Merge branch 'main' into feat/formula-having

test(querier): reject a formula having on heatmap requests
2026-11-09 18:00:43 +00:00 · 2026-11-09 22:01:47 +05:30 · 2026-11-09 15:51:08 +05:30 · 2026-11-09 15:49:13 +05:30 · 2026-11-07 16:59:46 +05:30 · 2026-11-07 12:08:27 +05:30
14 changed files with 474 additions and 537 deletions
--- a/docs/api/openapi.yml
+++ b/docs/api/openapi.yml
@@ -10231,8 +10231,10 @@ components:
        having:
          allOf:
          - $ref: '#/components/schemas/Querybuildertypesv5Having'
-          description: Accepted but currently ignored; the computed values are returned
-            unfiltered.
+          description: A filter on the formula values, referencing the formula by
+            its name or as __result, for example F1 > 0. A time series keeps only
+            the points that match and drops a series with none left; a scalar result
+            keeps only the rows that match.
        legend:
          description: The display name template for each series; {{field}} placeholders
            are replaced by label values.
@@ -32729,305 +32731,6 @@ paths:
                  requestType: time_series
                  schemaVersion: v1
                  start: 1640995200000
-              function_anomaly_request_rate:
-                description: 'anomaly is the one function with named arguments. seasonality
-                  says which past periods predict the current value: hourly, daily
-                  or weekly, daily when absent. z_score_threshold is how many standard
-                  deviations from the prediction count as an anomaly. It has no default:
-                  a request without it gets bounds of zero width, so send it. 3 is
-                  the value the UI sends. The response carries, next to the values,
-                  a predicted series, an upper and a lower bound series and an anomaly
-                  score series. The scoring runs in the enterprise build; the community
-                  build returns the series unchanged.'
-                summary: 'anomaly: request rate scored against its daily pattern'
-                value:
-                  compositeQuery:
-                    queries:
-                    - spec:
-                        aggregations:
-                        - metricName: http.server.duration.count
-                          spaceAggregation: sum
-                          timeAggregation: rate
-                        functions:
-                        - args:
-                          - name: seasonality
-                            value: daily
-                          - name: z_score_threshold
-                            value: 3
-                          name: anomaly
-                        groupBy:
-                        - fieldContext: resource
-                          name: service.name
-                        name: A
-                        signal: metrics
-                        stepInterval: 300s
-                      type: builder_query
-                  end: 1640998800000
-                  requestType: time_series
-                  schemaVersion: v1
-                  start: 1640995200000
-              function_cumulativesum_errors_so_far:
-                description: cumulativeSum replaces each point with the sum of every
-                  point up to and including it, so a per-step count becomes a running
-                  total whose first point is the first count. It takes no arguments.
-                  The total resets with the window, so a longer time range gives a
-                  larger final value; it is a view of the window, not a counter.
-                summary: 'cumulativeSum: 5xx responses since the start of the window'
-                value:
-                  compositeQuery:
-                    queries:
-                    - spec:
-                        aggregations:
-                        - alias: server_errors
-                          expression: count()
-                        filter:
-                          expression: http.response.status_code >= 500
-                        functions:
-                        - name: cumulativeSum
-                        groupBy:
-                        - fieldContext: resource
-                          name: service.name
-                        name: A
-                        signal: traces
-                        stepInterval: 60s
-                      type: builder_query
-                  end: 1640998800000
-                  requestType: time_series
-                  schemaVersion: v1
-                  start: 1640995200000
-              function_cutoffmin_hide_idle_hosts:
-                description: The four threshold functions take one number. cutOffMin
-                  and cutOffMax remove the points below or above the threshold, so
-                  an idle host disappears from the chart instead of drawing a line
-                  along the bottom. clampMin and clampMax keep the points and replace
-                  the value with the threshold, which caps spikes without hiding them.
-                  system.cpu.utilization is a ratio, so 0.05 is 5%.
-                summary: 'cutOffMin: drop hosts below 5% CPU from the chart'
-                value:
-                  compositeQuery:
-                    queries:
-                    - spec:
-                        aggregations:
-                        - metricName: system.cpu.utilization
-                          spaceAggregation: avg
-                          timeAggregation: avg
-                        functions:
-                        - args:
-                          - value: 0.05
-                          name: cutOffMin
-                        groupBy:
-                        - fieldContext: resource
-                          name: host.name
-                        name: A
-                        signal: metrics
-                        stepInterval: 60s
-                      type: builder_query
-                  end: 1640998800000
-                  requestType: time_series
-                  schemaVersion: v1
-                  start: 1640995200000
-              function_ewma_smoothed_latency:
-                description: 'ewma3, ewma5 and ewma7 replace each point with an exponentially
-                  weighted average of the point and the points before it. The number
-                  in the name is the window the default weight is derived from: alpha
-                  = 2 / (n + 1), so 0.5, 0.333 and 0.25. One optional argument overrides
-                  alpha; a value close to 1 follows the raw series, a value close
-                  to 0 smooths harder. 0.3 here smooths a little more than ewma5''s
-                  default.'
-                summary: 'ewma5: smoothed p95 latency'
-                value:
-                  compositeQuery:
-                    queries:
-                    - spec:
-                        aggregations:
-                        - metricName: http.server.duration.bucket
-                          spaceAggregation: p95
-                        functions:
-                        - args:
-                          - value: 0.3
-                          name: ewma5
-                        groupBy:
-                        - fieldContext: resource
-                          name: service.name
-                        name: A
-                        signal: metrics
-                        stepInterval: 60s
-                      type: builder_query
-                  end: 1640998800000
-                  requestType: time_series
-                  schemaVersion: v1
-                  start: 1640995200000
-              function_fillzero_sparse_errors:
-                description: A count over sparse events returns a point only for steps
-                  that had a match, so a chart of failed spans has gaps where nothing
-                  failed. fillZero adds a zero at every missing step. With no arguments
-                  the server fills the request window at the query's step, which is
-                  the common case. The three optional arguments are start, end and
-                  step in milliseconds, for callers that want to fill a different
-                  grid.
-                summary: 'fillZero: a zero at every step with no failed spans'
-                value:
-                  compositeQuery:
-                    queries:
-                    - spec:
-                        aggregations:
-                        - alias: failed_spans
-                          expression: count()
-                        filter:
-                          expression: has_error = true
-                        functions:
-                        - name: fillZero
-                        groupBy:
-                        - fieldContext: resource
-                          name: service.name
-                        name: A
-                        signal: traces
-                        stepInterval: 60s
-                      type: builder_query
-                  end: 1640998800000
-                  requestType: time_series
-                  schemaVersion: v1
-                  start: 1640995200000
-              function_log10_network_bytes:
-                description: log2 and log10 replace each value with its logarithm,
-                  so a loopback device moving kilobytes and an uplink moving gigabytes
-                  fit on one chart. They take no arguments. Zero and negative values
-                  have no logarithm and are not drawn. absolute, also without arguments,
-                  is the usual companion for a signed series before a logarithm.
-                summary: 'log10: network throughput across devices that differ by
-                  orders of magnitude'
-                value:
-                  compositeQuery:
-                    queries:
-                    - spec:
-                        aggregations:
-                        - metricName: system.network.io
-                          spaceAggregation: sum
-                          timeAggregation: rate
-                        filter:
-                          expression: direction = 'transmit'
-                        functions:
-                        - name: log10
-                        groupBy:
-                        - fieldContext: attribute
-                          name: device
-                        name: A
-                        signal: metrics
-                        stepInterval: 60s
-                      type: builder_query
-                  end: 1640998800000
-                  requestType: time_series
-                  schemaVersion: v1
-                  start: 1640995200000
-              function_median_despiked_request_rate:
-                description: median3, median5 and median7 replace each point with
-                  the median of the surrounding 3, 5 or 7 points. A spike that lasts
-                  one step vanishes, a shift that lasts longer than half the window
-                  stays. The first and last half window, 2 points each for median5,
-                  have no full window and keep their values, so the newest spike stays
-                  visible; a series shorter than the window is returned unchanged.
-                  They take no arguments. Use them when the raw series is noisy and
-                  the chart is for a trend, not for catching the spike.
-                summary: 'median5: request rate without one-step spikes'
-                value:
-                  compositeQuery:
-                    queries:
-                    - spec:
-                        aggregations:
-                        - metricName: http.server.duration.count
-                          spaceAggregation: sum
-                          timeAggregation: rate
-                        functions:
-                        - name: median5
-                        groupBy:
-                        - fieldContext: resource
-                          name: service.name
-                        name: A
-                        signal: metrics
-                        stepInterval: 60s
-                      type: builder_query
-                  end: 1640998800000
-                  requestType: time_series
-                  schemaVersion: v1
-                  start: 1640995200000
-              function_runningdiff_disk_growth:
-                description: 'runningDiff turns a gauge into the change between consecutive
-                  points, so a filesystem usage gauge becomes bytes written per step.
-                  It takes no arguments and drops the first point of the window, since
-                  that point has nothing to difference against; the server reads one
-                  step before the window to keep the first interval. Functions apply
-                  in order: clampMin with 0 runs on the differences and replaces the
-                  negative value a cleanup or a volume reset produces with zero.'
-                summary: 'runningDiff then clampMin: bytes written to disk per step'
-                value:
-                  compositeQuery:
-                    queries:
-                    - spec:
-                        aggregations:
-                        - metricName: system.filesystem.usage
-                          spaceAggregation: sum
-                          timeAggregation: latest
-                        filter:
-                          expression: state = 'used'
-                        functions:
-                        - name: runningDiff
-                        - args:
-                          - value: 0
-                          name: clampMin
-                        groupBy:
-                        - fieldContext: resource
-                          name: host.name
-                        name: A
-                        signal: metrics
-                        stepInterval: 60s
-                      type: builder_query
-                  end: 1640998800000
-                  requestType: time_series
-                  schemaVersion: v1
-                  start: 1640995200000
-              function_timeshift_week_over_week:
-                description: timeShift moves every point of its query forward by the
-                  argument, in seconds, so a series read from the past lands on the
-                  current timestamps. B here reads the hour exactly seven days (604800
-                  s) before the requested window and comes back on this week's timestamps,
-                  so it overlays A on a chart and the formula can subtract it point
-                  by point. The argument is positive; it says how far back to read.
-                summary: 'timeShift: this week''s error logs next to last week''s'
-                value:
-                  compositeQuery:
-                    queries:
-                    - spec:
-                        aggregations:
-                        - alias: errors
-                          expression: count()
-                        filter:
-                          expression: severity_text = 'ERROR'
-                        name: A
-                        signal: logs
-                        stepInterval: 60s
-                      type: builder_query
-                    - spec:
-                        aggregations:
-                        - alias: errors
-                          expression: count()
-                        filter:
-                          expression: severity_text = 'ERROR'
-                        functions:
-                        - args:
-                          - value: 604800
-                          name: timeShift
-                        name: B
-                        signal: logs
-                        stepInterval: 60s
-                      type: builder_query
-                    - spec:
-                        expression: A - B
-                        name: F1
-                      type: builder_formula
-                  end: 1640998800000
-                  requestType: time_series
-                  schemaVersion: v1
-                  start: 1640995200000
              logs_raw:
                summary: 'Raw: fetch raw log records'
                value:
--- a/frontend/src/api/generated/services/sigNoz.schemas.ts
+++ b/frontend/src/api/generated/services/sigNoz.schemas.ts
@@ -7079,7 +7079,7 @@ export interface Querybuildertypesv5QueryBuilderFormulaDTO {
 	 */
 	functions?: Querybuildertypesv5FunctionDTO[] | null;
 	/**
-	 * @description Accepted but currently ignored; the computed values are returned unfiltered.
+	 * @description A filter on the formula values, referencing the formula by its name or as __result, for example F1 > 0. A time series keeps only the points that match and drops a series with none left; a scalar result keeps only the rows that match.
 	 */
 	having?: Querybuildertypesv5HavingDTO;
 	/**
--- a/pkg/apiserver/signozapiserver/querier.go
+++ b/pkg/apiserver/signozapiserver/querier.go
@@ -30,7 +30,7 @@ func (provider *provider) addQuerierRoutes(router *mux.Router) error {
 		Description:        "Execute a composite query over a time range. Supports builder queries (traces, logs, metrics), formulas, trace operators, PromQL, and ClickHouse SQL.",
 		Request:            new(qbtypes.QueryRangeRequest),
 		RequestContentType: "application/json",
-		RequestExamples: append([]handler.OpenAPIExample{
+		RequestExamples: []handler.OpenAPIExample{
 			{
 				Name:    "traces_time_series",
 				Summary: "Time series: count spans grouped by service",
@@ -598,7 +598,7 @@ func (provider *provider) addQuerierRoutes(router *mux.Router) error {
 					},
 				},
 			},
-		}, queryRangeFunctionExamples()...),
+		},
 		Response:            new(qbtypes.QueryRangeResponse),
 		ResponseContentType: "application/json",
 		SuccessStatusCode:   http.StatusOK,
--- a/pkg/apiserver/signozapiserver/querier_examples.go
+++ b/pkg/apiserver/signozapiserver/querier_examples.go
@@ -1,202 +0,0 @@
-package signozapiserver
-
-import "github.com/SigNoz/signoz/pkg/http/handler"
-
-// timeSeriesExample wraps builder query specs in a one hour time series
-// request, the shape every function example shares.
-func timeSeriesExample(name, summary, description string, queries ...map[string]any) handler.OpenAPIExample {
-	list := make([]any, 0, len(queries))
-	for _, query := range queries {
-		list = append(list, query)
-	}
-	return handler.OpenAPIExample{
-		Name:        name,
-		Summary:     summary,
-		Description: description,
-		Value: map[string]any{
-			"schemaVersion":  "v1",
-			"start":          1640995200000,
-			"end":            1640998800000,
-			"requestType":    "time_series",
-			"compositeQuery": map[string]any{"queries": list},
-		},
-	}
-}
-
-func builderQueryEnvelope(spec map[string]any) map[string]any {
-	return map[string]any{"type": "builder_query", "spec": spec}
-}
-
-// function builds a function entry with positional arguments; anomaly is the
-// one function that takes named arguments and is written out in full.
-func function(name string, args ...any) map[string]any {
-	list := make([]any, 0, len(args))
-	for _, arg := range args {
-		list = append(list, map[string]any{"value": arg})
-	}
-	entry := map[string]any{"name": name}
-	if len(list) > 0 {
-		entry["args"] = list
-	}
-	return entry
-}
-
-// queryRangeFunctionExamples shows every function a builder query can carry,
-// what its arguments mean and the values they take. Functions run in the
-// order listed, after the aggregation and before formulas.
-func queryRangeFunctionExamples() []handler.OpenAPIExample {
-	return []handler.OpenAPIExample{
-		timeSeriesExample(
-			"function_timeshift_week_over_week",
-			"timeShift: this week's error logs next to last week's",
-			"timeShift moves every point of its query forward by the argument, in seconds, so a series read from the past lands on the current timestamps. B here reads the hour exactly seven days (604800 s) before the requested window and comes back on this week's timestamps, so it overlays A on a chart and the formula can subtract it point by point. The argument is positive; it says how far back to read.",
-			builderQueryEnvelope(map[string]any{
-				"name":         "A",
-				"signal":       "logs",
-				"aggregations": []any{map[string]any{"expression": "count()", "alias": "errors"}},
-				"stepInterval": "60s",
-				"filter":       map[string]any{"expression": "severity_text = 'ERROR'"},
-			}),
-			builderQueryEnvelope(map[string]any{
-				"name":         "B",
-				"signal":       "logs",
-				"aggregations": []any{map[string]any{"expression": "count()", "alias": "errors"}},
-				"stepInterval": "60s",
-				"filter":       map[string]any{"expression": "severity_text = 'ERROR'"},
-				"functions":    []any{function("timeShift", 604800)},
-			}),
-			map[string]any{
-				"type": "builder_formula",
-				"spec": map[string]any{"name": "F1", "expression": "A - B"},
-			},
-		),
-		timeSeriesExample(
-			"function_fillzero_sparse_errors",
-			"fillZero: a zero at every step with no failed spans",
-			"A count over sparse events returns a point only for steps that had a match, so a chart of failed spans has gaps where nothing failed. fillZero adds a zero at every missing step. With no arguments the server fills the request window at the query's step, which is the common case. The three optional arguments are start, end and step in milliseconds, for callers that want to fill a different grid.",
-			builderQueryEnvelope(map[string]any{
-				"name":         "A",
-				"signal":       "traces",
-				"aggregations": []any{map[string]any{"expression": "count()", "alias": "failed_spans"}},
-				"stepInterval": "60s",
-				"filter":       map[string]any{"expression": "has_error = true"},
-				"groupBy":      []any{map[string]any{"name": "service.name", "fieldContext": "resource"}},
-				"functions":    []any{function("fillZero")},
-			}),
-		),
-		timeSeriesExample(
-			"function_cutoffmin_hide_idle_hosts",
-			"cutOffMin: drop hosts below 5% CPU from the chart",
-			"The four threshold functions take one number. cutOffMin and cutOffMax remove the points below or above the threshold, so an idle host disappears from the chart instead of drawing a line along the bottom. clampMin and clampMax keep the points and replace the value with the threshold, which caps spikes without hiding them. system.cpu.utilization is a ratio, so 0.05 is 5%.",
-			builderQueryEnvelope(map[string]any{
-				"name":   "A",
-				"signal": "metrics",
-				"aggregations": []any{
-					map[string]any{"metricName": "system.cpu.utilization", "timeAggregation": "avg", "spaceAggregation": "avg"},
-				},
-				"stepInterval": "60s",
-				"groupBy":      []any{map[string]any{"name": "host.name", "fieldContext": "resource"}},
-				"functions":    []any{function("cutOffMin", 0.05)},
-			}),
-		),
-		timeSeriesExample(
-			"function_runningdiff_disk_growth",
-			"runningDiff then clampMin: bytes written to disk per step",
-			"runningDiff turns a gauge into the change between consecutive points, so a filesystem usage gauge becomes bytes written per step. It takes no arguments and drops the first point of the window, since that point has nothing to difference against; the server reads one step before the window to keep the first interval. Functions apply in order: clampMin with 0 runs on the differences and replaces the negative value a cleanup or a volume reset produces with zero.",
-			builderQueryEnvelope(map[string]any{
-				"name":   "A",
-				"signal": "metrics",
-				"aggregations": []any{
-					map[string]any{"metricName": "system.filesystem.usage", "timeAggregation": "latest", "spaceAggregation": "sum"},
-				},
-				"stepInterval": "60s",
-				"filter":       map[string]any{"expression": "state = 'used'"},
-				"groupBy":      []any{map[string]any{"name": "host.name", "fieldContext": "resource"}},
-				"functions":    []any{function("runningDiff"), function("clampMin", 0)},
-			}),
-		),
-		timeSeriesExample(
-			"function_ewma_smoothed_latency",
-			"ewma5: smoothed p95 latency",
-			"ewma3, ewma5 and ewma7 replace each point with an exponentially weighted average of the point and the points before it. The number in the name is the window the default weight is derived from: alpha = 2 / (n + 1), so 0.5, 0.333 and 0.25. One optional argument overrides alpha; a value close to 1 follows the raw series, a value close to 0 smooths harder. 0.3 here smooths a little more than ewma5's default.",
-			builderQueryEnvelope(map[string]any{
-				"name":   "A",
-				"signal": "metrics",
-				"aggregations": []any{
-					map[string]any{"metricName": "http.server.duration.bucket", "spaceAggregation": "p95"},
-				},
-				"stepInterval": "60s",
-				"groupBy":      []any{map[string]any{"name": "service.name", "fieldContext": "resource"}},
-				"functions":    []any{function("ewma5", 0.3)},
-			}),
-		),
-		timeSeriesExample(
-			"function_median_despiked_request_rate",
-			"median5: request rate without one-step spikes",
-			"median3, median5 and median7 replace each point with the median of the surrounding 3, 5 or 7 points. A spike that lasts one step vanishes, a shift that lasts longer than half the window stays. The first and last half window, 2 points each for median5, have no full window and keep their values, so the newest spike stays visible; a series shorter than the window is returned unchanged. They take no arguments. Use them when the raw series is noisy and the chart is for a trend, not for catching the spike.",
-			builderQueryEnvelope(map[string]any{
-				"name":   "A",
-				"signal": "metrics",
-				"aggregations": []any{
-					map[string]any{"metricName": "http.server.duration.count", "timeAggregation": "rate", "spaceAggregation": "sum"},
-				},
-				"stepInterval": "60s",
-				"groupBy":      []any{map[string]any{"name": "service.name", "fieldContext": "resource"}},
-				"functions":    []any{function("median5")},
-			}),
-		),
-		timeSeriesExample(
-			"function_cumulativesum_errors_so_far",
-			"cumulativeSum: 5xx responses since the start of the window",
-			"cumulativeSum replaces each point with the sum of every point up to and including it, so a per-step count becomes a running total whose first point is the first count. It takes no arguments. The total resets with the window, so a longer time range gives a larger final value; it is a view of the window, not a counter.",
-			builderQueryEnvelope(map[string]any{
-				"name":         "A",
-				"signal":       "traces",
-				"aggregations": []any{map[string]any{"expression": "count()", "alias": "server_errors"}},
-				"stepInterval": "60s",
-				"filter":       map[string]any{"expression": "http.response.status_code >= 500"},
-				"groupBy":      []any{map[string]any{"name": "service.name", "fieldContext": "resource"}},
-				"functions":    []any{function("cumulativeSum")},
-			}),
-		),
-		timeSeriesExample(
-			"function_log10_network_bytes",
-			"log10: network throughput across devices that differ by orders of magnitude",
-			"log2 and log10 replace each value with its logarithm, so a loopback device moving kilobytes and an uplink moving gigabytes fit on one chart. They take no arguments. Zero and negative values have no logarithm and are not drawn. absolute, also without arguments, is the usual companion for a signed series before a logarithm.",
-			builderQueryEnvelope(map[string]any{
-				"name":   "A",
-				"signal": "metrics",
-				"aggregations": []any{
-					map[string]any{"metricName": "system.network.io", "timeAggregation": "rate", "spaceAggregation": "sum"},
-				},
-				"stepInterval": "60s",
-				"filter":       map[string]any{"expression": "direction = 'transmit'"},
-				"groupBy":      []any{map[string]any{"name": "device", "fieldContext": "attribute"}},
-				"functions":    []any{function("log10")},
-			}),
-		),
-		timeSeriesExample(
-			"function_anomaly_request_rate",
-			"anomaly: request rate scored against its daily pattern",
-			"anomaly is the one function with named arguments. seasonality says which past periods predict the current value: hourly, daily or weekly, daily when absent. z_score_threshold is how many standard deviations from the prediction count as an anomaly. It has no default: a request without it gets bounds of zero width, so send it. 3 is the value the UI sends. The response carries, next to the values, a predicted series, an upper and a lower bound series and an anomaly score series. The scoring runs in the enterprise build; the community build returns the series unchanged.",
-			builderQueryEnvelope(map[string]any{
-				"name":   "A",
-				"signal": "metrics",
-				"aggregations": []any{
-					map[string]any{"metricName": "http.server.duration.count", "timeAggregation": "rate", "spaceAggregation": "sum"},
-				},
-				"stepInterval": "300s",
-				"groupBy":      []any{map[string]any{"name": "service.name", "fieldContext": "resource"}},
-				"functions": []any{
-					map[string]any{
-						"name": "anomaly",
-						"args": []any{
-							map[string]any{"name": "seasonality", "value": "daily"},
-							map[string]any{"name": "z_score_threshold", "value": 3},
-						},
-					},
-				},
-			}),
-		),
-	}
-}
--- a/pkg/apiserver/signozapiserver/querier_examples_test.go
+++ b/pkg/apiserver/signozapiserver/querier_examples_test.go
@@ -1,23 +0,0 @@
-package signozapiserver
-
-import (
-	"encoding/json"
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-
-	qbtypes "github.com/SigNoz/signoz/pkg/types/querybuildertypes/querybuildertypesv5"
-)
-
-func TestQueryRangeFunctionExamplesAreValidRequests(t *testing.T) {
-	for _, example := range queryRangeFunctionExamples() {
-		t.Run(example.Name, func(t *testing.T) {
-			raw, err := json.Marshal(example.Value)
-			require.NoError(t, err)
-			var req qbtypes.QueryRangeRequest
-			require.NoError(t, json.Unmarshal(raw, &req))
-			assert.NoError(t, req.Validate())
-		})
-	}
-}
--- a/pkg/querier/postprocess.go
+++ b/pkg/querier/postprocess.go
@@ -425,6 +425,12 @@ func (q *querier) processTimeSeriesFormula(
 		return nil
 	}

+	formulaSeries, err = applyFormulaHaving(formula, formulaSeries)
+	if err != nil {
+		q.logger.ErrorContext(ctx, "failed to apply formula having", errors.Attr(err), slog.String("formula", formula.Name))
+		return nil
+	}
+
 	// Create result for formula
 	formulaResult := &qbtypes.TimeSeriesData{
 		QueryName: formula.Name,
@@ -660,6 +666,12 @@ func (q *querier) processScalarFormula(
 		return nil
 	}

+	formulaSeries, err = applyFormulaHaving(formula, formulaSeries)
+	if err != nil {
+		q.logger.ErrorContext(ctx, "failed to apply formula having", errors.Attr(err), slog.String("formula", formula.Name))
+		return nil
+	}
+
 	// Apply ordering (and limit) before converting to scalar format.
 	formulaSeries = qbtypes.ApplySeriesLimit(formulaSeries, formula.Order, formula.Limit, formula.Offset)

@@ -710,6 +722,35 @@ func (q *querier) processScalarFormula(
 	}
 }

+// applyFormulaHaving keeps the values the formula having accepts, as SQL HAVING
+// keeps rows for a builder query, so a series with no values left is removed. It
+// runs before functions, order, limit, and offset, as HAVING runs before them in SQL.
+func applyFormulaHaving(formula qbtypes.QueryBuilderFormula, series []*qbtypes.TimeSeries) ([]*qbtypes.TimeSeries, error) {
+	if formula.Having == nil || strings.TrimSpace(formula.Having.Expression) == "" {
+		return series, nil
+	}
+
+	keep, err := querybuilder.CompileFormulaHaving(formula.Name, formula.Having.Expression)
+	if err != nil {
+		return nil, err
+	}
+
+	kept := series[:0]
+	for _, s := range series {
+		values := s.Values[:0]
+		for _, value := range s.Values {
+			if keep(value.Value) {
+				values = append(values, value)
+			}
+		}
+		if len(values) > 0 {
+			s.Values = values
+			kept = append(kept, s)
+		}
+	}
+	return kept, nil
+}
+
 // filterDisabledQueries removes results for disabled queries.
 func (q *querier) filterDisabledQueries(results map[string]*qbtypes.Result, req *qbtypes.QueryRangeRequest) map[string]*qbtypes.Result {
 	filtered := make(map[string]*qbtypes.Result)
--- a/pkg/querier/querier.go
+++ b/pkg/querier/querier.go
@@ -212,6 +212,14 @@ func (q *querier) buildQueries(
 		}

 		switch query.Type {
+		case qbtypes.QueryTypeFormula:
+			// the querier evaluates a formula after its queries run, so a bad
+			// having must fail here, before they run
+			if formula, ok := query.Spec.(qbtypes.QueryBuilderFormula); ok && formula.Having != nil && strings.TrimSpace(formula.Having.Expression) != "" {
+				if _, err := querybuilder.CompileFormulaHaving(formula.Name, formula.Having.Expression); err != nil {
+					return nil, nil, err
+				}
+			}
 		case qbtypes.QueryTypePromQL:
 			promQuery, ok := query.Spec.(qbtypes.PromQuery)
 			if !ok {
--- a/pkg/querybuilder/formula_having.go
+++ b/pkg/querybuilder/formula_having.go
@@ -0,0 +1,166 @@
+package querybuilder
+
+import (
+	"math"
+	"slices"
+	"strconv"
+
+	grammar "github.com/SigNoz/signoz/pkg/parser/havingexpression/grammar"
+	qbtypes "github.com/SigNoz/signoz/pkg/types/querybuildertypes/querybuildertypesv5"
+)
+
+// CompileFormulaHaving turns the having expression of a formula into a filter on
+// its values. The querier computes a formula in Go after ClickHouse returns, so the
+// having cannot run as SQL; it gets the same validation and messages as a
+// builder-query having, with the formula name and __result as the only references.
+func CompileFormulaHaving(formulaName, expression string) (func(value float64) bool, error) {
+	rewriter := &HavingExpressionRewriter{columnMap: map[string]string{
+		formulaName:               qbtypes.DefaultOrderByKey,
+		qbtypes.DefaultOrderByKey: qbtypes.DefaultOrderByKey,
+	}}
+	_, tree, err := rewriter.parseAndValidate(expression)
+	if err != nil {
+		return nil, err
+	}
+
+	return compileOrExpression(tree.Expression().OrExpression()), nil
+}
+
+func compileOrExpression(ctx grammar.IOrExpressionContext) func(float64) bool {
+	andExpressions := ctx.AllAndExpression()
+	conditions := make([]func(float64) bool, len(andExpressions))
+	for i, andExpression := range andExpressions {
+		conditions[i] = compileAndExpression(andExpression)
+	}
+
+	return func(value float64) bool {
+		for _, condition := range conditions {
+			if condition(value) {
+				return true
+			}
+		}
+		return false
+	}
+}
+
+func compileAndExpression(ctx grammar.IAndExpressionContext) func(float64) bool {
+	primaries := ctx.AllPrimary()
+	conditions := make([]func(float64) bool, len(primaries))
+	for i, primary := range primaries {
+		conditions[i] = compilePrimary(primary)
+	}
+
+	return func(value float64) bool {
+		for _, condition := range conditions {
+			if !condition(value) {
+				return false
+			}
+		}
+		return true
+	}
+}
+
+func compilePrimary(ctx grammar.IPrimaryContext) func(float64) bool {
+	var condition func(float64) bool
+	if ctx.OrExpression() != nil {
+		condition = compileOrExpression(ctx.OrExpression())
+	} else {
+		condition = compileComparison(ctx.Comparison())
+	}
+
+	if ctx.NOT() == nil {
+		return condition
+	}
+	return func(value float64) bool { return !condition(value) }
+}
+
+func compileComparison(ctx grammar.IComparisonContext) func(float64) bool {
+	left := compileOperand(ctx.Operand(0))
+
+	if ctx.IN() != nil {
+		signedNumbers := ctx.InList().AllSignedNumber()
+		list := make([]float64, len(signedNumbers))
+		for i, signedNumber := range signedNumbers {
+			list[i] = parseHavingNumber(signedNumber.GetText())
+		}
+		notIn := ctx.NOT() != nil
+		return func(value float64) bool { return slices.Contains(list, left(value)) != notIn }
+	}
+
+	right := compileOperand(ctx.Operand(1))
+	compOp := ctx.CompOp()
+	switch {
+	case compOp.EQUALS() != nil:
+		return func(value float64) bool { return left(value) == right(value) }
+	case compOp.NOT_EQUALS() != nil, compOp.NEQ() != nil:
+		return func(value float64) bool { return left(value) != right(value) }
+	case compOp.LT() != nil:
+		return func(value float64) bool { return left(value) < right(value) }
+	case compOp.LE() != nil:
+		return func(value float64) bool { return left(value) <= right(value) }
+	case compOp.GT() != nil:
+		return func(value float64) bool { return left(value) > right(value) }
+	default:
+		return func(value float64) bool { return left(value) >= right(value) }
+	}
+}
+
+func compileOperand(ctx grammar.IOperandContext) func(float64) float64 {
+	if ctx.Operand() == nil {
+		return compileTerm(ctx.Term())
+	}
+
+	left := compileOperand(ctx.Operand())
+	right := compileTerm(ctx.Term())
+	if ctx.MINUS() != nil {
+		return func(value float64) float64 { return left(value) - right(value) }
+	}
+	return func(value float64) float64 { return left(value) + right(value) }
+}
+
+func compileTerm(ctx grammar.ITermContext) func(float64) float64 {
+	if ctx.Term() == nil {
+		return compileFactor(ctx.Factor())
+	}
+
+	left := compileTerm(ctx.Term())
+	right := compileFactor(ctx.Factor())
+	switch {
+	case ctx.SLASH() != nil:
+		return func(value float64) float64 { return left(value) / right(value) }
+	case ctx.PERCENT() != nil:
+		return func(value float64) float64 { return math.Mod(left(value), right(value)) }
+	default:
+		return func(value float64) float64 { return left(value) * right(value) }
+	}
+}
+
+func compileFactor(ctx grammar.IFactorContext) func(float64) float64 {
+	if ctx.Factor() != nil {
+		inner := compileFactor(ctx.Factor())
+		if ctx.MINUS() != nil {
+			return func(value float64) float64 { return -inner(value) }
+		}
+		return inner
+	}
+
+	if ctx.Operand() != nil {
+		return compileOperand(ctx.Operand())
+	}
+
+	if number := ctx.Atom().NUMBER(); number != nil {
+		constant := parseHavingNumber(number.GetText())
+		return func(float64) float64 { return constant }
+	}
+
+	// validation rejects function calls, strings, and unknown names, so the atom
+	// names the formula value
+	return func(value float64) float64 { return value }
+}
+
+// ParseFloat reads every form the lexer admits as a number; a literal outside the
+// float64 range becomes the nearest value ParseFloat returns.
+func parseHavingNumber(text string) float64 {
+	number, _ := strconv.ParseFloat(text, 64)
+	return number
+}
--- a/pkg/querybuilder/formula_having_test.go
+++ b/pkg/querybuilder/formula_having_test.go
@@ -0,0 +1,86 @@
+package querybuilder
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/SigNoz/signoz/pkg/errors"
+)
+
+func TestCompileFormulaHaving_Matches(t *testing.T) {
+	values := []float64{-2, 0, 1, 2.5, 3, 10}
+
+	testCases := []struct {
+		name       string
+		expression string
+		want       []float64
+	}{
+		{name: "Name_GreaterThan", expression: "F1 > 2", want: []float64{2.5, 3, 10}},
+		{name: "Result_LessOrEqual", expression: "__result <= 1", want: []float64{-2, 0, 1}},
+		{name: "DoubleEquals", expression: "F1 == 3", want: []float64{3}},
+		{name: "AngleNotEquals", expression: "F1 <> 0", want: []float64{-2, 1, 2.5, 3, 10}},
+		{name: "In_Parentheses", expression: "F1 IN (0, 3, -2)", want: []float64{-2, 0, 3}},
+		{name: "NotIn_Brackets", expression: "F1 NOT IN [0, 3, -2]", want: []float64{1, 2.5, 10}},
+		{name: "AndBindsTighterThanOr", expression: "F1 > 0 AND F1 < 3 OR F1 = -2", want: []float64{-2, 1, 2.5}},
+		{name: "ImplicitAnd", expression: "F1 > 0 F1 < 3", want: []float64{1, 2.5}},
+		{name: "LowercaseKeywords", expression: "F1 > 2 and not F1 = 10", want: []float64{2.5, 3}},
+		{name: "NotParenthesized", expression: "NOT (F1 >= 1 AND F1 <= 3)", want: []float64{-2, 0, 10}},
+		{name: "Arithmetic", expression: "F1 * 2 - 1 > 4", want: []float64{3, 10}},
+		{name: "Arithmetic_Parentheses", expression: "(F1 + 2) / 2 >= 2", want: []float64{2.5, 3, 10}},
+		{name: "Modulo", expression: "F1 % 2 = 1", want: []float64{1, 3}},
+		{name: "UnaryMinus", expression: "-F1 > 1", want: []float64{-2}},
+		{name: "Number_Exponent", expression: "F1 >= 1e1", want: []float64{10}},
+		{name: "Number_LeadingDot", expression: "F1 < .5", want: []float64{-2, 0}},
+	}
+
+	for _, testCase := range testCases {
+		t.Run(testCase.name, func(t *testing.T) {
+			keep, err := CompileFormulaHaving("F1", testCase.expression)
+			require.NoError(t, err)
+			require.NotNil(t, keep)
+
+			got := []float64{}
+			for _, value := range values {
+				if keep(value) {
+					got = append(got, value)
+				}
+			}
+			assert.Equal(t, testCase.want, got)
+		})
+	}
+}
+
+func TestCompileFormulaHaving_Invalid(t *testing.T) {
+	testCases := []struct {
+		name           string
+		expression     string
+		wantErrMsg     string
+		wantAdditional []string
+	}{
+		{
+			name:           "QueryName_NotAReference",
+			expression:     "A > 0",
+			wantErrMsg:     "Invalid references in `Having` expression: [A]",
+			wantAdditional: []string{"Valid references are: [F1, __result]"},
+		},
+		{
+			name:           "Aggregation_NotAReference",
+			expression:     "count() > 0",
+			wantErrMsg:     "Invalid references in `Having` expression: [count]",
+			wantAdditional: []string{"Valid references are: [F1, __result]"},
+		},
+	}
+
+	for _, testCase := range testCases {
+		t.Run(testCase.name, func(t *testing.T) {
+			keep, err := CompileFormulaHaving("F1", testCase.expression)
+			require.Error(t, err)
+			assert.Nil(t, keep)
+			assert.True(t, errors.Ast(err, errors.TypeInvalidInput))
+			assert.ErrorContains(t, err, testCase.wantErrMsg)
+			assert.Equal(t, testCase.wantAdditional, additionalMessages(err))
+		})
+	}
+}
--- a/pkg/querybuilder/having_expression_validator.go
+++ b/pkg/querybuilder/having_expression_validator.go
@@ -237,7 +237,13 @@ func (v *havingExpressionRewriteVisitor) visitIdentifier(ctx grammar.IIdentifier
 	return name
 }

-// rewriteAndValidate is the single-pass implementation used by all RewriteFor* methods.
+func (r *HavingExpressionRewriter) rewriteAndValidate(expression string) (string, error) {
+	rewritten, _, err := r.parseAndValidate(expression)
+	return rewritten, err
+}
+
+// parseAndValidate is the single-pass implementation used by all RewriteFor* methods.
+// It also returns the parse tree, which CompileFormulaHaving evaluates in Go.
 //
 // Validation layers:
 //  1. The visitor runs on the parse tree, rewriting and collecting invalid references.
@@ -248,7 +254,7 @@ func (v *havingExpressionRewriteVisitor) visitIdentifier(ctx grammar.IIdentifier
 //  2. String literals in comparison-operand position → descriptive error
 //     ("aggregator results are numeric").
 //  3. ANTLR syntax errors → error with messages referencing the original token names.
-func (r *HavingExpressionRewriter) rewriteAndValidate(expression string) (string, error) {
+func (r *HavingExpressionRewriter) parseAndValidate(expression string) (string, grammar.IQueryContext, error) {
 	original := strings.TrimSpace(expression)

 	// Parse the expression once.
@@ -281,7 +287,7 @@ func (r *HavingExpressionRewriter) rewriteAndValidate(expression string) (string
 	// This is checked before invalid references so that "contains string literals" takes
 	// priority when a bare string literal is also an unresolvable operand.
 	if v.hasStringLiteral {
-		return "", errors.NewInvalidInputf(
+		return "", nil, errors.NewInvalidInputf(
 			errors.CodeInvalidInput,
 			"`Having` expression contains string literals",
 		).WithAdditional("Aggregator results are numeric")
@@ -317,7 +323,7 @@ func (r *HavingExpressionRewriter) rewriteAndValidate(expression string) (string
 		).WithAdditional(
 			"Valid references are: [" + strings.Join(validKeys, ", ") + "]",
 		).WithSuggestions(suggestions...)
-		return "", havingErr
+		return "", nil, havingErr
 	}

 	// Layer 3 – ANTLR syntax errors. We parse the original expression, so error messages
@@ -343,12 +349,12 @@ func (r *HavingExpressionRewriter) rewriteAndValidate(expression string) (string
 				return havingSuggestion(allSyntaxErrors[0], original)
 			})

-			return "", havingErr.WithSuggestiveAdditional(msgs[0], suggestions...)
+			return "", nil, havingErr.WithSuggestiveAdditional(msgs[0], suggestions...)
 		}
-		return "", havingErr.WithAdditional(msgs...)
+		return "", nil, havingErr.WithAdditional(msgs...)
 	}

-	return result, nil
+	return result, tree, nil
 }

 // havingSuggestion returns a corrected expression string to show as a suggestion when
--- a/pkg/types/querybuildertypes/querybuildertypesv5/formula.go
+++ b/pkg/types/querybuildertypes/querybuildertypesv5/formula.go
@@ -28,7 +28,7 @@ type QueryBuilderFormula struct {

 	Offset int `json:"offset,omitempty" description:"The number of ordered series or rows to skip before the page starts. Requires limit."`

-	Having *Having `json:"having,omitempty" description:"Accepted but currently ignored; the computed values are returned unfiltered."`
+	Having *Having `json:"having,omitempty" description:"A filter on the formula values, referencing the formula by its name or as __result, for example F1 > 0. A time series keeps only the points that match and drops a series with none left; a scalar result keeps only the rows that match."`

 	Functions []Function `json:"functions,omitzero" description:"Post-processing functions applied in order to each result series."`

--- a/tests/fixtures/querier.py
+++ b/tests/fixtures/querier.py
@@ -363,6 +363,7 @@ def build_formula_query(
    order: list[dict] | None = None,
    limit: int | None = None,
    offset: int | None = None,
+    having_expression: str | None = None,
 ) -> dict:
    spec: dict[str, Any] = {
        "name": name,
@@ -379,6 +380,8 @@ def build_formula_query(
        spec["limit"] = limit
    if offset is not None:
        spec["offset"] = offset
+    if having_expression:
+        spec["having"] = {"expression": having_expression}
    return {"type": "builder_formula", "spec": spec}


--- a/tests/integration/tests/querierlogs/04_formula.py
+++ b/tests/integration/tests/querierlogs/04_formula.py
@@ -2,6 +2,8 @@ from collections.abc import Callable
 from datetime import UTC, datetime, timedelta
 from http import HTTPStatus

+import pytest
+
 from fixtures import types
 from fixtures.auth import USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD
 from fixtures.logs import Logs
@@ -12,6 +14,9 @@ from fixtures.querier import (
    build_order_by,
    build_scalar_query,
    find_named_result,
+    get_all_series,
+    get_error_message,
+    index_series_by_label,
    make_query_request,
 )

@@ -191,3 +196,138 @@ def test_logs_formula_orderby_and_limit(
    assert len(f3_services) == 3, f"F3: expected 3 rows after limit, got {len(f3_services)}"
    assert f3_values == f4_values[:3], f"F3 values {f3_values} do not match F4[:3] values {f4_values[:3]}"
    assert set(f3_services) == set(f4_services[:3]), f"F3 services {f3_services} do not match F4[:3] services {f4_services[:3]}"
+
+
+# Logs per service at 5, 4, 3, 2, and 1 minutes before now. Totals: a 15, b 17, c 5, d 15.
+FORMULA_HAVING_COUNTS = {
+    "service-a": [1, 4, 2, 5, 3],
+    "service-b": [6, 1, 1, 2, 7],
+    "service-c": [1, 1, 1, 1, 1],
+    "service-d": [3, 3, 3, 3, 3],
+}
+
+
+@pytest.mark.parametrize(
+    "query_having,formula_having,expected_services",
+    [
+        pytest.param("count() > 4 AND count() < 16", "F1 > 4 AND F1 < 16", {"service-a", "service-b"}, id="and_range"),
+        pytest.param("count() IN (1, 5, 17) OR count() > 15", "__result IN (1, 5, 17) OR __result > 15", {"service-a", "service-b", "service-c"}, id="in_or"),
+        pytest.param("NOT (count() * 2 - 1 > 9)", "NOT (F1 * 2 - 1 > 9)", {"service-a", "service-b", "service-c", "service-d"}, id="not_arithmetic"),
+    ],
+)
+def test_logs_formula_having_time_series_matches_query_having(
+    signoz: types.SigNoz,
+    create_user_admin: None,  # pylint: disable=unused-argument
+    get_token: Callable[[str, str], str],
+    insert_logs: Callable[[list[Logs]], None],
+    query_having: str,
+    formula_having: str,
+    expected_services: set[str],
+) -> None:
+    """
+    The querier computes formulas in Go, so a formula having runs in Go. For the
+    formula `A`, it must keep the same points that SQL HAVING keeps on query A.
+    """
+    now = datetime.now(tz=UTC).replace(second=0, microsecond=0)
+    insert_logs([Logs(timestamp=now - timedelta(minutes=5 - minute), resources={"service.name": service}, body=f"{service} log {minute}-{i}") for service, counts in FORMULA_HAVING_COUNTS.items() for minute, count in enumerate(counts) for i in range(count)])
+    token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
+
+    group_by = [build_group_by_field("service.name", "string", "resource")]
+    response = make_query_request(
+        signoz,
+        token,
+        start_ms=int((now - timedelta(minutes=15)).timestamp() * 1000),
+        end_ms=int(now.timestamp() * 1000),
+        request_type="time_series",
+        queries=[
+            build_scalar_query(name="A", signal="logs", aggregations=[build_aggregation("count()")], group_by=group_by, disabled=True),
+            build_scalar_query(name="B", signal="logs", aggregations=[build_aggregation("count()")], group_by=group_by, having_expression=query_having),
+            build_formula_query("F1", "A", having_expression=formula_having),
+        ],
+    )
+    assert response.status_code == HTTPStatus.OK, response.text
+
+    query_series = index_series_by_label(get_all_series(response.json(), "B"), "service.name")
+    formula_series = index_series_by_label(get_all_series(response.json(), "F1"), "service.name")
+    assert set(formula_series) == expected_services
+    assert set(query_series) == expected_services
+    for service in expected_services:
+        query_points = sorted((value["timestamp"], value["value"]) for value in query_series[service]["values"])
+        formula_points = sorted((value["timestamp"], value["value"]) for value in formula_series[service]["values"])
+        assert formula_points == query_points, service
+
+
+@pytest.mark.parametrize(
+    "query_having,formula_having,expected_services",
+    [
+        pytest.param("count() > 4 AND count() < 16", "F1 > 4 AND F1 < 16", {"service-a", "service-c", "service-d"}, id="and_range"),
+        pytest.param("count() IN (1, 5, 17) OR count() > 15", "__result IN (1, 5, 17) OR __result > 15", {"service-b", "service-c"}, id="in_or"),
+        pytest.param("NOT (count() * 2 - 1 > 9)", "NOT (F1 * 2 - 1 > 9)", {"service-c"}, id="not_arithmetic"),
+    ],
+)
+def test_logs_formula_having_scalar_matches_query_having(
+    signoz: types.SigNoz,
+    create_user_admin: None,  # pylint: disable=unused-argument
+    get_token: Callable[[str, str], str],
+    insert_logs: Callable[[list[Logs]], None],
+    query_having: str,
+    formula_having: str,
+    expected_services: set[str],
+) -> None:
+    """
+    For the formula `A` in a scalar request, the formula having must keep the
+    same rows that SQL HAVING keeps on query A.
+    """
+    now = datetime.now(tz=UTC).replace(second=0, microsecond=0)
+    insert_logs([Logs(timestamp=now - timedelta(minutes=5 - minute), resources={"service.name": service}, body=f"{service} log {minute}-{i}") for service, counts in FORMULA_HAVING_COUNTS.items() for minute, count in enumerate(counts) for i in range(count)])
+    token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
+
+    group_by = [build_group_by_field("service.name", "string", "resource")]
+    response = make_query_request(
+        signoz,
+        token,
+        start_ms=int((now - timedelta(minutes=15)).timestamp() * 1000),
+        end_ms=int(now.timestamp() * 1000),
+        request_type="scalar",
+        queries=[
+            build_scalar_query(name="A", signal="logs", aggregations=[build_aggregation("count()")], group_by=group_by, disabled=True),
+            build_scalar_query(name="B", signal="logs", aggregations=[build_aggregation("count()")], group_by=group_by, having_expression=query_having),
+            build_formula_query("F1", "A", having_expression=formula_having),
+        ],
+    )
+    assert response.status_code == HTTPStatus.OK, response.text
+
+    results = response.json()["data"]["data"]["results"]
+    values_by_query = {}
+    for name in ("B", "F1"):
+        result = find_named_result(results, name)
+        assert result is not None, name
+        service_column = next(i for i, column in enumerate(result["columns"]) if column["name"] == "service.name")
+        value_column = next(i for i, column in enumerate(result["columns"]) if column["columnType"] == "aggregation")
+        values_by_query[name] = {row[service_column]: row[value_column] for row in result["data"]}
+    assert set(values_by_query["F1"]) == expected_services
+    assert values_by_query["F1"] == values_by_query["B"]
+
+
+def test_logs_formula_having_invalid_reference(
+    signoz: types.SigNoz,
+    create_user_admin: None,  # pylint: disable=unused-argument
+    get_token: Callable[[str, str], str],
+) -> None:
+    """A formula having can reference only the formula value, so `count()` is a bad request."""
+    now = datetime.now(tz=UTC).replace(second=0, microsecond=0)
+    token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
+
+    response = make_query_request(
+        signoz,
+        token,
+        start_ms=int((now - timedelta(minutes=15)).timestamp() * 1000),
+        end_ms=int(now.timestamp() * 1000),
+        request_type="time_series",
+        queries=[
+            build_scalar_query(name="A", signal="logs", aggregations=[build_aggregation("count()")], disabled=True),
+            build_formula_query("F1", "A", having_expression="count() > 0"),
+        ],
+    )
+    assert response.status_code == HTTPStatus.BAD_REQUEST, response.text
+    assert get_error_message(response.json()) == "Invalid references in `Having` expression: [count]"
--- a/tests/integration/tests/queriermetrics/16_heatmap_rejections.py
+++ b/tests/integration/tests/queriermetrics/16_heatmap_rejections.py
@@ -128,6 +128,15 @@ request_types = pytest.mark.parametrize(
            "having is not supported for {request_type} requests",
            id="having_on_the_query",
        ),
+        pytest.param(
+            [
+                build_builder_query("A", METRIC_NAME, "max", "max", disabled=True),
+                build_formula_query("F1", "A", having_expression="F1 > 1"),
+            ],
+            {},
+            "having is not supported for {request_type} requests",
+            id="having_on_the_formula",
+        ),
        pytest.param(
            [build_builder_query("A", METRIC_NAME, "max", "max", bucket_options={"kind": "quadratic", "spec": {}})],
            {},
Author	SHA1	Message	Date
Srikanth Chekuri	e270fd353e	Merge branch 'main' into feat/formula-having	2026-11-09 22:01:47 +05:30
Srikanth Chekuri	b244ff919d	Merge branch 'main' into feat/formula-having	2026-11-09 15:51:08 +05:30
srikanthccv	7065fe11e7	test(querier): reject a formula having on heatmap requests Assisted-by: Claude Fable 5.1	2026-11-09 15:49:13 +05:30
Srikanth Chekuri	38731717d7	Merge branch 'main' into feat/formula-having	2026-11-07 16:59:46 +05:30
srikanthccv	eba2d70f34	chore(querybuilder): group the formula having test imports Assisted-by: Claude Opus 5.5	2026-11-07 12:08:27 +05:30
srikanthccv	3e25917da6	chore: generate openapi spec Assisted-by: Claude Opus 5.5	2026-11-07 09:13:28 +05:30
srikanthccv	9021ced814	feat(querier): apply the having of a formula The querier computes a formula in Go after its queries return, so a formula having cannot run as SQL HAVING. It was accepted and ignored. The having now filters the formula values in Go. It uses the having grammar, validation, and messages of a builder query, with the formula name and __result as the only references. A time series keeps the points that match and drops a series with no points left. A scalar result keeps the rows that match. The having runs before functions, order, limit, and offset, as HAVING does in SQL. A bad having fails the request before any query runs. Assisted-by: Claude Opus 5.5	2026-11-07 09:13:27 +05:30