schema.ColumnTypeEnumJSON
-}
-
-func (m *fieldMapper) existsExpressionFor(
-	ctx context.Context,
-	orgID valuer.UUID,
-	tsStart, tsEnd uint64,
-	key *telemetrytypes.TelemetryFieldKey,
-	exists bool,
-) (string, error) {
-	columns, err := m.getColumn(ctx, orgID, key)
-	if errors.Is(err, qbtypes.ErrColumnNotFound) && key.FieldContext == telemetrytypes.FieldContextUnspecified {
-		bodyKey := *key
-		bodyKey.FieldContext = telemetrytypes.FieldContextBody
-		key = &bodyKey
-		columns, err = m.getColumn(ctx, orgID, key)
-	}
-	if err != nil {
-		return "", err
-	}
-
-	operator := qbtypes.FilterOperatorExists
-	if !exists {
-		operator = qbtypes.FilterOperatorNotExists
-	}
-
-	bodyJSONEnabled := m.fl.BooleanOrEmpty(ctx, flagger.FeatureUseJSONBody, featuretypes.NewFlaggerEvaluationContext(orgID))
-
-	for _, column := range columns {
-		if column.Type.GetType() == schema.ColumnTypeEnumJSON && isBodyJSONSearch(key, columns) && bodyJSONEnabled && key.Name != messageSubField {
-			valueType, value := InferDataType(nil, operator, key)
-			if len(key.JSONPlan) == 0 {
-				keyCopy := *key
-				if err := keyCopy.SetExhaustiveJSONAccessPlan(
-					telemetrytypes.JSONColumnMetadata{BaseColumn: LogsV2BodyV2Column}, valueType,
-				); err != nil {
-					return "", err
-				}
-				key = &keyCopy
-			}
-			sb := sqlbuilder.NewSelectBuilder()
-			cond, err := NewJSONConditionBuilder(key, valueType).buildJSONCondition(operator, value, sb)
-			if err != nil {
-				return "", err
-			}
-			sb.Where(cond)
-			expr, args := sb.BuildWithFlavor(sqlbuilder.ClickHouse)
-			expr = strings.TrimPrefix(expr, "WHERE ")
-			if len(args) > 0 {
-				expr, err = sqlbuilder.ClickHouse.Interpolate(expr, args)
-				if err != nil {
-					return "", err
-				}
-			}
-			return expr, nil
-		}
-	}
-
-	if isBodyJSONSearch(key, columns) && !bodyJSONEnabled {
-		if exists {
-			return GetBodyJSONKeyForExists(ctx, key, operator, nil), nil
-		}
-		return "NOT " + GetBodyJSONKeyForExists(ctx, key, operator, nil), nil
-	}
-
-	fieldExpression, err := m.FieldFor(ctx, orgID, tsStart, tsEnd, key)
-	if err != nil {
-		return "", err
-	}
-	return querybuilder.ExistsExpression(columns, key, tsStart, tsEnd, fieldExpression, exists)
-}

pkg/telemetrylogs/field_mapper_test.go

@@ -29,7 +29,7 @@ func TestGetColumn(t *testing.T) {
 				Name:         "service.name",
 				FieldContext: telemetrytypes.FieldContextResource,
 			},
-			expectedCol:   []*schema.Column{logsV2Columns["resource"], logsV2Columns["resources_string"]},
+			expectedCol:   []*schema.Column{logsV2Columns["resources_string"], logsV2Columns["resource"]},
 			expectedError: nil,
 		},
 		{
@@ -580,7 +580,7 @@ func TestFieldForWithMaterialized(t *testing.T) {
 			name:           "Multi evolution - both columns (JSON + materialized)",
 			start:          time.Date(2024, 2, 1, 0, 0, 0, 0, time.UTC),
 			end:            time.Date(2024, 4, 2, 0, 0, 0, 0, time.UTC),
-			expectedResult: "multiIf(resource.`service.name` IS NOT NULL, resource.`service.name`::String, `resource_string_service$$name_exists`, `resource_string_service$$name`, NULL)",
+			expectedResult: "multiIf(resource.`service.name` IS NOT NULL, resource.`service.name`::String, `resource_string_service$$name_exists`==true, `resource_string_service$$name`, NULL)",
 		},
 	}
 

pkg/telemetrylogs/groupby_unknown_key_test.go

@@ -1,72 +0,0 @@
-package telemetrylogs
-
-import (
-	"context"
-	"testing"
-	"time"
-
-	"github.com/SigNoz/signoz/pkg/flagger/flaggertest"
-	"github.com/SigNoz/signoz/pkg/instrumentation/instrumentationtest"
-	"github.com/SigNoz/signoz/pkg/querybuilder"
-	qbtypes "github.com/SigNoz/signoz/pkg/types/querybuildertypes/querybuildertypesv5"
-	"github.com/SigNoz/signoz/pkg/types/telemetrytypes"
-	"github.com/SigNoz/signoz/pkg/types/telemetrytypes/telemetrytypestest"
-	"github.com/SigNoz/signoz/pkg/valuer"
-	"github.com/stretchr/testify/require"
-)
-
-// A bare key absent from metadata groups by a multiIf over the synthesized
-// attribute maps first (string, number, bool) and the body path last; legacy
-// body doesn't support group by, so with the flag off only attributes remain.
-func TestStatementBuilderGroupByUnknownKey(t *testing.T) {
-	releaseTime := time.Date(2024, 1, 15, 10, 0, 0, 0, time.UTC)
-	releaseTimeNano := uint64(releaseTime.UnixNano())
-
-	cases := []struct {
-		name        string
-		useJSONBody bool
-		expected    string
-	}{
-		{
-			name:        "legacy body",
-			useJSONBody: false,
-			expected:    "SELECT toString(multiIf(mapContains(attributes_string, 'totally.unknown.key'), attributes_string['totally.unknown.key'], mapContains(attributes_number, 'totally.unknown.key'), toString(attributes_number['totally.unknown.key']), mapContains(attributes_bool, 'totally.unknown.key'), toString(attributes_bool['totally.unknown.key']), NULL)) AS `__GROUP_BY_KEY_0_totally.unknown.key`, count() AS __result_0 FROM signoz_logs.distributed_logs_v2 WHERE timestamp >= ? AND ts_bucket_start >= ? AND timestamp < ? AND ts_bucket_start <= ? GROUP BY `__GROUP_BY_KEY_0_totally.unknown.key` ORDER BY __result_0 DESC",
-		},
-		{
-			name:        "json body",
-			useJSONBody: true,
-			expected:    "SELECT toString(multiIf(mapContains(attributes_string, 'totally.unknown.key'), attributes_string['totally.unknown.key'], mapContains(attributes_number, 'totally.unknown.key'), toString(attributes_number['totally.unknown.key']), mapContains(attributes_bool, 'totally.unknown.key'), toString(attributes_bool['totally.unknown.key']), (dynamicElement(body_v2.`totally.unknown.key`, 'String') IS NOT NULL), dynamicElement(body_v2.`totally.unknown.key`, 'String'), NULL)) AS `__GROUP_BY_KEY_0_totally.unknown.key`, count() AS __result_0 FROM signoz_logs.distributed_logs_v2 WHERE timestamp >= ? AND ts_bucket_start >= ? AND timestamp < ? AND ts_bucket_start <= ? GROUP BY `__GROUP_BY_KEY_0_totally.unknown.key` ORDER BY __result_0 DESC",
-		},
-	}
-
-	for _, c := range cases {
-		t.Run(c.name, func(t *testing.T) {
-			fl := flaggertest.WithUseJSONBody(t, c.useJSONBody)
-			mockMetadataStore := telemetrytypestest.NewMockMetadataStore()
-			mockMetadataStore.KeysMap = buildCompleteFieldKeyMap(releaseTime)
-			fm := NewFieldMapper(fl)
-			cb := NewConditionBuilder(fm, fl)
-			aggExprRewriter := querybuilder.NewAggExprRewriter(instrumentationtest.New().ToProviderSettings(), nil, fm, cb, fl)
-			statementBuilder := NewLogQueryStatementBuilder(
-				instrumentationtest.New().ToProviderSettings(),
-				mockMetadataStore, fm, cb, aggExprRewriter,
-				DefaultFullTextColumn, GetBodyJSONKey, fl, nil, false, 100000,
-			)
-
-			query := qbtypes.QueryBuilderQuery[qbtypes.LogAggregation]{
-				Signal:       telemetrytypes.SignalLogs,
-				StepInterval: qbtypes.Step{Duration: 30 * time.Second},
-				Aggregations: []qbtypes.LogAggregation{{Expression: "count()"}},
-				GroupBy: []qbtypes.GroupByKey{
-					{TelemetryFieldKey: telemetrytypes.TelemetryFieldKey{Name: "totally.unknown.key"}},
-				},
-			}
-			q, err := statementBuilder.Build(context.Background(), valuer.UUID{},
-				releaseTimeNano+uint64(24*time.Hour.Nanoseconds()),
-				releaseTimeNano+uint64(48*time.Hour.Nanoseconds()),
-				qbtypes.RequestTypeScalar, query, nil)
-			require.NoError(t, err)
-			require.Equal(t, c.expected, q.Query)
-		})
-	}
-}

pkg/telemetrylogs/json_planless_test.go

@@ -1,86 +0,0 @@
-package telemetrylogs
-
-import (
-	"strings"
-	"testing"
-
-	qbtypes "github.com/SigNoz/signoz/pkg/types/querybuildertypes/querybuildertypesv5"
-	"github.com/SigNoz/signoz/pkg/types/telemetrytypes"
-	"github.com/huandu/go-sqlbuilder"
-	"github.com/stretchr/testify/require"
-)
-
-func TestExhaustiveJSONPlan_ConditionBuilder(t *testing.T) {
-	cases := []struct {
-		name         string
-		path         string
-		operator     qbtypes.FilterOperator
-		value        any
-		valueType    telemetrytypes.FieldDataType
-		expectedSQL  string
-		expectedArgs []any
-	}{
-		{
-			name:         "single hop array, both containers",
-			path:         "education[].name",
-			operator:     qbtypes.FilterOperatorEqual,
-			value:        "IIT",
-			valueType:    telemetrytypes.FieldDataTypeString,
-			expectedSQL:  "(((arrayExists(`body_v2.education`-> dynamicElement(`body_v2.education`.`name`, 'String') = ?, dynamicElement(body_v2.`education`, 'Array(JSON(max_dynamic_types=16, max_dynamic_paths=0))')) OR arrayExists(`body_v2.education`-> dynamicElement(`body_v2.education`.`name`, 'String') = ?, arrayMap(x->dynamicElement(x, 'JSON'), arrayFilter(x->(dynamicType(x) = 'JSON'), dynamicElement(body_v2.`education`, 'Array(Dynamic)')))))) AND has(JSONAllPaths(body_v2), 'education'))",
-			expectedArgs: []any{"IIT", "IIT"},
-		},
-		{
-			name:         "double hop array, both containers each hop",
-			path:         "education[].awards[].name",
-			operator:     qbtypes.FilterOperatorEqual,
-			value:        "Iron Award",
-			valueType:    telemetrytypes.FieldDataTypeString,
-			expectedSQL:  "(((arrayExists(`body_v2.education`-> (arrayExists(`body_v2.education[].awards`-> dynamicElement(`body_v2.education[].awards`.`name`, 'String') = ?, dynamicElement(`body_v2.education`.`awards`, 'Array(JSON(max_dynamic_types=8, max_dynamic_paths=0))')) OR arrayExists(`body_v2.education[].awards`-> dynamicElement(`body_v2.education[].awards`.`name`, 'String') = ?, arrayMap(x->dynamicElement(x, 'JSON'), arrayFilter(x->(dynamicType(x) = 'JSON'), dynamicElement(`body_v2.education`.`awards`, 'Array(Dynamic)'))))), dynamicElement(body_v2.`education`, 'Array(JSON(max_dynamic_types=16, max_dynamic_paths=0))')) OR arrayExists(`body_v2.education`-> (arrayExists(`body_v2.education[].awards`-> dynamicElement(`body_v2.education[].awards`.`name`, 'String') = ?, dynamicElement(`body_v2.education`.`awards`, 'Array(JSON(max_dynamic_types=16, max_dynamic_paths=256))')) OR arrayExists(`body_v2.education[].awards`-> dynamicElement(`body_v2.education[].awards`.`name`, 'String') = ?, arrayMap(x->dynamicElement(x, 'JSON'), arrayFilter(x->(dynamicType(x) = 'JSON'), dynamicElement(`body_v2.education`.`awards`, 'Array(Dynamic)'))))), arrayMap(x->dynamicElement(x, 'JSON'), arrayFilter(x->(dynamicType(x) = 'JSON'), dynamicElement(body_v2.`education`, 'Array(Dynamic)')))))) AND has(JSONAllPaths(body_v2), 'education'))",
-			expectedArgs: []any{"Iron Award", "Iron Award", "Iron Award", "Iron Award"},
-		},
-	}
-
-	for _, c := range cases {
-		t.Run(c.name, func(t *testing.T) {
-			key := &telemetrytypes.TelemetryFieldKey{
-				Name:         c.path,
-				Signal:       telemetrytypes.SignalLogs,
-				FieldContext: telemetrytypes.FieldContextBody,
-			}
-			require.Empty(t, key.JSONPlan)
-			require.NoError(t, key.SetExhaustiveJSONAccessPlan(
-				telemetrytypes.JSONColumnMetadata{BaseColumn: LogsV2BodyV2Column}, c.valueType))
-
-			sb := sqlbuilder.NewSelectBuilder()
-			cond, err := NewJSONConditionBuilder(key, c.valueType).buildJSONCondition(c.operator, c.value, sb)
-			require.NoError(t, err)
-
-			sb.Select("1").From("t").Where(cond)
-			sql, args := sb.BuildWithFlavor(sqlbuilder.ClickHouse)
-			where := sql[strings.Index(sql, "WHERE ")+len("WHERE "):]
-			t.Logf("WHERE: %s", where)
-
-			require.Equal(t, c.expectedArgs, args)
-			if c.expectedSQL != "" {
-				require.Equal(t, c.expectedSQL, where)
-			}
-		})
-	}
-}
-
-func TestExhaustiveJSONPlan_FieldMapper(t *testing.T) {
-	m := &fieldMapper{}
-
-	key := &telemetrytypes.TelemetryFieldKey{
-		Name:          "education[].name",
-		Signal:        telemetrytypes.SignalLogs,
-		FieldContext:  telemetrytypes.FieldContextBody,
-		FieldDataType: telemetrytypes.FieldDataTypeString,
-	}
-
-	expr, err := m.buildFieldForJSON(key)
-	require.NoError(t, err)
-	require.Equal(t,
-		"arrayFlatten(arrayConcat(arrayMap(`body_v2.education`->dynamicElement(`body_v2.education`.`name`, 'String'), dynamicElement(body_v2.`education`, 'Array(JSON(max_dynamic_types=16, max_dynamic_paths=0))')), arrayMap(`body_v2.education`->dynamicElement(`body_v2.education`.`name`, 'String'), arrayMap(x->assumeNotNull(dynamicElement(x, 'JSON')), arrayFilter(x->(dynamicType(x) = 'JSON'), dynamicElement(body_v2.`education`, 'Array(Dynamic)'))))))",
-		expr)
-}

pkg/telemetrylogs/json_stmt_builder_test.go

@@ -64,7 +64,7 @@ func TestJSONStmtBuilder_TimeSeries(t *testing.T) {
 				},
 			},
 			expected: qbtypes.Statement{
-				Query: "WITH __limit_cte AS (SELECT toString(multiIf((dynamicElement(body_v2.`user.age`, 'Int64') IS NOT NULL), toString(dynamicElement(body_v2.`user.age`, 'Int64')), (dynamicElement(body_v2.`user.age`, 'String') IS NOT NULL), dynamicElement(body_v2.`user.age`, 'String'), NULL)) AS `__GROUP_BY_KEY_0_user.age`, count() AS __result_0 FROM signoz_logs.distributed_logs_v2 WHERE timestamp >= ? AND ts_bucket_start >= ? AND timestamp < ? AND ts_bucket_start <= ? GROUP BY `__GROUP_BY_KEY_0_user.age` ORDER BY __result_0 DESC LIMIT ?) SELECT toStartOfInterval(fromUnixTimestamp64Nano(timestamp), INTERVAL 30 SECOND) AS ts, toString(multiIf((dynamicElement(body_v2.`user.age`, 'Int64') IS NOT NULL), toString(dynamicElement(body_v2.`user.age`, 'Int64')), (dynamicElement(body_v2.`user.age`, 'String') IS NOT NULL), dynamicElement(body_v2.`user.age`, 'String'), NULL)) AS `__GROUP_BY_KEY_0_user.age`, count() AS __result_0 FROM signoz_logs.distributed_logs_v2 WHERE timestamp >= ? AND ts_bucket_start >= ? AND timestamp < ? AND ts_bucket_start <= ? AND (`__GROUP_BY_KEY_0_user.age`) GLOBAL IN (SELECT `__GROUP_BY_KEY_0_user.age` FROM __limit_cte) GROUP BY ts, `__GROUP_BY_KEY_0_user.age`",
+				Query: "WITH __limit_cte AS (SELECT toString(multiIf((dynamicElement(body_v2.`user.age`, 'Int64') IS NOT NULL), toString(dynamicElement(body_v2.`user.age`, 'Int64')), (dynamicElement(body_v2.`user.age`, 'String') IS NOT NULL), dynamicElement(body_v2.`user.age`, 'String'), NULL)) AS `user.age`, count() AS __result_0 FROM signoz_logs.distributed_logs_v2 WHERE timestamp >= ? AND ts_bucket_start >= ? AND timestamp < ? AND ts_bucket_start <= ? GROUP BY `user.age` ORDER BY __result_0 DESC LIMIT ?) SELECT toStartOfInterval(fromUnixTimestamp64Nano(timestamp), INTERVAL 30 SECOND) AS ts, toString(multiIf((dynamicElement(body_v2.`user.age`, 'Int64') IS NOT NULL), toString(dynamicElement(body_v2.`user.age`, 'Int64')), (dynamicElement(body_v2.`user.age`, 'String') IS NOT NULL), dynamicElement(body_v2.`user.age`, 'String'), NULL)) AS `user.age`, count() AS __result_0 FROM signoz_logs.distributed_logs_v2 WHERE timestamp >= ? AND ts_bucket_start >= ? AND timestamp < ? AND ts_bucket_start <= ? AND (`user.age`) GLOBAL IN (SELECT `user.age` FROM __limit_cte) GROUP BY ts, `user.age`",
 				Args:  []any{"1747947419000000000", uint64(1747945619), "1747983448000000000", uint64(1747983448), 10, "1747947419000000000", uint64(1747945619), "1747983448000000000", uint64(1747983448)},
 			},
 		},
@@ -88,10 +88,7 @@ func TestJSONStmtBuilder_TimeSeries(t *testing.T) {
 					},
 				},
 			},
-			expected: qbtypes.Statement{
-				Query: "WITH __limit_cte AS (SELECT toString(arrayFlatten(arrayConcat(arrayMap(`body_v2.education`->arrayConcat(arrayMap(`body_v2.education[].awards`->dynamicElement(`body_v2.education[].awards`.`type`, 'String'), dynamicElement(`body_v2.education`.`awards`, 'Array(JSON(max_dynamic_types=8, max_dynamic_paths=0))')), arrayMap(`body_v2.education[].awards`->dynamicElement(`body_v2.education[].awards`.`type`, 'String'), arrayMap(x->assumeNotNull(dynamicElement(x, 'JSON')), arrayFilter(x->(dynamicType(x) = 'JSON'), dynamicElement(`body_v2.education`.`awards`, 'Array(Dynamic)'))))), dynamicElement(body_v2.`education`, 'Array(JSON(max_dynamic_types=16, max_dynamic_paths=0))'))))) AS `__GROUP_BY_KEY_0_education[].awards[].type`, count() AS __result_0 FROM signoz_logs.distributed_logs_v2 WHERE timestamp >= ? AND ts_bucket_start >= ? AND timestamp < ? AND ts_bucket_start <= ? GROUP BY `__GROUP_BY_KEY_0_education[].awards[].type` ORDER BY __result_0 DESC LIMIT ?) SELECT toStartOfInterval(fromUnixTimestamp64Nano(timestamp), INTERVAL 30 SECOND) AS ts, toString(arrayFlatten(arrayConcat(arrayMap(`body_v2.education`->arrayConcat(arrayMap(`body_v2.education[].awards`->dynamicElement(`body_v2.education[].awards`.`type`, 'String'), dynamicElement(`body_v2.education`.`awards`, 'Array(JSON(max_dynamic_types=8, max_dynamic_paths=0))')), arrayMap(`body_v2.education[].awards`->dynamicElement(`body_v2.education[].awards`.`type`, 'String'), arrayMap(x->assumeNotNull(dynamicElement(x, 'JSON')), arrayFilter(x->(dynamicType(x) = 'JSON'), dynamicElement(`body_v2.education`.`awards`, 'Array(Dynamic)'))))), dynamicElement(body_v2.`education`, 'Array(JSON(max_dynamic_types=16, max_dynamic_paths=0))'))))) AS `__GROUP_BY_KEY_0_education[].awards[].type`, count() AS __result_0 FROM signoz_logs.distributed_logs_v2 WHERE timestamp >= ? AND ts_bucket_start >= ? AND timestamp < ? AND ts_bucket_start <= ? AND (`__GROUP_BY_KEY_0_education[].awards[].type`) GLOBAL IN (SELECT `__GROUP_BY_KEY_0_education[].awards[].type` FROM __limit_cte) GROUP BY ts, `__GROUP_BY_KEY_0_education[].awards[].type`",
-				Args:  []any{"1747947419000000000", uint64(1747945619), "1747983448000000000", uint64(1747983448), 10, "1747947419000000000", uint64(1747945619), "1747983448000000000", uint64(1747983448)},
-			},
+			expectedErrContains: "Group by/Aggregation isn't available for the Array Paths",
 		},
 	}
 
@@ -187,8 +184,8 @@ func TestJSONStmtBuilder_PrimitivePaths(t *testing.T) {
 			name:   "message Exists",
 			filter: "message Exists",
 			expected: TestExpected{
-				WhereClause: "body_v2.message <> ''",
-				Args:        []any{"1747947419000000000", uint64(1747945619), "1747983448000000000", uint64(1747983448), 10},
+				WhereClause: "body_v2.message <> ?",
+				Args:        []any{"", "1747947419000000000", uint64(1747945619), "1747983448000000000", uint64(1747983448), 10},
 			},
 		},
 		{
@@ -948,7 +945,7 @@ func TestJSONStmtBuilder_SelectField(t *testing.T) {
 				},
 			},
 			expected: qbtypes.Statement{
-				Query: "SELECT timestamp, id, arrayFlatten(arrayConcat(arrayMap(`body_v2.education`->arrayConcat(arrayMap(`body_v2.education[].awards`->arrayConcat(arrayMap(`body_v2.education[].awards[].participated`->dynamicElement(`body_v2.education[].awards[].participated`.`members`, 'Array(Nullable(String))'), dynamicElement(`body_v2.education[].awards`.`participated`, 'Array(JSON(max_dynamic_types=4, max_dynamic_paths=0))')), arrayMap(`body_v2.education[].awards[].participated`->dynamicElement(`body_v2.education[].awards[].participated`.`members`, 'Array(Nullable(String))'), arrayMap(x->assumeNotNull(dynamicElement(x, 'JSON')), arrayFilter(x->(dynamicType(x) = 'JSON'), dynamicElement(`body_v2.education[].awards`.`participated`, 'Array(Dynamic)'))))), dynamicElement(`body_v2.education`.`awards`, 'Array(JSON(max_dynamic_types=8, max_dynamic_paths=0))')), arrayMap(`body_v2.education[].awards`->arrayConcat(arrayMap(`body_v2.education[].awards[].participated`->dynamicElement(`body_v2.education[].awards[].participated`.`members`, 'Array(Nullable(String))'), dynamicElement(`body_v2.education[].awards`.`participated`, 'Array(JSON(max_dynamic_types=16, max_dynamic_paths=256))')), arrayMap(`body_v2.education[].awards[].participated`->dynamicElement(`body_v2.education[].awards[].participated`.`members`, 'Array(Nullable(String))'), arrayMap(x->assumeNotNull(dynamicElement(x, 'JSON')), arrayFilter(x->(dynamicType(x) = 'JSON'), dynamicElement(`body_v2.education[].awards`.`participated`, 'Array(Dynamic)'))))), arrayMap(x->assumeNotNull(dynamicElement(x, 'JSON')), arrayFilter(x->(dynamicType(x) = 'JSON'), dynamicElement(`body_v2.education`.`awards`, 'Array(Dynamic)'))))), dynamicElement(body_v2.`education`, 'Array(JSON(max_dynamic_types=16, max_dynamic_paths=0))')))) AS `__SELECT_KEY_0_education[].awards[].participated[].members` FROM signoz_logs.distributed_logs_v2 WHERE (dynamicElement(body_v2.`user.name`, 'String') IS NOT NULL) AND timestamp >= ? AND ts_bucket_start >= ? AND timestamp < ? AND ts_bucket_start <= ? LIMIT ?",
+				Query: "SELECT timestamp, id, arrayFlatten(arrayConcat(arrayMap(`body_v2.education`->arrayConcat(arrayMap(`body_v2.education[].awards`->arrayConcat(arrayMap(`body_v2.education[].awards[].participated`->dynamicElement(`body_v2.education[].awards[].participated`.`members`, 'Array(Nullable(String))'), dynamicElement(`body_v2.education[].awards`.`participated`, 'Array(JSON(max_dynamic_types=4, max_dynamic_paths=0))')), arrayMap(`body_v2.education[].awards[].participated`->dynamicElement(`body_v2.education[].awards[].participated`.`members`, 'Array(Nullable(String))'), arrayMap(x->assumeNotNull(dynamicElement(x, 'JSON')), arrayFilter(x->(dynamicType(x) = 'JSON'), dynamicElement(`body_v2.education[].awards`.`participated`, 'Array(Dynamic)'))))), dynamicElement(`body_v2.education`.`awards`, 'Array(JSON(max_dynamic_types=8, max_dynamic_paths=0))')), arrayMap(`body_v2.education[].awards`->arrayConcat(arrayMap(`body_v2.education[].awards[].participated`->dynamicElement(`body_v2.education[].awards[].participated`.`members`, 'Array(Nullable(String))'), dynamicElement(`body_v2.education[].awards`.`participated`, 'Array(JSON(max_dynamic_types=16, max_dynamic_paths=256))')), arrayMap(`body_v2.education[].awards[].participated`->dynamicElement(`body_v2.education[].awards[].participated`.`members`, 'Array(Nullable(String))'), arrayMap(x->assumeNotNull(dynamicElement(x, 'JSON')), arrayFilter(x->(dynamicType(x) = 'JSON'), dynamicElement(`body_v2.education[].awards`.`participated`, 'Array(Dynamic)'))))), arrayMap(x->assumeNotNull(dynamicElement(x, 'JSON')), arrayFilter(x->(dynamicType(x) = 'JSON'), dynamicElement(`body_v2.education`.`awards`, 'Array(Dynamic)'))))), dynamicElement(body_v2.`education`, 'Array(JSON(max_dynamic_types=16, max_dynamic_paths=0))')))) AS `education[].awards[].participated[].members` FROM signoz_logs.distributed_logs_v2 WHERE (dynamicElement(body_v2.`user.name`, 'String') IS NOT NULL) AND timestamp >= ? AND ts_bucket_start >= ? AND timestamp < ? AND ts_bucket_start <= ? LIMIT ?",
 				Args:  []any{"1747947419000000000", uint64(1747945619), "1747983448000000000", uint64(1747983448), 10},
 			},
 		},
@@ -969,7 +966,7 @@ func TestJSONStmtBuilder_SelectField(t *testing.T) {
 				},
 			},
 			expected: qbtypes.Statement{
-				Query: "SELECT timestamp, id, arrayFlatten(arrayConcat(arrayMap(`body_v2.education`->arrayConcat(arrayMap(`body_v2.education[].awards`->dynamicElement(`body_v2.education[].awards`.`type`, 'String'), dynamicElement(`body_v2.education`.`awards`, 'Array(JSON(max_dynamic_types=8, max_dynamic_paths=0))')), arrayMap(`body_v2.education[].awards`->dynamicElement(`body_v2.education[].awards`.`type`, 'String'), arrayMap(x->assumeNotNull(dynamicElement(x, 'JSON')), arrayFilter(x->(dynamicType(x) = 'JSON'), dynamicElement(`body_v2.education`.`awards`, 'Array(Dynamic)'))))), dynamicElement(body_v2.`education`, 'Array(JSON(max_dynamic_types=16, max_dynamic_paths=0))')))) AS `__SELECT_KEY_0_education[].awards[].type` FROM signoz_logs.distributed_logs_v2 WHERE (dynamicElement(body_v2.`user.name`, 'String') IS NOT NULL) AND timestamp >= ? AND ts_bucket_start >= ? AND timestamp < ? AND ts_bucket_start <= ? LIMIT ?",
+				Query: "SELECT timestamp, id, arrayFlatten(arrayConcat(arrayMap(`body_v2.education`->arrayConcat(arrayMap(`body_v2.education[].awards`->dynamicElement(`body_v2.education[].awards`.`type`, 'String'), dynamicElement(`body_v2.education`.`awards`, 'Array(JSON(max_dynamic_types=8, max_dynamic_paths=0))')), arrayMap(`body_v2.education[].awards`->dynamicElement(`body_v2.education[].awards`.`type`, 'String'), arrayMap(x->assumeNotNull(dynamicElement(x, 'JSON')), arrayFilter(x->(dynamicType(x) = 'JSON'), dynamicElement(`body_v2.education`.`awards`, 'Array(Dynamic)'))))), dynamicElement(body_v2.`education`, 'Array(JSON(max_dynamic_types=16, max_dynamic_paths=0))')))) AS `education[].awards[].type` FROM signoz_logs.distributed_logs_v2 WHERE (dynamicElement(body_v2.`user.name`, 'String') IS NOT NULL) AND timestamp >= ? AND ts_bucket_start >= ? AND timestamp < ? AND ts_bucket_start <= ? LIMIT ?",
 				Args:  []any{"1747947419000000000", uint64(1747945619), "1747983448000000000", uint64(1747983448), 10},
 			},
 		},
@@ -987,7 +984,7 @@ func TestJSONStmtBuilder_SelectField(t *testing.T) {
 				},
 			},
 			expected: qbtypes.Statement{
-				Query: "SELECT timestamp, id, multiIf((dynamicElement(body_v2.`user.name`, 'String') IS NOT NULL), dynamicElement(body_v2.`user.name`, 'String'), NULL) AS `__SELECT_KEY_0_user.name` FROM signoz_logs.distributed_logs_v2 WHERE timestamp >= ? AND ts_bucket_start >= ? AND timestamp < ? AND ts_bucket_start <= ? LIMIT ?",
+				Query: "SELECT timestamp, id, dynamicElement(body_v2.`user.name`, 'String') AS `user.name` FROM signoz_logs.distributed_logs_v2 WHERE timestamp >= ? AND ts_bucket_start >= ? AND timestamp < ? AND ts_bucket_start <= ? LIMIT ?",
 				Args:  []any{"1747947419000000000", uint64(1747945619), "1747983448000000000", uint64(1747983448), 10},
 			},
 		},
@@ -1041,7 +1038,7 @@ func TestJSONStmtBuilder_OrderBy(t *testing.T) {
 				},
 			},
 			expected: qbtypes.Statement{
-				Query: "SELECT timestamp, id, trace_id, span_id, trace_flags, severity_text, severity_number, scope_name, scope_version, body_v2 as body, attributes_string, attributes_number, attributes_bool, resources_string, scope_string FROM signoz_logs.distributed_logs_v2 WHERE (dynamicElement(body_v2.`user.name`, 'String') IS NOT NULL) AND timestamp >= ? AND ts_bucket_start >= ? AND timestamp < ? AND ts_bucket_start <= ? ORDER BY arrayFlatten(arrayConcat(arrayMap(`body_v2.education`->arrayConcat(arrayMap(`body_v2.education[].awards`->arrayConcat(arrayMap(`body_v2.education[].awards[].participated`->dynamicElement(`body_v2.education[].awards[].participated`.`members`, 'Array(Nullable(String))'), dynamicElement(`body_v2.education[].awards`.`participated`, 'Array(JSON(max_dynamic_types=4, max_dynamic_paths=0))')), arrayMap(`body_v2.education[].awards[].participated`->dynamicElement(`body_v2.education[].awards[].participated`.`members`, 'Array(Nullable(String))'), arrayMap(x->assumeNotNull(dynamicElement(x, 'JSON')), arrayFilter(x->(dynamicType(x) = 'JSON'), dynamicElement(`body_v2.education[].awards`.`participated`, 'Array(Dynamic)'))))), dynamicElement(`body_v2.education`.`awards`, 'Array(JSON(max_dynamic_types=8, max_dynamic_paths=0))')), arrayMap(`body_v2.education[].awards`->arrayConcat(arrayMap(`body_v2.education[].awards[].participated`->dynamicElement(`body_v2.education[].awards[].participated`.`members`, 'Array(Nullable(String))'), dynamicElement(`body_v2.education[].awards`.`participated`, 'Array(JSON(max_dynamic_types=16, max_dynamic_paths=256))')), arrayMap(`body_v2.education[].awards[].participated`->dynamicElement(`body_v2.education[].awards[].participated`.`members`, 'Array(Nullable(String))'), arrayMap(x->assumeNotNull(dynamicElement(x, 'JSON')), arrayFilter(x->(dynamicType(x) = 'JSON'), dynamicElement(`body_v2.education[].awards`.`participated`, 'Array(Dynamic)'))))), arrayMap(x->assumeNotNull(dynamicElement(x, 'JSON')), arrayFilter(x->(dynamicType(x) = 'JSON'), dynamicElement(`body_v2.education`.`awards`, 'Array(Dynamic)'))))), dynamicElement(body_v2.`education`, 'Array(JSON(max_dynamic_types=16, max_dynamic_paths=0))')))) asc LIMIT ?",
+				Query: "SELECT timestamp, id, trace_id, span_id, trace_flags, severity_text, severity_number, scope_name, scope_version, body_v2 as body, attributes_string, attributes_number, attributes_bool, resources_string, scope_string FROM signoz_logs.distributed_logs_v2 WHERE (dynamicElement(body_v2.`user.name`, 'String') IS NOT NULL) AND timestamp >= ? AND ts_bucket_start >= ? AND timestamp < ? AND ts_bucket_start <= ? ORDER BY arrayFlatten(arrayConcat(arrayMap(`body_v2.education`->arrayConcat(arrayMap(`body_v2.education[].awards`->arrayConcat(arrayMap(`body_v2.education[].awards[].participated`->dynamicElement(`body_v2.education[].awards[].participated`.`members`, 'Array(Nullable(String))'), dynamicElement(`body_v2.education[].awards`.`participated`, 'Array(JSON(max_dynamic_types=4, max_dynamic_paths=0))')), arrayMap(`body_v2.education[].awards[].participated`->dynamicElement(`body_v2.education[].awards[].participated`.`members`, 'Array(Nullable(String))'), arrayMap(x->assumeNotNull(dynamicElement(x, 'JSON')), arrayFilter(x->(dynamicType(x) = 'JSON'), dynamicElement(`body_v2.education[].awards`.`participated`, 'Array(Dynamic)'))))), dynamicElement(`body_v2.education`.`awards`, 'Array(JSON(max_dynamic_types=8, max_dynamic_paths=0))')), arrayMap(`body_v2.education[].awards`->arrayConcat(arrayMap(`body_v2.education[].awards[].participated`->dynamicElement(`body_v2.education[].awards[].participated`.`members`, 'Array(Nullable(String))'), dynamicElement(`body_v2.education[].awards`.`participated`, 'Array(JSON(max_dynamic_types=16, max_dynamic_paths=256))')), arrayMap(`body_v2.education[].awards[].participated`->dynamicElement(`body_v2.education[].awards[].participated`.`members`, 'Array(Nullable(String))'), arrayMap(x->assumeNotNull(dynamicElement(x, 'JSON')), arrayFilter(x->(dynamicType(x) = 'JSON'), dynamicElement(`body_v2.education[].awards`.`participated`, 'Array(Dynamic)'))))), arrayMap(x->assumeNotNull(dynamicElement(x, 'JSON')), arrayFilter(x->(dynamicType(x) = 'JSON'), dynamicElement(`body_v2.education`.`awards`, 'Array(Dynamic)'))))), dynamicElement(body_v2.`education`, 'Array(JSON(max_dynamic_types=16, max_dynamic_paths=0))')))) AS `education[].awards[].participated[].members` asc LIMIT ?",
 				Args:  []any{"1747947419000000000", uint64(1747945619), "1747983448000000000", uint64(1747983448), 10},
 			},
 		},
@@ -1064,7 +1061,7 @@ func TestJSONStmtBuilder_OrderBy(t *testing.T) {
 				},
 			},
 			expected: qbtypes.Statement{
-				Query: "SELECT timestamp, id, trace_id, span_id, trace_flags, severity_text, severity_number, scope_name, scope_version, body_v2 as body, attributes_string, attributes_number, attributes_bool, resources_string, scope_string FROM signoz_logs.distributed_logs_v2 WHERE timestamp >= ? AND ts_bucket_start >= ? AND timestamp < ? AND ts_bucket_start <= ? ORDER BY multiIf((dynamicElement(body_v2.`user.name`, 'String') IS NOT NULL), dynamicElement(body_v2.`user.name`, 'String'), NULL) asc LIMIT ?",
+				Query: "SELECT timestamp, id, trace_id, span_id, trace_flags, severity_text, severity_number, scope_name, scope_version, body_v2 as body, attributes_string, attributes_number, attributes_bool, resources_string, scope_string FROM signoz_logs.distributed_logs_v2 WHERE timestamp >= ? AND ts_bucket_start >= ? AND timestamp < ? AND ts_bucket_start <= ? ORDER BY dynamicElement(body_v2.`user.name`, 'String') AS `user.name` asc LIMIT ?",
 				Args:  []any{"1747947419000000000", uint64(1747945619), "1747983448000000000", uint64(1747983448), 10},
 			},
 		},
@@ -1126,8 +1123,8 @@ func TestResourceAggrAndGroupBy_WithJSONEnabled(t *testing.T) {
 				},
 			},
 			expected: qbtypes.Statement{
-				Query:    "SELECT toStartOfInterval(fromUnixTimestamp64Nano(timestamp), INTERVAL 30 SECOND) AS ts, toString(multiIf(resource.`region` IS NOT NULL, resource.`region`::String, NULL)) AS `__GROUP_BY_KEY_0_region`, countDistinct(multiIf(resource.`service.name` IS NOT NULL, resource.`service.name`::String, NULL)) AS __result_0 FROM signoz_logs.distributed_logs_v2 WHERE ((dynamicElement(body_v2.`user.name`, 'String') IS NOT NULL) OR mapContains(attributes_string, 'user.name')) AND timestamp >= ? AND ts_bucket_start >= ? AND timestamp < ? AND ts_bucket_start <= ? GROUP BY ts, `__GROUP_BY_KEY_0_region`",
-				Args:     []any{"1747947419000000000", uint64(1747945619), "1747983448000000000", uint64(1747983448)},
+				Query:    "SELECT toStartOfInterval(fromUnixTimestamp64Nano(timestamp), INTERVAL 30 SECOND) AS ts, toString(multiIf(resource.`region`::String IS NOT NULL, resource.`region`::String, NULL)) AS `region`, countDistinct(multiIf(resource.`service.name`::String IS NOT NULL, resource.`service.name`::String, NULL)) AS __result_0 FROM signoz_logs.distributed_logs_v2 WHERE ((dynamicElement(body_v2.`user.name`, 'String') IS NOT NULL) OR mapContains(attributes_string, 'user.name') = ?) AND timestamp >= ? AND ts_bucket_start >= ? AND timestamp < ? AND ts_bucket_start <= ? GROUP BY ts, `region`",
+				Args:     []any{true, "1747947419000000000", uint64(1747945619), "1747983448000000000", uint64(1747983448)},
 				Warnings: []string{"Key `user.name` is ambiguous, found 2 different combinations of field context / data type: [name=user.name,context=body,datatype=string name=user.name,context=attribute,datatype=string]."},
 			},
 		},
@@ -1198,7 +1195,7 @@ func buildJSONTestStatementBuilder(t *testing.T, addIndexes bool) (*logQueryStat
 	fm := NewFieldMapper(fl)
 	cb := NewConditionBuilder(fm, fl)
 
-	aggExprRewriter := querybuilder.NewAggExprRewriter(instrumentationtest.New().ToProviderSettings(), nil, fm, cb, fl)
+	aggExprRewriter := querybuilder.NewAggExprRewriter(instrumentationtest.New().ToProviderSettings(), nil, fm, cb, nil, fl)
 
 	statementBuilder := NewLogQueryStatementBuilder(
 		instrumentationtest.New().ToProviderSettings(),

pkg/telemetrylogs/statement_builder.go

@@ -273,8 +273,9 @@ func (b *logQueryStatementBuilder) buildListQuery(
 ) (*qbtypes.Statement, error) {
 
 	var (
-		cteFragments []string
-		cteArgs      [][]any
+		cteFragments    []string
+		cteArgs         [][]any
+		bodyJSONEnabled = b.fl.BooleanOrEmpty(ctx, flagger.FeatureUseJSONBody, featuretypes.NewFlaggerEvaluationContext(orgID))
 	)
 
 	frag, args, skipResourceFilter, err := b.maybeAttachResourceFilter(ctx, orgID, sb, query, start, end, variables)
@@ -298,7 +299,7 @@ func (b *logQueryStatementBuilder) buildListQuery(
 		sb.SelectMore(LogsV2SeverityNumberColumn)
 		sb.SelectMore(LogsV2ScopeNameColumn)
 		sb.SelectMore(LogsV2ScopeVersionColumn)
-		sb.SelectMore(bodyAliasExpression(b.fl.BooleanOrEmpty(ctx, flagger.FeatureUseJSONBody, featuretypes.NewFlaggerEvaluationContext(orgID))))
+		sb.SelectMore(bodyAliasExpression(bodyJSONEnabled))
 		sb.SelectMore(LogsV2AttributesStringColumn)
 		sb.SelectMore(LogsV2AttributesNumberColumn)
 		sb.SelectMore(LogsV2AttributesBoolColumn)
@@ -313,11 +314,11 @@ func (b *logQueryStatementBuilder) buildListQuery(
 			}
 
 			// get column expression for the field - use array index directly to avoid pointer to loop variable
-			colExpr, err := b.fm.ColumnExpressionFor(ctx, orgID, start, end, &query.SelectFields[index], telemetrytypes.FieldDataTypeUnspecified, keys)
+			colExpr, err := b.fm.ColumnExpressionFor(ctx, orgID, start, end, &query.SelectFields[index], keys)
 			if err != nil {
 				return nil, err
 			}
-			sb.SelectMore(fmt.Sprintf("%s AS `%s`", sqlbuilder.Escape(colExpr), selectColumnAlias(index, query.SelectFields[index].Name)))
+			sb.SelectMore(colExpr)
 		}
 	}
 
@@ -332,11 +333,11 @@ func (b *logQueryStatementBuilder) buildListQuery(
 	// Add order by
 	for _, orderBy := range query.Order {
 
-		colExpr, err := b.fm.ColumnExpressionFor(ctx, orgID, start, end, &orderBy.Key.TelemetryFieldKey, telemetrytypes.FieldDataTypeUnspecified, keys)
+		colExpr, err := b.fm.ColumnExpressionFor(ctx, orgID, start, end, &orderBy.Key.TelemetryFieldKey, keys)
 		if err != nil {
 			return nil, err
 		}
-		sb.OrderBy(fmt.Sprintf("%s %s", sqlbuilder.Escape(colExpr), orderBy.Direction.StringValue()))
+		sb.OrderBy(fmt.Sprintf("%s %s", colExpr, orderBy.Direction.StringValue()))
 	}
 
 	// Add limit and offset
@@ -376,8 +377,9 @@ func (b *logQueryStatementBuilder) buildTimeSeriesQuery(
 ) (*qbtypes.Statement, error) {
 
 	var (
-		cteFragments []string
-		cteArgs      [][]any
+		cteFragments    []string
+		cteArgs         [][]any
+		bodyJSONEnabled = b.fl.BooleanOrEmpty(ctx, flagger.FeatureUseJSONBody, featuretypes.NewFlaggerEvaluationContext(orgID))
 	)
 
 	frag, args, skipResourceFilter, err := b.maybeAttachResourceFilter(ctx, orgID, sb, query, start, end, variables)
@@ -394,21 +396,20 @@ func (b *logQueryStatementBuilder) buildTimeSeriesQuery(
 		int64(query.StepInterval.Seconds()),
 	))
 
+	var allGroupByArgs []any
+
 	// Keep original column expressions so we can build the tuple
-	bodyJSONEnabled := b.fl.BooleanOrEmpty(ctx, flagger.FeatureUseJSONBody, featuretypes.NewFlaggerEvaluationContext(orgID))
 	fieldNames := make([]string, 0, len(query.GroupBy))
-	for i, gb := range query.GroupBy {
-		if !bodyJSONEnabled && (strings.Contains(gb.Name, telemetrytypes.ArraySep) || strings.Contains(gb.Name, telemetrytypes.ArrayAnyIndex)) {
-			return nil, errors.NewInvalidInputf(errors.CodeInvalidInput, "Group by/Aggregation isn't available for the Array Paths: %s", gb.Name)
-		}
-		expr, err := b.fm.ColumnExpressionFor(ctx, orgID, start, end, &gb.TelemetryFieldKey, telemetrytypes.FieldDataTypeString, keys)
+	for _, gb := range query.GroupBy {
+		expr, args, err := querybuilder.CollisionHandledFinalExpr(ctx, orgID, start, end, &gb.TelemetryFieldKey, b.fm, b.cb, keys, telemetrytypes.FieldDataTypeString, b.jsonKeyToKey, bodyJSONEnabled)
 		if err != nil {
 			return nil, err
 		}
 
-		fieldAlias := groupByColumnAlias(i, gb.Name)
-		sb.SelectMore(fmt.Sprintf("toString(%s) AS `%s`", sqlbuilder.Escape(expr), fieldAlias))
-		fieldNames = append(fieldNames, fmt.Sprintf("`%s`", fieldAlias))
+		colExpr := fmt.Sprintf("toString(%s) AS `%s`", expr, gb.Name)
+		allGroupByArgs = append(allGroupByArgs, args...)
+		sb.SelectMore(colExpr)
+		fieldNames = append(fieldNames, fmt.Sprintf("`%s`", gb.Name))
 	}
 
 	// Aggregations
@@ -455,7 +456,7 @@ func (b *logQueryStatementBuilder) buildTimeSeriesQuery(
 
 		// Group by all dimensions
 		sb.GroupBy("ts")
-		sb.GroupBy(fieldNames...)
+		sb.GroupBy(querybuilder.GroupByKeys(query.GroupBy)...)
 		if query.Having != nil && query.Having.Expression != "" {
 			// Rewrite having expression to use SQL column names
 			rewriter := querybuilder.NewHavingExpressionRewriter()
@@ -470,17 +471,13 @@ func (b *logQueryStatementBuilder) buildTimeSeriesQuery(
 			for _, orderBy := range query.Order {
 				_, ok := aggOrderBy(orderBy, query)
 				if !ok {
-					orderCol := orderBy.Key.Name
-					if alias, ok := groupByOrderAlias(orderBy.Key.Name, query.GroupBy); ok {
-						orderCol = alias
-					}
-					sb.OrderBy(fmt.Sprintf("`%s` %s", orderCol, orderBy.Direction.StringValue()))
+					sb.OrderBy(fmt.Sprintf("`%s` %s", orderBy.Key.Name, orderBy.Direction.StringValue()))
 				}
 			}
 			sb.OrderBy("ts desc")
 		}
 
-		combinedArgs := allAggChArgs
+		combinedArgs := append(allGroupByArgs, allAggChArgs...)
 		mainSQL, mainArgs := sb.BuildWithFlavor(sqlbuilder.ClickHouse, combinedArgs...)
 
 		// Stitch it all together:  WITH … SELECT …
@@ -489,7 +486,7 @@ func (b *logQueryStatementBuilder) buildTimeSeriesQuery(
 
 	} else {
 		sb.GroupBy("ts")
-		sb.GroupBy(fieldNames...)
+		sb.GroupBy(querybuilder.GroupByKeys(query.GroupBy)...)
 		if query.Having != nil && query.Having.Expression != "" {
 			rewriter := querybuilder.NewHavingExpressionRewriter()
 			rewrittenExpr, err := rewriter.RewriteForLogs(query.Having.Expression, query.Aggregations)
@@ -503,17 +500,13 @@ func (b *logQueryStatementBuilder) buildTimeSeriesQuery(
 			for _, orderBy := range query.Order {
 				_, ok := aggOrderBy(orderBy, query)
 				if !ok {
-					orderCol := orderBy.Key.Name
-					if alias, ok := groupByOrderAlias(orderBy.Key.Name, query.GroupBy); ok {
-						orderCol = alias
-					}
-					sb.OrderBy(fmt.Sprintf("`%s` %s", orderCol, orderBy.Direction.StringValue()))
+					sb.OrderBy(fmt.Sprintf("`%s` %s", orderBy.Key.Name, orderBy.Direction.StringValue()))
 				}
 			}
 			sb.OrderBy("ts desc")
 		}
 
-		combinedArgs := allAggChArgs
+		combinedArgs := append(allGroupByArgs, allAggChArgs...)
 		mainSQL, mainArgs := sb.BuildWithFlavor(sqlbuilder.ClickHouse, combinedArgs...)
 
 		// Stitch it all together:  WITH … SELECT …
@@ -544,8 +537,9 @@ func (b *logQueryStatementBuilder) buildScalarQuery(
 ) (*qbtypes.Statement, error) {
 
 	var (
-		cteFragments []string
-		cteArgs      [][]any
+		cteFragments    []string
+		cteArgs         [][]any
+		bodyJSONEnabled = b.fl.BooleanOrEmpty(ctx, flagger.FeatureUseJSONBody, featuretypes.NewFlaggerEvaluationContext(orgID))
 	)
 
 	frag, args, skipResourceFilter, err := b.maybeAttachResourceFilter(ctx, orgID, sb, query, start, end, variables)
@@ -559,20 +553,17 @@ func (b *logQueryStatementBuilder) buildScalarQuery(
 
 	allAggChArgs := []any{}
 
-	bodyJSONEnabled := b.fl.BooleanOrEmpty(ctx, flagger.FeatureUseJSONBody, featuretypes.NewFlaggerEvaluationContext(orgID))
-	fieldNames := make([]string, 0, len(query.GroupBy))
-	for i, gb := range query.GroupBy {
-		if !bodyJSONEnabled && (strings.Contains(gb.Name, telemetrytypes.ArraySep) || strings.Contains(gb.Name, telemetrytypes.ArrayAnyIndex)) {
-			return nil, errors.NewInvalidInputf(errors.CodeInvalidInput, "Group by/Aggregation isn't available for the Array Paths: %s", gb.Name)
-		}
-		expr, err := b.fm.ColumnExpressionFor(ctx, orgID, start, end, &gb.TelemetryFieldKey, telemetrytypes.FieldDataTypeString, keys)
+	var allGroupByArgs []any
+
+	for _, gb := range query.GroupBy {
+		expr, args, err := querybuilder.CollisionHandledFinalExpr(ctx, orgID, start, end, &gb.TelemetryFieldKey, b.fm, b.cb, keys, telemetrytypes.FieldDataTypeString, b.jsonKeyToKey, bodyJSONEnabled)
 		if err != nil {
 			return nil, err
 		}
 
-		fieldAlias := groupByColumnAlias(i, gb.Name)
-		sb.SelectMore(fmt.Sprintf("toString(%s) AS `%s`", sqlbuilder.Escape(expr), fieldAlias))
-		fieldNames = append(fieldNames, fmt.Sprintf("`%s`", fieldAlias))
+		colExpr := fmt.Sprintf("toString(%s) AS `%s`", expr, gb.Name)
+		allGroupByArgs = append(allGroupByArgs, args...)
+		sb.SelectMore(colExpr)
 	}
 
 	// for scalar queries, the rate would be end-start
@@ -605,7 +596,7 @@ func (b *logQueryStatementBuilder) buildScalarQuery(
 	}
 
 	// Group by dimensions
-	sb.GroupBy(fieldNames...)
+	sb.GroupBy(querybuilder.GroupByKeys(query.GroupBy)...)
 
 	// Add having clause if needed
 	if query.Having != nil && query.Having.Expression != "" {
@@ -623,11 +614,7 @@ func (b *logQueryStatementBuilder) buildScalarQuery(
 		if ok {
 			sb.OrderBy(fmt.Sprintf("__result_%d %s", idx, orderBy.Direction.StringValue()))
 		} else {
-			orderCol := orderBy.Key.Name
-			if alias, ok := groupByOrderAlias(orderBy.Key.Name, query.GroupBy); ok {
-				orderCol = alias
-			}
-			sb.OrderBy(fmt.Sprintf("`%s` %s", orderCol, orderBy.Direction.StringValue()))
+			sb.OrderBy(fmt.Sprintf("`%s` %s", orderBy.Key.Name, orderBy.Direction.StringValue()))
 		}
 	}
 
@@ -641,7 +628,7 @@ func (b *logQueryStatementBuilder) buildScalarQuery(
 		sb.Limit(query.Limit)
 	}
 
-	combinedArgs := allAggChArgs
+	combinedArgs := append(allGroupByArgs, allAggChArgs...)
 
 	mainSQL, mainArgs := sb.BuildWithFlavor(sqlbuilder.ClickHouse, combinedArgs...)
 
@@ -726,23 +713,6 @@ func aggOrderBy(k qbtypes.OrderBy, q qbtypes.QueryBuilderQuery[qbtypes.LogAggreg
 	return 0, false
 }
 
-func groupByColumnAlias(i int, name string) string {
-	return fmt.Sprintf("__GROUP_BY_KEY_%d_%s", i, name)
-}
-
-func selectColumnAlias(i int, name string) string {
-	return fmt.Sprintf("__SELECT_KEY_%d_%s", i, name)
-}
-
-func groupByOrderAlias(orderKey string, groupBy []qbtypes.GroupByKey) (string, bool) {
-	for i := range groupBy {
-		if groupBy[i].Name == orderKey {
-			return groupByColumnAlias(i, groupBy[i].Name), true
-		}
-	}
-	return "", false
-}
-
 func (b *logQueryStatementBuilder) maybeAttachResourceFilter(
 	ctx context.Context,
 	orgID valuer.UUID,

pkg/telemetrylogs/stmt_builder_test.go

@@ -73,7 +73,7 @@ func TestStatementBuilderTimeSeries(t *testing.T) {
 				},
 			},
 			expected: qbtypes.Statement{
-				Query: "WITH __resource_filter AS (SELECT fingerprint FROM signoz_logs.distributed_logs_v2_resource WHERE (simpleJSONExtractString(labels, 'service.name') = ? AND labels LIKE ? AND labels LIKE ?) AND seen_at_ts_bucket_start >= ? AND seen_at_ts_bucket_start <= ? GROUP BY fingerprint), __limit_cte AS (SELECT toString(multiIf(resource.`service.name` IS NOT NULL, resource.`service.name`::String, NULL)) AS `__GROUP_BY_KEY_0_service.name`, countDistinct(multiIf(resource.`service.name` IS NOT NULL, resource.`service.name`::String, NULL)) AS __result_0 FROM signoz_logs.distributed_logs_v2 WHERE resource_fingerprint GLOBAL IN (SELECT fingerprint FROM __resource_filter) AND timestamp >= ? AND ts_bucket_start >= ? AND timestamp < ? AND ts_bucket_start <= ? GROUP BY `__GROUP_BY_KEY_0_service.name` ORDER BY __result_0 DESC LIMIT ?) SELECT toStartOfInterval(fromUnixTimestamp64Nano(timestamp), INTERVAL 30 SECOND) AS ts, toString(multiIf(resource.`service.name` IS NOT NULL, resource.`service.name`::String, NULL)) AS `__GROUP_BY_KEY_0_service.name`, countDistinct(multiIf(resource.`service.name` IS NOT NULL, resource.`service.name`::String, NULL)) AS __result_0 FROM signoz_logs.distributed_logs_v2 WHERE resource_fingerprint GLOBAL IN (SELECT fingerprint FROM __resource_filter) AND timestamp >= ? AND ts_bucket_start >= ? AND timestamp < ? AND ts_bucket_start <= ? AND (`__GROUP_BY_KEY_0_service.name`) GLOBAL IN (SELECT `__GROUP_BY_KEY_0_service.name` FROM __limit_cte) GROUP BY ts, `__GROUP_BY_KEY_0_service.name`",
+				Query: "WITH __resource_filter AS (SELECT fingerprint FROM signoz_logs.distributed_logs_v2_resource WHERE (simpleJSONExtractString(labels, 'service.name') = ? AND labels LIKE ? AND labels LIKE ?) AND seen_at_ts_bucket_start >= ? AND seen_at_ts_bucket_start <= ? GROUP BY fingerprint), __limit_cte AS (SELECT toString(multiIf(resource.`service.name`::String IS NOT NULL, resource.`service.name`::String, NULL)) AS `service.name`, countDistinct(multiIf(resource.`service.name`::String IS NOT NULL, resource.`service.name`::String, NULL)) AS __result_0 FROM signoz_logs.distributed_logs_v2 WHERE resource_fingerprint GLOBAL IN (SELECT fingerprint FROM __resource_filter) AND timestamp >= ? AND ts_bucket_start >= ? AND timestamp < ? AND ts_bucket_start <= ? GROUP BY `service.name` ORDER BY __result_0 DESC LIMIT ?) SELECT toStartOfInterval(fromUnixTimestamp64Nano(timestamp), INTERVAL 30 SECOND) AS ts, toString(multiIf(resource.`service.name`::String IS NOT NULL, resource.`service.name`::String, NULL)) AS `service.name`, countDistinct(multiIf(resource.`service.name`::String IS NOT NULL, resource.`service.name`::String, NULL)) AS __result_0 FROM signoz_logs.distributed_logs_v2 WHERE resource_fingerprint GLOBAL IN (SELECT fingerprint FROM __resource_filter) AND timestamp >= ? AND ts_bucket_start >= ? AND timestamp < ? AND ts_bucket_start <= ? AND (`service.name`) GLOBAL IN (SELECT `service.name` FROM __limit_cte) GROUP BY ts, `service.name`",
 				Args:  []any{"cartservice", "%service.name%", "%service.name\":\"cartservice%", uint64(1705397400), uint64(1705485600), "1705399200000000000", uint64(1705397400), "1705485600000000000", uint64(1705485600), 10, "1705399200000000000", uint64(1705397400), "1705485600000000000", uint64(1705485600)},
 			},
 			expectedErr: nil,
@@ -104,8 +104,8 @@ func TestStatementBuilderTimeSeries(t *testing.T) {
 				},
 			},
 			expected: qbtypes.Statement{
-				Query: "WITH __limit_cte AS (SELECT toString(multiIf(multiIf(resource.`service.name` IS NOT NULL, resource.`service.name`::String, mapContains(resources_string, 'service.name'), resources_string['service.name'], NULL) IS NOT NULL, multiIf(resource.`service.name` IS NOT NULL, resource.`service.name`::String, mapContains(resources_string, 'service.name'), resources_string['service.name'], NULL), NULL)) AS `__GROUP_BY_KEY_0_service.name`, countDistinct(multiIf(multiIf(resource.`service.name` IS NOT NULL, resource.`service.name`::String, mapContains(resources_string, 'service.name'), resources_string['service.name'], NULL) IS NOT NULL, multiIf(resource.`service.name` IS NOT NULL, resource.`service.name`::String, mapContains(resources_string, 'service.name'), resources_string['service.name'], NULL), NULL)) AS __result_0 FROM signoz_logs.distributed_logs_v2 WHERE ((multiIf(resource.`service.name` IS NOT NULL, resource.`service.name`::String, mapContains(resources_string, 'service.name'), resources_string['service.name'], NULL) = ? AND multiIf(resource.`service.name` IS NOT NULL, resource.`service.name`::String, mapContains(resources_string, 'service.name'), resources_string['service.name'], NULL) IS NOT NULL) OR (attributes_string['http.method'] = ? AND mapContains(attributes_string, 'http.method'))) AND timestamp >= ? AND ts_bucket_start >= ? AND timestamp < ? AND ts_bucket_start <= ? GROUP BY `__GROUP_BY_KEY_0_service.name` ORDER BY __result_0 DESC LIMIT ?) SELECT toStartOfInterval(fromUnixTimestamp64Nano(timestamp), INTERVAL 30 SECOND) AS ts, toString(multiIf(multiIf(resource.`service.name` IS NOT NULL, resource.`service.name`::String, mapContains(resources_string, 'service.name'), resources_string['service.name'], NULL) IS NOT NULL, multiIf(resource.`service.name` IS NOT NULL, resource.`service.name`::String, mapContains(resources_string, 'service.name'), resources_string['service.name'], NULL), NULL)) AS `__GROUP_BY_KEY_0_service.name`, countDistinct(multiIf(multiIf(resource.`service.name` IS NOT NULL, resource.`service.name`::String, mapContains(resources_string, 'service.name'), resources_string['service.name'], NULL) IS NOT NULL, multiIf(resource.`service.name` IS NOT NULL, resource.`service.name`::String, mapContains(resources_string, 'service.name'), resources_string['service.name'], NULL), NULL)) AS __result_0 FROM signoz_logs.distributed_logs_v2 WHERE ((multiIf(resource.`service.name` IS NOT NULL, resource.`service.name`::String, mapContains(resources_string, 'service.name'), resources_string['service.name'], NULL) = ? AND multiIf(resource.`service.name` IS NOT NULL, resource.`service.name`::String, mapContains(resources_string, 'service.name'), resources_string['service.name'], NULL) IS NOT NULL) OR (attributes_string['http.method'] = ? AND mapContains(attributes_string, 'http.method'))) AND timestamp >= ? AND ts_bucket_start >= ? AND timestamp < ? AND ts_bucket_start <= ? AND (`__GROUP_BY_KEY_0_service.name`) GLOBAL IN (SELECT `__GROUP_BY_KEY_0_service.name` FROM __limit_cte) GROUP BY ts, `__GROUP_BY_KEY_0_service.name`",
-				Args:  []any{"redis-manual", "GET", "1705226400000000000", uint64(1705224600), "1705485600000000000", uint64(1705485600), 10, "redis-manual", "GET", "1705226400000000000", uint64(1705224600), "1705485600000000000", uint64(1705485600)},
+				Query: "WITH __limit_cte AS (SELECT toString(multiIf(multiIf(resource.`service.name` IS NOT NULL, resource.`service.name`::String, mapContains(resources_string, 'service.name'), resources_string['service.name'], NULL) IS NOT NULL, multiIf(resource.`service.name` IS NOT NULL, resource.`service.name`::String, mapContains(resources_string, 'service.name'), resources_string['service.name'], NULL), NULL)) AS `service.name`, countDistinct(multiIf(multiIf(resource.`service.name` IS NOT NULL, resource.`service.name`::String, mapContains(resources_string, 'service.name'), resources_string['service.name'], NULL) IS NOT NULL, multiIf(resource.`service.name` IS NOT NULL, resource.`service.name`::String, mapContains(resources_string, 'service.name'), resources_string['service.name'], NULL), NULL)) AS __result_0 FROM signoz_logs.distributed_logs_v2 WHERE ((multiIf(resource.`service.name` IS NOT NULL, resource.`service.name`::String, mapContains(resources_string, 'service.name'), resources_string['service.name'], NULL) = ? AND multiIf(resource.`service.name` IS NOT NULL, resource.`service.name`::String, mapContains(resources_string, 'service.name'), resources_string['service.name'], NULL) IS NOT NULL) OR (attributes_string['http.method'] = ? AND mapContains(attributes_string, 'http.method') = ?)) AND timestamp >= ? AND ts_bucket_start >= ? AND timestamp < ? AND ts_bucket_start <= ? GROUP BY `service.name` ORDER BY __result_0 DESC LIMIT ?) SELECT toStartOfInterval(fromUnixTimestamp64Nano(timestamp), INTERVAL 30 SECOND) AS ts, toString(multiIf(multiIf(resource.`service.name` IS NOT NULL, resource.`service.name`::String, mapContains(resources_string, 'service.name'), resources_string['service.name'], NULL) IS NOT NULL, multiIf(resource.`service.name` IS NOT NULL, resource.`service.name`::String, mapContains(resources_string, 'service.name'), resources_string['service.name'], NULL), NULL)) AS `service.name`, countDistinct(multiIf(multiIf(resource.`service.name` IS NOT NULL, resource.`service.name`::String, mapContains(resources_string, 'service.name'), resources_string['service.name'], NULL) IS NOT NULL, multiIf(resource.`service.name` IS NOT NULL, resource.`service.name`::String, mapContains(resources_string, 'service.name'), resources_string['service.name'], NULL), NULL)) AS __result_0 FROM signoz_logs.distributed_logs_v2 WHERE ((multiIf(resource.`service.name` IS NOT NULL, resource.`service.name`::String, mapContains(resources_string, 'service.name'), resources_string['service.name'], NULL) = ? AND multiIf(resource.`service.name` IS NOT NULL, resource.`service.name`::String, mapContains(resources_string, 'service.name'), resources_string['service.name'], NULL) IS NOT NULL) OR (attributes_string['http.method'] = ? AND mapContains(attributes_string, 'http.method') = ?)) AND timestamp >= ? AND ts_bucket_start >= ? AND timestamp < ? AND ts_bucket_start <= ? AND (`service.name`) GLOBAL IN (SELECT `service.name` FROM __limit_cte) GROUP BY ts, `service.name`",
+				Args:  []any{"redis-manual", "GET", true, "1705226400000000000", uint64(1705224600), "1705485600000000000", uint64(1705485600), 10, "redis-manual", "GET", true, "1705226400000000000", uint64(1705224600), "1705485600000000000", uint64(1705485600)},
 			},
 			expectedErr: nil,
 		},
@@ -145,7 +145,7 @@ func TestStatementBuilderTimeSeries(t *testing.T) {
 				},
 			},
 			expected: qbtypes.Statement{
-				Query: "WITH __resource_filter AS (SELECT fingerprint FROM signoz_logs.distributed_logs_v2_resource WHERE (simpleJSONExtractString(labels, 'service.name') = ? AND labels LIKE ? AND labels LIKE ?) AND seen_at_ts_bucket_start >= ? AND seen_at_ts_bucket_start <= ? GROUP BY fingerprint), __limit_cte AS (SELECT toString(multiIf(resource.`service.name` IS NOT NULL, resource.`service.name`::String, NULL)) AS `__GROUP_BY_KEY_0_service.name`, count() AS __result_0 FROM signoz_logs.distributed_logs_v2 WHERE resource_fingerprint GLOBAL IN (SELECT fingerprint FROM __resource_filter) AND timestamp >= ? AND ts_bucket_start >= ? AND timestamp < ? AND ts_bucket_start <= ? GROUP BY `__GROUP_BY_KEY_0_service.name` ORDER BY `__GROUP_BY_KEY_0_service.name` desc LIMIT ?) SELECT toStartOfInterval(fromUnixTimestamp64Nano(timestamp), INTERVAL 30 SECOND) AS ts, toString(multiIf(resource.`service.name` IS NOT NULL, resource.`service.name`::String, NULL)) AS `__GROUP_BY_KEY_0_service.name`, count() AS __result_0 FROM signoz_logs.distributed_logs_v2 WHERE resource_fingerprint GLOBAL IN (SELECT fingerprint FROM __resource_filter) AND timestamp >= ? AND ts_bucket_start >= ? AND timestamp < ? AND ts_bucket_start <= ? AND (`__GROUP_BY_KEY_0_service.name`) GLOBAL IN (SELECT `__GROUP_BY_KEY_0_service.name` FROM __limit_cte) GROUP BY ts, `__GROUP_BY_KEY_0_service.name` ORDER BY `__GROUP_BY_KEY_0_service.name` desc, ts desc",
+				Query: "WITH __resource_filter AS (SELECT fingerprint FROM signoz_logs.distributed_logs_v2_resource WHERE (simpleJSONExtractString(labels, 'service.name') = ? AND labels LIKE ? AND labels LIKE ?) AND seen_at_ts_bucket_start >= ? AND seen_at_ts_bucket_start <= ? GROUP BY fingerprint), __limit_cte AS (SELECT toString(multiIf(resource.`service.name`::String IS NOT NULL, resource.`service.name`::String, NULL)) AS `service.name`, count() AS __result_0 FROM signoz_logs.distributed_logs_v2 WHERE resource_fingerprint GLOBAL IN (SELECT fingerprint FROM __resource_filter) AND timestamp >= ? AND ts_bucket_start >= ? AND timestamp < ? AND ts_bucket_start <= ? GROUP BY `service.name` ORDER BY `service.name` desc LIMIT ?) SELECT toStartOfInterval(fromUnixTimestamp64Nano(timestamp), INTERVAL 30 SECOND) AS ts, toString(multiIf(resource.`service.name`::String IS NOT NULL, resource.`service.name`::String, NULL)) AS `service.name`, count() AS __result_0 FROM signoz_logs.distributed_logs_v2 WHERE resource_fingerprint GLOBAL IN (SELECT fingerprint FROM __resource_filter) AND timestamp >= ? AND ts_bucket_start >= ? AND timestamp < ? AND ts_bucket_start <= ? AND (`service.name`) GLOBAL IN (SELECT `service.name` FROM __limit_cte) GROUP BY ts, `service.name` ORDER BY `service.name` desc, ts desc",
 				Args:  []any{"cartservice", "%service.name%", "%service.name\":\"cartservice%", uint64(1705397400), uint64(1705485600), "1705399200000000000", uint64(1705397400), "1705485600000000000", uint64(1705485600), 10, "1705399200000000000", uint64(1705397400), "1705485600000000000", uint64(1705485600)},
 			},
 			expectedErr: nil,
@@ -178,8 +178,8 @@ func TestStatementBuilderTimeSeries(t *testing.T) {
 				},
 			},
 			expected: qbtypes.Statement{
-				Query: "WITH __resource_filter AS (SELECT fingerprint FROM signoz_logs.distributed_logs_v2_resource WHERE (simpleJSONExtractString(labels, 'service.name') = ? AND labels LIKE ? AND labels LIKE ?) AND seen_at_ts_bucket_start >= ? AND seen_at_ts_bucket_start <= ? GROUP BY fingerprint), __limit_cte AS (SELECT toString(multiIf(`attribute_string_materialized$$key$$name_exists`, `attribute_string_materialized$$key$$name`, NULL)) AS `__GROUP_BY_KEY_0_materialized.key.name`, count() AS __result_0 FROM signoz_logs.distributed_logs_v2 WHERE resource_fingerprint GLOBAL IN (SELECT fingerprint FROM __resource_filter) AND timestamp >= ? AND ts_bucket_start >= ? AND timestamp < ? AND ts_bucket_start <= ? GROUP BY `__GROUP_BY_KEY_0_materialized.key.name` ORDER BY __result_0 DESC LIMIT ?) SELECT toStartOfInterval(fromUnixTimestamp64Nano(timestamp), INTERVAL 30 SECOND) AS ts, toString(multiIf(`attribute_string_materialized$$key$$name_exists`, `attribute_string_materialized$$key$$name`, NULL)) AS `__GROUP_BY_KEY_0_materialized.key.name`, count() AS __result_0 FROM signoz_logs.distributed_logs_v2 WHERE resource_fingerprint GLOBAL IN (SELECT fingerprint FROM __resource_filter) AND timestamp >= ? AND ts_bucket_start >= ? AND timestamp < ? AND ts_bucket_start <= ? AND (`__GROUP_BY_KEY_0_materialized.key.name`) GLOBAL IN (SELECT `__GROUP_BY_KEY_0_materialized.key.name` FROM __limit_cte) GROUP BY ts, `__GROUP_BY_KEY_0_materialized.key.name`",
-				Args:  []any{"cartservice", "%service.name%", "%service.name\":\"cartservice%", uint64(1705397400), uint64(1705485600), "1705399200000000000", uint64(1705397400), "1705485600000000000", uint64(1705485600), 10, "1705399200000000000", uint64(1705397400), "1705485600000000000", uint64(1705485600)},
+				Query: "WITH __resource_filter AS (SELECT fingerprint FROM signoz_logs.distributed_logs_v2_resource WHERE (simpleJSONExtractString(labels, 'service.name') = ? AND labels LIKE ? AND labels LIKE ?) AND seen_at_ts_bucket_start >= ? AND seen_at_ts_bucket_start <= ? GROUP BY fingerprint), __limit_cte AS (SELECT toString(multiIf(`attribute_string_materialized$$key$$name_exists` = ?, `attribute_string_materialized$$key$$name`, NULL)) AS `materialized.key.name`, count() AS __result_0 FROM signoz_logs.distributed_logs_v2 WHERE resource_fingerprint GLOBAL IN (SELECT fingerprint FROM __resource_filter) AND timestamp >= ? AND ts_bucket_start >= ? AND timestamp < ? AND ts_bucket_start <= ? GROUP BY `materialized.key.name` ORDER BY __result_0 DESC LIMIT ?) SELECT toStartOfInterval(fromUnixTimestamp64Nano(timestamp), INTERVAL 30 SECOND) AS ts, toString(multiIf(`attribute_string_materialized$$key$$name_exists` = ?, `attribute_string_materialized$$key$$name`, NULL)) AS `materialized.key.name`, count() AS __result_0 FROM signoz_logs.distributed_logs_v2 WHERE resource_fingerprint GLOBAL IN (SELECT fingerprint FROM __resource_filter) AND timestamp >= ? AND ts_bucket_start >= ? AND timestamp < ? AND ts_bucket_start <= ? AND (`materialized.key.name`) GLOBAL IN (SELECT `materialized.key.name` FROM __limit_cte) GROUP BY ts, `materialized.key.name`",
+				Args:  []any{"cartservice", "%service.name%", "%service.name\":\"cartservice%", uint64(1705397400), uint64(1705485600), true, "1705399200000000000", uint64(1705397400), "1705485600000000000", uint64(1705485600), 10, true, "1705399200000000000", uint64(1705397400), "1705485600000000000", uint64(1705485600)},
 			},
 		},
 		{
@@ -201,8 +201,8 @@ func TestStatementBuilderTimeSeries(t *testing.T) {
 				Limit: 10,
 			},
 			expected: qbtypes.Statement{
-				Query: "SELECT toStartOfInterval(fromUnixTimestamp64Nano(timestamp), INTERVAL 30 SECOND) AS ts, count() AS __result_0 FROM signoz_logs.distributed_logs_v2 WHERE ((match(`attribute_string_materialized$$key$$name`, ?) AND `attribute_string_materialized$$key$$name_exists`) OR (`attribute_string_materialized$$key$$name` = ? AND `attribute_string_materialized$$key$$name_exists`)) AND timestamp >= ? AND ts_bucket_start >= ? AND timestamp < ? AND ts_bucket_start <= ? GROUP BY ts",
-				Args:  []any{"redis.*", "memcached", "1705399200000000000", uint64(1705397400), "1705485600000000000", uint64(1705485600)},
+				Query: "SELECT toStartOfInterval(fromUnixTimestamp64Nano(timestamp), INTERVAL 30 SECOND) AS ts, count() AS __result_0 FROM signoz_logs.distributed_logs_v2 WHERE ((match(`attribute_string_materialized$$key$$name`, ?) AND `attribute_string_materialized$$key$$name_exists` = ?) OR (`attribute_string_materialized$$key$$name` = ? AND `attribute_string_materialized$$key$$name_exists` = ?)) AND timestamp >= ? AND ts_bucket_start >= ? AND timestamp < ? AND ts_bucket_start <= ? GROUP BY ts",
+				Args:  []any{"redis.*", true, "memcached", true, "1705399200000000000", uint64(1705397400), "1705485600000000000", uint64(1705485600)},
 			},
 			expectedErr: nil,
 		},
@@ -219,7 +219,7 @@ func TestStatementBuilderTimeSeries(t *testing.T) {
 	fm := NewFieldMapper(fl)
 	cb := NewConditionBuilder(fm, fl)
 
-	aggExprRewriter := querybuilder.NewAggExprRewriter(instrumentationtest.New().ToProviderSettings(), nil, fm, cb, fl)
+	aggExprRewriter := querybuilder.NewAggExprRewriter(instrumentationtest.New().ToProviderSettings(), nil, fm, cb, nil, fl)
 
 	statementBuilder := NewLogQueryStatementBuilder(
 		instrumentationtest.New().ToProviderSettings(),
@@ -302,7 +302,7 @@ func TestStatementBuilderListQuery(t *testing.T) {
 				},
 			},
 			expected: qbtypes.Statement{
-				Query: "WITH __resource_filter AS (SELECT fingerprint FROM signoz_logs.distributed_logs_v2_resource WHERE (simpleJSONExtractString(labels, 'service.name') = ? AND labels LIKE ? AND labels LIKE ?) AND seen_at_ts_bucket_start >= ? AND seen_at_ts_bucket_start <= ? GROUP BY fingerprint) SELECT timestamp, id, trace_id, span_id, trace_flags, severity_text, severity_number, scope_name, scope_version, body, attributes_string, attributes_number, attributes_bool, resources_string, scope_string FROM signoz_logs.distributed_logs_v2 WHERE resource_fingerprint GLOBAL IN (SELECT fingerprint FROM __resource_filter) AND timestamp >= ? AND ts_bucket_start >= ? AND timestamp < ? AND ts_bucket_start <= ? ORDER BY multiIf(`attribute_string_materialized$$key$$name_exists`, `attribute_string_materialized$$key$$name`, NULL) desc LIMIT ?",
+				Query: "WITH __resource_filter AS (SELECT fingerprint FROM signoz_logs.distributed_logs_v2_resource WHERE (simpleJSONExtractString(labels, 'service.name') = ? AND labels LIKE ? AND labels LIKE ?) AND seen_at_ts_bucket_start >= ? AND seen_at_ts_bucket_start <= ? GROUP BY fingerprint) SELECT timestamp, id, trace_id, span_id, trace_flags, severity_text, severity_number, scope_name, scope_version, body, attributes_string, attributes_number, attributes_bool, resources_string, scope_string FROM signoz_logs.distributed_logs_v2 WHERE resource_fingerprint GLOBAL IN (SELECT fingerprint FROM __resource_filter) AND timestamp >= ? AND ts_bucket_start >= ? AND timestamp < ? AND ts_bucket_start <= ? ORDER BY `attribute_string_materialized$$key$$name` AS `materialized.key.name` desc LIMIT ?",
 				Args:  []any{"cartservice", "%service.name%", "%service.name\":\"cartservice%", uint64(1747945619), uint64(1747983448), "1747947419000000000", uint64(1747945619), "1747983448000000000", uint64(1747983448), 10},
 			},
 			expectedErr: nil,
@@ -330,8 +330,8 @@ func TestStatementBuilderListQuery(t *testing.T) {
 				},
 			},
 			expected: qbtypes.Statement{
-				Query: "SELECT timestamp, id, trace_id, span_id, trace_flags, severity_text, severity_number, scope_name, scope_version, body, attributes_string, attributes_number, attributes_bool, resources_string, scope_string FROM signoz_logs.distributed_logs_v2 WHERE ((match(`attribute_string_materialized$$key$$name`, ?) AND `attribute_string_materialized$$key$$name_exists`) OR (`attribute_string_materialized$$key$$name` = ? AND `attribute_string_materialized$$key$$name_exists`)) AND timestamp >= ? AND ts_bucket_start >= ? AND timestamp < ? AND ts_bucket_start <= ? ORDER BY multiIf(`attribute_string_materialized$$key$$name_exists`, `attribute_string_materialized$$key$$name`, NULL) desc LIMIT ?",
-				Args:  []any{"redis.*", "memcached", "1747947419000000000", uint64(1747945619), "1747983448000000000", uint64(1747983448), 10},
+				Query: "SELECT timestamp, id, trace_id, span_id, trace_flags, severity_text, severity_number, scope_name, scope_version, body, attributes_string, attributes_number, attributes_bool, resources_string, scope_string FROM signoz_logs.distributed_logs_v2 WHERE ((match(`attribute_string_materialized$$key$$name`, ?) AND `attribute_string_materialized$$key$$name_exists` = ?) OR (`attribute_string_materialized$$key$$name` = ? AND `attribute_string_materialized$$key$$name_exists` = ?)) AND timestamp >= ? AND ts_bucket_start >= ? AND timestamp < ? AND ts_bucket_start <= ? ORDER BY `attribute_string_materialized$$key$$name` AS `materialized.key.name` desc LIMIT ?",
+				Args:  []any{"redis.*", true, "memcached", true, "1747947419000000000", uint64(1747945619), "1747983448000000000", uint64(1747983448), 10},
 			},
 			expectedErr: nil,
 		},
@@ -363,7 +363,7 @@ func TestStatementBuilderListQuery(t *testing.T) {
 	mockMetadataStore.KeysMap = buildCompleteFieldKeyMap(releaseTime)
 	cb := NewConditionBuilder(fm, fl)
 
-	aggExprRewriter := querybuilder.NewAggExprRewriter(instrumentationtest.New().ToProviderSettings(), nil, fm, cb, fl)
+	aggExprRewriter := querybuilder.NewAggExprRewriter(instrumentationtest.New().ToProviderSettings(), nil, fm, cb, nil, fl)
 
 	statementBuilder := NewLogQueryStatementBuilder(
 		instrumentationtest.New().ToProviderSettings(),
@@ -448,7 +448,7 @@ func TestStatementBuilderListQueryResourceTests(t *testing.T) {
 				},
 			},
 			expected: qbtypes.Statement{
-				Query: "WITH __resource_filter AS (SELECT fingerprint FROM signoz_logs.distributed_logs_v2_resource WHERE (simpleJSONExtractString(labels, 'service.name') = ? AND labels LIKE ? AND labels LIKE ?) AND seen_at_ts_bucket_start >= ? AND seen_at_ts_bucket_start <= ? GROUP BY fingerprint) SELECT timestamp, id, trace_id, span_id, trace_flags, severity_text, severity_number, scope_name, scope_version, body, attributes_string, attributes_number, attributes_bool, resources_string, scope_string FROM signoz_logs.distributed_logs_v2 WHERE resource_fingerprint GLOBAL IN (SELECT fingerprint FROM __resource_filter) AND match(LOWER(body), LOWER(?)) AND timestamp >= ? AND ts_bucket_start >= ? AND timestamp < ? AND ts_bucket_start <= ? ORDER BY multiIf(`attribute_string_materialized$$key$$name_exists`, `attribute_string_materialized$$key$$name`, NULL) desc LIMIT ?",
+				Query: "WITH __resource_filter AS (SELECT fingerprint FROM signoz_logs.distributed_logs_v2_resource WHERE (simpleJSONExtractString(labels, 'service.name') = ? AND labels LIKE ? AND labels LIKE ?) AND seen_at_ts_bucket_start >= ? AND seen_at_ts_bucket_start <= ? GROUP BY fingerprint) SELECT timestamp, id, trace_id, span_id, trace_flags, severity_text, severity_number, scope_name, scope_version, body, attributes_string, attributes_number, attributes_bool, resources_string, scope_string FROM signoz_logs.distributed_logs_v2 WHERE resource_fingerprint GLOBAL IN (SELECT fingerprint FROM __resource_filter) AND match(LOWER(body), LOWER(?)) AND timestamp >= ? AND ts_bucket_start >= ? AND timestamp < ? AND ts_bucket_start <= ? ORDER BY `attribute_string_materialized$$key$$name` AS `materialized.key.name` desc LIMIT ?",
 				Args:  []any{"cartservice", "%service.name%", "%service.name\":\"cartservice%", uint64(1747945619), uint64(1747983448), "hello", "1747947419000000000", uint64(1747945619), "1747983448000000000", uint64(1747983448), 10},
 			},
 			expectedErr: nil,
@@ -464,9 +464,8 @@ func TestStatementBuilderListQueryResourceTests(t *testing.T) {
 				Limit: 10,
 			},
 			expected: qbtypes.Statement{
-				Query:    "SELECT timestamp, id, trace_id, span_id, trace_flags, severity_text, severity_number, scope_name, scope_version, body, attributes_string, attributes_number, attributes_bool, resources_string, scope_string FROM signoz_logs.distributed_logs_v2 WHERE (JSON_VALUE(body, '$.\"status\"') = ? AND JSON_EXISTS(body, '$.\"status\"')) AND timestamp >= ? AND ts_bucket_start >= ? AND timestamp < ? AND ts_bucket_start <= ? LIMIT ?",
-				Args:     []any{"success", "1747947419000000000", uint64(1747945619), "1747983448000000000", uint64(1747983448), 10},
-				Warnings: []string{querybuilder.NewKeyNotFoundWarning("status")},
+				Query: "SELECT timestamp, id, trace_id, span_id, trace_flags, severity_text, severity_number, scope_name, scope_version, body, attributes_string, attributes_number, attributes_bool, resources_string, scope_string FROM signoz_logs.distributed_logs_v2 WHERE (JSON_VALUE(body, '$.\"status\"') = ? AND JSON_EXISTS(body, '$.\"status\"')) AND timestamp >= ? AND ts_bucket_start >= ? AND timestamp < ? AND ts_bucket_start <= ? LIMIT ?",
+				Args:  []any{"success", "1747947419000000000", uint64(1747945619), "1747983448000000000", uint64(1747983448), 10},
 			},
 			expectedErr: nil,
 		},
@@ -481,9 +480,8 @@ func TestStatementBuilderListQueryResourceTests(t *testing.T) {
 				Limit: 10,
 			},
 			expected: qbtypes.Statement{
-				Query:    "SELECT timestamp, id, trace_id, span_id, trace_flags, severity_text, severity_number, scope_name, scope_version, body, attributes_string, attributes_number, attributes_bool, resources_string, scope_string FROM signoz_logs.distributed_logs_v2 WHERE ((JSONExtract(JSON_QUERY(body, '$.\"user_names\"[*]'), 'Array(String)') = ?) AND JSON_EXISTS(body, '$.\"user_names\"[*]')) AND timestamp >= ? AND ts_bucket_start >= ? AND timestamp < ? AND ts_bucket_start <= ? LIMIT ?",
-				Args:     []any{"john_doe", "1747947419000000000", uint64(1747945619), "1747983448000000000", uint64(1747983448), 10},
-				Warnings: []string{querybuilder.NewKeyNotFoundWarning("user_names[*]")},
+				Query: "SELECT timestamp, id, trace_id, span_id, trace_flags, severity_text, severity_number, scope_name, scope_version, body, attributes_string, attributes_number, attributes_bool, resources_string, scope_string FROM signoz_logs.distributed_logs_v2 WHERE ((JSONExtract(JSON_QUERY(body, '$.\"user_names\"[*]'), 'Array(String)') = ?) AND JSON_EXISTS(body, '$.\"user_names\"[*]')) AND timestamp >= ? AND ts_bucket_start >= ? AND timestamp < ? AND ts_bucket_start <= ? LIMIT ?",
+				Args:  []any{"john_doe", "1747947419000000000", uint64(1747945619), "1747983448000000000", uint64(1747983448), 10},
 			},
 			expectedErr: nil,
 		},
@@ -498,9 +496,8 @@ func TestStatementBuilderListQueryResourceTests(t *testing.T) {
 				Limit: 10,
 			},
 			expected: qbtypes.Statement{
-				Query:    "SELECT timestamp, id, trace_id, span_id, trace_flags, severity_text, severity_number, scope_name, scope_version, body, attributes_string, attributes_number, attributes_bool, resources_string, scope_string FROM signoz_logs.distributed_logs_v2 WHERE has(JSONExtract(JSON_QUERY(body, '$.\"user_names\"[*]'), 'Array(String)'), ?) AND timestamp >= ? AND ts_bucket_start >= ? AND timestamp < ? AND ts_bucket_start <= ? LIMIT ?",
-				Args:     []any{"john_doe", "1747947419000000000", uint64(1747945619), "1747983448000000000", uint64(1747983448), 10},
-				Warnings: []string{querybuilder.NewKeyNotFoundWarning("user_names[*]")},
+				Query: "SELECT timestamp, id, trace_id, span_id, trace_flags, severity_text, severity_number, scope_name, scope_version, body, attributes_string, attributes_number, attributes_bool, resources_string, scope_string FROM signoz_logs.distributed_logs_v2 WHERE has(JSONExtract(JSON_QUERY(body, '$.\"user_names\"[*]'), 'Array(String)'), ?) AND timestamp >= ? AND ts_bucket_start >= ? AND timestamp < ? AND ts_bucket_start <= ? LIMIT ?",
+				Args:  []any{"john_doe", "1747947419000000000", uint64(1747945619), "1747983448000000000", uint64(1747983448), 10},
 			},
 			expectedErr: nil,
 		},
@@ -515,7 +512,7 @@ func TestStatementBuilderListQueryResourceTests(t *testing.T) {
 	mockMetadataStore.KeysMap = buildCompleteFieldKeyMap(releaseTime)
 	cb := NewConditionBuilder(fm, fl)
 
-	aggExprRewriter := querybuilder.NewAggExprRewriter(instrumentationtest.New().ToProviderSettings(), nil, fm, cb, fl)
+	aggExprRewriter := querybuilder.NewAggExprRewriter(instrumentationtest.New().ToProviderSettings(), nil, fm, cb, nil, fl)
 
 	statementBuilder := NewLogQueryStatementBuilder(
 		instrumentationtest.New().ToProviderSettings(),
@@ -594,7 +591,7 @@ func TestStatementBuilderTimeSeriesBodyGroupBy(t *testing.T) {
 	mockMetadataStore.KeysMap = buildCompleteFieldKeyMap(releaseTime)
 	cb := NewConditionBuilder(fm, fl)
 
-	aggExprRewriter := querybuilder.NewAggExprRewriter(instrumentationtest.New().ToProviderSettings(), nil, fm, cb, fl)
+	aggExprRewriter := querybuilder.NewAggExprRewriter(instrumentationtest.New().ToProviderSettings(), nil, fm, cb, nil, fl)
 
 	statementBuilder := NewLogQueryStatementBuilder(
 		instrumentationtest.New().ToProviderSettings(),
@@ -677,7 +674,7 @@ func TestStatementBuilderListQueryServiceCollision(t *testing.T) {
 				},
 			},
 			expected: qbtypes.Statement{
-				Query: "WITH __resource_filter AS (SELECT fingerprint FROM signoz_logs.distributed_logs_v2_resource WHERE (simpleJSONExtractString(labels, 'service.name') = ? AND labels LIKE ? AND labels LIKE ?) AND seen_at_ts_bucket_start >= ? AND seen_at_ts_bucket_start <= ? GROUP BY fingerprint) SELECT timestamp, id, trace_id, span_id, trace_flags, severity_text, severity_number, scope_name, scope_version, body, attributes_string, attributes_number, attributes_bool, resources_string, scope_string FROM signoz_logs.distributed_logs_v2 WHERE resource_fingerprint GLOBAL IN (SELECT fingerprint FROM __resource_filter) AND LOWER(body) LIKE LOWER(?) AND timestamp >= ? AND ts_bucket_start >= ? AND timestamp < ? AND ts_bucket_start <= ? ORDER BY multiIf(`attribute_string_materialized$$key$$name_exists`, `attribute_string_materialized$$key$$name`, NULL) desc LIMIT ?",
+				Query: "WITH __resource_filter AS (SELECT fingerprint FROM signoz_logs.distributed_logs_v2_resource WHERE (simpleJSONExtractString(labels, 'service.name') = ? AND labels LIKE ? AND labels LIKE ?) AND seen_at_ts_bucket_start >= ? AND seen_at_ts_bucket_start <= ? GROUP BY fingerprint) SELECT timestamp, id, trace_id, span_id, trace_flags, severity_text, severity_number, scope_name, scope_version, body, attributes_string, attributes_number, attributes_bool, resources_string, scope_string FROM signoz_logs.distributed_logs_v2 WHERE resource_fingerprint GLOBAL IN (SELECT fingerprint FROM __resource_filter) AND LOWER(body) LIKE LOWER(?) AND timestamp >= ? AND ts_bucket_start >= ? AND timestamp < ? AND ts_bucket_start <= ? ORDER BY `attribute_string_materialized$$key$$name` AS `materialized.key.name` desc LIMIT ?",
 				Args:  []any{"cartservice", "%service.name%", "%service.name\":\"cartservice%", uint64(1747945619), uint64(1747983448), "%error%", "1747947419000000000", uint64(1747945619), "1747983448000000000", uint64(1747983448), 10},
 			},
 			expectedErr: nil,
@@ -692,7 +689,7 @@ func TestStatementBuilderListQueryServiceCollision(t *testing.T) {
 	mockMetadataStore.KeysMap = buildCompleteFieldKeyMapCollision()
 	cb := NewConditionBuilder(fm, fl)
 
-	aggExprRewriter := querybuilder.NewAggExprRewriter(instrumentationtest.New().ToProviderSettings(), nil, fm, cb, fl)
+	aggExprRewriter := querybuilder.NewAggExprRewriter(instrumentationtest.New().ToProviderSettings(), nil, fm, cb, nil, fl)
 
 	statementBuilder := NewLogQueryStatementBuilder(
 		instrumentationtest.New().ToProviderSettings(),
@@ -919,7 +916,7 @@ func TestAdjustKey(t *testing.T) {
 	mockMetadataStore.KeysMap = buildCompleteFieldKeyMapCollision()
 	cb := NewConditionBuilder(fm, fl)
 
-	aggExprRewriter := querybuilder.NewAggExprRewriter(instrumentationtest.New().ToProviderSettings(), nil, fm, cb, fl)
+	aggExprRewriter := querybuilder.NewAggExprRewriter(instrumentationtest.New().ToProviderSettings(), nil, fm, cb, nil, fl)
 
 	statementBuilder := NewLogQueryStatementBuilder(
 		instrumentationtest.New().ToProviderSettings(),
@@ -972,8 +969,8 @@ func TestStmtBuilderBodyField(t *testing.T) {
 			},
 			enableUseJSONBody: true,
 			expected: qbtypes.Statement{
-				Query:    "SELECT timestamp, id, trace_id, span_id, trace_flags, severity_text, severity_number, scope_name, scope_version, body_v2 as body, attributes_string, attributes_number, attributes_bool, resources_string, scope_string FROM signoz_logs.distributed_logs_v2 WHERE body_v2.message <> '' AND timestamp >= ? AND ts_bucket_start >= ? AND timestamp < ? AND ts_bucket_start <= ? LIMIT ?",
-				Args:     []any{"1747947419000000000", uint64(1747945619), "1747983448000000000", uint64(1747983448), 10},
+				Query:    "SELECT timestamp, id, trace_id, span_id, trace_flags, severity_text, severity_number, scope_name, scope_version, body_v2 as body, attributes_string, attributes_number, attributes_bool, resources_string, scope_string FROM signoz_logs.distributed_logs_v2 WHERE body_v2.message <> ? AND timestamp >= ? AND ts_bucket_start >= ? AND timestamp < ? AND ts_bucket_start <= ? LIMIT ?",
+				Args:     []any{"", "1747947419000000000", uint64(1747945619), "1747983448000000000", uint64(1747983448), 10},
 				Warnings: []string{bodySearchDefaultWarning},
 			},
 			expectedErr: nil,
@@ -988,8 +985,8 @@ func TestStmtBuilderBodyField(t *testing.T) {
 			},
 			enableUseJSONBody: false,
 			expected: qbtypes.Statement{
-				Query: "SELECT timestamp, id, trace_id, span_id, trace_flags, severity_text, severity_number, scope_name, scope_version, body, attributes_string, attributes_number, attributes_bool, resources_string, scope_string FROM signoz_logs.distributed_logs_v2 WHERE body <> '' AND timestamp >= ? AND ts_bucket_start >= ? AND timestamp < ? AND ts_bucket_start <= ? LIMIT ?",
-				Args:  []any{"1747947419000000000", uint64(1747945619), "1747983448000000000", uint64(1747983448), 10},
+				Query: "SELECT timestamp, id, trace_id, span_id, trace_flags, severity_text, severity_number, scope_name, scope_version, body, attributes_string, attributes_number, attributes_bool, resources_string, scope_string FROM signoz_logs.distributed_logs_v2 WHERE body <> ? AND timestamp >= ? AND ts_bucket_start >= ? AND timestamp < ? AND ts_bucket_start <= ? LIMIT ?",
+				Args:  []any{"", "1747947419000000000", uint64(1747945619), "1747983448000000000", uint64(1747983448), 10},
 			},
 			expectedErr: nil,
 		},
@@ -1068,7 +1065,7 @@ func TestStmtBuilderBodyField(t *testing.T) {
 				f := field
 				mockMetadataStore.KeysMap[field.Name] = append(mockMetadataStore.KeysMap[field.Name], &f)
 			}
-			aggExprRewriter := querybuilder.NewAggExprRewriter(instrumentationtest.New().ToProviderSettings(), nil, fm, cb, fl)
+			aggExprRewriter := querybuilder.NewAggExprRewriter(instrumentationtest.New().ToProviderSettings(), nil, fm, cb, nil, fl)
 			statementBuilder := NewLogQueryStatementBuilder(
 				instrumentationtest.New().ToProviderSettings(),
 				mockMetadataStore,
@@ -1170,7 +1167,7 @@ func TestStmtBuilderBodyFullTextSearch(t *testing.T) {
 				f := field
 				mockMetadataStore.KeysMap[field.Name] = append(mockMetadataStore.KeysMap[field.Name], &f)
 			}
-			aggExprRewriter := querybuilder.NewAggExprRewriter(instrumentationtest.New().ToProviderSettings(), nil, fm, cb, fl)
+			aggExprRewriter := querybuilder.NewAggExprRewriter(instrumentationtest.New().ToProviderSettings(), nil, fm, cb, nil, fl)
 			statementBuilder := NewLogQueryStatementBuilder(
 				instrumentationtest.New().ToProviderSettings(),
 				mockMetadataStore,
@@ -1291,6 +1288,7 @@ func newSkipResourceFingerprintLogsBuilder(
 		DefaultFullTextColumn,
 		fm,
 		cb,
+		GetBodyJSONKey,
 		fl,
 	)
 

pkg/telemetrymetadata/condition_builder.go

@@ -20,14 +20,12 @@ func NewConditionBuilder(fm qbtypes.FieldMapper) *conditionBuilder {
 	return &conditionBuilder{fm: fm}
 }
 
-// Metadata has no resource sub-query, so options are unused.
-func (c *conditionBuilder) ConditionForKeys(
+func (c *conditionBuilder) ConditionFor(
 	ctx context.Context,
 	orgID valuer.UUID,
 	tsStart, tsEnd uint64,
 	key *telemetrytypes.TelemetryFieldKey,
-	fieldKeys map[string][]*telemetrytypes.TelemetryFieldKey,
-	_ qbtypes.ConditionBuilderOptions,
+	fieldKeysForName []*telemetrytypes.TelemetryFieldKey,
 	operator qbtypes.FilterOperator,
 	value any,
 	sb *sqlbuilder.SelectBuilder,
@@ -38,8 +36,9 @@ func (c *conditionBuilder) ConditionForKeys(
 		return nil, nil, err
 	}
 
-	// an unknown key simply yields no condition rather than an error.
-	keys, warning := querybuilder.ResolveKeys(key, querybuilder.MatchingFieldKeys(key, fieldKeys))
+	// metadata builds best-effort filters for related-values lookups; an unknown key
+	// simply yields no condition rather than an error.
+	keys, warning := querybuilder.ResolveKeys(key, fieldKeysForName)
 	var warnings []string
 	if warning != "" {
 		warnings = append(warnings, warning)

pkg/telemetrymetadata/condition_builder_test.go

@@ -54,7 +54,7 @@ func TestConditionFor(t *testing.T) {
 	for _, tc := range testCases {
 		sb := sqlbuilder.NewSelectBuilder()
 		t.Run(tc.name, func(t *testing.T) {
-			cond, _, err := conditionBuilder.ConditionForKeys(ctx, valuer.UUID{}, 0, 0, &tc.key, map[string][]*telemetrytypes.TelemetryFieldKey{tc.key.Name: {&tc.key}}, qbtypes.ConditionBuilderOptions{}, tc.operator, tc.value, sb)
+			cond, _, err := conditionBuilder.ConditionFor(ctx, valuer.UUID{}, 0, 0, &tc.key, []*telemetrytypes.TelemetryFieldKey{&tc.key}, tc.operator, tc.value, sb)
 			sb.Where(cond...)
 
 			if tc.expectedError != nil {

pkg/telemetrymetadata/field_mapper.go

@@ -79,7 +79,6 @@ func (m *fieldMapper) ColumnExpressionFor(
 	orgID valuer.UUID,
 	startNs, endNs uint64,
 	field *telemetrytypes.TelemetryFieldKey,
-	_ telemetrytypes.FieldDataType,
 	keys map[string][]*telemetrytypes.TelemetryFieldKey,
 ) (string, error) {
 

pkg/telemetrymetadata/metadata.go

@@ -1444,20 +1444,20 @@ func (t *telemetryMetaStore) getRelatedValues(ctx context.Context, orgID valuer.
 
 			// search on attributes
 			key.FieldContext = telemetrytypes.FieldContextAttribute
-			attrConds, _, err := t.conditionBuilder.ConditionForKeys(ctx, orgID, 0, 0, key, map[string][]*telemetrytypes.TelemetryFieldKey{key.Name: {key}}, qbtypes.ConditionBuilderOptions{}, qbtypes.FilterOperatorContains, fieldValueSelector.Value, sb)
+			attrConds, _, err := t.conditionBuilder.ConditionFor(ctx, orgID, 0, 0, key, []*telemetrytypes.TelemetryFieldKey{key}, qbtypes.FilterOperatorContains, fieldValueSelector.Value, sb)
 			if err == nil {
 				conds = append(conds, attrConds...)
 			}
 
 			// search on resource
 			key.FieldContext = telemetrytypes.FieldContextResource
-			resourceConds, _, err := t.conditionBuilder.ConditionForKeys(ctx, orgID, 0, 0, key, map[string][]*telemetrytypes.TelemetryFieldKey{key.Name: {key}}, qbtypes.ConditionBuilderOptions{}, qbtypes.FilterOperatorContains, fieldValueSelector.Value, sb)
+			resourceConds, _, err := t.conditionBuilder.ConditionFor(ctx, orgID, 0, 0, key, []*telemetrytypes.TelemetryFieldKey{key}, qbtypes.FilterOperatorContains, fieldValueSelector.Value, sb)
 			if err == nil {
 				conds = append(conds, resourceConds...)
 			}
 			key.FieldContext = origContext
 		} else {
-			keyConds, _, err := t.conditionBuilder.ConditionForKeys(ctx, orgID, 0, 0, key, map[string][]*telemetrytypes.TelemetryFieldKey{key.Name: {key}}, qbtypes.ConditionBuilderOptions{}, qbtypes.FilterOperatorContains, fieldValueSelector.Value, sb)
+			keyConds, _, err := t.conditionBuilder.ConditionFor(ctx, orgID, 0, 0, key, []*telemetrytypes.TelemetryFieldKey{key}, qbtypes.FilterOperatorContains, fieldValueSelector.Value, sb)
 			if err == nil {
 				conds = append(conds, keyConds...)
 			}

pkg/telemetrymeter/statement_builder.go

@@ -126,7 +126,7 @@ func (b *meterQueryStatementBuilder) buildTemporalAggDeltaFastPath(
 		stepSec,
 	))
 	for _, g := range query.GroupBy {
-		col, err := b.fm.ColumnExpressionFor(ctx, orgID, start, end, &g.TelemetryFieldKey, telemetrytypes.FieldDataTypeString, keys)
+		col, err := b.fm.ColumnExpressionFor(ctx, orgID, start, end, &g.TelemetryFieldKey, keys)
 		if err != nil {
 			return "", nil, err
 		}
@@ -215,7 +215,7 @@ func (b *meterQueryStatementBuilder) buildTemporalAggDelta(
 	))
 
 	for _, g := range query.GroupBy {
-		col, err := b.fm.ColumnExpressionFor(ctx, orgID, start, end, &g.TelemetryFieldKey, telemetrytypes.FieldDataTypeString, keys)
+		col, err := b.fm.ColumnExpressionFor(ctx, orgID, start, end, &g.TelemetryFieldKey, keys)
 		if err != nil {
 			return "", nil, err
 		}
@@ -293,7 +293,7 @@ func (b *meterQueryStatementBuilder) buildTemporalAggCumulativeOrUnspecified(
 		stepSec,
 	))
 	for _, g := range query.GroupBy {
-		col, err := b.fm.ColumnExpressionFor(ctx, orgID, start, end, &g.TelemetryFieldKey, telemetrytypes.FieldDataTypeString, keys)
+		col, err := b.fm.ColumnExpressionFor(ctx, orgID, start, end, &g.TelemetryFieldKey, keys)
 		if err != nil {
 			return "", nil, err
 		}

pkg/telemetrymetrics/condition_builder.go

@@ -143,15 +143,13 @@ func (c *conditionBuilder) conditionFor(
 	return "", errors.NewInvalidInputf(errors.CodeInvalidInput, "unsupported operator: %v", operator)
 }
 
-// Metrics has no resource sub-query, so options are unused.
-func (c *conditionBuilder) ConditionForKeys(
+func (c *conditionBuilder) ConditionFor(
 	ctx context.Context,
 	orgID valuer.UUID,
 	startNs uint64,
 	endNs uint64,
 	key *telemetrytypes.TelemetryFieldKey,
-	fieldKeys map[string][]*telemetrytypes.TelemetryFieldKey,
-	_ qbtypes.ConditionBuilderOptions,
+	fieldKeysForName []*telemetrytypes.TelemetryFieldKey,
 	operator qbtypes.FilterOperator,
 	value any,
 	sb *sqlbuilder.SelectBuilder,
@@ -162,7 +160,7 @@ func (c *conditionBuilder) ConditionForKeys(
 		return nil, nil, err
 	}
 
-	keys, warning := querybuilder.ResolveKeys(key, querybuilder.MatchingFieldKeys(key, fieldKeys))
+	keys, warning := querybuilder.ResolveKeys(key, fieldKeysForName)
 	var warnings []string
 	if warning != "" {
 		warnings = append(warnings, warning)

pkg/telemetrymetrics/condition_builder_test.go

@@ -235,7 +235,7 @@ func TestConditionFor(t *testing.T) {
 	for _, tc := range testCases {
 		sb := sqlbuilder.NewSelectBuilder()
 		t.Run(tc.name, func(t *testing.T) {
-			cond, _, err := conditionBuilder.ConditionForKeys(ctx, valuer.UUID{}, 0, 0, &tc.key, map[string][]*telemetrytypes.TelemetryFieldKey{tc.key.Name: {&tc.key}}, qbtypes.ConditionBuilderOptions{}, tc.operator, tc.value, sb)
+			cond, _, err := conditionBuilder.ConditionFor(ctx, valuer.UUID{}, 0, 0, &tc.key, []*telemetrytypes.TelemetryFieldKey{&tc.key}, tc.operator, tc.value, sb)
 			sb.Where(cond...)
 
 			if tc.expectedError != nil {
@@ -290,7 +290,7 @@ func TestConditionForMultipleKeys(t *testing.T) {
 		t.Run(tc.name, func(t *testing.T) {
 			var err error
 			for _, key := range tc.keys {
-				cond, _, err := conditionBuilder.ConditionForKeys(ctx, valuer.UUID{}, 0, 0, &key, map[string][]*telemetrytypes.TelemetryFieldKey{key.Name: {&key}}, qbtypes.ConditionBuilderOptions{}, tc.operator, tc.value, sb)
+				cond, _, err := conditionBuilder.ConditionFor(ctx, valuer.UUID{}, 0, 0, &key, []*telemetrytypes.TelemetryFieldKey{&key}, tc.operator, tc.value, sb)
 				sb.Where(cond...)
 				if err != nil {
 					t.Fatalf("Error getting condition for key %s: %v", key.Name, err)

pkg/telemetrymetrics/field_mapper.go

@@ -102,7 +102,6 @@ func (m *fieldMapper) ColumnExpressionFor(
 	orgID valuer.UUID,
 	startNs, endNs uint64,
 	field *telemetrytypes.TelemetryFieldKey,
-	_ telemetrytypes.FieldDataType,
 	keys map[string][]*telemetrytypes.TelemetryFieldKey,
 ) (string, error) {