chore(tests): using webhook channel in list rules test

.github/workflows/integrationci.yaml

@@ -38,7 +38,6 @@ jobs:
       fail-fast: false
       matrix:
         suite:
-          - alerts
           - alertmanager
           - alertmanagerrotation
           - basepath
@@ -64,6 +63,7 @@ jobs:
           - querierauthz
           - role
           - rootuser
+          - ruler
           - savedview
           - semconvfamilies
           - serviceaccount

docs/contributing/go/handler.md

@@ -179,7 +179,6 @@ The `handler.New` function ties the HTTP handler to OpenAPI metadata via `OpenAP
 - **SuccessStatusCode**: The HTTP status for successful responses (for example, `http.StatusOK`, `http.StatusCreated`, `http.StatusNoContent`).
 - **ErrorStatusCodes**: Additional error status codes beyond the standard ones automatically added by `handler.New`.
 - **SecuritySchemes**: Auth mechanisms and scopes required by the operation.
-- **Stability**: Maturity marker (`handler.StabilityDevelopment`, `handler.StabilityAlpha`, `handler.StabilityBeta`, `handler.StabilityStable`, the OpenTelemetry Collector levels) emitted as the `x-signoz-stability` extension on every operation. Unset is emitted as `alpha`.
 
 The generic handler:
 

frontend/src/pages/ApiMonitoring/stories/ApiMonitoringPage.stories.mocks.tsx

@@ -8,7 +8,6 @@ import {
 	QuickfiltertypesSourceDTO,
 	TelemetrytypesFieldContextDTO,
 	TelemetrytypesFieldDataTypeDTO,
-	TelemetrytypesSignalDTO,
 } from 'api/generated/services/sigNoz.schemas';
 import ROUTES from 'constants/routes';
 import { VIEWS } from 'container/ApiMonitoring/Explorer/Domains/DomainDetails/constants';
@@ -25,10 +24,7 @@ import {
 	toggleControl,
 } from '@/storybook/controls/controls';
 import { defineStoryMocks } from '@/storybook/controls/defineStoryMocks';
-import {
-	fieldKeysResponse,
-	fieldValuesResponse,
-} from '@/storybook/msw/__story_mockdata__/fields';
+import { fieldValuesResponse } from '@/storybook/msw/__story_mockdata__/fields';
 import { quickFiltersResponse } from '@/storybook/msw/__story_mockdata__/quickFilters';
 
 import {
@@ -321,21 +317,6 @@ export const apiMonitoringMocks = defineStoryMocks({
 			})),
 		),
 
-		rest.get(
-			'http://localhost/api/v1/fields/keys',
-			response.json((req) =>
-				fieldKeysResponse(
-					groupByAttributeKeys(req.url.searchParams.get('searchText') ?? '').map(
-						({ key }) => key,
-					),
-					{
-						signal: TelemetrytypesSignalDTO.traces,
-						fieldContext: TelemetrytypesFieldContextDTO.attribute,
-					},
-				),
-			),
-		),
-
 		rest.get(
 			'http://localhost/api/v1/fields/values',
 			response.json((req) =>

pkg/apiserver/signozapiserver/alertmanager.go

@@ -145,7 +145,6 @@ func (provider *provider) addAlertmanagerRoutes(router *mux.Router) error {
 			SuccessStatusCode:   http.StatusCreated,
 			ErrorStatusCodes:    []int{http.StatusBadRequest, http.StatusConflict},
 			Deprecated:          false,
-			Stability:           handler.StabilityDevelopment,
 			SecuritySchemes:     newScopedSecuritySchemes([]string{coretypes.ResourceMetaResourceNotificationChannel.Scope(coretypes.VerbCreate)}),
 		},
 		handler.WithResourceDefs(handler.BasicResourceDef{
@@ -174,7 +173,6 @@ func (provider *provider) addAlertmanagerRoutes(router *mux.Router) error {
 			SuccessStatusCode:   http.StatusOK,
 			ErrorStatusCodes:    []int{http.StatusBadRequest},
 			Deprecated:          false,
-			Stability:           handler.StabilityDevelopment,
 			SecuritySchemes:     newScopedSecuritySchemes([]string{coretypes.ResourceMetaResourceNotificationChannel.Scope(coretypes.VerbList)}),
 		},
 		handler.WithResourceDefs(handler.BasicResourceDef{
@@ -201,7 +199,6 @@ func (provider *provider) addAlertmanagerRoutes(router *mux.Router) error {
 			SuccessStatusCode:   http.StatusOK,
 			ErrorStatusCodes:    []int{http.StatusBadRequest, http.StatusNotFound},
 			Deprecated:          false,
-			Stability:           handler.StabilityDevelopment,
 			SecuritySchemes:     newScopedSecuritySchemes([]string{coretypes.ResourceMetaResourceNotificationChannel.Scope(coretypes.VerbRead)}),
 		},
 		handler.WithResourceDefs(handler.BasicResourceDef{
@@ -229,7 +226,6 @@ func (provider *provider) addAlertmanagerRoutes(router *mux.Router) error {
 			SuccessStatusCode:   http.StatusOK,
 			ErrorStatusCodes:    []int{http.StatusBadRequest, http.StatusNotFound},
 			Deprecated:          false,
-			Stability:           handler.StabilityDevelopment,
 			SecuritySchemes:     newScopedSecuritySchemes([]string{coretypes.ResourceMetaResourceNotificationChannel.Scope(coretypes.VerbUpdate)}),
 		},
 		handler.WithResourceDefs(handler.BasicResourceDef{
@@ -257,7 +253,6 @@ func (provider *provider) addAlertmanagerRoutes(router *mux.Router) error {
 			SuccessStatusCode:   http.StatusNoContent,
 			ErrorStatusCodes:    []int{http.StatusBadRequest, http.StatusNotFound},
 			Deprecated:          false,
-			Stability:           handler.StabilityDevelopment,
 			SecuritySchemes:     newScopedSecuritySchemes([]string{coretypes.ResourceMetaResourceNotificationChannel.Scope(coretypes.VerbDelete)}),
 		},
 		handler.WithResourceDefs(handler.BasicResourceDef{
@@ -286,7 +281,6 @@ func (provider *provider) addAlertmanagerRoutes(router *mux.Router) error {
 			SuccessStatusCode:   http.StatusOK,
 			ErrorStatusCodes:    []int{http.StatusBadRequest, http.StatusNotFound},
 			Deprecated:          false,
-			Stability:           handler.StabilityDevelopment,
 			SecuritySchemes:     newScopedSecuritySchemes([]string{coretypes.ResourceMetaResourceNotificationChannel.Scope(coretypes.VerbUpdate)}),
 		},
 		handler.WithResourceDefs(handler.BasicResourceDef{
@@ -314,7 +308,6 @@ func (provider *provider) addAlertmanagerRoutes(router *mux.Router) error {
 			SuccessStatusCode:   http.StatusNoContent,
 			ErrorStatusCodes:    []int{http.StatusBadRequest},
 			Deprecated:          false,
-			Stability:           handler.StabilityDevelopment,
 			SecuritySchemes:     newScopedSecuritySchemes([]string{coretypes.ResourceMetaResourceNotificationChannel.Scope(coretypes.VerbCreate)}),
 		},
 		handler.WithResourceDefs(handler.BasicResourceDef{

pkg/http/handler/handler_test.go

@@ -1,75 +0,0 @@
-package handler
-
-import (
-	"net/http"
-	"testing"
-
-	"github.com/gorilla/mux"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-	"github.com/swaggest/openapi-go"
-	"github.com/swaggest/openapi-go/openapi3"
-)
-
-type bespokeOpenAPIHandler struct{}
-
-func (bespokeOpenAPIHandler) ServeHTTP(http.ResponseWriter, *http.Request) {}
-
-func (bespokeOpenAPIHandler) ServeOpenAPI(opCtx openapi.OperationContext) {
-	opCtx.SetID("Bespoke")
-	opCtx.AddRespStructure(nil, openapi.WithHTTPStatus(http.StatusOK))
-}
-
-func (bespokeOpenAPIHandler) ResourceDefs() []ResourceDef { return nil }
-
-func TestAttachStabilities(t *testing.T) {
-	router := mux.NewRouter()
-	router.Handle("/development", New(func(http.ResponseWriter, *http.Request) {}, OpenAPIDef{ID: "Development", SuccessStatusCode: http.StatusOK, Stability: StabilityDevelopment})).Methods(http.MethodGet)
-	router.Handle("/beta/{id}", New(func(http.ResponseWriter, *http.Request) {}, OpenAPIDef{ID: "Beta", SuccessStatusCode: http.StatusOK, Stability: StabilityBeta})).Methods(http.MethodPut)
-	router.Handle("/unset", New(func(http.ResponseWriter, *http.Request) {}, OpenAPIDef{ID: "Unset", SuccessStatusCode: http.StatusOK})).Methods(http.MethodGet)
-	router.Handle("/bespoke", bespokeOpenAPIHandler{}).Methods(http.MethodGet)
-
-	reflector := openapi3.NewReflector()
-	collector := NewOpenAPICollector(reflector)
-	require.NoError(t, router.Walk(collector.Walker))
-	collector.AttachStabilities(reflector.Spec)
-
-	testCases := []struct {
-		subtestName            string
-		path                   string
-		method                 string
-		expectedExtensionValue any
-	}{
-		{
-			subtestName:            "development handler",
-			path:                   "/development",
-			method:                 "get",
-			expectedExtensionValue: "development",
-		},
-		{
-			subtestName:            "beta handler with path parameter",
-			path:                   "/beta/{id}",
-			method:                 "put",
-			expectedExtensionValue: "beta",
-		},
-		{
-			subtestName:            "unset handler defaults to alpha",
-			path:                   "/unset",
-			method:                 "get",
-			expectedExtensionValue: "alpha",
-		},
-		{
-			subtestName:            "handler built outside New defaults to alpha",
-			path:                   "/bespoke",
-			method:                 "get",
-			expectedExtensionValue: "alpha",
-		},
-	}
-
-	for _, testCase := range testCases {
-		t.Run(testCase.subtestName, func(t *testing.T) {
-			operation := reflector.Spec.Paths.MapOfPathItemValues[testCase.path].MapOfOperationValues[testCase.method]
-			assert.Equal(t, testCase.expectedExtensionValue, operation.MapOfAnything["x-signoz-stability"])
-		})
-	}
-}

pkg/http/handler/openapi.go

@@ -1,37 +1,14 @@
 package handler
 
 import (
-	"net/http"
 	"reflect"
 
-	"github.com/SigNoz/signoz/pkg/valuer"
 	"github.com/gorilla/mux"
 	"github.com/swaggest/jsonschema-go"
 	openapigo "github.com/swaggest/openapi-go"
-	"github.com/swaggest/openapi-go/openapi3"
 	"github.com/swaggest/rest/openapi"
 )
 
-const signozStabilityKey string = "x-signoz-stability"
-
-var (
-	StabilityDevelopment = Stability{valuer.NewString("development")}
-	StabilityAlpha       = Stability{valuer.NewString("alpha")}
-	StabilityBeta        = Stability{valuer.NewString("beta")}
-	StabilityStable      = Stability{valuer.NewString("stable")}
-)
-
-// Stability is emitted as the x-signoz-stability extension on every operation; unset means alpha.
-type Stability struct{ valuer.String }
-
-func (stability Stability) StringValue() string {
-	if stability.IsZero() {
-		return StabilityAlpha.String.StringValue()
-	}
-
-	return stability.String.StringValue()
-}
-
 // OpenAPIExample is a named example for an OpenAPI operation.
 type OpenAPIExample struct {
 	Name        string
@@ -55,7 +32,6 @@ type OpenAPIDef struct {
 	SuccessStatusCode   int
 	ErrorStatusCodes    []int
 	Deprecated          bool
-	Stability           Stability
 	SecuritySchemes     []OpenAPISecurityScheme
 }
 
@@ -66,16 +42,14 @@ type OpenAPISecurityScheme struct {
 
 // OpenAPICollector is a collector for OpenAPI operations.
 type OpenAPICollector struct {
-	collector   *openapi.Collector
-	stabilities map[operationKey]Stability
+	collector *openapi.Collector
 }
 
 func NewOpenAPICollector(reflector openapigo.Reflector) *OpenAPICollector {
 	c := openapi.NewCollector(reflector)
 
 	return &OpenAPICollector{
-		collector:   c,
-		stabilities: make(map[operationKey]Stability),
+		collector: c,
 	}
 }
 
@@ -103,9 +77,6 @@ func (c *OpenAPICollector) Walker(route *mux.Route, _ *mux.Router, _ []*mux.Rout
 			if err := c.collector.CollectOperation(method, path, c.collect(method, path, handler.ServeOpenAPI)); err != nil {
 				return err
 			}
-			if err := c.recordStability(method, path, httpHandler); err != nil {
-				return err
-			}
 		}
 		return nil
 	}
@@ -113,17 +84,6 @@ func (c *OpenAPICollector) Walker(route *mux.Route, _ *mux.Router, _ []*mux.Rout
 	return nil
 }
 
-// AttachStabilities stamps every operation in spec, so handlers built outside New
-// carry the unset stability rather than none.
-func (c *OpenAPICollector) AttachStabilities(spec *openapi3.Spec) {
-	for path, pathItem := range spec.Paths.MapOfPathItemValues {
-		for method, operation := range pathItem.MapOfOperationValues {
-			operation.WithMapOfAnythingItem(signozStabilityKey, c.stabilities[operationKey{method: method, path: path}].StringValue())
-			pathItem.MapOfOperationValues[method] = operation
-		}
-	}
-}
-
 func (c *OpenAPICollector) collect(method string, path string, serveOpenAPIFunc ServeOpenAPIFunc) func(oc openapigo.OperationContext) error {
 	return func(oc openapigo.OperationContext) error {
 		// Serve the OpenAPI documentation for the handler
@@ -157,23 +117,3 @@ func (c *OpenAPICollector) collect(method string, path string, serveOpenAPIFunc
 		return nil
 	}
 }
-
-func (c *OpenAPICollector) recordStability(method string, path string, httpHandler http.Handler) error {
-	generic, ok := httpHandler.(*handler)
-	if !ok {
-		return nil
-	}
-
-	cleanMethod, cleanPath, _, err := openapigo.SanitizeMethodPath(method, path)
-	if err != nil {
-		return err
-	}
-
-	c.stabilities[operationKey{method: cleanMethod, path: cleanPath}] = generic.openAPIDef.Stability
-	return nil
-}
-
-type operationKey struct {
-	method string
-	path   string
-}

pkg/querybuilder/exists_expr.go

@@ -94,10 +94,10 @@ func ExistsExpression(columns []*schema.Column, key *telemetrytypes.TelemetryFie
 
 		switch valueType := column.Type.(schema.MapColumnType).ValueType; valueType.GetType() {
 		case schema.ColumnTypeEnumString, schema.ColumnTypeEnumBool, schema.ColumnTypeEnumFloat64:
-			if key.Materialized {
-				return telemetrytypes.FieldKeyToMaterializedExistsCondition(key, exists), nil
-			}
 			leftOperand := fmt.Sprintf("mapContains(%s, %s)", column.Name, clickhousesql.StringLiteral(key.Name))
+			if key.Materialized {
+				leftOperand = telemetrytypes.FieldKeyToMaterializedColumnNameForExists(key)
+			}
 			if exists {
 				return leftOperand, nil
 			}

pkg/signoz/openapi.go

@@ -174,7 +174,6 @@ func (openapi *OpenAPI) CreateAndWrite(path string) error {
 	}
 
 	attachDiscriminators(openapi.reflector.Spec)
-	openapi.collector.AttachStabilities(openapi.reflector.Spec)
 
 	// The library's MarshalYAML does a JSON round-trip that converts all numbers
 	// to float64, causing large integers (e.g. epoch millisecond timestamps) to

pkg/statementbuilder/aistatementbuilder/statement_builder_test.go

@@ -237,13 +237,13 @@ func TestBuild_FullSQL_TraceList_MaterializedColumns(t *testing.T) {
 	assertSQLEqual(t, `
 WITH matched AS (
     SELECT trace_id,
-        maxIf(timestamp, (attribute_string_gen_ai$$request$$model_exists = true OR mapContains(attributes_string, 'gen_ai.tool.name') OR mapContains(attributes_string, 'gen_ai.agent.name'))) AS last_activity_time
+        maxIf(timestamp, (attribute_string_gen_ai$$request$$model_exists OR mapContains(attributes_string, 'gen_ai.tool.name') OR mapContains(attributes_string, 'gen_ai.agent.name'))) AS last_activity_time
     FROM signoz_traces.distributed_signoz_index_v3
     WHERE timestamp >= '1747947419000000000'
       AND timestamp < '1747983448000000000'
       AND ts_bucket_start >= 1747945619
       AND ts_bucket_start <= 1747983448
-      AND ((attribute_string_gen_ai$$request$$model_exists = true OR mapContains(attributes_string, 'gen_ai.tool.name') OR mapContains(attributes_string, 'gen_ai.agent.name')))
+      AND ((attribute_string_gen_ai$$request$$model_exists OR mapContains(attributes_string, 'gen_ai.tool.name') OR mapContains(attributes_string, 'gen_ai.agent.name')))
     GROUP BY trace_id
     ORDER BY last_activity_time DESC, trace_id DESC
     LIMIT 20
@@ -268,16 +268,16 @@ SELECT trace_id,
     count() AS span_count,
     anyIf(name, parent_span_id = '') AS root_span_name,
     any(multiIf(resource.service.name IS NOT NULL, resource.service.name::String, mapContains(resources_string, 'service.name'), resources_string['service.name'], NULL)) AS service.name,
-    countIf(attribute_string_gen_ai$$request$$model_exists = true) AS llm_call_count,
+    countIf(attribute_string_gen_ai$$request$$model_exists) AS llm_call_count,
     countIf(mapContains(attributes_string, 'gen_ai.tool.name')) AS tool_call_count,
     uniqIf(multiIf(mapContains(attributes_string, 'gen_ai.tool.name'), attributes_string['gen_ai.tool.name'], NULL), mapContains(attributes_string, 'gen_ai.tool.name')) AS distinct_tool_count,
-    sum(multiIf(attribute_number_gen_ai$$usage$$input_tokens_exists = true, toFloat64(attribute_number_gen_ai$$usage$$input_tokens), NULL)) AS input_tokens,
+    sum(multiIf(attribute_number_gen_ai$$usage$$input_tokens_exists, toFloat64(attribute_number_gen_ai$$usage$$input_tokens), NULL)) AS input_tokens,
     sum(multiIf(mapContains(attributes_number, 'gen_ai.usage.output_tokens'), toFloat64(attributes_number['gen_ai.usage.output_tokens']), NULL)) AS output_tokens,
-    coalesce(sum(multiIf(attribute_number_gen_ai$$usage$$input_tokens_exists = true, toFloat64(attribute_number_gen_ai$$usage$$input_tokens), NULL)), 0) + coalesce(sum(multiIf(mapContains(attributes_number, 'gen_ai.usage.output_tokens'), toFloat64(attributes_number['gen_ai.usage.output_tokens']), NULL)), 0) AS total_tokens,
+    coalesce(sum(multiIf(attribute_number_gen_ai$$usage$$input_tokens_exists, toFloat64(attribute_number_gen_ai$$usage$$input_tokens), NULL)), 0) + coalesce(sum(multiIf(mapContains(attributes_number, 'gen_ai.usage.output_tokens'), toFloat64(attributes_number['gen_ai.usage.output_tokens']), NULL)), 0) AS total_tokens,
     sum(multiIf(mapContains(attributes_number, 'signoz.gen_ai.usage.tokens.cost'), toFloat64(attributes_number['signoz.gen_ai.usage.tokens.cost']), NULL)) AS estimated_total_cost,
-    maxIf(duration_nano, attribute_string_gen_ai$$request$$model_exists = true) AS max_llm_duration_nano,
+    maxIf(duration_nano, attribute_string_gen_ai$$request$$model_exists) AS max_llm_duration_nano,
     countIf(has_error = true) AS error_count,
-    maxIf(timestamp, (attribute_string_gen_ai$$request$$model_exists = true OR mapContains(attributes_string, 'gen_ai.tool.name') OR mapContains(attributes_string, 'gen_ai.agent.name'))) AS last_activity_time,
+    maxIf(timestamp, (attribute_string_gen_ai$$request$$model_exists OR mapContains(attributes_string, 'gen_ai.tool.name') OR mapContains(attributes_string, 'gen_ai.agent.name'))) AS last_activity_time,
     argMinIf(multiIf(mapContains(attributes_string, 'gen_ai.input.messages'), attributes_string['gen_ai.input.messages'], NULL), timestamp, mapContains(attributes_string, 'gen_ai.input.messages')) AS input,
     argMaxIf(multiIf(mapContains(attributes_string, 'gen_ai.output.messages'), attributes_string['gen_ai.output.messages'], NULL), timestamp, mapContains(attributes_string, 'gen_ai.output.messages')) AS output
 FROM signoz_traces.distributed_signoz_index_v3

pkg/statementbuilder/auditstatementbuilder/statement_builder_test.go

@@ -92,7 +92,7 @@ func TestStatementBuilder(t *testing.T) {
 				Limit: 100,
 			},
 			expected: qbtypes.Statement{
-				Query: "SELECT timestamp, id, trace_id, span_id, trace_flags, severity_text, severity_number, scope_name, scope_version, body, event_name, attributes_string, attributes_number, attributes_bool, resource, scope_string FROM signoz_audit.distributed_logs WHERE (`attribute_string_signoz$$audit$$principal$$id` = ? AND `attribute_string_signoz$$audit$$principal$$id_exists` = true) AND timestamp >= ? AND ts_bucket_start >= ? AND timestamp < ? AND ts_bucket_start <= ? LIMIT ?",
+				Query: "SELECT timestamp, id, trace_id, span_id, trace_flags, severity_text, severity_number, scope_name, scope_version, body, event_name, attributes_string, attributes_number, attributes_bool, resource, scope_string FROM signoz_audit.distributed_logs WHERE (`attribute_string_signoz$$audit$$principal$$id` = ? AND `attribute_string_signoz$$audit$$principal$$id_exists`) AND timestamp >= ? AND ts_bucket_start >= ? AND timestamp < ? AND ts_bucket_start <= ? LIMIT ?",
 				Args:  []any{"019a-1234-abcd-5678", "1747947419000000000", uint64(1747945619), "1747983448000000000", uint64(1747983448), 100},
 			},
 		},
@@ -109,7 +109,7 @@ func TestStatementBuilder(t *testing.T) {
 				Limit: 100,
 			},
 			expected: qbtypes.Statement{
-				Query: "SELECT timestamp, id, trace_id, span_id, trace_flags, severity_text, severity_number, scope_name, scope_version, body, event_name, attributes_string, attributes_number, attributes_bool, resource, scope_string FROM signoz_audit.distributed_logs WHERE (`attribute_string_signoz$$audit$$outcome` = ? AND `attribute_string_signoz$$audit$$outcome_exists` = true) AND timestamp >= ? AND ts_bucket_start >= ? AND timestamp < ? AND ts_bucket_start <= ? LIMIT ?",
+				Query: "SELECT timestamp, id, trace_id, span_id, trace_flags, severity_text, severity_number, scope_name, scope_version, body, event_name, attributes_string, attributes_number, attributes_bool, resource, scope_string FROM signoz_audit.distributed_logs WHERE (`attribute_string_signoz$$audit$$outcome` = ? AND `attribute_string_signoz$$audit$$outcome_exists`) AND timestamp >= ? AND ts_bucket_start >= ? AND timestamp < ? AND ts_bucket_start <= ? LIMIT ?",
 				Args:  []any{"failure", "1747947419000000000", uint64(1747945619), "1747983448000000000", uint64(1747983448), 100},
 			},
 		},
@@ -143,7 +143,7 @@ func TestStatementBuilder(t *testing.T) {
 				Limit: 100,
 			},
 			expected: qbtypes.Statement{
-				Query: "WITH __resource_filter AS (SELECT fingerprint FROM signoz_audit.distributed_logs_resource WHERE (simpleJSONExtractString(labels, 'signoz.audit.resource.kind') = ? AND labels LIKE ? AND labels LIKE ?) AND seen_at_ts_bucket_start >= ? AND seen_at_ts_bucket_start <= ? GROUP BY fingerprint) SELECT timestamp, id, trace_id, span_id, trace_flags, severity_text, severity_number, scope_name, scope_version, body, event_name, attributes_string, attributes_number, attributes_bool, resource, scope_string FROM signoz_audit.distributed_logs WHERE resource_fingerprint GLOBAL IN (SELECT fingerprint FROM __resource_filter) AND (`attribute_string_signoz$$audit$$action` = ? AND `attribute_string_signoz$$audit$$action_exists` = true) AND timestamp >= ? AND ts_bucket_start >= ? AND timestamp < ? AND ts_bucket_start <= ? LIMIT ?",
+				Query: "WITH __resource_filter AS (SELECT fingerprint FROM signoz_audit.distributed_logs_resource WHERE (simpleJSONExtractString(labels, 'signoz.audit.resource.kind') = ? AND labels LIKE ? AND labels LIKE ?) AND seen_at_ts_bucket_start >= ? AND seen_at_ts_bucket_start <= ? GROUP BY fingerprint) SELECT timestamp, id, trace_id, span_id, trace_flags, severity_text, severity_number, scope_name, scope_version, body, event_name, attributes_string, attributes_number, attributes_bool, resource, scope_string FROM signoz_audit.distributed_logs WHERE resource_fingerprint GLOBAL IN (SELECT fingerprint FROM __resource_filter) AND (`attribute_string_signoz$$audit$$action` = ? AND `attribute_string_signoz$$audit$$action_exists`) AND timestamp >= ? AND ts_bucket_start >= ? AND timestamp < ? AND ts_bucket_start <= ? LIMIT ?",
 				Args:  []any{"dashboard", "%signoz.audit.resource.kind%", "%signoz.audit.resource.kind\":\"dashboard%", uint64(1747945619), uint64(1747983448), "delete", "1747947419000000000", uint64(1747945619), "1747983448000000000", uint64(1747983448), 100},
 			},
 		},
@@ -160,7 +160,7 @@ func TestStatementBuilder(t *testing.T) {
 				Limit: 100,
 			},
 			expected: qbtypes.Statement{
-				Query: "SELECT timestamp, id, trace_id, span_id, trace_flags, severity_text, severity_number, scope_name, scope_version, body, event_name, attributes_string, attributes_number, attributes_bool, resource, scope_string FROM signoz_audit.distributed_logs WHERE (`attribute_string_signoz$$audit$$principal$$type` = ? AND `attribute_string_signoz$$audit$$principal$$type_exists` = true) AND timestamp >= ? AND ts_bucket_start >= ? AND timestamp < ? AND ts_bucket_start <= ? LIMIT ?",
+				Query: "SELECT timestamp, id, trace_id, span_id, trace_flags, severity_text, severity_number, scope_name, scope_version, body, event_name, attributes_string, attributes_number, attributes_bool, resource, scope_string FROM signoz_audit.distributed_logs WHERE (`attribute_string_signoz$$audit$$principal$$type` = ? AND `attribute_string_signoz$$audit$$principal$$type_exists`) AND timestamp >= ? AND ts_bucket_start >= ? AND timestamp < ? AND ts_bucket_start <= ? LIMIT ?",
 				Args:  []any{"service_account", "1747947419000000000", uint64(1747945619), "1747983448000000000", uint64(1747983448), 100},
 			},
 		},
@@ -180,7 +180,7 @@ func TestStatementBuilder(t *testing.T) {
 				},
 			},
 			expected: qbtypes.Statement{
-				Query: "SELECT count() AS __result_0 FROM signoz_audit.distributed_logs WHERE ((`attribute_string_signoz$$audit$$outcome` = ? AND `attribute_string_signoz$$audit$$outcome_exists` = true) AND (`attribute_string_signoz$$audit$$action` = ? AND `attribute_string_signoz$$audit$$action_exists` = true)) AND timestamp >= ? AND ts_bucket_start >= ? AND timestamp < ? AND ts_bucket_start <= ? ORDER BY __result_0 DESC",
+				Query: "SELECT count() AS __result_0 FROM signoz_audit.distributed_logs WHERE ((`attribute_string_signoz$$audit$$outcome` = ? AND `attribute_string_signoz$$audit$$outcome_exists`) AND (`attribute_string_signoz$$audit$$action` = ? AND `attribute_string_signoz$$audit$$action_exists`)) AND timestamp >= ? AND ts_bucket_start >= ? AND timestamp < ? AND ts_bucket_start <= ? ORDER BY __result_0 DESC",
 				Args:  []any{"failure", "update", "1747947419000000000", uint64(1747945619), "1747983448000000000", uint64(1747983448)},
 			},
 		},
@@ -204,7 +204,7 @@ func TestStatementBuilder(t *testing.T) {
 				Limit: 5,
 			},
 			expected: qbtypes.Statement{
-				Query: "WITH __limit_cte AS (SELECT toString(multiIf(`attribute_string_signoz$$audit$$principal$$email_exists` = true, `attribute_string_signoz$$audit$$principal$$email`, NULL)) AS `signoz.audit.principal.email`, count() AS __result_0 FROM signoz_audit.distributed_logs WHERE (`attribute_string_signoz$$audit$$outcome` = ? AND `attribute_string_signoz$$audit$$outcome_exists` = true) AND timestamp >= ? AND ts_bucket_start >= ? AND timestamp < ? AND ts_bucket_start <= ? GROUP BY `signoz.audit.principal.email` ORDER BY __result_0 DESC LIMIT ?) SELECT toStartOfInterval(fromUnixTimestamp64Nano(timestamp), INTERVAL 60 SECOND) AS ts, toString(multiIf(`attribute_string_signoz$$audit$$principal$$email_exists` = true, `attribute_string_signoz$$audit$$principal$$email`, NULL)) AS `signoz.audit.principal.email`, count() AS __result_0 FROM signoz_audit.distributed_logs WHERE (`attribute_string_signoz$$audit$$outcome` = ? AND `attribute_string_signoz$$audit$$outcome_exists` = true) AND timestamp >= ? AND ts_bucket_start >= ? AND timestamp < ? AND ts_bucket_start <= ? AND (`signoz.audit.principal.email`) GLOBAL IN (SELECT `signoz.audit.principal.email` FROM __limit_cte) GROUP BY ts, `signoz.audit.principal.email`",
+				Query: "WITH __limit_cte AS (SELECT toString(multiIf(`attribute_string_signoz$$audit$$principal$$email_exists`, `attribute_string_signoz$$audit$$principal$$email`, NULL)) AS `signoz.audit.principal.email`, count() AS __result_0 FROM signoz_audit.distributed_logs WHERE (`attribute_string_signoz$$audit$$outcome` = ? AND `attribute_string_signoz$$audit$$outcome_exists`) AND timestamp >= ? AND ts_bucket_start >= ? AND timestamp < ? AND ts_bucket_start <= ? GROUP BY `signoz.audit.principal.email` ORDER BY __result_0 DESC LIMIT ?) SELECT toStartOfInterval(fromUnixTimestamp64Nano(timestamp), INTERVAL 60 SECOND) AS ts, toString(multiIf(`attribute_string_signoz$$audit$$principal$$email_exists`, `attribute_string_signoz$$audit$$principal$$email`, NULL)) AS `signoz.audit.principal.email`, count() AS __result_0 FROM signoz_audit.distributed_logs WHERE (`attribute_string_signoz$$audit$$outcome` = ? AND `attribute_string_signoz$$audit$$outcome_exists`) AND timestamp >= ? AND ts_bucket_start >= ? AND timestamp < ? AND ts_bucket_start <= ? AND (`signoz.audit.principal.email`) GLOBAL IN (SELECT `signoz.audit.principal.email` FROM __limit_cte) GROUP BY ts, `signoz.audit.principal.email`",
 				Args:  []any{"failure", "1747947419000000000", uint64(1747945619), "1747983448000000000", uint64(1747983448), 5, "failure", "1747947419000000000", uint64(1747945619), "1747983448000000000", uint64(1747983448)},
 			},
 		},

pkg/statementbuilder/logsstatementbuilder/stmt_builder_test.go

@@ -180,7 +180,7 @@ func TestStatementBuilderTimeSeries(t *testing.T) {
 				},
 			},
 			expected: qbtypes.Statement{
-				Query: "WITH __resource_filter AS (SELECT fingerprint FROM signoz_logs.distributed_logs_v2_resource WHERE (simpleJSONExtractString(labels, 'service.name') = ? AND labels LIKE ? AND labels LIKE ?) AND seen_at_ts_bucket_start >= ? AND seen_at_ts_bucket_start <= ? GROUP BY fingerprint), __limit_cte AS (SELECT toString(multiIf(`attribute_string_materialized$$key$$name_exists` = true, `attribute_string_materialized$$key$$name`, NULL)) AS `__GROUP_BY_KEY_0_materialized.key.name`, count() AS __result_0 FROM signoz_logs.distributed_logs_v2 WHERE resource_fingerprint GLOBAL IN (SELECT fingerprint FROM __resource_filter) AND timestamp >= ? AND ts_bucket_start >= ? AND timestamp < ? AND ts_bucket_start <= ? GROUP BY `__GROUP_BY_KEY_0_materialized.key.name` ORDER BY __result_0 DESC LIMIT ?) SELECT toStartOfInterval(fromUnixTimestamp64Nano(timestamp), INTERVAL 30 SECOND) AS ts, toString(multiIf(`attribute_string_materialized$$key$$name_exists` = true, `attribute_string_materialized$$key$$name`, NULL)) AS `__GROUP_BY_KEY_0_materialized.key.name`, count() AS __result_0 FROM signoz_logs.distributed_logs_v2 WHERE resource_fingerprint GLOBAL IN (SELECT fingerprint FROM __resource_filter) AND timestamp >= ? AND ts_bucket_start >= ? AND timestamp < ? AND ts_bucket_start <= ? AND (`__GROUP_BY_KEY_0_materialized.key.name`) GLOBAL IN (SELECT `__GROUP_BY_KEY_0_materialized.key.name` FROM __limit_cte) GROUP BY ts, `__GROUP_BY_KEY_0_materialized.key.name`",
+				Query: "WITH __resource_filter AS (SELECT fingerprint FROM signoz_logs.distributed_logs_v2_resource WHERE (simpleJSONExtractString(labels, 'service.name') = ? AND labels LIKE ? AND labels LIKE ?) AND seen_at_ts_bucket_start >= ? AND seen_at_ts_bucket_start <= ? GROUP BY fingerprint), __limit_cte AS (SELECT toString(multiIf(`attribute_string_materialized$$key$$name_exists`, `attribute_string_materialized$$key$$name`, NULL)) AS `__GROUP_BY_KEY_0_materialized.key.name`, count() AS __result_0 FROM signoz_logs.distributed_logs_v2 WHERE resource_fingerprint GLOBAL IN (SELECT fingerprint FROM __resource_filter) AND timestamp >= ? AND ts_bucket_start >= ? AND timestamp < ? AND ts_bucket_start <= ? GROUP BY `__GROUP_BY_KEY_0_materialized.key.name` ORDER BY __result_0 DESC LIMIT ?) SELECT toStartOfInterval(fromUnixTimestamp64Nano(timestamp), INTERVAL 30 SECOND) AS ts, toString(multiIf(`attribute_string_materialized$$key$$name_exists`, `attribute_string_materialized$$key$$name`, NULL)) AS `__GROUP_BY_KEY_0_materialized.key.name`, count() AS __result_0 FROM signoz_logs.distributed_logs_v2 WHERE resource_fingerprint GLOBAL IN (SELECT fingerprint FROM __resource_filter) AND timestamp >= ? AND ts_bucket_start >= ? AND timestamp < ? AND ts_bucket_start <= ? AND (`__GROUP_BY_KEY_0_materialized.key.name`) GLOBAL IN (SELECT `__GROUP_BY_KEY_0_materialized.key.name` FROM __limit_cte) GROUP BY ts, `__GROUP_BY_KEY_0_materialized.key.name`",
 				Args:  []any{"cartservice", "%service.name%", "%service.name\":\"cartservice%", uint64(1705397400), uint64(1705485600), "1705399200000000000", uint64(1705397400), "1705485600000000000", uint64(1705485600), 10, "1705399200000000000", uint64(1705397400), "1705485600000000000", uint64(1705485600)},
 			},
 		},
@@ -203,7 +203,7 @@ func TestStatementBuilderTimeSeries(t *testing.T) {
 				Limit: 10,
 			},
 			expected: qbtypes.Statement{
-				Query: "SELECT toStartOfInterval(fromUnixTimestamp64Nano(timestamp), INTERVAL 30 SECOND) AS ts, count() AS __result_0 FROM signoz_logs.distributed_logs_v2 WHERE ((match(`attribute_string_materialized$$key$$name`, ?) AND `attribute_string_materialized$$key$$name_exists` = true) OR (`attribute_string_materialized$$key$$name` = ? AND `attribute_string_materialized$$key$$name_exists` = true)) AND timestamp >= ? AND ts_bucket_start >= ? AND timestamp < ? AND ts_bucket_start <= ? GROUP BY ts",
+				Query: "SELECT toStartOfInterval(fromUnixTimestamp64Nano(timestamp), INTERVAL 30 SECOND) AS ts, count() AS __result_0 FROM signoz_logs.distributed_logs_v2 WHERE ((match(`attribute_string_materialized$$key$$name`, ?) AND `attribute_string_materialized$$key$$name_exists`) OR (`attribute_string_materialized$$key$$name` = ? AND `attribute_string_materialized$$key$$name_exists`)) AND timestamp >= ? AND ts_bucket_start >= ? AND timestamp < ? AND ts_bucket_start <= ? GROUP BY ts",
 				Args:  []any{"redis.*", "memcached", "1705399200000000000", uint64(1705397400), "1705485600000000000", uint64(1705485600)},
 			},
 			expectedErr: nil,
@@ -300,7 +300,7 @@ func TestStatementBuilderListQuery(t *testing.T) {
 				},
 			},
 			expected: qbtypes.Statement{
-				Query: "WITH __resource_filter AS (SELECT fingerprint FROM signoz_logs.distributed_logs_v2_resource WHERE (simpleJSONExtractString(labels, 'service.name') = ? AND labels LIKE ? AND labels LIKE ?) AND seen_at_ts_bucket_start >= ? AND seen_at_ts_bucket_start <= ? GROUP BY fingerprint) SELECT timestamp, id, trace_id, span_id, trace_flags, severity_text, severity_number, scope_name, scope_version, body, attributes_string, attributes_number, attributes_bool, resources_string, scope_string FROM signoz_logs.distributed_logs_v2 WHERE resource_fingerprint GLOBAL IN (SELECT fingerprint FROM __resource_filter) AND timestamp >= ? AND ts_bucket_start >= ? AND timestamp < ? AND ts_bucket_start <= ? ORDER BY multiIf(`attribute_string_materialized$$key$$name_exists` = true, `attribute_string_materialized$$key$$name`, NULL) desc LIMIT ?",
+				Query: "WITH __resource_filter AS (SELECT fingerprint FROM signoz_logs.distributed_logs_v2_resource WHERE (simpleJSONExtractString(labels, 'service.name') = ? AND labels LIKE ? AND labels LIKE ?) AND seen_at_ts_bucket_start >= ? AND seen_at_ts_bucket_start <= ? GROUP BY fingerprint) SELECT timestamp, id, trace_id, span_id, trace_flags, severity_text, severity_number, scope_name, scope_version, body, attributes_string, attributes_number, attributes_bool, resources_string, scope_string FROM signoz_logs.distributed_logs_v2 WHERE resource_fingerprint GLOBAL IN (SELECT fingerprint FROM __resource_filter) AND timestamp >= ? AND ts_bucket_start >= ? AND timestamp < ? AND ts_bucket_start <= ? ORDER BY multiIf(`attribute_string_materialized$$key$$name_exists`, `attribute_string_materialized$$key$$name`, NULL) desc LIMIT ?",
 				Args:  []any{"cartservice", "%service.name%", "%service.name\":\"cartservice%", uint64(1747945619), uint64(1747983448), "1747947419000000000", uint64(1747945619), "1747983448000000000", uint64(1747983448), 10},
 			},
 			expectedErr: nil,
@@ -328,7 +328,7 @@ func TestStatementBuilderListQuery(t *testing.T) {
 				},
 			},
 			expected: qbtypes.Statement{
-				Query: "SELECT timestamp, id, trace_id, span_id, trace_flags, severity_text, severity_number, scope_name, scope_version, body, attributes_string, attributes_number, attributes_bool, resources_string, scope_string FROM signoz_logs.distributed_logs_v2 WHERE ((match(`attribute_string_materialized$$key$$name`, ?) AND `attribute_string_materialized$$key$$name_exists` = true) OR (`attribute_string_materialized$$key$$name` = ? AND `attribute_string_materialized$$key$$name_exists` = true)) AND timestamp >= ? AND ts_bucket_start >= ? AND timestamp < ? AND ts_bucket_start <= ? ORDER BY multiIf(`attribute_string_materialized$$key$$name_exists` = true, `attribute_string_materialized$$key$$name`, NULL) desc LIMIT ?",
+				Query: "SELECT timestamp, id, trace_id, span_id, trace_flags, severity_text, severity_number, scope_name, scope_version, body, attributes_string, attributes_number, attributes_bool, resources_string, scope_string FROM signoz_logs.distributed_logs_v2 WHERE ((match(`attribute_string_materialized$$key$$name`, ?) AND `attribute_string_materialized$$key$$name_exists`) OR (`attribute_string_materialized$$key$$name` = ? AND `attribute_string_materialized$$key$$name_exists`)) AND timestamp >= ? AND ts_bucket_start >= ? AND timestamp < ? AND ts_bucket_start <= ? ORDER BY multiIf(`attribute_string_materialized$$key$$name_exists`, `attribute_string_materialized$$key$$name`, NULL) desc LIMIT ?",
 				Args:  []any{"redis.*", "memcached", "1747947419000000000", uint64(1747945619), "1747983448000000000", uint64(1747983448), 10},
 			},
 			expectedErr: nil,
@@ -442,7 +442,7 @@ func TestStatementBuilderListQueryResourceTests(t *testing.T) {
 				},
 			},
 			expected: qbtypes.Statement{
-				Query: "WITH __resource_filter AS (SELECT fingerprint FROM signoz_logs.distributed_logs_v2_resource WHERE (simpleJSONExtractString(labels, 'service.name') = ? AND labels LIKE ? AND labels LIKE ?) AND seen_at_ts_bucket_start >= ? AND seen_at_ts_bucket_start <= ? GROUP BY fingerprint) SELECT timestamp, id, trace_id, span_id, trace_flags, severity_text, severity_number, scope_name, scope_version, body, attributes_string, attributes_number, attributes_bool, resources_string, scope_string FROM signoz_logs.distributed_logs_v2 WHERE resource_fingerprint GLOBAL IN (SELECT fingerprint FROM __resource_filter) AND match(LOWER(body), LOWER(?)) AND timestamp >= ? AND ts_bucket_start >= ? AND timestamp < ? AND ts_bucket_start <= ? ORDER BY multiIf(`attribute_string_materialized$$key$$name_exists` = true, `attribute_string_materialized$$key$$name`, NULL) desc LIMIT ?",
+				Query: "WITH __resource_filter AS (SELECT fingerprint FROM signoz_logs.distributed_logs_v2_resource WHERE (simpleJSONExtractString(labels, 'service.name') = ? AND labels LIKE ? AND labels LIKE ?) AND seen_at_ts_bucket_start >= ? AND seen_at_ts_bucket_start <= ? GROUP BY fingerprint) SELECT timestamp, id, trace_id, span_id, trace_flags, severity_text, severity_number, scope_name, scope_version, body, attributes_string, attributes_number, attributes_bool, resources_string, scope_string FROM signoz_logs.distributed_logs_v2 WHERE resource_fingerprint GLOBAL IN (SELECT fingerprint FROM __resource_filter) AND match(LOWER(body), LOWER(?)) AND timestamp >= ? AND ts_bucket_start >= ? AND timestamp < ? AND ts_bucket_start <= ? ORDER BY multiIf(`attribute_string_materialized$$key$$name_exists`, `attribute_string_materialized$$key$$name`, NULL) desc LIMIT ?",
 				Args:  []any{"cartservice", "%service.name%", "%service.name\":\"cartservice%", uint64(1747945619), uint64(1747983448), "hello", "1747947419000000000", uint64(1747945619), "1747983448000000000", uint64(1747983448), 10},
 			},
 			expectedErr: nil,
@@ -666,7 +666,7 @@ func TestStatementBuilderListQueryServiceCollision(t *testing.T) {
 				},
 			},
 			expected: qbtypes.Statement{
-				Query: "WITH __resource_filter AS (SELECT fingerprint FROM signoz_logs.distributed_logs_v2_resource WHERE (simpleJSONExtractString(labels, 'service.name') = ? AND labels LIKE ? AND labels LIKE ?) AND seen_at_ts_bucket_start >= ? AND seen_at_ts_bucket_start <= ? GROUP BY fingerprint) SELECT timestamp, id, trace_id, span_id, trace_flags, severity_text, severity_number, scope_name, scope_version, body, attributes_string, attributes_number, attributes_bool, resources_string, scope_string FROM signoz_logs.distributed_logs_v2 WHERE resource_fingerprint GLOBAL IN (SELECT fingerprint FROM __resource_filter) AND LOWER(body) LIKE LOWER(?) AND timestamp >= ? AND ts_bucket_start >= ? AND timestamp < ? AND ts_bucket_start <= ? ORDER BY multiIf(`attribute_string_materialized$$key$$name_exists` = true, `attribute_string_materialized$$key$$name`, NULL) desc LIMIT ?",
+				Query: "WITH __resource_filter AS (SELECT fingerprint FROM signoz_logs.distributed_logs_v2_resource WHERE (simpleJSONExtractString(labels, 'service.name') = ? AND labels LIKE ? AND labels LIKE ?) AND seen_at_ts_bucket_start >= ? AND seen_at_ts_bucket_start <= ? GROUP BY fingerprint) SELECT timestamp, id, trace_id, span_id, trace_flags, severity_text, severity_number, scope_name, scope_version, body, attributes_string, attributes_number, attributes_bool, resources_string, scope_string FROM signoz_logs.distributed_logs_v2 WHERE resource_fingerprint GLOBAL IN (SELECT fingerprint FROM __resource_filter) AND LOWER(body) LIKE LOWER(?) AND timestamp >= ? AND ts_bucket_start >= ? AND timestamp < ? AND ts_bucket_start <= ? ORDER BY multiIf(`attribute_string_materialized$$key$$name_exists`, `attribute_string_materialized$$key$$name`, NULL) desc LIMIT ?",
 				Args:  []any{"cartservice", "%service.name%", "%service.name\":\"cartservice%", uint64(1747945619), uint64(1747983448), "%error%", "1747947419000000000", uint64(1747945619), "1747983448000000000", uint64(1747983448), 10},
 			},
 			expectedErr: nil,

pkg/statementbuilder/tracesstatementbuilder/stmt_builder_test.go

@@ -129,7 +129,7 @@ func TestStatementBuilder(t *testing.T) {
 				},
 			},
 			expected: qbtypes.Statement{
-				Query: "WITH __limit_cte AS (SELECT toString(multiIf(resource.`service.name` IS NOT NULL, resource.`service.name`::String, mapContains(resources_string, 'service.name'), resources_string['service.name'], NULL)) AS `__GROUP_BY_KEY_0_service.name`, count() AS __result_0 FROM signoz_traces.distributed_signoz_index_v3 WHERE ((match(`attribute_string_materialized$$key$$name`, ?) AND `attribute_string_materialized$$key$$name_exists` = true) OR multiIf(resource.`service.name` IS NOT NULL, resource.`service.name`::String, mapContains(resources_string, 'service.name'), resources_string['service.name'], NULL) = ?) AND timestamp >= ? AND timestamp < ? AND ts_bucket_start >= ? AND ts_bucket_start <= ? GROUP BY `__GROUP_BY_KEY_0_service.name` ORDER BY __result_0 DESC LIMIT ?) SELECT toStartOfInterval(timestamp, INTERVAL 30 SECOND) AS ts, toString(multiIf(resource.`service.name` IS NOT NULL, resource.`service.name`::String, mapContains(resources_string, 'service.name'), resources_string['service.name'], NULL)) AS `__GROUP_BY_KEY_0_service.name`, count() AS __result_0 FROM signoz_traces.distributed_signoz_index_v3 WHERE ((match(`attribute_string_materialized$$key$$name`, ?) AND `attribute_string_materialized$$key$$name_exists` = true) OR multiIf(resource.`service.name` IS NOT NULL, resource.`service.name`::String, mapContains(resources_string, 'service.name'), resources_string['service.name'], NULL) = ?) AND timestamp >= ? AND timestamp < ? AND ts_bucket_start >= ? AND ts_bucket_start <= ? AND (`__GROUP_BY_KEY_0_service.name`) GLOBAL IN (SELECT `__GROUP_BY_KEY_0_service.name` FROM __limit_cte) GROUP BY ts, `__GROUP_BY_KEY_0_service.name`",
+				Query: "WITH __limit_cte AS (SELECT toString(multiIf(resource.`service.name` IS NOT NULL, resource.`service.name`::String, mapContains(resources_string, 'service.name'), resources_string['service.name'], NULL)) AS `__GROUP_BY_KEY_0_service.name`, count() AS __result_0 FROM signoz_traces.distributed_signoz_index_v3 WHERE ((match(`attribute_string_materialized$$key$$name`, ?) AND `attribute_string_materialized$$key$$name_exists`) OR multiIf(resource.`service.name` IS NOT NULL, resource.`service.name`::String, mapContains(resources_string, 'service.name'), resources_string['service.name'], NULL) = ?) AND timestamp >= ? AND timestamp < ? AND ts_bucket_start >= ? AND ts_bucket_start <= ? GROUP BY `__GROUP_BY_KEY_0_service.name` ORDER BY __result_0 DESC LIMIT ?) SELECT toStartOfInterval(timestamp, INTERVAL 30 SECOND) AS ts, toString(multiIf(resource.`service.name` IS NOT NULL, resource.`service.name`::String, mapContains(resources_string, 'service.name'), resources_string['service.name'], NULL)) AS `__GROUP_BY_KEY_0_service.name`, count() AS __result_0 FROM signoz_traces.distributed_signoz_index_v3 WHERE ((match(`attribute_string_materialized$$key$$name`, ?) AND `attribute_string_materialized$$key$$name_exists`) OR multiIf(resource.`service.name` IS NOT NULL, resource.`service.name`::String, mapContains(resources_string, 'service.name'), resources_string['service.name'], NULL) = ?) AND timestamp >= ? AND timestamp < ? AND ts_bucket_start >= ? AND ts_bucket_start <= ? AND (`__GROUP_BY_KEY_0_service.name`) GLOBAL IN (SELECT `__GROUP_BY_KEY_0_service.name` FROM __limit_cte) GROUP BY ts, `__GROUP_BY_KEY_0_service.name`",
 				Args:  []any{"redis-manual", "redis-manual", "1747947419000000000", "1747983448000000000", uint64(1747945619), uint64(1747983448), 10, "redis-manual", "redis-manual", "1747947419000000000", "1747983448000000000", uint64(1747945619), uint64(1747983448)},
 			},
 			expectedErr: nil,
@@ -268,7 +268,7 @@ func TestStatementBuilder(t *testing.T) {
 				},
 			},
 			expected: qbtypes.Statement{
-				Query: "WITH __resource_filter AS (SELECT fingerprint FROM signoz_traces.distributed_traces_v3_resource WHERE (simpleJSONExtractString(labels, 'service.name') = ? AND labels LIKE ? AND labels LIKE ?) AND seen_at_ts_bucket_start >= ? AND seen_at_ts_bucket_start <= ? GROUP BY fingerprint), __limit_cte AS (SELECT toString(multiIf(resource.`service.name` IS NOT NULL, resource.`service.name`::String, mapContains(resources_string, 'service.name'), resources_string['service.name'], NULL)) AS `__GROUP_BY_KEY_0_service.name`, sum(multiIf(`attribute_number_cart$$items_count_exists` = true, toFloat64(`attribute_number_cart$$items_count`), NULL)) AS __result_0 FROM signoz_traces.distributed_signoz_index_v3 WHERE resource_fingerprint GLOBAL IN (SELECT fingerprint FROM __resource_filter) AND timestamp >= ? AND timestamp < ? AND ts_bucket_start >= ? AND ts_bucket_start <= ? GROUP BY `__GROUP_BY_KEY_0_service.name` ORDER BY __result_0 DESC LIMIT ?) SELECT toStartOfInterval(timestamp, INTERVAL 30 SECOND) AS ts, toString(multiIf(resource.`service.name` IS NOT NULL, resource.`service.name`::String, mapContains(resources_string, 'service.name'), resources_string['service.name'], NULL)) AS `__GROUP_BY_KEY_0_service.name`, sum(multiIf(`attribute_number_cart$$items_count_exists` = true, toFloat64(`attribute_number_cart$$items_count`), NULL)) AS __result_0 FROM signoz_traces.distributed_signoz_index_v3 WHERE resource_fingerprint GLOBAL IN (SELECT fingerprint FROM __resource_filter) AND timestamp >= ? AND timestamp < ? AND ts_bucket_start >= ? AND ts_bucket_start <= ? AND (`__GROUP_BY_KEY_0_service.name`) GLOBAL IN (SELECT `__GROUP_BY_KEY_0_service.name` FROM __limit_cte) GROUP BY ts, `__GROUP_BY_KEY_0_service.name`",
+				Query: "WITH __resource_filter AS (SELECT fingerprint FROM signoz_traces.distributed_traces_v3_resource WHERE (simpleJSONExtractString(labels, 'service.name') = ? AND labels LIKE ? AND labels LIKE ?) AND seen_at_ts_bucket_start >= ? AND seen_at_ts_bucket_start <= ? GROUP BY fingerprint), __limit_cte AS (SELECT toString(multiIf(resource.`service.name` IS NOT NULL, resource.`service.name`::String, mapContains(resources_string, 'service.name'), resources_string['service.name'], NULL)) AS `__GROUP_BY_KEY_0_service.name`, sum(multiIf(`attribute_number_cart$$items_count_exists`, toFloat64(`attribute_number_cart$$items_count`), NULL)) AS __result_0 FROM signoz_traces.distributed_signoz_index_v3 WHERE resource_fingerprint GLOBAL IN (SELECT fingerprint FROM __resource_filter) AND timestamp >= ? AND timestamp < ? AND ts_bucket_start >= ? AND ts_bucket_start <= ? GROUP BY `__GROUP_BY_KEY_0_service.name` ORDER BY __result_0 DESC LIMIT ?) SELECT toStartOfInterval(timestamp, INTERVAL 30 SECOND) AS ts, toString(multiIf(resource.`service.name` IS NOT NULL, resource.`service.name`::String, mapContains(resources_string, 'service.name'), resources_string['service.name'], NULL)) AS `__GROUP_BY_KEY_0_service.name`, sum(multiIf(`attribute_number_cart$$items_count_exists`, toFloat64(`attribute_number_cart$$items_count`), NULL)) AS __result_0 FROM signoz_traces.distributed_signoz_index_v3 WHERE resource_fingerprint GLOBAL IN (SELECT fingerprint FROM __resource_filter) AND timestamp >= ? AND timestamp < ? AND ts_bucket_start >= ? AND ts_bucket_start <= ? AND (`__GROUP_BY_KEY_0_service.name`) GLOBAL IN (SELECT `__GROUP_BY_KEY_0_service.name` FROM __limit_cte) GROUP BY ts, `__GROUP_BY_KEY_0_service.name`",
 				Args:  []any{"redis-manual", "%service.name%", "%service.name\":\"redis-manual%", uint64(1747945619), uint64(1747983448), "1747947419000000000", "1747983448000000000", uint64(1747945619), uint64(1747983448), 10, "1747947419000000000", "1747983448000000000", uint64(1747945619), uint64(1747983448)},
 			},
 			expectedErr: nil,
@@ -307,7 +307,7 @@ func TestStatementBuilder(t *testing.T) {
 				},
 			},
 			expected: qbtypes.Statement{
-				Query: "WITH __resource_filter AS (SELECT fingerprint FROM signoz_traces.distributed_traces_v3_resource WHERE (simpleJSONExtractString(labels, 'service.name') = ? AND labels LIKE ? AND labels LIKE ?) AND seen_at_ts_bucket_start >= ? AND seen_at_ts_bucket_start <= ? GROUP BY fingerprint), __limit_cte AS (SELECT toString(multiIf(resource.`service.name` IS NOT NULL, resource.`service.name`::String, mapContains(resources_string, 'service.name'), resources_string['service.name'], NULL)) AS `__GROUP_BY_KEY_0_service.name`, sum(multiIf(`attribute_number_cart$$items_count_exists` = true, toFloat64(`attribute_number_cart$$items_count`), NULL)) AS __result_0 FROM signoz_traces.distributed_signoz_index_v3 WHERE resource_fingerprint GLOBAL IN (SELECT fingerprint FROM __resource_filter) AND timestamp >= ? AND timestamp < ? AND ts_bucket_start >= ? AND ts_bucket_start <= ? GROUP BY `__GROUP_BY_KEY_0_service.name` ORDER BY `__GROUP_BY_KEY_0_service.name` desc LIMIT ?) SELECT toStartOfInterval(timestamp, INTERVAL 30 SECOND) AS ts, toString(multiIf(resource.`service.name` IS NOT NULL, resource.`service.name`::String, mapContains(resources_string, 'service.name'), resources_string['service.name'], NULL)) AS `__GROUP_BY_KEY_0_service.name`, sum(multiIf(`attribute_number_cart$$items_count_exists` = true, toFloat64(`attribute_number_cart$$items_count`), NULL)) AS __result_0 FROM signoz_traces.distributed_signoz_index_v3 WHERE resource_fingerprint GLOBAL IN (SELECT fingerprint FROM __resource_filter) AND timestamp >= ? AND timestamp < ? AND ts_bucket_start >= ? AND ts_bucket_start <= ? AND (`__GROUP_BY_KEY_0_service.name`) GLOBAL IN (SELECT `__GROUP_BY_KEY_0_service.name` FROM __limit_cte) GROUP BY ts, `__GROUP_BY_KEY_0_service.name` ORDER BY `__GROUP_BY_KEY_0_service.name` desc, ts desc",
+				Query: "WITH __resource_filter AS (SELECT fingerprint FROM signoz_traces.distributed_traces_v3_resource WHERE (simpleJSONExtractString(labels, 'service.name') = ? AND labels LIKE ? AND labels LIKE ?) AND seen_at_ts_bucket_start >= ? AND seen_at_ts_bucket_start <= ? GROUP BY fingerprint), __limit_cte AS (SELECT toString(multiIf(resource.`service.name` IS NOT NULL, resource.`service.name`::String, mapContains(resources_string, 'service.name'), resources_string['service.name'], NULL)) AS `__GROUP_BY_KEY_0_service.name`, sum(multiIf(`attribute_number_cart$$items_count_exists`, toFloat64(`attribute_number_cart$$items_count`), NULL)) AS __result_0 FROM signoz_traces.distributed_signoz_index_v3 WHERE resource_fingerprint GLOBAL IN (SELECT fingerprint FROM __resource_filter) AND timestamp >= ? AND timestamp < ? AND ts_bucket_start >= ? AND ts_bucket_start <= ? GROUP BY `__GROUP_BY_KEY_0_service.name` ORDER BY `__GROUP_BY_KEY_0_service.name` desc LIMIT ?) SELECT toStartOfInterval(timestamp, INTERVAL 30 SECOND) AS ts, toString(multiIf(resource.`service.name` IS NOT NULL, resource.`service.name`::String, mapContains(resources_string, 'service.name'), resources_string['service.name'], NULL)) AS `__GROUP_BY_KEY_0_service.name`, sum(multiIf(`attribute_number_cart$$items_count_exists`, toFloat64(`attribute_number_cart$$items_count`), NULL)) AS __result_0 FROM signoz_traces.distributed_signoz_index_v3 WHERE resource_fingerprint GLOBAL IN (SELECT fingerprint FROM __resource_filter) AND timestamp >= ? AND timestamp < ? AND ts_bucket_start >= ? AND ts_bucket_start <= ? AND (`__GROUP_BY_KEY_0_service.name`) GLOBAL IN (SELECT `__GROUP_BY_KEY_0_service.name` FROM __limit_cte) GROUP BY ts, `__GROUP_BY_KEY_0_service.name` ORDER BY `__GROUP_BY_KEY_0_service.name` desc, ts desc",
 				Args:  []any{"redis-manual", "%service.name%", "%service.name\":\"redis-manual%", uint64(1747945619), uint64(1747983448), "1747947419000000000", "1747983448000000000", uint64(1747945619), uint64(1747983448), 10, "1747947419000000000", "1747983448000000000", uint64(1747945619), uint64(1747983448)},
 			},
 			expectedErr: nil,
@@ -552,7 +552,7 @@ func TestStatementBuilderListQuery(t *testing.T) {
 				},
 			},
 			expected: qbtypes.Statement{
-				Query: "WITH __resource_filter AS (SELECT fingerprint FROM signoz_traces.distributed_traces_v3_resource WHERE (simpleJSONExtractString(labels, 'service.name') = ? AND labels LIKE ? AND labels LIKE ?) AND seen_at_ts_bucket_start >= ? AND seen_at_ts_bucket_start <= ? GROUP BY fingerprint) SELECT timestamp AS `__SELECT_KEY_0_timestamp`, trace_id AS `__SELECT_KEY_1_trace_id`, span_id AS `__SELECT_KEY_2_span_id`, name AS `__SELECT_KEY_3_name`, multiIf(resource.`service.name` IS NOT NULL, resource.`service.name`::String, mapContains(resources_string, 'service.name'), resources_string['service.name'], NULL) AS `__SELECT_KEY_4_service.name`, duration_nano AS `__SELECT_KEY_5_duration_nano`, multiIf(`attribute_number_cart$$items_count_exists` = true, `attribute_number_cart$$items_count`, NULL) AS `__SELECT_KEY_6_cart.items_count` FROM signoz_traces.distributed_signoz_index_v3 WHERE resource_fingerprint GLOBAL IN (SELECT fingerprint FROM __resource_filter) AND timestamp >= ? AND timestamp < ? AND ts_bucket_start >= ? AND ts_bucket_start <= ? LIMIT ?",
+				Query: "WITH __resource_filter AS (SELECT fingerprint FROM signoz_traces.distributed_traces_v3_resource WHERE (simpleJSONExtractString(labels, 'service.name') = ? AND labels LIKE ? AND labels LIKE ?) AND seen_at_ts_bucket_start >= ? AND seen_at_ts_bucket_start <= ? GROUP BY fingerprint) SELECT timestamp AS `__SELECT_KEY_0_timestamp`, trace_id AS `__SELECT_KEY_1_trace_id`, span_id AS `__SELECT_KEY_2_span_id`, name AS `__SELECT_KEY_3_name`, multiIf(resource.`service.name` IS NOT NULL, resource.`service.name`::String, mapContains(resources_string, 'service.name'), resources_string['service.name'], NULL) AS `__SELECT_KEY_4_service.name`, duration_nano AS `__SELECT_KEY_5_duration_nano`, multiIf(`attribute_number_cart$$items_count_exists`, `attribute_number_cart$$items_count`, NULL) AS `__SELECT_KEY_6_cart.items_count` FROM signoz_traces.distributed_signoz_index_v3 WHERE resource_fingerprint GLOBAL IN (SELECT fingerprint FROM __resource_filter) AND timestamp >= ? AND timestamp < ? AND ts_bucket_start >= ? AND ts_bucket_start <= ? LIMIT ?",
 				Args:  []any{"redis-manual", "%service.name%", "%service.name\":\"redis-manual%", uint64(1747945619), uint64(1747983448), "1747947419000000000", "1747983448000000000", uint64(1747945619), uint64(1747983448), 10},
 			},
 			expectedErr: nil,
@@ -669,7 +669,7 @@ func TestStatementBuilderListQuery(t *testing.T) {
 				Limit: 10,
 			},
 			expected: qbtypes.Statement{
-				Query: "WITH __resource_filter AS (SELECT fingerprint FROM signoz_traces.distributed_traces_v3_resource WHERE (simpleJSONExtractString(labels, 'service.name') = ? AND labels LIKE ? AND labels LIKE ?) AND seen_at_ts_bucket_start >= ? AND seen_at_ts_bucket_start <= ? GROUP BY fingerprint) SELECT timestamp AS `__SELECT_KEY_0_timestamp`, trace_id AS `__SELECT_KEY_1_trace_id`, span_id AS `__SELECT_KEY_2_span_id`, name AS `__SELECT_KEY_3_name`, resource_string_service$$name AS `__SELECT_KEY_4_serviceName`, duration_nano AS `__SELECT_KEY_5_durationNano`, http_method AS `__SELECT_KEY_6_httpMethod`, multiIf(`attribute_string_mixed$$materialization$$key_exists` = true, `attribute_string_mixed$$materialization$$key`, multiIf(resource.`mixed.materialization.key` IS NOT NULL, resource.`mixed.materialization.key`::String, mapContains(resources_string, 'mixed.materialization.key'), resources_string['mixed.materialization.key'], NULL) IS NOT NULL, multiIf(resource.`mixed.materialization.key` IS NOT NULL, resource.`mixed.materialization.key`::String, mapContains(resources_string, 'mixed.materialization.key'), resources_string['mixed.materialization.key'], NULL), NULL) AS `__SELECT_KEY_7_mixed.materialization.key` FROM signoz_traces.distributed_signoz_index_v3 WHERE resource_fingerprint GLOBAL IN (SELECT fingerprint FROM __resource_filter) AND timestamp >= ? AND timestamp < ? AND ts_bucket_start >= ? AND ts_bucket_start <= ? LIMIT ?",
+				Query: "WITH __resource_filter AS (SELECT fingerprint FROM signoz_traces.distributed_traces_v3_resource WHERE (simpleJSONExtractString(labels, 'service.name') = ? AND labels LIKE ? AND labels LIKE ?) AND seen_at_ts_bucket_start >= ? AND seen_at_ts_bucket_start <= ? GROUP BY fingerprint) SELECT timestamp AS `__SELECT_KEY_0_timestamp`, trace_id AS `__SELECT_KEY_1_trace_id`, span_id AS `__SELECT_KEY_2_span_id`, name AS `__SELECT_KEY_3_name`, resource_string_service$$name AS `__SELECT_KEY_4_serviceName`, duration_nano AS `__SELECT_KEY_5_durationNano`, http_method AS `__SELECT_KEY_6_httpMethod`, multiIf(`attribute_string_mixed$$materialization$$key_exists`, `attribute_string_mixed$$materialization$$key`, multiIf(resource.`mixed.materialization.key` IS NOT NULL, resource.`mixed.materialization.key`::String, mapContains(resources_string, 'mixed.materialization.key'), resources_string['mixed.materialization.key'], NULL) IS NOT NULL, multiIf(resource.`mixed.materialization.key` IS NOT NULL, resource.`mixed.materialization.key`::String, mapContains(resources_string, 'mixed.materialization.key'), resources_string['mixed.materialization.key'], NULL), NULL) AS `__SELECT_KEY_7_mixed.materialization.key` FROM signoz_traces.distributed_signoz_index_v3 WHERE resource_fingerprint GLOBAL IN (SELECT fingerprint FROM __resource_filter) AND timestamp >= ? AND timestamp < ? AND ts_bucket_start >= ? AND ts_bucket_start <= ? LIMIT ?",
 				Args:  []any{"redis-manual", "%service.name%", "%service.name\":\"redis-manual%", uint64(1747945619), uint64(1747983448), "1747947419000000000", "1747983448000000000", uint64(1747945619), uint64(1747983448), 10},
 			},
 			expectedErr: nil,
@@ -714,7 +714,7 @@ func TestStatementBuilderListQuery(t *testing.T) {
 				Limit: 10,
 			},
 			expected: qbtypes.Statement{
-				Query: "WITH __resource_filter AS (SELECT fingerprint FROM signoz_traces.distributed_traces_v3_resource WHERE (simpleJSONExtractString(labels, 'service.name') = ? AND labels LIKE ? AND labels LIKE ?) AND seen_at_ts_bucket_start >= ? AND seen_at_ts_bucket_start <= ? GROUP BY fingerprint) SELECT timestamp AS `__SELECT_KEY_0_timestamp`, trace_id AS `__SELECT_KEY_1_trace_id`, span_id AS `__SELECT_KEY_2_span_id`, name AS `__SELECT_KEY_3_name`, resource_string_service$$name AS `__SELECT_KEY_4_serviceName`, duration_nano AS `__SELECT_KEY_5_durationNano`, http_method AS `__SELECT_KEY_6_httpMethod`, multiIf(`attribute_string_mixed$$materialization$$key_exists` = true, `attribute_string_mixed$$materialization$$key`, NULL) AS `__SELECT_KEY_7_mixed.materialization.key` FROM signoz_traces.distributed_signoz_index_v3 WHERE resource_fingerprint GLOBAL IN (SELECT fingerprint FROM __resource_filter) AND timestamp >= ? AND timestamp < ? AND ts_bucket_start >= ? AND ts_bucket_start <= ? LIMIT ?",
+				Query: "WITH __resource_filter AS (SELECT fingerprint FROM signoz_traces.distributed_traces_v3_resource WHERE (simpleJSONExtractString(labels, 'service.name') = ? AND labels LIKE ? AND labels LIKE ?) AND seen_at_ts_bucket_start >= ? AND seen_at_ts_bucket_start <= ? GROUP BY fingerprint) SELECT timestamp AS `__SELECT_KEY_0_timestamp`, trace_id AS `__SELECT_KEY_1_trace_id`, span_id AS `__SELECT_KEY_2_span_id`, name AS `__SELECT_KEY_3_name`, resource_string_service$$name AS `__SELECT_KEY_4_serviceName`, duration_nano AS `__SELECT_KEY_5_durationNano`, http_method AS `__SELECT_KEY_6_httpMethod`, multiIf(`attribute_string_mixed$$materialization$$key_exists`, `attribute_string_mixed$$materialization$$key`, NULL) AS `__SELECT_KEY_7_mixed.materialization.key` FROM signoz_traces.distributed_signoz_index_v3 WHERE resource_fingerprint GLOBAL IN (SELECT fingerprint FROM __resource_filter) AND timestamp >= ? AND timestamp < ? AND ts_bucket_start >= ? AND ts_bucket_start <= ? LIMIT ?",
 				Args:  []any{"redis-manual", "%service.name%", "%service.name\":\"redis-manual%", uint64(1747945619), uint64(1747983448), "1747947419000000000", "1747983448000000000", uint64(1747945619), uint64(1747983448), 10},
 			},
 			expectedErr: nil,
@@ -1178,7 +1178,7 @@ func TestStatementBuilderTraceQuery(t *testing.T) {
 				Limit: 10,
 			},
 			expected: qbtypes.Statement{
-				Query: "WITH __toe AS (SELECT trace_id FROM signoz_traces.distributed_signoz_index_v3 WHERE (`attribute_string_materialized$$key$$name` = ? AND `attribute_string_materialized$$key$$name_exists` = true) AND timestamp >= ? AND timestamp < ? AND ts_bucket_start >= ? AND ts_bucket_start <= ?), __toe_duration_sorted AS (SELECT trace_id, duration_nano, resource_string_service$$name as `service.name`, name FROM signoz_traces.distributed_signoz_index_v3 WHERE parent_span_id = '' AND trace_id GLOBAL IN __toe AND timestamp >= ? AND timestamp < ? AND ts_bucket_start >= ? AND ts_bucket_start <= ? ORDER BY duration_nano DESC LIMIT 1 BY trace_id) SELECT __toe_duration_sorted.`service.name` AS `service.name`, __toe_duration_sorted.name AS `name`, count() AS span_count, __toe_duration_sorted.duration_nano AS `duration_nano`, __toe_duration_sorted.trace_id AS `trace_id` FROM __toe INNER JOIN __toe_duration_sorted ON __toe.trace_id = __toe_duration_sorted.trace_id GROUP BY trace_id, duration_nano, name, `service.name` ORDER BY duration_nano DESC LIMIT 1 BY trace_id LIMIT ? SETTINGS distributed_product_mode='allow', max_memory_usage=10000000000",
+				Query: "WITH __toe AS (SELECT trace_id FROM signoz_traces.distributed_signoz_index_v3 WHERE (`attribute_string_materialized$$key$$name` = ? AND `attribute_string_materialized$$key$$name_exists`) AND timestamp >= ? AND timestamp < ? AND ts_bucket_start >= ? AND ts_bucket_start <= ?), __toe_duration_sorted AS (SELECT trace_id, duration_nano, resource_string_service$$name as `service.name`, name FROM signoz_traces.distributed_signoz_index_v3 WHERE parent_span_id = '' AND trace_id GLOBAL IN __toe AND timestamp >= ? AND timestamp < ? AND ts_bucket_start >= ? AND ts_bucket_start <= ? ORDER BY duration_nano DESC LIMIT 1 BY trace_id) SELECT __toe_duration_sorted.`service.name` AS `service.name`, __toe_duration_sorted.name AS `name`, count() AS span_count, __toe_duration_sorted.duration_nano AS `duration_nano`, __toe_duration_sorted.trace_id AS `trace_id` FROM __toe INNER JOIN __toe_duration_sorted ON __toe.trace_id = __toe_duration_sorted.trace_id GROUP BY trace_id, duration_nano, name, `service.name` ORDER BY duration_nano DESC LIMIT 1 BY trace_id LIMIT ? SETTINGS distributed_product_mode='allow', max_memory_usage=10000000000",
 				Args:  []any{"redis-manual", "1747947419000000000", "1747983448000000000", uint64(1747945619), uint64(1747983448), "1747947419000000000", "1747983448000000000", uint64(1747945619), uint64(1747983448), 10},
 			},
 			expectedErr: nil,
@@ -1194,7 +1194,7 @@ func TestStatementBuilderTraceQuery(t *testing.T) {
 				Limit: 10,
 			},
 			expected: qbtypes.Statement{
-				Query: "WITH __toe AS (SELECT trace_id FROM signoz_traces.distributed_signoz_index_v3 WHERE ((match(`attribute_string_materialized$$key$$name`, ?) AND `attribute_string_materialized$$key$$name_exists` = true) OR multiIf(resource.`service.name` IS NOT NULL, resource.`service.name`::String, mapContains(resources_string, 'service.name'), resources_string['service.name'], NULL) = ?) AND timestamp >= ? AND timestamp < ? AND ts_bucket_start >= ? AND ts_bucket_start <= ?), __toe_duration_sorted AS (SELECT trace_id, duration_nano, resource_string_service$$name as `service.name`, name FROM signoz_traces.distributed_signoz_index_v3 WHERE parent_span_id = '' AND trace_id GLOBAL IN __toe AND timestamp >= ? AND timestamp < ? AND ts_bucket_start >= ? AND ts_bucket_start <= ? ORDER BY duration_nano DESC LIMIT 1 BY trace_id) SELECT __toe_duration_sorted.`service.name` AS `service.name`, __toe_duration_sorted.name AS `name`, count() AS span_count, __toe_duration_sorted.duration_nano AS `duration_nano`, __toe_duration_sorted.trace_id AS `trace_id` FROM __toe INNER JOIN __toe_duration_sorted ON __toe.trace_id = __toe_duration_sorted.trace_id GROUP BY trace_id, duration_nano, name, `service.name` ORDER BY duration_nano DESC LIMIT 1 BY trace_id LIMIT ? SETTINGS distributed_product_mode='allow', max_memory_usage=10000000000",
+				Query: "WITH __toe AS (SELECT trace_id FROM signoz_traces.distributed_signoz_index_v3 WHERE ((match(`attribute_string_materialized$$key$$name`, ?) AND `attribute_string_materialized$$key$$name_exists`) OR multiIf(resource.`service.name` IS NOT NULL, resource.`service.name`::String, mapContains(resources_string, 'service.name'), resources_string['service.name'], NULL) = ?) AND timestamp >= ? AND timestamp < ? AND ts_bucket_start >= ? AND ts_bucket_start <= ?), __toe_duration_sorted AS (SELECT trace_id, duration_nano, resource_string_service$$name as `service.name`, name FROM signoz_traces.distributed_signoz_index_v3 WHERE parent_span_id = '' AND trace_id GLOBAL IN __toe AND timestamp >= ? AND timestamp < ? AND ts_bucket_start >= ? AND ts_bucket_start <= ? ORDER BY duration_nano DESC LIMIT 1 BY trace_id) SELECT __toe_duration_sorted.`service.name` AS `service.name`, __toe_duration_sorted.name AS `name`, count() AS span_count, __toe_duration_sorted.duration_nano AS `duration_nano`, __toe_duration_sorted.trace_id AS `trace_id` FROM __toe INNER JOIN __toe_duration_sorted ON __toe.trace_id = __toe_duration_sorted.trace_id GROUP BY trace_id, duration_nano, name, `service.name` ORDER BY duration_nano DESC LIMIT 1 BY trace_id LIMIT ? SETTINGS distributed_product_mode='allow', max_memory_usage=10000000000",
 				Args:  []any{"redis-manual", "redis-manual", "1747947419000000000", "1747983448000000000", uint64(1747945619), uint64(1747983448), "1747947419000000000", "1747983448000000000", uint64(1747945619), uint64(1747983448), 10},
 			},
 			expectedErr: nil,
@@ -1240,7 +1240,7 @@ func TestStatementBuilderTraceQuery(t *testing.T) {
 				Limit: 10,
 			},
 			expected: qbtypes.Statement{
-				Query: "WITH __toe AS (SELECT trace_id FROM signoz_traces.distributed_signoz_index_v3 WHERE (((name, resource_string_service$$name) GLOBAL IN (SELECT DISTINCT name, serviceName from signoz_traces.distributed_top_level_operations WHERE time >= toDateTime(1747947419))) AND parent_span_id != '' OR (`attribute_string_materialized$$key$$name` = ? AND `attribute_string_materialized$$key$$name_exists` = true)) AND timestamp >= ? AND timestamp < ? AND ts_bucket_start >= ? AND ts_bucket_start <= ?), __toe_duration_sorted AS (SELECT trace_id, duration_nano, resource_string_service$$name as `service.name`, name FROM signoz_traces.distributed_signoz_index_v3 WHERE parent_span_id = '' AND trace_id GLOBAL IN __toe AND timestamp >= ? AND timestamp < ? AND ts_bucket_start >= ? AND ts_bucket_start <= ? ORDER BY duration_nano DESC LIMIT 1 BY trace_id) SELECT __toe_duration_sorted.`service.name` AS `service.name`, __toe_duration_sorted.name AS `name`, count() AS span_count, __toe_duration_sorted.duration_nano AS `duration_nano`, __toe_duration_sorted.trace_id AS `trace_id` FROM __toe INNER JOIN __toe_duration_sorted ON __toe.trace_id = __toe_duration_sorted.trace_id GROUP BY trace_id, duration_nano, name, `service.name` ORDER BY duration_nano DESC LIMIT 1 BY trace_id LIMIT ? SETTINGS distributed_product_mode='allow', max_memory_usage=10000000000",
+				Query: "WITH __toe AS (SELECT trace_id FROM signoz_traces.distributed_signoz_index_v3 WHERE (((name, resource_string_service$$name) GLOBAL IN (SELECT DISTINCT name, serviceName from signoz_traces.distributed_top_level_operations WHERE time >= toDateTime(1747947419))) AND parent_span_id != '' OR (`attribute_string_materialized$$key$$name` = ? AND `attribute_string_materialized$$key$$name_exists`)) AND timestamp >= ? AND timestamp < ? AND ts_bucket_start >= ? AND ts_bucket_start <= ?), __toe_duration_sorted AS (SELECT trace_id, duration_nano, resource_string_service$$name as `service.name`, name FROM signoz_traces.distributed_signoz_index_v3 WHERE parent_span_id = '' AND trace_id GLOBAL IN __toe AND timestamp >= ? AND timestamp < ? AND ts_bucket_start >= ? AND ts_bucket_start <= ? ORDER BY duration_nano DESC LIMIT 1 BY trace_id) SELECT __toe_duration_sorted.`service.name` AS `service.name`, __toe_duration_sorted.name AS `name`, count() AS span_count, __toe_duration_sorted.duration_nano AS `duration_nano`, __toe_duration_sorted.trace_id AS `trace_id` FROM __toe INNER JOIN __toe_duration_sorted ON __toe.trace_id = __toe_duration_sorted.trace_id GROUP BY trace_id, duration_nano, name, `service.name` ORDER BY duration_nano DESC LIMIT 1 BY trace_id LIMIT ? SETTINGS distributed_product_mode='allow', max_memory_usage=10000000000",
 				Args:  []any{"redis-manual", "1747947419000000000", "1747983448000000000", uint64(1747945619), uint64(1747983448), "1747947419000000000", "1747983448000000000", uint64(1747945619), uint64(1747983448), 10},
 			},
 			expectedErr: nil,

pkg/telemetryschema/logstelemetryschema/compile_test.go

@@ -461,7 +461,7 @@ func TestConditionFor(t *testing.T) {
 			evolutions:    mockEvolution,
 			operator:      qbtypes.FilterOperatorRegexp,
 			value:         "frontend-.*",
-			expectedSQL:   "WHERE (match(`resource_string_service$$name`, ?) AND `resource_string_service$$name_exists` = true)",
+			expectedSQL:   "WHERE (match(`resource_string_service$$name`, ?) AND `resource_string_service$$name_exists`)",
 			expectedArgs:  []any{"frontend-.*"},
 			expectedError: nil,
 		},

pkg/telemetryschema/logstelemetryschema/filter_expr_logs_test.go

@@ -1596,7 +1596,7 @@ func TestFilterExprLogs(t *testing.T) {
 			category:              "Materialized key",
 			query:                 "materialized.key.name=\"test\"",
 			shouldPass:            true,
-			expectedQuery:         "WHERE (`attribute_string_materialized$$key$$name` = ? AND `attribute_string_materialized$$key$$name_exists` = true)",
+			expectedQuery:         "WHERE (`attribute_string_materialized$$key$$name` = ? AND `attribute_string_materialized$$key$$name_exists`)",
 			expectedArgs:          []any{"test"},
 			expectedErrorContains: "",
 		},

pkg/telemetryschema/logstelemetryschema/storage.go

@@ -182,7 +182,7 @@ func (m *storage) read(_ context.Context, q qbtypes.QueryInfo, key *telemetrytyp
 				// a key could have been materialized, if so return the materialized column name
 				if key.Materialized {
 					exprs = append(exprs, telemetrytypes.FieldKeyToMaterializedColumnName(key))
-					existExpr = append(existExpr, telemetrytypes.FieldKeyToMaterializedExistsCondition(key, true))
+					existExpr = append(existExpr, telemetrytypes.FieldKeyToMaterializedColumnNameForExists(key))
 				} else {
 					exprs = append(exprs, fmt.Sprintf("%s[%s]", columnName, clickhousesql.StringLiteral(key.Name)))
 					existExpr = append(existExpr, fmt.Sprintf("mapContains(%s, %s)", columnName, clickhousesql.StringLiteral(key.Name)))

pkg/telemetryschema/logstelemetryschema/storage_test.go

@@ -580,7 +580,7 @@ func TestFieldForWithMaterialized(t *testing.T) {
 			name:           "Multi evolution - both columns (JSON + materialized)",
 			start:          time.Date(2024, 2, 1, 0, 0, 0, 0, time.UTC),
 			end:            time.Date(2024, 4, 2, 0, 0, 0, 0, time.UTC),
-			expectedResult: "multiIf(resource.`service.name` IS NOT NULL, resource.`service.name`::String, `resource_string_service$$name_exists` = true, `resource_string_service$$name`, NULL)",
+			expectedResult: "multiIf(resource.`service.name` IS NOT NULL, resource.`service.name`::String, `resource_string_service$$name_exists`, `resource_string_service$$name`, NULL)",
 		},
 	}
 

pkg/telemetryschema/tracestelemetryschema/storage.go

@@ -306,7 +306,7 @@ func (m *storage) resolveColumnExprs(
 				// a key could have been materialized, if so return the materialized column name
 				if key.Materialized {
 					exprs = append(exprs, telemetrytypes.FieldKeyToMaterializedColumnName(key))
-					existExprs = append(existExprs, telemetrytypes.FieldKeyToMaterializedExistsCondition(key, true))
+					existExprs = append(existExprs, telemetrytypes.FieldKeyToMaterializedColumnNameForExists(key))
 				} else {
 					exprs = append(exprs, fmt.Sprintf("%s[%s]", columnName, clickhousesql.StringLiteral(key.Name)))
 					existExprs = append(existExprs, fmt.Sprintf("mapContains(%s, %s)", columnName, clickhousesql.StringLiteral(key.Name)))

pkg/telemetryschema/tracestelemetryschema/storage_test.go

@@ -80,7 +80,7 @@ func TestGetFieldKeyName(t *testing.T) {
 				Materialized:  true,
 				Evolutions:    mockEvolution,
 			},
-			expectedResult: "multiIf(resource.`deployment.environment` IS NOT NULL, resource.`deployment.environment`::String, `resource_string_deployment$$environment_exists` = true, `resource_string_deployment$$environment`, NULL)",
+			expectedResult: "multiIf(resource.`deployment.environment` IS NOT NULL, resource.`deployment.environment`::String, `resource_string_deployment$$environment_exists`, `resource_string_deployment$$environment`, NULL)",
 			expectedError:  nil,
 		},
 		{
@@ -228,7 +228,7 @@ func TestFieldForResourceWithEvolution(t *testing.T) {
 			},
 			tsStart:        uint64(time.Date(2024, 6, 1, 0, 0, 0, 0, time.UTC).UnixNano()),
 			tsEnd:          uint64(time.Date(2025, 6, 1, 0, 0, 0, 0, time.UTC).UnixNano()),
-			expectedResult: "multiIf(resource.`deployment.environment` IS NOT NULL, resource.`deployment.environment`::String, `resource_string_deployment$$environment_exists` = true, `resource_string_deployment$$environment`, NULL)",
+			expectedResult: "multiIf(resource.`deployment.environment` IS NOT NULL, resource.`deployment.environment`::String, `resource_string_deployment$$environment_exists`, `resource_string_deployment$$environment`, NULL)",
 		},
 	}
 

pkg/types/telemetrytypes/field.go

@@ -218,12 +218,6 @@ func FieldKeyToMaterializedColumnNameForExists(key *TelemetryFieldKey) string {
 	))
 }
 
-// FieldKeyToMaterializedExistsCondition compares the exists column explicitly: a bare bool
-// column defeats skip-index pruning across OR.
-func FieldKeyToMaterializedExistsCondition(key *TelemetryFieldKey, exists bool) string {
-	return fmt.Sprintf("%s = %t", FieldKeyToMaterializedColumnNameForExists(key), exists)
-}
-
 type TelemetryFieldValues struct {
 	StringValues  []string  `json:"stringValues,omitempty"`
 	BoolValues    []bool    `json:"boolValues,omitempty"`

tests/fixtures/alerts.py

@@ -108,14 +108,23 @@ def delete_all_rules(signoz: types.SigNoz, token: str) -> None:
 def seed_alert_rules(
     signoz: types.SigNoz,
     get_token: Callable[[str, str], str],
+    notification_channel: types.TestContainerDocker,
     create_notification_channel: Callable[[dict], str],
     create_alert_rule: Callable[[dict], str],
-) -> Callable[[dict, list[dict]], None]:
+) -> Callable[[str, list[dict]], None]:
     admin_token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
 
-    def _seed_alert_rules(channel_config: dict, rules: list[dict]) -> None:
+    # create_notification_channel rather than create_webhook_notification_channel:
+    # only the former deletes on teardown, and callers reuse one channel name
+    # across tests, so a leaked channel fails the next create as a duplicate.
+    def _seed_alert_rules(channel_name: str, rules: list[dict]) -> None:
         delete_all_rules(signoz, admin_token)
-        create_notification_channel(channel_config)
+        create_notification_channel(
+            {
+                "name": channel_name,
+                "webhook_configs": [{"url": notification_channel.container_configs["8080"].get(f"/alert/{channel_name}"), "send_resolved": False}],
+            }
+        )
         for rule in rules:
             create_alert_rule(rule)
 

tests/integration/tests/alertmanager/02_notifiers.py

@@ -31,11 +31,11 @@ logger = setup_logger(__name__)
 NOTIFIERS_TEST = [
     types.AlertManagerNotificationTestCase(
         name="slack_notifier_default_templating",
-        rule_path="alerts/test_scenarios/threshold_above_at_least_once/rule.json",
+        rule_path="ruler/test_scenarios/threshold_above_at_least_once/rule.json",
         alert_data=[
             types.AlertData(
                 type="metrics",
-                data_path="alerts/test_scenarios/threshold_above_at_least_once/alert_data.jsonl",
+                data_path="ruler/test_scenarios/threshold_above_at_least_once/alert_data.jsonl",
             ),
         ],
         channel_config=slack_default_config,
@@ -64,11 +64,11 @@ NOTIFIERS_TEST = [
     ),
     types.AlertManagerNotificationTestCase(
         name="msteams_notifier_default_templating",
-        rule_path="alerts/test_scenarios/threshold_above_at_least_once/rule.json",
+        rule_path="ruler/test_scenarios/threshold_above_at_least_once/rule.json",
         alert_data=[
             types.AlertData(
                 type="metrics",
-                data_path="alerts/test_scenarios/threshold_above_at_least_once/alert_data.jsonl",
+                data_path="ruler/test_scenarios/threshold_above_at_least_once/alert_data.jsonl",
             ),
         ],
         channel_config=msteams_default_config,
@@ -149,11 +149,11 @@ NOTIFIERS_TEST = [
     ),
     types.AlertManagerNotificationTestCase(
         name="pagerduty_notifier_default_templating",
-        rule_path="alerts/test_scenarios/threshold_above_at_least_once/rule.json",
+        rule_path="ruler/test_scenarios/threshold_above_at_least_once/rule.json",
         alert_data=[
             types.AlertData(
                 type="metrics",
-                data_path="alerts/test_scenarios/threshold_above_at_least_once/alert_data.jsonl",
+                data_path="ruler/test_scenarios/threshold_above_at_least_once/alert_data.jsonl",
             ),
         ],
         channel_config=pagerduty_default_config,
@@ -194,11 +194,11 @@ NOTIFIERS_TEST = [
     ),
     types.AlertManagerNotificationTestCase(
         name="opsgenie_notifier_default_templating",
-        rule_path="alerts/test_scenarios/threshold_above_at_least_once/rule.json",
+        rule_path="ruler/test_scenarios/threshold_above_at_least_once/rule.json",
         alert_data=[
             types.AlertData(
                 type="metrics",
-                data_path="alerts/test_scenarios/threshold_above_at_least_once/alert_data.jsonl",
+                data_path="ruler/test_scenarios/threshold_above_at_least_once/alert_data.jsonl",
             ),
         ],
         channel_config=opsgenie_default_config,
@@ -226,11 +226,11 @@ NOTIFIERS_TEST = [
     ),
     types.AlertManagerNotificationTestCase(
         name="webhook_notifier_default_templating",
-        rule_path="alerts/test_scenarios/threshold_above_at_least_once/rule.json",
+        rule_path="ruler/test_scenarios/threshold_above_at_least_once/rule.json",
         alert_data=[
             types.AlertData(
                 type="metrics",
-                data_path="alerts/test_scenarios/threshold_above_at_least_once/alert_data.jsonl",
+                data_path="ruler/test_scenarios/threshold_above_at_least_once/alert_data.jsonl",
             ),
         ],
         channel_config=webhook_default_config,
@@ -275,11 +275,11 @@ NOTIFIERS_TEST = [
     ),
     types.AlertManagerNotificationTestCase(
         name="email_notifier_default_templating",
-        rule_path="alerts/test_scenarios/threshold_above_at_least_once/rule.json",
+        rule_path="ruler/test_scenarios/threshold_above_at_least_once/rule.json",
         alert_data=[
             types.AlertData(
                 type="metrics",
-                data_path="alerts/test_scenarios/threshold_above_at_least_once/alert_data.jsonl",
+                data_path="ruler/test_scenarios/threshold_above_at_least_once/alert_data.jsonl",
             ),
         ],
         channel_config=email_default_config,

tests/integration/tests/alertmanager/06_test_channel.py

@@ -15,10 +15,10 @@ logger = setup_logger(__name__)
 
 def test_webhook_notification_channel(
     signoz: types.SigNoz,
+    create_user_admin: None,  # pylint: disable=unused-argument
     get_token: Callable[[str, str], str],
     notification_channel: types.TestContainerDocker,
     make_http_mocks: Callable[[types.TestContainerDocker, list[Mapping]], None],
-    create_webhook_notification_channel: Callable[[str, str, dict, bool], str],
 ) -> None:
     logger.info("Setting up notification channel")
 
@@ -45,14 +45,6 @@ def test_webhook_notification_channel(
         ],
     )
 
-    # Create an alert channel using the given route
-    create_webhook_notification_channel(
-        channel_name=notification_channel_name,
-        webhook_url=webhook_endpoint,
-        http_config={},
-        send_resolved=True,
-    )
-
     # TODO: @abhishekhugetech # pylint: disable=W0511
     # Time required for newly created Org to be registered in the alertmanager is 5 seconds in signoz.py
     # this will be fixed after [https://github.com/SigNoz/engineering-pod/issues/3800]

tests/integration/tests/ruler/01_basic_alert_conditions.py

@@ -21,12 +21,12 @@ from fixtures.logger import setup_logger
 TEST_RULES_MATCH_TYPE_AND_COMPARE_OPERATORS = [
     types.AlertTestCase(
         name="test_threshold_above_at_least_once",
-        rule_path="alerts/test_scenarios/threshold_above_at_least_once/rule.json",
+        rule_path="ruler/test_scenarios/threshold_above_at_least_once/rule.json",
         alert_data=[
             types.AlertData(
                 type="metrics",
                 # active requests dummy data
-                data_path="alerts/test_scenarios/threshold_above_at_least_once/alert_data.jsonl",
+                data_path="ruler/test_scenarios/threshold_above_at_least_once/alert_data.jsonl",
             ),
         ],
         alert_expectation=types.AlertExpectation(
@@ -44,11 +44,11 @@ TEST_RULES_MATCH_TYPE_AND_COMPARE_OPERATORS = [
     ),
     types.AlertTestCase(
         name="test_threshold_above_all_the_time",
-        rule_path="alerts/test_scenarios/threshold_above_all_the_time/rule.json",
+        rule_path="ruler/test_scenarios/threshold_above_all_the_time/rule.json",
         alert_data=[
             types.AlertData(
                 type="metrics",
-                data_path="alerts/test_scenarios/threshold_above_all_the_time/alert_data.jsonl",
+                data_path="ruler/test_scenarios/threshold_above_all_the_time/alert_data.jsonl",
             ),
         ],
         alert_expectation=types.AlertExpectation(
@@ -66,11 +66,11 @@ TEST_RULES_MATCH_TYPE_AND_COMPARE_OPERATORS = [
     ),
     types.AlertTestCase(
         name="test_threshold_above_in_total",
-        rule_path="alerts/test_scenarios/threshold_above_in_total/rule.json",
+        rule_path="ruler/test_scenarios/threshold_above_in_total/rule.json",
         alert_data=[
             types.AlertData(
                 type="metrics",
-                data_path="alerts/test_scenarios/threshold_above_in_total/alert_data.jsonl",
+                data_path="ruler/test_scenarios/threshold_above_in_total/alert_data.jsonl",
             ),
         ],
         alert_expectation=types.AlertExpectation(
@@ -96,11 +96,11 @@ TEST_RULES_MATCH_TYPE_AND_COMPARE_OPERATORS = [
     ),
     types.AlertTestCase(
         name="test_threshold_above_average",
-        rule_path="alerts/test_scenarios/threshold_above_average/rule.json",
+        rule_path="ruler/test_scenarios/threshold_above_average/rule.json",
         alert_data=[
             types.AlertData(
                 type="traces",
-                data_path="alerts/test_scenarios/threshold_above_average/alert_data.jsonl",
+                data_path="ruler/test_scenarios/threshold_above_average/alert_data.jsonl",
             ),
         ],
         alert_expectation=types.AlertExpectation(
@@ -118,11 +118,11 @@ TEST_RULES_MATCH_TYPE_AND_COMPARE_OPERATORS = [
     ),
     types.AlertTestCase(
         name="test_threshold_above_last",
-        rule_path="alerts/test_scenarios/threshold_above_last/rule.json",
+        rule_path="ruler/test_scenarios/threshold_above_last/rule.json",
         alert_data=[
             types.AlertData(
                 type="metrics",
-                data_path="alerts/test_scenarios/threshold_above_last/alert_data.jsonl",
+                data_path="ruler/test_scenarios/threshold_above_last/alert_data.jsonl",
             ),
         ],
         alert_expectation=types.AlertExpectation(
@@ -140,11 +140,11 @@ TEST_RULES_MATCH_TYPE_AND_COMPARE_OPERATORS = [
     ),
     types.AlertTestCase(
         name="test_threshold_below_at_least_once",
-        rule_path="alerts/test_scenarios/threshold_below_at_least_once/rule.json",
+        rule_path="ruler/test_scenarios/threshold_below_at_least_once/rule.json",
         alert_data=[
             types.AlertData(
                 type="logs",
-                data_path="alerts/test_scenarios/threshold_below_at_least_once/alert_data.jsonl",
+                data_path="ruler/test_scenarios/threshold_below_at_least_once/alert_data.jsonl",
             ),
         ],
         alert_expectation=types.AlertExpectation(
@@ -162,11 +162,11 @@ TEST_RULES_MATCH_TYPE_AND_COMPARE_OPERATORS = [
     ),
     types.AlertTestCase(
         name="test_threshold_below_all_the_time",
-        rule_path="alerts/test_scenarios/threshold_below_all_the_time/rule.json",
+        rule_path="ruler/test_scenarios/threshold_below_all_the_time/rule.json",
         alert_data=[
             types.AlertData(
                 type="logs",
-                data_path="alerts/test_scenarios/threshold_below_all_the_time/alert_data.jsonl",
+                data_path="ruler/test_scenarios/threshold_below_all_the_time/alert_data.jsonl",
             ),
         ],
         alert_expectation=types.AlertExpectation(
@@ -184,12 +184,12 @@ TEST_RULES_MATCH_TYPE_AND_COMPARE_OPERATORS = [
     ),
     types.AlertTestCase(
         name="test_threshold_below_in_total",
-        rule_path="alerts/test_scenarios/threshold_below_in_total/rule.json",
+        rule_path="ruler/test_scenarios/threshold_below_in_total/rule.json",
         alert_data=[
             types.AlertData(
                 type="metrics",
                 # one rate ~5 + rest 0.01 so it remains in total below 10
-                data_path="alerts/test_scenarios/threshold_below_in_total/alert_data.jsonl",
+                data_path="ruler/test_scenarios/threshold_below_in_total/alert_data.jsonl",
             ),
         ],
         alert_expectation=types.AlertExpectation(
@@ -207,11 +207,11 @@ TEST_RULES_MATCH_TYPE_AND_COMPARE_OPERATORS = [
     ),
     types.AlertTestCase(
         name="test_threshold_below_average",
-        rule_path="alerts/test_scenarios/threshold_below_average/rule.json",
+        rule_path="ruler/test_scenarios/threshold_below_average/rule.json",
         alert_data=[
             types.AlertData(
                 type="metrics",
-                data_path="alerts/test_scenarios/threshold_below_average/alert_data.jsonl",
+                data_path="ruler/test_scenarios/threshold_below_average/alert_data.jsonl",
             ),
         ],
         alert_expectation=types.AlertExpectation(
@@ -229,11 +229,11 @@ TEST_RULES_MATCH_TYPE_AND_COMPARE_OPERATORS = [
     ),
     types.AlertTestCase(
         name="test_threshold_below_last",
-        rule_path="alerts/test_scenarios/threshold_below_last/rule.json",
+        rule_path="ruler/test_scenarios/threshold_below_last/rule.json",
         alert_data=[
             types.AlertData(
                 type="metrics",
-                data_path="alerts/test_scenarios/threshold_below_last/alert_data.jsonl",
+                data_path="ruler/test_scenarios/threshold_below_last/alert_data.jsonl",
             ),
         ],
         alert_expectation=types.AlertExpectation(
@@ -251,11 +251,11 @@ TEST_RULES_MATCH_TYPE_AND_COMPARE_OPERATORS = [
     ),
     types.AlertTestCase(
         name="test_threshold_equal_to_at_least_once",
-        rule_path="alerts/test_scenarios/threshold_equal_to_at_least_once/rule.json",
+        rule_path="ruler/test_scenarios/threshold_equal_to_at_least_once/rule.json",
         alert_data=[
             types.AlertData(
                 type="metrics",
-                data_path="alerts/test_scenarios/threshold_equal_to_at_least_once/alert_data.jsonl",
+                data_path="ruler/test_scenarios/threshold_equal_to_at_least_once/alert_data.jsonl",
             ),
         ],
         alert_expectation=types.AlertExpectation(
@@ -273,11 +273,11 @@ TEST_RULES_MATCH_TYPE_AND_COMPARE_OPERATORS = [
     ),
     types.AlertTestCase(
         name="test_threshold_equal_to_all_the_time",
-        rule_path="alerts/test_scenarios/threshold_equal_to_all_the_time/rule.json",
+        rule_path="ruler/test_scenarios/threshold_equal_to_all_the_time/rule.json",
         alert_data=[
             types.AlertData(
                 type="metrics",
-                data_path="alerts/test_scenarios/threshold_equal_to_all_the_time/alert_data.jsonl",
+                data_path="ruler/test_scenarios/threshold_equal_to_all_the_time/alert_data.jsonl",
             ),
         ],
         alert_expectation=types.AlertExpectation(
@@ -295,11 +295,11 @@ TEST_RULES_MATCH_TYPE_AND_COMPARE_OPERATORS = [
     ),
     types.AlertTestCase(
         name="test_threshold_equal_to_in_total",
-        rule_path="alerts/test_scenarios/threshold_equal_to_in_total/rule.json",
+        rule_path="ruler/test_scenarios/threshold_equal_to_in_total/rule.json",
         alert_data=[
             types.AlertData(
                 type="metrics",
-                data_path="alerts/test_scenarios/threshold_equal_to_in_total/alert_data.jsonl",
+                data_path="ruler/test_scenarios/threshold_equal_to_in_total/alert_data.jsonl",
             ),
         ],
         alert_expectation=types.AlertExpectation(
@@ -317,11 +317,11 @@ TEST_RULES_MATCH_TYPE_AND_COMPARE_OPERATORS = [
     ),
     types.AlertTestCase(
         name="test_threshold_equal_to_average",
-        rule_path="alerts/test_scenarios/threshold_equal_to_average/rule.json",
+        rule_path="ruler/test_scenarios/threshold_equal_to_average/rule.json",
         alert_data=[
             types.AlertData(
                 type="metrics",
-                data_path="alerts/test_scenarios/threshold_equal_to_average/alert_data.jsonl",
+                data_path="ruler/test_scenarios/threshold_equal_to_average/alert_data.jsonl",
             ),
         ],
         alert_expectation=types.AlertExpectation(
@@ -339,11 +339,11 @@ TEST_RULES_MATCH_TYPE_AND_COMPARE_OPERATORS = [
     ),
     types.AlertTestCase(
         name="test_threshold_equal_to_last",
-        rule_path="alerts/test_scenarios/threshold_equal_to_last/rule.json",
+        rule_path="ruler/test_scenarios/threshold_equal_to_last/rule.json",
         alert_data=[
             types.AlertData(
                 type="metrics",
-                data_path="alerts/test_scenarios/threshold_equal_to_last/alert_data.jsonl",
+                data_path="ruler/test_scenarios/threshold_equal_to_last/alert_data.jsonl",
             ),
         ],
         alert_expectation=types.AlertExpectation(
@@ -361,11 +361,11 @@ TEST_RULES_MATCH_TYPE_AND_COMPARE_OPERATORS = [
     ),
     types.AlertTestCase(
         name="test_threshold_not_equal_to_at_least_once",
-        rule_path="alerts/test_scenarios/threshold_not_equal_to_at_least_once/rule.json",
+        rule_path="ruler/test_scenarios/threshold_not_equal_to_at_least_once/rule.json",
         alert_data=[
             types.AlertData(
                 type="metrics",
-                data_path="alerts/test_scenarios/threshold_not_equal_to_at_least_once/alert_data.jsonl",
+                data_path="ruler/test_scenarios/threshold_not_equal_to_at_least_once/alert_data.jsonl",
             ),
         ],
         alert_expectation=types.AlertExpectation(
@@ -383,11 +383,11 @@ TEST_RULES_MATCH_TYPE_AND_COMPARE_OPERATORS = [
     ),
     types.AlertTestCase(
         name="test_threshold_not_equal_to_all_the_time",
-        rule_path="alerts/test_scenarios/threshold_not_equal_to_all_the_time/rule.json",
+        rule_path="ruler/test_scenarios/threshold_not_equal_to_all_the_time/rule.json",
         alert_data=[
             types.AlertData(
                 type="metrics",
-                data_path="alerts/test_scenarios/threshold_not_equal_to_all_the_time/alert_data.jsonl",
+                data_path="ruler/test_scenarios/threshold_not_equal_to_all_the_time/alert_data.jsonl",
             ),
         ],
         alert_expectation=types.AlertExpectation(
@@ -405,11 +405,11 @@ TEST_RULES_MATCH_TYPE_AND_COMPARE_OPERATORS = [
     ),
     types.AlertTestCase(
         name="test_threshold_not_equal_to_in_total",
-        rule_path="alerts/test_scenarios/threshold_not_equal_to_in_total/rule.json",
+        rule_path="ruler/test_scenarios/threshold_not_equal_to_in_total/rule.json",
         alert_data=[
             types.AlertData(
                 type="metrics",
-                data_path="alerts/test_scenarios/threshold_not_equal_to_in_total/alert_data.jsonl",
+                data_path="ruler/test_scenarios/threshold_not_equal_to_in_total/alert_data.jsonl",
             ),
         ],
         alert_expectation=types.AlertExpectation(
@@ -427,11 +427,11 @@ TEST_RULES_MATCH_TYPE_AND_COMPARE_OPERATORS = [
     ),
     types.AlertTestCase(
         name="test_threshold_not_equal_to_average",
-        rule_path="alerts/test_scenarios/threshold_not_equal_to_average/rule.json",
+        rule_path="ruler/test_scenarios/threshold_not_equal_to_average/rule.json",
         alert_data=[
             types.AlertData(
                 type="metrics",
-                data_path="alerts/test_scenarios/threshold_not_equal_to_average/alert_data.jsonl",
+                data_path="ruler/test_scenarios/threshold_not_equal_to_average/alert_data.jsonl",
             ),
         ],
         alert_expectation=types.AlertExpectation(
@@ -449,11 +449,11 @@ TEST_RULES_MATCH_TYPE_AND_COMPARE_OPERATORS = [
     ),
     types.AlertTestCase(
         name="test_threshold_not_equal_to_last",
-        rule_path="alerts/test_scenarios/threshold_not_equal_to_last/rule.json",
+        rule_path="ruler/test_scenarios/threshold_not_equal_to_last/rule.json",
         alert_data=[
             types.AlertData(
                 type="metrics",
-                data_path="alerts/test_scenarios/threshold_not_equal_to_last/alert_data.jsonl",
+                data_path="ruler/test_scenarios/threshold_not_equal_to_last/alert_data.jsonl",
             ),
         ],
         alert_expectation=types.AlertExpectation(
@@ -475,11 +475,11 @@ TEST_RULES_MATCH_TYPE_AND_COMPARE_OPERATORS = [
 TEST_RULES_UNIT_CONVERSION = [
     types.AlertTestCase(
         name="test_unit_conversion_bytes_to_mb",
-        rule_path="alerts/test_scenarios/unit_conversion_bytes_to_mb/rule.json",
+        rule_path="ruler/test_scenarios/unit_conversion_bytes_to_mb/rule.json",
         alert_data=[
             types.AlertData(
                 type="metrics",
-                data_path="alerts/test_scenarios/unit_conversion_bytes_to_mb/alert_data.jsonl",
+                data_path="ruler/test_scenarios/unit_conversion_bytes_to_mb/alert_data.jsonl",
             ),
         ],
         alert_expectation=types.AlertExpectation(
@@ -497,11 +497,11 @@ TEST_RULES_UNIT_CONVERSION = [
     ),
     types.AlertTestCase(
         name="test_unit_conversion_ms_to_second",
-        rule_path="alerts/test_scenarios/unit_conversion_ms_to_second/rule.json",
+        rule_path="ruler/test_scenarios/unit_conversion_ms_to_second/rule.json",
         alert_data=[
             types.AlertData(
                 type="metrics",
-                data_path="alerts/test_scenarios/unit_conversion_ms_to_second/alert_data.jsonl",
+                data_path="ruler/test_scenarios/unit_conversion_ms_to_second/alert_data.jsonl",
             ),
         ],
         alert_expectation=types.AlertExpectation(
@@ -523,11 +523,11 @@ TEST_RULES_UNIT_CONVERSION = [
 TEST_RULES_MISCELLANEOUS = [
     types.AlertTestCase(
         name="test_no_data_rule_test",
-        rule_path="alerts/test_scenarios/no_data_rule_test/rule.json",
+        rule_path="ruler/test_scenarios/no_data_rule_test/rule.json",
         alert_data=[
             types.AlertData(
                 type="metrics",
-                data_path="alerts/test_scenarios/no_data_rule_test/alert_data.jsonl",
+                data_path="ruler/test_scenarios/no_data_rule_test/alert_data.jsonl",
             ),
         ],
         alert_expectation=types.AlertExpectation(
@@ -547,11 +547,11 @@ TEST_RULES_MISCELLANEOUS = [
     # after the [issue](https://github.com/SigNoz/engineering-pod/issues/3934) with alertManager is resolved
     # types.AlertTestCase(
     #     name="test_multi_threshold_rule_test",
-    #     rule_path="alerts/test_scenarios/multi_threshold_rule_test/rule.json",
+    #     rule_path="ruler/test_scenarios/multi_threshold_rule_test/rule.json",
     #     alert_data=[
     #         types.AlertData(
     #             type="metrics",
-    #             data_path="alerts/test_scenarios/multi_threshold_rule_test/alert_data.jsonl",
+    #             data_path="ruler/test_scenarios/multi_threshold_rule_test/alert_data.jsonl",
     #         ),
     #     ],
     #     alert_expectation=types.AlertExpectation(

tests/integration/tests/ruler/02_rule_state_history.py

@@ -29,10 +29,10 @@ def test_logs_rule_history_related_links(
     query_start_ms = int((datetime.now(tz=UTC) - timedelta(minutes=30)).timestamp() * 1000)
 
     insert_alert_data(
-        [types.AlertData(type="logs", data_path="alerts/test_scenarios/rule_state_history_logs/alert_data.jsonl")],
+        [types.AlertData(type="logs", data_path="ruler/test_scenarios/rule_state_history_logs/alert_data.jsonl")],
         base_time=datetime.now(tz=UTC) - timedelta(minutes=5),
     )
-    rule_id = create_alert_rule_with_channel("alerts/test_scenarios/rule_state_history_logs/rule.json")
+    rule_id = create_alert_rule_with_channel("ruler/test_scenarios/rule_state_history_logs/rule.json")
 
     (item, query_end_ms) = wait_for_firing_timeline_entry(signoz, token, rule_id, query_start_ms)
 
@@ -73,10 +73,10 @@ def test_traces_rule_history_related_links(
     query_start_ms = int((datetime.now(tz=UTC) - timedelta(minutes=30)).timestamp() * 1000)
 
     insert_alert_data(
-        [types.AlertData(type="traces", data_path="alerts/test_scenarios/rule_state_history_traces/alert_data.jsonl")],
+        [types.AlertData(type="traces", data_path="ruler/test_scenarios/rule_state_history_traces/alert_data.jsonl")],
         base_time=datetime.now(tz=UTC) - timedelta(minutes=5),
     )
-    rule_id = create_alert_rule_with_channel("alerts/test_scenarios/rule_state_history_traces/rule.json")
+    rule_id = create_alert_rule_with_channel("ruler/test_scenarios/rule_state_history_traces/rule.json")
 
     (item, query_end_ms) = wait_for_firing_timeline_entry(signoz, token, rule_id, query_start_ms)
 
@@ -117,10 +117,10 @@ def test_ai_traces_rule_history_related_links(
     query_start_ms = int((datetime.now(tz=UTC) - timedelta(minutes=30)).timestamp() * 1000)
 
     insert_alert_data(
-        [types.AlertData(type="traces", data_path="alerts/test_scenarios/rule_state_history_ai_traces/alert_data.jsonl")],
+        [types.AlertData(type="traces", data_path="ruler/test_scenarios/rule_state_history_ai_traces/alert_data.jsonl")],
         base_time=datetime.now(tz=UTC) - timedelta(minutes=5),
     )
-    rule_id = create_alert_rule_with_channel("alerts/test_scenarios/rule_state_history_ai_traces/rule.json")
+    rule_id = create_alert_rule_with_channel("ruler/test_scenarios/rule_state_history_ai_traces/rule.json")
 
     (item, query_end_ms) = wait_for_firing_timeline_entry(signoz, token, rule_id, query_start_ms)
 

tests/integration/tests/ruler/03_promql_subquery_no_step.py

@@ -14,11 +14,11 @@ from fixtures.fs import get_testdata_file_path
 
 TEST_CASE = types.AlertTestCase(
     name="promql_subquery_no_step",
-    rule_path="alerts/test_scenarios/promql_subquery_no_step/rule.json",
+    rule_path="ruler/test_scenarios/promql_subquery_no_step/rule.json",
     alert_data=[
         types.AlertData(
             type="metrics",
-            data_path="alerts/test_scenarios/promql_subquery_no_step/alert_data.jsonl",
+            data_path="ruler/test_scenarios/promql_subquery_no_step/alert_data.jsonl",
         ),
     ],
     alert_expectation=types.AlertExpectation(

tests/integration/tests/ruler/04_disabled_rule.py

@@ -40,7 +40,7 @@ def test_disabled_rule_does_not_evaluate_or_notify(
     A rule created with disabled: true must not be evaluated: its state must
     stay "disabled" and it must not send any notification, even though the
     inserted data would fire the rule if it were evaluated. The companion
-    scenario threshold_above_at_least_once in 02_basic_alert_conditions.py
+    scenario threshold_above_at_least_once in 01_basic_alert_conditions.py
     uses the same data shape and fires when the rule is enabled.
     """
     token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
@@ -78,12 +78,12 @@ def test_disabled_rule_does_not_evaluate_or_notify(
 
     # Insert alert data that would fire the rule if it were evaluated
     insert_alert_data(
-        [types.AlertData(type="metrics", data_path="alerts/test_scenarios/disabled_rule/alert_data.jsonl")],
+        [types.AlertData(type="metrics", data_path="ruler/test_scenarios/disabled_rule/alert_data.jsonl")],
         base_time=datetime.now(tz=UTC) - timedelta(minutes=5),
     )
 
     # Create the disabled alert rule
-    rule_path = get_testdata_file_path("alerts/test_scenarios/disabled_rule/rule.json")
+    rule_path = get_testdata_file_path("ruler/test_scenarios/disabled_rule/rule.json")
     with open(rule_path, encoding="utf-8") as f:
         rule_data = json.loads(f.read())
     update_rule_channel_name(rule_data, notification_channel_name)

tests/integration/tests/ruler/05_list_rules_v3.py

@@ -8,7 +8,7 @@ from fixtures.types import Operation, SigNoz
 
 BASE_URL = "/api/v3/rules"
 
-SEED_CHANNEL = {"name": "list-rules-v3-channel", "email_configs": [{"to": "list-rules-v3@integration.test"}]}
+SEED_CHANNEL_NAME = "list-rules-v3-channel"
 
 EVALUATION = {"kind": "rolling", "spec": {"evalWindow": "5m0s", "frequency": "1m"}}
 
@@ -21,7 +21,7 @@ NOTIFICATION_SETTINGS = {
 METRIC_CONDITION = {
     "thresholds": {
         "kind": "basic",
-        "spec": [{"name": "critical", "target": 90, "matchType": "at_least_once", "op": "above", "channels": ["list-rules-v3-channel"]}],
+        "spec": [{"name": "critical", "target": 90, "matchType": "at_least_once", "op": "above", "channels": [SEED_CHANNEL_NAME]}],
     },
     "compositeQuery": {
         "queryType": "builder",
@@ -43,7 +43,7 @@ METRIC_CONDITION = {
 LOGS_CONDITION = {
     "thresholds": {
         "kind": "basic",
-        "spec": [{"name": "critical", "target": 100, "matchType": "at_least_once", "op": "above", "channels": ["list-rules-v3-channel"]}],
+        "spec": [{"name": "critical", "target": 100, "matchType": "at_least_once", "op": "above", "channels": [SEED_CHANNEL_NAME]}],
     },
     "compositeQuery": {
         "queryType": "builder",
@@ -66,7 +66,7 @@ LOGS_CONDITION = {
 PROMQL_CONDITION = {
     "thresholds": {
         "kind": "basic",
-        "spec": [{"name": "critical", "target": 1, "matchType": "at_least_once", "op": "below", "channels": ["list-rules-v3-channel"]}],
+        "spec": [{"name": "critical", "target": 1, "matchType": "at_least_once", "op": "below", "channels": [SEED_CHANNEL_NAME]}],
     },
     "compositeQuery": {
         "queryType": "promql",
@@ -177,10 +177,10 @@ def test_envelope_and_slim_rows(
     signoz: SigNoz,
     create_user_admin: Operation,  # pylint: disable=unused-argument
     get_token: Callable[[str, str], str],
-    seed_alert_rules: Callable[[dict, list[dict]], None],
+    seed_alert_rules: Callable[[str, list[dict]], None],
 ):
     token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
-    seed_alert_rules(SEED_CHANNEL, SEED_RULES)
+    seed_alert_rules(SEED_CHANNEL_NAME, SEED_RULES)
 
     response = requests.get(
         signoz.self.host_configs["8080"].get(BASE_URL),
@@ -232,10 +232,10 @@ def test_query_filters(
     signoz: SigNoz,
     create_user_admin: Operation,  # pylint: disable=unused-argument
     get_token: Callable[[str, str], str],
-    seed_alert_rules: Callable[[dict, list[dict]], None],
+    seed_alert_rules: Callable[[str, list[dict]], None],
 ):
     token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
-    seed_alert_rules(SEED_CHANNEL, SEED_RULES)
+    seed_alert_rules(SEED_CHANNEL_NAME, SEED_RULES)
 
     cases = [
         ("name = 'payment latency high'", {"payment latency high"}),
@@ -278,10 +278,10 @@ def test_bare_and_collision_keys(
     signoz: SigNoz,
     create_user_admin: Operation,  # pylint: disable=unused-argument
     get_token: Callable[[str, str], str],
-    seed_alert_rules: Callable[[dict, list[dict]], None],
+    seed_alert_rules: Callable[[str, list[dict]], None],
 ):
     token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
-    seed_alert_rules(SEED_CHANNEL, SEED_RULES + [COLLIDER_RULE])
+    seed_alert_rules(SEED_CHANNEL_NAME, SEED_RULES + [COLLIDER_RULE])
 
     cases = [
         # a bare non-reserved key is a label lookup, no labels. prefix needed
@@ -318,10 +318,10 @@ def test_label_missing_semantics(
     signoz: SigNoz,
     create_user_admin: Operation,  # pylint: disable=unused-argument
     get_token: Callable[[str, str], str],
-    seed_alert_rules: Callable[[dict, list[dict]], None],
+    seed_alert_rules: Callable[[str, list[dict]], None],
 ):
     token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
-    seed_alert_rules(SEED_CHANNEL, SEED_RULES)
+    seed_alert_rules(SEED_CHANNEL_NAME, SEED_RULES)
 
     # A missing label uniformly evaluates as the empty string for value
     # operators; presence is expressed with EXISTS / NOT EXISTS.
@@ -355,10 +355,10 @@ def test_states_param(
     signoz: SigNoz,
     create_user_admin: Operation,  # pylint: disable=unused-argument
     get_token: Callable[[str, str], str],
-    seed_alert_rules: Callable[[dict, list[dict]], None],
+    seed_alert_rules: Callable[[str, list[dict]], None],
 ):
     token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
-    seed_alert_rules(SEED_CHANNEL, SEED_RULES)
+    seed_alert_rules(SEED_CHANNEL_NAME, SEED_RULES)
 
     # No telemetry is seeded, so enabled rules sit at inactive and the one
     # disabled rule reads disabled, deterministic without waiting on evals.
@@ -388,10 +388,10 @@ def test_sorting(
     signoz: SigNoz,
     create_user_admin: Operation,  # pylint: disable=unused-argument
     get_token: Callable[[str, str], str],
-    seed_alert_rules: Callable[[dict, list[dict]], None],
+    seed_alert_rules: Callable[[str, list[dict]], None],
 ):
     token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
-    seed_alert_rules(SEED_CHANNEL, SEED_RULES)
+    seed_alert_rules(SEED_CHANNEL_NAME, SEED_RULES)
 
     response = requests.get(
         signoz.self.host_configs["8080"].get(BASE_URL),
@@ -474,10 +474,10 @@ def test_pagination(
     signoz: SigNoz,
     create_user_admin: Operation,  # pylint: disable=unused-argument
     get_token: Callable[[str, str], str],
-    seed_alert_rules: Callable[[dict, list[dict]], None],
+    seed_alert_rules: Callable[[str, list[dict]], None],
 ):
     token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
-    seed_alert_rules(SEED_CHANNEL, SEED_RULES)
+    seed_alert_rules(SEED_CHANNEL_NAME, SEED_RULES)
 
     pages = []
     for offset in (0, 2, 4):
@@ -579,10 +579,10 @@ def test_v2_list_still_serves_bare_array(
     signoz: SigNoz,
     create_user_admin: Operation,  # pylint: disable=unused-argument
     get_token: Callable[[str, str], str],
-    seed_alert_rules: Callable[[dict, list[dict]], None],
+    seed_alert_rules: Callable[[str, list[dict]], None],
 ):
     token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
-    seed_alert_rules(SEED_CHANNEL, SEED_RULES)
+    seed_alert_rules(SEED_CHANNEL_NAME, SEED_RULES)
 
     response = requests.get(
         signoz.self.host_configs["8080"].get("/api/v2/rules"),