Merge remote-tracking branch 'origin/main' into issue_5329

docs/api/openapi.yml

@@ -9621,6 +9621,8 @@ components:
           type: string
         name:
           type: string
+        origin:
+          $ref: '#/components/schemas/SpantypesSpanMapperOrigin'
         updatedAt:
           format: date-time
           type: string
@@ -9633,6 +9635,7 @@ components:
       - fieldContext
       - config
       - enabled
+      - origin
       type: object
     SpantypesSpanMapperConfig:
       properties:
@@ -9661,48 +9664,75 @@ components:
           type: string
         orgId:
           type: string
+        origin:
+          $ref: '#/components/schemas/SpantypesSpanMapperOrigin'
         updatedAt:
           format: date-time
           type: string
         updatedBy:
           type: string
+        version:
+          type: integer
       required:
       - id
       - orgId
       - name
       - condition
       - enabled
+      - origin
+      - version
       type: object
     SpantypesSpanMapperGroupCondition:
       nullable: true
       properties:
         attributes:
           items:
-            type: string
+            $ref: '#/components/schemas/SpantypesSpanMapperGroupConditionKey'
           nullable: true
           type: array
         resource:
           items:
-            type: string
+            $ref: '#/components/schemas/SpantypesSpanMapperGroupConditionKey'
           nullable: true
           type: array
       required:
       - attributes
       - resource
       type: object
+    SpantypesSpanMapperGroupConditionKey:
+      properties:
+        enabled:
+          type: boolean
+        origin:
+          $ref: '#/components/schemas/SpantypesSpanMapperOrigin'
+        value:
+          type: string
+      required:
+      - value
+      - enabled
+      type: object
     SpantypesSpanMapperOperation:
       enum:
       - move
       - copy
       type: string
+    SpantypesSpanMapperOrigin:
+      enum:
+      - user
+      - system
+      type: string
     SpantypesSpanMapperSource:
       properties:
         context:
           $ref: '#/components/schemas/SpantypesFieldContext'
+        enabled:
+          type: boolean
         key:
           type: string
         operation:
           $ref: '#/components/schemas/SpantypesSpanMapperOperation'
+        origin:
+          $ref: '#/components/schemas/SpantypesSpanMapperOrigin'
         priority:
           type: integer
       required:
@@ -9710,6 +9740,7 @@ components:
       - context
       - operation
       - priority
+      - enabled
       type: object
     SpantypesSpanMapperTestSpan:
       properties:

ee/modules/cloudintegration/implcloudintegration/module.go

@@ -583,7 +583,7 @@ func (module *module) deprovisionDashboards(ctx context.Context, orgID valuer.UU
 			return err
 		}
 
-		if err := module.dashboardModule.DeleteUnsafeV2(ctx, orgID, dashID); err != nil {
+		if err := module.dashboardModule.DeleteUnsafe(ctx, orgID, dashID); err != nil {
 			return err
 		}
 	}

ee/modules/dashboard/impldashboard/module.go

@@ -297,15 +297,6 @@ func (module *module) DeleteV2(ctx context.Context, orgID valuer.UUID, id valuer
 	})
 }
 
-func (module *module) DeleteUnsafeV2(ctx context.Context, orgID valuer.UUID, id valuer.UUID) error {
-	return module.store.RunInTx(ctx, func(ctx context.Context) error {
-		if err := module.store.DeletePublic(ctx, id.String()); err != nil && !errors.Ast(err, errors.TypeNotFound) {
-			return err
-		}
-		return module.pkgDashboardModule.DeleteUnsafeV2(ctx, orgID, id)
-	})
-}
-
 func (module *module) LockUnlockV2(ctx context.Context, orgID valuer.UUID, id valuer.UUID, updatedBy string, isAdmin bool, lock bool) error {
 	return module.pkgDashboardModule.LockUnlockV2(ctx, orgID, id, updatedBy, isAdmin, lock)
 }

frontend/src/api/generated/services/sigNoz.schemas.ts

@@ -10682,6 +10682,22 @@ export interface SpantypesGettableFlamegraphTraceDTO {
 	startTimestampMillis: number;
 }
 
+export enum SpantypesSpanMapperOriginDTO {
+	user = 'user',
+	system = 'system',
+}
+export interface SpantypesSpanMapperGroupConditionKeyDTO {
+	/**
+	 * @type boolean
+	 */
+	enabled: boolean;
+	origin?: SpantypesSpanMapperOriginDTO;
+	/**
+	 * @type string
+	 */
+	value: string;
+}
+
 /**
  * @nullable
  */
@@ -10689,11 +10705,11 @@ export type SpantypesSpanMapperGroupConditionDTO = {
 	/**
 	 * @type array,null
 	 */
-	attributes: string[] | null;
+	attributes: SpantypesSpanMapperGroupConditionKeyDTO[] | null;
 	/**
 	 * @type array,null
 	 */
-	resource: string[] | null;
+	resource: SpantypesSpanMapperGroupConditionKeyDTO[] | null;
 } | null;
 
 export interface SpantypesSpanMapperGroupDTO {
@@ -10723,6 +10739,7 @@ export interface SpantypesSpanMapperGroupDTO {
 	 * @type string
 	 */
 	orgId: string;
+	origin: SpantypesSpanMapperOriginDTO;
 	/**
 	 * @type string
 	 * @format date-time
@@ -10732,6 +10749,10 @@ export interface SpantypesSpanMapperGroupDTO {
 	 * @type string
 	 */
 	updatedBy?: string;
+	/**
+	 * @type integer
+	 */
+	version: number;
 }
 
 export interface SpantypesGettableSpanMapperGroupsDTO {
@@ -10789,11 +10810,16 @@ export enum SpantypesSpanMapperOperationDTO {
 }
 export interface SpantypesSpanMapperSourceDTO {
 	context: SpantypesFieldContextDTO;
+	/**
+	 * @type boolean
+	 */
+	enabled: boolean;
 	/**
 	 * @type string
 	 */
 	key: string;
 	operation: SpantypesSpanMapperOperationDTO;
+	origin?: SpantypesSpanMapperOriginDTO;
 	/**
 	 * @type integer
 	 */
@@ -10835,6 +10861,7 @@ export interface SpantypesSpanMapperDTO {
 	 * @type string
 	 */
 	name: string;
+	origin: SpantypesSpanMapperOriginDTO;
 	/**
 	 * @type string
 	 * @format date-time

frontend/src/api/querySuggestions/__tests__/getFieldKeySuggestions.test.ts

@@ -1,74 +0,0 @@
-import { getAIObservabilityFieldsKeys } from 'api/generated/services/ai-observability';
-import { getFieldsKeys } from 'api/generated/services/fields';
-import { TelemetrytypesSignalDTO } from 'api/generated/services/sigNoz.schemas';
-
-import { getFieldKeySuggestions } from '../getFieldKeySuggestions';
-import { FieldKeysResponse } from '../types';
-
-jest.mock('api/generated/services/ai-observability', () => ({
-	getAIObservabilityFieldsKeys: jest.fn(),
-}));
-
-jest.mock('api/generated/services/fields', () => ({
-	getFieldsKeys: jest.fn(),
-}));
-
-const mockedAIKeys = getAIObservabilityFieldsKeys as jest.MockedFunction<
-	typeof getAIObservabilityFieldsKeys
->;
-const mockedGenericKeys = getFieldsKeys as jest.MockedFunction<
-	typeof getFieldsKeys
->;
-
-const keysResponse = (): FieldKeysResponse => ({
-	status: 'success',
-	data: {
-		complete: true,
-		keys: { llm_call_count: [{ name: 'llm_call_count' }] },
-	},
-});
-
-describe('getFieldKeySuggestions', () => {
-	beforeEach(() => {
-		jest.clearAllMocks();
-	});
-
-	it('reads the ai_observability endpoint for a builder_ai_query', async () => {
-		const response = keysResponse();
-		mockedAIKeys.mockResolvedValue(response);
-
-		const fieldKeysConfig = { searchText: 'llm' };
-		const abortSignal = new AbortController().signal;
-
-		await expect(
-			getFieldKeySuggestions(fieldKeysConfig, 'builder_ai_query', abortSignal),
-		).resolves.toBe(response);
-		expect(mockedAIKeys).toHaveBeenCalledWith(fieldKeysConfig, abortSignal);
-		expect(mockedGenericKeys).not.toHaveBeenCalled();
-	});
-
-	it.each<
-		[
-			'an unmarked query' | 'an explicitly generic query',
-			undefined | 'builder_query',
-		]
-	>([
-		['an unmarked query', undefined],
-		['an explicitly generic query', 'builder_query'],
-	])('reads the generic endpoint for %s', async (_label, builderQueryType) => {
-		const response = keysResponse();
-		mockedGenericKeys.mockResolvedValue(response);
-
-		const fieldKeysConfig = {
-			signal: TelemetrytypesSignalDTO.traces,
-			searchText: 'svc',
-		};
-		const abortSignal = new AbortController().signal;
-
-		await expect(
-			getFieldKeySuggestions(fieldKeysConfig, builderQueryType, abortSignal),
-		).resolves.toBe(response);
-		expect(mockedGenericKeys).toHaveBeenCalledWith(fieldKeysConfig, abortSignal);
-		expect(mockedAIKeys).not.toHaveBeenCalled();
-	});
-});

frontend/src/api/querySuggestions/__tests__/getFieldValueSuggestions.test.ts

@@ -1,75 +0,0 @@
-import { getAIObservabilityFieldsValues } from 'api/generated/services/ai-observability';
-import { getFieldsValues } from 'api/generated/services/fields';
-import { TelemetrytypesSignalDTO } from 'api/generated/services/sigNoz.schemas';
-
-import { getFieldValueSuggestions } from '../getFieldValueSuggestions';
-import { FieldValuesResponse } from '../types';
-
-jest.mock('api/generated/services/ai-observability', () => ({
-	getAIObservabilityFieldsValues: jest.fn(),
-}));
-
-jest.mock('api/generated/services/fields', () => ({
-	getFieldsValues: jest.fn(),
-}));
-
-const mockedAIValues = getAIObservabilityFieldsValues as jest.MockedFunction<
-	typeof getAIObservabilityFieldsValues
->;
-const mockedGenericValues = getFieldsValues as jest.MockedFunction<
-	typeof getFieldsValues
->;
-
-const valuesResponse = (): FieldValuesResponse => ({
-	status: 'success',
-	data: { complete: true, values: { stringValues: ['gpt-4o'] } },
-});
-
-describe('getFieldValueSuggestions', () => {
-	beforeEach(() => {
-		jest.clearAllMocks();
-	});
-
-	it('reads the ai_observability endpoint for a builder_ai_query, forwarding the key as name', async () => {
-		const response = valuesResponse();
-		mockedAIValues.mockResolvedValue(response);
-
-		const fieldValuesConfig = { name: 'gen_ai.request.model', searchText: 'gpt' };
-		const abortSignal = new AbortController().signal;
-
-		await expect(
-			getFieldValueSuggestions(fieldValuesConfig, 'builder_ai_query', abortSignal),
-		).resolves.toBe(response);
-		expect(mockedAIValues).toHaveBeenCalledWith(fieldValuesConfig, abortSignal);
-		expect(mockedGenericValues).not.toHaveBeenCalled();
-	});
-
-	it.each<
-		[
-			'an unmarked query' | 'an explicitly generic query',
-			undefined | 'builder_query',
-		]
-	>([
-		['an unmarked query', undefined],
-		['an explicitly generic query', 'builder_query'],
-	])('reads the generic endpoint for %s', async (_label, builderQueryType) => {
-		const response = valuesResponse();
-		mockedGenericValues.mockResolvedValue(response);
-
-		const fieldValuesConfig = {
-			signal: TelemetrytypesSignalDTO.traces,
-			name: 'service.name',
-			searchText: 'front',
-		};
-		const abortSignal = new AbortController().signal;
-
-		await expect(
-			getFieldValueSuggestions(fieldValuesConfig, builderQueryType, abortSignal),
-		).resolves.toBe(response);
-		expect(mockedGenericValues).toHaveBeenCalledWith(
-			fieldValuesConfig,
-			abortSignal,
-		);
-		expect(mockedAIValues).not.toHaveBeenCalled();
-	});
-});

frontend/src/api/querySuggestions/getFieldKeySuggestions.ts

@@ -1,14 +0,0 @@
-import { getAIObservabilityFieldsKeys } from 'api/generated/services/ai-observability';
-import { getFieldsKeys } from 'api/generated/services/fields';
-import type { BuilderQueryType } from 'types/api/v5/queryRange';
-
-import { FieldKeysConfig, FieldKeysResponse } from './types';
-
-export const getFieldKeySuggestions = (
-	fieldKeysConfig: FieldKeysConfig,
-	builderQueryType?: BuilderQueryType,
-	abortSignal?: AbortSignal,
-): Promise<FieldKeysResponse> =>
-	builderQueryType === 'builder_ai_query'
-		? getAIObservabilityFieldsKeys(fieldKeysConfig, abortSignal)
-		: getFieldsKeys(fieldKeysConfig, abortSignal);

frontend/src/api/querySuggestions/getFieldValueSuggestions.ts

@@ -1,14 +0,0 @@
-import { getAIObservabilityFieldsValues } from 'api/generated/services/ai-observability';
-import { getFieldsValues } from 'api/generated/services/fields';
-import type { BuilderQueryType } from 'types/api/v5/queryRange';
-
-import { FieldValuesConfig, FieldValuesResponse } from './types';
-
-export const getFieldValueSuggestions = (
-	fieldValuesConfig: FieldValuesConfig,
-	builderQueryType?: BuilderQueryType,
-	abortSignal?: AbortSignal,
-): Promise<FieldValuesResponse> =>
-	builderQueryType === 'builder_ai_query'
-		? getAIObservabilityFieldsValues(fieldValuesConfig, abortSignal)
-		: getFieldsValues(fieldValuesConfig, abortSignal);

frontend/src/api/querySuggestions/types.ts

@@ -1,31 +0,0 @@
-import type {
-	GetAIObservabilityFieldsKeys200,
-	GetAIObservabilityFieldsValues200,
-	GetAIObservabilityFieldsKeysParams,
-	GetAIObservabilityFieldsValuesParams,
-	GetFieldsKeys200,
-	GetFieldsKeysParams,
-	GetFieldsValues200,
-	GetFieldsValuesParams,
-} from 'api/generated/services/sigNoz.schemas';
-
-export type FieldKeysConfig =
-	| GetFieldsKeysParams
-	| GetAIObservabilityFieldsKeysParams;
-
-export type FieldValuesConfig =
-	| GetFieldsValuesParams
-	| GetAIObservabilityFieldsValuesParams;
-
-export type FieldKeysConfigProp = Omit<
-	FieldKeysConfig,
-	'signal' | 'searchText'
->;
-
-export type FieldKeysResponse =
-	| GetFieldsKeys200
-	| GetAIObservabilityFieldsKeys200;
-
-export type FieldValuesResponse =
-	| GetFieldsValues200
-	| GetAIObservabilityFieldsValues200;

frontend/src/components/FieldsSelector/FieldsSelector.tsx

@@ -6,8 +6,7 @@ import useDebouncedFn from 'hooks/useDebouncedFunction';
 import { Check, TableColumnsSplit, X } from '@signozhq/icons';
 import { FloatingPanel } from 'periscope/components/FloatingPanel';
 import { buildCompositeKey } from 'container/OptionsMenu/utils';
-import { FieldKeysConfigProp } from 'api/querySuggestions/types';
-import { BuilderQueryType, TelemetryFieldKey } from 'types/api/v5/queryRange';
+import { TelemetryFieldKey } from 'types/api/v5/queryRange';
 import { DataSource } from 'types/common/queryBuilder';
 
 import AddedFields from './AddedFields';
@@ -32,9 +31,6 @@ interface FieldsSelectorProps {
 	// Lets users add a free-typed field which
 	// does not show up in the suggestions
 	allowCustomFields?: boolean;
-	fieldKeysConfig?: FieldKeysConfigProp;
-	builderQueryType?: BuilderQueryType;
-	extraFields?: TelemetryFieldKey[];
 	width?: number;
 	height?: number;
 	defaultPosition?: { x: number; y: number };
@@ -54,9 +50,6 @@ function FieldsSelectorContent({
 	maxFields,
 	requiredFields,
 	allowCustomFields,
-	fieldKeysConfig,
-	builderQueryType,
-	extraFields,
 	width = DEFAULT_PANEL_WIDTH,
 	height,
 	defaultPosition,
@@ -165,9 +158,6 @@ function FieldsSelectorContent({
 					onAdd={handleAdd}
 					isAtLimit={isAtLimit}
 					allowCustomFields={allowCustomFields}
-					fieldKeysConfig={fieldKeysConfig}
-					builderQueryType={builderQueryType}
-					extraFields={extraFields}
 				/>
 
 				{hasUnsavedChanges && (

frontend/src/components/FieldsSelector/OtherFields.tsx

@@ -3,22 +3,18 @@ import { Button } from '@signozhq/ui/button';
 import { Skeleton } from 'antd';
 import cx from 'classnames';
 import OverlayScrollbar from 'components/OverlayScrollbar/OverlayScrollbar';
+import { REACT_QUERY_KEY } from 'constants/reactQueryKeys';
 import { buildCompositeKey } from 'container/OptionsMenu/utils';
-import { FieldKeysConfigProp } from 'api/querySuggestions/types';
-import { useFieldKeysSuggestion } from 'hooks/querySuggestions/useFieldKeysSuggestion';
+import { useGetQueryKeySuggestions } from 'hooks/querySuggestions/useGetQueryKeySuggestions';
 import {
-	BuilderQueryType,
 	FieldContext,
 	SignalType,
 	TelemetryFieldKey,
 } from 'types/api/v5/queryRange';
-import { DATA_SOURCE_TO_SIGNAL, DataSource } from 'types/common/queryBuilder';
-import { mergeExtraFields } from 'utils/extraFields';
+import { DataSource } from 'types/common/queryBuilder';
 
 import styles from './FieldsSelector.module.scss';
 
-const EMPTY_EXTRA_FIELDS: TelemetryFieldKey[] = [];
-
 interface OtherFieldsProps {
 	signal: DataSource;
 	debouncedInputValue: string;
@@ -26,9 +22,6 @@ interface OtherFieldsProps {
 	onAdd: (field: TelemetryFieldKey) => void;
 	isAtLimit: boolean;
 	allowCustomFields?: boolean;
-	fieldKeysConfig?: FieldKeysConfigProp;
-	builderQueryType?: BuilderQueryType;
-	extraFields?: TelemetryFieldKey[];
 }
 
 function OtherFields({
@@ -38,26 +31,26 @@ function OtherFields({
 	onAdd,
 	isAtLimit,
 	allowCustomFields,
-	fieldKeysConfig,
-	builderQueryType,
-	extraFields = EMPTY_EXTRA_FIELDS,
 }: OtherFieldsProps): JSX.Element {
-	const { data: fetchedFields, isFetching } = useFieldKeysSuggestion(
+	const { data, isFetching } = useGetQueryKeySuggestions(
 		{
-			...fieldKeysConfig,
-			signal: DATA_SOURCE_TO_SIGNAL[signal],
+			signal,
 			searchText: debouncedInputValue,
 		},
-		builderQueryType,
+		{
+			queryKey: [
+				REACT_QUERY_KEY.GET_FIELDS_SELECTOR_SUGGESTIONS,
+				signal,
+				debouncedInputValue,
+			],
+			enabled: true,
+		},
 	);
 
 	const otherFields = useMemo<TelemetryFieldKey[]>(() => {
-		const search = debouncedInputValue.trim().toLowerCase();
+		const rawSuggestions = Object.values(data?.data.data.keys || {}).flat();
 		// Normalize: synthesize `key` once so downstream reads can trust it.
-		const suggestions: TelemetryFieldKey[] = mergeExtraFields(
-			extraFields.filter((field) => field.name.toLowerCase().includes(search)),
-			fetchedFields ?? [],
-		).map((attr) => ({
+		const suggestions: TelemetryFieldKey[] = rawSuggestions.map((attr) => ({
 			...attr,
 			key: buildCompositeKey(attr.name, attr.fieldContext, attr.fieldDataType),
 			signal: attr.signal as SignalType,
@@ -94,13 +87,7 @@ function OtherFields({
 			key: buildCompositeKey(typed, ''),
 		};
 		return [customField, ...available];
-	}, [
-		extraFields,
-		fetchedFields,
-		addedFields,
-		allowCustomFields,
-		debouncedInputValue,
-	]);
+	}, [data, addedFields, allowCustomFields, debouncedInputValue]);
 
 	if (isFetching) {
 		return (

frontend/src/components/FieldsSelector/__tests__/FieldsSelector.test.tsx

@@ -1,17 +1,11 @@
 import { act, fireEvent, render, screen } from 'tests/test-utils';
+import { useGetQueryKeySuggestions } from 'hooks/querySuggestions/useGetQueryKeySuggestions';
 import { TelemetryFieldKey } from 'types/api/v5/queryRange';
 import { DataSource } from 'types/common/queryBuilder';
 
 import FieldsSelector from '../FieldsSelector';
-import { useFieldKeysSuggestion } from 'hooks/querySuggestions/useFieldKeysSuggestion';
 
-jest.mock('hooks/querySuggestions/useFieldKeysSuggestion', () => ({
-	useFieldKeysSuggestion: jest.fn(() => ({
-		data: undefined,
-		isFetching: false,
-		isFetched: true,
-	})),
-}));
+jest.mock('hooks/querySuggestions/useGetQueryKeySuggestions');
 
 jest.mock('@signozhq/ui/sonner', () => ({
 	...jest.requireActual('@signozhq/ui/sonner'),
@@ -27,15 +21,22 @@ jest.mock('periscope/components/FloatingPanel', () => ({
 }));
 
 const mockSuggestions = (names: string[]): void => {
-	(useFieldKeysSuggestion as jest.Mock).mockReturnValue({
-		data: names.map((name) => ({
-			name,
-			signal: 'logs',
-			fieldDataType: 'string',
-			fieldContext: '',
-		})),
+	(useGetQueryKeySuggestions as jest.Mock).mockReturnValue({
+		data: {
+			data: {
+				data: {
+					keys: {
+						attributeKeys: names.map((name) => ({
+							name,
+							signal: 'logs',
+							fieldDataType: 'string',
+							fieldContext: '',
+						})),
+					},
+				},
+			},
+		},
 		isFetching: false,
-		isFetched: true,
 	});
 };
 

frontend/src/components/FieldsSelector/__tests__/OtherFields.test.tsx

@@ -1,30 +1,29 @@
 import { fireEvent, render, screen } from 'tests/test-utils';
-import { TelemetrytypesFieldContextDTO } from 'api/generated/services/sigNoz.schemas';
-import { FieldKeysConfigProp } from 'api/querySuggestions/types';
-import { useFieldKeysSuggestion } from 'hooks/querySuggestions/useFieldKeysSuggestion';
-import { BuilderQueryType, TelemetryFieldKey } from 'types/api/v5/queryRange';
-import { DATA_SOURCE_TO_SIGNAL, DataSource } from 'types/common/queryBuilder';
+import { useGetQueryKeySuggestions } from 'hooks/querySuggestions/useGetQueryKeySuggestions';
+import { TelemetryFieldKey } from 'types/api/v5/queryRange';
+import { DataSource } from 'types/common/queryBuilder';
 
 import OtherFields from '../OtherFields';
 
-jest.mock('hooks/querySuggestions/useFieldKeysSuggestion', () => ({
-	useFieldKeysSuggestion: jest.fn(() => ({
-		data: undefined,
-		isFetching: false,
-		isFetched: true,
-	})),
-}));
+jest.mock('hooks/querySuggestions/useGetQueryKeySuggestions');
 
 const mockSuggestions = (names: string[]): void => {
-	(useFieldKeysSuggestion as jest.Mock).mockReturnValue({
-		data: names.map((name) => ({
-			name,
-			signal: 'logs',
-			fieldDataType: 'string',
-			fieldContext: '',
-		})),
+	(useGetQueryKeySuggestions as jest.Mock).mockReturnValue({
+		data: {
+			data: {
+				data: {
+					keys: {
+						attributeKeys: names.map((name) => ({
+							name,
+							signal: 'logs',
+							fieldDataType: 'string',
+							fieldContext: '',
+						})),
+					},
+				},
+			},
+		},
 		isFetching: false,
-		isFetched: true,
 	});
 };
 
@@ -83,6 +82,7 @@ describe('OtherFields — custom (free-typed) option', () => {
 		mockSuggestions(['orderId']);
 		renderOtherFields({ debouncedInputValue: 'orderid' });
 
+		// the real suggestion shows, the lowercased custom name does not
 		expect(screen.getByText('orderId')).toBeInTheDocument();
 		expect(screen.queryByText('orderid')).not.toBeInTheDocument();
 	});
@@ -116,126 +116,10 @@ describe('OtherFields — custom (free-typed) option', () => {
 	it('shows the custom option at the field limit but hides its Add button', () => {
 		renderOtherFields({ debouncedInputValue: 'unknown.a.b.c', isAtLimit: true });
 
+		// same as every other row at the limit: name shown, no Add button
 		expect(screen.getByText('unknown.a.b.c')).toBeInTheDocument();
 		expect(
 			screen.queryByRole('button', { name: /add/i }),
 		).not.toBeInTheDocument();
 	});
 });
-
-describe('OtherFields — field keys config', () => {
-	const pool: TelemetryFieldKey[] = [
-		{ name: 'total_tokens', fieldContext: 'trace', fieldDataType: 'float64' },
-		{ name: 'llm_call_count', fieldContext: 'trace', fieldDataType: 'float64' },
-	];
-
-	const fieldKeysConfig: FieldKeysConfigProp = {
-		fieldContext: TelemetrytypesFieldContextDTO.trace,
-	};
-	const builderQueryType: BuilderQueryType = 'builder_ai_query';
-
-	const mockPool = (fields: TelemetryFieldKey[]): void => {
-		(useFieldKeysSuggestion as jest.Mock).mockReturnValue({
-			data: fields,
-			isFetching: false,
-			isFetched: true,
-		});
-	};
-
-	beforeEach(() => {
-		mockPool(pool);
-	});
-
-	it('lists the pool it is handed', () => {
-		renderOtherFields({
-			fieldKeysConfig,
-			builderQueryType,
-			allowCustomFields: false,
-		});
-
-		expect(screen.getByText('total_tokens')).toBeInTheDocument();
-		expect(screen.getByText('llm_call_count')).toBeInTheDocument();
-	});
-
-	it('forwards the fetch params and search to the shared keys hook', () => {
-		renderOtherFields({
-			fieldKeysConfig,
-			builderQueryType,
-			allowCustomFields: false,
-			debouncedInputValue: 'llm',
-		});
-
-		expect(useFieldKeysSuggestion).toHaveBeenCalledWith(
-			{
-				...fieldKeysConfig,
-				signal: DATA_SOURCE_TO_SIGNAL[DataSource.LOGS],
-				searchText: 'llm',
-			},
-			builderQueryType,
-		);
-	});
-
-	it('lists extra fields the keys endpoint never returns', () => {
-		mockPool([{ name: 'total_tokens' } as TelemetryFieldKey]);
-
-		renderOtherFields({
-			fieldKeysConfig,
-			builderQueryType,
-			extraFields: [{ name: 'last_activity_time' } as TelemetryFieldKey],
-			allowCustomFields: false,
-		});
-
-		expect(screen.getByText('last_activity_time')).toBeInTheDocument();
-		expect(screen.getByText('total_tokens')).toBeInTheDocument();
-	});
-
-	it('filters extra fields by search text', () => {
-		mockPool([]);
-
-		renderOtherFields({
-			fieldKeysConfig,
-			builderQueryType,
-			extraFields: [
-				{ name: 'last_activity_time' } as TelemetryFieldKey,
-				{ name: 'timestamp' } as TelemetryFieldKey,
-			],
-			debouncedInputValue: 'activity',
-			allowCustomFields: false,
-		});
-
-		expect(screen.getByText('last_activity_time')).toBeInTheDocument();
-		expect(screen.queryByText('timestamp')).not.toBeInTheDocument();
-	});
-
-	it('keeps a fetched key whose name does not contain the search text', () => {
-		mockPool([
-			{ name: 'service.name', fieldContext: 'resource' } as TelemetryFieldKey,
-		]);
-
-		renderOtherFields({
-			debouncedInputValue: 'resource.service',
-			allowCustomFields: false,
-		});
-
-		expect(screen.getByText('service.name')).toBeInTheDocument();
-	});
-
-	it('omits pool fields that are already added', () => {
-		renderOtherFields({
-			fieldKeysConfig,
-			builderQueryType,
-			allowCustomFields: false,
-			addedFields: [
-				{
-					name: 'total_tokens',
-					fieldContext: 'trace',
-					fieldDataType: 'float64',
-					key: 'trace:total_tokens:float64',
-				},
-			],
-		});
-
-		expect(screen.queryByText('total_tokens')).not.toBeInTheDocument();
-		expect(screen.getByText('llm_call_count')).toBeInTheDocument();
-	});
-});

frontend/src/components/OrderBy/ListViewOrderBy.tsx

@@ -1,23 +1,16 @@
 import { useEffect, useRef, useState } from 'react';
+import { useQuery } from 'react-query';
 import { Select, Spin } from 'antd';
-import { FieldKeysConfigProp } from 'api/querySuggestions/types';
-import { useFieldKeysSuggestion } from 'hooks/querySuggestions/useFieldKeysSuggestion';
-import { BuilderQueryType, TelemetryFieldKey } from 'types/api/v5/queryRange';
-import { DATA_SOURCE_TO_SIGNAL, DataSource } from 'types/common/queryBuilder';
+import { getKeySuggestions } from 'api/querySuggestions/getKeySuggestions';
+import { QueryKeyDataSuggestionsProps } from 'types/api/querySuggestions/types';
+import { DataSource } from 'types/common/queryBuilder';
 
 import './ListViewOrderBy.styles.scss';
 
-const DEFAULT_EXTRA_FIELDS: TelemetryFieldKey[] = [
-	{ name: 'timestamp' } as TelemetryFieldKey,
-];
-
 interface ListViewOrderByProps {
 	value: string;
 	onChange: (value: string) => void;
 	dataSource: DataSource;
-	fieldKeysConfig?: FieldKeysConfigProp;
-	builderQueryType?: BuilderQueryType;
-	extraFields?: TelemetryFieldKey[];
 }
 
 // Loader component for the dropdown when loading or no results
@@ -33,9 +26,6 @@ function ListViewOrderBy({
 	value,
 	onChange,
 	dataSource,
-	fieldKeysConfig,
-	builderQueryType,
-	extraFields = DEFAULT_EXTRA_FIELDS,
 }: ListViewOrderByProps): JSX.Element {
 	const [searchInput, setSearchInput] = useState('');
 	const [debouncedInput, setDebouncedInput] = useState('');
@@ -44,14 +34,17 @@ function ListViewOrderBy({
 	>([]);
 	const debounceTimer = useRef<ReturnType<typeof setTimeout> | null>(null);
 
-	const { data, isLoading } = useFieldKeysSuggestion(
-		{
-			...fieldKeysConfig,
-			signal: DATA_SOURCE_TO_SIGNAL[dataSource],
-			searchText: debouncedInput,
+	// Fetch key suggestions based on debounced input
+	const { data, isLoading } = useQuery({
+		queryKey: ['orderByKeySuggestions', dataSource, debouncedInput],
+		queryFn: async () => {
+			const response = await getKeySuggestions({
+				signal: dataSource,
+				searchText: debouncedInput,
+			});
+			return response.data;
 		},
-		builderQueryType,
-	);
+	});
 
 	useEffect(
 		() => (): void => {
@@ -62,24 +55,24 @@ function ListViewOrderBy({
 		[],
 	);
 
-	const extraKeysSignature = extraFields.map((field) => field.name).join(',');
-
 	// Update options when API data changes
 	useEffect(() => {
-		const keyNames = (data ?? []).map((field) => field.name);
-		const search = searchInput.trim().toLowerCase();
-		const extraMatches = extraKeysSignature
-			.split(',')
-			.filter((key) => key.length > 0 && key.toLowerCase().includes(search));
-		const uniqueKeys = [...new Set([...extraMatches, ...keyNames])];
+		const rawKeys: QueryKeyDataSuggestionsProps[] = data?.data?.keys
+			? Object.values(data.data?.keys).flat()
+			: [];
 
-		setSelectOptions(
-			uniqueKeys.flatMap((key) => [
-				{ label: `${key} (desc)`, value: `${key}:desc` },
-				{ label: `${key} (asc)`, value: `${key}:asc` },
-			]),
-		);
-	}, [data, searchInput, extraKeysSignature]);
+		const keyNames = rawKeys.map((key) => key.name);
+		const uniqueKeys = [
+			...new Set(searchInput ? keyNames : ['timestamp', ...keyNames]),
+		];
+
+		const updatedOptions = uniqueKeys.flatMap((key) => [
+			{ label: `${key} (desc)`, value: `${key}:desc` },
+			{ label: `${key} (asc)`, value: `${key}:asc` },
+		]);
+
+		setSelectOptions(updatedOptions);
+	}, [data, searchInput]);
 
 	// Handle search input with debounce
 	const handleSearch = (input: string): void => {

frontend/src/components/OrderBy/__tests__/ListViewOrderBy.test.tsx

@@ -1,169 +0,0 @@
-import { fireEvent, render, screen, waitFor } from 'tests/test-utils';
-import { ENVIRONMENT } from 'constants/env';
-import {
-	TRACE_VIEW_BUILDER_QUERY_TYPE,
-	TRACE_VIEW_FIELD_KEYS,
-	TRACE_VIEW_ORDER_BY_EXTRA_FIELDS,
-} from 'container/LLMObservability/Explorer/constants';
-import { server } from 'mocks-server/server';
-import { rest } from 'msw';
-import { TelemetrytypesFieldContextDTO } from 'api/generated/services/sigNoz.schemas';
-import { DataSource } from 'types/common/queryBuilder';
-
-import ListViewOrderBy from '../ListViewOrderBy';
-
-const seenAI: URLSearchParams[] = [];
-const seenGeneric: URLSearchParams[] = [];
-
-const mockAIKeys = (names: string[]): void => {
-	server.use(
-		rest.get(
-			`${ENVIRONMENT.baseURL}/api/v1/ai_observability/fields/keys`,
-			(req, res, ctx) => {
-				seenAI.push(req.url.searchParams);
-				return res(
-					ctx.status(200),
-					ctx.json({
-						status: 'success',
-						data: {
-							complete: true,
-							keys: Object.fromEntries(names.map((name) => [name, [{ name }]])),
-						},
-					}),
-				);
-			},
-		),
-	);
-};
-
-const mockGenericKeys = (names: string[]): void => {
-	server.use(
-		rest.get(`${ENVIRONMENT.baseURL}/api/v1/fields/keys`, (req, res, ctx) => {
-			seenGeneric.push(req.url.searchParams);
-			return res(
-				ctx.status(200),
-				ctx.json({
-					status: 'success',
-					data: {
-						complete: true,
-						keys: Object.fromEntries(names.map((name) => [name, [{ name }]])),
-					},
-				}),
-			);
-		}),
-	);
-};
-
-const openDropdown = (): void => {
-	fireEvent.mouseDown(screen.getByRole('combobox'));
-};
-
-const getOptionLabels = (): string[] =>
-	Array.from(document.querySelectorAll('.ant-select-item-option-content')).map(
-		(node) => node.textContent ?? '',
-	);
-
-describe('ListViewOrderBy', () => {
-	beforeEach(() => {
-		seenAI.length = 0;
-		seenGeneric.length = 0;
-	});
-
-	it('reads the ai_observability trace context for an AI query', async () => {
-		mockAIKeys(['total_tokens']);
-
-		render(
-			<ListViewOrderBy
-				value="last_activity_time:desc"
-				onChange={jest.fn()}
-				dataSource={DataSource.TRACES}
-				fieldKeysConfig={TRACE_VIEW_FIELD_KEYS}
-				builderQueryType={TRACE_VIEW_BUILDER_QUERY_TYPE}
-				extraFields={TRACE_VIEW_ORDER_BY_EXTRA_FIELDS}
-			/>,
-		);
-
-		await waitFor(() => {
-			expect(seenAI).toHaveLength(1);
-		});
-		expect(seenAI[0]?.get('searchText')).toBe('');
-		expect(seenAI[0]?.get('fieldContext')).toBe(
-			TelemetrytypesFieldContextDTO.trace,
-		);
-		expect(seenGeneric).toHaveLength(0);
-	});
-
-	it('offers the extra keys alongside the ones the endpoint reports', async () => {
-		mockAIKeys(['total_tokens']);
-
-		render(
-			<ListViewOrderBy
-				value="last_activity_time:desc"
-				onChange={jest.fn()}
-				dataSource={DataSource.TRACES}
-				fieldKeysConfig={TRACE_VIEW_FIELD_KEYS}
-				builderQueryType={TRACE_VIEW_BUILDER_QUERY_TYPE}
-				extraFields={TRACE_VIEW_ORDER_BY_EXTRA_FIELDS}
-			/>,
-		);
-
-		openDropdown();
-
-		await waitFor(() => {
-			expect(getOptionLabels()).toContain('total_tokens (desc)');
-		});
-		expect(getOptionLabels()).toContain('last_activity_time (asc)');
-	});
-
-	it('keeps a matching extra key while searching', async () => {
-		mockAIKeys([]);
-
-		render(
-			<ListViewOrderBy
-				value="last_activity_time:desc"
-				onChange={jest.fn()}
-				dataSource={DataSource.TRACES}
-				fieldKeysConfig={TRACE_VIEW_FIELD_KEYS}
-				builderQueryType={TRACE_VIEW_BUILDER_QUERY_TYPE}
-				extraFields={TRACE_VIEW_ORDER_BY_EXTRA_FIELDS}
-			/>,
-		);
-
-		await waitFor(() => {
-			expect(seenAI.length).toBeGreaterThan(0);
-		});
-
-		openDropdown();
-		fireEvent.change(screen.getByRole('combobox'), {
-			target: { value: 'activity' },
-		});
-
-		await waitFor(() => {
-			expect(getOptionLabels()).toContain('last_activity_time (desc)');
-		});
-	});
-
-	it('defaults to timestamp and the generic endpoint', async () => {
-		mockGenericKeys(['service.name']);
-
-		render(
-			<ListViewOrderBy
-				value="timestamp:desc"
-				onChange={jest.fn()}
-				dataSource={DataSource.TRACES}
-			/>,
-		);
-
-		await waitFor(() => {
-			expect(seenGeneric).toHaveLength(1);
-		});
-		expect(seenGeneric[0]?.get('signal')).toBe(DataSource.TRACES);
-		expect(seenGeneric[0]?.get('searchText')).toBe('');
-
-		openDropdown();
-
-		await waitFor(() => {
-			expect(getOptionLabels()).toContain('timestamp (desc)');
-		});
-	});
-});

frontend/src/components/QueryBuilderV2/QueryV2/QuerySearch/QuerySearch.tsx

@@ -36,7 +36,7 @@ import {
 } from 'types/antlrQueryTypes';
 import { IBuilderQuery } from 'types/api/queryBuilder/queryBuilderData';
 import { QueryKeyDataSuggestionsProps } from 'types/api/querySuggestions/types';
-import { DATA_SOURCE_TO_SIGNAL, DataSource } from 'types/common/queryBuilder';
+import { DataSource } from 'types/common/queryBuilder';
 import {
 	getCurrentValueIndexAtCursor,
 	getQueryContextAtCursor,
@@ -45,13 +45,6 @@ import { validateQuery } from 'utils/queryValidationUtils';
 import { unquote } from 'utils/stringUtils';
 
 import { getRecentQueries } from 'lib/recentQueries/getRecentQueries';
-import type {
-	TelemetrytypesGettableFieldKeysDTOKeysAnyOf,
-	TelemetrytypesSourceDTO,
-	TelemetrytypesTelemetryFieldKeyDTO,
-} from 'api/generated/services/sigNoz.schemas';
-import { getFieldKeySuggestions } from 'api/querySuggestions/getFieldKeySuggestions';
-import { getFieldValueSuggestions } from 'api/querySuggestions/getFieldValueSuggestions';
 import type { SignalType } from 'types/api/v5/queryRange';
 
 import {
@@ -59,6 +52,12 @@ import {
 	SUGGESTION_FETCH_DEBOUNCE_MS,
 	SUGGESTIONS_SECTION,
 } from './constants';
+import {
+	fetchFieldKeysForQuery,
+	fetchFieldValuesForQuery,
+	SuggestedFieldKey,
+	SuggestedFieldKeysByName,
+} from './fieldSuggestions';
 import {
 	combineInitialAndUserExpression,
 	dedupeOptionsByLabel,
@@ -266,10 +265,8 @@ function QuerySearch({
 	const dashboardDynamicVariables = useDynamicVariableSuggestions();
 
 	// Add back the generateOptions function and useEffect
-	const generateOptions = (
-		keys: TelemetrytypesGettableFieldKeysDTOKeysAnyOf,
-	): any[] =>
-		Object.values(keys).flatMap((items: TelemetrytypesTelemetryFieldKeyDTO[]) =>
+	const generateOptions = (keys: SuggestedFieldKeysByName): any[] =>
+		Object.values(keys).flatMap((items: SuggestedFieldKey[]) =>
 			items.map(({ name, fieldDataType, fieldContext }) => ({
 				label: name,
 				type: fieldDataType === 'string' ? 'keyword' : fieldDataType,
@@ -322,19 +319,17 @@ function QuerySearch({
 
 			lastFetchedKeyRef.current = searchText || '';
 
-			const response = await getFieldKeySuggestions(
-				{
-					signal: DATA_SOURCE_TO_SIGNAL[dataSource],
-					searchText: searchText || '',
-					metricName: debouncedMetricName ?? undefined,
-					source: signalSource as TelemetrytypesSourceDTO,
-					metricNamespace,
-				},
-				queryData.builderQueryType,
-			);
+			const response = await fetchFieldKeysForQuery({
+				builderQueryType: queryData.builderQueryType,
+				dataSource,
+				searchText: searchText || '',
+				metricName: debouncedMetricName ?? undefined,
+				signalSource: signalSource as 'meter' | '',
+				metricNamespace,
+			});
 
-			if (response.data.keys) {
-				const { keys } = response.data;
+			if (response.data.data) {
+				const { keys } = response.data.data;
 				const options = generateOptions(keys);
 				// Deduplicate by full variant identity (name + context + data type), NOT by
 				// label. deduping by label removes varient which is not expected. If we need
@@ -502,23 +497,21 @@ function QuerySearch({
 			try {
 				const values = valueSuggestionsOverride
 					? await valueSuggestionsOverride(key, sanitizedSearchText)
-					: await getFieldValueSuggestions(
-							{
-								signal: DATA_SOURCE_TO_SIGNAL[dataSource],
-								name: key,
-								searchText: sanitizedSearchText,
-								source: signalSource as TelemetrytypesSourceDTO,
-								metricName: debouncedMetricName ?? undefined,
-							},
-							queryData.builderQueryType,
-						).then((response) => {
-							const responseData = response.data;
-							const responseDataValues = responseData.values;
-
+					: await fetchFieldValuesForQuery({
+							builderQueryType: queryData.builderQueryType,
+							dataSource,
+							key,
+							searchText: sanitizedSearchText,
+							signalSource: signalSource as 'meter' | '',
+							metricName: debouncedMetricName ?? undefined,
+						}).then((response) => {
+							const responseData = response.data as any;
+							const data = responseData.data || {};
+							const values = data.values || {};
 							return {
-								stringValues: responseDataValues.stringValues ?? [],
-								numberValues: responseDataValues.numberValues ?? [],
-								complete: responseData.complete ?? false,
+								stringValues: values.stringValues || [],
+								numberValues: values.numberValues || [],
+								complete: data.complete ?? false,
 							};
 						});
 

frontend/src/components/QueryBuilderV2/QueryV2/QuerySearch/__tests__/fieldSuggestions.test.ts

@@ -0,0 +1,215 @@
+import {
+	getAIObservabilityFieldsKeys,
+	getAIObservabilityFieldsValues,
+} from 'api/generated/services/ai-observability';
+import { getKeySuggestions } from 'api/querySuggestions/getKeySuggestions';
+import { getValueSuggestions } from 'api/querySuggestions/getValueSuggestion';
+import { DataSource } from 'types/common/queryBuilder';
+
+import {
+	fetchFieldKeysForQuery,
+	fetchFieldValuesForQuery,
+} from '../fieldSuggestions';
+
+jest.mock('api/generated/services/ai-observability', () => ({
+	getAIObservabilityFieldsKeys: jest.fn(),
+	getAIObservabilityFieldsValues: jest.fn(),
+}));
+
+jest.mock('api/querySuggestions/getKeySuggestions', () => ({
+	getKeySuggestions: jest.fn(),
+}));
+
+jest.mock('api/querySuggestions/getValueSuggestion', () => ({
+	getValueSuggestions: jest.fn(),
+}));
+
+const mockedAIKeys = getAIObservabilityFieldsKeys as jest.MockedFunction<
+	typeof getAIObservabilityFieldsKeys
+>;
+const mockedGenericKeys = getKeySuggestions as jest.MockedFunction<
+	typeof getKeySuggestions
+>;
+const mockedAIValues = getAIObservabilityFieldsValues as jest.MockedFunction<
+	typeof getAIObservabilityFieldsValues
+>;
+const mockedGenericValues = getValueSuggestions as jest.MockedFunction<
+	typeof getValueSuggestions
+>;
+
+const aiValuesResponse = (
+	values: { stringValues?: string[]; numberValues?: number[] } | null,
+	complete = true,
+): Awaited<ReturnType<typeof getAIObservabilityFieldsValues>> =>
+	({
+		status: 'success',
+		data: { complete, values },
+	}) as Awaited<ReturnType<typeof getAIObservabilityFieldsValues>>;
+
+describe('fetchFieldKeysForQuery', () => {
+	beforeEach(() => {
+		jest.clearAllMocks();
+	});
+
+	it('reads the ai_observability endpoint for a builder_ai_query', async () => {
+		mockedAIKeys.mockResolvedValue({
+			status: 'success',
+			data: {
+				complete: true,
+				keys: { llm_call_count: [{ name: 'llm_call_count' }] },
+			},
+		} as Awaited<ReturnType<typeof getAIObservabilityFieldsKeys>>);
+
+		const keys = await fetchFieldKeysForQuery({
+			builderQueryType: 'builder_ai_query',
+			dataSource: DataSource.TRACES,
+			searchText: 'llm',
+		});
+
+		expect(mockedAIKeys).toHaveBeenCalledWith({ searchText: 'llm' });
+		expect(mockedGenericKeys).not.toHaveBeenCalled();
+		expect(keys.data.data).toStrictEqual({
+			complete: true,
+			keys: { llm_call_count: [{ name: 'llm_call_count' }] },
+		});
+	});
+
+	it.each<[string, 'builder_query' | undefined]>([
+		['an unmarked query', undefined],
+		['an explicitly generic query', 'builder_query'],
+	])('reads the generic endpoint for %s', async (_label, builderQueryType) => {
+		mockedGenericKeys.mockResolvedValue({
+			data: { status: 'success', data: { complete: true, keys: {} } },
+		} as Awaited<ReturnType<typeof getKeySuggestions>>);
+
+		await fetchFieldKeysForQuery({
+			builderQueryType,
+			dataSource: DataSource.TRACES,
+			searchText: 'svc',
+		});
+
+		expect(mockedAIKeys).not.toHaveBeenCalled();
+		expect(mockedGenericKeys).toHaveBeenCalledWith(
+			expect.objectContaining({ signal: DataSource.TRACES, searchText: 'svc' }),
+		);
+	});
+
+	it('normalizes a null ai_observability keys payload to an empty map', async () => {
+		mockedAIKeys.mockResolvedValue({
+			status: 'success',
+			data: { complete: false, keys: null },
+		} as Awaited<ReturnType<typeof getAIObservabilityFieldsKeys>>);
+
+		const response = await fetchFieldKeysForQuery({
+			builderQueryType: 'builder_ai_query',
+			dataSource: DataSource.TRACES,
+			searchText: '',
+		});
+
+		expect(response.data.data).toStrictEqual({ complete: false, keys: {} });
+	});
+
+	it('passes the generic response through untouched', async () => {
+		const genericResponse = {
+			data: { status: 'success', data: { complete: true, keys: {} } },
+		} as unknown as Awaited<ReturnType<typeof getKeySuggestions>>;
+		mockedGenericKeys.mockResolvedValue(genericResponse);
+
+		await expect(
+			fetchFieldKeysForQuery({
+				builderQueryType: 'builder_query',
+				dataSource: DataSource.TRACES,
+				searchText: '',
+			}),
+		).resolves.toBe(genericResponse);
+	});
+});
+
+describe('fetchFieldValuesForQuery', () => {
+	beforeEach(() => {
+		jest.clearAllMocks();
+	});
+
+	it('reads the ai_observability endpoint for a builder_ai_query', async () => {
+		mockedAIValues.mockResolvedValue(
+			aiValuesResponse({ stringValues: ['gpt-4o'], numberValues: [] }),
+		);
+
+		const response = await fetchFieldValuesForQuery({
+			builderQueryType: 'builder_ai_query',
+			dataSource: DataSource.TRACES,
+			key: 'gen_ai.request.model',
+			searchText: 'gpt',
+		});
+
+		expect(mockedGenericValues).not.toHaveBeenCalled();
+		expect(response).toStrictEqual({
+			data: {
+				data: {
+					complete: true,
+					values: { stringValues: ['gpt-4o'], numberValues: [] },
+				},
+			},
+		});
+	});
+
+	it('forwards the key as the name the endpoint expects', async () => {
+		mockedAIValues.mockResolvedValue(aiValuesResponse({}));
+
+		await fetchFieldValuesForQuery({
+			builderQueryType: 'builder_ai_query',
+			dataSource: DataSource.TRACES,
+			key: 'total_tokens',
+			searchText: '',
+		});
+
+		expect(mockedAIValues).toHaveBeenCalledWith({
+			name: 'total_tokens',
+			searchText: '',
+		});
+	});
+
+	it('wraps the ai_observability payload in the envelope the call site unwraps', async () => {
+		mockedAIValues.mockResolvedValue(aiValuesResponse(null, false));
+
+		await expect(
+			fetchFieldValuesForQuery({
+				builderQueryType: 'builder_ai_query',
+				dataSource: DataSource.TRACES,
+				key: 'llm_call_count',
+				searchText: '',
+			}),
+		).resolves.toStrictEqual({
+			data: { data: { complete: false, values: null } },
+		});
+	});
+
+	it.each<[string, 'builder_query' | undefined]>([
+		['an unmarked query', undefined],
+		['an explicitly generic query', 'builder_query'],
+	])('reads the generic endpoint for %s', async (_label, builderQueryType) => {
+		const genericResponse = {
+			data: {
+				data: { complete: false, values: { stringValues: ['frontend'] } },
+			},
+		} as unknown as Awaited<ReturnType<typeof getValueSuggestions>>;
+		mockedGenericValues.mockResolvedValue(genericResponse);
+
+		const response = await fetchFieldValuesForQuery({
+			builderQueryType,
+			dataSource: DataSource.TRACES,
+			key: 'service.name',
+			searchText: 'front',
+		});
+
+		expect(mockedAIValues).not.toHaveBeenCalled();
+		expect(mockedGenericValues).toHaveBeenCalledWith(
+			expect.objectContaining({
+				signal: DataSource.TRACES,
+				key: 'service.name',
+				searchText: 'front',
+			}),
+		);
+		expect(response).toBe(genericResponse);
+	});
+});

frontend/src/components/QueryBuilderV2/QueryV2/QuerySearch/fieldSuggestions.ts

@@ -0,0 +1,111 @@
+import {
+	getAIObservabilityFieldsKeys,
+	getAIObservabilityFieldsValues,
+} from 'api/generated/services/ai-observability';
+import { getKeySuggestions } from 'api/querySuggestions/getKeySuggestions';
+import { getValueSuggestions } from 'api/querySuggestions/getValueSuggestion';
+import { IBuilderQuery } from 'types/api/queryBuilder/queryBuilderData';
+import { DataSource } from 'types/common/queryBuilder';
+
+export interface SuggestedFieldKey {
+	name: string;
+	fieldContext?: string;
+	fieldDataType?: string;
+}
+
+export type SuggestedFieldKeysByName = Record<string, SuggestedFieldKey[]>;
+
+export interface SuggestedFieldKeysPayload {
+	complete: boolean;
+	keys: SuggestedFieldKeysByName;
+}
+
+export interface SuggestedFieldKeysResponse {
+	data: { data?: SuggestedFieldKeysPayload };
+}
+
+export interface SuggestedFieldValuesPayload {
+	complete?: boolean;
+	values?: {
+		stringValues?: string[] | null;
+		numberValues?: number[] | null;
+	} | null;
+}
+
+export interface SuggestedFieldValuesResponse {
+	data: { data?: SuggestedFieldValuesPayload };
+}
+
+interface FetchFieldKeysParams {
+	builderQueryType: IBuilderQuery['builderQueryType'];
+	dataSource: DataSource;
+	searchText: string;
+	metricName?: string;
+	signalSource?: 'meter' | '';
+	metricNamespace?: string;
+}
+
+interface FetchFieldValuesParams {
+	builderQueryType: IBuilderQuery['builderQueryType'];
+	dataSource: DataSource;
+	key: string;
+	searchText: string;
+	metricName?: string;
+	signalSource?: 'meter' | '';
+}
+
+export const fetchFieldKeysForQuery = async ({
+	builderQueryType,
+	dataSource,
+	searchText,
+	metricName,
+	signalSource,
+	metricNamespace,
+}: FetchFieldKeysParams): Promise<SuggestedFieldKeysResponse> => {
+	if (builderQueryType === 'builder_ai_query') {
+		const response = await getAIObservabilityFieldsKeys({ searchText });
+
+		return {
+			data: {
+				data: response.data
+					? { complete: response.data.complete, keys: response.data.keys ?? {} }
+					: undefined,
+			},
+		};
+	}
+
+	return getKeySuggestions({
+		signal: dataSource,
+		searchText,
+		metricName,
+		signalSource,
+		metricNamespace,
+	});
+};
+
+export const fetchFieldValuesForQuery = async ({
+	builderQueryType,
+	dataSource,
+	key,
+	searchText,
+	metricName,
+	signalSource,
+}: FetchFieldValuesParams): Promise<SuggestedFieldValuesResponse> => {
+	if (builderQueryType === 'builder_ai_query') {
+		const response = await getAIObservabilityFieldsValues({
+			name: key,
+			searchText,
+		});
+
+		return { data: { data: response.data } };
+	}
+
+	// getValueSuggestions' declared response type does not match what the endpoint returns.
+	return getValueSuggestions({
+		signal: dataSource,
+		key,
+		searchText,
+		signalSource,
+		metricName,
+	}) as unknown as Promise<SuggestedFieldValuesResponse>;
+};

frontend/src/components/QueryBuilderV2/QueryV2/__tests__/QuerySearch.test.tsx

@@ -1,15 +1,10 @@
 import { EditorView } from '@uiw/react-codemirror';
-import { getFieldKeySuggestions } from 'api/querySuggestions/getFieldKeySuggestions';
-import { getFieldValueSuggestions } from 'api/querySuggestions/getFieldValueSuggestions';
+import { getKeySuggestions } from 'api/querySuggestions/getKeySuggestions';
+import { getValueSuggestions } from 'api/querySuggestions/getValueSuggestion';
 import { initialQueriesMap } from 'constants/queryBuilder';
-import {
-	fireEvent,
-	render,
-	screen,
-	userEvent,
-	waitFor,
-} from 'tests/test-utils';
+import { fireEvent, render, userEvent, waitFor } from 'tests/test-utils';
 import { DataTypes } from 'types/api/queryBuilder/queryAutocompleteResponse';
+import type { QueryKeyDataSuggestionsProps } from 'types/api/querySuggestions/types';
 import { DataSource } from 'types/common/queryBuilder';
 
 import QuerySearch from '../QuerySearch/QuerySearch';
@@ -35,25 +30,17 @@ jest.mock('hooks/queryBuilder/useQueryBuilder', () => {
 	};
 });
 
-jest.mock('api/querySuggestions/getFieldKeySuggestions', () => ({
-	getFieldKeySuggestions: jest.fn().mockResolvedValue({
-		status: 'success',
-		data: { complete: true, keys: {} },
+jest.mock('api/querySuggestions/getKeySuggestions', () => ({
+	getKeySuggestions: jest.fn().mockResolvedValue({
+		data: {
+			data: { keys: {} as Record<string, QueryKeyDataSuggestionsProps[]> },
+		},
 	}),
 }));
 
-jest.mock('api/querySuggestions/getFieldValueSuggestions', () => ({
-	getFieldValueSuggestions: jest.fn().mockResolvedValue({
-		status: 'success',
-		data: {
-			complete: true,
-			values: {
-				stringValues: [],
-				numberValues: [],
-				boolValues: [],
-				relatedValues: [],
-			},
-		},
+jest.mock('api/querySuggestions/getValueSuggestion', () => ({
+	getValueSuggestions: jest.fn().mockResolvedValue({
+		data: { data: { values: { stringValues: [], numberValues: [] } } },
 	}),
 }));
 
@@ -81,8 +68,8 @@ describe('QuerySearch (Integration with Real CodeMirror)', () => {
 
 	it('fetches key suggestions when typing a key (debounced)', async () => {
 		// Use real timers for CodeMirror integration tests
-		const mockedGetKeys = getFieldKeySuggestions as jest.MockedFunction<
-			typeof getFieldKeySuggestions
+		const mockedGetKeys = getKeySuggestions as jest.MockedFunction<
+			typeof getKeySuggestions
 		>;
 		mockedGetKeys.mockClear();
 
@@ -115,22 +102,10 @@ describe('QuerySearch (Integration with Real CodeMirror)', () => {
 
 	it('fetches value suggestions when editing value context', async () => {
 		// Use real timers for CodeMirror integration tests
-		const mockedGetValues = getFieldValueSuggestions as jest.MockedFunction<
-			typeof getFieldValueSuggestions
+		const mockedGetValues = getValueSuggestions as jest.MockedFunction<
+			typeof getValueSuggestions
 		>;
 		mockedGetValues.mockClear();
-		mockedGetValues.mockResolvedValueOnce({
-			status: 'success',
-			data: {
-				complete: true,
-				values: {
-					stringValues: ['payment-service'],
-					numberValues: [200],
-					boolValues: [],
-					relatedValues: [],
-				},
-			},
-		});
 
 		render(
 			<QuerySearch
@@ -154,18 +129,12 @@ describe('QuerySearch (Integration with Real CodeMirror)', () => {
 		await waitFor(() => expect(mockedGetValues).toHaveBeenCalled(), {
 			timeout: 2000,
 		});
-
-		// the string and number values off the response both reach the dropdown
-		await expect(
-			screen.findByText('payment-service'),
-		).resolves.toBeInTheDocument();
-		await expect(screen.findByText('200')).resolves.toBeInTheDocument();
 	});
 
 	it('fetches key suggestions on mount for LOGS', async () => {
 		// Use real timers for CodeMirror integration tests
-		const mockedGetKeysOnMount = getFieldKeySuggestions as jest.MockedFunction<
-			typeof getFieldKeySuggestions
+		const mockedGetKeysOnMount = getKeySuggestions as jest.MockedFunction<
+			typeof getKeySuggestions
 		>;
 		mockedGetKeysOnMount.mockClear();
 
@@ -184,7 +153,6 @@ describe('QuerySearch (Integration with Real CodeMirror)', () => {
 			() =>
 				expect(mockedGetKeysOnMount).toHaveBeenCalledWith(
 					expect.objectContaining({ signal: DataSource.LOGS, searchText: '' }),
-					undefined,
 				),
 			{ timeout: 2000 },
 		);
@@ -389,8 +357,8 @@ describe('QuerySearch (Integration with Real CodeMirror)', () => {
 	});
 
 	it('fetches key suggestions for metrics even without aggregateAttribute.key when showFilterSuggestionsWithoutMetric is true', async () => {
-		const mockedGetKeys = getFieldKeySuggestions as jest.MockedFunction<
-			typeof getFieldKeySuggestions
+		const mockedGetKeys = getKeySuggestions as jest.MockedFunction<
+			typeof getKeySuggestions
 		>;
 		mockedGetKeys.mockClear();
 

frontend/src/components/QueryBuilderV2/QueryV2/__tests__/RecentSearches.test.tsx

@@ -31,25 +31,15 @@ jest.mock('hooks/useDarkMode', () => ({
 	useIsDarkMode: (): boolean => false,
 }));
 
-jest.mock('api/querySuggestions/getFieldKeySuggestions', () => ({
-	getFieldKeySuggestions: jest.fn().mockResolvedValue({
-		status: 'success',
-		data: { complete: true, keys: {} },
+jest.mock('api/querySuggestions/getKeySuggestions', () => ({
+	getKeySuggestions: jest.fn().mockResolvedValue({
+		data: { data: { keys: {} } },
 	}),
 }));
 
-jest.mock('api/querySuggestions/getFieldValueSuggestions', () => ({
-	getFieldValueSuggestions: jest.fn().mockResolvedValue({
-		status: 'success',
-		data: {
-			complete: true,
-			values: {
-				stringValues: [],
-				numberValues: [],
-				boolValues: [],
-				relatedValues: [],
-			},
-		},
+jest.mock('api/querySuggestions/getValueSuggestion', () => ({
+	getValueSuggestions: jest.fn().mockResolvedValue({
+		data: { data: { values: { stringValues: [], numberValues: [] } } },
 	}),
 }));
 

frontend/src/components/QuickFilters/FilterRenderers/Checkbox/v2/useFieldValues.tsx

@@ -1,12 +1,15 @@
 import { useMemo } from 'react';
 import { useGetFieldsValues } from 'api/generated/services/fields';
-import { TelemetrytypesSourceDTO } from 'api/generated/services/sigNoz.schemas';
+import {
+	TelemetrytypesSignalDTO,
+	TelemetrytypesSourceDTO,
+} from 'api/generated/services/sigNoz.schemas';
 import {
 	IQuickFiltersConfig,
 	QuickFiltersSource,
 } from 'components/QuickFilters/types';
+import { DataSource } from 'types/common/queryBuilder';
 import { FIELD_API_CACHE_TIME } from 'constants/queryCacheTime';
-import { DATA_SOURCE_TO_SIGNAL } from 'types/common/queryBuilder';
 
 interface UseFieldValuesProps {
 	filter: IQuickFiltersConfig;
@@ -26,6 +29,15 @@ interface UseFieldValuesReturn {
 	isFetching: boolean;
 }
 
+export const DATA_SOURCE_TO_SIGNAL: Record<
+	DataSource,
+	TelemetrytypesSignalDTO
+> = {
+	[DataSource.METRICS]: TelemetrytypesSignalDTO.metrics,
+	[DataSource.TRACES]: TelemetrytypesSignalDTO.traces,
+	[DataSource.LOGS]: TelemetrytypesSignalDTO.logs,
+};
+
 const QUICK_FILTERS_SOURCE_TO_SOURCE: Partial<
 	Record<QuickFiltersSource, TelemetrytypesSourceDTO>
 > = {

frontend/src/components/QuickFilters/QuickFiltersSettings/OtherFilters.tsx

@@ -3,6 +3,7 @@ import { Button, Skeleton } from 'antd';
 import { useGetFieldsKeys } from 'api/generated/services/fields';
 import { TelemetrytypesSourceDTO } from 'api/generated/services/sigNoz.schemas';
 import OverlayScrollbar from 'components/OverlayScrollbar/OverlayScrollbar';
+import { DATA_SOURCE_TO_SIGNAL } from 'components/QuickFilters/FilterRenderers/Checkbox/v2/useFieldValues';
 import { SIGNAL_DATA_SOURCE_MAP } from 'components/QuickFilters/QuickFiltersSettings/constants';
 import { SignalType } from 'components/QuickFilters/types';
 import { buildCompositeKey } from 'container/OptionsMenu/utils';
@@ -11,7 +12,6 @@ import {
 	FieldDataType,
 	TelemetryFieldKey,
 } from 'types/api/v5/queryRange';
-import { DATA_SOURCE_TO_SIGNAL } from 'types/common/queryBuilder';
 
 function OtherFiltersSkeleton(): JSX.Element {
 	return (

frontend/src/constants/localStorage.ts

@@ -12,8 +12,6 @@ export enum LOCALSTORAGE {
 	GRAPH_VISIBILITY_STATES = 'GRAPH_VISIBILITY_STATES',
 	TRACES_LIST_COLUMNS = 'TRACES_LIST_COLUMNS',
 	TRACES_VIEW_COLUMNS = 'TRACES_VIEW_COLUMNS',
-	AI_OBSERVABILITY_TRACE_VIEW_COLUMNS = 'AI_OBSERVABILITY_TRACE_VIEW_COLUMNS',
-	AI_OBSERVABILITY_LIST_COLUMNS = 'AI_OBSERVABILITY_LIST_COLUMNS',
 	LOGS_LIST_COLUMNS = 'LOGS_LIST_COLUMNS',
 	LOGS_LIST_COLUMN_SIZING = 'LOGS_LIST_COLUMN_SIZING',
 	LOGGED_IN_USER_NAME = 'LOGGED_IN_USER_NAME',

frontend/src/constants/reactQueryKeys.ts

@@ -106,8 +106,8 @@ export const REACT_QUERY_KEY = {
 	// Dashboard Grid Card Query Keys
 	DASHBOARD_GRID_CARD_QUERY_RANGE: 'DASHBOARD_GRID_CARD_QUERY_RANGE',
 
-	// Field Keys Suggestion Query Keys
-	FIELD_KEYS_SUGGESTION: 'FIELD_KEYS_SUGGESTION',
+	// Fields Selector Query Keys
+	GET_FIELDS_SELECTOR_SUGGESTIONS: 'GET_FIELDS_SELECTOR_SUGGESTIONS',
 
 	// AI Assistant Query Keys
 	AI_ASSISTANT_EMPTY_STATE_CHIPS: 'AI_ASSISTANT_EMPTY_STATE_CHIPS',

frontend/src/container/LLMObservability/AttributeMapping/AttributeMappingsTab/__tests__/AttributeMappingsTab.test.tsx

@@ -333,6 +333,7 @@ describe('AttributeMappingsTab (integration)', () => {
 						context: FieldContext.attribute,
 						operation: MapperOperation.copy,
 						priority,
+						enabled: true,
 					})),
 				},
 			}),

frontend/src/container/LLMObservability/AttributeMapping/AttributeMappingsTab/components/MappingsTable/GroupHeader/ConditionsTooltip.tsx

@@ -1,10 +1,12 @@
 import { Typography } from '@signozhq/ui/typography';
 
+import { ConditionKey } from 'container/LLMObservability/AttributeMapping/types';
+
 import styles from './ConditionsTooltip.module.scss';
 
 interface ConditionsTooltipProps {
-	attributes: string[];
-	resource: string[];
+	attributes: ConditionKey[];
+	resource: ConditionKey[];
 }
 
 function ConditionsTooltip({
@@ -33,8 +35,8 @@ function ConditionsTooltip({
 					</Typography.Text>
 					<div className={styles.keyList}>
 						{attributes.map((key) => (
-							<code key={key} className={styles.key}>
-								{key}
+							<code key={`${key.origin}-${key.value}`} className={styles.key}>
+								{key.value}
 							</code>
 						))}
 					</div>
@@ -47,8 +49,8 @@ function ConditionsTooltip({
 					</Typography.Text>
 					<div className={styles.keyList}>
 						{resource.map((key) => (
-							<code key={key} className={styles.key}>
-								{key}
+							<code key={`${key.origin}-${key.value}`} className={styles.key}>
+								{key.value}
 							</code>
 						))}
 					</div>

frontend/src/container/LLMObservability/AttributeMapping/__tests__/fixtures.ts

@@ -3,6 +3,7 @@ import {
 	SpantypesSpanMapperDTO as Mapper,
 	SpantypesSpanMapperGroupDTO as MapperGroup,
 	SpantypesSpanMapperOperationDTO as MapperOperation,
+	SpantypesSpanMapperOriginDTO as MapperOrigin,
 	SpantypesSpanMapperTestSpanDTO as TestSpan,
 } from 'api/generated/services/sigNoz.schemas';
 
@@ -21,9 +22,15 @@ export function makeGroup(overrides: Partial<MapperGroup> = {}): MapperGroup {
 		orgId: 'org-1',
 		name: 'demo',
 		enabled: true,
+		origin: MapperOrigin.user,
+		version: 0,
 		condition: {
-			attributes: ['ai.embeddings'],
-			resource: ['cloud.account.id'],
+			attributes: [
+				{ value: 'ai.embeddings', enabled: true, origin: MapperOrigin.user },
+			],
+			resource: [
+				{ value: 'cloud.account.id', enabled: true, origin: MapperOrigin.user },
+			],
 		},
 		...overrides,
 	};
@@ -35,6 +42,7 @@ export function makeMapper(overrides: Partial<Mapper> = {}): Mapper {
 		groupId: 'group-1',
 		name: 'gen_ai.request.model',
 		enabled: true,
+		origin: MapperOrigin.user,
 		fieldContext: FieldContext.attribute,
 		config: {
 			sources: [
@@ -43,12 +51,16 @@ export function makeMapper(overrides: Partial<Mapper> = {}): Mapper {
 					context: FieldContext.attribute,
 					operation: MapperOperation.copy,
 					priority: 2,
+					enabled: true,
+					origin: MapperOrigin.user,
 				},
 				{
 					key: 'llm.model',
 					context: FieldContext.attribute,
 					operation: MapperOperation.move,
 					priority: 1,
+					enabled: true,
+					origin: MapperOrigin.user,
 				},
 			],
 		},
@@ -85,8 +97,12 @@ export const mockGroups: MapperGroup[] = [
 		id: 'group-1',
 		name: 'demo',
 		condition: {
-			attributes: ['ai.embeddings'],
-			resource: ['cloud.account.id'],
+			attributes: [
+				{ value: 'ai.embeddings', enabled: true, origin: MapperOrigin.user },
+			],
+			resource: [
+				{ value: 'cloud.account.id', enabled: true, origin: MapperOrigin.user },
+			],
 		},
 	}),
 	makeGroup({

frontend/src/container/LLMObservability/AttributeMapping/components/GroupFormDrawer/components/ConditionKeyList/ConditionKeyList.tsx

@@ -1,19 +1,23 @@
 import { Button } from '@signozhq/ui/button';
 import { Plus, X } from '@signozhq/icons';
 
-import { FieldContextValue } from 'container/LLMObservability/AttributeMapping/types';
+import {
+	ConditionKey,
+	FieldContextValue,
+} from 'container/LLMObservability/AttributeMapping/types';
+import { createConditionKey } from 'container/LLMObservability/AttributeMapping/utils';
 import KeySearchInput from '../../../KeySearchInput/KeySearchInput';
 import styles from './ConditionKeyList.module.scss';
 
 interface ConditionKeyListProps {
 	label: string;
 	labelHint?: string;
-	keys: string[];
+	keys: ConditionKey[];
 	placeholder: string;
 	addLabel: string;
 	testIdPrefix: string;
 	fieldContext: FieldContextValue;
-	onChange: (keys: string[]) => void;
+	onChange: (keys: ConditionKey[]) => void;
 }
 
 function ConditionKeyList({
@@ -27,11 +31,11 @@ function ConditionKeyList({
 	onChange,
 }: ConditionKeyListProps): JSX.Element {
 	const updateKey = (index: number, value: string): void => {
-		onChange(keys.map((key, i) => (i === index ? value : key)));
+		onChange(keys.map((key, i) => (i === index ? { ...key, value } : key)));
 	};
 
 	const addKey = (): void => {
-		onChange([...keys, '']);
+		onChange([...keys, createConditionKey()]);
 	};
 
 	const removeKey = (index: number): void => {
@@ -53,7 +57,7 @@ function ConditionKeyList({
 							<KeySearchInput
 								className={styles.keyInput}
 								placeholder={placeholder}
-								value={key}
+								value={key.value}
 								fieldContext={fieldContext}
 								onChange={(next): void => updateKey(index, next)}
 								testId={`${testIdPrefix}-${index}`}

frontend/src/container/LLMObservability/AttributeMapping/saveDraft.ts

@@ -42,7 +42,9 @@ function sourcesEqual(a: SourceConfig[], b: SourceConfig[]): boolean {
 			(source, index) =>
 				source.key === b[index].key &&
 				source.context === b[index].context &&
-				source.operation === b[index].operation,
+				source.operation === b[index].operation &&
+				source.enabled === b[index].enabled &&
+				source.origin === b[index].origin,
 		)
 	);
 }

frontend/src/container/LLMObservability/AttributeMapping/types.ts

@@ -3,6 +3,7 @@ import {
 	SpantypesSpanMapperDTO,
 	SpantypesSpanMapperGroupDTO,
 	SpantypesSpanMapperOperationDTO,
+	SpantypesSpanMapperOriginDTO,
 } from 'api/generated/services/sigNoz.schemas';
 
 export type MapperGroup = SpantypesSpanMapperGroupDTO;
@@ -11,6 +12,16 @@ export const FieldContext = SpantypesFieldContextDTO;
 export type FieldContextValue = SpantypesFieldContextDTO;
 export const MapperOperation = SpantypesSpanMapperOperationDTO;
 export type MapperOperationValue = SpantypesSpanMapperOperationDTO;
+export const MapperOrigin = SpantypesSpanMapperOriginDTO;
+export type MapperOriginValue = SpantypesSpanMapperOriginDTO;
+
+// One condition substring. Shipped (system) keys are read-only apart from
+// `enabled`; user keys are fully editable.
+export interface ConditionKey {
+	value: string;
+	enabled: boolean;
+	origin: MapperOriginValue;
+}
 
 export type MapperDraftMode = 'add' | 'edit';
 
@@ -18,6 +29,8 @@ export interface SourceConfig {
 	key: string;
 	context: SpantypesFieldContextDTO;
 	operation: SpantypesSpanMapperOperationDTO;
+	enabled: boolean;
+	origin: MapperOriginValue;
 }
 
 // Editable form state for a mapper. `sources` is ordered highest priority
@@ -33,8 +46,8 @@ export interface MapperDraft {
 export interface GroupDraft {
 	id: string | null;
 	name: string;
-	attributes: string[];
-	resource: string[];
+	attributes: ConditionKey[];
+	resource: ConditionKey[];
 	enabled: boolean;
 }
 
@@ -51,8 +64,8 @@ export interface DraftGroup {
 	localId: string;
 	serverId: string | null;
 	name: string;
-	attributes: string[];
-	resource: string[];
+	attributes: ConditionKey[];
+	resource: ConditionKey[];
 	enabled: boolean;
 	mappers: DraftMapper[];
 }

frontend/src/container/LLMObservability/AttributeMapping/utils.ts

@@ -1,12 +1,14 @@
 import {
 	SpantypesPostableSpanMapperDTO,
 	SpantypesPostableSpanMapperGroupDTO,
+	SpantypesSpanMapperGroupConditionKeyDTO,
 	SpantypesUpdatableSpanMapperDTO,
 	SpantypesUpdatableSpanMapperGroupDTO,
 } from 'api/generated/services/sigNoz.schemas';
 import { v4 as uuid } from 'uuid';
 
 import {
+	ConditionKey,
 	DraftGroup,
 	DraftMapper,
 	FieldContext,
@@ -15,6 +17,7 @@ import {
 	MapperDraft,
 	MapperGroup,
 	MapperOperation,
+	MapperOrigin,
 	SourceConfig,
 } from './types';
 
@@ -24,20 +27,36 @@ function genLocalId(prefix: 'group' | 'mapper'): string {
 	return `local-${prefix}-${uuid()}`;
 }
 
-// Trimmed, de-duplicated, non-empty keys preserving input order.
-function cleanKeys(keys: string[]): string[] {
+export function createConditionKey(value = ''): ConditionKey {
+	return { value, enabled: true, origin: MapperOrigin.user };
+}
+
+// Trimmed, de-duplicated, non-empty keys preserving input order. A shipped and
+// a user key may share a value, so the origin is part of the identity.
+function cleanKeys(keys: ConditionKey[]): ConditionKey[] {
 	const seen = new Set<string>();
-	const result: string[] = [];
+	const result: ConditionKey[] = [];
 	keys.forEach((raw) => {
-		const key = raw.trim();
-		if (key && !seen.has(key)) {
-			seen.add(key);
-			result.push(key);
+		const value = raw.value.trim();
+		const dedupeKey = `${raw.origin}:${value}`;
+		if (value && !seen.has(dedupeKey)) {
+			seen.add(dedupeKey);
+			result.push({ ...raw, value });
 		}
 	});
 	return result;
 }
 
+function fromConditionKeys(
+	keys: SpantypesSpanMapperGroupConditionKeyDTO[] | null | undefined,
+): ConditionKey[] {
+	return (keys ?? []).map((key) => ({
+		value: key.value,
+		enabled: key.enabled,
+		origin: key.origin ?? MapperOrigin.user,
+	}));
+}
+
 // Source configs for a mapper, highest priority first (first match wins at
 // evaluation time).
 function getMapperSources(mapper: Mapper): SourceConfig[] {
@@ -48,6 +67,8 @@ function getMapperSources(mapper: Mapper): SourceConfig[] {
 			key: source.key,
 			context: source.context,
 			operation: source.operation,
+			enabled: source.enabled,
+			origin: source.origin ?? MapperOrigin.user,
 		}));
 }
 
@@ -56,6 +77,8 @@ export function createEmptySource(): SourceConfig {
 		key: '',
 		context: FieldContext.attribute,
 		operation: MapperOperation.copy,
+		enabled: true,
+		origin: MapperOrigin.user,
 	};
 }
 
@@ -72,7 +95,7 @@ function getCleanSources(draft: MapperDraft): SourceConfig[] {
 	const result: SourceConfig[] = [];
 	draft.sources.forEach((source) => {
 		const key = source.key.trim();
-		const dedupeKey = `${source.context}:${key}`;
+		const dedupeKey = `${source.origin}:${source.context}:${key}`;
 		if (key && !seen.has(dedupeKey)) {
 			seen.add(dedupeKey);
 			result.push({ ...source, key });
@@ -95,6 +118,8 @@ function buildSources(
 		context: source.context,
 		operation: source.operation,
 		priority: sources.length - index,
+		enabled: source.enabled,
+		origin: source.origin,
 	}));
 }
 
@@ -123,7 +148,7 @@ export function buildUpdatableMapper(
 export const EMPTY_GROUP_DRAFT: GroupDraft = {
 	id: null,
 	name: '',
-	attributes: [''],
+	attributes: [createConditionKey()],
 	resource: [],
 	enabled: true,
 };
@@ -170,8 +195,8 @@ export function buildDraftGroup(
 		localId: group.id,
 		serverId: group.id,
 		name: group.name,
-		attributes: group.condition?.attributes ?? [],
-		resource: group.condition?.resource ?? [],
+		attributes: fromConditionKeys(group.condition?.attributes),
+		resource: fromConditionKeys(group.condition?.resource),
 		enabled: group.enabled,
 		mappers: mappers.map(buildDraftMapper),
 	};
@@ -182,7 +207,8 @@ export function groupDraftFromNode(group: DraftGroup): GroupDraft {
 	return {
 		id: group.localId,
 		name: group.name,
-		attributes: group.attributes.length > 0 ? group.attributes : [''],
+		attributes:
+			group.attributes.length > 0 ? group.attributes : [createConditionKey()],
 		resource: group.resource,
 		enabled: group.enabled,
 	};

frontend/src/container/LLMObservability/Explorer/Controls/index.tsx

@@ -1,12 +1,10 @@
 import { memo, useState } from 'react';
 import { useTranslation } from 'react-i18next';
 import { Settings } from '@signozhq/icons';
-import { FieldKeysConfigProp } from 'api/querySuggestions/types';
 import FieldsSelector from 'components/FieldsSelector';
 import Controls, { ControlsProps } from 'container/Controls';
 import { OptionsMenuConfig } from 'container/OptionsMenu/types';
 import useQueryPagination from 'hooks/queryPagination/useQueryPagination';
-import { BuilderQueryType, TelemetryFieldKey } from 'types/api/v5/queryRange';
 import { DataSource } from 'types/common/queryBuilder';
 
 import styles from './Controls.module.scss';
@@ -16,10 +14,7 @@ function TraceExplorerControls({
 	totalCount,
 	perPageOptions,
 	config,
-	fieldKeysConfig,
-	builderQueryType,
-	extraFields,
-	requiredFields,
+	showSizeChanger = true,
 }: TraceExplorerControlsProps): JSX.Element | null {
 	const { t } = useTranslation(['trace']);
 	const [isFieldsSelectorOpen, setIsFieldsSelectorOpen] = useState(false);
@@ -49,10 +44,6 @@ function TraceExplorerControls({
 						onFieldsChange={config.fieldsSelector.onFieldsChange}
 						onClose={(): void => setIsFieldsSelectorOpen(false)}
 						signal={DataSource.TRACES}
-						fieldKeysConfig={fieldKeysConfig}
-						builderQueryType={builderQueryType}
-						extraFields={extraFields}
-						requiredFields={requiredFields}
 					/>
 				</>
 			)}
@@ -66,28 +57,26 @@ function TraceExplorerControls({
 				handleCountItemsPerPageChange={handleCountItemsPerPageChange}
 				handleNavigateNext={handleNavigateNext}
 				handleNavigatePrevious={handleNavigatePrevious}
+				showSizeChanger={showSizeChanger}
 			/>
 		</div>
 	);
 }
 
+TraceExplorerControls.defaultProps = {
+	config: null,
+};
+
 type TraceExplorerControlsProps = Pick<
 	ControlsProps,
 	'isLoading' | 'totalCount' | 'perPageOptions'
 > & {
 	config?: OptionsMenuConfig | null;
-	fieldKeysConfig?: FieldKeysConfigProp;
-	builderQueryType?: BuilderQueryType;
-	extraFields?: TelemetryFieldKey[];
-	requiredFields?: readonly string[];
+	showSizeChanger?: boolean;
 };
 
 TraceExplorerControls.defaultProps = {
-	config: null,
-	fieldKeysConfig: undefined,
-	builderQueryType: undefined,
-	extraFields: undefined,
-	requiredFields: undefined,
+	showSizeChanger: true,
 };
 
 export default memo(TraceExplorerControls);

frontend/src/container/LLMObservability/Explorer/TracesView/TracesView.module.scss

@@ -10,25 +10,6 @@
 
 .actionsContainer {
 	display: flex;
-	justify-content: flex-end;
+	justify-content: space-between;
 	align-items: center;
 }
-
-.orderByContainer {
-	display: flex;
-	align-items: center;
-	gap: var(--spacing-4);
-}
-
-.orderByLabel {
-	color: var(--muted-foreground);
-	// Between --periscope-font-size-small (11px) and -base (13px), so literal.
-	font-size: 12px;
-	font-style: normal;
-	font-weight: 400;
-	line-height: 16px; /* 133.333% */
-
-	display: flex;
-	align-items: center;
-	gap: var(--spacing-2);
-}

frontend/src/container/LLMObservability/Explorer/TracesView/TracesView.tsx

@@ -3,45 +3,35 @@ import {
 	memo,
 	MutableRefObject,
 	SetStateAction,
-	useCallback,
 	useEffect,
 	useMemo,
-	useState,
 } from 'react';
 import { QueryKey } from 'react-query';
 // eslint-disable-next-line no-restricted-imports
 import { useSelector } from 'react-redux';
+import { Typography } from '@signozhq/ui/typography';
 import logEvent from 'api/common/logEvent';
-import ListViewOrderBy from 'components/OrderBy/ListViewOrderBy';
+import DownloadOptionsMenu from 'components/DownloadOptionsMenu/DownloadOptionsMenu';
 import { ENTITY_VERSION_V5 } from 'constants/app';
-import { LOCALSTORAGE } from 'constants/localStorage';
 import { QueryParams } from 'constants/query';
 import { initialQueryAIWithType, PANEL_TYPES } from 'constants/queryBuilder';
 import { REACT_QUERY_KEY } from 'constants/reactQueryKeys';
-import { getTraceLink } from '../ListView/utils';
-import { TracesTableRow } from '../TracesTable/getFieldColumn';
-import TracesTable from '../TracesTable/TracesTable';
+import TraceExplorerControls from 'container/TracesExplorer/Controls';
+import { getTraceLink } from 'container/TracesExplorer/ListView/utils';
+import { TracesTableRow } from 'container/TracesExplorer/TracesTable/getFieldColumn';
+import TracesTable from 'container/TracesExplorer/TracesTable/TracesTable';
 import { useGetQueryRange } from 'hooks/queryBuilder/useGetQueryRange';
 import { useQueryBuilder } from 'hooks/queryBuilder/useQueryBuilder';
 import { Pagination } from 'hooks/queryPagination';
 import useUrlQueryData from 'hooks/useUrlQueryData';
-import { ArrowUp10, Minus } from '@signozhq/icons';
 import { AppState } from 'store/reducers';
 import { Warning } from 'types/api';
 import { DataSource } from 'types/common/queryBuilder';
 import { GlobalReducer } from 'types/reducer/globalTime';
+import DOCLINKS from 'utils/docLinks';
 
-import TraceExplorerControls from '../Controls';
-import {
-	TRACE_VIEW_BUILDER_QUERY_TYPE,
-	TRACE_VIEW_COLUMN_EXTRA_FIELDS,
-	TRACE_VIEW_DEFAULT_ORDER_BY,
-	TRACE_VIEW_FIELD_KEYS,
-	TRACE_VIEW_ORDER_BY_EXTRA_FIELDS,
-} from '../constants';
 import { getListViewQuery } from '../explorerUtils';
-import { PER_PAGE_OPTIONS } from './configs';
-import { useTraceViewColumns } from './useTraceViewColumns';
+import { columns, PER_PAGE_OPTIONS } from './configs';
 import styles from './TracesView.module.scss';
 
 interface TracesViewProps {
@@ -59,16 +49,6 @@ function TracesView({
 }: TracesViewProps): JSX.Element {
 	const { stagedQuery, panelType } = useQueryBuilder();
 
-	const [orderBy, setOrderBy] = useState<string>(TRACE_VIEW_DEFAULT_ORDER_BY);
-
-	const {
-		columns,
-		selectedFields,
-		onFieldsChange,
-		requiredFields,
-		isLoading: isColumnsLoading,
-	} = useTraceViewColumns();
-
 	const {
 		selectedTime: globalSelectedTime,
 		maxTime,
@@ -80,8 +60,8 @@ function TracesView({
 	);
 
 	const transformedQuery = useMemo(
-		() => getListViewQuery(stagedQuery || initialQueryAIWithType, orderBy),
-		[stagedQuery, orderBy],
+		() => getListViewQuery(stagedQuery || initialQueryAIWithType),
+		[stagedQuery],
 	);
 
 	const queryKey = useMemo(
@@ -93,7 +73,6 @@ function TracesView({
 			stagedQuery,
 			panelType,
 			paginationQueryData,
-			orderBy,
 		],
 		[
 			globalSelectedTime,
@@ -102,7 +81,6 @@ function TracesView({
 			stagedQuery,
 			panelType,
 			paginationQueryData,
-			orderBy,
 		],
 	);
 
@@ -164,43 +142,27 @@ function TracesView({
 		}
 	}, [isLoading, isFetching, isError, rows.length]);
 
-	const handleOrderChange = useCallback((value: string): void => {
-		setOrderBy(value);
-	}, []);
-
-	const fieldsSelectorConfig = useMemo(
-		() => ({ fieldsSelector: { value: selectedFields, onFieldsChange } }),
-		[selectedFields, onFieldsChange],
-	);
-
 	return (
 		<div className={styles.container}>
 			<div className={styles.actionsContainer}>
-				<div className="trace-explorer-controls">
-					<div className={styles.orderByContainer}>
-						<div className={styles.orderByLabel}>
-							Order by <Minus size={14} /> <ArrowUp10 size={14} />
-						</div>
+				<Typography>
+					This tab only shows Root Spans. More details
+					<Typography.Link href={DOCLINKS.TRACES_DETAILS_LINK} target="_blank">
+						{' '}
+						here
+					</Typography.Link>
+				</Typography>
 
-						<ListViewOrderBy
-							value={orderBy}
-							onChange={handleOrderChange}
-							dataSource={DataSource.TRACES}
-							fieldKeysConfig={TRACE_VIEW_FIELD_KEYS}
-							builderQueryType={TRACE_VIEW_BUILDER_QUERY_TYPE}
-							extraFields={TRACE_VIEW_ORDER_BY_EXTRA_FIELDS}
-						/>
-					</div>
+				<div className="trace-explorer-controls">
+					<DownloadOptionsMenu
+						dataSource={DataSource.TRACES}
+						panelType={PANEL_TYPES.TRACE}
+					/>
 
 					<TraceExplorerControls
 						isLoading={isLoading}
 						totalCount={rows.length}
 						perPageOptions={PER_PAGE_OPTIONS}
-						config={fieldsSelectorConfig}
-						fieldKeysConfig={TRACE_VIEW_FIELD_KEYS}
-						builderQueryType={TRACE_VIEW_BUILDER_QUERY_TYPE}
-						extraFields={TRACE_VIEW_COLUMN_EXTRA_FIELDS}
-						requiredFields={requiredFields}
 					/>
 				</div>
 			</div>
@@ -208,11 +170,10 @@ function TracesView({
 			<TracesTable
 				data={rows}
 				columns={columns}
-				columnStorageKey={LOCALSTORAGE.AI_OBSERVABILITY_TRACE_VIEW_COLUMNS}
 				respectColumnOrder
 				panelType="TRACE"
 				getRowHref={getTraceLink}
-				isLoading={isLoading || isColumnsLoading}
+				isLoading={isLoading}
 				isFetching={isFetching}
 				isError={isError}
 				error={error}

frontend/src/container/LLMObservability/Explorer/TracesView/__tests__/useTraceViewColumns.test.tsx

@@ -1,219 +0,0 @@
-/* eslint-disable no-restricted-syntax */
-import { ReactNode } from 'react';
-import { QueryClient, QueryClientProvider } from 'react-query';
-import { act, renderHook, waitFor } from '@testing-library/react';
-import { ENVIRONMENT } from 'constants/env';
-import { server } from 'mocks-server/server';
-import { rest } from 'msw';
-import {
-	TelemetrytypesFieldContextDTO,
-	TelemetrytypesFieldDataTypeDTO,
-} from 'api/generated/services/sigNoz.schemas';
-import { useColumnStore } from 'components/TanStackTableView/useColumnStore';
-import { LOCALSTORAGE } from 'constants/localStorage';
-import { TelemetryFieldKey } from 'types/api/v5/queryRange';
-
-import { useTraceViewColumns } from '../useTraceViewColumns';
-
-const STORAGE_KEY = LOCALSTORAGE.AI_OBSERVABILITY_TRACE_VIEW_COLUMNS;
-
-const AGGREGATE_KEYS = [
-	'llm_call_count',
-	'tool_call_count',
-	'distinct_tool_count',
-	'input_tokens',
-	'output_tokens',
-	'total_tokens',
-	'estimated_total_cost',
-	'max_llm_duration_nano',
-];
-
-const fieldNames = (fields: TelemetryFieldKey[]): string[] =>
-	fields.map((field) => field.name);
-
-const columnNames = (columns: { header?: unknown }[]): string[] =>
-	columns.map((column) => column.header as string);
-
-function wrapper({ children }: { children: ReactNode }): JSX.Element {
-	const queryClient = new QueryClient({
-		defaultOptions: { queries: { retry: false } },
-	});
-	return (
-		<QueryClientProvider client={queryClient}>{children}</QueryClientProvider>
-	);
-}
-
-const seenAI: URLSearchParams[] = [];
-
-const mockAggregateKeys = (names: string[]): void => {
-	server.use(
-		rest.get(
-			`${ENVIRONMENT.baseURL}/api/v1/ai_observability/fields/keys`,
-			(req, res, ctx) => {
-				seenAI.push(req.url.searchParams);
-				return res(
-					ctx.status(200),
-					ctx.json({
-						status: 'success',
-						data: {
-							complete: true,
-							keys: Object.fromEntries(
-								names.map((name) => [
-									name,
-									[
-										{
-											name,
-											fieldContext: TelemetrytypesFieldContextDTO.trace,
-											fieldDataType: TelemetrytypesFieldDataTypeDTO.float64,
-										},
-									],
-								]),
-							),
-						},
-					}),
-				);
-			},
-		),
-	);
-};
-
-const renderColumns = async (): Promise<
-	ReturnType<typeof renderHook<ReturnType<typeof useTraceViewColumns>, unknown>>
-> => {
-	const rendered = renderHook(() => useTraceViewColumns(), { wrapper });
-	await waitFor(() => {
-		expect(rendered.result.current.isLoading).toBe(false);
-	});
-	return rendered;
-};
-
-describe('useTraceViewColumns', () => {
-	beforeEach(() => {
-		seenAI.length = 0;
-		useColumnStore.getState().tables = {};
-		localStorage.clear();
-		mockAggregateKeys(AGGREGATE_KEYS);
-	});
-
-	it('reads the aggregates from the trace context of the keys endpoint', async () => {
-		await renderColumns();
-
-		expect(seenAI).toHaveLength(1);
-		expect(seenAI[0]?.get('searchText')).toBe('');
-		expect(seenAI[0]?.get('fieldContext')).toBe(
-			TelemetrytypesFieldContextDTO.trace,
-		);
-	});
-
-	it('pools the hardcoded display-only columns with the endpoint aggregates', async () => {
-		const { result } = await renderColumns();
-
-		expect(columnNames(result.current.columns)).toStrictEqual([
-			'service.name',
-			'root_span_name',
-			'trace_duration_nano',
-			'span_count',
-			'trace_id',
-			'start_time',
-			'end_time',
-			'error_count',
-			'input',
-			'output',
-			...AGGREGATE_KEYS,
-		]);
-	});
-
-	it('selects only the default-visible columns on first render', async () => {
-		const { result } = await renderColumns();
-
-		expect(fieldNames(result.current.selectedFields)).toStrictEqual([
-			'service.name',
-			'root_span_name',
-			'trace_duration_nano',
-			'span_count',
-			'trace_id',
-			'llm_call_count',
-			'total_tokens',
-			'estimated_total_cost',
-		]);
-	});
-
-	it('keeps a newly reported aggregate hidden until it is picked', async () => {
-		mockAggregateKeys(['brand_new_aggregate']);
-
-		const { result } = await renderColumns();
-
-		expect(columnNames(result.current.columns)).toContain('brand_new_aggregate');
-		expect(fieldNames(result.current.selectedFields)).not.toContain(
-			'brand_new_aggregate',
-		);
-	});
-
-	it('hides the columns dropped from the selection', async () => {
-		const { result } = await renderColumns();
-
-		act(() => {
-			result.current.onFieldsChange([
-				{ name: 'trace_id' },
-				{ name: 'total_tokens', fieldContext: 'trace', fieldDataType: 'float64' },
-			]);
-		});
-
-		expect(fieldNames(result.current.selectedFields)).toStrictEqual([
-			'trace_id',
-			'total_tokens',
-		]);
-	});
-
-	it('shows a column added back from the pool', async () => {
-		const { result } = await renderColumns();
-
-		act(() => {
-			result.current.onFieldsChange([{ name: 'trace_id' }]);
-		});
-		act(() => {
-			result.current.onFieldsChange([{ name: 'trace_id' }, { name: 'input' }]);
-		});
-
-		expect(fieldNames(result.current.selectedFields)).toStrictEqual([
-			'trace_id',
-			'input',
-		]);
-	});
-
-	it('keeps the trace id column even when the selection drops it', async () => {
-		const { result } = await renderColumns();
-
-		act(() => {
-			result.current.onFieldsChange([{ name: 'span_count' }]);
-		});
-
-		expect(fieldNames(result.current.selectedFields)).toContain('trace_id');
-		expect(result.current.requiredFields).toStrictEqual(['trace_id']);
-	});
-
-	it('persists the selection order', async () => {
-		const { result } = await renderColumns();
-
-		act(() => {
-			result.current.onFieldsChange([
-				{ name: 'total_tokens', fieldContext: 'trace', fieldDataType: 'float64' },
-				{ name: 'trace_id' },
-				{ name: 'service.name', fieldContext: 'resource' },
-			]);
-		});
-
-		expect(fieldNames(result.current.selectedFields)).toStrictEqual([
-			'total_tokens',
-			'trace_id',
-			'service.name',
-		]);
-		expect(
-			useColumnStore.getState().tables[STORAGE_KEY].columnOrder,
-		).toStrictEqual([
-			'trace:total_tokens:float64',
-			'trace_id',
-			'resource:service.name',
-		]);
-	});
-});

frontend/src/container/LLMObservability/Explorer/TracesView/configs.tsx

@@ -5,29 +5,18 @@ import { DEFAULT_PER_PAGE_OPTIONS } from 'hooks/queryPagination';
 
 export const PER_PAGE_OPTIONS: number[] = [10, ...DEFAULT_PER_PAGE_OPTIONS];
 
-/** Always visible: it is the row's link to the trace. */
-export const TRACE_ID_COLUMN_ID = 'trace_id';
+const TRACE_FIELDS = [
+	{ name: 'service.name', fieldContext: 'resource' },
+	{ name: 'name' },
+	{ name: 'duration_nano' },
+	{ name: 'span_count' },
+	{ name: 'trace_id' },
+] as TelemetryFieldKey[];
 
-/** Everything else starts hidden, including any aggregate the endpoint adds later. */
-const DEFAULT_VISIBLE_FIELDS = new Set([
-	'service.name',
-	'root_span_name',
-	'trace_duration_nano',
-	'span_count',
-	'llm_call_count',
-	'total_tokens',
-	'estimated_total_cost',
-	TRACE_ID_COLUMN_ID,
-]);
-
-export const buildTraceViewColumns = (
-	fields: TelemetryFieldKey[],
-): TableColumnDef<TracesTableRow>[] =>
-	fields.map((field) => ({
+export const columns: TableColumnDef<TracesTableRow>[] = TRACE_FIELDS.map(
+	(field) => ({
 		...getFieldColumn(field),
-		defaultVisibility: DEFAULT_VISIBLE_FIELDS.has(field.name),
-		// The shared column builder pins anything in TIMESTAMP_FIELD_NAMES; these stay movable.
-		enableMove: field.name !== TRACE_ID_COLUMN_ID,
-		enableRemove: field.name !== TRACE_ID_COLUMN_ID,
-		canBeHidden: field.name !== TRACE_ID_COLUMN_ID,
-	}));
+		enableRemove: false,
+		canBeHidden: false,
+	}),
+);

frontend/src/container/LLMObservability/Explorer/TracesView/useTraceViewColumns.ts

@@ -1,109 +0,0 @@
-import { useCallback, useEffect, useMemo } from 'react';
-import { useFieldKeysSuggestion } from 'hooks/querySuggestions/useFieldKeysSuggestion';
-import { mergeExtraFields } from 'utils/extraFields';
-import type { TableColumnDef } from 'components/TanStackTableView/types';
-import {
-	hideColumn,
-	initializeFromDefaults,
-	setColumnOrder,
-	showColumn,
-	useColumnOrder,
-	useHiddenColumnIds,
-} from 'components/TanStackTableView/useColumnStore';
-import { LOCALSTORAGE } from 'constants/localStorage';
-import { buildCompositeKey } from 'container/OptionsMenu/utils';
-import { TracesTableRow } from '../TracesTable/getFieldColumn';
-import { TelemetryFieldKey } from 'types/api/v5/queryRange';
-import { DATA_SOURCE_TO_SIGNAL, DataSource } from 'types/common/queryBuilder';
-
-import {
-	TRACE_VIEW_BUILDER_QUERY_TYPE,
-	TRACE_VIEW_COLUMN_EXTRA_FIELDS,
-	TRACE_VIEW_FIELD_KEYS,
-} from '../constants';
-import { buildTraceViewColumns, TRACE_ID_COLUMN_ID } from './configs';
-
-const STORAGE_KEY = LOCALSTORAGE.AI_OBSERVABILITY_TRACE_VIEW_COLUMNS;
-
-/** Matches the id getFieldColumn derives, so fields and columns address alike. */
-const columnIdOf = (field: TelemetryFieldKey): string =>
-	buildCompositeKey(field.name, field.fieldContext, field.fieldDataType);
-
-interface UseTraceViewColumns {
-	columns: TableColumnDef<TracesTableRow>[];
-	selectedFields: TelemetryFieldKey[];
-	onFieldsChange: (next: TelemetryFieldKey[]) => void;
-	requiredFields: readonly string[];
-	isLoading: boolean;
-}
-
-// TODO(ai-explorer): browser-local only, unlike the list views' `?options=` columns.
-export function useTraceViewColumns(): UseTraceViewColumns {
-	const { data: fetchedFields = [], isFetched } = useFieldKeysSuggestion(
-		{
-			...TRACE_VIEW_FIELD_KEYS,
-			signal: DATA_SOURCE_TO_SIGNAL[DataSource.TRACES],
-			searchText: '',
-		},
-		TRACE_VIEW_BUILDER_QUERY_TYPE,
-	);
-
-	const availableFields = useMemo(
-		() => mergeExtraFields(TRACE_VIEW_COLUMN_EXTRA_FIELDS, fetchedFields),
-		[fetchedFields],
-	);
-
-	const columns = useMemo(
-		() => buildTraceViewColumns(availableFields),
-		[availableFields],
-	);
-
-	// Defaults from a partial column set would persist as the user's own choice.
-	useEffect(() => {
-		if (isFetched) {
-			initializeFromDefaults(STORAGE_KEY, columns);
-		}
-	}, [isFetched, columns]);
-
-	const hiddenColumnIds = useHiddenColumnIds(STORAGE_KEY);
-	const columnOrder = useColumnOrder(STORAGE_KEY);
-
-	const selectedFields = useMemo(() => {
-		const hidden = new Set(hiddenColumnIds);
-		const orderIndex = new Map(columnOrder.map((id, index) => [id, index]));
-
-		return availableFields
-			.filter((field) => !hidden.has(columnIdOf(field)))
-			.sort(
-				(a, b) =>
-					(orderIndex.get(columnIdOf(a)) ?? Infinity) -
-					(orderIndex.get(columnIdOf(b)) ?? Infinity),
-			);
-	}, [availableFields, hiddenColumnIds, columnOrder]);
-
-	const onFieldsChange = useCallback(
-		(next: TelemetryFieldKey[]): void => {
-			const keptIds = new Set(next.map(columnIdOf));
-
-			columns.forEach((column) => {
-				if (keptIds.has(column.id) || column.id === TRACE_ID_COLUMN_ID) {
-					showColumn(STORAGE_KEY, column.id);
-				} else {
-					hideColumn(STORAGE_KEY, column.id);
-				}
-			});
-
-			// Columns missing from the order sort last, so the visible ones suffice.
-			setColumnOrder(STORAGE_KEY, next.map(columnIdOf));
-		},
-		[columns],
-	);
-
-	return {
-		columns,
-		selectedFields,
-		onFieldsChange,
-		requiredFields: [TRACE_ID_COLUMN_ID],
-		isLoading: !isFetched,
-	};
-}

frontend/src/container/LLMObservability/Explorer/constants.ts

@@ -1,6 +1,3 @@
-import { TelemetrytypesFieldContextDTO } from 'api/generated/services/sigNoz.schemas';
-import { TelemetryFieldKey } from 'types/api/v5/queryRange';
-
 export const TOOLBAR_VIEWS = {
 	list: {
 		name: 'list',
@@ -37,29 +34,3 @@ export const TOOLBAR_VIEWS = {
 		key: 'clickhouse',
 	},
 };
-
-export const TRACE_VIEW_DEFAULT_ORDER_BY = 'last_activity_time:desc';
-
-/** Display-only: ordering or filtering on one is an error, so the keys endpoint omits them. */
-export const TRACE_VIEW_COLUMN_EXTRA_FIELDS: TelemetryFieldKey[] = [
-	{ name: 'service.name', fieldContext: 'resource' },
-	{ name: 'root_span_name' },
-	{ name: 'trace_duration_nano' },
-	{ name: 'span_count' },
-	{ name: 'trace_id' },
-	{ name: 'start_time' },
-	{ name: 'end_time' },
-	{ name: 'error_count' },
-	{ name: 'input' },
-	{ name: 'output' },
-] as TelemetryFieldKey[];
-
-export const TRACE_VIEW_FIELD_KEYS = {
-	fieldContext: TelemetrytypesFieldContextDTO.trace,
-} as const;
-
-export const TRACE_VIEW_BUILDER_QUERY_TYPE = 'builder_ai_query' as const;
-
-export const TRACE_VIEW_ORDER_BY_EXTRA_FIELDS: TelemetryFieldKey[] = [
-	{ name: 'last_activity_time' } as TelemetryFieldKey,
-];

frontend/src/container/LogExplorerQuerySection/LogExplorerQuerySection.test.tsx

@@ -92,25 +92,17 @@ jest.mock('hooks/useDarkMode', () => ({
 	useIsDarkMode: (): boolean => false,
 }));
 
-jest.mock('api/querySuggestions/getFieldKeySuggestions', () => ({
-	getFieldKeySuggestions: jest.fn().mockResolvedValue({
-		status: 'success',
-		data: { complete: true, keys: {} },
+jest.mock('api/querySuggestions/getKeySuggestions', () => ({
+	getKeySuggestions: jest.fn().mockResolvedValue({
+		data: {
+			data: { keys: {} },
+		},
 	}),
 }));
 
-jest.mock('api/querySuggestions/getFieldValueSuggestions', () => ({
-	getFieldValueSuggestions: jest.fn().mockResolvedValue({
-		status: 'success',
-		data: {
-			complete: true,
-			values: {
-				stringValues: [],
-				numberValues: [],
-				boolValues: [],
-				relatedValues: [],
-			},
-		},
+jest.mock('api/querySuggestions/getValueSuggestion', () => ({
+	getValueSuggestions: jest.fn().mockResolvedValue({
+		data: { data: { values: { stringValues: [], numberValues: [] } } },
 	}),
 }));
 

frontend/src/container/LogsExplorerViews/tests/LogsExplorerPagination.test.tsx

@@ -179,10 +179,7 @@ const setupServer = (capturedPayloads: QueryRangePayloadV5[]): void => {
 		),
 		// Add handler for the fields endpoint that's causing warnings
 		rest.get(`${ENVIRONMENT.baseURL}/api/v1/fields/keys`, async (req, res, ctx) =>
-			res(
-				ctx.status(200),
-				ctx.json({ status: 'success', data: { complete: true, keys: {} } }),
-			),
+			res(ctx.status(200), ctx.json([])),
 		),
 	);
 };

frontend/src/hooks/querySuggestions/__tests__/useFieldKeysSuggestion.test.ts

@@ -1,185 +0,0 @@
-import { QueryClient } from 'react-query';
-import { ENVIRONMENT } from 'constants/env';
-import { server } from 'mocks-server/server';
-import { rest } from 'msw';
-import { TelemetrytypesFieldContextDTO } from 'api/generated/services/sigNoz.schemas';
-import { FieldKeysConfig, FieldKeysResponse } from 'api/querySuggestions/types';
-import { BuilderQueryType, TelemetryFieldKey } from 'types/api/v5/queryRange';
-import { DATA_SOURCE_TO_SIGNAL, DataSource } from 'types/common/queryBuilder';
-
-import {
-	getFieldKeysQueryOptions,
-	toFieldKeys,
-} from '../useFieldKeysSuggestion';
-
-/** Drives the options object the way react-query does, without a client. */
-const fetchKeys = async (
-	fieldKeysConfig: FieldKeysConfig,
-	builderQueryType?: BuilderQueryType,
-): Promise<TelemetryFieldKey[]> => {
-	const { queryFn, select } = getFieldKeysQueryOptions(
-		fieldKeysConfig,
-		builderQueryType,
-	);
-	const response = await (
-		queryFn as (context: { signal: AbortSignal }) => Promise<FieldKeysResponse>
-	)({ signal: new AbortController().signal });
-
-	return select?.(response) ?? [];
-};
-
-const mockKeys = (
-	path: '/api/v1/ai_observability/fields/keys' | '/api/v1/fields/keys',
-	names: string[],
-	onRequest?: (params: URLSearchParams) => void,
-): void => {
-	server.use(
-		rest.get(`${ENVIRONMENT.baseURL}${path}`, (req, res, ctx) => {
-			onRequest?.(req.url.searchParams);
-			return res(
-				ctx.status(200),
-				ctx.json({
-					status: 'success',
-					data: {
-						complete: true,
-						keys: Object.fromEntries(names.map((name) => [name, [{ name }]])),
-					},
-				}),
-			);
-		}),
-	);
-};
-
-describe('useFieldKeysSuggestion', () => {
-	let queryClient: QueryClient;
-
-	beforeEach(() => {
-		queryClient = new QueryClient({
-			defaultOptions: { queries: { retry: false } },
-		});
-	});
-
-	it('reads the ai_observability endpoint for a builder_ai_query', async () => {
-		const seen: URLSearchParams[] = [];
-		mockKeys(
-			'/api/v1/ai_observability/fields/keys',
-			['total_tokens'],
-			(params) => {
-				seen.push(params);
-			},
-		);
-
-		const keys = await fetchKeys(
-			{
-				signal: DATA_SOURCE_TO_SIGNAL[DataSource.TRACES],
-				searchText: 'llm',
-				fieldContext: TelemetrytypesFieldContextDTO.trace,
-			},
-			'builder_ai_query',
-		);
-
-		expect(seen).toHaveLength(1);
-		expect(seen[0]?.get('searchText')).toBe('llm');
-		expect(seen[0]?.get('fieldContext')).toBe(
-			TelemetrytypesFieldContextDTO.trace,
-		);
-		expect(keys.map((key) => key.name)).toStrictEqual(['total_tokens']);
-	});
-
-	it('reads the generic endpoint for an unmarked query', async () => {
-		const seen: URLSearchParams[] = [];
-		mockKeys('/api/v1/fields/keys', ['service.name'], (params) => {
-			seen.push(params);
-		});
-
-		const keys = await fetchKeys({
-			signal: DATA_SOURCE_TO_SIGNAL[DataSource.TRACES],
-			searchText: 'svc',
-		});
-
-		expect(seen).toHaveLength(1);
-		expect(seen[0]?.get('signal')).toBe(DataSource.TRACES);
-		expect(seen[0]?.get('searchText')).toBe('svc');
-		expect(keys.map((key) => key.name)).toStrictEqual(['service.name']);
-	});
-
-	it('reads the trace context of the ai_observability endpoint', async () => {
-		const seen: URLSearchParams[] = [];
-		mockKeys(
-			'/api/v1/ai_observability/fields/keys',
-			['total_tokens'],
-			(params) => {
-				seen.push(params);
-			},
-		);
-
-		const keys = await fetchKeys(
-			{
-				signal: DATA_SOURCE_TO_SIGNAL[DataSource.TRACES],
-				searchText: '',
-				fieldContext: TelemetrytypesFieldContextDTO.trace,
-			},
-			'builder_ai_query',
-		);
-
-		expect(seen[0]?.get('searchText')).toBe('');
-		expect(keys.map((key) => key.name)).toStrictEqual(['total_tokens']);
-	});
-
-	it('reuses the cached keys response for a second empty search', async () => {
-		const seen: URLSearchParams[] = [];
-		mockKeys(
-			'/api/v1/ai_observability/fields/keys',
-			['total_tokens'],
-			(params) => {
-				seen.push(params);
-			},
-		);
-
-		const fieldKeysConfig = {
-			signal: DATA_SOURCE_TO_SIGNAL[DataSource.TRACES],
-			searchText: '',
-			fieldContext: TelemetrytypesFieldContextDTO.trace,
-		};
-
-		// Built twice: equal keys must resolve to one cache entry, not two requests.
-		await queryClient.fetchQuery(
-			getFieldKeysQueryOptions(fieldKeysConfig, 'builder_ai_query'),
-		);
-		await queryClient.fetchQuery(
-			getFieldKeysQueryOptions(fieldKeysConfig, 'builder_ai_query'),
-		);
-
-		expect(seen).toHaveLength(1);
-	});
-
-	it('hands the query signal to the fetcher so a superseded search aborts', async () => {
-		server.use(
-			rest.get(`${ENVIRONMENT.baseURL}/api/v1/fields/keys`, (_req, res, ctx) =>
-				res(ctx.delay(500), ctx.status(200), ctx.json({ status: 'success' })),
-			),
-		);
-
-		const controller = new AbortController();
-		const { queryFn } = getFieldKeysQueryOptions({
-			signal: DATA_SOURCE_TO_SIGNAL[DataSource.LOGS],
-			searchText: 'svc',
-		});
-		const pending = (
-			queryFn as (context: { signal: AbortSignal }) => Promise<unknown>
-		)({ signal: controller.signal });
-
-		controller.abort();
-
-		await expect(pending).rejects.toBeDefined();
-	});
-
-	it('treats a null keys map as empty', () => {
-		expect(
-			toFieldKeys({
-				status: 'success',
-				data: { complete: false, keys: null },
-			}),
-		).toStrictEqual([]);
-	});
-});

frontend/src/hooks/querySuggestions/useFieldKeysSuggestion.ts

@@ -1,50 +0,0 @@
-import {
-	QueryKey,
-	useQuery,
-	UseQueryOptions,
-	UseQueryResult,
-} from 'react-query';
-import { ErrorType } from 'api/generatedAPIInstance';
-import { RenderErrorResponseDTO } from 'api/generated/services/sigNoz.schemas';
-import { getFieldKeySuggestions } from 'api/querySuggestions/getFieldKeySuggestions';
-import { FIELD_API_CACHE_TIME } from 'constants/queryCacheTime';
-import { REACT_QUERY_KEY } from 'constants/reactQueryKeys';
-import { FieldKeysConfig, FieldKeysResponse } from 'api/querySuggestions/types';
-import { BuilderQueryType, TelemetryFieldKey } from 'types/api/v5/queryRange';
-
-export type FieldKeysQueryOptions = UseQueryOptions<
-	FieldKeysResponse,
-	ErrorType<RenderErrorResponseDTO>,
-	TelemetryFieldKey[]
-> & { queryKey: QueryKey };
-
-export const toFieldKeys = (
-	res: FieldKeysResponse | undefined,
-): TelemetryFieldKey[] =>
-	Object.values(res?.data?.keys ?? {})
-		.flat()
-		.map((key) => ({ ...key }) as TelemetryFieldKey);
-
-export const getFieldKeysQueryOptions = (
-	fieldKeysConfig: FieldKeysConfig,
-	builderQueryType?: BuilderQueryType,
-): FieldKeysQueryOptions => ({
-	queryKey: [
-		REACT_QUERY_KEY.FIELD_KEYS_SUGGESTION,
-		builderQueryType,
-		fieldKeysConfig,
-	],
-	queryFn: ({ signal }): Promise<FieldKeysResponse> =>
-		getFieldKeySuggestions(fieldKeysConfig, builderQueryType, signal),
-	select: toFieldKeys,
-	staleTime: FIELD_API_CACHE_TIME,
-	cacheTime: FIELD_API_CACHE_TIME,
-	refetchOnMount: false,
-	refetchOnWindowFocus: false,
-});
-
-export const useFieldKeysSuggestion = (
-	fieldKeysConfig: FieldKeysConfig,
-	builderQueryType?: BuilderQueryType,
-): UseQueryResult<TelemetryFieldKey[], ErrorType<RenderErrorResponseDTO>> =>
-	useQuery(getFieldKeysQueryOptions(fieldKeysConfig, builderQueryType));

frontend/src/pages/DashboardPage/DashboardContainer/PanelsAndSectionsLayout/Panel/__tests__/useViewPanel.addons.test.tsx

@@ -52,24 +52,14 @@ jest.mock('hooks/useSafeNavigate', () =>
 		.createBrowserHistorySafeNavigateMock(),
 );
 
-jest.mock('api/querySuggestions/getFieldKeySuggestions', () => ({
-	getFieldKeySuggestions: jest.fn().mockResolvedValue({
-		status: 'success',
-		data: { complete: true, keys: {} },
-	}),
+jest.mock('api/querySuggestions/getKeySuggestions', () => ({
+	getKeySuggestions: jest
+		.fn()
+		.mockResolvedValue({ data: { data: { keys: {} } } }),
 }));
-jest.mock('api/querySuggestions/getFieldValueSuggestions', () => ({
-	getFieldValueSuggestions: jest.fn().mockResolvedValue({
-		status: 'success',
-		data: {
-			complete: true,
-			values: {
-				stringValues: [],
-				numberValues: [],
-				boolValues: [],
-				relatedValues: [],
-			},
-		},
+jest.mock('api/querySuggestions/getValueSuggestion', () => ({
+	getValueSuggestions: jest.fn().mockResolvedValue({
+		data: { data: { values: { stringValues: [], numberValues: [] } } },
 	}),
 }));
 

frontend/src/types/common/queryBuilder.ts

@@ -1,5 +1,4 @@
 import { Dispatch, SetStateAction } from 'react';
-import { TelemetrytypesSignalDTO } from 'api/generated/services/sigNoz.schemas';
 import { PANEL_TYPES } from 'constants/queryBuilder';
 import ROUTES from 'constants/routes';
 import { Format } from 'constants/formats/types';
@@ -23,15 +22,6 @@ export enum DataSource {
 	LOGS = 'logs',
 }
 
-export const DATA_SOURCE_TO_SIGNAL: Record<
-	DataSource,
-	TelemetrytypesSignalDTO
-> = {
-	[DataSource.METRICS]: TelemetrytypesSignalDTO.metrics,
-	[DataSource.TRACES]: TelemetrytypesSignalDTO.traces,
-	[DataSource.LOGS]: TelemetrytypesSignalDTO.logs,
-};
-
 export enum StringOperators {
 	NOOP = 'noop',
 	COUNT = 'count',

frontend/src/utils/__tests__/extraFields.test.ts

@@ -1,44 +0,0 @@
-import { TelemetryFieldKey } from 'types/api/v5/queryRange';
-
-import { mergeExtraFields } from '../extraFields';
-
-describe('mergeExtraFields', () => {
-	it('drops fetched keys that share a composite key with an extra field', () => {
-		expect(
-			mergeExtraFields(
-				[{ name: 'trace_id' } as TelemetryFieldKey],
-				[
-					{ name: 'trace_id' } as TelemetryFieldKey,
-					{ name: 'total_tokens' } as TelemetryFieldKey,
-				],
-			).map((key) => key.name),
-		).toStrictEqual(['trace_id', 'total_tokens']);
-	});
-
-	it('keeps extra and fetched keys that share a name but differ in context', () => {
-		expect(
-			mergeExtraFields(
-				[{ name: 'service.name', fieldContext: 'resource' } as TelemetryFieldKey],
-				[
-					{
-						name: 'service.name',
-						fieldContext: 'attribute',
-					} as TelemetryFieldKey,
-					{ name: 'total_tokens' } as TelemetryFieldKey,
-				],
-			),
-		).toStrictEqual([
-			{ name: 'service.name', fieldContext: 'resource' },
-			{ name: 'service.name', fieldContext: 'attribute' },
-			{ name: 'total_tokens' },
-		]);
-	});
-
-	it('returns the fetched keys when there are no extra fields', () => {
-		expect(
-			mergeExtraFields(undefined, [
-				{ name: 'total_tokens' } as TelemetryFieldKey,
-			]).map((key) => key.name),
-		).toStrictEqual(['total_tokens']);
-	});
-});

frontend/src/utils/extraFields.ts

@@ -1,23 +0,0 @@
-import { buildCompositeKey } from 'container/OptionsMenu/utils';
-import { TelemetryFieldKey } from 'types/api/v5/queryRange';
-
-export const mergeExtraFields = (
-	extra: TelemetryFieldKey[] = [],
-	fetched: TelemetryFieldKey[],
-): TelemetryFieldKey[] => {
-	const extraKeys = new Set(
-		extra.map((field) =>
-			buildCompositeKey(field.name, field.fieldContext, field.fieldDataType),
-		),
-	);
-
-	return [
-		...extra,
-		...fetched.filter(
-			(field) =>
-				!extraKeys.has(
-					buildCompositeKey(field.name, field.fieldContext, field.fieldDataType),
-				),
-		),
-	];
-};

pkg/modules/dashboard/dashboard.go

@@ -82,10 +82,6 @@ type Module interface {
 
 	DeleteV2(ctx context.Context, orgID valuer.UUID, id valuer.UUID) error
 
-	// DeleteUnsafeV2 deletes a v2 dashboard and its related state without applying deletion guards.
-	// Intended for internal system callers.
-	DeleteUnsafeV2(ctx context.Context, orgID valuer.UUID, id valuer.UUID) error
-
 	DeletePreferencesForUser(ctx context.Context, orgID valuer.UUID, userID valuer.UUID) error
 
 	// get the v2 dashboard data by public dashboard id

pkg/modules/dashboard/impldashboard/v2_module.go

@@ -294,15 +294,6 @@ func (module *module) DeleteV2(ctx context.Context, orgID valuer.UUID, id valuer
 		return err
 	}
 
-	return module.deleteV2(ctx, orgID, id)
-}
-
-// DeleteUnsafeV2 deletes a v2 dashboard bypassing the guards. Intended for internal system callers.
-func (module *module) DeleteUnsafeV2(ctx context.Context, orgID valuer.UUID, id valuer.UUID) error {
-	return module.deleteV2(ctx, orgID, id)
-}
-
-func (module *module) deleteV2(ctx context.Context, orgID valuer.UUID, id valuer.UUID) error {
 	return module.store.RunInTx(ctx, func(ctx context.Context) error {
 		// Syncing to an empty tag set drops every tag link for the dashboard.
 		if _, err := module.tagModule.SyncTags(ctx, orgID, coretypes.KindDashboard, id, nil); err != nil {

pkg/modules/organization/implorganization/setter.go

@@ -7,6 +7,7 @@ import (
 	"github.com/SigNoz/signoz/pkg/modules/dashboard"
 	"github.com/SigNoz/signoz/pkg/modules/organization"
 	"github.com/SigNoz/signoz/pkg/modules/quickfilter"
+	"github.com/SigNoz/signoz/pkg/modules/spanmapper"
 	"github.com/SigNoz/signoz/pkg/types"
 	"github.com/SigNoz/signoz/pkg/valuer"
 )
@@ -16,10 +17,11 @@ type setter struct {
 	alertmanager alertmanager.Alertmanager
 	quickfilter  quickfilter.Module
 	dashboard    dashboard.Module
+	spanMapper   spanmapper.Module
 }
 
-func NewSetter(store types.OrganizationStore, alertmanager alertmanager.Alertmanager, quickfilter quickfilter.Module, dashboard dashboard.Module) organization.Setter {
-	return &setter{store: store, alertmanager: alertmanager, quickfilter: quickfilter, dashboard: dashboard}
+func NewSetter(store types.OrganizationStore, alertmanager alertmanager.Alertmanager, quickfilter quickfilter.Module, dashboard dashboard.Module, spanMapper spanmapper.Module) organization.Setter {
+	return &setter{store: store, alertmanager: alertmanager, quickfilter: quickfilter, dashboard: dashboard, spanMapper: spanMapper}
 }
 
 func (module *setter) Create(ctx context.Context, organization *types.Organization, createManagedRoles func(context.Context, valuer.UUID) error) error {
@@ -43,6 +45,10 @@ func (module *setter) Create(ctx context.Context, organization *types.Organizati
 		return err
 	}
 
+	if err := module.spanMapper.ReconcileSystemGroups(ctx, organization.ID); err != nil {
+		return err
+	}
+
 	return nil
 }
 

pkg/modules/spanmapper/implspanmapper/definitions.go

@@ -0,0 +1,46 @@
+package implspanmapper
+
+import (
+	"embed"
+	"io/fs"
+	"path"
+
+	"github.com/SigNoz/signoz/pkg/errors"
+	"github.com/SigNoz/signoz/pkg/types/spantypes"
+)
+
+const definitionsRoot = "fs/definitions"
+
+//go:embed fs/definitions/*.json
+var definitionFiles embed.FS
+
+// NewSystemGroupRegistry parses every embedded definition. Definitions are
+// build-time assets validated by a test, so a failure here means the binary
+// shipped broken JSON.
+func NewSystemGroupRegistry() (spantypes.SpanMapperGroupRegistry, error) {
+	entries, err := fs.ReadDir(definitionFiles, definitionsRoot)
+	if err != nil {
+		return spantypes.SpanMapperGroupRegistry{}, errors.WrapInternalf(err, errors.CodeInternal, "couldn't read span mapper group definitions")
+	}
+
+	definitions := make([]spantypes.SpanMapperGroupDefinition, 0, len(entries))
+	for _, entry := range entries {
+		if entry.IsDir() {
+			continue
+		}
+
+		file := path.Join(definitionsRoot, entry.Name())
+		raw, err := definitionFiles.ReadFile(file)
+		if err != nil {
+			return spantypes.SpanMapperGroupRegistry{}, errors.WrapInternalf(err, errors.CodeInternal, "couldn't read %s", file)
+		}
+
+		definition, err := spantypes.NewSpanMapperGroupDefinition(raw)
+		if err != nil {
+			return spantypes.SpanMapperGroupRegistry{}, errors.Wrapf(err, errors.TypeInternal, errors.CodeInternal, "couldn't parse %s", file)
+		}
+		definitions = append(definitions, definition)
+	}
+
+	return spantypes.NewSpanMapperGroupRegistry(definitions)
+}

pkg/modules/spanmapper/implspanmapper/fs/definitions/gen_ai.agent.json

@@ -0,0 +1,79 @@
+{
+  "version": 1,
+  "definition": {
+    "name": "gen_ai.agent",
+    "condition": {
+      "attributes": [
+        {
+          "value": "agent"
+        }
+      ],
+      "resource": []
+    },
+    "enabled": true,
+    "mappers": [
+      {
+        "name": "gen_ai.agent.name",
+        "fieldContext": "attribute",
+        "config": {
+          "sources": [
+            {
+              "key": "agent.name",
+              "context": "attribute",
+              "operation": "copy",
+              "priority": 20
+            },
+            {
+              "key": "agent_name",
+              "context": "attribute",
+              "operation": "copy",
+              "priority": 10
+            }
+          ]
+        }
+      },
+      {
+        "name": "gen_ai.agent.id",
+        "fieldContext": "attribute",
+        "config": {
+          "sources": [
+            {
+              "key": "agent.id",
+              "context": "attribute",
+              "operation": "copy",
+              "priority": 10
+            }
+          ]
+        }
+      },
+      {
+        "name": "gen_ai.agent.description",
+        "fieldContext": "attribute",
+        "config": {
+          "sources": [
+            {
+              "key": "agent.description",
+              "context": "attribute",
+              "operation": "copy",
+              "priority": 10
+            }
+          ]
+        }
+      },
+      {
+        "name": "gen_ai.output.messages",
+        "fieldContext": "attribute",
+        "config": {
+          "sources": [
+            {
+              "key": "final_result",
+              "context": "attribute",
+              "operation": "copy",
+              "priority": 10
+            }
+          ]
+        }
+      }
+    ]
+  }
+}

pkg/modules/spanmapper/implspanmapper/fs/definitions/gen_ai.llm.json

@@ -0,0 +1,347 @@
+{
+  "version": 1,
+  "definition": {
+    "name": "gen_ai.llm",
+    "condition": {
+      "attributes": [
+        {
+          "value": "model"
+        }
+      ],
+      "resource": []
+    },
+    "enabled": true,
+    "mappers": [
+      {
+        "name": "gen_ai.request.model",
+        "fieldContext": "attribute",
+        "config": {
+          "sources": [
+            {
+              "key": "llm.model_name",
+              "context": "attribute",
+              "operation": "copy",
+              "priority": 60
+            },
+            {
+              "key": "llm.request.model",
+              "context": "attribute",
+              "operation": "copy",
+              "priority": 50
+            },
+            {
+              "key": "ai.model.id",
+              "context": "attribute",
+              "operation": "copy",
+              "priority": 40
+            },
+            {
+              "key": "langfuse.observation.model.name",
+              "context": "attribute",
+              "operation": "copy",
+              "priority": 30
+            },
+            {
+              "key": "embedding.model_name",
+              "context": "attribute",
+              "operation": "copy",
+              "priority": 20
+            },
+            {
+              "key": "model",
+              "context": "attribute",
+              "operation": "copy",
+              "priority": 10
+            }
+          ]
+        }
+      },
+      {
+        "name": "gen_ai.response.model",
+        "fieldContext": "attribute",
+        "config": {
+          "sources": [
+            {
+              "key": "llm.response.model",
+              "context": "attribute",
+              "operation": "copy",
+              "priority": 20
+            },
+            {
+              "key": "ai.response.model",
+              "context": "attribute",
+              "operation": "copy",
+              "priority": 10
+            }
+          ]
+        }
+      },
+      {
+        "name": "gen_ai.provider.name",
+        "fieldContext": "attribute",
+        "config": {
+          "sources": [
+            {
+              "key": "gen_ai.system",
+              "context": "attribute",
+              "operation": "copy",
+              "priority": 50
+            },
+            {
+              "key": "llm.vendor",
+              "context": "attribute",
+              "operation": "copy",
+              "priority": 40
+            },
+            {
+              "key": "llm.provider",
+              "context": "attribute",
+              "operation": "copy",
+              "priority": 30
+            },
+            {
+              "key": "llm.system",
+              "context": "attribute",
+              "operation": "copy",
+              "priority": 20
+            },
+            {
+              "key": "ai.model.provider",
+              "context": "attribute",
+              "operation": "copy",
+              "priority": 10
+            }
+          ]
+        }
+      },
+      {
+        "name": "gen_ai.operation.name",
+        "fieldContext": "attribute",
+        "config": {
+          "sources": [
+            {
+              "key": "llm.request.type",
+              "context": "attribute",
+              "operation": "copy",
+              "priority": 10
+            }
+          ]
+        }
+      },
+      {
+        "name": "gen_ai.usage.input_tokens",
+        "fieldContext": "attribute",
+        "config": {
+          "sources": [
+            {
+              "key": "gen_ai.usage.prompt_tokens",
+              "context": "attribute",
+              "operation": "copy",
+              "priority": 50
+            },
+            {
+              "key": "llm.usage.prompt_tokens",
+              "context": "attribute",
+              "operation": "copy",
+              "priority": 40
+            },
+            {
+              "key": "llm.token_count.prompt",
+              "context": "attribute",
+              "operation": "copy",
+              "priority": 30
+            },
+            {
+              "key": "ai.usage.inputTokens",
+              "context": "attribute",
+              "operation": "copy",
+              "priority": 20
+            },
+            {
+              "key": "ai.usage.promptTokens",
+              "context": "attribute",
+              "operation": "copy",
+              "priority": 10
+            }
+          ]
+        }
+      },
+      {
+        "name": "gen_ai.usage.output_tokens",
+        "fieldContext": "attribute",
+        "config": {
+          "sources": [
+            {
+              "key": "gen_ai.usage.completion_tokens",
+              "context": "attribute",
+              "operation": "copy",
+              "priority": 50
+            },
+            {
+              "key": "llm.usage.completion_tokens",
+              "context": "attribute",
+              "operation": "copy",
+              "priority": 40
+            },
+            {
+              "key": "llm.token_count.completion",
+              "context": "attribute",
+              "operation": "copy",
+              "priority": 30
+            },
+            {
+              "key": "ai.usage.outputTokens",
+              "context": "attribute",
+              "operation": "copy",
+              "priority": 20
+            },
+            {
+              "key": "ai.usage.completionTokens",
+              "context": "attribute",
+              "operation": "copy",
+              "priority": 10
+            }
+          ]
+        }
+      },
+      {
+        "name": "gen_ai.usage.cache_read.input_tokens",
+        "fieldContext": "attribute",
+        "config": {
+          "sources": [
+            {
+              "key": "gen_ai.usage.cache_read_input_tokens",
+              "context": "attribute",
+              "operation": "copy",
+              "priority": 30
+            },
+            {
+              "key": "llm.token_count.prompt_details.cache_read",
+              "context": "attribute",
+              "operation": "copy",
+              "priority": 20
+            },
+            {
+              "key": "ai.usage.cachedInputTokens",
+              "context": "attribute",
+              "operation": "copy",
+              "priority": 10
+            }
+          ]
+        }
+      },
+      {
+        "name": "gen_ai.usage.cache_creation.input_tokens",
+        "fieldContext": "attribute",
+        "config": {
+          "sources": [
+            {
+              "key": "gen_ai.usage.cache_write.input_tokens",
+              "context": "attribute",
+              "operation": "copy",
+              "priority": 30
+            },
+            {
+              "key": "gen_ai.usage.cache_creation_input_tokens",
+              "context": "attribute",
+              "operation": "copy",
+              "priority": 20
+            },
+            {
+              "key": "llm.token_count.prompt_details.cache_write",
+              "context": "attribute",
+              "operation": "copy",
+              "priority": 10
+            }
+          ]
+        }
+      },
+      {
+        "name": "gen_ai.input.messages",
+        "fieldContext": "attribute",
+        "config": {
+          "sources": [
+            {
+              "key": "gen_ai.prompt",
+              "context": "attribute",
+              "operation": "copy",
+              "priority": 30
+            },
+            {
+              "key": "ai.prompt.messages",
+              "context": "attribute",
+              "operation": "copy",
+              "priority": 20
+            },
+            {
+              "key": "input.value",
+              "context": "attribute",
+              "operation": "copy",
+              "priority": 10
+            }
+          ]
+        }
+      },
+      {
+        "name": "gen_ai.output.messages",
+        "fieldContext": "attribute",
+        "config": {
+          "sources": [
+            {
+              "key": "gen_ai.completion",
+              "context": "attribute",
+              "operation": "copy",
+              "priority": 30
+            },
+            {
+              "key": "ai.response.text",
+              "context": "attribute",
+              "operation": "copy",
+              "priority": 20
+            },
+            {
+              "key": "output.value",
+              "context": "attribute",
+              "operation": "copy",
+              "priority": 10
+            }
+          ]
+        }
+      },
+      {
+        "name": "gen_ai.conversation.id",
+        "fieldContext": "attribute",
+        "config": {
+          "sources": [
+            {
+              "key": "session.id",
+              "context": "attribute",
+              "operation": "copy",
+              "priority": 20
+            },
+            {
+              "key": "langfuse.session.id",
+              "context": "attribute",
+              "operation": "copy",
+              "priority": 10
+            }
+          ]
+        }
+      },
+      {
+        "name": "gen_ai.response.finish_reason",
+        "fieldContext": "attribute",
+        "config": {
+          "sources": [
+            {
+              "key": "ai.response.finishReason",
+              "context": "attribute",
+              "operation": "copy",
+              "priority": 10
+            }
+          ]
+        }
+      }
+    ]
+  }
+}

pkg/modules/spanmapper/implspanmapper/fs/definitions/gen_ai.tool.json

@@ -0,0 +1,135 @@
+{
+  "version": 1,
+  "definition": {
+    "name": "gen_ai.tool",
+    "condition": {
+      "attributes": [
+        {
+          "value": "tool"
+        }
+      ],
+      "resource": []
+    },
+    "enabled": true,
+    "mappers": [
+      {
+        "name": "gen_ai.tool.name",
+        "fieldContext": "attribute",
+        "config": {
+          "sources": [
+            {
+              "key": "tool.name",
+              "context": "attribute",
+              "operation": "copy",
+              "priority": 20
+            },
+            {
+              "key": "ai.toolCall.name",
+              "context": "attribute",
+              "operation": "copy",
+              "priority": 10
+            }
+          ]
+        }
+      },
+      {
+        "name": "gen_ai.tool.call.id",
+        "fieldContext": "attribute",
+        "config": {
+          "sources": [
+            {
+              "key": "tool.id",
+              "context": "attribute",
+              "operation": "copy",
+              "priority": 20
+            },
+            {
+              "key": "ai.toolCall.id",
+              "context": "attribute",
+              "operation": "copy",
+              "priority": 10
+            }
+          ]
+        }
+      },
+      {
+        "name": "gen_ai.tool.description",
+        "fieldContext": "attribute",
+        "config": {
+          "sources": [
+            {
+              "key": "tool.description",
+              "context": "attribute",
+              "operation": "copy",
+              "priority": 10
+            }
+          ]
+        }
+      },
+      {
+        "name": "gen_ai.tool.call.arguments",
+        "fieldContext": "attribute",
+        "config": {
+          "sources": [
+            {
+              "key": "ai.toolCall.args",
+              "context": "attribute",
+              "operation": "copy",
+              "priority": 40
+            },
+            {
+              "key": "traceloop.entity.input",
+              "context": "attribute",
+              "operation": "copy",
+              "priority": 30
+            },
+            {
+              "key": "gcp.vertex.agent.tool_call_args",
+              "context": "attribute",
+              "operation": "copy",
+              "priority": 20
+            },
+            {
+              "key": "input.value",
+              "context": "attribute",
+              "operation": "copy",
+              "priority": 10
+            }
+          ]
+        }
+      },
+      {
+        "name": "gen_ai.tool.call.result",
+        "fieldContext": "attribute",
+        "config": {
+          "sources": [
+            {
+              "key": "ai.toolCall.result",
+              "context": "attribute",
+              "operation": "copy",
+              "priority": 40
+            },
+            {
+              "key": "traceloop.entity.output",
+              "context": "attribute",
+              "operation": "copy",
+              "priority": 30
+            },
+            {
+              "key": "gcp.vertex.agent.tool_response",
+              "context": "attribute",
+              "operation": "copy",
+              "priority": 20
+            },
+            {
+              "key": "output.value",
+              "context": "attribute",
+              "operation": "copy",
+              "priority": 10
+            }
+          ]
+        }
+      }
+    ]
+  }
+}

pkg/modules/spanmapper/implspanmapper/handler.go

@@ -69,6 +69,10 @@ func (h *handler) CreateGroup(rw http.ResponseWriter, r *http.Request) {
 		render.Error(rw, err)
 		return
 	}
+	if err := req.Validate(); err != nil {
+		render.Error(rw, err)
+		return
+	}
 
 	group := spantypes.NewSpanMapperGroup(orgID, claims.Email, req)
 
@@ -191,6 +195,10 @@ func (h *handler) CreateMapper(rw http.ResponseWriter, r *http.Request) {
 		render.Error(rw, err)
 		return
 	}
+	if err := req.Validate(); err != nil {
+		render.Error(rw, err)
+		return
+	}
 	mapper := spantypes.NewSpanMapper(groupID, claims.Email, req)
 
 	if err := h.module.CreateMapper(ctx, orgID, groupID, mapper); err != nil {

pkg/modules/spanmapper/implspanmapper/module.go

@@ -5,6 +5,7 @@ import (
 	"encoding/json"
 
 	"github.com/SigNoz/signoz/pkg/errors"
+	"github.com/SigNoz/signoz/pkg/factory"
 	"github.com/SigNoz/signoz/pkg/flagger"
 	"github.com/SigNoz/signoz/pkg/modules/spanmapper"
 	"github.com/SigNoz/signoz/pkg/query-service/agentConf"
@@ -14,13 +15,24 @@ import (
 	"github.com/SigNoz/signoz/pkg/valuer"
 )
 
+// maxTestSpans bounds the input size: every test request boots a full
+// in-memory collector pipeline and is reachable with viewer access.
+const maxTestSpans = 100
+
 type module struct {
-	store   spantypes.SpanMapperStore
-	flagger flagger.Flagger
+	store    spantypes.SpanMapperStore
+	flagger  flagger.Flagger
+	registry spantypes.SpanMapperGroupRegistry
+	settings factory.ScopedProviderSettings
 }
 
-func NewModule(store spantypes.SpanMapperStore, flagger flagger.Flagger) spanmapper.Module {
-	return &module{store: store, flagger: flagger}
+func NewModule(store spantypes.SpanMapperStore, flagger flagger.Flagger, registry spantypes.SpanMapperGroupRegistry, providerSettings factory.ProviderSettings) spanmapper.Module {
+	return &module{
+		store:    store,
+		flagger:  flagger,
+		registry: registry,
+		settings: factory.NewScopedProviderSettings(providerSettings, "github.com/SigNoz/signoz/pkg/modules/spanmapper/implspanmapper"),
+	}
 }
 
 func (module *module) ListGroups(ctx context.Context, orgID valuer.UUID, q *spantypes.ListSpanMapperGroupsQuery) ([]*spantypes.SpanMapperGroup, error) {
@@ -32,6 +44,9 @@ func (module *module) GetGroup(ctx context.Context, orgID, id valuer.UUID) (*spa
 }
 
 func (module *module) CreateGroup(ctx context.Context, orgID valuer.UUID, group *spantypes.SpanMapperGroup) error {
+	if module.registry.IsReserved(group.Name) {
+		return errors.Newf(errors.TypeInvalidInput, spantypes.ErrCodeMappingGroupNameReserved, "group name %q is reserved for a default group", group.Name)
+	}
 	return module.store.CreateGroup(ctx, group)
 }
 
@@ -40,10 +55,14 @@ func (module *module) UpdateGroup(ctx context.Context, orgID, id valuer.UUID, na
 	if err != nil {
 		return err
 	}
-	group.Update(name, condition, enabled, updatedBy)
+	if name != nil && *name != group.Name && module.registry.IsReserved(*name) {
+		return errors.Newf(errors.TypeInvalidInput, spantypes.ErrCodeMappingGroupNameReserved, "group name %q is reserved for a default group", *name)
+	}
+	if err := group.Update(name, condition, enabled, updatedBy); err != nil {
+		return err
+	}
 
-	err = module.store.UpdateGroup(ctx, group)
-	if err != nil {
+	if err := module.store.UpdateGroup(ctx, group); err != nil {
 		return err
 	}
 	agentConf.NotifyConfigUpdate(ctx)
@@ -51,8 +70,7 @@ func (module *module) UpdateGroup(ctx context.Context, orgID, id valuer.UUID, na
 }
 
 func (module *module) DeleteGroup(ctx context.Context, orgID, id valuer.UUID) error {
-	err := module.store.DeleteGroup(ctx, orgID, id)
-	if err != nil {
+	if err := module.store.DeleteGroup(ctx, orgID, id); err != nil {
 		return err
 	}
 	agentConf.NotifyConfigUpdate(ctx)
@@ -81,14 +99,13 @@ func (module *module) CreateMapper(ctx context.Context, orgID, groupID valuer.UU
 }
 
 func (module *module) UpdateMapper(ctx context.Context, orgID, groupID, id valuer.UUID, fieldContext spantypes.FieldContext, config *spantypes.SpanMapperConfig, enabled *bool, updatedBy string) error {
-	if _, err := module.store.GetGroup(ctx, orgID, groupID); err != nil {
-		return err
-	}
 	mapper, err := module.store.GetMapper(ctx, orgID, groupID, id)
 	if err != nil {
 		return err
 	}
-	mapper.Update(fieldContext, config, enabled, updatedBy)
+	if err := mapper.Update(fieldContext, config, enabled, updatedBy); err != nil {
+		return err
+	}
 	err = module.store.UpdateMapper(ctx, mapper)
 	if err != nil {
 		return err
@@ -98,18 +115,13 @@ func (module *module) UpdateMapper(ctx context.Context, orgID, groupID, id value
 }
 
 func (module *module) DeleteMapper(ctx context.Context, orgID, groupID, id valuer.UUID) error {
-	err := module.store.DeleteMapper(ctx, orgID, groupID, id)
-	if err != nil {
+	if err := module.store.DeleteMapper(ctx, orgID, groupID, id, spantypes.SpanMapperOriginUser); err != nil {
 		return err
 	}
 	agentConf.NotifyConfigUpdate(ctx)
 	return nil
 }
 
-// maxTestSpans bounds the input size: every test request boots a full
-// in-memory collector pipeline and is reachable with viewer access.
-const maxTestSpans = 100
-
 func (module *module) TestMappers(ctx context.Context, orgID valuer.UUID, spans []spantypes.SpanMapperTestSpan, groups []*spantypes.SpanMapperGroupWithMappers) ([]spantypes.SpanMapperTestSpan, []string, error) {
 	if len(spans) == 0 {
 		return nil, nil, errors.New(errors.TypeInvalidInput, spantypes.ErrCodeMappingInvalidInput, "'spans' must contain at least one span")
@@ -130,37 +142,6 @@ func (module *module) TestMappers(ctx context.Context, orgID valuer.UUID, spans
 	return out, collectorLogs, nil
 }
 
-// backfillMappers loads saved mappers for any enabled group whose Mappers is
-// nil. Disabled groups are skipped: the simulation filters them out anyway,
-// so there is no point loading their mappers or failing on their names.
-func (module *module) backfillMappers(ctx context.Context, orgID valuer.UUID, groups []*spantypes.SpanMapperGroupWithMappers) ([]*spantypes.SpanMapperGroupWithMappers, error) {
-	savedGroups, err := module.store.ListGroups(ctx, orgID, nil)
-	if err != nil {
-		return nil, err
-	}
-	savedByName := make(map[string]*spantypes.SpanMapperGroup, len(savedGroups))
-	for _, g := range savedGroups {
-		savedByName[g.Name] = g
-	}
-
-	// For each group in the request, if Mappers is nil, load the saved mappers for that group name.
-	for _, g := range groups {
-		if g.Mappers != nil || !g.Group.Enabled {
-			continue
-		}
-		saved, ok := savedByName[g.Group.Name]
-		if !ok {
-			return nil, errors.Newf(errors.TypeNotFound, spantypes.ErrCodeMappingGroupNotFound, "no saved group named %q to load mappers from; send 'mappers' for new or edited groups", g.Group.Name)
-		}
-		loaded, err := module.store.ListMappers(ctx, orgID, saved.ID)
-		if err != nil {
-			return nil, err
-		}
-		g.Mappers = loaded
-	}
-	return groups, nil
-}
-
 func (module *module) AgentFeatureType() agentConf.AgentFeatureType {
 	return spantypes.SpanAttrMappingFeatureType
 }
@@ -196,6 +177,37 @@ func (module *module) RecommendAgentConfig(orgID valuer.UUID, currentConfYaml []
 	return updatedConf, string(serialized), nil
 }
 
+// backfillMappers loads saved mappers for any enabled group whose Mappers is
+// nil. Disabled groups are skipped: the simulation filters them out anyway,
+// so there is no point loading their mappers or failing on their names.
+func (module *module) backfillMappers(ctx context.Context, orgID valuer.UUID, groups []*spantypes.SpanMapperGroupWithMappers) ([]*spantypes.SpanMapperGroupWithMappers, error) {
+	savedGroups, err := module.store.ListGroups(ctx, orgID, nil)
+	if err != nil {
+		return nil, err
+	}
+	savedByName := make(map[string]*spantypes.SpanMapperGroup, len(savedGroups))
+	for _, g := range savedGroups {
+		savedByName[g.Name] = g
+	}
+
+	// For each group in the request, if Mappers is nil, load the saved mappers for that group name.
+	for _, g := range groups {
+		if g.Mappers != nil || !g.Group.Enabled {
+			continue
+		}
+		saved, ok := savedByName[g.Group.Name]
+		if !ok {
+			return nil, errors.Newf(errors.TypeNotFound, spantypes.ErrCodeMappingGroupNotFound, "no saved group named %q to load mappers from; send 'mappers' for new or edited groups", g.Group.Name)
+		}
+		loaded, err := module.store.ListMappers(ctx, orgID, saved.ID)
+		if err != nil {
+			return nil, err
+		}
+		g.Mappers = loaded
+	}
+	return groups, nil
+}
+
 // listEnabledGroupsWithMappers returns groups with their mappers.
 func (module *module) listEnabledGroupsWithMappers(ctx context.Context, orgID valuer.UUID) ([]*spantypes.SpanMapperGroupWithMappers, error) {
 	enabled := true

pkg/modules/spanmapper/implspanmapper/module_test.go

@@ -0,0 +1,228 @@
+package implspanmapper
+
+import (
+	"context"
+	"path/filepath"
+	"strconv"
+	"testing"
+	"time"
+
+	"github.com/SigNoz/signoz/pkg/factory/factorytest"
+	"github.com/SigNoz/signoz/pkg/sqlstore"
+	"github.com/SigNoz/signoz/pkg/sqlstore/sqlitesqlstore"
+	"github.com/SigNoz/signoz/pkg/types/spantypes"
+	"github.com/SigNoz/signoz/pkg/valuer"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+const testUser = "user@signoz.io"
+
+func newTestSQLStore(t *testing.T) sqlstore.SQLStore {
+	t.Helper()
+
+	store, err := sqlitesqlstore.New(context.Background(), factorytest.NewSettings(), sqlstore.Config{
+		Provider:   "sqlite",
+		Connection: sqlstore.ConnectionConfig{MaxOpenConns: 10},
+		Sqlite: sqlstore.SqliteConfig{
+			Path:            filepath.Join(t.TempDir(), "test.db"),
+			Mode:            "wal",
+			BusyTimeout:     5 * time.Second,
+			TransactionMode: "deferred",
+		},
+	})
+	require.NoError(t, err)
+
+	for _, model := range []any{
+		(*spantypes.StorableSpanMapperGroup)(nil),
+		(*spantypes.StorableSpanMapper)(nil),
+	} {
+		_, err := store.BunDB().NewCreateTable().Model(model).IfNotExists().Exec(context.Background())
+		require.NoError(t, err)
+	}
+
+	_, err = store.BunDB().Exec(`CREATE UNIQUE INDEX IF NOT EXISTS uq_span_mapper_group_org_name ON span_mapper_group (org_id, name)`)
+	require.NoError(t, err)
+	_, err = store.BunDB().Exec(`CREATE UNIQUE INDEX IF NOT EXISTS uq_span_mapper_group_name ON span_mapper (group_id, name)`)
+	require.NoError(t, err)
+
+	return store
+}
+
+func newTestModule(t *testing.T, sqlStore sqlstore.SQLStore, definitions ...spantypes.SpanMapperGroupDefinition) *module {
+	t.Helper()
+
+	registry, err := spantypes.NewSpanMapperGroupRegistry(definitions)
+	require.NoError(t, err)
+
+	return NewModule(NewStore(sqlStore), nil, registry, factorytest.NewSettings()).(*module)
+}
+
+func newTestDefinition(t *testing.T, version int, body string) spantypes.SpanMapperGroupDefinition {
+	t.Helper()
+
+	definition, err := spantypes.NewSpanMapperGroupDefinition([]byte(`{"version": ` + strconv.Itoa(version) + `, "definition": ` + body + `}`))
+	require.NoError(t, err)
+
+	return definition
+}
+
+// llmV1 ships two mappers; llmV2 renames a source, adds a mapper and drops one.
+const llmV1 = `{
+	"name": "llm",
+	"condition": {"attributes": [{"value": "model"}], "resource": []},
+	"enabled": true,
+	"mappers": [
+		{"name": "gen_ai.request.model", "fieldContext": "attribute", "config": {"sources": [
+			{"key": "llm.model_name", "context": "attribute", "operation": "copy", "priority": 20},
+			{"key": "ai.model.id", "context": "attribute", "operation": "copy", "priority": 10}
+		]}},
+		{"name": "gen_ai.input.messages", "fieldContext": "attribute", "config": {"sources": [
+			{"key": "gen_ai.prompt", "context": "attribute", "operation": "copy", "priority": 10}
+		]}}
+	]
+}`
+
+const llmV2 = `{
+	"name": "llm",
+	"condition": {"attributes": [{"value": "model"}, {"value": "llm."}], "resource": []},
+	"enabled": true,
+	"mappers": [
+		{"name": "gen_ai.request.model", "fieldContext": "attribute", "config": {"sources": [
+			{"key": "llm.model_name", "context": "attribute", "operation": "copy", "priority": 20},
+			{"key": "langfuse.observation.model.name", "context": "attribute", "operation": "copy", "priority": 10}
+		]}},
+		{"name": "gen_ai.provider.name", "fieldContext": "attribute", "config": {"sources": [
+			{"key": "llm.vendor", "context": "attribute", "operation": "copy", "priority": 10}
+		]}}
+	]
+}`
+
+func findMapper(t *testing.T, mappers []*spantypes.SpanMapper, name string) *spantypes.SpanMapper {
+	t.Helper()
+	for _, m := range mappers {
+		if m.Name == name {
+			return m
+		}
+	}
+	require.Failf(t, "mapper not found", "no mapper named %q", name)
+	return nil
+}
+
+func findSource(t *testing.T, sources []spantypes.SpanMapperSource, key string, origin spantypes.SpanMapperOrigin) spantypes.SpanMapperSource {
+	t.Helper()
+	for _, s := range sources {
+		if s.Key == key && s.Origin == origin {
+			return s
+		}
+	}
+	require.Failf(t, "source not found", "no %s source with key %q", origin.StringValue(), key)
+	return spantypes.SpanMapperSource{}
+}
+
+func TestReconcileUpgradeKeepsTogglesAndUserItems(t *testing.T) {
+	ctx := context.Background()
+	orgID := valuer.GenerateUUID()
+	sqlStore := newTestSQLStore(t)
+	v1 := newTestModule(t, sqlStore, newTestDefinition(t, 1, llmV1))
+	require.NoError(t, v1.ReconcileSystemGroups(ctx, orgID))
+
+	group, err := v1.store.GetGroupByName(ctx, orgID, "llm")
+	require.NoError(t, err)
+	mappers, err := v1.ListMappers(ctx, orgID, group.ID)
+	require.NoError(t, err)
+
+	// Switch the shipped substring off and add a user one.
+	off := false
+	require.NoError(t, v1.UpdateGroup(ctx, orgID, group.ID, nil, &spantypes.SpanMapperGroupCondition{
+		Attributes: []spantypes.SpanMapperGroupConditionKey{
+			{Value: "model", Enabled: false, Origin: spantypes.SpanMapperOriginSystem},
+			{Value: "gen_ai.request.model", Enabled: true, Origin: spantypes.SpanMapperOriginUser},
+		},
+		Resource: []spantypes.SpanMapperGroupConditionKey{},
+	}, &off, testUser))
+
+	// Switch a shipped source off, add a user override, and switch the mapper off.
+	model := findMapper(t, mappers, "gen_ai.request.model")
+	require.NoError(t, v1.UpdateMapper(ctx, orgID, group.ID, model.ID, spantypes.FieldContext{}, &spantypes.SpanMapperConfig{Sources: []spantypes.SpanMapperSource{
+		{Key: "llm.model_name", Context: spantypes.FieldContextSpanAttribute, Operation: spantypes.SpanMapperOperationCopy, Priority: 20, Enabled: false, Origin: spantypes.SpanMapperOriginSystem},
+		{Key: "llm.model_name", Context: spantypes.FieldContextSpanAttribute, Operation: spantypes.SpanMapperOperationMove, Priority: 1, Enabled: true, Origin: spantypes.SpanMapperOriginUser},
+	}}, &off, testUser))
+
+	// Add a user source to the mapper v2 stops shipping, so it must survive.
+	messages := findMapper(t, mappers, "gen_ai.input.messages")
+	require.NoError(t, v1.UpdateMapper(ctx, orgID, group.ID, messages.ID, spantypes.FieldContext{}, &spantypes.SpanMapperConfig{Sources: []spantypes.SpanMapperSource{
+		{Key: "input.value", Context: spantypes.FieldContextSpanAttribute, Operation: spantypes.SpanMapperOperationCopy, Priority: 1, Enabled: true},
+	}}, nil, testUser))
+
+	// A user mapper in the shipped group.
+	require.NoError(t, v1.CreateMapper(ctx, orgID, group.ID, spantypes.NewSpanMapper(group.ID, testUser, &spantypes.PostableSpanMapper{
+		Name: "gen_ai.custom", FieldContext: spantypes.FieldContextSpanAttribute, Enabled: true,
+		Config: spantypes.SpanMapperConfig{Sources: []spantypes.SpanMapperSource{{Key: "custom", Context: spantypes.FieldContextSpanAttribute, Operation: spantypes.SpanMapperOperationCopy, Priority: 1, Enabled: true}}},
+	})))
+
+	v2 := newTestModule(t, sqlStore, newTestDefinition(t, 2, llmV2))
+	require.NoError(t, v2.ReconcileSystemGroups(ctx, orgID))
+
+	upgraded, err := v2.GetGroup(ctx, orgID, group.ID)
+	require.NoError(t, err)
+	assert.Equal(t, 2, upgraded.Version)
+	assert.False(t, upgraded.Enabled)
+	assert.Equal(t, spantypes.ProvisionerIdentity, upgraded.UpdatedBy)
+	assert.Equal(t, []spantypes.SpanMapperGroupConditionKey{
+		{Value: "model", Enabled: false, Origin: spantypes.SpanMapperOriginSystem},
+		{Value: "llm.", Enabled: true, Origin: spantypes.SpanMapperOriginSystem},
+		{Value: "gen_ai.request.model", Enabled: true, Origin: spantypes.SpanMapperOriginUser},
+	}, upgraded.Condition.Attributes)
+
+	mappers, err = v2.ListMappers(ctx, orgID, group.ID)
+	require.NoError(t, err)
+	require.Len(t, mappers, 4)
+
+	model = findMapper(t, mappers, "gen_ai.request.model")
+	assert.False(t, model.Enabled)
+	assert.Equal(t, spantypes.SpanMapperOriginSystem, model.Origin)
+	assert.False(t, findSource(t, model.Config.Sources, "llm.model_name", spantypes.SpanMapperOriginSystem).Enabled)
+	assert.True(t, findSource(t, model.Config.Sources, "langfuse.observation.model.name", spantypes.SpanMapperOriginSystem).Enabled)
+	assert.Equal(t, spantypes.SpanMapperOperationMove, findSource(t, model.Config.Sources, "llm.model_name", spantypes.SpanMapperOriginUser).Operation)
+	assert.Len(t, model.Config.Sources, 3)
+
+	messages = findMapper(t, mappers, "gen_ai.input.messages")
+	assert.Equal(t, spantypes.SpanMapperOriginUser, messages.Origin)
+	require.Len(t, messages.Config.Sources, 1)
+	assert.Equal(t, "input.value", messages.Config.Sources[0].Key)
+
+	assert.Equal(t, spantypes.SpanMapperOriginSystem, findMapper(t, mappers, "gen_ai.provider.name").Origin)
+	assert.Equal(t, spantypes.SpanMapperOriginUser, findMapper(t, mappers, "gen_ai.custom").Origin)
+
+	// Shipping v1 again drops provider.name outright (no user sources) and
+	// re-adopts the surviving user mapper input.messages as a shipped one.
+	v3 := newTestModule(t, sqlStore, newTestDefinition(t, 3, llmV1))
+	require.NoError(t, v3.ReconcileSystemGroups(ctx, orgID))
+	mappers, err = v3.ListMappers(ctx, orgID, group.ID)
+	require.NoError(t, err)
+	require.Len(t, mappers, 3)
+	for _, m := range mappers {
+		assert.NotEqual(t, "gen_ai.provider.name", m.Name)
+	}
+	messages = findMapper(t, mappers, "gen_ai.input.messages")
+	assert.Equal(t, spantypes.SpanMapperOriginSystem, messages.Origin)
+	assert.Len(t, messages.Config.Sources, 2)
+}
+
+func TestReconcileDoesNotDowngrade(t *testing.T) {
+	ctx := context.Background()
+	orgID := valuer.GenerateUUID()
+	sqlStore := newTestSQLStore(t)
+
+	require.NoError(t, newTestModule(t, sqlStore, newTestDefinition(t, 2, llmV2)).ReconcileSystemGroups(ctx, orgID))
+	older := newTestModule(t, sqlStore, newTestDefinition(t, 1, llmV1))
+	require.NoError(t, older.ReconcileSystemGroups(ctx, orgID))
+
+	group, err := older.store.GetGroupByName(ctx, orgID, "llm")
+	require.NoError(t, err)
+	assert.Equal(t, 2, group.Version)
+	mappers, err := older.ListMappers(ctx, orgID, group.ID)
+	require.NoError(t, err)
+	findMapper(t, mappers, "gen_ai.provider.name")
+}

pkg/modules/spanmapper/implspanmapper/reconcile.go

@@ -0,0 +1,187 @@
+package implspanmapper
+
+import (
+	"context"
+	"log/slog"
+	"slices"
+	"time"
+
+	"github.com/SigNoz/signoz/pkg/errors"
+	"github.com/SigNoz/signoz/pkg/query-service/agentConf"
+	"github.com/SigNoz/signoz/pkg/types/spantypes"
+	"github.com/SigNoz/signoz/pkg/valuer"
+)
+
+func (module *module) ReconcileSystemGroups(ctx context.Context, orgID valuer.UUID) error {
+	for _, definition := range module.registry.List() {
+		if err := module.reconcileSystemGroup(ctx, orgID, definition); err != nil {
+			return err
+		}
+	}
+	agentConf.NotifyConfigUpdate(ctx)
+	return nil
+}
+
+// reconcileSystemGroup brings one org's copy of a definition to the shipped
+// version in a single transaction. A concurrent provisioner (another replica,
+// or the org-creation hook racing the startup sweep) loses on the group's
+// unique (org_id, name) index and is treated as a no-op.
+func (module *module) reconcileSystemGroup(ctx context.Context, orgID valuer.UUID, definition spantypes.SpanMapperGroupDefinition) error {
+	err := module.store.RunInTx(ctx, func(ctx context.Context) error {
+		group, err := module.store.GetGroupByName(ctx, orgID, definition.Name())
+		if err != nil && errors.Ast(err, errors.TypeNotFound) {
+			group = newSystemGroup(orgID, definition)
+			err = module.store.CreateGroup(ctx, group)
+		}
+		if err != nil {
+			return err
+		}
+
+		if group.Origin != spantypes.SpanMapperOriginSystem {
+			module.settings.Logger().WarnContext(ctx, "skipping default span mapper group: a user group holds its name", slog.String("name", definition.Name()), slog.String("org_id", orgID.StringValue()))
+			return nil
+		}
+		if group.Version >= definition.Version {
+			return nil
+		}
+		return module.applyDefinition(ctx, orgID, group, definition)
+	})
+	if err != nil && errors.Ast(err, errors.TypeAlreadyExists) {
+		module.settings.Logger().DebugContext(ctx, "default span mapper group provisioned concurrently", slog.String("name", definition.Name()), slog.String("org_id", orgID.StringValue()))
+		return nil
+	}
+	return err
+}
+
+// applyDefinition replaces every shipped item with the definition, carrying each
+// enabled flag over by identity, and leaves user items untouched. A mapper that
+// is no longer shipped is deleted unless the user added sources to it, in which
+// case it survives as a user mapper.
+func (module *module) applyDefinition(ctx context.Context, orgID valuer.UUID, group *spantypes.SpanMapperGroup, definition spantypes.SpanMapperGroupDefinition) error {
+	mappers, err := module.store.ListMappers(ctx, orgID, group.ID)
+	if err != nil {
+		return err
+	}
+	byName := make(map[string]*spantypes.SpanMapper, len(mappers))
+	for _, m := range mappers {
+		byName[m.Name] = m
+	}
+
+	now := time.Now()
+	for i := range definition.Definition.Mappers {
+		pm := &definition.Definition.Mappers[i]
+		mapper, exists := byName[pm.Name]
+		delete(byName, pm.Name)
+		if !exists {
+			if err := module.store.CreateMapper(ctx, newSystemMapper(group.ID, pm)); err != nil {
+				return err
+			}
+			continue
+		}
+		mapper.Config.Sources = mergeShippedSources(mapper.Config.Sources, pm.Config.Sources)
+		mapper.FieldContext = pm.FieldContext
+		mapper.Origin = spantypes.SpanMapperOriginSystem
+		mapper.UpdatedAt = now
+		mapper.UpdatedBy = spantypes.ProvisionerIdentity
+		if err := module.store.UpdateMapper(ctx, mapper); err != nil {
+			return err
+		}
+	}
+
+	// Whatever is left in byName is not shipped any more.
+	for _, mapper := range byName {
+		if mapper.Origin != spantypes.SpanMapperOriginSystem {
+			continue
+		}
+		mapper.Config.Sources = mergeShippedSources(mapper.Config.Sources, nil)
+		if len(mapper.Config.Sources) == 0 {
+			if err := module.store.DeleteMapper(ctx, orgID, group.ID, mapper.ID, spantypes.SpanMapperOriginSystem); err != nil {
+				return err
+			}
+			continue
+		}
+		mapper.Origin = spantypes.SpanMapperOriginUser
+		mapper.UpdatedAt = now
+		mapper.UpdatedBy = spantypes.ProvisionerIdentity
+		if err := module.store.UpdateMapper(ctx, mapper); err != nil {
+			return err
+		}
+	}
+
+	shipped := definition.Definition.Condition
+	group.Condition = spantypes.SpanMapperGroupCondition{
+		Attributes: mergeShippedConditionKeys(group.Condition.Attributes, shipped.Attributes),
+		Resource:   mergeShippedConditionKeys(group.Condition.Resource, shipped.Resource),
+	}
+	group.Version = definition.Version
+	group.UpdatedAt = now
+	group.UpdatedBy = spantypes.ProvisionerIdentity
+	if err := module.store.UpdateGroup(ctx, group); err != nil {
+		return err
+	}
+
+	module.settings.Logger().InfoContext(ctx, "applied default span mapper group", slog.String("name", definition.Name()), slog.Int("version", definition.Version), slog.String("org_id", orgID.StringValue()))
+	return nil
+}
+
+// newSystemGroup is the empty shell applyDefinition fills: version 0 so the
+// definition is applied right after the row exists.
+func newSystemGroup(orgID valuer.UUID, definition spantypes.SpanMapperGroupDefinition) *spantypes.SpanMapperGroup {
+	group := spantypes.NewSpanMapperGroup(orgID, spantypes.ProvisionerIdentity, &definition.Definition.PostableSpanMapperGroup)
+	group.Condition = definition.Definition.Condition
+	group.Enabled = true
+	group.Origin = spantypes.SpanMapperOriginSystem
+	return group
+}
+
+func newSystemMapper(groupID valuer.UUID, pm *spantypes.PostableSpanMapper) *spantypes.SpanMapper {
+	mapper := spantypes.NewSpanMapper(groupID, spantypes.ProvisionerIdentity, pm)
+	mapper.Config = pm.Config
+	mapper.Enabled = true
+	mapper.Origin = spantypes.SpanMapperOriginSystem
+	return mapper
+}
+
+// mergeShippedConditionKeys returns the shipped keys, each keeping the enabled
+// flag of the stored system key with the same value, followed by the stored
+// user keys.
+func mergeShippedConditionKeys(stored, shipped []spantypes.SpanMapperGroupConditionKey) []spantypes.SpanMapperGroupConditionKey {
+	out := make([]spantypes.SpanMapperGroupConditionKey, 0, len(stored)+len(shipped))
+	for _, k := range shipped {
+		idx := slices.IndexFunc(stored, func(s spantypes.SpanMapperGroupConditionKey) bool {
+			return s.Origin == spantypes.SpanMapperOriginSystem && s.Value == k.Value
+		})
+		if idx != -1 {
+			k.Enabled = stored[idx].Enabled
+		}
+		out = append(out, k)
+	}
+	for _, k := range stored {
+		if k.Origin != spantypes.SpanMapperOriginSystem {
+			out = append(out, k)
+		}
+	}
+	return out
+}
+
+// mergeShippedSources returns the shipped sources, each keeping the enabled
+// flag of the stored system source with the same key and context, followed by
+// the stored user sources.
+func mergeShippedSources(stored, shipped []spantypes.SpanMapperSource) []spantypes.SpanMapperSource {
+	out := make([]spantypes.SpanMapperSource, 0, len(stored)+len(shipped))
+	for _, s := range shipped {
+		idx := slices.IndexFunc(stored, func(o spantypes.SpanMapperSource) bool {
+			return o.Origin == spantypes.SpanMapperOriginSystem && o.Key == s.Key && o.Context == s.Context
+		})
+		if idx != -1 {
+			s.Enabled = stored[idx].Enabled
+		}
+		out = append(out, s)
+	}
+	for _, s := range stored {
+		if s.Origin != spantypes.SpanMapperOriginSystem {
+			out = append(out, s)
+		}
+	}
+	return out
+}

pkg/modules/spanmapper/implspanmapper/service.go

@@ -0,0 +1,81 @@
+package implspanmapper
+
+import (
+	"context"
+	"log/slog"
+	"time"
+
+	"github.com/SigNoz/signoz/pkg/errors"
+	"github.com/SigNoz/signoz/pkg/factory"
+	"github.com/SigNoz/signoz/pkg/modules/organization"
+	"github.com/SigNoz/signoz/pkg/modules/spanmapper"
+)
+
+const reconcileRetryInterval = 30 * time.Second
+
+type service struct {
+	settings  factory.ScopedProviderSettings
+	module    spanmapper.Module
+	orgGetter organization.Getter
+	stopC     chan struct{}
+	healthyC  chan struct{}
+}
+
+// NewService reconciles every org's default mapping groups once at startup.
+// Orgs created later are reconciled by the organization setter instead.
+func NewService(providerSettings factory.ProviderSettings, module spanmapper.Module, orgGetter organization.Getter) factory.Service {
+	return &service{
+		settings:  factory.NewScopedProviderSettings(providerSettings, "github.com/SigNoz/signoz/pkg/modules/spanmapper/implspanmapper"),
+		module:    module,
+		orgGetter: orgGetter,
+		stopC:     make(chan struct{}),
+		healthyC:  make(chan struct{}),
+	}
+}
+
+func (service *service) Start(ctx context.Context) error {
+	ticker := time.NewTicker(reconcileRetryInterval)
+	defer ticker.Stop()
+
+	for {
+		err := service.reconcile(ctx)
+		if err == nil {
+			close(service.healthyC)
+			<-service.stopC
+			return nil
+		}
+
+		service.settings.Logger().WarnContext(ctx, "default span mapper group reconciliation failed, retrying", errors.Attr(err))
+
+		select {
+		case <-service.stopC:
+			return nil
+		case <-ticker.C:
+		}
+	}
+}
+
+func (service *service) Healthy() <-chan struct{} {
+	return service.healthyC
+}
+
+func (service *service) Stop(_ context.Context) error {
+	close(service.stopC)
+	return nil
+}
+
+func (service *service) reconcile(ctx context.Context) error {
+	orgs, err := service.orgGetter.ListByOwnedKeyRange(ctx)
+	if err != nil {
+		return err
+	}
+
+	for _, org := range orgs {
+		if err := service.module.ReconcileSystemGroups(ctx, org.ID); err != nil {
+			return errors.Wrapf(err, errors.TypeInternal, errors.CodeInternal, "couldn't reconcile default span mapper groups for org %s", org.ID.StringValue())
+		}
+	}
+
+	service.settings.Logger().InfoContext(ctx, "default span mapper group reconciliation completed", slog.Int("orgs", len(orgs)))
+	return nil
+}

pkg/modules/spanmapper/implspanmapper/store.go

@@ -17,6 +17,10 @@ func NewStore(sqlstore sqlstore.SQLStore) spantypes.SpanMapperStore {
 	return &store{sqlstore: sqlstore}
 }
 
+func (s *store) RunInTx(ctx context.Context, cb func(ctx context.Context) error) error {
+	return s.sqlstore.RunInTxCtx(ctx, nil, cb)
+}
+
 func (s *store) CreateGroup(ctx context.Context, group *spantypes.SpanMapperGroup) error {
 	storable := group.ToStorable()
 	_, err := s.sqlstore.
@@ -34,7 +38,7 @@ func (s *store) GetGroup(ctx context.Context, orgID, id valuer.UUID) (*spantypes
 	storable := new(spantypes.StorableSpanMapperGroup)
 
 	err := s.sqlstore.
-		BunDB().
+		BunDBCtx(ctx).
 		NewSelect().
 		Model(storable).
 		Where("org_id = ?", orgID).
@@ -46,11 +50,27 @@ func (s *store) GetGroup(ctx context.Context, orgID, id valuer.UUID) (*spantypes
 	return storable.ToSpanMapperGroup(), nil
 }
 
+func (s *store) GetGroupByName(ctx context.Context, orgID valuer.UUID, name string) (*spantypes.SpanMapperGroup, error) {
+	storable := new(spantypes.StorableSpanMapperGroup)
+
+	err := s.sqlstore.
+		BunDBCtx(ctx).
+		NewSelect().
+		Model(storable).
+		Where("org_id = ?", orgID).
+		Where("name = ?", name).
+		Scan(ctx)
+	if err != nil {
+		return nil, s.sqlstore.WrapNotFoundErrf(err, spantypes.ErrCodeMappingGroupNotFound, "span mapper group %q not found", name)
+	}
+	return storable.ToSpanMapperGroup(), nil
+}
+
 func (s *store) ListGroups(ctx context.Context, orgID valuer.UUID, q *spantypes.ListSpanMapperGroupsQuery) ([]*spantypes.SpanMapperGroup, error) {
 	storables := make([]*spantypes.StorableSpanMapperGroup, 0)
 
 	sel := s.sqlstore.
-		BunDB().
+		BunDBCtx(ctx).
 		NewSelect().
 		Model(&storables).
 		Where("org_id = ?", orgID)
@@ -91,38 +111,43 @@ func (s *store) UpdateGroup(ctx context.Context, group *spantypes.SpanMapperGrou
 }
 
 func (s *store) DeleteGroup(ctx context.Context, orgID, id valuer.UUID) error {
-	tx, err := s.sqlstore.BunDBCtx(ctx).BeginTx(ctx, nil)
-	if err != nil {
-		return err
-	}
-	defer func() { _ = tx.Rollback() }()
+	return s.RunInTx(ctx, func(ctx context.Context) error {
+		db := s.sqlstore.BunDBCtx(ctx)
 
-	// Cascade: remove mappers belonging to this group first.
-	if _, err := tx.NewDelete().
-		Model((*spantypes.StorableSpanMapper)(nil)).
-		Where("group_id = ?", id).
-		Exec(ctx); err != nil {
-		return err
-	}
+		// Cascade: remove mappers belonging to this group first.
+		if _, err := db.NewDelete().
+			Model((*spantypes.StorableSpanMapper)(nil)).
+			Where("group_id = ?", id).
+			Exec(ctx); err != nil {
+			return err
+		}
 
-	res, err := tx.NewDelete().
-		Model((*spantypes.StorableSpanMapperGroup)(nil)).
-		Where("org_id = ?", orgID).
-		Where("id = ?", id).
-		Exec(ctx)
-	if err != nil {
-		return err
-	}
+		res, err := db.NewDelete().
+			Model((*spantypes.StorableSpanMapperGroup)(nil)).
+			Where("org_id = ?", orgID).
+			Where("id = ?", id).
+			Where("origin = ?", spantypes.SpanMapperOriginUser).
+			Exec(ctx)
+		if err != nil {
+			return err
+		}
 
-	rowsAffected, err := res.RowsAffected()
-	if err != nil {
-		return err
-	}
-	if rowsAffected == 0 {
-		return errors.Newf(errors.TypeNotFound, spantypes.ErrCodeMappingGroupNotFound, "span mapper group %s not found", id)
-	}
-
-	return tx.Commit()
+		rowsAffected, err := res.RowsAffected()
+		if err != nil {
+			return err
+		}
+		if rowsAffected == 0 {
+			group, err := s.GetGroup(ctx, orgID, id)
+			if err != nil {
+				return err
+			}
+			if err := group.ErrIfNotDeletable(); err != nil {
+				return err
+			}
+			return errors.Newf(errors.TypeNotFound, spantypes.ErrCodeMappingGroupNotFound, "span mapper group %s not found", id)
+		}
+		return nil
+	})
 }
 
 func (s *store) CreateMapper(ctx context.Context, mapper *spantypes.SpanMapper) error {
@@ -146,7 +171,7 @@ func (s *store) GetMapper(ctx context.Context, orgID, groupID, id valuer.UUID) (
 
 	storable := new(spantypes.StorableSpanMapper)
 	err := s.sqlstore.
-		BunDB().
+		BunDBCtx(ctx).
 		NewSelect().
 		Model(storable).
 		Where("group_id = ?", groupID).
@@ -166,7 +191,7 @@ func (s *store) ListMappers(ctx context.Context, orgID, groupID valuer.UUID) ([]
 
 	storables := make([]*spantypes.StorableSpanMapper, 0)
 	if err := s.sqlstore.
-		BunDB().
+		BunDBCtx(ctx).
 		NewSelect().
 		Model(&storables).
 		Where("group_id = ?", groupID).
@@ -200,7 +225,7 @@ func (s *store) UpdateMapper(ctx context.Context, mapper *spantypes.SpanMapper)
 	return nil
 }
 
-func (s *store) DeleteMapper(ctx context.Context, orgID, groupID, id valuer.UUID) error {
+func (s *store) DeleteMapper(ctx context.Context, orgID, groupID, id valuer.UUID, origin spantypes.SpanMapperOrigin) error {
 	if _, err := s.GetGroup(ctx, orgID, groupID); err != nil {
 		return err
 	}
@@ -211,6 +236,7 @@ func (s *store) DeleteMapper(ctx context.Context, orgID, groupID, id valuer.UUID
 		Model((*spantypes.StorableSpanMapper)(nil)).
 		Where("group_id = ?", groupID).
 		Where("id = ?", id).
+		Where("origin = ?", origin).
 		Exec(ctx)
 	if err != nil {
 		return err
@@ -221,6 +247,13 @@ func (s *store) DeleteMapper(ctx context.Context, orgID, groupID, id valuer.UUID
 		return err
 	}
 	if rowsAffected == 0 {
+		mapper, err := s.GetMapper(ctx, orgID, groupID, id)
+		if err != nil {
+			return err
+		}
+		if err := mapper.ErrIfNotDeletable(); err != nil {
+			return err
+		}
 		return errors.Newf(errors.TypeNotFound, spantypes.ErrCodeMapperNotFound, "span mapper %s not found", id)
 	}
 	return nil

pkg/modules/spanmapper/spanmapper.go

@@ -28,6 +28,10 @@ type Module interface {
 	UpdateMapper(ctx context.Context, orgID, groupID, id valuer.UUID, fieldContext spantypes.FieldContext, config *spantypes.SpanMapperConfig, enabled *bool, updatedBy string) error
 	DeleteMapper(ctx context.Context, orgID, groupID, id valuer.UUID) error
 	TestMappers(ctx context.Context, orgID valuer.UUID, spans []spantypes.SpanMapperTestSpan, groups []*spantypes.SpanMapperGroupWithMappers) ([]spantypes.SpanMapperTestSpan, []string, error)
+
+	// ReconcileSystemGroups provisions or upgrades the shipped mapping groups
+	// for one org. It runs at startup for every org and again on org creation.
+	ReconcileSystemGroups(ctx context.Context, orgID valuer.UUID) error
 }
 
 // Handler defines the HTTP handler interface for mapping group and mapper endpoints.

pkg/querier/consume.go

@@ -566,39 +566,17 @@ func readAsRaw(rows driver.Rows, queryName string) (*qbtypes.RawData, error) {
 	}, nil
 }
 
-// flattenJSONPaths flattens a decoded JSON document into dotted keys, overwriting existing keys in out.
-func flattenJSONPaths(prefix string, m map[string]any, out map[string]any) {
-	for k, v := range m {
-		key := k
-		if prefix != "" {
-			key = prefix + "." + k
-		}
-		switch child := v.(type) {
-		case map[string]any:
-			flattenJSONPaths(key, child, out)
-		case telemetrystoretypes.JSONValue:
-			flattenJSONPaths(key, child, out)
-		default:
-			out[key] = v
-		}
-	}
-}
-
 // mergeSpanAttributeColumns merges (attributes_string, attributes_number, attributes_bool, resources_string) into
 // unified "attributes" and "resource" keys, and parses the stringified `events`
 // and `links` columns into structured slices. Raw DB columns are removed.
-//
-// The `attributes` JSON column is flattened in first and the legacy maps merged over it, so maps win on collision.
 func mergeSpanAttributeColumns(data map[string]any) {
 	attrStr, hasStr := data["attributes_string"]
 	attrNum, hasNum := data["attributes_number"]
 	attrBool, hasBool := data["attributes_bool"]
-	attrJSON, _ := data["attributes"].(telemetrystoretypes.JSONValue)
 	// todo(nitya): move to resource json
 	resStr, hasRes := data["resources_string"]
-	if hasStr || hasNum || hasBool || attrJSON != nil || hasRes {
+	if hasStr || hasNum || hasBool || hasRes {
 		attributes := make(map[string]any)
-		flattenJSONPaths("", attrJSON, attributes)
 		if m, ok := attrStr.(map[string]string); ok {
 			for k, v := range m {
 				attributes[k] = v

pkg/querier/consume_test.go

@@ -195,115 +195,3 @@ func TestMergeSpanAttributeColumns_EmptyEventsAndLinks(t *testing.T) {
 		t.Fatalf("expected empty []spantypes.Link, got %#v", data["links"])
 	}
 }
-
-// Arrays stay native leaves: the collector stringifies top-level arrays and explodes nested ones
-// into indexed keys in the legacy maps; the JSON home keeps them whole and we do not mimic either.
-func TestMergeSpanAttributeColumns_JSONColumn(t *testing.T) {
-	testCases := []struct {
-		name string
-		data map[string]any
-		want map[string]any
-	}{
-		{
-			name: "JSONOnly_FlattensNestedPaths_PreservesTypes",
-			data: map[string]any{
-				"attributes": telemetrystoretypes.JSONValue{
-					"http":      map[string]any{"route": "/api/pay", "retry": map[string]any{"count": float64(3)}},
-					"cache.hit": true,
-				},
-			},
-			want: map[string]any{"http.route": "/api/pay", "http.retry.count": float64(3), "cache.hit": true},
-		},
-		{
-			name: "Straddle_MapsWinOnCollision_JSONFillsGaps",
-			data: map[string]any{
-				"attributes_string": map[string]string{"http.route": "/old", "only.map": "m"},
-				"attributes_number": map[string]float64{"http.status": 500},
-				"attributes":        telemetrystoretypes.JSONValue{"http": map[string]any{"route": "/new"}, "only.json": "j"},
-			},
-			want: map[string]any{"http.route": "/old", "only.map": "m", "http.status": float64(500), "only.json": "j"},
-		},
-		{
-			name: "MapOnly_EmptyJSONDoc_KeepsMapValues",
-			data: map[string]any{
-				"attributes_string": map[string]string{"http.route": "/map"},
-				"attributes_number": map[string]float64{"http.status": 200},
-				"attributes_bool":   map[string]bool{"cache.hit": true},
-				"attributes":        telemetrystoretypes.JSONValue{},
-			},
-			want: map[string]any{"http.route": "/map", "http.status": float64(200), "cache.hit": true},
-		},
-		{
-			name: "MapOnly_NilJSON_BehavesAsAbsent",
-			data: map[string]any{
-				"attributes_string": map[string]string{"http.route": "/map"},
-				"attributes":        telemetrystoretypes.JSONValue(nil),
-			},
-			want: map[string]any{"http.route": "/map"},
-		},
-		{
-			name: "Arrays_StayLeafValues",
-			data: map[string]any{
-				"attributes": telemetrystoretypes.JSONValue{"http": map[string]any{"tags": []any{"a", "b"}, "codes": []any{float64(1), float64(2)}}},
-			},
-			want: map[string]any{"http.tags": []any{"a", "b"}, "http.codes": []any{float64(1), float64(2)}},
-		},
-		{
-			name: "TopLevelArrayOfMaps_StaysNativeLeaf",
-			data: map[string]any{
-				"attributes": telemetrystoretypes.JSONValue{"key": []any{map[string]any{"a": float64(1)}, map[string]any{"b": float64(2)}}},
-			},
-			want: map[string]any{"key": []any{map[string]any{"a": float64(1)}, map[string]any{"b": float64(2)}}},
-		},
-		{
-			name: "NestedArrayOfMaps_StaysNativeLeaf_NoIndexPaths",
-			data: map[string]any{
-				"attributes": telemetrystoretypes.JSONValue{"http": map[string]any{"items": []any{map[string]any{"a": float64(1)}}}},
-			},
-			want: map[string]any{"http.items": []any{map[string]any{"a": float64(1)}}},
-		},
-		{
-			name: "DualWritten_NestedArray_IndexKeysAndJSONArrayCoexist",
-			data: map[string]any{
-				"attributes_number": map[string]float64{"http.items.0.a": 1},
-				"attributes":        telemetrystoretypes.JSONValue{"http": map[string]any{"items": []any{map[string]any{"a": float64(1)}}}},
-			},
-			want: map[string]any{"http.items.0.a": float64(1), "http.items": []any{map[string]any{"a": float64(1)}}},
-		},
-		{
-			name: "JSONNull_KeptAsNil",
-			data: map[string]any{
-				"attributes": telemetrystoretypes.JSONValue{"k": nil},
-			},
-			want: map[string]any{"k": nil},
-		},
-		{
-			name: "KeyIsLeafValue_NotFlattened",
-			data: map[string]any{
-				"attributes": telemetrystoretypes.JSONValue{"http": "plaintext"},
-			},
-			want: map[string]any{"http": "plaintext"},
-		},
-		{
-			name: "KeyIsParent_FlattensToDottedPath",
-			data: map[string]any{
-				"attributes": telemetrystoretypes.JSONValue{"http": map[string]any{"route": "/a"}},
-			},
-			want: map[string]any{"http.route": "/a"},
-		},
-	}
-
-	for _, testCase := range testCases {
-		t.Run(testCase.name, func(t *testing.T) {
-			mergeSpanAttributeColumns(testCase.data)
-
-			attrs, ok := testCase.data["attributes"].(map[string]any)
-			require.True(t, ok, "attributes should be map[string]any, got %T", testCase.data["attributes"])
-			assert.Equal(t, testCase.want, attrs)
-			for _, removed := range []string{"attributes_string", "attributes_number", "attributes_bool"} {
-				_, present := testCase.data[removed]
-				assert.False(t, present, "%s should be removed", removed)
-			}
-		})
-	}
-}

pkg/query-service/app/integrations/manager.go

@@ -470,7 +470,7 @@ func (m *Manager) deprovisionDashboards(
 		if err != nil {
 			return err
 		}
-		if err := m.dashboardModule.DeleteUnsafeV2(ctx, orgID, dashID); err != nil {
+		if err := m.dashboardModule.DeleteUnsafe(ctx, orgID, dashID); err != nil {
 			return err
 		}
 	}

pkg/querybuilder/key_resolution.go

@@ -25,9 +25,8 @@ const (
 // ResolveLogicalFields picks which logical fields a filter term builds conditions
 // for. With 0 or 1 field it returns the input unchanged and no warning. When a
 // name is ambiguous (several logical fields — a family is one field and never
-// ambiguous with itself) it returns a warning; a resource + other-context mix
-// (attribute, body, scope, …) defaults to the resource fields (the common
-// intent), noted in the warning.
+// ambiguous with itself) it returns a warning; a resource+attribute mix defaults
+// to the resource fields (the common intent), noted in the warning.
 func ResolveLogicalFields(field *telemetrytypes.TelemetryFieldKey, logicalFields []*telemetrytypes.LogicalField) ([]*telemetrytypes.LogicalField, string) {
 	if len(logicalFields) <= 1 {
 		return logicalFields, ""
@@ -40,17 +39,18 @@ func ResolveLogicalFields(field *telemetrytypes.TelemetryFieldKey, logicalFields
 		logicalFields,
 	)
 
-	hasResource, hasOther := false, false
+	hasResource, hasAttribute := false, false
 	for _, item := range logicalFields {
-		if item.FieldContext == telemetrytypes.FieldContextResource {
+		switch item.FieldContext {
+		case telemetrytypes.FieldContextResource:
 			hasResource = true
-		} else {
-			hasOther = true
+		case telemetrytypes.FieldContextAttribute:
+			hasAttribute = true
 		}
 	}
 
-	// with resource and any other context, default to resource only
-	if hasResource && hasOther {
+	// when there is both resource and attribute context, default to resource only
+	if hasResource && hasAttribute {
 		filtered := make([]*telemetrytypes.LogicalField, 0, len(logicalFields))
 		for _, item := range logicalFields {
 			if item.FieldContext == telemetrytypes.FieldContextResource {
@@ -58,8 +58,8 @@ func ResolveLogicalFields(field *telemetrytypes.TelemetryFieldKey, logicalFields
 			}
 		}
 		logicalFields = filtered
-		warning += " " + "Using `resource` context by default. To query another context explicitly, " +
-			fmt.Sprintf("use the fully qualified name (e.g., 'attribute.%s' or 'body.%s')", field.Name, field.Name)
+		warning += " " + "Using `resource` context by default. To query attributes explicitly, " +
+			fmt.Sprintf("use the fully qualified name (e.g., 'attribute.%s')", field.Name)
 	}
 
 	return logicalFields, warning

pkg/querybuilder/logical_fields_test.go

@@ -175,42 +175,6 @@ func TestResolveLogicalFieldsKeepsFamilyThroughAmbiguity(t *testing.T) {
 	assert.Equal(t, []string{"deployment.environment.name", "deployment.environment"}, memberNames(resolved[0]))
 }
 
-// Resource wins over every other context, not just attribute: a bare key that
-// also lives in body or scope must collapse to resource alone, so the surviving
-// candidate does not AND against the resource fingerprint CTE.
-func TestResolveLogicalFieldsResourceWinsOverOtherContexts(t *testing.T) {
-	testCases := []struct {
-		name  string
-		other telemetrytypes.FieldContext
-	}{
-		{name: "ResourceOverBody", other: telemetrytypes.FieldContextBody},
-		{name: "ResourceOverScope", other: telemetrytypes.FieldContextScope},
-	}
-
-	for _, testCase := range testCases {
-		t.Run(testCase.name, func(t *testing.T) {
-			requested := &telemetrytypes.TelemetryFieldKey{Name: "service.name"}
-			fields := []*telemetrytypes.LogicalField{
-				telemetrytypes.SingleLogicalField("service.name", &telemetrytypes.TelemetryFieldKey{
-					Name:          "service.name",
-					FieldContext:  telemetrytypes.FieldContextResource,
-					FieldDataType: telemetrytypes.FieldDataTypeString,
-				}),
-				telemetrytypes.SingleLogicalField("service.name", &telemetrytypes.TelemetryFieldKey{
-					Name:          "service.name",
-					FieldContext:  testCase.other,
-					FieldDataType: telemetrytypes.FieldDataTypeString,
-				}),
-			}
-
-			resolved, warning := ResolveLogicalFields(requested, fields)
-			assert.NotEmpty(t, warning)
-			require.Len(t, resolved, 1)
-			assert.Equal(t, telemetrytypes.FieldContextResource, resolved[0].FieldContext)
-		})
-	}
-}
-
 // Members of a family with different data types never merge: the identity
 // (signal, context, data type) separates them into distinct logical fields.
 func TestMatchingLogicalFieldsNeverMergesAcrossDataTypes(t *testing.T) {

pkg/signoz/handler_test.go

@@ -18,6 +18,7 @@ import (
 	"github.com/SigNoz/signoz/pkg/modules/dashboard/impldashboard"
 	"github.com/SigNoz/signoz/pkg/modules/organization/implorganization"
 	"github.com/SigNoz/signoz/pkg/modules/retention/implretention"
+	"github.com/SigNoz/signoz/pkg/modules/spanmapper/implspanmapper"
 	"github.com/SigNoz/signoz/pkg/modules/tag/impltag"
 	"github.com/SigNoz/signoz/pkg/modules/user/impluser"
 	"github.com/SigNoz/signoz/pkg/querier"
@@ -61,7 +62,10 @@ func TestNewHandlers(t *testing.T) {
 	userGetter := impluser.NewGetter(impluser.NewStore(sqlstore, providerSettings), userRoleStore, flagger)
 
 	retentionGetter := implretention.NewGetter(implretention.NewStore(sqlstore))
-	modules := NewModules(sqlstore, tokenizer, emailing, providerSettings, orgGetter, alertmanager, nil, nil, nil, nil, nil, nil, nil, queryParser, Config{}, dashboardModule, userGetter, userRoleStore, nil, nil, nil, retentionGetter, flagger, tagModule, nil)
+	spanMapperRegistry, err := implspanmapper.NewSystemGroupRegistry()
+	require.NoError(t, err)
+	spanMapperModule := implspanmapper.NewModule(implspanmapper.NewStore(sqlstore), flagger, spanMapperRegistry, providerSettings)
+	modules := NewModules(sqlstore, tokenizer, emailing, providerSettings, orgGetter, alertmanager, nil, nil, nil, nil, nil, nil, nil, queryParser, Config{}, dashboardModule, userGetter, userRoleStore, nil, nil, nil, retentionGetter, flagger, tagModule, nil, spanMapperModule)
 
 	querierHandler := querier.NewHandler(providerSettings, nil, nil)
 	registryHandler := factory.NewHandler(nil)

pkg/signoz/module.go

@@ -45,7 +45,6 @@ import (
 	"github.com/SigNoz/signoz/pkg/modules/session"
 	"github.com/SigNoz/signoz/pkg/modules/session/implsession"
 	"github.com/SigNoz/signoz/pkg/modules/spanmapper"
-	"github.com/SigNoz/signoz/pkg/modules/spanmapper/implspanmapper"
 	"github.com/SigNoz/signoz/pkg/modules/spanpercentile"
 	"github.com/SigNoz/signoz/pkg/modules/spanpercentile/implspanpercentile"
 	"github.com/SigNoz/signoz/pkg/modules/tag"
@@ -124,9 +123,10 @@ func NewModules(
 	fl flagger.Flagger,
 	tagModule tag.Module,
 	metricReductionRule metricreductionrule.Module,
+	spanMapper spanmapper.Module,
 ) Modules {
 	quickfilter := implquickfilter.NewModule(implquickfilter.NewStore(sqlstore))
-	orgSetter := implorganization.NewSetter(implorganization.NewStore(sqlstore), alertmanager, quickfilter, dashboard)
+	orgSetter := implorganization.NewSetter(implorganization.NewStore(sqlstore), alertmanager, quickfilter, dashboard, spanMapper)
 	// Cleanup callbacks from other modules, invoked when a user is deleted.
 	onDeleteUser := []user.OnDeleteUser{
 		dashboard.DeletePreferencesForUser,
@@ -162,7 +162,7 @@ func NewModules(
 		RuleStateHistory:     implrulestatehistory.NewModule(implrulestatehistory.NewStore(telemetryStore, telemetryMetadataStore, providerSettings.Logger), ruleStore),
 		CloudIntegration:     cloudIntegrationModule,
 		TraceDetail:          impltracedetail.NewModule(impltracedetail.NewTraceStore(telemetryStore), providerSettings, config.TraceDetail),
-		SpanMapper:           implspanmapper.NewModule(implspanmapper.NewStore(sqlstore), fl),
+		SpanMapper:           spanMapper,
 		LLMPricingRule:       impllmpricingrule.NewModule(impllmpricingrule.NewStore(sqlstore), fl, querier),
 		Tag:                  tagModule,
 	}

pkg/signoz/module_test.go

@@ -21,6 +21,7 @@ import (
 	"github.com/SigNoz/signoz/pkg/modules/retention/implretention"
 	"github.com/SigNoz/signoz/pkg/modules/serviceaccount"
 	"github.com/SigNoz/signoz/pkg/modules/serviceaccount/implserviceaccount"
+	"github.com/SigNoz/signoz/pkg/modules/spanmapper/implspanmapper"
 	"github.com/SigNoz/signoz/pkg/modules/tag/impltag"
 	"github.com/SigNoz/signoz/pkg/modules/user/impluser"
 	"github.com/SigNoz/signoz/pkg/queryparser"
@@ -68,7 +69,11 @@ func TestNewModules(t *testing.T) {
 
 	retentionGetter := implretention.NewGetter(implretention.NewStore(sqlstore))
 
-	modules := NewModules(sqlstore, tokenizer, emailing, providerSettings, orgGetter, alertmanager, nil, nil, nil, nil, nil, nil, nil, queryParser, Config{}, dashboardModule, userGetter, userRoleStore, serviceAccount, serviceAccountGetter, implcloudintegration.NewModule(), retentionGetter, flagger, tagModule, implmetricreductionrule.NewModule())
+	spanMapperRegistry, err := implspanmapper.NewSystemGroupRegistry()
+	require.NoError(t, err)
+	spanMapperModule := implspanmapper.NewModule(implspanmapper.NewStore(sqlstore), flagger, spanMapperRegistry, providerSettings)
+
+	modules := NewModules(sqlstore, tokenizer, emailing, providerSettings, orgGetter, alertmanager, nil, nil, nil, nil, nil, nil, nil, queryParser, Config{}, dashboardModule, userGetter, userRoleStore, serviceAccount, serviceAccountGetter, implcloudintegration.NewModule(), retentionGetter, flagger, tagModule, implmetricreductionrule.NewModule(), spanMapperModule)
 
 	reflectVal := reflect.ValueOf(modules)
 	for i := 0; i < reflectVal.NumField(); i++ {

pkg/signoz/provider.go

@@ -254,6 +254,7 @@ func NewSQLMigrationProviderFactories(
 		sqlmigration.NewAddIngestionTuplesFactory(sqlstore),
 		sqlmigration.NewAddSubscriptionTuplesFactory(sqlstore),
 		sqlmigration.NewNormalizeQuickFilterFieldsFactory(sqlstore),
+		sqlmigration.NewAddSpanMapperOriginFactory(sqlstore, sqlschema),
 	)
 }
 

pkg/signoz/signoz.go

@@ -36,6 +36,7 @@ import (
 	"github.com/SigNoz/signoz/pkg/modules/rulestatehistory"
 	"github.com/SigNoz/signoz/pkg/modules/serviceaccount"
 	"github.com/SigNoz/signoz/pkg/modules/serviceaccount/implserviceaccount"
+	"github.com/SigNoz/signoz/pkg/modules/spanmapper/implspanmapper"
 	"github.com/SigNoz/signoz/pkg/modules/tag"
 	"github.com/SigNoz/signoz/pkg/modules/tag/impltag"
 	"github.com/SigNoz/signoz/pkg/modules/user/impluser"
@@ -549,7 +550,15 @@ func New(
 	metricReductionRuleModule := metricReductionRuleModuleCallback(sqlstore, telemetrystore, dashboard, queryParser, licensing, flagger, telemetryMetadataStore, providerSettings, config.MetricsExplorer.TelemetryStore.Threads)
 
 	// Initialize all modules
-	modules := NewModules(sqlstore, tokenizer, emailing, providerSettings, orgGetter, alertmanager, analytics, querier, telemetrystore, telemetryMetadataStore, authNs, authz, cache, queryParser, config, dashboard, userGetter, userRoleStore, serviceAccount, serviceAccountGetter, cloudIntegrationModule, retentionGetter, flagger, tagModule, metricReductionRuleModule)
+	// The default mapping group registry is parsed here so a malformed embedded
+	// definition fails startup instead of a request.
+	spanMapperRegistry, err := implspanmapper.NewSystemGroupRegistry()
+	if err != nil {
+		return nil, err
+	}
+	spanMapperModule := implspanmapper.NewModule(implspanmapper.NewStore(sqlstore), flagger, spanMapperRegistry, providerSettings)
+
+	modules := NewModules(sqlstore, tokenizer, emailing, providerSettings, orgGetter, alertmanager, analytics, querier, telemetrystore, telemetryMetadataStore, authNs, authz, cache, queryParser, config, dashboard, userGetter, userRoleStore, serviceAccount, serviceAccountGetter, cloudIntegrationModule, retentionGetter, flagger, tagModule, metricReductionRuleModule, spanMapperModule)
 
 	// Initialize ruler from the variant-specific provider factories
 	rulerInstance, err := factory.NewProviderFromNamedMap(ctx, providerSettings, config.Ruler, rulerProviderFactories(cache, alertmanager, sqlstore, telemetrystore, telemetryMetadataStore, prometheus, orgGetter, modules.RuleStateHistory, querier, queryParser), "signoz")
@@ -619,6 +628,7 @@ func New(
 		factory.NewNamedService(factory.MustNewName("meterreporter"), meterReporter, factory.MustNewName("licensing")),
 		factory.NewNamedService(factory.MustNewName("ruler"), rulerInstance),
 		factory.NewNamedService(factory.MustNewName("systemdashboard"), impldashboard.NewService(providerSettings, dashboard, orgGetter)),
+		factory.NewNamedService(factory.MustNewName("spanmappergroup"), implspanmapper.NewService(providerSettings, spanMapperModule, orgGetter)),
 	)
 	if err != nil {
 		return nil, err

pkg/sqlmigration/127_add_span_mapper_origin.go

@@ -0,0 +1,93 @@
+package sqlmigration
+
+import (
+	"context"
+
+	"github.com/SigNoz/signoz/pkg/factory"
+	"github.com/SigNoz/signoz/pkg/sqlschema"
+	"github.com/SigNoz/signoz/pkg/sqlstore"
+	"github.com/uptrace/bun"
+	"github.com/uptrace/bun/migrate"
+)
+
+type addSpanMapperOrigin struct {
+	sqlstore  sqlstore.SQLStore
+	sqlschema sqlschema.SQLSchema
+}
+
+func NewAddSpanMapperOriginFactory(sqlstore sqlstore.SQLStore, sqlschema sqlschema.SQLSchema) factory.ProviderFactory[SQLMigration, Config] {
+	return factory.NewProviderFactory(
+		factory.MustNewName("add_span_mapper_origin"),
+		func(ctx context.Context, ps factory.ProviderSettings, c Config) (SQLMigration, error) {
+			return &addSpanMapperOrigin{sqlstore: sqlstore, sqlschema: sqlschema}, nil
+		},
+	)
+}
+
+func (migration *addSpanMapperOrigin) Register(migrations *migrate.Migrations) error {
+	return migrations.Register(migration.Up, migration.Down)
+}
+
+// Up adds the ownership columns that let SigNoz ship default mapping groups
+// alongside user ones.
+func (migration *addSpanMapperOrigin) Up(ctx context.Context, db *bun.DB) error {
+	// span_mapper references span_mapper_group and both have foreign keys, so
+	// enforcement must be off for the SQLite recreate-table fallback.
+	if err := migration.sqlschema.ToggleFKEnforcement(ctx, db, false); err != nil {
+		return err
+	}
+
+	tx, err := db.BeginTx(ctx, nil)
+	if err != nil {
+		return err
+	}
+	defer func() {
+		_ = tx.Rollback()
+	}()
+
+	groupTable, groupUniqueConstraints, err := migration.sqlschema.GetTable(ctx, sqlschema.TableName("span_mapper_group"))
+	if err != nil {
+		return err
+	}
+
+	sqls := migration.sqlschema.Operator().AddColumn(groupTable, groupUniqueConstraints, &sqlschema.Column{
+		Name:     sqlschema.ColumnName("origin"),
+		DataType: sqlschema.DataTypeText,
+		Nullable: false,
+		Default:  "'user'",
+	}, "user")
+	sqls = append(sqls, migration.sqlschema.Operator().AddColumn(groupTable, groupUniqueConstraints, &sqlschema.Column{
+		Name:     sqlschema.ColumnName("version"),
+		DataType: sqlschema.DataTypeBigInt,
+		Nullable: false,
+		Default:  "0",
+	}, 0)...)
+
+	mapperTable, mapperUniqueConstraints, err := migration.sqlschema.GetTable(ctx, sqlschema.TableName("span_mapper"))
+	if err != nil {
+		return err
+	}
+
+	sqls = append(sqls, migration.sqlschema.Operator().AddColumn(mapperTable, mapperUniqueConstraints, &sqlschema.Column{
+		Name:     sqlschema.ColumnName("origin"),
+		DataType: sqlschema.DataTypeText,
+		Nullable: false,
+		Default:  "'user'",
+	}, "user")...)
+
+	for _, sql := range sqls {
+		if _, err := tx.ExecContext(ctx, string(sql)); err != nil {
+			return err
+		}
+	}
+
+	if err := tx.Commit(); err != nil {
+		return err
+	}
+
+	return migration.sqlschema.ToggleFKEnforcement(ctx, db, true)
+}
+
+func (migration *addSpanMapperOrigin) Down(context.Context, *bun.DB) error {
+	return nil
+}

pkg/statementbuilder/aistatementbuilder/span_list_test.go

@@ -45,7 +45,7 @@ SELECT timestamp AS __SELECT_KEY_0_timestamp, trace_id AS __SELECT_KEY_1_trace_i
     http_url AS __SELECT_KEY_17_http_url, external_http_method AS __SELECT_KEY_18_external_http_method,
     http_method AS __SELECT_KEY_19_http_method, http_host AS __SELECT_KEY_20_http_host, db_name AS __SELECT_KEY_21_db_name,
     db_operation AS __SELECT_KEY_22_db_operation, has_error AS __SELECT_KEY_23_has_error, is_remote AS __SELECT_KEY_24_is_remote,
-    attributes_string, attributes_number, attributes_bool, resources_string, attributes
+    attributes_string, attributes_number, attributes_bool, resources_string
 FROM signoz_traces.distributed_signoz_index_v3
 WHERE trace_id GLOBAL IN (SELECT trace_id FROM __trace_scope)
   AND (((mapContains(attributes_string, 'gen_ai.request.model')

pkg/statementbuilder/aistatementbuilder/statement_builder_test.go

@@ -676,7 +676,7 @@ SELECT timestamp AS __SELECT_KEY_0_timestamp, trace_id AS __SELECT_KEY_1_trace_i
     http_url AS __SELECT_KEY_17_http_url, external_http_method AS __SELECT_KEY_18_external_http_method,
     http_method AS __SELECT_KEY_19_http_method, http_host AS __SELECT_KEY_20_http_host, db_name AS __SELECT_KEY_21_db_name,
     db_operation AS __SELECT_KEY_22_db_operation, has_error AS __SELECT_KEY_23_has_error, is_remote AS __SELECT_KEY_24_is_remote,
-    attributes_string, attributes_number, attributes_bool, resources_string, attributes
+    attributes_string, attributes_number, attributes_bool, resources_string
 FROM signoz_traces.distributed_signoz_index_v3
 WHERE (((mapContains(attributes_string, 'gen_ai.request.model')
         OR mapContains(attributes_string, 'gen_ai.tool.name')

pkg/statementbuilder/logsstatementbuilder/resource_conflict_test.go

@@ -1,90 +0,0 @@
-package logsstatementbuilder
-
-import (
-	"context"
-	"testing"
-
-	"github.com/SigNoz/signoz/pkg/flagger/flaggertest"
-	"github.com/SigNoz/signoz/pkg/instrumentation/instrumentationtest"
-	"github.com/SigNoz/signoz/pkg/querybuilder"
-	"github.com/SigNoz/signoz/pkg/statementbuilder"
-	"github.com/SigNoz/signoz/pkg/telemetryschema/logstelemetryschema"
-	qbtypes "github.com/SigNoz/signoz/pkg/types/querybuildertypes/querybuildertypesv5"
-	"github.com/SigNoz/signoz/pkg/types/telemetrytypes"
-	"github.com/SigNoz/signoz/pkg/types/telemetrytypes/telemetrytypestest"
-	"github.com/SigNoz/signoz/pkg/valuer"
-	"github.com/stretchr/testify/require"
-)
-
-// A key present in both resource and body contexts must filter on resource only.
-// The resource condition builds the fingerprint CTE, so a surviving body condition
-// would AND against it and match almost nothing (engineering-pod#6086).
-func TestStatementBuilderResourceBodyConflict(t *testing.T) {
-	store := telemetrytypestest.NewMockMetadataStore()
-	store.SetStaticFields(logstelemetryschema.IntrinsicFields)
-	store.SetKey(&telemetrytypes.TelemetryFieldKey{
-		Name:          "service.name",
-		Signal:        telemetrytypes.SignalLogs,
-		FieldContext:  telemetrytypes.FieldContextResource,
-		FieldDataType: telemetrytypes.FieldDataTypeString,
-	})
-	bodyKey := &telemetrytypes.TelemetryFieldKey{
-		Name:          "service.name",
-		Signal:        telemetrytypes.SignalLogs,
-		FieldContext:  telemetrytypes.FieldContextBody,
-		FieldDataType: telemetrytypes.FieldDataTypeString,
-	}
-	require.NoError(t, bodyKey.SetJSONAccessPlan(telemetrytypes.JSONColumnMetadata{
-		BaseColumn:     logstelemetryschema.LogsV2BodyV2Column,
-		PromotedColumn: logstelemetryschema.LogsV2BodyPromotedColumn,
-	}, map[string][]telemetrytypes.FieldDataType{"service.name": {telemetrytypes.FieldDataTypeString}}))
-	store.SetKey(bodyKey)
-
-	fl := flaggertest.WithUseJSONBody(t, true)
-	storage := logstelemetryschema.NewStorage()
-	aggExprRewriter := querybuilder.NewAggExprRewriter(instrumentationtest.New().ToProviderSettings(), nil, storage, fl, telemetrytypes.SignalLogs)
-	statementBuilder := NewLogQueryStatementBuilder(
-		instrumentationtest.New().ToProviderSettings(),
-		store,
-		storage,
-		aggExprRewriter,
-		logstelemetryschema.DefaultFullTextColumn,
-		fl,
-		nil,
-		statementbuilder.Config{SkipResourceFingerprint: statementbuilder.SkipResourceFingerprint{Enabled: false, Threshold: 100000}},
-	)
-
-	testCases := []struct {
-		name        string
-		requestType qbtypes.RequestType
-		query       qbtypes.QueryBuilderQuery[qbtypes.LogAggregation]
-		expected    qbtypes.Statement
-	}{
-		{
-			name:        "AmbiguousKeyFiltersResourceOnly",
-			requestType: qbtypes.RequestTypeRaw,
-			query: qbtypes.QueryBuilderQuery[qbtypes.LogAggregation]{
-				Signal: telemetrytypes.SignalLogs,
-				Filter: &qbtypes.Filter{Expression: "service.name = 'webapp'"},
-				Limit:  10,
-			},
-			expected: qbtypes.Statement{
-				Query: "WITH __resource_filter AS (SELECT fingerprint FROM signoz_logs.distributed_logs_v2_resource WHERE (simpleJSONExtractString(labels, 'service.name') = ? AND labels LIKE ? AND labels LIKE ?) AND seen_at_ts_bucket_start >= ? AND seen_at_ts_bucket_start <= ? GROUP BY fingerprint) SELECT timestamp, id, trace_id, span_id, trace_flags, severity_text, severity_number, scope_name, scope_version, body_v2 as body, attributes_string, attributes_number, attributes_bool, resources_string, scope_string FROM signoz_logs.distributed_logs_v2 WHERE resource_fingerprint GLOBAL IN (SELECT fingerprint FROM __resource_filter) AND timestamp >= ? AND ts_bucket_start >= ? AND timestamp < ? AND ts_bucket_start <= ? LIMIT ?",
-				Args:  []any{"webapp", "%service.name%", "%service.name\":\"webapp%", uint64(1747945619), uint64(1747983448), "1747947419000000000", uint64(1747945619), "1747983448000000000", uint64(1747983448), 10},
-				Warnings: []string{
-					"Key `service.name` is ambiguous, found 2 different combinations of field context / data type: [name=service.name,context=resource,datatype=string name=service.name,context=body,datatype=string]. Using `resource` context by default. To query another context explicitly, use the fully qualified name (e.g., 'attribute.service.name' or 'body.service.name')",
-				},
-			},
-		},
-	}
-
-	for _, testCase := range testCases {
-		t.Run(testCase.name, func(t *testing.T) {
-			q, err := statementBuilder.Build(context.Background(), valuer.UUID{}, 1747947419000, 1747983448000, testCase.requestType, testCase.query, nil)
-			require.NoError(t, err)
-			require.Equal(t, testCase.expected.Query, q.Query)
-			require.Equal(t, testCase.expected.Args, q.Args)
-			require.Equal(t, testCase.expected.Warnings, q.Warnings)
-		})
-	}
-}

pkg/statementbuilder/tracesstatementbuilder/bulk_attributes_test.go

@@ -1,149 +0,0 @@
-package tracesstatementbuilder
-
-import (
-	"context"
-	"regexp"
-	"strings"
-	"testing"
-	"time"
-
-	"github.com/SigNoz/signoz/pkg/flagger/flaggertest"
-	"github.com/SigNoz/signoz/pkg/instrumentation/instrumentationtest"
-	"github.com/SigNoz/signoz/pkg/querybuilder"
-	"github.com/SigNoz/signoz/pkg/telemetryschema/tracestelemetryschema"
-	qbtypes "github.com/SigNoz/signoz/pkg/types/querybuildertypes/querybuildertypesv5"
-	"github.com/SigNoz/signoz/pkg/types/telemetrytypes"
-	"github.com/SigNoz/signoz/pkg/types/telemetrytypes/telemetrytypestest"
-	"github.com/SigNoz/signoz/pkg/valuer"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-)
-
-// jsonAttrColRe matches the bare `attributes` JSON column in the SELECT list, not the legacy maps.
-var jsonAttrColRe = regexp.MustCompile(`,\s*attributes\s*(,| FROM )`)
-
-func newBulkTestBuilder(t *testing.T, releaseTime time.Time) *traceQueryStatementBuilder {
-	t.Helper()
-	fl := flaggertest.New(t)
-	storage := tracestelemetryschema.NewStorage()
-	store := telemetrytypestest.NewMockMetadataStore()
-	store.KeysMap = tracestelemetryschema.BuildCompleteFieldKeyMap(releaseTime)
-	store.KeysMap["http.route"] = []*telemetrytypes.TelemetryFieldKey{{
-		Name:          "http.route",
-		FieldContext:  telemetrytypes.FieldContextAttribute,
-		FieldDataType: telemetrytypes.FieldDataTypeString,
-		Signal:        telemetrytypes.SignalTraces,
-	}}
-	store.ColumnEvolutionMetadataMap["traces:attribute:__all__"] = tracestelemetryschema.MockAttributeEvolutionData(releaseTime)
-
-	aggExprRewriter := querybuilder.NewAggExprRewriter(instrumentationtest.New().ToProviderSettings(), nil, storage, fl, telemetrytypes.SignalTraces)
-	return NewTraceQueryStatementBuilder(
-		instrumentationtest.New().ToProviderSettings(),
-		store, storage, aggExprRewriter, nil, fl, false, 100000,
-	)
-}
-
-// TestListQuerySelectsAllAttributeHomes: every bag home is scanned in any window, with no evolution lookup.
-func TestListQuerySelectsAllAttributeHomes(t *testing.T) {
-	releaseTime := time.Date(2025, 5, 22, 22, 0, 0, 0, time.UTC)
-	rel := releaseTime.UnixMilli()
-	day := int64(24 * time.Hour / time.Millisecond)
-
-	b := newBulkTestBuilder(t, releaseTime)
-
-	testCases := []struct {
-		name    string
-		startMs uint64
-		endMs   uint64
-	}{
-		{"BeforeRollout", uint64(rel - 2*day), uint64(rel - day)},
-		{"AfterRollout", uint64(rel + day), uint64(rel + 2*day)},
-		{"StraddlingRollout", uint64(rel - day), uint64(rel + day)},
-	}
-
-	for _, testCase := range testCases {
-		t.Run(testCase.name, func(t *testing.T) {
-			stmt, err := b.Build(
-				context.Background(), valuer.UUID{}, testCase.startMs, testCase.endMs,
-				qbtypes.RequestTypeRaw,
-				qbtypes.QueryBuilderQuery[qbtypes.TraceAggregation]{Signal: telemetrytypes.SignalTraces},
-				nil,
-			)
-			require.NoError(t, err)
-			selectList := stmt.Query[:strings.Index(stmt.Query, " FROM ")]
-
-			assert.Regexp(t, jsonAttrColRe, stmt.Query, "json `attributes` column; select=%s", selectList)
-			for _, col := range []string{"attributes_string", "attributes_number", "attributes_bool", "resources_string"} {
-				assert.Contains(t, stmt.Query, col, "select=%s", selectList)
-			}
-		})
-	}
-}
-
-// TestGroupByAttributeHomeAcrossRollout: the group-by home follows the window — legacy map
-// before the rollout, JSON with legacy fallback while straddling, JSON only after it.
-func TestGroupByAttributeHomeAcrossRollout(t *testing.T) {
-	releaseTime := time.Date(2025, 5, 22, 22, 0, 0, 0, time.UTC)
-	rel := releaseTime.UnixMilli()
-	day := int64(24 * time.Hour / time.Millisecond)
-
-	b := newBulkTestBuilder(t, releaseTime)
-
-	testCases := []struct {
-		name            string
-		startMs         uint64
-		endMs           uint64
-		wantContains    []string
-		wantNotContains []string
-	}{
-		{
-			name:            "BeforeRollout_ReadsLegacyMap",
-			startMs:         uint64(rel - 2*day),
-			endMs:           uint64(rel - day),
-			wantContains:    []string{"mapContains(attributes_string, 'http.route')", "attributes_string['http.route']"},
-			wantNotContains: []string{"attributes.`http.route`"},
-		},
-		{
-			name:            "StraddlingRollout_JSONThenLegacyFallback",
-			startMs:         uint64(rel - day),
-			endMs:           uint64(rel + day),
-			wantContains:    []string{"attributes.`http.route` IS NOT NULL", "attributes.`http.route`::String", "attributes_string['http.route']"},
-			wantNotContains: nil,
-		},
-		{
-			name:            "AfterRollout_ReadsJSONOnly",
-			startMs:         uint64(rel + day),
-			endMs:           uint64(rel + 2*day),
-			wantContains:    []string{"attributes.`http.route`::String"},
-			wantNotContains: []string{"attributes_string"},
-		},
-	}
-
-	for _, testCase := range testCases {
-		t.Run(testCase.name, func(t *testing.T) {
-			stmt, err := b.Build(
-				context.Background(), valuer.UUID{}, testCase.startMs, testCase.endMs,
-				qbtypes.RequestTypeTimeSeries,
-				qbtypes.QueryBuilderQuery[qbtypes.TraceAggregation]{
-					Signal:       telemetrytypes.SignalTraces,
-					StepInterval: qbtypes.Step{Duration: 30 * time.Second},
-					Aggregations: []qbtypes.TraceAggregation{{Expression: "count()"}},
-					GroupBy: []qbtypes.GroupByKey{{TelemetryFieldKey: telemetrytypes.TelemetryFieldKey{
-						Name:          "http.route",
-						FieldContext:  telemetrytypes.FieldContextAttribute,
-						FieldDataType: telemetrytypes.FieldDataTypeString,
-					}}},
-					Limit: 10,
-				},
-				nil,
-			)
-			require.NoError(t, err)
-			for _, want := range testCase.wantContains {
-				assert.Contains(t, stmt.Query, want)
-			}
-			for _, unwanted := range testCase.wantNotContains {
-				assert.NotContains(t, stmt.Query, unwanted)
-			}
-		})
-	}
-}

pkg/statementbuilder/tracesstatementbuilder/stmt_builder_test.go

@@ -581,7 +581,7 @@ func TestStatementBuilderListQuery(t *testing.T) {
 				Limit: 10,
 			},
 			expected: qbtypes.Statement{
-				Query: "WITH __resource_filter AS (SELECT fingerprint FROM signoz_traces.distributed_traces_v3_resource WHERE (simpleJSONExtractString(labels, 'service.name') = ? AND labels LIKE ? AND labels LIKE ?) AND seen_at_ts_bucket_start >= ? AND seen_at_ts_bucket_start <= ? GROUP BY fingerprint) SELECT timestamp AS `__SELECT_KEY_0_timestamp`, trace_id AS `__SELECT_KEY_1_trace_id`, span_id AS `__SELECT_KEY_2_span_id`, trace_state AS `__SELECT_KEY_3_trace_state`, parent_span_id AS `__SELECT_KEY_4_parent_span_id`, flags AS `__SELECT_KEY_5_flags`, name AS `__SELECT_KEY_6_name`, kind AS `__SELECT_KEY_7_kind`, kind_string AS `__SELECT_KEY_8_kind_string`, duration_nano AS `__SELECT_KEY_9_duration_nano`, status_code AS `__SELECT_KEY_10_status_code`, status_message AS `__SELECT_KEY_11_status_message`, status_code_string AS `__SELECT_KEY_12_status_code_string`, events AS `__SELECT_KEY_13_events`, links AS `__SELECT_KEY_14_links`, response_status_code AS `__SELECT_KEY_15_response_status_code`, external_http_url AS `__SELECT_KEY_16_external_http_url`, http_url AS `__SELECT_KEY_17_http_url`, external_http_method AS `__SELECT_KEY_18_external_http_method`, http_method AS `__SELECT_KEY_19_http_method`, http_host AS `__SELECT_KEY_20_http_host`, db_name AS `__SELECT_KEY_21_db_name`, db_operation AS `__SELECT_KEY_22_db_operation`, has_error AS `__SELECT_KEY_23_has_error`, is_remote AS `__SELECT_KEY_24_is_remote`, attributes_string, attributes_number, attributes_bool, resources_string, attributes FROM signoz_traces.distributed_signoz_index_v3 WHERE resource_fingerprint GLOBAL IN (SELECT fingerprint FROM __resource_filter) AND timestamp >= ? AND timestamp < ? AND ts_bucket_start >= ? AND ts_bucket_start <= ? ORDER BY multiIf(mapContains(attributes_string, 'user.id'), attributes_string['user.id'], NULL) desc LIMIT ?",
+				Query: "WITH __resource_filter AS (SELECT fingerprint FROM signoz_traces.distributed_traces_v3_resource WHERE (simpleJSONExtractString(labels, 'service.name') = ? AND labels LIKE ? AND labels LIKE ?) AND seen_at_ts_bucket_start >= ? AND seen_at_ts_bucket_start <= ? GROUP BY fingerprint) SELECT timestamp AS `__SELECT_KEY_0_timestamp`, trace_id AS `__SELECT_KEY_1_trace_id`, span_id AS `__SELECT_KEY_2_span_id`, trace_state AS `__SELECT_KEY_3_trace_state`, parent_span_id AS `__SELECT_KEY_4_parent_span_id`, flags AS `__SELECT_KEY_5_flags`, name AS `__SELECT_KEY_6_name`, kind AS `__SELECT_KEY_7_kind`, kind_string AS `__SELECT_KEY_8_kind_string`, duration_nano AS `__SELECT_KEY_9_duration_nano`, status_code AS `__SELECT_KEY_10_status_code`, status_message AS `__SELECT_KEY_11_status_message`, status_code_string AS `__SELECT_KEY_12_status_code_string`, events AS `__SELECT_KEY_13_events`, links AS `__SELECT_KEY_14_links`, response_status_code AS `__SELECT_KEY_15_response_status_code`, external_http_url AS `__SELECT_KEY_16_external_http_url`, http_url AS `__SELECT_KEY_17_http_url`, external_http_method AS `__SELECT_KEY_18_external_http_method`, http_method AS `__SELECT_KEY_19_http_method`, http_host AS `__SELECT_KEY_20_http_host`, db_name AS `__SELECT_KEY_21_db_name`, db_operation AS `__SELECT_KEY_22_db_operation`, has_error AS `__SELECT_KEY_23_has_error`, is_remote AS `__SELECT_KEY_24_is_remote`, attributes_string, attributes_number, attributes_bool, resources_string FROM signoz_traces.distributed_signoz_index_v3 WHERE resource_fingerprint GLOBAL IN (SELECT fingerprint FROM __resource_filter) AND timestamp >= ? AND timestamp < ? AND ts_bucket_start >= ? AND ts_bucket_start <= ? ORDER BY multiIf(mapContains(attributes_string, 'user.id'), attributes_string['user.id'], NULL) desc LIMIT ?",
 				Args:  []any{"redis-manual", "%service.name%", "%service.name\":\"redis-manual%", uint64(1747945619), uint64(1747983448), "1747947419000000000", "1747983448000000000", uint64(1747945619), uint64(1747983448), 10},
 			},
 			expectedErr: nil,
@@ -837,7 +837,7 @@ func TestStatementBuilderListQueryWithCorruptData(t *testing.T) {
 				Limit:        10,
 			},
 			expected: qbtypes.Statement{
-				Query: "SELECT timestamp AS `__SELECT_KEY_0_timestamp`, trace_id AS `__SELECT_KEY_1_trace_id`, span_id AS `__SELECT_KEY_2_span_id`, trace_state AS `__SELECT_KEY_3_trace_state`, parent_span_id AS `__SELECT_KEY_4_parent_span_id`, flags AS `__SELECT_KEY_5_flags`, name AS `__SELECT_KEY_6_name`, kind AS `__SELECT_KEY_7_kind`, kind_string AS `__SELECT_KEY_8_kind_string`, duration_nano AS `__SELECT_KEY_9_duration_nano`, status_code AS `__SELECT_KEY_10_status_code`, status_message AS `__SELECT_KEY_11_status_message`, status_code_string AS `__SELECT_KEY_12_status_code_string`, events AS `__SELECT_KEY_13_events`, links AS `__SELECT_KEY_14_links`, response_status_code AS `__SELECT_KEY_15_response_status_code`, external_http_url AS `__SELECT_KEY_16_external_http_url`, http_url AS `__SELECT_KEY_17_http_url`, external_http_method AS `__SELECT_KEY_18_external_http_method`, http_method AS `__SELECT_KEY_19_http_method`, http_host AS `__SELECT_KEY_20_http_host`, db_name AS `__SELECT_KEY_21_db_name`, db_operation AS `__SELECT_KEY_22_db_operation`, has_error AS `__SELECT_KEY_23_has_error`, is_remote AS `__SELECT_KEY_24_is_remote`, attributes_string, attributes_number, attributes_bool, resources_string, attributes FROM signoz_traces.distributed_signoz_index_v3 WHERE timestamp >= ? AND timestamp < ? AND ts_bucket_start >= ? AND ts_bucket_start <= ? LIMIT ?",
+				Query: "SELECT timestamp AS `__SELECT_KEY_0_timestamp`, trace_id AS `__SELECT_KEY_1_trace_id`, span_id AS `__SELECT_KEY_2_span_id`, trace_state AS `__SELECT_KEY_3_trace_state`, parent_span_id AS `__SELECT_KEY_4_parent_span_id`, flags AS `__SELECT_KEY_5_flags`, name AS `__SELECT_KEY_6_name`, kind AS `__SELECT_KEY_7_kind`, kind_string AS `__SELECT_KEY_8_kind_string`, duration_nano AS `__SELECT_KEY_9_duration_nano`, status_code AS `__SELECT_KEY_10_status_code`, status_message AS `__SELECT_KEY_11_status_message`, status_code_string AS `__SELECT_KEY_12_status_code_string`, events AS `__SELECT_KEY_13_events`, links AS `__SELECT_KEY_14_links`, response_status_code AS `__SELECT_KEY_15_response_status_code`, external_http_url AS `__SELECT_KEY_16_external_http_url`, http_url AS `__SELECT_KEY_17_http_url`, external_http_method AS `__SELECT_KEY_18_external_http_method`, http_method AS `__SELECT_KEY_19_http_method`, http_host AS `__SELECT_KEY_20_http_host`, db_name AS `__SELECT_KEY_21_db_name`, db_operation AS `__SELECT_KEY_22_db_operation`, has_error AS `__SELECT_KEY_23_has_error`, is_remote AS `__SELECT_KEY_24_is_remote`, attributes_string, attributes_number, attributes_bool, resources_string FROM signoz_traces.distributed_signoz_index_v3 WHERE timestamp >= ? AND timestamp < ? AND ts_bucket_start >= ? AND ts_bucket_start <= ? LIMIT ?",
 				Args:  []any{"1747947419000000000", "1747983448000000000", uint64(1747945619), uint64(1747983448), 10},
 			},
 			expectedErr: nil,
@@ -879,7 +879,7 @@ func TestStatementBuilderListQueryWithCorruptData(t *testing.T) {
 				}},
 			},
 			expected: qbtypes.Statement{
-				Query: "SELECT timestamp AS `__SELECT_KEY_0_timestamp`, trace_id AS `__SELECT_KEY_1_trace_id`, span_id AS `__SELECT_KEY_2_span_id`, trace_state AS `__SELECT_KEY_3_trace_state`, parent_span_id AS `__SELECT_KEY_4_parent_span_id`, flags AS `__SELECT_KEY_5_flags`, name AS `__SELECT_KEY_6_name`, kind AS `__SELECT_KEY_7_kind`, kind_string AS `__SELECT_KEY_8_kind_string`, duration_nano AS `__SELECT_KEY_9_duration_nano`, status_code AS `__SELECT_KEY_10_status_code`, status_message AS `__SELECT_KEY_11_status_message`, status_code_string AS `__SELECT_KEY_12_status_code_string`, events AS `__SELECT_KEY_13_events`, links AS `__SELECT_KEY_14_links`, response_status_code AS `__SELECT_KEY_15_response_status_code`, external_http_url AS `__SELECT_KEY_16_external_http_url`, http_url AS `__SELECT_KEY_17_http_url`, external_http_method AS `__SELECT_KEY_18_external_http_method`, http_method AS `__SELECT_KEY_19_http_method`, http_host AS `__SELECT_KEY_20_http_host`, db_name AS `__SELECT_KEY_21_db_name`, db_operation AS `__SELECT_KEY_22_db_operation`, has_error AS `__SELECT_KEY_23_has_error`, is_remote AS `__SELECT_KEY_24_is_remote`, attributes_string, attributes_number, attributes_bool, resources_string, attributes FROM signoz_traces.distributed_signoz_index_v3 WHERE timestamp >= ? AND timestamp < ? AND ts_bucket_start >= ? AND ts_bucket_start <= ? ORDER BY timestamp asc LIMIT ?",
+				Query: "SELECT timestamp AS `__SELECT_KEY_0_timestamp`, trace_id AS `__SELECT_KEY_1_trace_id`, span_id AS `__SELECT_KEY_2_span_id`, trace_state AS `__SELECT_KEY_3_trace_state`, parent_span_id AS `__SELECT_KEY_4_parent_span_id`, flags AS `__SELECT_KEY_5_flags`, name AS `__SELECT_KEY_6_name`, kind AS `__SELECT_KEY_7_kind`, kind_string AS `__SELECT_KEY_8_kind_string`, duration_nano AS `__SELECT_KEY_9_duration_nano`, status_code AS `__SELECT_KEY_10_status_code`, status_message AS `__SELECT_KEY_11_status_message`, status_code_string AS `__SELECT_KEY_12_status_code_string`, events AS `__SELECT_KEY_13_events`, links AS `__SELECT_KEY_14_links`, response_status_code AS `__SELECT_KEY_15_response_status_code`, external_http_url AS `__SELECT_KEY_16_external_http_url`, http_url AS `__SELECT_KEY_17_http_url`, external_http_method AS `__SELECT_KEY_18_external_http_method`, http_method AS `__SELECT_KEY_19_http_method`, http_host AS `__SELECT_KEY_20_http_host`, db_name AS `__SELECT_KEY_21_db_name`, db_operation AS `__SELECT_KEY_22_db_operation`, has_error AS `__SELECT_KEY_23_has_error`, is_remote AS `__SELECT_KEY_24_is_remote`, attributes_string, attributes_number, attributes_bool, resources_string FROM signoz_traces.distributed_signoz_index_v3 WHERE timestamp >= ? AND timestamp < ? AND ts_bucket_start >= ? AND ts_bucket_start <= ? ORDER BY timestamp asc LIMIT ?",
 				Args:  []any{"1747947419000000000", "1747983448000000000", uint64(1747945619), uint64(1747983448), 10},
 			},
 			expectedErr: nil,
@@ -906,7 +906,7 @@ func TestStatementBuilderListQueryWithCorruptData(t *testing.T) {
 				Limit: 10,
 			},
 			expected: qbtypes.Statement{
-				Query: "SELECT timestamp AS `__SELECT_KEY_0_timestamp`, trace_id AS `__SELECT_KEY_1_trace_id`, span_id AS `__SELECT_KEY_2_span_id`, trace_state AS `__SELECT_KEY_3_trace_state`, parent_span_id AS `__SELECT_KEY_4_parent_span_id`, flags AS `__SELECT_KEY_5_flags`, name AS `__SELECT_KEY_6_name`, kind AS `__SELECT_KEY_7_kind`, kind_string AS `__SELECT_KEY_8_kind_string`, duration_nano AS `__SELECT_KEY_9_duration_nano`, status_code AS `__SELECT_KEY_10_status_code`, status_message AS `__SELECT_KEY_11_status_message`, status_code_string AS `__SELECT_KEY_12_status_code_string`, events AS `__SELECT_KEY_13_events`, links AS `__SELECT_KEY_14_links`, response_status_code AS `__SELECT_KEY_15_response_status_code`, external_http_url AS `__SELECT_KEY_16_external_http_url`, http_url AS `__SELECT_KEY_17_http_url`, external_http_method AS `__SELECT_KEY_18_external_http_method`, http_method AS `__SELECT_KEY_19_http_method`, http_host AS `__SELECT_KEY_20_http_host`, db_name AS `__SELECT_KEY_21_db_name`, db_operation AS `__SELECT_KEY_22_db_operation`, has_error AS `__SELECT_KEY_23_has_error`, is_remote AS `__SELECT_KEY_24_is_remote`, attributes_string, attributes_number, attributes_bool, resources_string, attributes FROM signoz_traces.distributed_signoz_index_v3 WHERE (scope.version::String = ? AND scope.version::String <> '') AND timestamp >= ? AND timestamp < ? AND ts_bucket_start >= ? AND ts_bucket_start <= ? LIMIT ?",
+				Query: "SELECT timestamp AS `__SELECT_KEY_0_timestamp`, trace_id AS `__SELECT_KEY_1_trace_id`, span_id AS `__SELECT_KEY_2_span_id`, trace_state AS `__SELECT_KEY_3_trace_state`, parent_span_id AS `__SELECT_KEY_4_parent_span_id`, flags AS `__SELECT_KEY_5_flags`, name AS `__SELECT_KEY_6_name`, kind AS `__SELECT_KEY_7_kind`, kind_string AS `__SELECT_KEY_8_kind_string`, duration_nano AS `__SELECT_KEY_9_duration_nano`, status_code AS `__SELECT_KEY_10_status_code`, status_message AS `__SELECT_KEY_11_status_message`, status_code_string AS `__SELECT_KEY_12_status_code_string`, events AS `__SELECT_KEY_13_events`, links AS `__SELECT_KEY_14_links`, response_status_code AS `__SELECT_KEY_15_response_status_code`, external_http_url AS `__SELECT_KEY_16_external_http_url`, http_url AS `__SELECT_KEY_17_http_url`, external_http_method AS `__SELECT_KEY_18_external_http_method`, http_method AS `__SELECT_KEY_19_http_method`, http_host AS `__SELECT_KEY_20_http_host`, db_name AS `__SELECT_KEY_21_db_name`, db_operation AS `__SELECT_KEY_22_db_operation`, has_error AS `__SELECT_KEY_23_has_error`, is_remote AS `__SELECT_KEY_24_is_remote`, attributes_string, attributes_number, attributes_bool, resources_string FROM signoz_traces.distributed_signoz_index_v3 WHERE (scope.version::String = ? AND scope.version::String <> '') AND timestamp >= ? AND timestamp < ? AND ts_bucket_start >= ? AND ts_bucket_start <= ? LIMIT ?",
 				Args:  []any{"1.0.0", "1747947419000000000", "1747983448000000000", uint64(1747945619), uint64(1747983448), 10},
 			},
 		},

pkg/statementbuilder/tracesstatementbuilder/trace_operator_cte_builder_test.go

@@ -124,7 +124,7 @@ func TestTraceOperatorStatementBuilder(t *testing.T) {
 				},
 			},
 			expected: qbtypes.Statement{
-				Query: "WITH toDateTime64(1747947419000000000, 9) AS t_from, toDateTime64(1747983448000000000, 9) AS t_to, 1747945619 AS bucket_from, 1747983448 AS bucket_to, all_spans AS (SELECT *, resource_string_service$$name AS `service.name` FROM signoz_traces.distributed_signoz_index_v3 WHERE timestamp >= ? AND timestamp < ? AND ts_bucket_start >= ? AND ts_bucket_start <= ?), __resource_filter_A AS (SELECT fingerprint FROM signoz_traces.distributed_traces_v3_resource WHERE (simpleJSONExtractString(labels, 'service.name') = ? AND labels LIKE ? AND labels LIKE ?) AND seen_at_ts_bucket_start >= ? AND seen_at_ts_bucket_start <= ? GROUP BY fingerprint), A AS (SELECT * FROM signoz_traces.distributed_signoz_index_v3 WHERE resource_fingerprint GLOBAL IN (SELECT fingerprint FROM __resource_filter_A) AND timestamp >= ? AND timestamp < ? AND ts_bucket_start >= ? AND ts_bucket_start <= ?), __resource_filter_B AS (SELECT fingerprint FROM signoz_traces.distributed_traces_v3_resource WHERE (simpleJSONExtractString(labels, 'service.name') = ? AND labels LIKE ? AND labels LIKE ?) AND seen_at_ts_bucket_start >= ? AND seen_at_ts_bucket_start <= ? GROUP BY fingerprint), B AS (SELECT * FROM signoz_traces.distributed_signoz_index_v3 WHERE resource_fingerprint GLOBAL IN (SELECT fingerprint FROM __resource_filter_B) AND timestamp >= ? AND timestamp < ? AND ts_bucket_start >= ? AND ts_bucket_start <= ?), A_INDIR_DESC_B AS (WITH RECURSIVE up AS (SELECT d.trace_id, d.span_id, d.parent_span_id, 0 AS depth FROM B AS d UNION ALL SELECT p.trace_id, p.span_id, p.parent_span_id, up.depth + 1 FROM all_spans AS p JOIN up ON p.trace_id = up.trace_id AND p.span_id = up.parent_span_id WHERE up.depth < 100) SELECT DISTINCT a.* FROM A AS a GLOBAL INNER JOIN (SELECT DISTINCT trace_id, span_id FROM up WHERE depth > 0 ) AS ancestors ON ancestors.trace_id = a.trace_id AND ancestors.span_id = a.span_id) SELECT timestamp, trace_id, span_id, name, duration_nano, parent_span_id, trace_state AS `__SELECT_KEY_3_trace_state`, flags AS `__SELECT_KEY_5_flags`, kind AS `__SELECT_KEY_7_kind`, kind_string AS `__SELECT_KEY_8_kind_string`, status_code AS `__SELECT_KEY_10_status_code`, status_message AS `__SELECT_KEY_11_status_message`, status_code_string AS `__SELECT_KEY_12_status_code_string`, events AS `__SELECT_KEY_13_events`, links AS `__SELECT_KEY_14_links`, response_status_code AS `__SELECT_KEY_15_response_status_code`, external_http_url AS `__SELECT_KEY_16_external_http_url`, http_url AS `__SELECT_KEY_17_http_url`, external_http_method AS `__SELECT_KEY_18_external_http_method`, http_method AS `__SELECT_KEY_19_http_method`, http_host AS `__SELECT_KEY_20_http_host`, db_name AS `__SELECT_KEY_21_db_name`, db_operation AS `__SELECT_KEY_22_db_operation`, has_error AS `__SELECT_KEY_23_has_error`, is_remote AS `__SELECT_KEY_24_is_remote`, attributes_string, attributes_number, attributes_bool, resources_string, attributes FROM A_INDIR_DESC_B ORDER BY timestamp DESC LIMIT ? SETTINGS distributed_product_mode='allow', max_memory_usage=10000000000",
+				Query: "WITH toDateTime64(1747947419000000000, 9) AS t_from, toDateTime64(1747983448000000000, 9) AS t_to, 1747945619 AS bucket_from, 1747983448 AS bucket_to, all_spans AS (SELECT *, resource_string_service$$name AS `service.name` FROM signoz_traces.distributed_signoz_index_v3 WHERE timestamp >= ? AND timestamp < ? AND ts_bucket_start >= ? AND ts_bucket_start <= ?), __resource_filter_A AS (SELECT fingerprint FROM signoz_traces.distributed_traces_v3_resource WHERE (simpleJSONExtractString(labels, 'service.name') = ? AND labels LIKE ? AND labels LIKE ?) AND seen_at_ts_bucket_start >= ? AND seen_at_ts_bucket_start <= ? GROUP BY fingerprint), A AS (SELECT * FROM signoz_traces.distributed_signoz_index_v3 WHERE resource_fingerprint GLOBAL IN (SELECT fingerprint FROM __resource_filter_A) AND timestamp >= ? AND timestamp < ? AND ts_bucket_start >= ? AND ts_bucket_start <= ?), __resource_filter_B AS (SELECT fingerprint FROM signoz_traces.distributed_traces_v3_resource WHERE (simpleJSONExtractString(labels, 'service.name') = ? AND labels LIKE ? AND labels LIKE ?) AND seen_at_ts_bucket_start >= ? AND seen_at_ts_bucket_start <= ? GROUP BY fingerprint), B AS (SELECT * FROM signoz_traces.distributed_signoz_index_v3 WHERE resource_fingerprint GLOBAL IN (SELECT fingerprint FROM __resource_filter_B) AND timestamp >= ? AND timestamp < ? AND ts_bucket_start >= ? AND ts_bucket_start <= ?), A_INDIR_DESC_B AS (WITH RECURSIVE up AS (SELECT d.trace_id, d.span_id, d.parent_span_id, 0 AS depth FROM B AS d UNION ALL SELECT p.trace_id, p.span_id, p.parent_span_id, up.depth + 1 FROM all_spans AS p JOIN up ON p.trace_id = up.trace_id AND p.span_id = up.parent_span_id WHERE up.depth < 100) SELECT DISTINCT a.* FROM A AS a GLOBAL INNER JOIN (SELECT DISTINCT trace_id, span_id FROM up WHERE depth > 0 ) AS ancestors ON ancestors.trace_id = a.trace_id AND ancestors.span_id = a.span_id) SELECT timestamp, trace_id, span_id, name, duration_nano, parent_span_id, trace_state AS `__SELECT_KEY_3_trace_state`, flags AS `__SELECT_KEY_5_flags`, kind AS `__SELECT_KEY_7_kind`, kind_string AS `__SELECT_KEY_8_kind_string`, status_code AS `__SELECT_KEY_10_status_code`, status_message AS `__SELECT_KEY_11_status_message`, status_code_string AS `__SELECT_KEY_12_status_code_string`, events AS `__SELECT_KEY_13_events`, links AS `__SELECT_KEY_14_links`, response_status_code AS `__SELECT_KEY_15_response_status_code`, external_http_url AS `__SELECT_KEY_16_external_http_url`, http_url AS `__SELECT_KEY_17_http_url`, external_http_method AS `__SELECT_KEY_18_external_http_method`, http_method AS `__SELECT_KEY_19_http_method`, http_host AS `__SELECT_KEY_20_http_host`, db_name AS `__SELECT_KEY_21_db_name`, db_operation AS `__SELECT_KEY_22_db_operation`, has_error AS `__SELECT_KEY_23_has_error`, is_remote AS `__SELECT_KEY_24_is_remote`, attributes_string, attributes_number, attributes_bool, resources_string FROM A_INDIR_DESC_B ORDER BY timestamp DESC LIMIT ? SETTINGS distributed_product_mode='allow', max_memory_usage=10000000000",
 				Args:  []any{"1747947419000000000", "1747983448000000000", uint64(1747945619), uint64(1747983448), "gateway", "%service.name%", "%service.name\":\"gateway%", uint64(1747945619), uint64(1747983448), "1747947419000000000", "1747983448000000000", uint64(1747945619), uint64(1747983448), "database", "%service.name%", "%service.name\":\"database%", uint64(1747945619), uint64(1747983448), "1747947419000000000", "1747983448000000000", uint64(1747945619), uint64(1747983448), 5},
 			},
 			expectedErr: nil,
@@ -161,7 +161,7 @@ func TestTraceOperatorStatementBuilder(t *testing.T) {
 				},
 			},
 			expected: qbtypes.Statement{
-				Query: "WITH toDateTime64(1747947419000000000, 9) AS t_from, toDateTime64(1747983448000000000, 9) AS t_to, 1747945619 AS bucket_from, 1747983448 AS bucket_to, all_spans AS (SELECT *, resource_string_service$$name AS `service.name` FROM signoz_traces.distributed_signoz_index_v3 WHERE timestamp >= ? AND timestamp < ? AND ts_bucket_start >= ? AND ts_bucket_start <= ?), __resource_filter_A AS (SELECT fingerprint FROM signoz_traces.distributed_traces_v3_resource WHERE (simpleJSONExtractString(labels, 'service.name') = ? AND labels LIKE ? AND labels LIKE ?) AND seen_at_ts_bucket_start >= ? AND seen_at_ts_bucket_start <= ? GROUP BY fingerprint), A AS (SELECT * FROM signoz_traces.distributed_signoz_index_v3 WHERE resource_fingerprint GLOBAL IN (SELECT fingerprint FROM __resource_filter_A) AND timestamp >= ? AND timestamp < ? AND ts_bucket_start >= ? AND ts_bucket_start <= ?), __resource_filter_B AS (SELECT fingerprint FROM signoz_traces.distributed_traces_v3_resource WHERE (simpleJSONExtractString(labels, 'service.name') = ? AND labels LIKE ? AND labels LIKE ?) AND seen_at_ts_bucket_start >= ? AND seen_at_ts_bucket_start <= ? GROUP BY fingerprint), B AS (SELECT * FROM signoz_traces.distributed_signoz_index_v3 WHERE resource_fingerprint GLOBAL IN (SELECT fingerprint FROM __resource_filter_B) AND timestamp >= ? AND timestamp < ? AND ts_bucket_start >= ? AND ts_bucket_start <= ?), A_AND_B AS (SELECT l.* FROM A AS l INNER JOIN B AS r ON l.trace_id = r.trace_id) SELECT timestamp, trace_id, span_id, name, duration_nano, parent_span_id, trace_state AS `__SELECT_KEY_3_trace_state`, flags AS `__SELECT_KEY_5_flags`, kind AS `__SELECT_KEY_7_kind`, kind_string AS `__SELECT_KEY_8_kind_string`, status_code AS `__SELECT_KEY_10_status_code`, status_message AS `__SELECT_KEY_11_status_message`, status_code_string AS `__SELECT_KEY_12_status_code_string`, events AS `__SELECT_KEY_13_events`, links AS `__SELECT_KEY_14_links`, response_status_code AS `__SELECT_KEY_15_response_status_code`, external_http_url AS `__SELECT_KEY_16_external_http_url`, http_url AS `__SELECT_KEY_17_http_url`, external_http_method AS `__SELECT_KEY_18_external_http_method`, http_method AS `__SELECT_KEY_19_http_method`, http_host AS `__SELECT_KEY_20_http_host`, db_name AS `__SELECT_KEY_21_db_name`, db_operation AS `__SELECT_KEY_22_db_operation`, has_error AS `__SELECT_KEY_23_has_error`, is_remote AS `__SELECT_KEY_24_is_remote`, attributes_string, attributes_number, attributes_bool, resources_string, attributes FROM A_AND_B ORDER BY timestamp DESC LIMIT ? SETTINGS distributed_product_mode='allow', max_memory_usage=10000000000",
+				Query: "WITH toDateTime64(1747947419000000000, 9) AS t_from, toDateTime64(1747983448000000000, 9) AS t_to, 1747945619 AS bucket_from, 1747983448 AS bucket_to, all_spans AS (SELECT *, resource_string_service$$name AS `service.name` FROM signoz_traces.distributed_signoz_index_v3 WHERE timestamp >= ? AND timestamp < ? AND ts_bucket_start >= ? AND ts_bucket_start <= ?), __resource_filter_A AS (SELECT fingerprint FROM signoz_traces.distributed_traces_v3_resource WHERE (simpleJSONExtractString(labels, 'service.name') = ? AND labels LIKE ? AND labels LIKE ?) AND seen_at_ts_bucket_start >= ? AND seen_at_ts_bucket_start <= ? GROUP BY fingerprint), A AS (SELECT * FROM signoz_traces.distributed_signoz_index_v3 WHERE resource_fingerprint GLOBAL IN (SELECT fingerprint FROM __resource_filter_A) AND timestamp >= ? AND timestamp < ? AND ts_bucket_start >= ? AND ts_bucket_start <= ?), __resource_filter_B AS (SELECT fingerprint FROM signoz_traces.distributed_traces_v3_resource WHERE (simpleJSONExtractString(labels, 'service.name') = ? AND labels LIKE ? AND labels LIKE ?) AND seen_at_ts_bucket_start >= ? AND seen_at_ts_bucket_start <= ? GROUP BY fingerprint), B AS (SELECT * FROM signoz_traces.distributed_signoz_index_v3 WHERE resource_fingerprint GLOBAL IN (SELECT fingerprint FROM __resource_filter_B) AND timestamp >= ? AND timestamp < ? AND ts_bucket_start >= ? AND ts_bucket_start <= ?), A_AND_B AS (SELECT l.* FROM A AS l INNER JOIN B AS r ON l.trace_id = r.trace_id) SELECT timestamp, trace_id, span_id, name, duration_nano, parent_span_id, trace_state AS `__SELECT_KEY_3_trace_state`, flags AS `__SELECT_KEY_5_flags`, kind AS `__SELECT_KEY_7_kind`, kind_string AS `__SELECT_KEY_8_kind_string`, status_code AS `__SELECT_KEY_10_status_code`, status_message AS `__SELECT_KEY_11_status_message`, status_code_string AS `__SELECT_KEY_12_status_code_string`, events AS `__SELECT_KEY_13_events`, links AS `__SELECT_KEY_14_links`, response_status_code AS `__SELECT_KEY_15_response_status_code`, external_http_url AS `__SELECT_KEY_16_external_http_url`, http_url AS `__SELECT_KEY_17_http_url`, external_http_method AS `__SELECT_KEY_18_external_http_method`, http_method AS `__SELECT_KEY_19_http_method`, http_host AS `__SELECT_KEY_20_http_host`, db_name AS `__SELECT_KEY_21_db_name`, db_operation AS `__SELECT_KEY_22_db_operation`, has_error AS `__SELECT_KEY_23_has_error`, is_remote AS `__SELECT_KEY_24_is_remote`, attributes_string, attributes_number, attributes_bool, resources_string FROM A_AND_B ORDER BY timestamp DESC LIMIT ? SETTINGS distributed_product_mode='allow', max_memory_usage=10000000000",
 				Args:  []any{"1747947419000000000", "1747983448000000000", uint64(1747945619), uint64(1747983448), "frontend", "%service.name%", "%service.name\":\"frontend%", uint64(1747945619), uint64(1747983448), "1747947419000000000", "1747983448000000000", uint64(1747945619), uint64(1747983448), "backend", "%service.name%", "%service.name\":\"backend%", uint64(1747945619), uint64(1747983448), "1747947419000000000", "1747983448000000000", uint64(1747945619), uint64(1747983448), 15},
 			},
 			expectedErr: nil,
@@ -198,7 +198,7 @@ func TestTraceOperatorStatementBuilder(t *testing.T) {
 				},
 			},
 			expected: qbtypes.Statement{
-				Query: "WITH toDateTime64(1747947419000000000, 9) AS t_from, toDateTime64(1747983448000000000, 9) AS t_to, 1747945619 AS bucket_from, 1747983448 AS bucket_to, all_spans AS (SELECT *, resource_string_service$$name AS `service.name` FROM signoz_traces.distributed_signoz_index_v3 WHERE timestamp >= ? AND timestamp < ? AND ts_bucket_start >= ? AND ts_bucket_start <= ?), __resource_filter_A AS (SELECT fingerprint FROM signoz_traces.distributed_traces_v3_resource WHERE (simpleJSONExtractString(labels, 'service.name') = ? AND labels LIKE ? AND labels LIKE ?) AND seen_at_ts_bucket_start >= ? AND seen_at_ts_bucket_start <= ? GROUP BY fingerprint), A AS (SELECT * FROM signoz_traces.distributed_signoz_index_v3 WHERE resource_fingerprint GLOBAL IN (SELECT fingerprint FROM __resource_filter_A) AND timestamp >= ? AND timestamp < ? AND ts_bucket_start >= ? AND ts_bucket_start <= ?), __resource_filter_B AS (SELECT fingerprint FROM signoz_traces.distributed_traces_v3_resource WHERE (simpleJSONExtractString(labels, 'service.name') = ? AND labels LIKE ? AND labels LIKE ?) AND seen_at_ts_bucket_start >= ? AND seen_at_ts_bucket_start <= ? GROUP BY fingerprint), B AS (SELECT * FROM signoz_traces.distributed_signoz_index_v3 WHERE resource_fingerprint GLOBAL IN (SELECT fingerprint FROM __resource_filter_B) AND timestamp >= ? AND timestamp < ? AND ts_bucket_start >= ? AND ts_bucket_start <= ?), A_OR_B AS (SELECT * FROM A UNION DISTINCT SELECT * FROM B) SELECT timestamp, trace_id, span_id, name, duration_nano, parent_span_id, trace_state AS `__SELECT_KEY_3_trace_state`, flags AS `__SELECT_KEY_5_flags`, kind AS `__SELECT_KEY_7_kind`, kind_string AS `__SELECT_KEY_8_kind_string`, status_code AS `__SELECT_KEY_10_status_code`, status_message AS `__SELECT_KEY_11_status_message`, status_code_string AS `__SELECT_KEY_12_status_code_string`, events AS `__SELECT_KEY_13_events`, links AS `__SELECT_KEY_14_links`, response_status_code AS `__SELECT_KEY_15_response_status_code`, external_http_url AS `__SELECT_KEY_16_external_http_url`, http_url AS `__SELECT_KEY_17_http_url`, external_http_method AS `__SELECT_KEY_18_external_http_method`, http_method AS `__SELECT_KEY_19_http_method`, http_host AS `__SELECT_KEY_20_http_host`, db_name AS `__SELECT_KEY_21_db_name`, db_operation AS `__SELECT_KEY_22_db_operation`, has_error AS `__SELECT_KEY_23_has_error`, is_remote AS `__SELECT_KEY_24_is_remote`, attributes_string, attributes_number, attributes_bool, resources_string, attributes FROM A_OR_B ORDER BY timestamp DESC LIMIT ? SETTINGS distributed_product_mode='allow', max_memory_usage=10000000000",
+				Query: "WITH toDateTime64(1747947419000000000, 9) AS t_from, toDateTime64(1747983448000000000, 9) AS t_to, 1747945619 AS bucket_from, 1747983448 AS bucket_to, all_spans AS (SELECT *, resource_string_service$$name AS `service.name` FROM signoz_traces.distributed_signoz_index_v3 WHERE timestamp >= ? AND timestamp < ? AND ts_bucket_start >= ? AND ts_bucket_start <= ?), __resource_filter_A AS (SELECT fingerprint FROM signoz_traces.distributed_traces_v3_resource WHERE (simpleJSONExtractString(labels, 'service.name') = ? AND labels LIKE ? AND labels LIKE ?) AND seen_at_ts_bucket_start >= ? AND seen_at_ts_bucket_start <= ? GROUP BY fingerprint), A AS (SELECT * FROM signoz_traces.distributed_signoz_index_v3 WHERE resource_fingerprint GLOBAL IN (SELECT fingerprint FROM __resource_filter_A) AND timestamp >= ? AND timestamp < ? AND ts_bucket_start >= ? AND ts_bucket_start <= ?), __resource_filter_B AS (SELECT fingerprint FROM signoz_traces.distributed_traces_v3_resource WHERE (simpleJSONExtractString(labels, 'service.name') = ? AND labels LIKE ? AND labels LIKE ?) AND seen_at_ts_bucket_start >= ? AND seen_at_ts_bucket_start <= ? GROUP BY fingerprint), B AS (SELECT * FROM signoz_traces.distributed_signoz_index_v3 WHERE resource_fingerprint GLOBAL IN (SELECT fingerprint FROM __resource_filter_B) AND timestamp >= ? AND timestamp < ? AND ts_bucket_start >= ? AND ts_bucket_start <= ?), A_OR_B AS (SELECT * FROM A UNION DISTINCT SELECT * FROM B) SELECT timestamp, trace_id, span_id, name, duration_nano, parent_span_id, trace_state AS `__SELECT_KEY_3_trace_state`, flags AS `__SELECT_KEY_5_flags`, kind AS `__SELECT_KEY_7_kind`, kind_string AS `__SELECT_KEY_8_kind_string`, status_code AS `__SELECT_KEY_10_status_code`, status_message AS `__SELECT_KEY_11_status_message`, status_code_string AS `__SELECT_KEY_12_status_code_string`, events AS `__SELECT_KEY_13_events`, links AS `__SELECT_KEY_14_links`, response_status_code AS `__SELECT_KEY_15_response_status_code`, external_http_url AS `__SELECT_KEY_16_external_http_url`, http_url AS `__SELECT_KEY_17_http_url`, external_http_method AS `__SELECT_KEY_18_external_http_method`, http_method AS `__SELECT_KEY_19_http_method`, http_host AS `__SELECT_KEY_20_http_host`, db_name AS `__SELECT_KEY_21_db_name`, db_operation AS `__SELECT_KEY_22_db_operation`, has_error AS `__SELECT_KEY_23_has_error`, is_remote AS `__SELECT_KEY_24_is_remote`, attributes_string, attributes_number, attributes_bool, resources_string FROM A_OR_B ORDER BY timestamp DESC LIMIT ? SETTINGS distributed_product_mode='allow', max_memory_usage=10000000000",
 				Args:  []any{"1747947419000000000", "1747983448000000000", uint64(1747945619), uint64(1747983448), "frontend", "%service.name%", "%service.name\":\"frontend%", uint64(1747945619), uint64(1747983448), "1747947419000000000", "1747983448000000000", uint64(1747945619), uint64(1747983448), "backend", "%service.name%", "%service.name\":\"backend%", uint64(1747945619), uint64(1747983448), "1747947419000000000", "1747983448000000000", uint64(1747945619), uint64(1747983448), 20},
 			},
 			expectedErr: nil,
@@ -235,7 +235,7 @@ func TestTraceOperatorStatementBuilder(t *testing.T) {
 				},
 			},
 			expected: qbtypes.Statement{
-				Query: "WITH toDateTime64(1747947419000000000, 9) AS t_from, toDateTime64(1747983448000000000, 9) AS t_to, 1747945619 AS bucket_from, 1747983448 AS bucket_to, all_spans AS (SELECT *, resource_string_service$$name AS `service.name` FROM signoz_traces.distributed_signoz_index_v3 WHERE timestamp >= ? AND timestamp < ? AND ts_bucket_start >= ? AND ts_bucket_start <= ?), __resource_filter_A AS (SELECT fingerprint FROM signoz_traces.distributed_traces_v3_resource WHERE (simpleJSONExtractString(labels, 'service.name') = ? AND labels LIKE ? AND labels LIKE ?) AND seen_at_ts_bucket_start >= ? AND seen_at_ts_bucket_start <= ? GROUP BY fingerprint), A AS (SELECT * FROM signoz_traces.distributed_signoz_index_v3 WHERE resource_fingerprint GLOBAL IN (SELECT fingerprint FROM __resource_filter_A) AND timestamp >= ? AND timestamp < ? AND ts_bucket_start >= ? AND ts_bucket_start <= ?), __resource_filter_B AS (SELECT fingerprint FROM signoz_traces.distributed_traces_v3_resource WHERE (simpleJSONExtractString(labels, 'service.name') = ? AND labels LIKE ? AND labels LIKE ?) AND seen_at_ts_bucket_start >= ? AND seen_at_ts_bucket_start <= ? GROUP BY fingerprint), B AS (SELECT * FROM signoz_traces.distributed_signoz_index_v3 WHERE resource_fingerprint GLOBAL IN (SELECT fingerprint FROM __resource_filter_B) AND timestamp >= ? AND timestamp < ? AND ts_bucket_start >= ? AND ts_bucket_start <= ?), A_not_B AS (SELECT l.* FROM A AS l WHERE l.trace_id GLOBAL NOT IN (SELECT DISTINCT trace_id FROM B)) SELECT timestamp, trace_id, span_id, name, duration_nano, parent_span_id, trace_state AS `__SELECT_KEY_3_trace_state`, flags AS `__SELECT_KEY_5_flags`, kind AS `__SELECT_KEY_7_kind`, kind_string AS `__SELECT_KEY_8_kind_string`, status_code AS `__SELECT_KEY_10_status_code`, status_message AS `__SELECT_KEY_11_status_message`, status_code_string AS `__SELECT_KEY_12_status_code_string`, events AS `__SELECT_KEY_13_events`, links AS `__SELECT_KEY_14_links`, response_status_code AS `__SELECT_KEY_15_response_status_code`, external_http_url AS `__SELECT_KEY_16_external_http_url`, http_url AS `__SELECT_KEY_17_http_url`, external_http_method AS `__SELECT_KEY_18_external_http_method`, http_method AS `__SELECT_KEY_19_http_method`, http_host AS `__SELECT_KEY_20_http_host`, db_name AS `__SELECT_KEY_21_db_name`, db_operation AS `__SELECT_KEY_22_db_operation`, has_error AS `__SELECT_KEY_23_has_error`, is_remote AS `__SELECT_KEY_24_is_remote`, attributes_string, attributes_number, attributes_bool, resources_string, attributes FROM A_not_B ORDER BY timestamp DESC LIMIT ? SETTINGS distributed_product_mode='allow', max_memory_usage=10000000000",
+				Query: "WITH toDateTime64(1747947419000000000, 9) AS t_from, toDateTime64(1747983448000000000, 9) AS t_to, 1747945619 AS bucket_from, 1747983448 AS bucket_to, all_spans AS (SELECT *, resource_string_service$$name AS `service.name` FROM signoz_traces.distributed_signoz_index_v3 WHERE timestamp >= ? AND timestamp < ? AND ts_bucket_start >= ? AND ts_bucket_start <= ?), __resource_filter_A AS (SELECT fingerprint FROM signoz_traces.distributed_traces_v3_resource WHERE (simpleJSONExtractString(labels, 'service.name') = ? AND labels LIKE ? AND labels LIKE ?) AND seen_at_ts_bucket_start >= ? AND seen_at_ts_bucket_start <= ? GROUP BY fingerprint), A AS (SELECT * FROM signoz_traces.distributed_signoz_index_v3 WHERE resource_fingerprint GLOBAL IN (SELECT fingerprint FROM __resource_filter_A) AND timestamp >= ? AND timestamp < ? AND ts_bucket_start >= ? AND ts_bucket_start <= ?), __resource_filter_B AS (SELECT fingerprint FROM signoz_traces.distributed_traces_v3_resource WHERE (simpleJSONExtractString(labels, 'service.name') = ? AND labels LIKE ? AND labels LIKE ?) AND seen_at_ts_bucket_start >= ? AND seen_at_ts_bucket_start <= ? GROUP BY fingerprint), B AS (SELECT * FROM signoz_traces.distributed_signoz_index_v3 WHERE resource_fingerprint GLOBAL IN (SELECT fingerprint FROM __resource_filter_B) AND timestamp >= ? AND timestamp < ? AND ts_bucket_start >= ? AND ts_bucket_start <= ?), A_not_B AS (SELECT l.* FROM A AS l WHERE l.trace_id GLOBAL NOT IN (SELECT DISTINCT trace_id FROM B)) SELECT timestamp, trace_id, span_id, name, duration_nano, parent_span_id, trace_state AS `__SELECT_KEY_3_trace_state`, flags AS `__SELECT_KEY_5_flags`, kind AS `__SELECT_KEY_7_kind`, kind_string AS `__SELECT_KEY_8_kind_string`, status_code AS `__SELECT_KEY_10_status_code`, status_message AS `__SELECT_KEY_11_status_message`, status_code_string AS `__SELECT_KEY_12_status_code_string`, events AS `__SELECT_KEY_13_events`, links AS `__SELECT_KEY_14_links`, response_status_code AS `__SELECT_KEY_15_response_status_code`, external_http_url AS `__SELECT_KEY_16_external_http_url`, http_url AS `__SELECT_KEY_17_http_url`, external_http_method AS `__SELECT_KEY_18_external_http_method`, http_method AS `__SELECT_KEY_19_http_method`, http_host AS `__SELECT_KEY_20_http_host`, db_name AS `__SELECT_KEY_21_db_name`, db_operation AS `__SELECT_KEY_22_db_operation`, has_error AS `__SELECT_KEY_23_has_error`, is_remote AS `__SELECT_KEY_24_is_remote`, attributes_string, attributes_number, attributes_bool, resources_string FROM A_not_B ORDER BY timestamp DESC LIMIT ? SETTINGS distributed_product_mode='allow', max_memory_usage=10000000000",
 				Args:  []any{"1747947419000000000", "1747983448000000000", uint64(1747945619), uint64(1747983448), "frontend", "%service.name%", "%service.name\":\"frontend%", uint64(1747945619), uint64(1747983448), "1747947419000000000", "1747983448000000000", uint64(1747945619), uint64(1747983448), "backend", "%service.name%", "%service.name\":\"backend%", uint64(1747945619), uint64(1747983448), "1747947419000000000", "1747983448000000000", uint64(1747945619), uint64(1747983448), 10},
 			},
 			expectedErr: nil,
@@ -400,7 +400,7 @@ func TestTraceOperatorStatementBuilder(t *testing.T) {
 				},
 			},
 			expected: qbtypes.Statement{
-				Query: "WITH toDateTime64(1747947419000000000, 9) AS t_from, toDateTime64(1747983448000000000, 9) AS t_to, 1747945619 AS bucket_from, 1747983448 AS bucket_to, all_spans AS (SELECT *, resource_string_service$$name AS `service.name` FROM signoz_traces.distributed_signoz_index_v3 WHERE timestamp >= ? AND timestamp < ? AND ts_bucket_start >= ? AND ts_bucket_start <= ?), __resource_filter_A AS (SELECT fingerprint FROM signoz_traces.distributed_traces_v3_resource WHERE (simpleJSONExtractString(labels, 'service.name') = ? AND labels LIKE ? AND labels LIKE ?) AND seen_at_ts_bucket_start >= ? AND seen_at_ts_bucket_start <= ? GROUP BY fingerprint), A AS (SELECT * FROM signoz_traces.distributed_signoz_index_v3 WHERE resource_fingerprint GLOBAL IN (SELECT fingerprint FROM __resource_filter_A) AND timestamp >= ? AND timestamp < ? AND ts_bucket_start >= ? AND ts_bucket_start <= ?), __resource_filter_B AS (SELECT fingerprint FROM signoz_traces.distributed_traces_v3_resource WHERE (simpleJSONExtractString(labels, 'service.name') = ? AND labels LIKE ? AND labels LIKE ?) AND seen_at_ts_bucket_start >= ? AND seen_at_ts_bucket_start <= ? GROUP BY fingerprint), B AS (SELECT * FROM signoz_traces.distributed_signoz_index_v3 WHERE resource_fingerprint GLOBAL IN (SELECT fingerprint FROM __resource_filter_B) AND timestamp >= ? AND timestamp < ? AND ts_bucket_start >= ? AND ts_bucket_start <= ?), A_DIR_DESC_B AS (SELECT p.* FROM A AS p INNER JOIN B AS c ON p.trace_id = c.trace_id AND p.span_id = c.parent_span_id), __resource_filter_C AS (SELECT fingerprint FROM signoz_traces.distributed_traces_v3_resource WHERE (simpleJSONExtractString(labels, 'service.name') = ? AND labels LIKE ? AND labels LIKE ?) AND seen_at_ts_bucket_start >= ? AND seen_at_ts_bucket_start <= ? GROUP BY fingerprint), C AS (SELECT * FROM signoz_traces.distributed_signoz_index_v3 WHERE resource_fingerprint GLOBAL IN (SELECT fingerprint FROM __resource_filter_C) AND timestamp >= ? AND timestamp < ? AND ts_bucket_start >= ? AND ts_bucket_start <= ?), __resource_filter_D AS (SELECT fingerprint FROM signoz_traces.distributed_traces_v3_resource WHERE (simpleJSONExtractString(labels, 'service.name') = ? AND labels LIKE ? AND labels LIKE ?) AND seen_at_ts_bucket_start >= ? AND seen_at_ts_bucket_start <= ? GROUP BY fingerprint), D AS (SELECT * FROM signoz_traces.distributed_signoz_index_v3 WHERE resource_fingerprint GLOBAL IN (SELECT fingerprint FROM __resource_filter_D) AND timestamp >= ? AND timestamp < ? AND ts_bucket_start >= ? AND ts_bucket_start <= ?), C_DIR_DESC_D AS (SELECT p.* FROM C AS p INNER JOIN D AS c ON p.trace_id = c.trace_id AND p.span_id = c.parent_span_id), A_DIR_DESC_B_AND_C_DIR_DESC_D AS (SELECT l.* FROM A_DIR_DESC_B AS l INNER JOIN C_DIR_DESC_D AS r ON l.trace_id = r.trace_id) SELECT timestamp, trace_id, span_id, name, duration_nano, parent_span_id, trace_state AS `__SELECT_KEY_3_trace_state`, flags AS `__SELECT_KEY_5_flags`, kind AS `__SELECT_KEY_7_kind`, kind_string AS `__SELECT_KEY_8_kind_string`, status_code AS `__SELECT_KEY_10_status_code`, status_message AS `__SELECT_KEY_11_status_message`, status_code_string AS `__SELECT_KEY_12_status_code_string`, events AS `__SELECT_KEY_13_events`, links AS `__SELECT_KEY_14_links`, response_status_code AS `__SELECT_KEY_15_response_status_code`, external_http_url AS `__SELECT_KEY_16_external_http_url`, http_url AS `__SELECT_KEY_17_http_url`, external_http_method AS `__SELECT_KEY_18_external_http_method`, http_method AS `__SELECT_KEY_19_http_method`, http_host AS `__SELECT_KEY_20_http_host`, db_name AS `__SELECT_KEY_21_db_name`, db_operation AS `__SELECT_KEY_22_db_operation`, has_error AS `__SELECT_KEY_23_has_error`, is_remote AS `__SELECT_KEY_24_is_remote`, attributes_string, attributes_number, attributes_bool, resources_string, attributes FROM A_DIR_DESC_B_AND_C_DIR_DESC_D ORDER BY timestamp DESC LIMIT ? SETTINGS distributed_product_mode='allow', max_memory_usage=10000000000",
+				Query: "WITH toDateTime64(1747947419000000000, 9) AS t_from, toDateTime64(1747983448000000000, 9) AS t_to, 1747945619 AS bucket_from, 1747983448 AS bucket_to, all_spans AS (SELECT *, resource_string_service$$name AS `service.name` FROM signoz_traces.distributed_signoz_index_v3 WHERE timestamp >= ? AND timestamp < ? AND ts_bucket_start >= ? AND ts_bucket_start <= ?), __resource_filter_A AS (SELECT fingerprint FROM signoz_traces.distributed_traces_v3_resource WHERE (simpleJSONExtractString(labels, 'service.name') = ? AND labels LIKE ? AND labels LIKE ?) AND seen_at_ts_bucket_start >= ? AND seen_at_ts_bucket_start <= ? GROUP BY fingerprint), A AS (SELECT * FROM signoz_traces.distributed_signoz_index_v3 WHERE resource_fingerprint GLOBAL IN (SELECT fingerprint FROM __resource_filter_A) AND timestamp >= ? AND timestamp < ? AND ts_bucket_start >= ? AND ts_bucket_start <= ?), __resource_filter_B AS (SELECT fingerprint FROM signoz_traces.distributed_traces_v3_resource WHERE (simpleJSONExtractString(labels, 'service.name') = ? AND labels LIKE ? AND labels LIKE ?) AND seen_at_ts_bucket_start >= ? AND seen_at_ts_bucket_start <= ? GROUP BY fingerprint), B AS (SELECT * FROM signoz_traces.distributed_signoz_index_v3 WHERE resource_fingerprint GLOBAL IN (SELECT fingerprint FROM __resource_filter_B) AND timestamp >= ? AND timestamp < ? AND ts_bucket_start >= ? AND ts_bucket_start <= ?), A_DIR_DESC_B AS (SELECT p.* FROM A AS p INNER JOIN B AS c ON p.trace_id = c.trace_id AND p.span_id = c.parent_span_id), __resource_filter_C AS (SELECT fingerprint FROM signoz_traces.distributed_traces_v3_resource WHERE (simpleJSONExtractString(labels, 'service.name') = ? AND labels LIKE ? AND labels LIKE ?) AND seen_at_ts_bucket_start >= ? AND seen_at_ts_bucket_start <= ? GROUP BY fingerprint), C AS (SELECT * FROM signoz_traces.distributed_signoz_index_v3 WHERE resource_fingerprint GLOBAL IN (SELECT fingerprint FROM __resource_filter_C) AND timestamp >= ? AND timestamp < ? AND ts_bucket_start >= ? AND ts_bucket_start <= ?), __resource_filter_D AS (SELECT fingerprint FROM signoz_traces.distributed_traces_v3_resource WHERE (simpleJSONExtractString(labels, 'service.name') = ? AND labels LIKE ? AND labels LIKE ?) AND seen_at_ts_bucket_start >= ? AND seen_at_ts_bucket_start <= ? GROUP BY fingerprint), D AS (SELECT * FROM signoz_traces.distributed_signoz_index_v3 WHERE resource_fingerprint GLOBAL IN (SELECT fingerprint FROM __resource_filter_D) AND timestamp >= ? AND timestamp < ? AND ts_bucket_start >= ? AND ts_bucket_start <= ?), C_DIR_DESC_D AS (SELECT p.* FROM C AS p INNER JOIN D AS c ON p.trace_id = c.trace_id AND p.span_id = c.parent_span_id), A_DIR_DESC_B_AND_C_DIR_DESC_D AS (SELECT l.* FROM A_DIR_DESC_B AS l INNER JOIN C_DIR_DESC_D AS r ON l.trace_id = r.trace_id) SELECT timestamp, trace_id, span_id, name, duration_nano, parent_span_id, trace_state AS `__SELECT_KEY_3_trace_state`, flags AS `__SELECT_KEY_5_flags`, kind AS `__SELECT_KEY_7_kind`, kind_string AS `__SELECT_KEY_8_kind_string`, status_code AS `__SELECT_KEY_10_status_code`, status_message AS `__SELECT_KEY_11_status_message`, status_code_string AS `__SELECT_KEY_12_status_code_string`, events AS `__SELECT_KEY_13_events`, links AS `__SELECT_KEY_14_links`, response_status_code AS `__SELECT_KEY_15_response_status_code`, external_http_url AS `__SELECT_KEY_16_external_http_url`, http_url AS `__SELECT_KEY_17_http_url`, external_http_method AS `__SELECT_KEY_18_external_http_method`, http_method AS `__SELECT_KEY_19_http_method`, http_host AS `__SELECT_KEY_20_http_host`, db_name AS `__SELECT_KEY_21_db_name`, db_operation AS `__SELECT_KEY_22_db_operation`, has_error AS `__SELECT_KEY_23_has_error`, is_remote AS `__SELECT_KEY_24_is_remote`, attributes_string, attributes_number, attributes_bool, resources_string FROM A_DIR_DESC_B_AND_C_DIR_DESC_D ORDER BY timestamp DESC LIMIT ? SETTINGS distributed_product_mode='allow', max_memory_usage=10000000000",
 				Args:  []any{"1747947419000000000", "1747983448000000000", uint64(1747945619), uint64(1747983448), "frontend", "%service.name%", "%service.name\":\"frontend%", uint64(1747945619), uint64(1747983448), "1747947419000000000", "1747983448000000000", uint64(1747945619), uint64(1747983448), "backend", "%service.name%", "%service.name\":\"backend%", uint64(1747945619), uint64(1747983448), "1747947419000000000", "1747983448000000000", uint64(1747945619), uint64(1747983448), "auth", "%service.name%", "%service.name\":\"auth%", uint64(1747945619), uint64(1747983448), "1747947419000000000", "1747983448000000000", uint64(1747945619), uint64(1747983448), "database", "%service.name%", "%service.name\":\"database%", uint64(1747945619), uint64(1747983448), "1747947419000000000", "1747983448000000000", uint64(1747945619), uint64(1747983448), 5},
 			},
 			expectedErr: nil,
@@ -434,7 +434,7 @@ func TestTraceOperatorStatementBuilder(t *testing.T) {
 				},
 			},
 			expected: qbtypes.Statement{
-				Query: "WITH toDateTime64(1747947419000000000, 9) AS t_from, toDateTime64(1747983448000000000, 9) AS t_to, 1747945619 AS bucket_from, 1747983448 AS bucket_to, all_spans AS (SELECT *, resource_string_service$$name AS `service.name` FROM signoz_traces.distributed_signoz_index_v3 WHERE timestamp >= ? AND timestamp < ? AND ts_bucket_start >= ? AND ts_bucket_start <= ?), __resource_filter_A AS (SELECT fingerprint FROM signoz_traces.distributed_traces_v3_resource WHERE (simpleJSONExtractString(labels, 'service.name') = ? AND labels LIKE ? AND labels LIKE ?) AND seen_at_ts_bucket_start >= ? AND seen_at_ts_bucket_start <= ? GROUP BY fingerprint), A AS (SELECT * FROM signoz_traces.distributed_signoz_index_v3 WHERE resource_fingerprint GLOBAL IN (SELECT fingerprint FROM __resource_filter_A) AND timestamp >= ? AND timestamp < ? AND ts_bucket_start >= ? AND ts_bucket_start <= ?), __resource_filter_B AS (SELECT fingerprint FROM signoz_traces.distributed_traces_v3_resource WHERE (simpleJSONExtractString(labels, 'service.name') = ? AND labels LIKE ? AND labels LIKE ?) AND seen_at_ts_bucket_start >= ? AND seen_at_ts_bucket_start <= ? GROUP BY fingerprint), B AS (SELECT * FROM signoz_traces.distributed_signoz_index_v3 WHERE resource_fingerprint GLOBAL IN (SELECT fingerprint FROM __resource_filter_B) AND timestamp >= ? AND timestamp < ? AND ts_bucket_start >= ? AND ts_bucket_start <= ?), A_INDIR_DESC_B AS (WITH RECURSIVE up AS (SELECT d.trace_id, d.span_id, d.parent_span_id, 0 AS depth FROM B AS d UNION ALL SELECT p.trace_id, p.span_id, p.parent_span_id, up.depth + 1 FROM all_spans AS p JOIN up ON p.trace_id = up.trace_id AND p.span_id = up.parent_span_id WHERE up.depth < 100) SELECT DISTINCT a.* FROM A AS a GLOBAL INNER JOIN (SELECT DISTINCT trace_id, span_id FROM up WHERE depth > 0 ) AS ancestors ON ancestors.trace_id = a.trace_id AND ancestors.span_id = a.span_id), __return_from_B AS (SELECT * FROM B WHERE trace_id IN (SELECT DISTINCT trace_id FROM A_INDIR_DESC_B)) SELECT timestamp, trace_id, span_id, name, duration_nano, parent_span_id, trace_state AS `__SELECT_KEY_3_trace_state`, flags AS `__SELECT_KEY_5_flags`, kind AS `__SELECT_KEY_7_kind`, kind_string AS `__SELECT_KEY_8_kind_string`, status_code AS `__SELECT_KEY_10_status_code`, status_message AS `__SELECT_KEY_11_status_message`, status_code_string AS `__SELECT_KEY_12_status_code_string`, events AS `__SELECT_KEY_13_events`, links AS `__SELECT_KEY_14_links`, response_status_code AS `__SELECT_KEY_15_response_status_code`, external_http_url AS `__SELECT_KEY_16_external_http_url`, http_url AS `__SELECT_KEY_17_http_url`, external_http_method AS `__SELECT_KEY_18_external_http_method`, http_method AS `__SELECT_KEY_19_http_method`, http_host AS `__SELECT_KEY_20_http_host`, db_name AS `__SELECT_KEY_21_db_name`, db_operation AS `__SELECT_KEY_22_db_operation`, has_error AS `__SELECT_KEY_23_has_error`, is_remote AS `__SELECT_KEY_24_is_remote`, attributes_string, attributes_number, attributes_bool, resources_string, attributes FROM __return_from_B ORDER BY timestamp DESC LIMIT ? SETTINGS distributed_product_mode='allow', max_memory_usage=10000000000",
+				Query: "WITH toDateTime64(1747947419000000000, 9) AS t_from, toDateTime64(1747983448000000000, 9) AS t_to, 1747945619 AS bucket_from, 1747983448 AS bucket_to, all_spans AS (SELECT *, resource_string_service$$name AS `service.name` FROM signoz_traces.distributed_signoz_index_v3 WHERE timestamp >= ? AND timestamp < ? AND ts_bucket_start >= ? AND ts_bucket_start <= ?), __resource_filter_A AS (SELECT fingerprint FROM signoz_traces.distributed_traces_v3_resource WHERE (simpleJSONExtractString(labels, 'service.name') = ? AND labels LIKE ? AND labels LIKE ?) AND seen_at_ts_bucket_start >= ? AND seen_at_ts_bucket_start <= ? GROUP BY fingerprint), A AS (SELECT * FROM signoz_traces.distributed_signoz_index_v3 WHERE resource_fingerprint GLOBAL IN (SELECT fingerprint FROM __resource_filter_A) AND timestamp >= ? AND timestamp < ? AND ts_bucket_start >= ? AND ts_bucket_start <= ?), __resource_filter_B AS (SELECT fingerprint FROM signoz_traces.distributed_traces_v3_resource WHERE (simpleJSONExtractString(labels, 'service.name') = ? AND labels LIKE ? AND labels LIKE ?) AND seen_at_ts_bucket_start >= ? AND seen_at_ts_bucket_start <= ? GROUP BY fingerprint), B AS (SELECT * FROM signoz_traces.distributed_signoz_index_v3 WHERE resource_fingerprint GLOBAL IN (SELECT fingerprint FROM __resource_filter_B) AND timestamp >= ? AND timestamp < ? AND ts_bucket_start >= ? AND ts_bucket_start <= ?), A_INDIR_DESC_B AS (WITH RECURSIVE up AS (SELECT d.trace_id, d.span_id, d.parent_span_id, 0 AS depth FROM B AS d UNION ALL SELECT p.trace_id, p.span_id, p.parent_span_id, up.depth + 1 FROM all_spans AS p JOIN up ON p.trace_id = up.trace_id AND p.span_id = up.parent_span_id WHERE up.depth < 100) SELECT DISTINCT a.* FROM A AS a GLOBAL INNER JOIN (SELECT DISTINCT trace_id, span_id FROM up WHERE depth > 0 ) AS ancestors ON ancestors.trace_id = a.trace_id AND ancestors.span_id = a.span_id), __return_from_B AS (SELECT * FROM B WHERE trace_id IN (SELECT DISTINCT trace_id FROM A_INDIR_DESC_B)) SELECT timestamp, trace_id, span_id, name, duration_nano, parent_span_id, trace_state AS `__SELECT_KEY_3_trace_state`, flags AS `__SELECT_KEY_5_flags`, kind AS `__SELECT_KEY_7_kind`, kind_string AS `__SELECT_KEY_8_kind_string`, status_code AS `__SELECT_KEY_10_status_code`, status_message AS `__SELECT_KEY_11_status_message`, status_code_string AS `__SELECT_KEY_12_status_code_string`, events AS `__SELECT_KEY_13_events`, links AS `__SELECT_KEY_14_links`, response_status_code AS `__SELECT_KEY_15_response_status_code`, external_http_url AS `__SELECT_KEY_16_external_http_url`, http_url AS `__SELECT_KEY_17_http_url`, external_http_method AS `__SELECT_KEY_18_external_http_method`, http_method AS `__SELECT_KEY_19_http_method`, http_host AS `__SELECT_KEY_20_http_host`, db_name AS `__SELECT_KEY_21_db_name`, db_operation AS `__SELECT_KEY_22_db_operation`, has_error AS `__SELECT_KEY_23_has_error`, is_remote AS `__SELECT_KEY_24_is_remote`, attributes_string, attributes_number, attributes_bool, resources_string FROM __return_from_B ORDER BY timestamp DESC LIMIT ? SETTINGS distributed_product_mode='allow', max_memory_usage=10000000000",
 				Args:  []any{"1747947419000000000", "1747983448000000000", uint64(1747945619), uint64(1747983448), "gateway", "%service.name%", "%service.name\":\"gateway%", uint64(1747945619), uint64(1747983448), "1747947419000000000", "1747983448000000000", uint64(1747945619), uint64(1747983448), "database", "%service.name%", "%service.name\":\"database%", uint64(1747945619), uint64(1747983448), "1747947419000000000", "1747983448000000000", uint64(1747945619), uint64(1747983448), 10},
 			},
 			expectedErr: nil,
@@ -476,7 +476,7 @@ func TestTraceOperatorStatementBuilder(t *testing.T) {
 				},
 			},
 			expected: qbtypes.Statement{
-				Query: "WITH toDateTime64(1747947419000000000, 9) AS t_from, toDateTime64(1747983448000000000, 9) AS t_to, 1747945619 AS bucket_from, 1747983448 AS bucket_to, all_spans AS (SELECT *, resource_string_service$$name AS `service.name` FROM signoz_traces.distributed_signoz_index_v3 WHERE timestamp >= ? AND timestamp < ? AND ts_bucket_start >= ? AND ts_bucket_start <= ?), __resource_filter_A AS (SELECT fingerprint FROM signoz_traces.distributed_traces_v3_resource WHERE (simpleJSONExtractString(labels, 'service.name') = ? AND labels LIKE ? AND labels LIKE ?) AND seen_at_ts_bucket_start >= ? AND seen_at_ts_bucket_start <= ? GROUP BY fingerprint), A AS (SELECT * FROM signoz_traces.distributed_signoz_index_v3 WHERE resource_fingerprint GLOBAL IN (SELECT fingerprint FROM __resource_filter_A) AND timestamp >= ? AND timestamp < ? AND ts_bucket_start >= ? AND ts_bucket_start <= ?), __resource_filter_B AS (SELECT fingerprint FROM signoz_traces.distributed_traces_v3_resource WHERE (simpleJSONExtractString(labels, 'service.name') = ? AND labels LIKE ? AND labels LIKE ?) AND seen_at_ts_bucket_start >= ? AND seen_at_ts_bucket_start <= ? GROUP BY fingerprint), B AS (SELECT * FROM signoz_traces.distributed_signoz_index_v3 WHERE resource_fingerprint GLOBAL IN (SELECT fingerprint FROM __resource_filter_B) AND timestamp >= ? AND timestamp < ? AND ts_bucket_start >= ? AND ts_bucket_start <= ?), A_INDIR_DESC_B AS (WITH RECURSIVE up AS (SELECT d.trace_id, d.span_id, d.parent_span_id, 0 AS depth FROM B AS d UNION ALL SELECT p.trace_id, p.span_id, p.parent_span_id, up.depth + 1 FROM all_spans AS p JOIN up ON p.trace_id = up.trace_id AND p.span_id = up.parent_span_id WHERE up.depth < 100) SELECT DISTINCT a.* FROM A AS a GLOBAL INNER JOIN (SELECT DISTINCT trace_id, span_id FROM up WHERE depth > 0 ) AS ancestors ON ancestors.trace_id = a.trace_id AND ancestors.span_id = a.span_id), __resource_filter_C AS (SELECT fingerprint FROM signoz_traces.distributed_traces_v3_resource WHERE (simpleJSONExtractString(labels, 'service.name') = ? AND labels LIKE ? AND labels LIKE ?) AND seen_at_ts_bucket_start >= ? AND seen_at_ts_bucket_start <= ? GROUP BY fingerprint), C AS (SELECT * FROM signoz_traces.distributed_signoz_index_v3 WHERE resource_fingerprint GLOBAL IN (SELECT fingerprint FROM __resource_filter_C) AND timestamp >= ? AND timestamp < ? AND ts_bucket_start >= ? AND ts_bucket_start <= ?), A_INDIR_DESC_B_AND_C AS (SELECT l.* FROM A_INDIR_DESC_B AS l INNER JOIN C AS r ON l.trace_id = r.trace_id), __return_from_C AS (SELECT * FROM C WHERE trace_id IN (SELECT DISTINCT trace_id FROM A_INDIR_DESC_B_AND_C)) SELECT timestamp, trace_id, span_id, name, duration_nano, parent_span_id, trace_state AS `__SELECT_KEY_3_trace_state`, flags AS `__SELECT_KEY_5_flags`, kind AS `__SELECT_KEY_7_kind`, kind_string AS `__SELECT_KEY_8_kind_string`, status_code AS `__SELECT_KEY_10_status_code`, status_message AS `__SELECT_KEY_11_status_message`, status_code_string AS `__SELECT_KEY_12_status_code_string`, events AS `__SELECT_KEY_13_events`, links AS `__SELECT_KEY_14_links`, response_status_code AS `__SELECT_KEY_15_response_status_code`, external_http_url AS `__SELECT_KEY_16_external_http_url`, http_url AS `__SELECT_KEY_17_http_url`, external_http_method AS `__SELECT_KEY_18_external_http_method`, http_method AS `__SELECT_KEY_19_http_method`, http_host AS `__SELECT_KEY_20_http_host`, db_name AS `__SELECT_KEY_21_db_name`, db_operation AS `__SELECT_KEY_22_db_operation`, has_error AS `__SELECT_KEY_23_has_error`, is_remote AS `__SELECT_KEY_24_is_remote`, attributes_string, attributes_number, attributes_bool, resources_string, attributes FROM __return_from_C ORDER BY timestamp DESC LIMIT ? SETTINGS distributed_product_mode='allow', max_memory_usage=10000000000",
+				Query: "WITH toDateTime64(1747947419000000000, 9) AS t_from, toDateTime64(1747983448000000000, 9) AS t_to, 1747945619 AS bucket_from, 1747983448 AS bucket_to, all_spans AS (SELECT *, resource_string_service$$name AS `service.name` FROM signoz_traces.distributed_signoz_index_v3 WHERE timestamp >= ? AND timestamp < ? AND ts_bucket_start >= ? AND ts_bucket_start <= ?), __resource_filter_A AS (SELECT fingerprint FROM signoz_traces.distributed_traces_v3_resource WHERE (simpleJSONExtractString(labels, 'service.name') = ? AND labels LIKE ? AND labels LIKE ?) AND seen_at_ts_bucket_start >= ? AND seen_at_ts_bucket_start <= ? GROUP BY fingerprint), A AS (SELECT * FROM signoz_traces.distributed_signoz_index_v3 WHERE resource_fingerprint GLOBAL IN (SELECT fingerprint FROM __resource_filter_A) AND timestamp >= ? AND timestamp < ? AND ts_bucket_start >= ? AND ts_bucket_start <= ?), __resource_filter_B AS (SELECT fingerprint FROM signoz_traces.distributed_traces_v3_resource WHERE (simpleJSONExtractString(labels, 'service.name') = ? AND labels LIKE ? AND labels LIKE ?) AND seen_at_ts_bucket_start >= ? AND seen_at_ts_bucket_start <= ? GROUP BY fingerprint), B AS (SELECT * FROM signoz_traces.distributed_signoz_index_v3 WHERE resource_fingerprint GLOBAL IN (SELECT fingerprint FROM __resource_filter_B) AND timestamp >= ? AND timestamp < ? AND ts_bucket_start >= ? AND ts_bucket_start <= ?), A_INDIR_DESC_B AS (WITH RECURSIVE up AS (SELECT d.trace_id, d.span_id, d.parent_span_id, 0 AS depth FROM B AS d UNION ALL SELECT p.trace_id, p.span_id, p.parent_span_id, up.depth + 1 FROM all_spans AS p JOIN up ON p.trace_id = up.trace_id AND p.span_id = up.parent_span_id WHERE up.depth < 100) SELECT DISTINCT a.* FROM A AS a GLOBAL INNER JOIN (SELECT DISTINCT trace_id, span_id FROM up WHERE depth > 0 ) AS ancestors ON ancestors.trace_id = a.trace_id AND ancestors.span_id = a.span_id), __resource_filter_C AS (SELECT fingerprint FROM signoz_traces.distributed_traces_v3_resource WHERE (simpleJSONExtractString(labels, 'service.name') = ? AND labels LIKE ? AND labels LIKE ?) AND seen_at_ts_bucket_start >= ? AND seen_at_ts_bucket_start <= ? GROUP BY fingerprint), C AS (SELECT * FROM signoz_traces.distributed_signoz_index_v3 WHERE resource_fingerprint GLOBAL IN (SELECT fingerprint FROM __resource_filter_C) AND timestamp >= ? AND timestamp < ? AND ts_bucket_start >= ? AND ts_bucket_start <= ?), A_INDIR_DESC_B_AND_C AS (SELECT l.* FROM A_INDIR_DESC_B AS l INNER JOIN C AS r ON l.trace_id = r.trace_id), __return_from_C AS (SELECT * FROM C WHERE trace_id IN (SELECT DISTINCT trace_id FROM A_INDIR_DESC_B_AND_C)) SELECT timestamp, trace_id, span_id, name, duration_nano, parent_span_id, trace_state AS `__SELECT_KEY_3_trace_state`, flags AS `__SELECT_KEY_5_flags`, kind AS `__SELECT_KEY_7_kind`, kind_string AS `__SELECT_KEY_8_kind_string`, status_code AS `__SELECT_KEY_10_status_code`, status_message AS `__SELECT_KEY_11_status_message`, status_code_string AS `__SELECT_KEY_12_status_code_string`, events AS `__SELECT_KEY_13_events`, links AS `__SELECT_KEY_14_links`, response_status_code AS `__SELECT_KEY_15_response_status_code`, external_http_url AS `__SELECT_KEY_16_external_http_url`, http_url AS `__SELECT_KEY_17_http_url`, external_http_method AS `__SELECT_KEY_18_external_http_method`, http_method AS `__SELECT_KEY_19_http_method`, http_host AS `__SELECT_KEY_20_http_host`, db_name AS `__SELECT_KEY_21_db_name`, db_operation AS `__SELECT_KEY_22_db_operation`, has_error AS `__SELECT_KEY_23_has_error`, is_remote AS `__SELECT_KEY_24_is_remote`, attributes_string, attributes_number, attributes_bool, resources_string FROM __return_from_C ORDER BY timestamp DESC LIMIT ? SETTINGS distributed_product_mode='allow', max_memory_usage=10000000000",
 				Args:  []any{"1747947419000000000", "1747983448000000000", uint64(1747945619), uint64(1747983448), "gateway", "%service.name%", "%service.name\":\"gateway%", uint64(1747945619), uint64(1747983448), "1747947419000000000", "1747983448000000000", uint64(1747945619), uint64(1747983448), "database", "%service.name%", "%service.name\":\"database%", uint64(1747945619), uint64(1747983448), "1747947419000000000", "1747983448000000000", uint64(1747945619), uint64(1747983448), "auth", "%service.name%", "%service.name\":\"auth%", uint64(1747945619), uint64(1747983448), "1747947419000000000", "1747983448000000000", uint64(1747945619), uint64(1747983448), 10},
 			},
 			expectedErr: nil,

pkg/telemetryschema/tracestelemetryschema/const.go

@@ -447,14 +447,14 @@ var (
 		{Name: SpanIsRemoteColumn, FieldContext: telemetrytypes.FieldContextSpan},
 	}
 
-	// ContextualSpanColumns lists the bag columns selected raw so consume.go can merge
-	// them into unified "attributes" and "resource" maps, legacy maps winning on collision.
+	// ContextualSpanColumns lists the typed attribute and resource columns
+	// selected raw (rather than via ColumnExpressionFor) so that consume.go
+	// can merge them into unified "attributes" and "resource" maps.
 	ContextualSpanColumns = []string{
 		SpanAttributesStringColumn,
 		SpanAttributesNumberColumn,
 		SpanAttributesBoolColumn,
 		SpanResourcesStringColumn,
-		SpanAttributesColumn,
 	}
 
 	DefaultFields = map[string]telemetrytypes.TelemetryFieldKey{

pkg/types/spantypes/mapper.go

@@ -1,6 +1,8 @@
 package spantypes
 
 import (
+	"slices"
+	"strings"
 	"time"
 
 	"github.com/SigNoz/signoz/pkg/errors"
@@ -11,6 +13,7 @@ import (
 var (
 	ErrCodeMapperNotFound      = errors.MustNewCode("span_attribute_mapper_not_found")
 	ErrCodeMapperAlreadyExists = errors.MustNewCode("span_attribute_mapper_already_exists")
+	ErrCodeMapperNotDeletable  = errors.MustNewCode("span_attribute_mapper_not_deletable")
 	ErrCodeMappingInvalidInput = errors.MustNewCode("span_attribute_mapping_invalid_input")
 )
 
@@ -34,12 +37,25 @@ var (
 	SpanMapperOperationCopy = SpanMapperOperation{valuer.NewString("copy")}
 )
 
+// SpanMapperOrigin tells shipped (system) items apart from user-created ones.
+// System items are read-only apart from their enabled toggle.
+type SpanMapperOrigin struct {
+	valuer.String
+}
+
+var (
+	SpanMapperOriginUser   = SpanMapperOrigin{valuer.NewString("user")}
+	SpanMapperOriginSystem = SpanMapperOrigin{valuer.NewString("system")}
+)
+
 // MapperSource describes one candidate source for a target attribute.
 type SpanMapperSource struct {
 	Key       string              `json:"key" required:"true"`
 	Context   FieldContext        `json:"context" required:"true"`
 	Operation SpanMapperOperation `json:"operation" required:"true"`
 	Priority  int                 `json:"priority" required:"true"`
+	Enabled   bool                `json:"enabled" required:"true"`
+	Origin    SpanMapperOrigin    `json:"origin"`
 }
 
 // MapperConfig holds the mapping logic for a single target attribute.
@@ -59,6 +75,7 @@ type SpanMapper struct {
 	FieldContext FieldContext     `json:"fieldContext"  required:"true"`
 	Config       SpanMapperConfig `json:"config"        required:"true"`
 	Enabled      bool             `json:"enabled"       required:"true"`
+	Origin       SpanMapperOrigin `json:"origin"        required:"true"`
 }
 
 type PostableSpanMapper struct {
@@ -90,6 +107,63 @@ func (SpanMapperOperation) Enum() []any {
 	return []any{SpanMapperOperationMove, SpanMapperOperationCopy}
 }
 
+func (SpanMapperOrigin) Enum() []any {
+	return []any{SpanMapperOriginUser, SpanMapperOriginSystem}
+}
+
+func (p *PostableSpanMapper) Validate() error {
+	if strings.TrimSpace(p.Name) == "" {
+		return errors.New(errors.TypeInvalidInput, ErrCodeMappingInvalidInput, "mapper name must not be blank")
+	}
+	if err := p.FieldContext.Validate(); err != nil {
+		return err
+	}
+	return p.Config.Validate()
+}
+
+func (f FieldContext) Validate() error {
+	if f != FieldContextSpanAttribute && f != FieldContextResource {
+		return errors.Newf(errors.TypeInvalidInput, ErrCodeMappingInvalidInput, "field context must be one of %q or %q, got %q", FieldContextSpanAttribute, FieldContextResource, f.StringValue())
+	}
+	return nil
+}
+
+// Validate checks every source and rejects duplicate priorities within an
+// origin. Shipped and user sources are never compared with each other: a user
+// re-adding a shipped key with another operation is the supported override.
+func (c *SpanMapperConfig) Validate() error {
+	if len(c.Sources) == 0 {
+		return errors.New(errors.TypeInvalidInput, ErrCodeMappingInvalidInput, "config.sources must contain at least one source")
+	}
+	seen := map[SpanMapperOrigin]map[int]struct{}{}
+	for _, s := range c.Sources {
+		if strings.TrimSpace(s.Key) == "" {
+			return errors.New(errors.TypeInvalidInput, ErrCodeMappingInvalidInput, "source key must not be blank")
+		}
+		if err := s.Context.Validate(); err != nil {
+			return err
+		}
+		if s.Operation != SpanMapperOperationCopy && s.Operation != SpanMapperOperationMove {
+			return errors.Newf(errors.TypeInvalidInput, ErrCodeMappingInvalidInput, "source operation must be one of %q or %q, got %q", SpanMapperOperationCopy, SpanMapperOperationMove, s.Operation.StringValue())
+		}
+		if !s.Origin.IsZero() && s.Origin != SpanMapperOriginUser && s.Origin != SpanMapperOriginSystem {
+			return errors.Newf(errors.TypeInvalidInput, ErrCodeMappingInvalidInput, "source origin must be one of %q or %q, got %q", SpanMapperOriginUser, SpanMapperOriginSystem, s.Origin.StringValue())
+		}
+		origin := s.Origin
+		if origin.IsZero() {
+			origin = SpanMapperOriginUser
+		}
+		if seen[origin] == nil {
+			seen[origin] = map[int]struct{}{}
+		}
+		if _, dup := seen[origin][s.Priority]; dup {
+			return errors.Newf(errors.TypeInvalidInput, ErrCodeMappingInvalidInput, "source priority %d is used more than once", s.Priority)
+		}
+		seen[origin][s.Priority] = struct{}{}
+	}
+	return nil
+}
+
 func NewSpanMapper(groupID valuer.UUID, createdBy string, p *PostableSpanMapper) *SpanMapper {
 	now := time.Now()
 	return &SpanMapper{
@@ -97,8 +171,9 @@ func NewSpanMapper(groupID valuer.UUID, createdBy string, p *PostableSpanMapper)
 		GroupID:      groupID,
 		Name:         p.Name,
 		FieldContext: p.FieldContext,
-		Config:       p.Config,
+		Config:       SpanMapperConfig{Sources: withOrigin(p.Config.Sources, SpanMapperOriginUser)},
 		Enabled:      p.Enabled,
+		Origin:       SpanMapperOriginUser,
 		TimeAuditable: types.TimeAuditable{
 			CreatedAt: now,
 			UpdatedAt: now,
@@ -110,16 +185,42 @@ func NewSpanMapper(groupID valuer.UUID, createdBy string, p *PostableSpanMapper)
 	}
 }
 
-func (m *SpanMapper) Update(fieldContext FieldContext, config *SpanMapperConfig, enabled *bool, updatedBy string) {
-	m.FieldContext = fieldContext
+// Update applies a user edit; a zero fieldContext means it was omitted. On a
+// system mapper the field context is fixed and the stored system sources are
+// kept; see nextSources.
+func (m *SpanMapper) Update(fieldContext FieldContext, config *SpanMapperConfig, enabled *bool, updatedBy string) error {
+	if !fieldContext.IsZero() {
+		if m.Origin == SpanMapperOriginSystem && fieldContext != m.FieldContext {
+			return errors.Newf(errors.TypeInvalidInput, ErrCodeMappingInvalidInput, "field context of system mapper %q cannot be changed", m.Name)
+		}
+		if err := fieldContext.Validate(); err != nil {
+			return err
+		}
+		m.FieldContext = fieldContext
+	}
 	if config != nil {
-		m.Config = *config
+		sources, err := m.nextSources(config.Sources)
+		if err != nil {
+			return err
+		}
+		m.Config = SpanMapperConfig{Sources: sources}
+		if err := m.Config.Validate(); err != nil {
+			return err
+		}
 	}
 	if enabled != nil {
 		m.Enabled = *enabled
 	}
 	m.UpdatedAt = time.Now()
 	m.UpdatedBy = updatedBy
+	return nil
+}
+
+func (m *SpanMapper) ErrIfNotDeletable() error {
+	if m.Origin == SpanMapperOriginSystem {
+		return errors.Newf(errors.TypeInvalidInput, ErrCodeMapperNotDeletable, "system mapper %q cannot be deleted, disable it instead", m.Name)
+	}
+	return nil
 }
 
 func (m *SpanMapper) ToStorable() *StorableSpanMapper {
@@ -132,6 +233,7 @@ func (m *SpanMapper) ToStorable() *StorableSpanMapper {
 		FieldContext:  m.FieldContext,
 		Config:        m.Config,
 		Enabled:       m.Enabled,
+		Origin:        m.Origin,
 	}
 }
 
@@ -145,6 +247,7 @@ func (s *StorableSpanMapper) ToSpanMapper() *SpanMapper {
 		FieldContext:  s.FieldContext,
 		Config:        s.Config,
 		Enabled:       s.Enabled,
+		Origin:        s.Origin,
 	}
 }
 
@@ -159,3 +262,39 @@ func NewSpanMappersFromStorable(ss []*StorableSpanMapper) []*SpanMapper {
 func NewGettableSpanMappers(m []*SpanMapper) *GettableSpanMappers {
 	return &GettableSpanMappers{Items: m}
 }
+
+// nextSources builds the source list from an edit: user sources are taken from
+// the edit as sent, system sources stay as stored and the edit can only flip
+// their enabled flag.
+func (m *SpanMapper) nextSources(edit []SpanMapperSource) ([]SpanMapperSource, error) {
+	var systemSources, userSources []SpanMapperSource
+	for _, s := range m.Config.Sources {
+		if s.Origin == SpanMapperOriginSystem {
+			systemSources = append(systemSources, s)
+		}
+	}
+
+	for _, s := range edit {
+		if s.Origin != SpanMapperOriginSystem {
+			s.Origin = SpanMapperOriginUser
+			userSources = append(userSources, s)
+			continue
+		}
+		idx := slices.IndexFunc(systemSources, func(o SpanMapperSource) bool { return o.Key == s.Key && o.Context == s.Context })
+		if idx == -1 {
+			return nil, errors.Newf(errors.TypeInvalidInput, ErrCodeMappingInvalidInput, "system source %q does not exist on this mapper; only its enabled flag can change", s.Key)
+		}
+		systemSources[idx].Enabled = s.Enabled
+	}
+
+	return append(systemSources, userSources...), nil
+}
+
+func withOrigin(sources []SpanMapperSource, origin SpanMapperOrigin) []SpanMapperSource {
+	out := make([]SpanMapperSource, len(sources))
+	for i, s := range sources {
+		s.Origin = origin
+		out[i] = s
+	}
+	return out
+}

pkg/types/spantypes/mappergroup.go

@@ -1,6 +1,8 @@
 package spantypes
 
 import (
+	"slices"
+	"strings"
 	"time"
 
 	"github.com/SigNoz/signoz/pkg/errors"
@@ -11,17 +13,28 @@ import (
 var (
 	ErrCodeMappingGroupNotFound      = errors.MustNewCode("span_attribute_mapping_group_not_found")
 	ErrCodeMappingGroupAlreadyExists = errors.MustNewCode("span_attribute_mapping_group_already_exists")
+	ErrCodeMappingGroupNameReserved  = errors.MustNewCode("span_attribute_mapping_group_name_reserved")
+	ErrCodeMappingGroupNotDeletable  = errors.MustNewCode("span_attribute_mapping_group_not_deletable")
 )
 
+// SpanMapperGroupConditionKey is one substring a span's attribute or resource
+// keys are matched against.
+type SpanMapperGroupConditionKey struct {
+	Value   string           `json:"value" required:"true"`
+	Enabled bool             `json:"enabled" required:"true"`
+	Origin  SpanMapperOrigin `json:"origin"`
+}
+
 // SpanMapperGroupCondition gates whether a group's rules run for a given span.
 // A group runs when any attribute or resource key on the span CONTAINS one of
 // the listed substrings (plain substring match — no glob syntax).
 type SpanMapperGroupCondition struct {
-	Attributes []string `json:"attributes" required:"true" nullable:"true"`
-	Resource   []string `json:"resource" required:"true" nullable:"true"`
+	Attributes []SpanMapperGroupConditionKey `json:"attributes" required:"true" nullable:"true"`
+	Resource   []SpanMapperGroupConditionKey `json:"resource" required:"true" nullable:"true"`
 }
 
 // SpanMapperGroup is the domain model for a span attribute mapping group.
+// Version is the shipped definition version for system groups and 0 otherwise.
 type SpanMapperGroup struct {
 	types.TimeAuditable
 	types.UserAuditable
@@ -31,6 +44,8 @@ type SpanMapperGroup struct {
 	Name      string                   `json:"name" required:"true"`
 	Condition SpanMapperGroupCondition `json:"condition" required:"true"`
 	Enabled   bool                     `json:"enabled" required:"true"`
+	Origin    SpanMapperOrigin         `json:"origin" required:"true"`
+	Version   int                      `json:"version" required:"true"`
 }
 
 // GettableSpanMapperGroup is the HTTP response representation of a mapping group.
@@ -58,14 +73,42 @@ type GettableSpanMapperGroups struct {
 	Items []*GettableSpanMapperGroup `json:"items" required:"true" nullable:"false"`
 }
 
+// Validate requires at least one substring overall and rejects blank ones.
+// All-off is allowed: a group with every substring disabled simply never runs.
+func (c *SpanMapperGroupCondition) Validate() error {
+	if len(c.Attributes)+len(c.Resource) == 0 {
+		return errors.New(errors.TypeInvalidInput, ErrCodeMappingInvalidInput, "condition must list at least one attribute or resource substring")
+	}
+	for _, k := range slices.Concat(c.Attributes, c.Resource) {
+		if strings.TrimSpace(k.Value) == "" {
+			return errors.New(errors.TypeInvalidInput, ErrCodeMappingInvalidInput, "condition substrings must not be blank")
+		}
+		if !k.Origin.IsZero() && k.Origin != SpanMapperOriginUser && k.Origin != SpanMapperOriginSystem {
+			return errors.Newf(errors.TypeInvalidInput, ErrCodeMappingInvalidInput, "condition origin must be one of %q or %q, got %q", SpanMapperOriginUser, SpanMapperOriginSystem, k.Origin.StringValue())
+		}
+	}
+	return nil
+}
+
+func (p *PostableSpanMapperGroup) Validate() error {
+	if strings.TrimSpace(p.Name) == "" {
+		return errors.New(errors.TypeInvalidInput, ErrCodeMappingInvalidInput, "group name must not be blank")
+	}
+	return p.Condition.Validate()
+}
+
 func NewSpanMapperGroup(orgID valuer.UUID, createdBy string, p *PostableSpanMapperGroup) *SpanMapperGroup {
 	now := time.Now()
 	return &SpanMapperGroup{
-		ID:        valuer.GenerateUUID(),
-		OrgID:     orgID,
-		Name:      p.Name,
-		Condition: p.Condition,
-		Enabled:   p.Enabled,
+		ID:    valuer.GenerateUUID(),
+		OrgID: orgID,
+		Name:  p.Name,
+		Condition: SpanMapperGroupCondition{
+			Attributes: conditionKeysWithOrigin(p.Condition.Attributes, SpanMapperOriginUser),
+			Resource:   conditionKeysWithOrigin(p.Condition.Resource, SpanMapperOriginUser),
+		},
+		Enabled: p.Enabled,
+		Origin:  SpanMapperOriginUser,
 		TimeAuditable: types.TimeAuditable{
 			CreatedAt: now,
 			UpdatedAt: now,
@@ -77,18 +120,45 @@ func NewSpanMapperGroup(orgID valuer.UUID, createdBy string, p *PostableSpanMapp
 	}
 }
 
-func (g *SpanMapperGroup) Update(name *string, condition *SpanMapperGroupCondition, enabled *bool, updatedBy string) {
+// Update applies a user edit. A system group keeps its name and its system
+// substrings; see nextConditionKeys.
+func (g *SpanMapperGroup) Update(name *string, condition *SpanMapperGroupCondition, enabled *bool, updatedBy string) error {
 	if name != nil {
+		if g.Origin == SpanMapperOriginSystem && *name != g.Name {
+			return errors.Newf(errors.TypeInvalidInput, ErrCodeMappingInvalidInput, "system group %q cannot be renamed", g.Name)
+		}
+		if strings.TrimSpace(*name) == "" {
+			return errors.New(errors.TypeInvalidInput, ErrCodeMappingInvalidInput, "group name must not be blank")
+		}
 		g.Name = *name
 	}
 	if condition != nil {
-		g.Condition = *condition
+		attrs, err := nextConditionKeys(g.Condition.Attributes, condition.Attributes)
+		if err != nil {
+			return err
+		}
+		res, err := nextConditionKeys(g.Condition.Resource, condition.Resource)
+		if err != nil {
+			return err
+		}
+		g.Condition = SpanMapperGroupCondition{Attributes: attrs, Resource: res}
+		if err := g.Condition.Validate(); err != nil {
+			return err
+		}
 	}
 	if enabled != nil {
 		g.Enabled = *enabled
 	}
 	g.UpdatedAt = time.Now()
 	g.UpdatedBy = updatedBy
+	return nil
+}
+
+func (g *SpanMapperGroup) ErrIfNotDeletable() error {
+	if g.Origin == SpanMapperOriginSystem {
+		return errors.Newf(errors.TypeInvalidInput, ErrCodeMappingGroupNotDeletable, "system group %q cannot be deleted, disable it instead", g.Name)
+	}
+	return nil
 }
 
 func (g *SpanMapperGroup) ToStorable() *StorableSpanMapperGroup {
@@ -100,6 +170,8 @@ func (g *SpanMapperGroup) ToStorable() *StorableSpanMapperGroup {
 		Name:          g.Name,
 		Condition:     g.Condition,
 		Enabled:       g.Enabled,
+		Origin:        g.Origin,
+		Version:       g.Version,
 	}
 }
 
@@ -112,6 +184,8 @@ func (s *StorableSpanMapperGroup) ToSpanMapperGroup() *SpanMapperGroup {
 		Name:          s.Name,
 		Condition:     s.Condition,
 		Enabled:       s.Enabled,
+		Origin:        s.Origin,
+		Version:       s.Version,
 	}
 }
 
@@ -126,3 +200,39 @@ func NewSpanMapperGroupsFromStorable(ss []*StorableSpanMapperGroup) []*SpanMappe
 func NewGettableSpanMapperGroups(g []*SpanMapperGroup) *GettableSpanMapperGroups {
 	return &GettableSpanMapperGroups{Items: g}
 }
+
+// nextConditionKeys builds a substring list from an edit: user substrings are
+// taken from the edit as sent, system substrings stay as stored and the edit
+// can only flip their enabled flag.
+func nextConditionKeys(stored, edit []SpanMapperGroupConditionKey) ([]SpanMapperGroupConditionKey, error) {
+	var systemKeys, userKeys []SpanMapperGroupConditionKey
+	for _, k := range stored {
+		if k.Origin == SpanMapperOriginSystem {
+			systemKeys = append(systemKeys, k)
+		}
+	}
+
+	for _, k := range edit {
+		if k.Origin != SpanMapperOriginSystem {
+			k.Origin = SpanMapperOriginUser
+			userKeys = append(userKeys, k)
+			continue
+		}
+		idx := slices.IndexFunc(systemKeys, func(s SpanMapperGroupConditionKey) bool { return s.Value == k.Value })
+		if idx == -1 {
+			return nil, errors.Newf(errors.TypeInvalidInput, ErrCodeMappingInvalidInput, "system substring %q does not exist on this group; only its enabled flag can change", k.Value)
+		}
+		systemKeys[idx].Enabled = k.Enabled
+	}
+
+	return append(systemKeys, userKeys...), nil
+}
+
+func conditionKeysWithOrigin(keys []SpanMapperGroupConditionKey, origin SpanMapperOrigin) []SpanMapperGroupConditionKey {
+	out := make([]SpanMapperGroupConditionKey, len(keys))
+	for i, k := range keys {
+		k.Origin = origin
+		out[i] = k
+	}
+	return out
+}

pkg/types/spantypes/spanmapperdefinition.go

@@ -0,0 +1,121 @@
+package spantypes
+
+import (
+	"bytes"
+	"encoding/json"
+	"slices"
+	"strings"
+
+	"github.com/SigNoz/signoz/pkg/errors"
+)
+
+var ErrCodeMappingDefinitionInvalid = errors.MustNewCode("span_attribute_mapping_definition_invalid")
+
+// ProvisionerIdentity is stamped into created_by/updated_by by the reconciler.
+const ProvisionerIdentity = "signoz"
+
+// SpanMapperGroupDefinition is one shipped mapping group. Version is bumped on
+// every content change and drives upgrades; the group name is the stable key
+// and never changes. Once parsed, every substring and source carries the
+// system origin and is enabled.
+type SpanMapperGroupDefinition struct {
+	Version    int                         `json:"version"`
+	Definition PostableSpanMapperTestGroup `json:"definition"`
+}
+
+func (d SpanMapperGroupDefinition) Name() string {
+	return d.Definition.Name
+}
+
+func NewSpanMapperGroupDefinition(raw []byte) (SpanMapperGroupDefinition, error) {
+	decoder := json.NewDecoder(bytes.NewReader(raw))
+	decoder.DisallowUnknownFields()
+
+	var d SpanMapperGroupDefinition
+	if err := decoder.Decode(&d); err != nil {
+		return SpanMapperGroupDefinition{}, errors.WrapInvalidInputf(err, ErrCodeMappingDefinitionInvalid, "%s", err.Error())
+	}
+	if err := d.validate(); err != nil {
+		return SpanMapperGroupDefinition{}, err
+	}
+
+	for _, keys := range [][]SpanMapperGroupConditionKey{d.Definition.Condition.Attributes, d.Definition.Condition.Resource} {
+		for i := range keys {
+			keys[i].Enabled = true
+			keys[i].Origin = SpanMapperOriginSystem
+		}
+	}
+	for i := range d.Definition.Mappers {
+		sources := d.Definition.Mappers[i].Config.Sources
+		for j := range sources {
+			sources[j].Enabled = true
+			sources[j].Origin = SpanMapperOriginSystem
+		}
+	}
+	return d, nil
+}
+
+// SpanMapperGroupRegistry holds every definition embedded in the binary, keyed by name.
+type SpanMapperGroupRegistry struct {
+	definitions map[string]SpanMapperGroupDefinition
+}
+
+func NewSpanMapperGroupRegistry(definitions []SpanMapperGroupDefinition) (SpanMapperGroupRegistry, error) {
+	byName := make(map[string]SpanMapperGroupDefinition, len(definitions))
+	for _, d := range definitions {
+		if _, dup := byName[d.Name()]; dup {
+			return SpanMapperGroupRegistry{}, errors.NewInvalidInputf(ErrCodeMappingDefinitionInvalid, "duplicate span mapper group name %q", d.Name())
+		}
+		byName[d.Name()] = d
+	}
+	return SpanMapperGroupRegistry{definitions: byName}, nil
+}
+
+func (r SpanMapperGroupRegistry) IsReserved(name string) bool {
+	_, ok := r.definitions[name]
+	return ok
+}
+
+// List returns the definitions sorted by name so provisioning order is stable.
+func (r SpanMapperGroupRegistry) List() []SpanMapperGroupDefinition {
+	out := make([]SpanMapperGroupDefinition, 0, len(r.definitions))
+	for _, d := range r.definitions {
+		out = append(out, d)
+	}
+	slices.SortFunc(out, func(a, b SpanMapperGroupDefinition) int { return strings.Compare(a.Name(), b.Name()) })
+	return out
+}
+
+func (d SpanMapperGroupDefinition) validate() error {
+	if d.Version < 1 {
+		return errors.NewInvalidInputf(ErrCodeMappingDefinitionInvalid, "version must be at least 1, got %d", d.Version)
+	}
+	if err := d.Definition.Validate(); err != nil {
+		return errors.Wrapf(err, errors.TypeInvalidInput, ErrCodeMappingDefinitionInvalid, "%s", d.Name())
+	}
+	if len(d.Definition.Mappers) == 0 {
+		return errors.NewInvalidInputf(ErrCodeMappingDefinitionInvalid, "%s: at least one mapper is required", d.Name())
+	}
+	names := make(map[string]struct{}, len(d.Definition.Mappers))
+	for i := range d.Definition.Mappers {
+		m := &d.Definition.Mappers[i]
+		if err := m.Validate(); err != nil {
+			return errors.Wrapf(err, errors.TypeInvalidInput, ErrCodeMappingDefinitionInvalid, "%s: mapper %q", d.Name(), m.Name)
+		}
+		if _, dup := names[m.Name]; dup {
+			return errors.NewInvalidInputf(ErrCodeMappingDefinitionInvalid, "%s: duplicate mapper %q", d.Name(), m.Name)
+		}
+		names[m.Name] = struct{}{}
+		for _, s := range m.Config.Sources {
+			if !s.Origin.IsZero() || s.Enabled {
+				return errors.NewInvalidInputf(ErrCodeMappingDefinitionInvalid, "%s: mapper %q: sources must not set origin or enabled", d.Name(), m.Name)
+			}
+		}
+	}
+	for _, k := range slices.Concat(d.Definition.Condition.Attributes, d.Definition.Condition.Resource) {
+		if !k.Origin.IsZero() || k.Enabled {
+			return errors.NewInvalidInputf(ErrCodeMappingDefinitionInvalid, "%s: condition substrings must not set origin or enabled", d.Name())
+		}
+	}
+	return nil
+}

pkg/types/spantypes/spanmapperprocessor.go

@@ -86,17 +86,31 @@ func buildProcessorConfig(groups []*SpanMapperGroupWithMappers) *spanMapperProce
 	out := make([]spanMapperProcessorGroup, 0, len(groups))
 
 	for _, gm := range groups {
+		existsAny := spanMapperProcessorExistsAny{
+			Attributes: enabledConditionValues(gm.Group.Condition.Attributes),
+			Resource:   enabledConditionValues(gm.Group.Condition.Resource),
+		}
+		// The collector rejects an empty exists_any and empty sources; with
+		// per-item toggles, all-off is valid stored state and means "never runs".
+		if len(existsAny.Attributes)+len(existsAny.Resource) == 0 {
+			continue
+		}
+
 		rules := make([]spanMapperProcessorAttribute, 0, len(gm.Mappers))
 		for _, m := range gm.Mappers {
-			rules = append(rules, buildAttributeRule(m))
+			rule := buildAttributeRule(m)
+			if len(rule.Sources) == 0 {
+				continue
+			}
+			rules = append(rules, rule)
+		}
+		if len(rules) == 0 {
+			continue
 		}
 
 		out = append(out, spanMapperProcessorGroup{
-			ID: gm.Group.Name,
-			ExistsAny: spanMapperProcessorExistsAny{
-				Attributes: gm.Group.Condition.Attributes,
-				Resource:   gm.Group.Condition.Resource,
-			},
+			ID:         gm.Group.Name,
+			ExistsAny:  existsAny,
 			Attributes: rules,
 		})
 	}
@@ -104,14 +118,31 @@ func buildProcessorConfig(groups []*SpanMapperGroupWithMappers) *spanMapperProce
 	return &spanMapperProcessorConfig{Groups: out}
 }
 
+func enabledConditionValues(keys []SpanMapperGroupConditionKey) []string {
+	out := make([]string, 0, len(keys))
+	for _, k := range keys {
+		if k.Enabled {
+			out = append(out, k.Value)
+		}
+	}
+	if len(out) == 0 {
+		return nil
+	}
+	return out
+}
+
 // buildAttributeRule maps a single SpanMapper to a collector attribute rule.
-// Sources are sorted by Priority DESC (highest-priority first); read-from-
-// resource sources are encoded via the "resource." prefix on the key. Each
-// source carries its own action — "copy" is omitted to keep the emitted YAML
-// compact, and only "move" is set explicitly.
+// Disabled sources are skipped and the rest are sorted by Priority DESC
+// (highest-priority first); read-from-resource sources are encoded via the
+// "resource." prefix on the key. Each source carries its own action — "copy"
+// is omitted to keep the emitted YAML compact, and only "move" is set explicitly.
 func buildAttributeRule(m *SpanMapper) spanMapperProcessorAttribute {
-	sources := make([]SpanMapperSource, len(m.Config.Sources))
-	copy(sources, m.Config.Sources)
+	sources := make([]SpanMapperSource, 0, len(m.Config.Sources))
+	for _, s := range m.Config.Sources {
+		if s.Enabled {
+			sources = append(sources, s)
+		}
+	}
 	sort.SliceStable(sources, func(i, j int) bool { return sources[i].Priority > sources[j].Priority })
 
 	out := make([]spanMapperProcessorSource, 0, len(sources))

pkg/types/spantypes/spanmapperprocessor_test.go

@@ -145,6 +145,22 @@ func TestBuildAttributeRule(t *testing.T) {
 				},
 			},
 		},
+		{
+			name: "disabled_sources_skipped",
+			mapper: newMapper("gen_ai.input.messages", FieldContextSpanAttribute,
+				systemSrc("gen_ai.prompt", SpanMapperOperationCopy, 30, false),
+				systemSrc("input.value", SpanMapperOperationCopy, 20, true),
+				attrSrc("gen_ai.prompt", SpanMapperOperationMove, 40),
+			),
+			want: spanMapperProcessorAttribute{
+				Target:  "gen_ai.input.messages",
+				Context: FieldContextSpanAttribute.StringValue(),
+				Sources: []spanMapperProcessorSource{
+					{Key: "gen_ai.prompt", Action: SpanMapperOperationMove.StringValue()},
+					{Key: "input.value"},
+				},
+			},
+		},
 	}
 
 	for _, tc := range tests {
@@ -155,6 +171,33 @@ func TestBuildAttributeRule(t *testing.T) {
 	}
 }
 
+func TestBuildProcessorConfigDropsAllOffItems(t *testing.T) {
+	t.Parallel()
+
+	offGroup := newGroup("all-off", nil, nil)
+	offGroup.Condition.Attributes = []SpanMapperGroupConditionKey{{Value: "model", Enabled: false, Origin: SpanMapperOriginSystem}}
+
+	mixed := newGroup("llm", nil, nil)
+	mixed.Condition.Attributes = []SpanMapperGroupConditionKey{
+		{Value: "model", Enabled: false, Origin: SpanMapperOriginSystem},
+		{Value: "gen_ai.request.model", Enabled: true, Origin: SpanMapperOriginUser},
+	}
+
+	got := buildProcessorConfig([]*SpanMapperGroupWithMappers{
+		{Group: offGroup, Mappers: []*SpanMapper{newMapper("gen_ai.request.model", FieldContextSpanAttribute, attrSrc("llm.model", SpanMapperOperationCopy, 1))}},
+		{Group: mixed, Mappers: []*SpanMapper{
+			newMapper("gen_ai.request.model", FieldContextSpanAttribute, systemSrc("llm.model", SpanMapperOperationCopy, 10, false)),
+			newMapper("gen_ai.provider.name", FieldContextSpanAttribute, systemSrc("llm.vendor", SpanMapperOperationCopy, 10, true)),
+		}},
+	})
+
+	require.Len(t, got.Groups, 1)
+	assert.Equal(t, "llm", got.Groups[0].ID)
+	assert.Equal(t, []string{"gen_ai.request.model"}, got.Groups[0].ExistsAny.Attributes)
+	require.Len(t, got.Groups[0].Attributes, 1)
+	assert.Equal(t, "gen_ai.provider.name", got.Groups[0].Attributes[0].Target)
+}
+
 func loadFixture(t *testing.T, name string) []byte {
 	t.Helper()
 	b, err := os.ReadFile(filepath.Join("testdata", name))
@@ -174,12 +217,23 @@ func assertYAMLEqual(t *testing.T, want, got []byte) {
 
 func newGroup(name string, attrs, res []string) *SpanMapperGroup {
 	return &SpanMapperGroup{
-		Name:      name,
-		Condition: SpanMapperGroupCondition{Attributes: attrs, Resource: res},
-		Enabled:   true,
+		Name: name,
+		Condition: SpanMapperGroupCondition{
+			Attributes: userConditionKeys(attrs),
+			Resource:   userConditionKeys(res),
+		},
+		Enabled: true,
 	}
 }
 
+func userConditionKeys(values []string) []SpanMapperGroupConditionKey {
+	out := make([]SpanMapperGroupConditionKey, len(values))
+	for i, v := range values {
+		out[i] = SpanMapperGroupConditionKey{Value: v, Enabled: true, Origin: SpanMapperOriginUser}
+	}
+	return out
+}
+
 func newMapper(name string, target FieldContext, sources ...SpanMapperSource) *SpanMapper {
 	return &SpanMapper{
 		Name:         name,
@@ -190,9 +244,13 @@ func newMapper(name string, target FieldContext, sources ...SpanMapperSource) *S
 }
 
 func attrSrc(key string, op SpanMapperOperation, priority int) SpanMapperSource {
-	return SpanMapperSource{Key: key, Context: FieldContextSpanAttribute, Operation: op, Priority: priority}
+	return SpanMapperSource{Key: key, Context: FieldContextSpanAttribute, Operation: op, Priority: priority, Enabled: true, Origin: SpanMapperOriginUser}
 }
 
 func resSrc(key string, op SpanMapperOperation, priority int) SpanMapperSource {
-	return SpanMapperSource{Key: key, Context: FieldContextResource, Operation: op, Priority: priority}
+	return SpanMapperSource{Key: key, Context: FieldContextResource, Operation: op, Priority: priority, Enabled: true, Origin: SpanMapperOriginUser}
+}
+
+func systemSrc(key string, op SpanMapperOperation, priority int, enabled bool) SpanMapperSource {
+	return SpanMapperSource{Key: key, Context: FieldContextSpanAttribute, Operation: op, Priority: priority, Enabled: enabled, Origin: SpanMapperOriginSystem}
 }

pkg/types/spantypes/spanmappersimulator_test.go

@@ -15,14 +15,14 @@ func TestSimulateSpanMappersProcessing_EndToEnd(t *testing.T) {
 	groups := []*SpanMapperGroupWithMappers{{
 		Group: &SpanMapperGroup{
 			Name:      "llm",
-			Condition: SpanMapperGroupCondition{Attributes: []string{"model"}},
+			Condition: SpanMapperGroupCondition{Attributes: userConditionKeys([]string{"model"})},
 			Enabled:   true,
 		},
 		Mappers: []*SpanMapper{{
 			Name:         "gen_ai.request.model",
 			FieldContext: FieldContextSpanAttribute,
 			Config: SpanMapperConfig{Sources: []SpanMapperSource{
-				{Key: "llm.model", Context: FieldContextSpanAttribute, Operation: SpanMapperOperationCopy, Priority: 1},
+				{Key: "llm.model", Context: FieldContextSpanAttribute, Operation: SpanMapperOperationCopy, Priority: 1, Enabled: true, Origin: SpanMapperOriginUser},
 			}},
 			Enabled: true,
 		}},

pkg/types/spantypes/storable.go

@@ -20,7 +20,9 @@ type StorableSpanMapperGroup struct {
 	OrgID     valuer.UUID              `bun:"org_id,type:text,notnull"`
 	Name      string                   `bun:"name,type:text,notnull"`
 	Condition SpanMapperGroupCondition `bun:"condition,type:jsonb,notnull"`
-	Enabled   bool                     `bun:"enabled,notnull,default:true"`
+	Enabled   bool                     `bun:"enabled,notnull"`
+	Origin    SpanMapperOrigin         `bun:"origin,type:text,notnull"`
+	Version   int                      `bun:"version,notnull"`
 }
 
 type StorableSpanMapper struct {
@@ -34,7 +36,8 @@ type StorableSpanMapper struct {
 	Name         string           `bun:"name,type:text,notnull"`
 	FieldContext FieldContext     `bun:"field_context,type:text,notnull"`
 	Config       SpanMapperConfig `bun:"config,type:jsonb,notnull"`
-	Enabled      bool             `bun:"enabled,notnull,default:true"`
+	Enabled      bool             `bun:"enabled,notnull"`
+	Origin       SpanMapperOrigin `bun:"origin,type:text,notnull"`
 }
 
 func (c SpanMapperGroupCondition) Value() (driver.Value, error) {

pkg/types/spantypes/store.go

@@ -9,9 +9,14 @@ import (
 )
 
 type SpanMapperStore interface {
+	// RunInTx runs cb in one transaction; every store call made with the
+	// callback's ctx joins it.
+	RunInTx(ctx context.Context, cb func(ctx context.Context) error) error
+
 	// Group operations
 	ListGroups(ctx context.Context, orgID valuer.UUID, q *ListSpanMapperGroupsQuery) ([]*SpanMapperGroup, error)
 	GetGroup(ctx context.Context, orgID, id valuer.UUID) (*SpanMapperGroup, error)
+	GetGroupByName(ctx context.Context, orgID valuer.UUID, name string) (*SpanMapperGroup, error)
 	CreateGroup(ctx context.Context, group *SpanMapperGroup) error
 	UpdateGroup(ctx context.Context, group *SpanMapperGroup) error
 	DeleteGroup(ctx context.Context, orgID, id valuer.UUID) error
@@ -21,7 +26,7 @@ type SpanMapperStore interface {
 	GetMapper(ctx context.Context, orgID, groupID, id valuer.UUID) (*SpanMapper, error)
 	CreateMapper(ctx context.Context, mapper *SpanMapper) error
 	UpdateMapper(ctx context.Context, mapper *SpanMapper) error
-	DeleteMapper(ctx context.Context, orgID, groupID, id valuer.UUID) error
+	DeleteMapper(ctx context.Context, orgID, groupID, id valuer.UUID, origin SpanMapperOrigin) error
 }
 
 // TraceStore defines the data access interface for trace detail queries.

tests/fixtures/traces.py

@@ -331,7 +331,7 @@ class Traces(ABC):
         flags: np.uint32 = 0,
         scope: dict[str, Any] = {},
         resource_write_mode: Literal["legacy_only", "dual_write"] = "dual_write",
-        attribute_write_mode: Literal["legacy_only", "dual_write", "json_only"] = "dual_write",
+        attribute_write_mode: Literal["legacy_only", "dual_write"] = "dual_write",
     ) -> None:
         if timestamp is None:
             timestamp = datetime.datetime.now()
@@ -514,11 +514,8 @@ class Traces(ABC):
 
         # Spans before the attribute JSON-evolution time populate only the legacy
         # attributes_{string,number,bool} maps; spans at or after it dual-write the
-        # native-typed `attributes` JSON column too, and spans past the map-write
-        # cutoff populate only the JSON column (metadata rows are still written).
+        # native-typed `attributes` JSON column too.
         self.attributes_json = {} if attribute_write_mode == "legacy_only" else dict(attributes)
-        if attribute_write_mode == "json_only":
-            self.attribute_string, self.attributes_number, self.attributes_bool = {}, {}, {}
 
         # Process events and derive error events. self.events holds the parsed
         # response shape; np_arr() encodes back to the DB format on insert.

tests/integration/tests/queriercommon/02_qb_warnings.py

@@ -64,8 +64,8 @@ def test_resource_default_warning(
         "Key `service.name` is ambiguous, found 2 different combinations of "
         "field context / data type: [name=service.name,context=resource,datatype=string "
         "name=service.name,context=attribute,datatype=string]. Using `resource` context "
-        "by default. To query another context explicitly, use the fully qualified name "
-        "(e.g., 'attribute.service.name' or 'body.service.name')"
+        "by default. To query attributes explicitly, use the fully qualified name "
+        "(e.g., 'attribute.service.name')"
     )
     assert warning["warnings"] == [
         {"message": expected_service_name_warning},
@@ -237,8 +237,8 @@ def test_deduped_warnings_for_single_query(
         "Key `service.name` is ambiguous, found 2 different combinations of "
         "field context / data type: [name=service.name,context=resource,datatype=string "
         "name=service.name,context=attribute,datatype=string]. Using `resource` context "
-        "by default. To query another context explicitly, use the fully qualified name "
-        "(e.g., 'attribute.service.name' or 'body.service.name')"
+        "by default. To query attributes explicitly, use the fully qualified name "
+        "(e.g., 'attribute.service.name')"
     )
     expected_status_code_warning = "Key `http.status_code` is ambiguous, found 2 different combinations of field context / data type: [name=http.status_code,context=attribute,datatype=number name=http.status_code,context=attribute,datatype=string]."
     assert warning["warnings"] == [
@@ -328,8 +328,8 @@ def test_deduped_warnings_for_multiple_queries(
         "Key `service.name` is ambiguous, found 2 different combinations of "
         "field context / data type: [name=service.name,context=resource,datatype=string "
         "name=service.name,context=attribute,datatype=string]. Using `resource` context "
-        "by default. To query another context explicitly, use the fully qualified name "
-        "(e.g., 'attribute.service.name' or 'body.service.name')"
+        "by default. To query attributes explicitly, use the fully qualified name "
+        "(e.g., 'attribute.service.name')"
     )
     expected_status_code_warning = "Key `http.status_code` is ambiguous, found 2 different combinations of field context / data type: [name=http.status_code,context=attribute,datatype=number name=http.status_code,context=attribute,datatype=string]."
     assert warning["warnings"] == [

tests/integration/tests/queriertraces/13_attributes_json_evolution.py

@@ -5,15 +5,11 @@ from http import HTTPStatus
 from fixtures import types
 from fixtures.auth import USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD
 from fixtures.querier import (
-    BuilderQuery,
-    OrderBy,
     RequestType,
-    TelemetryFieldKey,
     assert_grouped_series,
     build_aggregation,
     build_group_by_field,
     build_traces_scalar_query,
-    get_rows,
     index_series_by_label,
     make_query_request,
 )
@@ -333,80 +329,3 @@ def test_traces_attributes_json_collision_and_map_parity(
         aggregations = (response.json()["data"]["data"]["results"][0].get("aggregations")) or []
         series = index_series_by_label(aggregations[0]["series"], "http.route") if aggregations else {}
         assert set(series.keys()) == expected, label
-
-
-def test_traces_attributes_json_list_view(
-    signoz: types.SigNoz,
-    create_user_admin: None,  # pylint: disable=unused-argument
-    get_token: Callable[[str, str], str],
-    insert_traces: Callable[[list[Traces]], None],
-    seed_attribute_evolution: Callable[[str, datetime], None],
-) -> None:
-    """One straddling list query surfaces each row's attributes bag from its own home
-    (legacy maps / dual-written / JSON-only), flattened to dotted keys with native types."""
-    token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
-
-    evolution_time = datetime.now(tz=UTC).replace(second=0, microsecond=0) - timedelta(minutes=30)
-    seed_attribute_evolution("traces", evolution_time)
-
-    service = "list-homes-service"
-    spans = [
-        Traces(
-            timestamp=evolution_time - timedelta(minutes=10),
-            trace_id=TraceIdGenerator.trace_id(),
-            span_id=TraceIdGenerator.span_id(),
-            name="map only",
-            resources={"service.name": service},
-            attributes={"http.route": "/map", "http.retry.count": 1, "http.cache.hit": True},
-            attribute_write_mode="legacy_only",
-        ),
-        Traces(
-            timestamp=evolution_time + timedelta(minutes=5),
-            trace_id=TraceIdGenerator.trace_id(),
-            span_id=TraceIdGenerator.span_id(),
-            name="dual written",
-            resources={"service.name": service},
-            attributes={"http.route": "/dual", "http.retry.count": 2, "http.cache.hit": False},
-            attribute_write_mode="dual_write",
-        ),
-        Traces(
-            timestamp=evolution_time + timedelta(minutes=10),
-            trace_id=TraceIdGenerator.trace_id(),
-            span_id=TraceIdGenerator.span_id(),
-            name="json only",
-            resources={"service.name": service},
-            attributes={"http.route": "/json", "http.retry.count": 3, "http.cache.hit": True},
-            attribute_write_mode="json_only",
-        ),
-    ]
-    insert_traces(spans)
-
-    response = make_query_request(
-        signoz,
-        token,
-        start_ms=int((evolution_time - timedelta(minutes=15)).timestamp() * 1000),
-        end_ms=int((evolution_time + timedelta(minutes=15)).timestamp() * 1000),
-        request_type=RequestType.RAW,
-        queries=[
-            BuilderQuery(
-                signal="traces",
-                name="A",
-                limit=10,
-                filter_expression=f"resource.service.name = '{service}'",
-                order=[OrderBy(TelemetryFieldKey("timestamp"), "asc")],
-            ).to_dict()
-        ],
-    )
-    assert response.status_code == HTTPStatus.OK
-
-    rows = get_rows(response)
-    assert len(rows) == 3
-    expected = [
-        ("map only", {"http.route": "/map", "http.retry.count": 1, "http.cache.hit": True}),
-        ("dual written", {"http.route": "/dual", "http.retry.count": 2, "http.cache.hit": False}),
-        ("json only", {"http.route": "/json", "http.retry.count": 3, "http.cache.hit": True}),
-    ]
-    for row, (name, attributes) in zip(rows, expected, strict=True):
-        assert row["data"]["name"] == name
-        # int/float compare equal in Python, so map-sourced float64 and JSON-sourced numbers both match.
-        assert row["data"]["attributes"] == attributes, name

tests/integration/tests/spanmapper/01_span_mapper.py

@@ -41,7 +41,7 @@ def test_create_groups_and_simulate_with_backfill(
         },
         json={
             "name": "llm-backfill",
-            "condition": {"attributes": ["model"], "resource": []},
+            "condition": {"attributes": [{"value": "model", "enabled": True}], "resource": []},
             "enabled": True,
         },
     )
@@ -69,6 +69,7 @@ def test_create_groups_and_simulate_with_backfill(
                         "context": "attribute",
                         "operation": "copy",
                         "priority": 1,
+                        "enabled": True,
                     }
                 ]
             },
@@ -126,13 +127,13 @@ def test_create_groups_and_simulate_with_backfill(
                 # No "mappers" key: the server backfills them from the saved group.
                 {
                     "name": "llm-backfill",
-                    "condition": {"attributes": ["model"], "resource": []},
+                    "condition": {"attributes": [{"value": "model", "enabled": True}], "resource": []},
                     "enabled": True,
                 },
                 # Unsaved group; mappers provided inline.
                 {
                     "name": "db-inline",
-                    "condition": {"attributes": ["db"], "resource": []},
+                    "condition": {"attributes": [{"value": "db", "enabled": True}], "resource": []},
                     "enabled": True,
                     "mappers": [
                         {
@@ -145,6 +146,7 @@ def test_create_groups_and_simulate_with_backfill(
                                         "context": "attribute",
                                         "operation": "move",
                                         "priority": 1,
+                                        "enabled": True,
                                     }
                                 ]
                             },

tests/integration/tests/spanmapper/02_default_groups.py

@@ -0,0 +1,152 @@
+from collections.abc import Callable
+from http import HTTPStatus
+
+import requests
+
+from fixtures import types
+from fixtures.auth import USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD
+
+GROUPS_PATH = "/api/v1/span_mapper_groups"
+
+
+def test_default_groups_are_seeded_and_shipped_items_are_toggle_only(
+    signoz: types.SigNoz,
+    create_user_admin: types.Operation,  # pylint: disable=unused-argument
+    get_token: Callable[[str, str], str],
+) -> None:
+    """
+    Setup:
+    A fresh org. The reconciler seeds the shipped mapping groups at startup
+    and on org creation, so nothing has to be created here.
+
+    Tests:
+    1. The list contains llm, agent and tool as system groups with shipped
+       substrings
+    2. Shipped mappers and their sources are system-owned and enabled
+    3. A shipped name cannot be taken by a user group, and system groups and
+       mappers cannot be deleted
+    4. A shipped source can be switched off and a user override added; both
+       round-trip through PATCH and the simulator honours them
+    5. A shipped substring can be switched off and a user one added
+    """
+    token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
+    headers = {"authorization": f"Bearer {token}", "content-type": "application/json"}
+
+    list_groups = requests.get(signoz.self.host_configs["8080"].get(GROUPS_PATH), timeout=10, headers=headers)
+    assert list_groups.status_code == HTTPStatus.OK
+    groups = {g["name"]: g for g in list_groups.json()["data"]["items"]}
+    assert {"gen_ai.llm", "gen_ai.agent", "gen_ai.tool"} <= set(groups)
+    for name in ("gen_ai.llm", "gen_ai.agent", "gen_ai.tool"):
+        assert groups[name]["origin"] == "system"
+        assert groups[name]["version"] >= 1
+        assert groups[name]["createdBy"] == "signoz"
+    llm = groups["gen_ai.llm"]
+    assert llm["condition"]["attributes"] == [{"value": "model", "enabled": True, "origin": "system"}]
+
+    list_mappers = requests.get(signoz.self.host_configs["8080"].get(f"{GROUPS_PATH}/{llm['id']}/span_mappers"), timeout=10, headers=headers)
+    assert list_mappers.status_code == HTTPStatus.OK
+    mappers = {m["name"]: m for m in list_mappers.json()["data"]["items"]}
+    model = mappers["gen_ai.request.model"]
+    assert model["origin"] == "system"
+    assert model["enabled"] is True
+    assert all(s["origin"] == "system" and s["enabled"] is True for s in model["config"]["sources"])
+    assert "llm.model_name" in [s["key"] for s in model["config"]["sources"]]
+
+    reserved = requests.post(
+        signoz.self.host_configs["8080"].get(GROUPS_PATH),
+        timeout=10,
+        headers=headers,
+        json={"name": "gen_ai.tool", "condition": {"attributes": [{"value": "tool", "enabled": True}], "resource": []}, "enabled": True},
+    )
+    assert reserved.status_code == HTTPStatus.BAD_REQUEST
+    assert reserved.json()["error"]["code"] == "span_attribute_mapping_group_name_reserved"
+
+    delete_group = requests.delete(signoz.self.host_configs["8080"].get(f"{GROUPS_PATH}/{llm['id']}"), timeout=10, headers=headers)
+    assert delete_group.status_code == HTTPStatus.BAD_REQUEST
+    assert delete_group.json()["error"]["code"] == "span_attribute_mapping_group_not_deletable"
+
+    delete_mapper = requests.delete(signoz.self.host_configs["8080"].get(f"{GROUPS_PATH}/{llm['id']}/span_mappers/{model['id']}"), timeout=10, headers=headers)
+    assert delete_mapper.status_code == HTTPStatus.BAD_REQUEST
+    assert delete_mapper.json()["error"]["code"] == "span_attribute_mapper_not_deletable"
+
+    # Switch the shipped llm.model_name source off and re-add it as a user move.
+    sources = [{**s, "enabled": s["key"] != "llm.model_name"} for s in model["config"]["sources"]] + [{"key": "llm.model_name", "context": "attribute", "operation": "move", "priority": 1, "enabled": True}]
+    patch_mapper = requests.patch(
+        signoz.self.host_configs["8080"].get(f"{GROUPS_PATH}/{llm['id']}/span_mappers/{model['id']}"),
+        timeout=10,
+        headers=headers,
+        json={"config": {"sources": sources}},
+    )
+    assert patch_mapper.status_code == HTTPStatus.NO_CONTENT
+
+    list_mappers = requests.get(signoz.self.host_configs["8080"].get(f"{GROUPS_PATH}/{llm['id']}/span_mappers"), timeout=10, headers=headers)
+    updated = {m["name"]: m for m in list_mappers.json()["data"]["items"]}["gen_ai.request.model"]
+    by_origin = {(s["key"], s["origin"]): s for s in updated["config"]["sources"]}
+    assert by_origin[("llm.model_name", "system")]["enabled"] is False
+    assert by_origin[("llm.model_name", "user")]["operation"] == "move"
+    assert len(updated["config"]["sources"]) == len(model["config"]["sources"]) + 1
+
+    # The user override wins: the source is moved, not copied.
+    simulate = requests.post(
+        signoz.self.host_configs["8080"].get(f"{GROUPS_PATH}/test"),
+        timeout=10,
+        headers=headers,
+        json={
+            "spans": [{"attributes": {"llm.model_name": "gpt-4o"}, "resource": {}}],
+            "groups": [{"name": "gen_ai.llm", "condition": llm["condition"], "enabled": True}],
+        },
+    )
+    assert simulate.status_code == HTTPStatus.OK
+    attrs = simulate.json()["data"]["spans"][0]["attributes"]
+    assert attrs["gen_ai.request.model"] == "gpt-4o"
+    assert "llm.model_name" not in attrs
+
+    # A shipped substring that does not exist is rejected; toggling one is not.
+    bad_condition = requests.patch(
+        signoz.self.host_configs["8080"].get(f"{GROUPS_PATH}/{llm['id']}"),
+        timeout=10,
+        headers=headers,
+        json={"condition": {"attributes": [{"value": "nope", "enabled": True, "origin": "system"}], "resource": []}},
+    )
+    assert bad_condition.status_code == HTTPStatus.BAD_REQUEST
+
+    patch_group = requests.patch(
+        signoz.self.host_configs["8080"].get(f"{GROUPS_PATH}/{llm['id']}"),
+        timeout=10,
+        headers=headers,
+        json={
+            "condition": {
+                "attributes": [
+                    {"value": "model", "enabled": False, "origin": "system"},
+                    {"value": "gen_ai.request.model", "enabled": True},
+                ],
+                "resource": [],
+            }
+        },
+    )
+    assert patch_group.status_code == HTTPStatus.NO_CONTENT
+
+    list_groups = requests.get(signoz.self.host_configs["8080"].get(GROUPS_PATH), timeout=10, headers=headers)
+    llm_after = {g["name"]: g for g in list_groups.json()["data"]["items"]}["gen_ai.llm"]
+    assert llm_after["condition"]["attributes"] == [
+        {"value": "model", "enabled": False, "origin": "system"},
+        {"value": "gen_ai.request.model", "enabled": True, "origin": "user"},
+    ]
+    assert llm_after["origin"] == "system"
+    assert llm_after["name"] == "gen_ai.llm"
+
+    # Leave the shipped group as seeded for the other suites.
+    restore_group = requests.patch(
+        signoz.self.host_configs["8080"].get(f"{GROUPS_PATH}/{llm['id']}"),
+        timeout=10,
+        headers=headers,
+        json={"condition": {"attributes": [{"value": "model", "enabled": True, "origin": "system"}], "resource": []}},
+    )
+    assert restore_group.status_code == HTTPStatus.NO_CONTENT
+    restore_mapper = requests.patch(
+        signoz.self.host_configs["8080"].get(f"{GROUPS_PATH}/{llm['id']}/span_mappers/{model['id']}"),
+        timeout=10,
+        headers=headers,
+        json={"config": {"sources": model["config"]["sources"]}},
+    )
+    assert restore_mapper.status_code == HTTPStatus.NO_CONTENT