fix(traces): resolve scope-context intrinsic collision in adjustTraceKey

A scope-context key that shares its name with a span intrinsic (e.g. the
scope's name addressed as {name, scope}) was resolved against the span 'name'
column when no metadata matched. Guard the intrinsic/calculated lookup in
adjustTraceKey so a scope-context key never binds to a non-scope intrinsic;
the intentionally context-blind span<->attribute remapping of legacy fields is
left untouched. This supersedes the AdjustKey change in collision.go, which is
reverted to keep the shared query builder generic.

Assisted-by: Claude Opus 4.8

frontend/src/components/ChangelogModal/__test__/ChangelogRenderer.test.tsx

@@ -8,19 +8,12 @@ import {
 
 import ChangelogRenderer from '../components/ChangelogRenderer';
 
-// Mock react-markdown to render children as plain text and a sample
-// anchor through the `components.a` override
+// Mock react-markdown to just render children as plain text
 jest.mock(
 	'react-markdown',
 	() =>
-		function ReactMarkdown({ children, components }: any) {
-			const Anchor = components?.a;
-			return (
-				<div>
-					{children}
-					{Anchor && <Anchor href="https://signoz.io/docs">docs</Anchor>}
-				</div>
-			);
+		function ReactMarkdown({ children }: any) {
+			return <div>{children}</div>;
 		},
 );
 
@@ -69,14 +62,4 @@ describe('ChangelogRenderer', () => {
 		expect(screen.getByAltText('Media')).toBeInTheDocument();
 		expect(screen.getByText('Description for feature 1')).toBeInTheDocument();
 	});
-
-	it('renders markdown links that open in a new tab', () => {
-		render(<ChangelogRenderer changelog={mockChangelog} />);
-		const links = screen.getAllByRole('link', { name: 'docs' });
-		expect(links.length).toBeGreaterThan(0);
-		links.forEach((link) => {
-			expect(link).toHaveAttribute('target', '_blank');
-			expect(link).toHaveAttribute('rel', 'noopener noreferrer');
-		});
-	});
 });

frontend/src/components/ChangelogModal/components/ChangelogRenderer.tsx

@@ -13,19 +13,6 @@ interface Props {
 	changelog: ChangelogSchema;
 }
 
-interface LinkProps {
-	href?: string;
-	children?: React.ReactNode;
-}
-
-function Link({ href, children }: LinkProps): JSX.Element {
-	return (
-		<a href={href} target="_blank" rel="noopener noreferrer">
-			{children}
-		</a>
-	);
-}
-
 function renderMedia(media: Media): JSX.Element | null {
 	if (SupportedImageTypes.includes(media.ext)) {
 		return (
@@ -75,9 +62,7 @@ function ChangelogRenderer({ changelog }: Props): JSX.Element {
 							<div key={feature.id}>
 								<div className="changelog-renderer-section-title">{feature.title}</div>
 								{feature.media && renderMedia(feature.media)}
-								<ReactMarkdown components={{ a: Link }}>
-									{feature.description}
-								</ReactMarkdown>
+								<ReactMarkdown>{feature.description}</ReactMarkdown>
 							</div>
 						))}
 					</div>
@@ -86,9 +71,7 @@ function ChangelogRenderer({ changelog }: Props): JSX.Element {
 					<div className="changelog-renderer-bug-fixes">
 						<div className="changelog-renderer-section-title">Bug Fixes</div>
 						{changelog.bug_fixes && (
-							<ReactMarkdown components={{ a: Link }}>
-								{changelog.bug_fixes}
-							</ReactMarkdown>
+							<ReactMarkdown>{changelog.bug_fixes}</ReactMarkdown>
 						)}
 					</div>
 				)}
@@ -96,9 +79,7 @@ function ChangelogRenderer({ changelog }: Props): JSX.Element {
 					<div className="changelog-renderer-maintenance">
 						<div className="changelog-renderer-section-title">Maintenance</div>
 						{changelog.maintenance && (
-							<ReactMarkdown components={{ a: Link }}>
-								{changelog.maintenance}
-							</ReactMarkdown>
+							<ReactMarkdown>{changelog.maintenance}</ReactMarkdown>
 						)}
 					</div>
 				)}

frontend/src/components/LogDetail/index.tsx

@@ -100,7 +100,6 @@ function LogDetailInner({
 			// Don't close if clicking on drawer content, overlays, or portal elements
 			if (
 				target.closest('[data-log-detail-ignore="true"]') ||
-				target.closest('.log-detail-drawer') ||
 				target.closest('.cm-tooltip-autocomplete') ||
 				target.closest('.drawer-popover') ||
 				target.closest('.query-status-popover') ||

frontend/src/container/GridCardLayout/__tests__/useResolveQuery.test.tsx

@@ -1,91 +0,0 @@
-import { renderHook } from '@testing-library/react';
-import { PANEL_TYPES } from 'constants/queryBuilder';
-import MockQueryClientProvider from 'providers/test/MockQueryClientProvider';
-import { Query } from 'types/api/queryBuilder/queryBuilderData';
-
-import useUpdatedQuery from '../useResolveQuery';
-
-const mockGetSubstituteVars = jest.fn();
-const mockDynamicVariables: unknown[] = [];
-
-jest.mock('api/dashboard/substitute_vars', () => ({
-	getSubstituteVars: (...args: unknown[]): unknown =>
-		mockGetSubstituteVars(...args),
-}));
-
-jest.mock('api/v5/v5', () => ({
-	prepareQueryRangePayloadV5: (): { queryPayload: unknown } => ({
-		queryPayload: { start: 0, end: 1 },
-	}),
-}));
-
-jest.mock(
-	'lib/newQueryBuilder/queryBuilderMappers/mapQueryDataFromApi',
-	() => ({
-		mapQueryDataFromApi: (): Query => ({ resolved: true }) as unknown as Query,
-	}),
-);
-
-jest.mock('hooks/dashboard/useDashboardVariablesByType', () => ({
-	useDashboardVariablesByType: (): unknown[] => mockDynamicVariables,
-}));
-
-jest.mock('react-redux', () => ({
-	...jest.requireActual('react-redux'),
-	useSelector: (): unknown => ({
-		selectedTime: 'GLOBAL_TIME',
-	}),
-}));
-
-const QUERY = { builder: { queryData: [] } } as unknown as Query;
-
-const WIDGET_CONFIG = {
-	query: QUERY,
-	panelTypes: PANEL_TYPES.TIME_SERIES,
-	timePreferance: 'GLOBAL_TIME' as const,
-};
-
-describe('useResolveQuery', () => {
-	beforeEach(() => {
-		jest.clearAllMocks();
-		mockDynamicVariables.length = 0;
-	});
-
-	it('skips the substitute_vars round-trip when there are no variables', async () => {
-		const { result } = renderHook(() => useUpdatedQuery(), {
-			wrapper: MockQueryClientProvider,
-		});
-
-		const resolved = await result.current.getUpdatedQuery({
-			widgetConfig: WIDGET_CONFIG,
-		});
-
-		expect(mockGetSubstituteVars).not.toHaveBeenCalled();
-		expect(resolved).toBe(QUERY);
-	});
-
-	it('resolves through substitute_vars when the dashboard has variables', async () => {
-		mockGetSubstituteVars.mockResolvedValue({
-			httpStatusCode: 200,
-			data: { compositeQuery: {} },
-		});
-
-		const { result } = renderHook(() => useUpdatedQuery(), {
-			wrapper: MockQueryClientProvider,
-		});
-
-		const resolved = await result.current.getUpdatedQuery({
-			widgetConfig: WIDGET_CONFIG,
-			dashboardData: {
-				data: {
-					variables: {
-						env: { name: 'env', selectedValue: 'prod' },
-					},
-				},
-			},
-		});
-
-		expect(mockGetSubstituteVars).toHaveBeenCalledTimes(1);
-		expect(resolved).toStrictEqual({ resolved: true });
-	});
-});

frontend/src/container/GridCardLayout/useResolveQuery.ts

@@ -2,7 +2,6 @@ import { useCallback } from 'react';
 import { useMutation } from 'react-query';
 // eslint-disable-next-line no-restricted-imports
 import { useSelector } from 'react-redux';
-import { isEmpty } from 'lodash-es';
 import { getSubstituteVars } from 'api/dashboard/substitute_vars';
 import { prepareQueryRangePayloadV5 } from 'api/v5/v5';
 import { PANEL_TYPES } from 'constants/queryBuilder';
@@ -47,21 +46,13 @@ function useUpdatedQuery(): UseUpdatedQueryResult {
 			widgetConfig,
 			dashboardData,
 		}: UseUpdatedQueryOptions): Promise<Query> => {
-			const variables = getDashboardVariables(dashboardData?.data?.variables);
-
-			// `/substitute_vars` only rewrites `$variable` references, so on surfaces with no
-			// dashboard behind them (APM, Celery, API monitoring) the round-trip is a no-op.
-			if (isEmpty(variables) && isEmpty(dashboardDynamicVariables)) {
-				return widgetConfig.query;
-			}
-
 			// Prepare query payload with resolved variables
 			const { queryPayload } = prepareQueryRangePayloadV5({
 				query: widgetConfig.query,
 				graphType: getGraphType(widgetConfig.panelTypes),
 				selectedTime: widgetConfig.timePreferance,
 				globalSelectedInterval,
-				variables,
+				variables: getDashboardVariables(dashboardData?.data?.variables),
 				originalGraphType: widgetConfig.panelTypes,
 				dynamicVariables: dashboardDynamicVariables,
 			});

frontend/src/container/InfraMonitoringK8sV2/Base/K8sExpandedRow.tsx

@@ -37,7 +37,7 @@ import { useInfraMonitoringFontSize } from './useInfraMonitoringTablePreferences
 import styles from './K8sExpandedRow.module.scss';
 import { buildExpressionFromGroupMeta } from './utils';
 import { logInfraColumnSortedEvent } from 'container/InfraMonitoringK8sV2/Base/events';
-import { getUnstableCurrentSearchParams } from 'utils/getUnstableCurrentSearchParams';
+import { getUnstableCurrentSearchParams } from 'container/TopNav/DateTimeSelectionV2/utils/getUnstableCurrentSearchParams';
 import { QueryParams } from 'constants/query';
 
 const EXPANDED_ROW_LIMIT = 10;

frontend/src/container/LLMObservability/Overview/Overview.tsx

@@ -9,11 +9,7 @@ function Overview(): JSX.Element {
 
 	return (
 		<div className={styles.overview} data-testid="llm-observability-overview">
-			<DashboardContainer
-				dashboard={dashboard}
-				refetch={refetch}
-				canEditDashboardOverride={false}
-			/>
+			<DashboardContainer dashboard={dashboard} refetch={refetch} />
 		</div>
 	);
 }

frontend/src/container/LLMObservability/Overview/json/dashboard.json

@@ -1,7 +1,7 @@
 {
   "id": "llm-observability-overview",
   "orgId": "",
-  "locked": false,
+  "locked": true,
   "name": "AI Observability Overview",
   "schemaVersion": "v6",
   "source": "system",
@@ -1146,4 +1146,4 @@
       }
     ]
   }
-}
+}

frontend/src/container/MetricsApplication/Tabs/Overview.tsx

@@ -124,9 +124,6 @@ function Application(): JSX.Element {
 				start: minTime,
 				end: maxTime,
 			}),
-		// the time range is part of the key, so without this every window change blanks the
-		// operations list and the widgets below are rebuilt with an empty `operation in []`
-		keepPreviousData: true,
 	});
 
 	const selectedTraceTags: string = JSON.stringify(

frontend/src/container/QueryTable/Drilldown/__tests__/useBaseAggregateOptions.test.tsx

@@ -1,88 +0,0 @@
-import { renderHook, waitFor } from '@testing-library/react';
-import { Query } from 'types/api/queryBuilder/queryBuilderData';
-
-import useBaseAggregateOptions from '../useBaseAggregateOptions';
-
-const mockGetUpdatedQuery = jest.fn();
-const mockNotificationsError = jest.fn();
-
-jest.mock('container/GridCardLayout/useResolveQuery', () => ({
-	__esModule: true,
-	default: (): unknown => ({
-		getUpdatedQuery: mockGetUpdatedQuery,
-		isLoading: false,
-	}),
-}));
-
-jest.mock('hooks/useNotifications', () => ({
-	useNotifications: (): unknown => ({
-		notifications: { error: mockNotificationsError },
-	}),
-}));
-
-jest.mock('providers/Dashboard/store/useDashboardStore', () => ({
-	useDashboardStore: (): unknown => ({ dashboardData: undefined }),
-}));
-
-jest.mock('hooks/dashboard/useContextVariables', () => ({
-	__esModule: true,
-	default: (): unknown => ({ processedVariables: {} }),
-}));
-
-jest.mock('hooks/useSafeNavigate', () => ({
-	useSafeNavigate: (): unknown => ({ safeNavigate: jest.fn() }),
-}));
-
-jest.mock('react-router-dom', () => ({
-	...jest.requireActual('react-router-dom'),
-	useLocation: (): { pathname: string } => ({ pathname: '/services/socky-api' }),
-}));
-
-const QUERY = {
-	builder: {
-		queryData: [{ queryName: 'A', dataSource: 'traces', aggregations: [] }],
-	},
-} as unknown as Query;
-
-const AGGREGATE_DATA = { queryName: 'A', filters: [] };
-
-const renderOptions = (): ReturnType<typeof renderHook> =>
-	renderHook(() =>
-		useBaseAggregateOptions({
-			query: QUERY,
-			onClose: jest.fn(),
-			subMenu: '',
-			setSubMenu: jest.fn(),
-			aggregateData: AGGREGATE_DATA,
-			fieldVariables: {},
-		}),
-	);
-
-describe('useBaseAggregateOptions', () => {
-	beforeEach(() => {
-		jest.clearAllMocks();
-	});
-
-	it('notifies and keeps the unresolved query when variable resolution fails', async () => {
-		mockGetUpdatedQuery.mockRejectedValue(
-			new Error('syntax errors in expression'),
-		);
-
-		renderOptions();
-
-		await waitFor(() =>
-			expect(mockNotificationsError).toHaveBeenCalledWith({
-				message: 'Unable to resolve variables',
-			}),
-		);
-	});
-
-	it('does not notify when variable resolution succeeds', async () => {
-		mockGetUpdatedQuery.mockResolvedValue(QUERY);
-
-		renderOptions();
-
-		await waitFor(() => expect(mockGetUpdatedQuery).toHaveBeenCalled());
-		expect(mockNotificationsError).not.toHaveBeenCalled();
-	});
-});

frontend/src/container/QueryTable/Drilldown/useBaseAggregateOptions.tsx

@@ -6,7 +6,6 @@ import { PANEL_TYPES } from 'constants/queryBuilder';
 import useUpdatedQuery from 'container/GridCardLayout/useResolveQuery';
 import { processContextLinks } from 'container/NewWidget/RightContainer/ContextLinks/utils';
 import useContextVariables from 'hooks/dashboard/useContextVariables';
-import { useNotifications } from 'hooks/useNotifications';
 import ContextMenu from 'periscope/components/ContextMenu';
 import { useDashboardStore } from 'providers/Dashboard/store/useDashboardStore';
 import { ContextLinksData } from 'types/api/dashboard/getAll';
@@ -51,25 +50,23 @@ const useBaseAggregateOptions = ({
 	const { getUpdatedQuery, isLoading: isResolveQueryLoading } =
 		useUpdatedQuery();
 	const { dashboardData } = useDashboardStore();
-	const { notifications } = useNotifications();
 
 	useEffect(() => {
 		if (!aggregateData) {
 			return;
 		}
-		getUpdatedQuery({
-			widgetConfig: {
-				query,
-				panelTypes: panelType || PANEL_TYPES.TIME_SERIES,
-				timePreferance: 'GLOBAL_TIME',
-			},
-			dashboardData,
-		})
-			.then(setResolvedQuery)
-			.catch(() => {
-				setResolvedQuery(query);
-				notifications.error({ message: 'Unable to resolve variables' });
+		const resolveQuery = async (): Promise<void> => {
+			const updatedQuery = await getUpdatedQuery({
+				widgetConfig: {
+					query,
+					panelTypes: panelType || PANEL_TYPES.TIME_SERIES,
+					timePreferance: 'GLOBAL_TIME',
+				},
+				dashboardData,
 			});
+			setResolvedQuery(updatedQuery);
+		};
+		resolveQuery();
 		// eslint-disable-next-line react-hooks/exhaustive-deps
 	}, [query, aggregateData, panelType]);
 

frontend/src/container/TopNav/DateTimeSelectionV2/__tests__/DateTimeSelectionV2.edge-cases.test.tsx

@@ -10,7 +10,7 @@ import DateTimeSelection from '../index';
 import {
 	__resetSearchParamsGetter,
 	__setSearchParamsGetterForTest,
-} from 'utils/getUnstableCurrentSearchParams';
+} from '../utils/getUnstableCurrentSearchParams';
 import { queryClient, TestWrapper } from './testUtils';
 
 const mockSafeNavigate = jest.fn();

frontend/src/container/TopNav/DateTimeSelectionV2/__tests__/DateTimeSelectionV2.modal-mode.test.tsx

@@ -10,7 +10,7 @@ import DateTimeSelection from '../index';
 import {
 	__resetSearchParamsGetter,
 	__setSearchParamsGetterForTest,
-} from 'utils/getUnstableCurrentSearchParams';
+} from '../utils/getUnstableCurrentSearchParams';
 import { queryClient, TestWrapper } from './testUtils';
 
 const mockSafeNavigate = jest.fn();

frontend/src/container/TopNav/DateTimeSelectionV2/__tests__/DateTimeSelectionV2.regression.test.tsx

@@ -24,7 +24,7 @@ import DateTimeSelection from '../index';
 import {
 	__resetSearchParamsGetter,
 	__setSearchParamsGetterForTest,
-} from 'utils/getUnstableCurrentSearchParams';
+} from '../utils/getUnstableCurrentSearchParams';
 
 const queryClient = new QueryClient({
 	defaultOptions: {

frontend/src/container/TopNav/DateTimeSelectionV2/__tests__/DateTimeSelectionV2.routes.test.tsx

@@ -5,7 +5,7 @@ import DateTimeSelection from '../index';
 import {
 	__resetSearchParamsGetter,
 	__setSearchParamsGetterForTest,
-} from 'utils/getUnstableCurrentSearchParams';
+} from '../utils/getUnstableCurrentSearchParams';
 import { queryClient, TestWrapper } from './testUtils';
 
 const mockSafeNavigate = jest.fn();

frontend/src/container/TopNav/DateTimeSelectionV2/__tests__/DateTimeSelectionV2.time-selection.test.tsx

@@ -10,7 +10,7 @@ import DateTimeSelection from '../index';
 import {
 	__resetSearchParamsGetter,
 	__setSearchParamsGetterForTest,
-} from 'utils/getUnstableCurrentSearchParams';
+} from '../utils/getUnstableCurrentSearchParams';
 import { queryClient, TestWrapper, createMockMoment } from './testUtils';
 
 const mockSafeNavigate = jest.fn();

frontend/src/container/TopNav/DateTimeSelectionV2/index.tsx

@@ -54,7 +54,7 @@ import {
 	Time,
 	TimeRange,
 } from './types';
-import { getUnstableCurrentSearchParams } from 'utils/getUnstableCurrentSearchParams';
+import { getUnstableCurrentSearchParams } from './utils/getUnstableCurrentSearchParams';
 
 import './DateTimeSelectionV2.styles.scss';
 

frontend/src/pages/DashboardPageV2/DashboardContainer/DashboardPageToolbar/DashboardActions/DashboardActions.tsx

@@ -189,8 +189,7 @@ function DashboardActions({
 				onClick: (): void => void handleClone(),
 			});
 		}
-
-		if (canEditDashboard && (isAuthor || user.role === USER_ROLES.ADMIN)) {
+		if (isAuthor || user.role === USER_ROLES.ADMIN) {
 			dashboardGroup.push({
 				key: 'lock',
 				label: isDashboardLocked ? 'Unlock dashboard' : 'Lock dashboard',

frontend/src/pages/DashboardPageV2/DashboardContainer/PanelsAndSectionsLayout/Panel/__tests__/useViewPanel.addons.test.tsx

@@ -46,11 +46,23 @@ beforeAll(() => {
 });
 
 // jest.config maps the real hook to a no-op mock; this suite needs real navigation.
-jest.mock('hooks/useSafeNavigate', () =>
-	jest
-		.requireActual('tests/browser-history-safe-navigate')
-		.createBrowserHistorySafeNavigateMock(),
-);
+jest.mock('hooks/useSafeNavigate', () => {
+	const { useHistory } = jest.requireActual('react-router-dom');
+	return {
+		useSafeNavigate: (): unknown => {
+			const history = useHistory();
+			return {
+				safeNavigate: (to: string, opts?: { replace?: boolean }): void => {
+					if (opts?.replace) {
+						history.replace(to);
+					} else {
+						history.push(to);
+					}
+				},
+			};
+		},
+	};
+});
 
 jest.mock('api/querySuggestions/getKeySuggestions', () => ({
 	getKeySuggestions: jest
@@ -192,12 +204,9 @@ function Harness(): JSX.Element {
 	);
 }
 
-const INITIAL_ROUTE = '/dashboard/dash-1';
-
 const renderHarness = (): void => {
-	window.history.replaceState(null, '', INITIAL_ROUTE);
 	render(
-		<MemoryRouter initialEntries={[INITIAL_ROUTE]}>
+		<MemoryRouter initialEntries={['/dashboard/dash-1']}>
 			<CompatRouter>
 				<QueryClientProvider client={new QueryClient()}>
 					<ReduxProvider store={configureStore([])(appStore.getState())}>

frontend/src/pages/DashboardPageV2/DashboardContainer/PanelsAndSectionsLayout/Panel/__tests__/useViewPanel.promql.test.tsx

@@ -16,11 +16,23 @@ import ViewPanelModal from '../ViewPanelModal/ViewPanelModal';
 import { useViewPanel } from '../hooks/useViewPanel';
 
 // jest.config maps the real hook to a no-op mock; this suite needs real navigation.
-jest.mock('hooks/useSafeNavigate', () =>
-	jest
-		.requireActual('tests/browser-history-safe-navigate')
-		.createBrowserHistorySafeNavigateMock(),
-);
+jest.mock('hooks/useSafeNavigate', () => {
+	const { useHistory } = jest.requireActual('react-router-dom');
+	return {
+		useSafeNavigate: (): unknown => {
+			const history = useHistory();
+			return {
+				safeNavigate: (to: string, opts?: { replace?: boolean }): void => {
+					if (opts?.replace) {
+						history.replace(to);
+					} else {
+						history.push(to);
+					}
+				},
+			};
+		},
+	};
+});
 
 jest.mock(
 	'pages/DashboardPageV2/DashboardContainer/hooks/usePanelQuery',
@@ -138,12 +150,9 @@ function Harness(): JSX.Element {
 	);
 }
 
-const INITIAL_ROUTE = '/dashboard/dash-1';
-
 const renderHarness = (): void => {
-	window.history.replaceState(null, '', INITIAL_ROUTE);
 	render(
-		<MemoryRouter initialEntries={[INITIAL_ROUTE]}>
+		<MemoryRouter initialEntries={['/dashboard/dash-1']}>
 			<CompatRouter>
 				<QueryClientProvider client={new QueryClient()}>
 					<ReduxProvider store={configureStore([])(appStore.getState())}>

frontend/src/pages/DashboardPageV2/DashboardContainer/PanelsAndSectionsLayout/Panel/__tests__/useViewPanel.test.tsx

@@ -14,11 +14,23 @@ import { useViewPanelMode } from '../ViewPanelModal/useViewPanelMode';
 import { useViewPanel } from '../hooks/useViewPanel';
 
 // jest.config maps the real hook to a no-op mock; this suite needs real navigation.
-jest.mock('hooks/useSafeNavigate', () =>
-	jest
-		.requireActual('tests/browser-history-safe-navigate')
-		.createBrowserHistorySafeNavigateMock(),
-);
+jest.mock('hooks/useSafeNavigate', () => {
+	const { useHistory } = jest.requireActual('react-router-dom');
+	return {
+		useSafeNavigate: (): unknown => {
+			const history = useHistory();
+			return {
+				safeNavigate: (to: string, opts?: { replace?: boolean }): void => {
+					if (opts?.replace) {
+						history.replace(to);
+					} else {
+						history.push(to);
+					}
+				},
+			};
+		},
+	};
+});
 
 jest.mock(
 	'pages/DashboardPageV2/DashboardContainer/hooks/usePanelQuery',
@@ -172,12 +184,9 @@ function Harness(): JSX.Element {
 	);
 }
 
-const INITIAL_ROUTE = '/dashboard/dash-1';
-
 const renderHarness = (): void => {
-	window.history.replaceState(null, '', INITIAL_ROUTE);
 	render(
-		<MemoryRouter initialEntries={[INITIAL_ROUTE]}>
+		<MemoryRouter initialEntries={['/dashboard/dash-1']}>
 			<CompatRouter>
 				<QueryBuilderProvider>
 					<Harness />

frontend/src/pages/DashboardPageV2/DashboardContainer/index.tsx

@@ -19,20 +19,11 @@ import { resolveDashboardImage } from 'pages/DashboardPageV2/DashboardContainer/
 interface DashboardContainerProps {
 	dashboard: DashboardtypesGettableDashboardV2DTO;
 	refetch: () => void;
-	/**
-	 * @deprecated
-	 * `canEditDashboardOverride` is a temporary solution to allow the dashboard to be view only.
-	 * This is only used for LLM Observability.
-	 * It will be removed in the future.
-	 *  TODO: @Ashwin / @Abhi — remove when the final solution is implemented.
-	 */
-	canEditDashboardOverride?: boolean;
 }
 
 function DashboardContainer({
 	dashboard,
 	refetch,
-	canEditDashboardOverride,
 }: DashboardContainerProps): JSX.Element {
 	const spec = dashboard.spec;
 	const image = resolveDashboardImage(dashboard.image);
@@ -54,11 +45,10 @@ function DashboardContainer({
 	// Seed during render (not an effect) so the first Panel render already sees the id —
 	// useDashboardFetchRequired throws on a missing id. setEditContext self-guards.
 	const setEditContext = useDashboardStore((s) => s.setEditContext);
-
 	setEditContext({
 		dashboardId: dashboard.id,
 		isLocked,
-		canEditDashboard: canEditDashboardOverride ?? canEditDashboard,
+		canEditDashboard,
 		refetch,
 	});
 

frontend/src/providers/QueryBuilder.tsx

@@ -37,6 +37,7 @@ import { OptionsQuery } from 'container/OptionsMenu/types';
 import { useGetCompositeQueryParam } from 'hooks/queryBuilder/useGetCompositeQueryParam';
 import { updateStepInterval } from 'hooks/queryBuilder/useStepInterval';
 import { useSafeNavigate } from 'hooks/useSafeNavigate';
+import useUrlQuery from 'hooks/useUrlQuery';
 import { createIdFromObjectFields } from 'lib/createIdFromObjectFields';
 import { createNewBuilderItemName } from 'lib/newQueryBuilder/createNewBuilderItemName';
 import { getOperatorsBySourceAndPanelType } from 'lib/newQueryBuilder/getOperatorsBySourceAndPanelType';
@@ -65,7 +66,6 @@ import {
 } from 'types/common/queryBuilder';
 import { sanitizeOrderByForExplorer } from 'utils/sanitizeOrderBy';
 import { v4 as uuid } from 'uuid';
-import { getUnstableCurrentSearchParams } from 'utils/getUnstableCurrentSearchParams';
 
 export const QueryBuilderContext = createContext<QueryBuilderContextType>({
 	currentQuery: initialQueriesMap.metrics,
@@ -105,6 +105,7 @@ export const QueryBuilderContext = createContext<QueryBuilderContextType>({
 export function QueryBuilderProvider({
 	children,
 }: PropsWithChildren): JSX.Element {
+	const urlQuery = useUrlQuery();
 	const location = useLocation();
 
 	const currentPathnameRef = useRef<string | null>(location.pathname);
@@ -121,7 +122,7 @@ export function QueryBuilderProvider({
 		null,
 	);
 
-	const panelTypeQueryParams = getUnstableCurrentSearchParams().get(
+	const panelTypeQueryParams = urlQuery.get(
 		QueryParams.panelTypes,
 	) as PANEL_TYPES | null;
 
@@ -975,7 +976,6 @@ export function QueryBuilderProvider({
 				unit: query.unit || initialQueryState.unit,
 			};
 
-			const urlQuery = getUnstableCurrentSearchParams();
 			const pagination = urlQuery.get(QueryParams.pagination);
 
 			if (pagination) {
@@ -1014,7 +1014,7 @@ export function QueryBuilderProvider({
 
 			safeNavigate(generatedUrl, { newTab });
 		},
-		[location.pathname, safeNavigate],
+		[location.pathname, safeNavigate, urlQuery],
 	);
 
 	const handleSetConfig = useCallback(

frontend/src/tests/browser-history-safe-navigate.ts

@@ -1,54 +0,0 @@
-// Mock factory for suites that need `useSafeNavigate` to navigate for real.
-//
-// `jest.config.ts` maps every `hooks/useSafeNavigate` import to the no-op
-// `__tests__/safeNavigateMock.ts`, so a suite that drives navigation has to opt
-// out with its own `jest.mock`.
-//
-// In production `safeNavigate` goes through `createBrowserHistory`, which writes
-// `window.location` as well as notifying the router. `MemoryRouter` never touches
-// `window`, so anything reading `getUnstableCurrentSearchParams()` sees an empty
-// search and drops the params the test just navigated with. This mock writes both.
-//
-// The `jest.mock` factory is hoisted above imports, so require it inside:
-//
-//   jest.mock('hooks/useSafeNavigate', () =>
-//     jest
-//       .requireActual('tests/browser-history-safe-navigate')
-//       .createBrowserHistorySafeNavigateMock(),
-//   );
-
-import type { History } from 'history';
-
-interface SafeNavigateOptions {
-	replace?: boolean;
-}
-
-interface UseSafeNavigateModule {
-	useSafeNavigate: () => {
-		safeNavigate: (to: string, options?: SafeNavigateOptions) => void;
-	};
-}
-
-export function createBrowserHistorySafeNavigateMock(): UseSafeNavigateModule {
-	const { useHistory } = jest.requireActual<{ useHistory: () => History }>(
-		'react-router-dom',
-	);
-
-	return {
-		useSafeNavigate: () => {
-			const history = useHistory();
-
-			return {
-				safeNavigate: (to: string, options?: SafeNavigateOptions): void => {
-					if (options?.replace) {
-						window.history.replaceState(null, '', to);
-						history.replace(to);
-					} else {
-						window.history.pushState(null, '', to);
-						history.push(to);
-					}
-				},
-			};
-		},
-	};
-}

pkg/alertmanager/alertmanagernotify/googlechat/googlechat.go

@@ -7,6 +7,7 @@ import (
 	"fmt"
 	"log/slog"
 	"net/http"
+	"net/url"
 	"unicode/utf8"
 
 	"github.com/SigNoz/signoz/pkg/alertmanager/alertmanagertemplate"
@@ -185,7 +186,18 @@ func (n *Notifier) Notify(ctx context.Context, alerts ...*types.Alert) (bool, er
 		}
 	}
 
-	resp, err := notify.PostJSON(ctx, n.client, n.conf.WebhookURL.String(), buf) //nolint:bodyclose
+	// Thread same-rule alerts together: threadKey is a stable hash of the
+	// alert group key. Changing a rule's grouping starts a new thread.
+	u, err := url.Parse(n.conf.WebhookURL.String())
+	if err != nil {
+		return false, errors.WrapInternalf(err, errors.CodeInternal, "parse google chat webhook url")
+	}
+	q := u.Query()
+	q.Set("threadKey", key.Hash())
+	q.Set("messageReplyOption", "REPLY_MESSAGE_FALLBACK_TO_NEW_THREAD")
+	u.RawQuery = q.Encode()
+
+	resp, err := notify.PostJSON(ctx, n.client, u.String(), buf) //nolint:bodyclose
 	if err != nil {
 		return true, notify.RedactURL(err)
 	}

pkg/alertmanager/alertmanagernotify/googlechat/googlechat_test.go

@@ -245,7 +245,7 @@ func TestGoogleChatMessageSizeLimit(t *testing.T) {
 	assert.LessOrEqual(t, bodyLen, maxMessageBytes, "posted body must be within the size limit")
 }
 
-func TestGoogleChatWebhookURLVerbatim(t *testing.T) {
+func TestGoogleChatThreading(t *testing.T) {
 	var query url.Values
 	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		query = r.URL.Query()
@@ -253,11 +253,25 @@ func TestGoogleChatWebhookURLVerbatim(t *testing.T) {
 	}))
 	defer server.Close()
 
-	n := newTestNotifier(t, server.URL+"?key=abc&token=xyz", "T", "")
-	_, err := n.Notify(newTestContext(), newTestAlerts("X")...)
-	require.NoError(t, err)
+	cases := []struct{ name, groupKey string }{
+		{"rule a", "{ruleId=\"aaa\"}"},
+		{"rule b", "{ruleId=\"bbb\"}"},
+	}
+	seen := map[string]string{}
+	for _, c := range cases {
+		t.Run(c.name, func(t *testing.T) {
+			n := newTestNotifier(t, server.URL, "T", "")
+			ctx := notify.WithGroupKey(context.Background(), c.groupKey)
+			_, err := n.Notify(ctx, newTestAlerts("X")...)
+			require.NoError(t, err)
 
-	assert.Equal(t, url.Values{"key": {"abc"}, "token": {"xyz"}}, query, "configured webhook URL must be posted verbatim, with no params added")
+			assert.Equal(t, "REPLY_MESSAGE_FALLBACK_TO_NEW_THREAD", query.Get("messageReplyOption"))
+			threadKey := query.Get("threadKey")
+			assert.Equal(t, notify.Key(c.groupKey).Hash(), threadKey, "threadKey must be the group key hash")
+			seen[c.name] = threadKey
+		})
+	}
+	assert.NotEqual(t, seen["rule a"], seen["rule b"], "distinct group keys must yield distinct threadKeys")
 }
 
 func TestGoogleChatCustomTemplateMarkdown(t *testing.T) {

pkg/modules/cloudintegration/implcloudintegration/fs/definitions/aws/lambda/assets/dashboards/overview.json

@@ -51,28 +51,6 @@
           },
           "name": "Region"
         }
-      },
-      {
-        "kind": "ListVariable",
-        "spec": {
-          "display": {
-            "name": "FunctionName",
-            "description": "Name of the Lambda function"
-          },
-          "allowAllValue": true,
-          "allowMultiple": true,
-          "customAllValue": "",
-          "capturingRegexp": "",
-          "sort": "none",
-          "plugin": {
-            "kind": "signoz/DynamicVariable",
-            "spec": {
-              "name": "FunctionName",
-              "signal": "metrics"
-            }
-          },
-          "name": "FunctionName"
-        }
       }
     ],
     "panels": {
@@ -140,7 +118,7 @@
                     ],
                     "disabled": false,
                     "filter": {
-                      "expression": "(cloud.account.id = $Account AND cloud.region = $Region AND FunctionName EXISTS AND Resource NOT EXISTS) AND FunctionName IN $FunctionName"
+                      "expression": "(cloud.account.id = $Account AND cloud.region = $Region AND FunctionName EXISTS AND Resource NOT EXISTS)"
                     },
                     "groupBy": [
                       {
@@ -240,7 +218,7 @@
                     ],
                     "disabled": false,
                     "filter": {
-                      "expression": "(cloud.account.id = $Account AND cloud.region = $Region AND FunctionName EXISTS AND Resource NOT EXISTS) AND FunctionName IN $FunctionName"
+                      "expression": "(cloud.account.id = $Account AND cloud.region = $Region AND FunctionName EXISTS AND Resource NOT EXISTS)"
                     },
                     "groupBy": [
                       {
@@ -340,7 +318,7 @@
                     ],
                     "disabled": false,
                     "filter": {
-                      "expression": "(cloud.account.id = $Account AND cloud.region = $Region AND FunctionName EXISTS AND Resource NOT EXISTS) AND FunctionName IN $FunctionName"
+                      "expression": "(cloud.account.id = $Account AND cloud.region = $Region AND FunctionName EXISTS AND Resource NOT EXISTS)"
                     },
                     "groupBy": [
                       {
@@ -440,7 +418,7 @@
                     ],
                     "disabled": false,
                     "filter": {
-                      "expression": "(cloud.account.id = $Account AND cloud.region = $Region AND FunctionName EXISTS AND Resource NOT EXISTS) AND FunctionName IN $FunctionName"
+                      "expression": "(cloud.account.id = $Account AND cloud.region = $Region AND FunctionName EXISTS AND Resource NOT EXISTS)"
                     },
                     "groupBy": [
                       {
@@ -540,7 +518,7 @@
                     ],
                     "disabled": false,
                     "filter": {
-                      "expression": "(cloud.account.id = $Account AND cloud.region = $Region AND FunctionName EXISTS AND Resource NOT EXISTS) AND FunctionName IN $FunctionName"
+                      "expression": "(cloud.account.id = $Account AND cloud.region = $Region AND FunctionName EXISTS AND Resource NOT EXISTS)"
                     },
                     "groupBy": [
                       {
@@ -640,7 +618,7 @@
                     ],
                     "disabled": false,
                     "filter": {
-                      "expression": "(cloud.account.id = $Account AND cloud.region = $Region AND FunctionName EXISTS AND Resource NOT EXISTS) AND FunctionName IN $FunctionName"
+                      "expression": "(cloud.account.id = $Account AND cloud.region = $Region AND FunctionName EXISTS AND Resource NOT EXISTS)"
                     },
                     "groupBy": [
                       {
@@ -740,7 +718,7 @@
                     ],
                     "disabled": false,
                     "filter": {
-                      "expression": "(cloud.account.id = $Account AND cloud.region = $Region AND FunctionName EXISTS AND Resource NOT EXISTS) AND FunctionName IN $FunctionName"
+                      "expression": "(cloud.account.id = $Account AND cloud.region = $Region AND FunctionName EXISTS AND Resource NOT EXISTS)"
                     },
                     "groupBy": [
                       {
@@ -853,4 +831,4 @@
     "refreshInterval": "",
     "links": []
   }
-}
+}

pkg/querybuilder/query_to_keys.go

@@ -56,6 +56,17 @@ func QueryStringToKeysSelectors(query string) []*telemetrytypes.FieldKeySelector
 					FieldDataType: key.FieldDataType,
 				})
 			}
+
+			// todo(tushar): consider reverting changes done to this method in below PR to avoid scope specific checks
+			// https://github.com/SigNoz/signoz/issues/11374
+			if key.FieldContext == telemetrytypes.FieldContextScope {
+				keys = append(keys, &telemetrytypes.FieldKeySelector{
+					Name:          key.FieldContext.StringValue() + "." + key.Name,
+					Signal:        key.Signal,
+					FieldContext:  telemetrytypes.FieldContextUnspecified, // this allows 'scope.' prefix for keys with other context as well
+					FieldDataType: key.FieldDataType,
+				})
+			}
 		}
 	}
 

pkg/querybuilder/query_to_keys_test.go

@@ -72,6 +72,23 @@ func TestQueryToKeys(t *testing.T) {
 				},
 			},
 		},
+		{
+			query: `scope.version = '1.0.0'`,
+			expectedKeys: []telemetrytypes.FieldKeySelector{
+				{
+					Name:          "version",
+					Signal:        telemetrytypes.SignalUnspecified,
+					FieldContext:  telemetrytypes.FieldContextScope,
+					FieldDataType: telemetrytypes.FieldDataTypeUnspecified,
+				},
+				{
+					Name:          "scope.version",
+					Signal:        telemetrytypes.SignalUnspecified,
+					FieldContext:  telemetrytypes.FieldContextUnspecified,
+					FieldDataType: telemetrytypes.FieldDataTypeUnspecified,
+				},
+			},
+		},
 	}
 
 	for _, testCase := range testCases {

pkg/signoz/provider.go

@@ -242,7 +242,6 @@ func NewSQLMigrationProviderFactories(
 		sqlmigration.NewRestructureAuthDomainConfigFactory(sqlstore),
 		sqlmigration.NewFixSavedViewSelectFieldsFactory(sqlstore),
 		sqlmigration.NewDeleteOrphanUserRolesFactory(),
-		sqlmigration.NewMigrateLambdaDashboardsFactory(),
 	)
 }
 

pkg/sqlmigration/116_migrate_lambda_dashboards.go

@@ -1,160 +0,0 @@
-package sqlmigration
-
-import (
-	"bytes"
-	"context"
-	"embed"
-	"encoding/json"
-	"time"
-
-	"github.com/SigNoz/signoz/pkg/factory"
-	"github.com/uptrace/bun"
-	"github.com/uptrace/bun/migrate"
-)
-
-//go:embed 116_migrate_lambda_dashboards
-var lambdaDashboardFiles embed.FS
-
-// These values mirror the cloud integration and dashboard packages but are duplicated
-// here so this migration keeps targeting and writing the same rows even if those
-// constants are later renamed or changed.
-const (
-	lambdaDashboardFile = "116_migrate_lambda_dashboards/aws/lambda/overview.json"
-
-	lambdaDashboardSlug               = "aws-lambda-overview"
-	cloudIntegrationDashboardProvider = "cloud_integration"
-	integrationDashboardSource        = "integration"
-	dashboardSchemaVersion            = "v6"
-)
-
-type migrateLambdaDashboards struct{}
-
-type lambdaDashboardRow struct {
-	bun.BaseModel `bun:"table:dashboard,alias:dashboard"`
-
-	ID   string `bun:"id"`
-	Data string `bun:"data"`
-}
-
-// lambdaDashboardDefinition is the part of the embedded dashboard this migration reads:
-// its spec, which is what the cloud integration stores under data.spec.
-type lambdaDashboardDefinition struct {
-	Spec map[string]any `json:"spec"`
-}
-
-func NewMigrateLambdaDashboardsFactory() factory.ProviderFactory[SQLMigration, Config] {
-	return factory.NewProviderFactory(
-		factory.MustNewName("migrate_lambda_dashboards"),
-		func(ctx context.Context, ps factory.ProviderSettings, c Config) (SQLMigration, error) {
-			return &migrateLambdaDashboards{}, nil
-		},
-	)
-}
-
-func (m *migrateLambdaDashboards) Register(migrations *migrate.Migrations) error {
-	return migrations.Register(m.Up, m.Down)
-}
-
-// Up rewrites the spec of every provisioned AWS Lambda overview dashboard to the
-// embedded revision that added the FunctionName variable. Cloud integration dashboards
-// are provisioned once and never updated afterwards, so existing installs only pick up
-// this change through a migration. Only the spec is replaced; the row keeps its id, name,
-// tags and metadata, so the dashboard is updated in place rather than recreated.
-func (m *migrateLambdaDashboards) Up(ctx context.Context, db *bun.DB) error {
-	spec, err := m.loadSpec()
-	if err != nil {
-		return err
-	}
-
-	tx, err := db.BeginTx(ctx, nil)
-	if err != nil {
-		return err
-	}
-	defer func() { _ = tx.Rollback() }()
-
-	var rows []*lambdaDashboardRow
-	if err := tx.NewSelect().
-		Model(&rows).
-		Join("JOIN integration_dashboard AS id ON id.dashboard_id = dashboard.id").
-		Where("id.provider = ?", cloudIntegrationDashboardProvider).
-		Where("id.slug = ?", lambdaDashboardSlug).
-		Where("dashboard.source = ?", integrationDashboardSource).
-		Scan(ctx); err != nil {
-		return err
-	}
-
-	for _, row := range rows {
-		data := map[string]any{}
-		if err := json.Unmarshal([]byte(row.Data), &data); err != nil {
-			return err
-		}
-
-		// The embedded spec is v6-shaped, so only rewrite a row already carrying a v6 spec;
-		// anything else is left alone rather than turned into a broken mix of versions.
-		if !m.hasV6Spec(data) {
-			continue
-		}
-		data["spec"] = spec
-
-		encoded, err := m.marshalUnescaped(data)
-		if err != nil {
-			return err
-		}
-		// Skip rows already carrying this spec so a re-run does not needlessly rewrite them.
-		if string(encoded) == row.Data {
-			continue
-		}
-
-		if _, err := tx.NewUpdate().
-			Model((*lambdaDashboardRow)(nil)).
-			Set("data = ?", string(encoded)).
-			Set("updated_at = ?", time.Now()).
-			Where("id = ?", row.ID).
-			Exec(ctx); err != nil {
-			return err
-		}
-	}
-
-	return tx.Commit()
-}
-
-func (m *migrateLambdaDashboards) Down(context.Context, *bun.DB) error {
-	return nil
-}
-
-// hasV6Spec reports whether the stored data is a v6 dashboard with a spec object, which
-// is the shape whose spec this migration replaces.
-func (m *migrateLambdaDashboards) hasV6Spec(data map[string]any) bool {
-	metadata, _ := data["metadata"].(map[string]any)
-	version, _ := metadata["schemaVersion"].(string)
-	if version != dashboardSchemaVersion {
-		return false
-	}
-	_, ok := data["spec"].(map[string]any)
-	return ok
-}
-
-func (m *migrateLambdaDashboards) marshalUnescaped(v any) ([]byte, error) {
-	var buf bytes.Buffer
-	encoder := json.NewEncoder(&buf)
-	encoder.SetEscapeHTML(false)
-	if err := encoder.Encode(v); err != nil {
-		return nil, err
-	}
-
-	return bytes.TrimRight(buf.Bytes(), "\n"), nil
-}
-
-func (m *migrateLambdaDashboards) loadSpec() (map[string]any, error) {
-	raw, err := lambdaDashboardFiles.ReadFile(lambdaDashboardFile)
-	if err != nil {
-		return nil, err
-	}
-
-	var dashboard lambdaDashboardDefinition
-	if err := json.Unmarshal(raw, &dashboard); err != nil {
-		return nil, err
-	}
-
-	return dashboard.Spec, nil
-}

pkg/sqlmigration/116_migrate_lambda_dashboards/aws/lambda/overview.json

@@ -1,856 +0,0 @@
-{
-  "schemaVersion": "v6",
-  "image": "data:image/svg+xml;base64,PHN2ZyB3aWR0aD0iODAwcHgiIGhlaWdodD0iODAwcHgiIHZpZXdCb3g9IjAgMCAxNiAxNiIgeG1sbnM9Imh0dHA6Ly93d3cudzMub3JnLzIwMDAvc3ZnIiBmaWxsPSJub25lIj48cGF0aCBmaWxsPSIjRkE3RTE0IiBkPSJNNy45ODMgOC4zN2MtLjA1My4wNzMtLjA5OC4xMzMtLjE0MS4xOTRMNS43NzUgMTEuNWMtLjY0LjkxLTEuMjgyIDEuODItMS45MjQgMi43M2EuMTI4LjEyOCAwIDAxLS4wOTIuMDUxYy0uOTA2LS4wMDctMS44MTMtLjAxNy0yLjcxOS0uMDI4LS4wMSAwLS4wMi0uMDAzLS4wNC0uMDA2YS40NTUuNDU1IDAgMDEuMDI1LS4wNTMgMTM5NzcuNDk2IDEzOTc3LjQ5NiAwIDAxNS40NDYtOC4xNDZjLjA5Mi0uMTM4LjE4OC0uMjczLjI3NS0uNDEzYS4xNjUuMTY1IDAgMDAuMDE4LS4xMjRjLS4xNjctLjUxNS0uMzM4LTEuMDMtLjUwOC0xLjU0My0uMDczLS4yMi0uMTUtLjQ0LS4yMTgtLjY2LS4wMjItLjA3Mi0uMDU5LS4wOTQtLjEzNC0uMDkzLS41Ny4wMDItMS4xMzYuMDAxLTEuNzA0LjAwMS0uMTA4IDAtLjEwOCAwLS4xMDgtLjEwMyAwLS42NzQgMC0xLjM0Ny0uMDAyLTIuMDIxIDAtLjA3NS4wMjYtLjA5Mi4wOTktLjA5MiAxLjE0My4wMDIgMi4yODYuMDAyIDMuNDMgMGEuMTEzLjExMyAwIDAxLjA3Ni4wMTcuMTA3LjEwNyAwIDAxLjA0NS4wNjEgMTgyNjYuMTg0IDE4MjY2LjE4NCAwIDAwMy45MiA5LjUxYy4yMTguNTMuNDM4IDEuMDU5LjY1NCAxLjU5LjAyNi4wNjQuMDUzLjA3Ni4xMi4wNTYuNi0uMTc4IDEuMi0uMzUyIDEuOC0uNTMxLjA3NS0uMDIzLjEwMi0uMDA4LjEyNi4wNjQuMjA0LjYyLjQxMiAxLjIzOS42MiAxLjg1OGwuMDIuMDczYy0uMDQzLjAxNS0uMDgzLjAzMi0uMTI0LjA0M2wtNC4wODUgMS4yNWMtLjA2NS4wMi0uMDg1IDAtLjEwNi0uMDU0bC0xLjI1LTMuMDQ4LTEuMjI2LTIuOTg0LS4xODMtLjQ0OWMtLjAxLS4wMjYtLjAyMy0uMDQ4LS4wNDMtLjA4N3oiLz48L3N2Zz4=",
-  "name": "",
-  "generateName": true,
-  "tags": [],
-  "spec": {
-    "display": {
-      "name": "AWS Lambda Overview",
-      "description": "Overview of AWS Lambda functions"
-    },
-    "variables": [
-      {
-        "kind": "ListVariable",
-        "spec": {
-          "display": {
-            "name": "Account",
-            "description": "AWS Account"
-          },
-          "allowAllValue": false,
-          "allowMultiple": false,
-          "customAllValue": "",
-          "capturingRegexp": "",
-          "sort": "none",
-          "plugin": {
-            "kind": "signoz/QueryVariable",
-            "spec": {
-              "queryValue": "SELECT JSONExtractString(labels, 'cloud.account.id') as `cloud.account.id`\nFROM signoz_metrics.distributed_time_series_v4_1day\nWHERE \n    metric_name like 'aws_Lambda_Invocations_sum'\nGROUP BY `cloud.account.id`\n\n"
-            }
-          },
-          "name": "Account"
-        }
-      },
-      {
-        "kind": "ListVariable",
-        "spec": {
-          "display": {
-            "name": "Region",
-            "description": "AWS Region"
-          },
-          "allowAllValue": false,
-          "allowMultiple": false,
-          "customAllValue": "",
-          "capturingRegexp": "",
-          "sort": "none",
-          "plugin": {
-            "kind": "signoz/QueryVariable",
-            "spec": {
-              "queryValue": "SELECT JSONExtractString(labels, 'cloud.region') as `cloud.region`\nFROM signoz_metrics.distributed_time_series_v4_1day\nWHERE \n    metric_name like 'aws_Lambda_Invocations_sum'\n    and JSONExtractString(labels, 'cloud.account.id') IN {{.Account}}\nGROUP BY `cloud.region`\n"
-            }
-          },
-          "name": "Region"
-        }
-      },
-      {
-        "kind": "ListVariable",
-        "spec": {
-          "display": {
-            "name": "FunctionName",
-            "description": "Name of the Lambda function"
-          },
-          "allowAllValue": true,
-          "allowMultiple": true,
-          "customAllValue": "",
-          "capturingRegexp": "",
-          "sort": "none",
-          "plugin": {
-            "kind": "signoz/DynamicVariable",
-            "spec": {
-              "name": "FunctionName",
-              "signal": "metrics"
-            }
-          },
-          "name": "FunctionName"
-        }
-      }
-    ],
-    "panels": {
-      "2516c785-b025-49b3-aeb4-a4735ccb2709": {
-        "kind": "Panel",
-        "spec": {
-          "display": {
-            "name": "Errors",
-            "description": "The number of invocations that result in a function error. Function errors include exceptions that your code throws and exceptions that the Lambda runtime throws. The runtime returns errors for issues such as timeouts and configuration errors. To calculate the error rate, divide the value of Errors by the value of Invocations. Note that the timestamp on an error metric reflects when the function was invoked, not when the error occurred.\n\nSee more at https://docs.aws.amazon.com/lambda/latest/dg/monitoring-metrics-types.html"
-          },
-          "plugin": {
-            "kind": "signoz/TimeSeriesPanel",
-            "spec": {
-              "visualization": {
-                "timePreference": "global_time",
-                "fillSpans": false
-              },
-              "formatting": {
-                "unit": "none",
-                "decimalPrecision": "2"
-              },
-              "chartAppearance": {
-                "lineInterpolation": "spline",
-                "showPoints": false,
-                "lineStyle": "solid",
-                "fillMode": "none",
-                "spanGaps": {
-                  "fillOnlyBelow": false,
-                  "fillLessThan": ""
-                }
-              },
-              "axes": {
-                "softMin": 0,
-                "softMax": 0,
-                "isLogScale": false
-              },
-              "legend": {
-                "position": "bottom",
-                "mode": "list",
-                "customColors": null
-              },
-              "thresholds": null
-            }
-          },
-          "queries": [
-            {
-              "kind": "time_series",
-              "spec": {
-                "name": "A",
-                "plugin": {
-                  "kind": "signoz/BuilderQuery",
-                  "spec": {
-                    "name": "A",
-                    "stepInterval": 60,
-                    "signal": "metrics",
-                    "source": "",
-                    "aggregations": [
-                      {
-                        "metricName": "aws_Lambda_Errors_sum",
-                        "temporality": "",
-                        "timeAggregation": "sum",
-                        "spaceAggregation": "sum",
-                        "reduceTo": "avg"
-                      }
-                    ],
-                    "disabled": false,
-                    "filter": {
-                      "expression": "(cloud.account.id = $Account AND cloud.region = $Region AND FunctionName EXISTS AND Resource NOT EXISTS) AND FunctionName IN $FunctionName"
-                    },
-                    "groupBy": [
-                      {
-                        "name": "cloud.account.id",
-                        "signal": "",
-                        "fieldContext": "attribute",
-                        "fieldDataType": "string"
-                      },
-                      {
-                        "name": "cloud.region",
-                        "signal": "",
-                        "fieldContext": "attribute",
-                        "fieldDataType": "string"
-                      },
-                      {
-                        "name": "FunctionName",
-                        "signal": "",
-                        "fieldContext": "attribute",
-                        "fieldDataType": "string"
-                      }
-                    ],
-                    "order": [],
-                    "having": {
-                      "expression": ""
-                    },
-                    "functions": [],
-                    "legend": "{{FunctionName}}"
-                  }
-                }
-              }
-            }
-          ],
-          "links": []
-        }
-      },
-      "4119a1e5-32a8-4859-96e9-a5451114782b": {
-        "kind": "Panel",
-        "spec": {
-          "display": {
-            "name": "Async events dropped",
-            "description": "The number of events that are dropped without successfully executing the function. If you configure a dead-letter queue (DLQ) or OnFailure destination, then events are sent there before they're dropped. Events are dropped for various reasons. For example, events can exceed the maximum event age or exhaust the maximum retry attempts, or reserved concurrency might be set to 0. To troubleshoot why events are dropped, look at the Errors metric to identify function errors and the Throttles metric to identify concurrency issues.\n\nSee more at https://docs.aws.amazon.com/lambda/latest/dg/monitoring-metrics-types.html"
-          },
-          "plugin": {
-            "kind": "signoz/TimeSeriesPanel",
-            "spec": {
-              "visualization": {
-                "timePreference": "global_time",
-                "fillSpans": false
-              },
-              "formatting": {
-                "unit": "none",
-                "decimalPrecision": "2"
-              },
-              "chartAppearance": {
-                "lineInterpolation": "spline",
-                "showPoints": false,
-                "lineStyle": "solid",
-                "fillMode": "none",
-                "spanGaps": {
-                  "fillOnlyBelow": false,
-                  "fillLessThan": ""
-                }
-              },
-              "axes": {
-                "softMin": 0,
-                "softMax": 0,
-                "isLogScale": false
-              },
-              "legend": {
-                "position": "bottom",
-                "mode": "list",
-                "customColors": null
-              },
-              "thresholds": null
-            }
-          },
-          "queries": [
-            {
-              "kind": "time_series",
-              "spec": {
-                "name": "A",
-                "plugin": {
-                  "kind": "signoz/BuilderQuery",
-                  "spec": {
-                    "name": "A",
-                    "stepInterval": 60,
-                    "signal": "metrics",
-                    "source": "",
-                    "aggregations": [
-                      {
-                        "metricName": "aws_Lambda_AsyncEventsDropped_sum",
-                        "temporality": "",
-                        "timeAggregation": "sum",
-                        "spaceAggregation": "sum",
-                        "reduceTo": "avg"
-                      }
-                    ],
-                    "disabled": false,
-                    "filter": {
-                      "expression": "(cloud.account.id = $Account AND cloud.region = $Region AND FunctionName EXISTS AND Resource NOT EXISTS) AND FunctionName IN $FunctionName"
-                    },
-                    "groupBy": [
-                      {
-                        "name": "cloud.account.id",
-                        "signal": "",
-                        "fieldContext": "attribute",
-                        "fieldDataType": "string"
-                      },
-                      {
-                        "name": "cloud.region",
-                        "signal": "",
-                        "fieldContext": "attribute",
-                        "fieldDataType": "string"
-                      },
-                      {
-                        "name": "FunctionName",
-                        "signal": "",
-                        "fieldContext": "attribute",
-                        "fieldDataType": "string"
-                      }
-                    ],
-                    "order": [],
-                    "having": {
-                      "expression": ""
-                    },
-                    "functions": [],
-                    "legend": "{{FunctionName}}"
-                  }
-                }
-              }
-            }
-          ],
-          "links": []
-        }
-      },
-      "6354ea62-e82b-4323-a33d-eef92519e843": {
-        "kind": "Panel",
-        "spec": {
-          "display": {
-            "name": "Throttles",
-            "description": "The number of invocation requests that are throttled. When all function instances are processing requests and no concurrency is available to scale up, Lambda rejects additional requests with a TooManyRequestsException error. Throttled requests and other invocation errors don't count as either Invocations or Errors.\n\nSee more at https://docs.aws.amazon.com/lambda/latest/dg/monitoring-metrics-types.html"
-          },
-          "plugin": {
-            "kind": "signoz/TimeSeriesPanel",
-            "spec": {
-              "visualization": {
-                "timePreference": "global_time",
-                "fillSpans": false
-              },
-              "formatting": {
-                "unit": "none",
-                "decimalPrecision": "2"
-              },
-              "chartAppearance": {
-                "lineInterpolation": "spline",
-                "showPoints": false,
-                "lineStyle": "solid",
-                "fillMode": "none",
-                "spanGaps": {
-                  "fillOnlyBelow": false,
-                  "fillLessThan": ""
-                }
-              },
-              "axes": {
-                "softMin": 0,
-                "softMax": 0,
-                "isLogScale": false
-              },
-              "legend": {
-                "position": "bottom",
-                "mode": "list",
-                "customColors": null
-              },
-              "thresholds": null
-            }
-          },
-          "queries": [
-            {
-              "kind": "time_series",
-              "spec": {
-                "name": "A",
-                "plugin": {
-                  "kind": "signoz/BuilderQuery",
-                  "spec": {
-                    "name": "A",
-                    "stepInterval": 60,
-                    "signal": "metrics",
-                    "source": "",
-                    "aggregations": [
-                      {
-                        "metricName": "aws_Lambda_Throttles_sum",
-                        "temporality": "",
-                        "timeAggregation": "sum",
-                        "spaceAggregation": "sum",
-                        "reduceTo": "avg"
-                      }
-                    ],
-                    "disabled": false,
-                    "filter": {
-                      "expression": "(cloud.account.id = $Account AND cloud.region = $Region AND FunctionName EXISTS AND Resource NOT EXISTS) AND FunctionName IN $FunctionName"
-                    },
-                    "groupBy": [
-                      {
-                        "name": "cloud.account.id",
-                        "signal": "",
-                        "fieldContext": "attribute",
-                        "fieldDataType": "string"
-                      },
-                      {
-                        "name": "cloud.region",
-                        "signal": "",
-                        "fieldContext": "attribute",
-                        "fieldDataType": "string"
-                      },
-                      {
-                        "name": "FunctionName",
-                        "signal": "",
-                        "fieldContext": "attribute",
-                        "fieldDataType": "string"
-                      }
-                    ],
-                    "order": [],
-                    "having": {
-                      "expression": ""
-                    },
-                    "functions": [],
-                    "legend": "{{FunctionName}}"
-                  }
-                }
-              }
-            }
-          ],
-          "links": []
-        }
-      },
-      "853d3a92-b396-4064-8762-18d7487989e0": {
-        "kind": "Panel",
-        "spec": {
-          "display": {
-            "name": "Async events received",
-            "description": "The number of events that Lambda successfully queues for processing. This metric provides insight into the number of events that a Lambda function receives. Monitor this metric and set alarms for thresholds to check for issues. For example, to detect an undesirable number of events sent to Lambda, and to quickly diagnose issues resulting from incorrect trigger or function configurations. Mismatches between AsyncEventsReceived and Invocations can indicate a disparity in processing, events being dropped, or a potential queue backlog.\n\nSee more at https://docs.aws.amazon.com/lambda/latest/dg/monitoring-metrics-types.html"
-          },
-          "plugin": {
-            "kind": "signoz/TimeSeriesPanel",
-            "spec": {
-              "visualization": {
-                "timePreference": "global_time",
-                "fillSpans": false
-              },
-              "formatting": {
-                "unit": "none",
-                "decimalPrecision": "2"
-              },
-              "chartAppearance": {
-                "lineInterpolation": "spline",
-                "showPoints": false,
-                "lineStyle": "solid",
-                "fillMode": "none",
-                "spanGaps": {
-                  "fillOnlyBelow": false,
-                  "fillLessThan": ""
-                }
-              },
-              "axes": {
-                "softMin": 0,
-                "softMax": 0,
-                "isLogScale": false
-              },
-              "legend": {
-                "position": "bottom",
-                "mode": "list",
-                "customColors": null
-              },
-              "thresholds": null
-            }
-          },
-          "queries": [
-            {
-              "kind": "time_series",
-              "spec": {
-                "name": "A",
-                "plugin": {
-                  "kind": "signoz/BuilderQuery",
-                  "spec": {
-                    "name": "A",
-                    "stepInterval": 60,
-                    "signal": "metrics",
-                    "source": "",
-                    "aggregations": [
-                      {
-                        "metricName": "aws_Lambda_AsyncEventsReceived_sum",
-                        "temporality": "",
-                        "timeAggregation": "sum",
-                        "spaceAggregation": "sum",
-                        "reduceTo": "avg"
-                      }
-                    ],
-                    "disabled": false,
-                    "filter": {
-                      "expression": "(cloud.account.id = $Account AND cloud.region = $Region AND FunctionName EXISTS AND Resource NOT EXISTS) AND FunctionName IN $FunctionName"
-                    },
-                    "groupBy": [
-                      {
-                        "name": "cloud.account.id",
-                        "signal": "",
-                        "fieldContext": "attribute",
-                        "fieldDataType": "string"
-                      },
-                      {
-                        "name": "cloud.region",
-                        "signal": "",
-                        "fieldContext": "attribute",
-                        "fieldDataType": "string"
-                      },
-                      {
-                        "name": "FunctionName",
-                        "signal": "",
-                        "fieldContext": "attribute",
-                        "fieldDataType": "string"
-                      }
-                    ],
-                    "order": [],
-                    "having": {
-                      "expression": ""
-                    },
-                    "functions": [],
-                    "legend": "{{FunctionName}}"
-                  }
-                }
-              }
-            }
-          ],
-          "links": []
-        }
-      },
-      "877bb5c8-331c-492f-b666-2054c2ae39bd": {
-        "kind": "Panel",
-        "spec": {
-          "display": {
-            "name": "Invocations",
-            "description": "The number of times that your function code is invoked, including successful invocations and invocations that result in a function error. Invocations aren't recorded if the invocation request is throttled or otherwise results in an invocation error. The value of Invocations equals the number of requests billed.\n\nSee more at https://docs.aws.amazon.com/lambda/latest/dg/monitoring-metrics-types.html"
-          },
-          "plugin": {
-            "kind": "signoz/TimeSeriesPanel",
-            "spec": {
-              "visualization": {
-                "timePreference": "global_time",
-                "fillSpans": false
-              },
-              "formatting": {
-                "unit": "none",
-                "decimalPrecision": "2"
-              },
-              "chartAppearance": {
-                "lineInterpolation": "spline",
-                "showPoints": false,
-                "lineStyle": "solid",
-                "fillMode": "none",
-                "spanGaps": {
-                  "fillOnlyBelow": false,
-                  "fillLessThan": ""
-                }
-              },
-              "axes": {
-                "softMin": 0,
-                "softMax": 0,
-                "isLogScale": false
-              },
-              "legend": {
-                "position": "bottom",
-                "mode": "list",
-                "customColors": null
-              },
-              "thresholds": null
-            }
-          },
-          "queries": [
-            {
-              "kind": "time_series",
-              "spec": {
-                "name": "A",
-                "plugin": {
-                  "kind": "signoz/BuilderQuery",
-                  "spec": {
-                    "name": "A",
-                    "stepInterval": 60,
-                    "signal": "metrics",
-                    "source": "",
-                    "aggregations": [
-                      {
-                        "metricName": "aws_Lambda_Invocations_sum",
-                        "temporality": "",
-                        "timeAggregation": "sum",
-                        "spaceAggregation": "sum",
-                        "reduceTo": "avg"
-                      }
-                    ],
-                    "disabled": false,
-                    "filter": {
-                      "expression": "(cloud.account.id = $Account AND cloud.region = $Region AND FunctionName EXISTS AND Resource NOT EXISTS) AND FunctionName IN $FunctionName"
-                    },
-                    "groupBy": [
-                      {
-                        "name": "cloud.account.id",
-                        "signal": "",
-                        "fieldContext": "attribute",
-                        "fieldDataType": "string"
-                      },
-                      {
-                        "name": "cloud.region",
-                        "signal": "",
-                        "fieldContext": "attribute",
-                        "fieldDataType": "string"
-                      },
-                      {
-                        "name": "FunctionName",
-                        "signal": "",
-                        "fieldContext": "attribute",
-                        "fieldDataType": "string"
-                      }
-                    ],
-                    "order": [],
-                    "having": {
-                      "expression": ""
-                    },
-                    "functions": [],
-                    "legend": "{{FunctionName}}"
-                  }
-                }
-              }
-            }
-          ],
-          "links": []
-        }
-      },
-      "ae6d7c81-d921-4d4c-95ec-6b42d900ea45": {
-        "kind": "Panel",
-        "spec": {
-          "display": {
-            "name": "Max Async Event Age",
-            "description": "The time between when Lambda successfully queues the event and when the function is invoked. The value of this metric increases when events are being retried due to invocation failures or throttling. Monitor this metric and set alarms for thresholds on different statistics for when a queue buildup occurs. To troubleshoot an increase in this metric, look at the Errors metric to identify function errors and the Throttles metric to identify concurrency issues.\n\nSee more at https://docs.aws.amazon.com/lambda/latest/dg/monitoring-metrics-types.html"
-          },
-          "plugin": {
-            "kind": "signoz/TimeSeriesPanel",
-            "spec": {
-              "visualization": {
-                "timePreference": "global_time",
-                "fillSpans": false
-              },
-              "formatting": {
-                "unit": "ms",
-                "decimalPrecision": "2"
-              },
-              "chartAppearance": {
-                "lineInterpolation": "spline",
-                "showPoints": false,
-                "lineStyle": "solid",
-                "fillMode": "none",
-                "spanGaps": {
-                  "fillOnlyBelow": false,
-                  "fillLessThan": ""
-                }
-              },
-              "axes": {
-                "softMin": 0,
-                "softMax": 0,
-                "isLogScale": false
-              },
-              "legend": {
-                "position": "bottom",
-                "mode": "list",
-                "customColors": null
-              },
-              "thresholds": null
-            }
-          },
-          "queries": [
-            {
-              "kind": "time_series",
-              "spec": {
-                "name": "A",
-                "plugin": {
-                  "kind": "signoz/BuilderQuery",
-                  "spec": {
-                    "name": "A",
-                    "stepInterval": 60,
-                    "signal": "metrics",
-                    "source": "",
-                    "aggregations": [
-                      {
-                        "metricName": "aws_Lambda_AsyncEventAge_max",
-                        "temporality": "",
-                        "timeAggregation": "max",
-                        "spaceAggregation": "max",
-                        "reduceTo": "avg"
-                      }
-                    ],
-                    "disabled": false,
-                    "filter": {
-                      "expression": "(cloud.account.id = $Account AND cloud.region = $Region AND FunctionName EXISTS AND Resource NOT EXISTS) AND FunctionName IN $FunctionName"
-                    },
-                    "groupBy": [
-                      {
-                        "name": "cloud.account.id",
-                        "signal": "",
-                        "fieldContext": "attribute",
-                        "fieldDataType": "string"
-                      },
-                      {
-                        "name": "cloud.region",
-                        "signal": "",
-                        "fieldContext": "attribute",
-                        "fieldDataType": "string"
-                      },
-                      {
-                        "name": "FunctionName",
-                        "signal": "",
-                        "fieldContext": "attribute",
-                        "fieldDataType": "string"
-                      }
-                    ],
-                    "order": [],
-                    "having": {
-                      "expression": ""
-                    },
-                    "functions": [],
-                    "legend": "{{FunctionName}}"
-                  }
-                }
-              }
-            }
-          ],
-          "links": []
-        }
-      },
-      "b038520d-0756-4e46-a915-12a2f19a0254": {
-        "kind": "Panel",
-        "spec": {
-          "display": {
-            "name": "Max Duration",
-            "description": "The amount of time that your function code spends processing an event. The billed duration for an invocation is the value of Duration rounded up to the nearest millisecond. Duration does not include cold start time.\n\nSee more at https://docs.aws.amazon.com/lambda/latest/dg/monitoring-metrics-types.html"
-          },
-          "plugin": {
-            "kind": "signoz/TimeSeriesPanel",
-            "spec": {
-              "visualization": {
-                "timePreference": "global_time",
-                "fillSpans": false
-              },
-              "formatting": {
-                "unit": "ms",
-                "decimalPrecision": "2"
-              },
-              "chartAppearance": {
-                "lineInterpolation": "spline",
-                "showPoints": false,
-                "lineStyle": "solid",
-                "fillMode": "none",
-                "spanGaps": {
-                  "fillOnlyBelow": false,
-                  "fillLessThan": ""
-                }
-              },
-              "axes": {
-                "softMin": 0,
-                "softMax": 0,
-                "isLogScale": false
-              },
-              "legend": {
-                "position": "bottom",
-                "mode": "list",
-                "customColors": null
-              },
-              "thresholds": null
-            }
-          },
-          "queries": [
-            {
-              "kind": "time_series",
-              "spec": {
-                "name": "A",
-                "plugin": {
-                  "kind": "signoz/BuilderQuery",
-                  "spec": {
-                    "name": "A",
-                    "stepInterval": 60,
-                    "signal": "metrics",
-                    "source": "",
-                    "aggregations": [
-                      {
-                        "metricName": "aws_Lambda_Duration_max",
-                        "temporality": "",
-                        "timeAggregation": "max",
-                        "spaceAggregation": "max",
-                        "reduceTo": "avg"
-                      }
-                    ],
-                    "disabled": false,
-                    "filter": {
-                      "expression": "(cloud.account.id = $Account AND cloud.region = $Region AND FunctionName EXISTS AND Resource NOT EXISTS) AND FunctionName IN $FunctionName"
-                    },
-                    "groupBy": [
-                      {
-                        "name": "cloud.account.id",
-                        "signal": "",
-                        "fieldContext": "attribute",
-                        "fieldDataType": "string"
-                      },
-                      {
-                        "name": "cloud.region",
-                        "signal": "",
-                        "fieldContext": "attribute",
-                        "fieldDataType": "string"
-                      },
-                      {
-                        "name": "FunctionName",
-                        "signal": "",
-                        "fieldContext": "attribute",
-                        "fieldDataType": "string"
-                      }
-                    ],
-                    "order": [],
-                    "having": {
-                      "expression": ""
-                    },
-                    "functions": [],
-                    "legend": "{{FunctionName}}"
-                  }
-                }
-              }
-            }
-          ],
-          "links": []
-        }
-      }
-    },
-    "layouts": [
-      {
-        "kind": "Grid",
-        "spec": {
-          "items": [
-            {
-              "x": 0,
-              "y": 0,
-              "width": 6,
-              "height": 6,
-              "content": {
-                "$ref": "#/spec/panels/877bb5c8-331c-492f-b666-2054c2ae39bd"
-              }
-            },
-            {
-              "x": 6,
-              "y": 0,
-              "width": 6,
-              "height": 6,
-              "content": {
-                "$ref": "#/spec/panels/b038520d-0756-4e46-a915-12a2f19a0254"
-              }
-            },
-            {
-              "x": 0,
-              "y": 6,
-              "width": 6,
-              "height": 6,
-              "content": {
-                "$ref": "#/spec/panels/2516c785-b025-49b3-aeb4-a4735ccb2709"
-              }
-            },
-            {
-              "x": 6,
-              "y": 6,
-              "width": 6,
-              "height": 6,
-              "content": {
-                "$ref": "#/spec/panels/6354ea62-e82b-4323-a33d-eef92519e843"
-              }
-            },
-            {
-              "x": 0,
-              "y": 12,
-              "width": 6,
-              "height": 6,
-              "content": {
-                "$ref": "#/spec/panels/853d3a92-b396-4064-8762-18d7487989e0"
-              }
-            },
-            {
-              "x": 6,
-              "y": 12,
-              "width": 6,
-              "height": 6,
-              "content": {
-                "$ref": "#/spec/panels/ae6d7c81-d921-4d4c-95ec-6b42d900ea45"
-              }
-            },
-            {
-              "x": 0,
-              "y": 18,
-              "width": 6,
-              "height": 6,
-              "content": {
-                "$ref": "#/spec/panels/4119a1e5-32a8-4859-96e9-a5451114782b"
-              }
-            }
-          ]
-        }
-      }
-    ],
-    "duration": "",
-    "refreshInterval": "",
-    "links": []
-  }
-}

pkg/statementbuilder/logsstatementbuilder/stmt_builder_test.go

@@ -462,8 +462,8 @@ func TestStatementBuilderListQueryResourceTests(t *testing.T) {
 				Limit: 10,
 			},
 			expected: qbtypes.Statement{
-				Query:    "SELECT timestamp, id, trace_id, span_id, trace_flags, severity_text, severity_number, scope_name, scope_version, body, attributes_string, attributes_number, attributes_bool, resources_string, scope_string FROM signoz_logs.distributed_logs_v2 WHERE ((JSON_VALUE(body, '$.\"status\"') = ? AND LOWER(body) LIKE LOWER(?)) AND (JSON_EXISTS(body, '$.\"status\"') AND LOWER(body) LIKE LOWER(?))) AND timestamp >= ? AND ts_bucket_start >= ? AND timestamp < ? AND ts_bucket_start <= ? LIMIT ?",
-				Args:     []any{"success", "%success%", "%\"status\"%", "1747947419000000000", uint64(1747945619), "1747983448000000000", uint64(1747983448), 10},
+				Query:    "SELECT timestamp, id, trace_id, span_id, trace_flags, severity_text, severity_number, scope_name, scope_version, body, attributes_string, attributes_number, attributes_bool, resources_string, scope_string FROM signoz_logs.distributed_logs_v2 WHERE (JSON_VALUE(body, '$.\"status\"') = ? AND JSON_EXISTS(body, '$.\"status\"')) AND timestamp >= ? AND ts_bucket_start >= ? AND timestamp < ? AND ts_bucket_start <= ? LIMIT ?",
+				Args:     []any{"success", "1747947419000000000", uint64(1747945619), "1747983448000000000", uint64(1747983448), 10},
 				Warnings: []string{querybuilder.NewKeyNotFoundWarning("status")},
 			},
 			expectedErr: nil,
@@ -481,8 +481,8 @@ func TestStatementBuilderListQueryResourceTests(t *testing.T) {
 				Limit: 10,
 			},
 			expected: qbtypes.Statement{
-				Query:    "SELECT timestamp, id, trace_id, span_id, trace_flags, severity_text, severity_number, scope_name, scope_version, body, attributes_string, attributes_number, attributes_bool, resources_string, scope_string FROM signoz_logs.distributed_logs_v2 WHERE (((JSON_VALUE(body, '$.\"user_names\"[*]') = ? AND LOWER(body) LIKE LOWER(?))) AND (JSON_EXISTS(body, '$.\"user_names\"[*]') AND LOWER(body) LIKE LOWER(?))) AND timestamp >= ? AND ts_bucket_start >= ? AND timestamp < ? AND ts_bucket_start <= ? LIMIT ?",
-				Args:     []any{"john_doe", "%john\\_doe%", "%\"user\\_names\"%", "1747947419000000000", uint64(1747945619), "1747983448000000000", uint64(1747983448), 10},
+				Query:    "SELECT timestamp, id, trace_id, span_id, trace_flags, severity_text, severity_number, scope_name, scope_version, body, attributes_string, attributes_number, attributes_bool, resources_string, scope_string FROM signoz_logs.distributed_logs_v2 WHERE ((JSON_VALUE(body, '$.\"user_names\"[*]') = ?) AND JSON_EXISTS(body, '$.\"user_names\"[*]')) AND timestamp >= ? AND ts_bucket_start >= ? AND timestamp < ? AND ts_bucket_start <= ? LIMIT ?",
+				Args:     []any{"john_doe", "1747947419000000000", uint64(1747945619), "1747983448000000000", uint64(1747983448), 10},
 				Warnings: []string{querybuilder.NewKeyNotFoundWarning("user_names[*]")},
 			},
 			expectedErr: nil,
@@ -498,8 +498,8 @@ func TestStatementBuilderListQueryResourceTests(t *testing.T) {
 				Limit: 10,
 			},
 			expected: qbtypes.Statement{
-				Query:    "SELECT timestamp, id, trace_id, span_id, trace_flags, severity_text, severity_number, scope_name, scope_version, body, attributes_string, attributes_number, attributes_bool, resources_string, scope_string FROM signoz_logs.distributed_logs_v2 WHERE ((has(JSONExtract(JSON_QUERY(body, '$.\"user_names\"[*]'), 'Array(Nullable(String))'), ?) OR ifNull((JSON_VALUE(body, '$.\"user_names\"') = ? AND JSONType(body, 'user_names') NOT IN ('Array', 'Object', 'Null')), false)) AND LOWER(body) LIKE LOWER(?) AND LOWER(body) LIKE LOWER(?)) AND timestamp >= ? AND ts_bucket_start >= ? AND timestamp < ? AND ts_bucket_start <= ? LIMIT ?",
-				Args:     []any{"john_doe", "john_doe", "%\"user\\_names\"%", "%john\\_doe%", "1747947419000000000", uint64(1747945619), "1747983448000000000", uint64(1747983448), 10},
+				Query:    "SELECT timestamp, id, trace_id, span_id, trace_flags, severity_text, severity_number, scope_name, scope_version, body, attributes_string, attributes_number, attributes_bool, resources_string, scope_string FROM signoz_logs.distributed_logs_v2 WHERE (has(JSONExtract(JSON_QUERY(body, '$.\"user_names\"[*]'), 'Array(Nullable(String))'), ?) OR ifNull((JSON_VALUE(body, '$.\"user_names\"') = ? AND JSONType(body, 'user_names') NOT IN ('Array', 'Object', 'Null')), false)) AND timestamp >= ? AND ts_bucket_start >= ? AND timestamp < ? AND ts_bucket_start <= ? LIMIT ?",
+				Args:     []any{"john_doe", "john_doe", "1747947419000000000", uint64(1747945619), "1747983448000000000", uint64(1747983448), 10},
 				Warnings: []string{querybuilder.NewKeyNotFoundWarning("user_names[*]")},
 			},
 			expectedErr: nil,
@@ -1011,8 +1011,8 @@ func TestStmtBuilderBodyField(t *testing.T) {
 			},
 			enableUseJSONBody: false,
 			expected: qbtypes.Statement{
-				Query: "SELECT timestamp, id, trace_id, span_id, trace_flags, severity_text, severity_number, scope_name, scope_version, body, attributes_string, attributes_number, attributes_bool, resources_string, scope_string FROM signoz_logs.distributed_logs_v2 WHERE (body = ? AND LOWER(body) = LOWER(?)) AND timestamp >= ? AND ts_bucket_start >= ? AND timestamp < ? AND ts_bucket_start <= ? LIMIT ?",
-				Args:  []any{"", "", "1747947419000000000", uint64(1747945619), "1747983448000000000", uint64(1747983448), 10},
+				Query: "SELECT timestamp, id, trace_id, span_id, trace_flags, severity_text, severity_number, scope_name, scope_version, body, attributes_string, attributes_number, attributes_bool, resources_string, scope_string FROM signoz_logs.distributed_logs_v2 WHERE body = ? AND timestamp >= ? AND ts_bucket_start >= ? AND timestamp < ? AND ts_bucket_start <= ? LIMIT ?",
+				Args:  []any{"", "1747947419000000000", uint64(1747945619), "1747983448000000000", uint64(1747983448), 10},
 			},
 			expectedErr: nil,
 		},

pkg/statementbuilder/metricsstatementbuilder/stmt_builder_test.go

@@ -322,38 +322,6 @@ func TestStatementBuilder(t *testing.T) {
 			},
 			expectedErr: nil,
 		},
-		{
-			name:        "test_bool_label_filter",
-			requestType: qbtypes.RequestTypeTimeSeries,
-			query: qbtypes.QueryBuilderQuery[qbtypes.MetricAggregation]{
-				Signal:       telemetrytypes.SignalMetrics,
-				StepInterval: qbtypes.Step{Duration: 30 * time.Second},
-				Aggregations: []qbtypes.MetricAggregation{
-					{
-						MetricName:       "signoz_calls_total",
-						Type:             metrictypes.SumType,
-						Temporality:      metrictypes.Cumulative,
-						TimeAggregation:  metrictypes.TimeAggregationRate,
-						SpaceAggregation: metrictypes.SpaceAggregationSum,
-					},
-				},
-				Filter: &qbtypes.Filter{
-					Expression: "success = true",
-				},
-				GroupBy: []qbtypes.GroupByKey{
-					{
-						TelemetryFieldKey: telemetrytypes.TelemetryFieldKey{
-							Name: "service.name",
-						},
-					},
-				},
-			},
-			expected: qbtypes.Statement{
-				Query: "WITH __temporal_aggregation_cte AS (SELECT ts, `__GROUP_BY_KEY_0_service.name`, multiIf(row_number() OVER rate_window = 1, nan, (per_series_value - lagInFrame(per_series_value, 1) OVER rate_window) < 0, per_series_value / (ts - lagInFrame(ts, 1) OVER rate_window), (per_series_value - lagInFrame(per_series_value, 1) OVER rate_window) / (ts - lagInFrame(ts, 1) OVER rate_window)) AS per_series_value FROM (SELECT fingerprint, toStartOfInterval(toDateTime(intDiv(unix_milli, 1000)), toIntervalSecond(30)) AS ts, `__GROUP_BY_KEY_0_service.name`, max(value) AS per_series_value FROM signoz_metrics.distributed_samples_v4 AS points INNER JOIN (SELECT fingerprint, JSONExtractString(labels, 'service.name') AS `__GROUP_BY_KEY_0_service.name` FROM signoz_metrics.time_series_v4_6hrs WHERE metric_name IN (?) AND unix_milli >= ? AND unix_milli <= ? AND LOWER(temporality) LIKE LOWER(?) AND accurateCastOrNull(JSONExtractString(labels, 'success'), 'Bool') = ? GROUP BY fingerprint, `__GROUP_BY_KEY_0_service.name`) AS filtered_time_series ON points.fingerprint = filtered_time_series.fingerprint WHERE metric_name IN (?) AND unix_milli >= ? AND unix_milli < ? GROUP BY fingerprint, ts, `__GROUP_BY_KEY_0_service.name` ORDER BY fingerprint, ts) WINDOW rate_window AS (PARTITION BY fingerprint ORDER BY fingerprint, ts)), __spatial_aggregation_cte AS (SELECT ts, `__GROUP_BY_KEY_0_service.name`, sum(per_series_value) AS value FROM __temporal_aggregation_cte WHERE isNaN(per_series_value) = ? GROUP BY ts, `__GROUP_BY_KEY_0_service.name`) SELECT * FROM __spatial_aggregation_cte ORDER BY `__GROUP_BY_KEY_0_service.name`, ts",
-				Args:  []any{"signoz_calls_total", uint64(1747936800000), uint64(1747983420000), "cumulative", true, "signoz_calls_total", uint64(1747947360000), uint64(1747983420000), 0},
-			},
-			expectedErr: nil,
-		},
 	}
 
 	fm := metricstelemetryschema.NewFieldMapper()

pkg/statementbuilder/metricsstatementbuilder/testdata/keys_map.json

@@ -31,14 +31,6 @@
             "signal": "metrics"
         }
     ],
-    "success": [
-        {
-            "name": "success",
-            "fieldContext": "attribute",
-            "fieldDataType": "bool",
-            "signal": "metrics"
-        }
-    ],
     "materialized.key.name": [
         {
             "name": "materialized.key.name",

pkg/statementbuilder/tracesstatementbuilder/statement_builder.go

@@ -271,18 +271,25 @@ func adjustTraceKey(key *telemetrytypes.TelemetryFieldKey, keys map[string][]*te
 	*/
 	var isIntrinsicOrCalculatedField bool
 	var intrinsicOrCalculatedField telemetrytypes.TelemetryFieldKey
-	if _, ok := tracestelemetryschema.IntrinsicFields[key.Name]; ok {
+	// A scope-context key addresses the scope JSON column and must not bind to a non-scope
+	// intrinsic/calculated field that only shares its name (e.g. `{name, scope}` is the scope's
+	// name, not the span `name` column). The span<->attribute remapping of legacy fields is
+	// intentionally context-blind and left untouched.
+	boundToScopeMismatch := func(f telemetrytypes.TelemetryFieldKey) bool {
+		return key.FieldContext == telemetrytypes.FieldContextScope && f.FieldContext != telemetrytypes.FieldContextScope
+	}
+	if f, ok := tracestelemetryschema.IntrinsicFields[key.Name]; ok && !boundToScopeMismatch(f) {
 		isIntrinsicOrCalculatedField = true
-		intrinsicOrCalculatedField = tracestelemetryschema.IntrinsicFields[key.Name]
-	} else if _, ok := tracestelemetryschema.CalculatedFields[key.Name]; ok {
+		intrinsicOrCalculatedField = f
+	} else if f, ok := tracestelemetryschema.CalculatedFields[key.Name]; ok && !boundToScopeMismatch(f) {
 		isIntrinsicOrCalculatedField = true
-		intrinsicOrCalculatedField = tracestelemetryschema.CalculatedFields[key.Name]
-	} else if _, ok := tracestelemetryschema.IntrinsicFieldsDeprecated[key.Name]; ok {
+		intrinsicOrCalculatedField = f
+	} else if f, ok := tracestelemetryschema.IntrinsicFieldsDeprecated[key.Name]; ok && !boundToScopeMismatch(f) {
 		isIntrinsicOrCalculatedField = true
-		intrinsicOrCalculatedField = tracestelemetryschema.IntrinsicFieldsDeprecated[key.Name]
-	} else if _, ok := tracestelemetryschema.CalculatedFieldsDeprecated[key.Name]; ok {
+		intrinsicOrCalculatedField = f
+	} else if f, ok := tracestelemetryschema.CalculatedFieldsDeprecated[key.Name]; ok && !boundToScopeMismatch(f) {
 		isIntrinsicOrCalculatedField = true
-		intrinsicOrCalculatedField = tracestelemetryschema.CalculatedFieldsDeprecated[key.Name]
+		intrinsicOrCalculatedField = f
 	}
 
 	if isIntrinsicOrCalculatedField {

pkg/statementbuilder/tracesstatementbuilder/stmt_builder_test.go

@@ -369,11 +369,99 @@ func TestStatementBuilder(t *testing.T) {
 				},
 			},
 			expected: qbtypes.Statement{
-				Query: "WITH __resource_filter AS (SELECT fingerprint FROM signoz_traces.distributed_traces_v3_resource WHERE (simpleJSONExtractString(labels, 'service.name') = ? AND labels LIKE ? AND labels LIKE ?) AND seen_at_ts_bucket_start >= ? AND seen_at_ts_bucket_start <= ? GROUP BY fingerprint), __limit_cte AS (SELECT toString(multiIf(response_status_code <> '', response_status_code, NULL)) AS `__GROUP_BY_KEY_0_responseStatusCode`, quantile(0.90)(multiIf(duration_nano <> 0, accurateCastOrNull(duration_nano, 'Float64'), NULL)) AS __result_0 FROM signoz_traces.distributed_signoz_index_v3 WHERE resource_fingerprint GLOBAL IN (SELECT fingerprint FROM __resource_filter) AND timestamp >= ? AND timestamp < ? AND ts_bucket_start >= ? AND ts_bucket_start <= ? GROUP BY `__GROUP_BY_KEY_0_responseStatusCode` ORDER BY __result_0 DESC LIMIT ?) SELECT toStartOfInterval(timestamp, INTERVAL 30 SECOND) AS ts, toString(multiIf(response_status_code <> '', response_status_code, NULL)) AS `__GROUP_BY_KEY_0_responseStatusCode`, quantile(0.90)(multiIf(duration_nano <> 0, accurateCastOrNull(duration_nano, 'Float64'), NULL)) AS __result_0 FROM signoz_traces.distributed_signoz_index_v3 WHERE resource_fingerprint GLOBAL IN (SELECT fingerprint FROM __resource_filter) AND timestamp >= ? AND timestamp < ? AND ts_bucket_start >= ? AND ts_bucket_start <= ? AND (`__GROUP_BY_KEY_0_responseStatusCode`) GLOBAL IN (SELECT `__GROUP_BY_KEY_0_responseStatusCode` FROM __limit_cte) GROUP BY ts, `__GROUP_BY_KEY_0_responseStatusCode`",
+				Query: "WITH __resource_filter AS (SELECT fingerprint FROM signoz_traces.distributed_traces_v3_resource WHERE (simpleJSONExtractString(labels, 'service.name') = ? AND labels LIKE ? AND labels LIKE ?) AND seen_at_ts_bucket_start >= ? AND seen_at_ts_bucket_start <= ? GROUP BY fingerprint), __limit_cte AS (SELECT toString(multiIf(response_status_code <> '', response_status_code, NULL)) AS `__GROUP_BY_KEY_0_responseStatusCode`, quantile(0.90)(multiIf(duration_nano <> 0, toFloat64(duration_nano), NULL)) AS __result_0 FROM signoz_traces.distributed_signoz_index_v3 WHERE resource_fingerprint GLOBAL IN (SELECT fingerprint FROM __resource_filter) AND timestamp >= ? AND timestamp < ? AND ts_bucket_start >= ? AND ts_bucket_start <= ? GROUP BY `__GROUP_BY_KEY_0_responseStatusCode` ORDER BY __result_0 DESC LIMIT ?) SELECT toStartOfInterval(timestamp, INTERVAL 30 SECOND) AS ts, toString(multiIf(response_status_code <> '', response_status_code, NULL)) AS `__GROUP_BY_KEY_0_responseStatusCode`, quantile(0.90)(multiIf(duration_nano <> 0, toFloat64(duration_nano), NULL)) AS __result_0 FROM signoz_traces.distributed_signoz_index_v3 WHERE resource_fingerprint GLOBAL IN (SELECT fingerprint FROM __resource_filter) AND timestamp >= ? AND timestamp < ? AND ts_bucket_start >= ? AND ts_bucket_start <= ? AND (`__GROUP_BY_KEY_0_responseStatusCode`) GLOBAL IN (SELECT `__GROUP_BY_KEY_0_responseStatusCode` FROM __limit_cte) GROUP BY ts, `__GROUP_BY_KEY_0_responseStatusCode`",
 				Args:  []any{"redis-manual", "%service.name%", "%service.name\":\"redis-manual%", uint64(1747945619), uint64(1747983448), "1747947419000000000", "1747983448000000000", uint64(1747945619), uint64(1747983448), 10, "1747947419000000000", "1747983448000000000", uint64(1747945619), uint64(1747983448)},
 			},
 			expectedErr: nil,
 		},
+		{
+			name:        "scope.name filter and group by",
+			requestType: qbtypes.RequestTypeTimeSeries,
+			query: qbtypes.QueryBuilderQuery[qbtypes.TraceAggregation]{
+				Signal:       telemetrytypes.SignalTraces,
+				StepInterval: qbtypes.Step{Duration: 30 * time.Second},
+				Aggregations: []qbtypes.TraceAggregation{
+					{
+						Expression: "count()",
+					},
+				},
+				Filter: &qbtypes.Filter{
+					Expression: "scope.name = 'opentelemetry-io'",
+				},
+				Limit: 10,
+				GroupBy: []qbtypes.GroupByKey{
+					{
+						TelemetryFieldKey: telemetrytypes.TelemetryFieldKey{
+							Name:         "scope.name",
+							FieldContext: telemetrytypes.FieldContextScope,
+						},
+					},
+				},
+			},
+			expected: qbtypes.Statement{
+				Query: "WITH __limit_cte AS (SELECT toString(multiIf(scope.name::String <> '', scope.name::String, NULL)) AS `__GROUP_BY_KEY_0_scope.name`, count() AS __result_0 FROM signoz_traces.distributed_signoz_index_v3 WHERE (scope.name::String = ? AND scope.name::String <> '') AND timestamp >= ? AND timestamp < ? AND ts_bucket_start >= ? AND ts_bucket_start <= ? GROUP BY `__GROUP_BY_KEY_0_scope.name` ORDER BY __result_0 DESC LIMIT ?) SELECT toStartOfInterval(timestamp, INTERVAL 30 SECOND) AS ts, toString(multiIf(scope.name::String <> '', scope.name::String, NULL)) AS `__GROUP_BY_KEY_0_scope.name`, count() AS __result_0 FROM signoz_traces.distributed_signoz_index_v3 WHERE (scope.name::String = ? AND scope.name::String <> '') AND timestamp >= ? AND timestamp < ? AND ts_bucket_start >= ? AND ts_bucket_start <= ? AND (`__GROUP_BY_KEY_0_scope.name`) GLOBAL IN (SELECT `__GROUP_BY_KEY_0_scope.name` FROM __limit_cte) GROUP BY ts, `__GROUP_BY_KEY_0_scope.name`",
+				Args:  []any{"opentelemetry-io", "1747947419000000000", "1747983448000000000", uint64(1747945619), uint64(1747983448), 10, "opentelemetry-io", "1747947419000000000", "1747983448000000000", uint64(1747945619), uint64(1747983448)},
+			},
+			expectedErr: nil,
+		},
+		{
+			name:        "scope.version filter with scope.name group by",
+			requestType: qbtypes.RequestTypeTimeSeries,
+			query: qbtypes.QueryBuilderQuery[qbtypes.TraceAggregation]{
+				Signal:       telemetrytypes.SignalTraces,
+				StepInterval: qbtypes.Step{Duration: 30 * time.Second},
+				Aggregations: []qbtypes.TraceAggregation{
+					{
+						Expression: "count()",
+					},
+				},
+				Filter: &qbtypes.Filter{
+					Expression: "scope.version = '1.0.0'",
+				},
+				Limit: 10,
+				GroupBy: []qbtypes.GroupByKey{
+					{
+						TelemetryFieldKey: telemetrytypes.TelemetryFieldKey{
+							Name:         "scope.name",
+							FieldContext: telemetrytypes.FieldContextScope,
+						},
+					},
+				},
+			},
+			expected: qbtypes.Statement{
+				Query: "WITH __limit_cte AS (SELECT toString(multiIf(scope.name::String <> '', scope.name::String, NULL)) AS `__GROUP_BY_KEY_0_scope.name`, count() AS __result_0 FROM signoz_traces.distributed_signoz_index_v3 WHERE (scope.version::String = ? AND scope.version::String <> '') AND timestamp >= ? AND timestamp < ? AND ts_bucket_start >= ? AND ts_bucket_start <= ? GROUP BY `__GROUP_BY_KEY_0_scope.name` ORDER BY __result_0 DESC LIMIT ?) SELECT toStartOfInterval(timestamp, INTERVAL 30 SECOND) AS ts, toString(multiIf(scope.name::String <> '', scope.name::String, NULL)) AS `__GROUP_BY_KEY_0_scope.name`, count() AS __result_0 FROM signoz_traces.distributed_signoz_index_v3 WHERE (scope.version::String = ? AND scope.version::String <> '') AND timestamp >= ? AND timestamp < ? AND ts_bucket_start >= ? AND ts_bucket_start <= ? AND (`__GROUP_BY_KEY_0_scope.name`) GLOBAL IN (SELECT `__GROUP_BY_KEY_0_scope.name` FROM __limit_cte) GROUP BY ts, `__GROUP_BY_KEY_0_scope.name`",
+				Args:  []any{"1.0.0", "1747947419000000000", "1747983448000000000", uint64(1747945619), uint64(1747983448), 10, "1.0.0", "1747947419000000000", "1747983448000000000", uint64(1747945619), uint64(1747983448)},
+			},
+			expectedErr: nil,
+		},
+		{
+			name:        "scope.version filter only (no scope field in group by)",
+			requestType: qbtypes.RequestTypeTimeSeries,
+			query: qbtypes.QueryBuilderQuery[qbtypes.TraceAggregation]{
+				Signal:       telemetrytypes.SignalTraces,
+				StepInterval: qbtypes.Step{Duration: 30 * time.Second},
+				Aggregations: []qbtypes.TraceAggregation{
+					{
+						Expression: "count()",
+					},
+				},
+				Filter: &qbtypes.Filter{
+					Expression: "scope.version = '1.0.0'",
+				},
+				Limit: 10,
+				GroupBy: []qbtypes.GroupByKey{
+					{
+						TelemetryFieldKey: telemetrytypes.TelemetryFieldKey{
+							Name: "service.name",
+						},
+					},
+				},
+			},
+			expected: qbtypes.Statement{
+				Query: "WITH __limit_cte AS (SELECT toString(multiIf(multiIf(resource.`service.name` IS NOT NULL, resource.`service.name`::String, mapContains(resources_string, 'service.name'), resources_string['service.name'], NULL) IS NOT NULL, multiIf(resource.`service.name` IS NOT NULL, resource.`service.name`::String, mapContains(resources_string, 'service.name'), resources_string['service.name'], NULL), NULL)) AS `__GROUP_BY_KEY_0_service.name`, count() AS __result_0 FROM signoz_traces.distributed_signoz_index_v3 WHERE (scope.version::String = ? AND scope.version::String <> '') AND timestamp >= ? AND timestamp < ? AND ts_bucket_start >= ? AND ts_bucket_start <= ? GROUP BY `__GROUP_BY_KEY_0_service.name` ORDER BY __result_0 DESC LIMIT ?) SELECT toStartOfInterval(timestamp, INTERVAL 30 SECOND) AS ts, toString(multiIf(multiIf(resource.`service.name` IS NOT NULL, resource.`service.name`::String, mapContains(resources_string, 'service.name'), resources_string['service.name'], NULL) IS NOT NULL, multiIf(resource.`service.name` IS NOT NULL, resource.`service.name`::String, mapContains(resources_string, 'service.name'), resources_string['service.name'], NULL), NULL)) AS `__GROUP_BY_KEY_0_service.name`, count() AS __result_0 FROM signoz_traces.distributed_signoz_index_v3 WHERE (scope.version::String = ? AND scope.version::String <> '') AND timestamp >= ? AND timestamp < ? AND ts_bucket_start >= ? AND ts_bucket_start <= ? AND (`__GROUP_BY_KEY_0_service.name`) GLOBAL IN (SELECT `__GROUP_BY_KEY_0_service.name` FROM __limit_cte) GROUP BY ts, `__GROUP_BY_KEY_0_service.name`",
+				Args:  []any{"1.0.0", "1747947419000000000", "1747983448000000000", uint64(1747945619), uint64(1747983448), 10, "1.0.0", "1747947419000000000", "1747983448000000000", uint64(1747945619), uint64(1747983448)},
+			},
+		},
 	}
 
 	fl := flaggertest.New(t)
@@ -670,7 +758,7 @@ func TestStatementBuilderListQuery(t *testing.T) {
 				Limit: 10,
 			},
 			expected: qbtypes.Statement{
-				Query: "WITH __resource_filter AS (SELECT fingerprint FROM signoz_traces.distributed_traces_v3_resource WHERE (simpleJSONExtractString(labels, 'service.name') = ? AND labels LIKE ? AND labels LIKE ?) AND seen_at_ts_bucket_start >= ? AND seen_at_ts_bucket_start <= ? GROUP BY fingerprint) SELECT timestamp AS `__SELECT_KEY_0_timestamp`, trace_id AS `__SELECT_KEY_1_trace_id`, span_id AS `__SELECT_KEY_2_span_id`, name AS `__SELECT_KEY_3_name`, resource_string_service$$name AS `__SELECT_KEY_4_serviceName`, duration_nano AS `__SELECT_KEY_5_durationNano`, http_method AS `__SELECT_KEY_6_httpMethod`, multiIf(mapContains(attributes_string, 'non-existent.key'), toString(attributes_string['non-existent.key']), mapContains(attributes_number, 'non-existent.key'), toString(attributes_number['non-existent.key']), mapContains(attributes_bool, 'non-existent.key'), toString(attributes_bool['non-existent.key']), NULL) AS `__SELECT_KEY_7_non-existent.key` FROM signoz_traces.distributed_signoz_index_v3 WHERE resource_fingerprint GLOBAL IN (SELECT fingerprint FROM __resource_filter) AND timestamp >= ? AND timestamp < ? AND ts_bucket_start >= ? AND ts_bucket_start <= ? LIMIT ?",
+				Query: "WITH __resource_filter AS (SELECT fingerprint FROM signoz_traces.distributed_traces_v3_resource WHERE (simpleJSONExtractString(labels, 'service.name') = ? AND labels LIKE ? AND labels LIKE ?) AND seen_at_ts_bucket_start >= ? AND seen_at_ts_bucket_start <= ? GROUP BY fingerprint) SELECT timestamp AS `__SELECT_KEY_0_timestamp`, trace_id AS `__SELECT_KEY_1_trace_id`, span_id AS `__SELECT_KEY_2_span_id`, name AS `__SELECT_KEY_3_name`, resource_string_service$$name AS `__SELECT_KEY_4_serviceName`, duration_nano AS `__SELECT_KEY_5_durationNano`, http_method AS `__SELECT_KEY_6_httpMethod`, multiIf(mapContains(attributes_string, 'non-existent.key'), toString(attributes_string['non-existent.key']), mapContains(attributes_number, 'non-existent.key'), toString(attributes_number['non-existent.key']), mapContains(attributes_bool, 'non-existent.key'), toString(attributes_bool['non-existent.key']), scope.attributes.`non-existent.key` IS NOT NULL, toString(scope.attributes.`non-existent.key`::String), NULL) AS `__SELECT_KEY_7_non-existent.key` FROM signoz_traces.distributed_signoz_index_v3 WHERE resource_fingerprint GLOBAL IN (SELECT fingerprint FROM __resource_filter) AND timestamp >= ? AND timestamp < ? AND ts_bucket_start >= ? AND ts_bucket_start <= ? LIMIT ?",
 				Args:  []any{"redis-manual", "%service.name%", "%service.name\":\"redis-manual%", uint64(1747945619), uint64(1747983448), "1747947419000000000", "1747983448000000000", uint64(1747945619), uint64(1747983448), 10},
 			},
 			expectedErr: nil,
@@ -800,6 +888,110 @@ func TestStatementBuilderListQueryWithCorruptData(t *testing.T) {
 			},
 			expectedErr: nil,
 		},
+		{
+			name:        "List query with scope filter only (no scope in select or group by)",
+			requestType: qbtypes.RequestTypeRaw,
+			keysMap: map[string][]*telemetrytypes.TelemetryFieldKey{
+				"scope.version": {
+					{
+						Name:          "scope.version",
+						Signal:        telemetrytypes.SignalTraces,
+						FieldContext:  telemetrytypes.FieldContextScope,
+						FieldDataType: telemetrytypes.FieldDataTypeString,
+					},
+				},
+			},
+			query: qbtypes.QueryBuilderQuery[qbtypes.TraceAggregation]{
+				Signal:       telemetrytypes.SignalTraces,
+				StepInterval: qbtypes.Step{Duration: 30 * time.Second},
+				Filter: &qbtypes.Filter{
+					Expression: "scope.version = '1.0.0'",
+				},
+				Limit: 10,
+			},
+			expected: qbtypes.Statement{
+				Query: "SELECT timestamp AS `__SELECT_KEY_0_timestamp`, trace_id AS `__SELECT_KEY_1_trace_id`, span_id AS `__SELECT_KEY_2_span_id`, trace_state AS `__SELECT_KEY_3_trace_state`, parent_span_id AS `__SELECT_KEY_4_parent_span_id`, flags AS `__SELECT_KEY_5_flags`, name AS `__SELECT_KEY_6_name`, kind AS `__SELECT_KEY_7_kind`, kind_string AS `__SELECT_KEY_8_kind_string`, duration_nano AS `__SELECT_KEY_9_duration_nano`, status_code AS `__SELECT_KEY_10_status_code`, status_message AS `__SELECT_KEY_11_status_message`, status_code_string AS `__SELECT_KEY_12_status_code_string`, events AS `__SELECT_KEY_13_events`, links AS `__SELECT_KEY_14_links`, response_status_code AS `__SELECT_KEY_15_response_status_code`, external_http_url AS `__SELECT_KEY_16_external_http_url`, http_url AS `__SELECT_KEY_17_http_url`, external_http_method AS `__SELECT_KEY_18_external_http_method`, http_method AS `__SELECT_KEY_19_http_method`, http_host AS `__SELECT_KEY_20_http_host`, db_name AS `__SELECT_KEY_21_db_name`, db_operation AS `__SELECT_KEY_22_db_operation`, has_error AS `__SELECT_KEY_23_has_error`, is_remote AS `__SELECT_KEY_24_is_remote`, attributes_string, attributes_number, attributes_bool, resources_string FROM signoz_traces.distributed_signoz_index_v3 WHERE (scope.version::String = ? AND scope.version::String <> '') AND timestamp >= ? AND timestamp < ? AND ts_bucket_start >= ? AND ts_bucket_start <= ? LIMIT ?",
+				Args:  []any{"1.0.0", "1747947419000000000", "1747983448000000000", uint64(1747945619), uint64(1747983448), 10},
+			},
+		},
+		{
+			// Regression test: scope.version in selectFields with no metadata (isColumn=true filters it out)
+			// must still produce scope.version::String, not scope.attributes.version::String
+			name:        "scope.version in selectFields only, no metadata (intrinsic field fallback)",
+			requestType: qbtypes.RequestTypeRaw,
+			keysMap:     map[string][]*telemetrytypes.TelemetryFieldKey{},
+			query: qbtypes.QueryBuilderQuery[qbtypes.TraceAggregation]{
+				Signal:       telemetrytypes.SignalTraces,
+				StepInterval: qbtypes.Step{Duration: 30 * time.Second},
+				Filter:       &qbtypes.Filter{},
+				SelectFields: []telemetrytypes.TelemetryFieldKey{
+					{Name: "scope.version", FieldContext: telemetrytypes.FieldContextUnspecified},
+				},
+				Limit: 10,
+			},
+			expected: qbtypes.Statement{
+				Query: "SELECT timestamp AS `__SELECT_KEY_0_timestamp`, trace_id AS `__SELECT_KEY_1_trace_id`, span_id AS `__SELECT_KEY_2_span_id`, multiIf(scope.version::String <> '', scope.version::String, NULL) AS `__SELECT_KEY_3_scope.version` FROM signoz_traces.distributed_signoz_index_v3 WHERE timestamp >= ? AND timestamp < ? AND ts_bucket_start >= ? AND ts_bucket_start <= ? LIMIT ?",
+				Args:  []any{"1747947419000000000", "1747983448000000000", uint64(1747945619), uint64(1747983448), 10},
+			},
+		},
+		{
+			// A scope-context key that shares its name with a span intrinsic must resolve
+			// against the scope column, not the span `name` column, even with no metadata.
+			name:        "scope-context name with no metadata resolves to the scope attribute, not the span column",
+			requestType: qbtypes.RequestTypeRaw,
+			keysMap:     map[string][]*telemetrytypes.TelemetryFieldKey{},
+			query: qbtypes.QueryBuilderQuery[qbtypes.TraceAggregation]{
+				Signal:       telemetrytypes.SignalTraces,
+				StepInterval: qbtypes.Step{Duration: 30 * time.Second},
+				Filter:       &qbtypes.Filter{},
+				SelectFields: []telemetrytypes.TelemetryFieldKey{
+					{Name: "name", FieldContext: telemetrytypes.FieldContextScope},
+				},
+				Limit: 10,
+			},
+			expected: qbtypes.Statement{
+				Query: "SELECT timestamp AS `__SELECT_KEY_0_timestamp`, trace_id AS `__SELECT_KEY_1_trace_id`, span_id AS `__SELECT_KEY_2_span_id`, multiIf(scope.attributes.`name` IS NOT NULL, scope.attributes.`name`::String, NULL) AS `__SELECT_KEY_3_name` FROM signoz_traces.distributed_signoz_index_v3 WHERE timestamp >= ? AND timestamp < ? AND ts_bucket_start >= ? AND ts_bucket_start <= ? LIMIT ?",
+				Args:  []any{"1747947419000000000", "1747983448000000000", uint64(1747945619), uint64(1747983448), 10},
+			},
+		},
+		{
+			// A scope name that collides with a declared path: with both the declared
+			// scope.version and a scope attribute literally named `version` in metadata, a
+			// select on `{version, scope}` unions both (attribute first, declared fallback).
+			name:        "scope select field unions a same-named scope attribute and the declared path",
+			requestType: qbtypes.RequestTypeRaw,
+			keysMap: map[string][]*telemetrytypes.TelemetryFieldKey{
+				"scope.version": {
+					{
+						Name:          "scope.version",
+						Signal:        telemetrytypes.SignalTraces,
+						FieldContext:  telemetrytypes.FieldContextScope,
+						FieldDataType: telemetrytypes.FieldDataTypeString,
+					},
+				},
+				"version": {
+					{
+						Name:          "version",
+						Signal:        telemetrytypes.SignalTraces,
+						FieldContext:  telemetrytypes.FieldContextScope,
+						FieldDataType: telemetrytypes.FieldDataTypeString,
+					},
+				},
+			},
+			query: qbtypes.QueryBuilderQuery[qbtypes.TraceAggregation]{
+				Signal:       telemetrytypes.SignalTraces,
+				StepInterval: qbtypes.Step{Duration: 30 * time.Second},
+				Filter:       &qbtypes.Filter{},
+				SelectFields: []telemetrytypes.TelemetryFieldKey{
+					{Name: "version", FieldContext: telemetrytypes.FieldContextScope},
+				},
+				Limit: 10,
+			},
+			expected: qbtypes.Statement{
+				Query: "SELECT timestamp AS `__SELECT_KEY_0_timestamp`, trace_id AS `__SELECT_KEY_1_trace_id`, span_id AS `__SELECT_KEY_2_span_id`, multiIf(scope.attributes.`version` IS NOT NULL, toString(scope.attributes.`version`::String), scope.version::String <> '', toString(scope.version::String), NULL) AS `__SELECT_KEY_3_version` FROM signoz_traces.distributed_signoz_index_v3 WHERE timestamp >= ? AND timestamp < ? AND ts_bucket_start >= ? AND ts_bucket_start <= ? LIMIT ?",
+				Args:  []any{"1747947419000000000", "1747983448000000000", uint64(1747945619), uint64(1747983448), 10},
+			},
+		},
 	}
 
 	for _, c := range cases {

pkg/statementbuilder/tracesstatementbuilder/trace_operator_cte_builder_test.go

@@ -344,7 +344,7 @@ func TestTraceOperatorStatementBuilder(t *testing.T) {
 				},
 			},
 			expected: qbtypes.Statement{
-				Query: "WITH toDateTime64(1747947419000000000, 9) AS t_from, toDateTime64(1747983448000000000, 9) AS t_to, 1747945619 AS bucket_from, 1747983448 AS bucket_to, all_spans AS (SELECT *, resource_string_service$$name AS `service.name` FROM signoz_traces.distributed_signoz_index_v3 WHERE timestamp >= ? AND timestamp < ? AND ts_bucket_start >= ? AND ts_bucket_start <= ?), __resource_filter_A AS (SELECT fingerprint FROM signoz_traces.distributed_traces_v3_resource WHERE (simpleJSONExtractString(labels, 'service.name') = ? AND labels LIKE ? AND labels LIKE ?) AND seen_at_ts_bucket_start >= ? AND seen_at_ts_bucket_start <= ? GROUP BY fingerprint), A AS (SELECT * FROM signoz_traces.distributed_signoz_index_v3 WHERE resource_fingerprint GLOBAL IN (SELECT fingerprint FROM __resource_filter_A) AND timestamp >= ? AND timestamp < ? AND ts_bucket_start >= ? AND ts_bucket_start <= ?), B AS (SELECT * FROM signoz_traces.distributed_signoz_index_v3 WHERE timestamp >= ? AND timestamp < ? AND ts_bucket_start >= ? AND ts_bucket_start <= ? AND toFloat64(response_status_code) < ?), A_AND_B AS (SELECT l.* FROM A AS l INNER JOIN B AS r ON l.trace_id = r.trace_id) SELECT toString(multiIf(multiIf(resource.`service.name` IS NOT NULL, resource.`service.name`::String, mapContains(resources_string, 'service.name'), resources_string['service.name'], NULL) IS NOT NULL, multiIf(resource.`service.name` IS NOT NULL, resource.`service.name`::String, mapContains(resources_string, 'service.name'), resources_string['service.name'], NULL), NULL)) AS `service.name`, avg(multiIf(duration_nano <> 0, accurateCastOrNull(duration_nano, 'Float64'), mapContains(attributes_number, 'duration_nano'), toFloat64(attributes_number['duration_nano']), NULL)) AS __result_0 FROM A_AND_B GROUP BY `service.name` ORDER BY __result_0 desc SETTINGS distributed_product_mode='allow', max_memory_usage=10000000000",
+				Query: "WITH toDateTime64(1747947419000000000, 9) AS t_from, toDateTime64(1747983448000000000, 9) AS t_to, 1747945619 AS bucket_from, 1747983448 AS bucket_to, all_spans AS (SELECT *, resource_string_service$$name AS `service.name` FROM signoz_traces.distributed_signoz_index_v3 WHERE timestamp >= ? AND timestamp < ? AND ts_bucket_start >= ? AND ts_bucket_start <= ?), __resource_filter_A AS (SELECT fingerprint FROM signoz_traces.distributed_traces_v3_resource WHERE (simpleJSONExtractString(labels, 'service.name') = ? AND labels LIKE ? AND labels LIKE ?) AND seen_at_ts_bucket_start >= ? AND seen_at_ts_bucket_start <= ? GROUP BY fingerprint), A AS (SELECT * FROM signoz_traces.distributed_signoz_index_v3 WHERE resource_fingerprint GLOBAL IN (SELECT fingerprint FROM __resource_filter_A) AND timestamp >= ? AND timestamp < ? AND ts_bucket_start >= ? AND ts_bucket_start <= ?), B AS (SELECT * FROM signoz_traces.distributed_signoz_index_v3 WHERE timestamp >= ? AND timestamp < ? AND ts_bucket_start >= ? AND ts_bucket_start <= ? AND toFloat64(response_status_code) < ?), A_AND_B AS (SELECT l.* FROM A AS l INNER JOIN B AS r ON l.trace_id = r.trace_id) SELECT toString(multiIf(multiIf(resource.`service.name` IS NOT NULL, resource.`service.name`::String, mapContains(resources_string, 'service.name'), resources_string['service.name'], NULL) IS NOT NULL, multiIf(resource.`service.name` IS NOT NULL, resource.`service.name`::String, mapContains(resources_string, 'service.name'), resources_string['service.name'], NULL), NULL)) AS `service.name`, avg(multiIf(duration_nano <> 0, toFloat64(duration_nano), mapContains(attributes_number, 'duration_nano'), toFloat64(attributes_number['duration_nano']), NULL)) AS __result_0 FROM A_AND_B GROUP BY `service.name` ORDER BY __result_0 desc SETTINGS distributed_product_mode='allow', max_memory_usage=10000000000",
 				Args:  []any{"1747947419000000000", "1747983448000000000", uint64(1747945619), uint64(1747983448), "frontend", "%service.name%", "%service.name\":\"frontend%", uint64(1747945619), uint64(1747983448), "1747947419000000000", "1747983448000000000", uint64(1747945619), uint64(1747983448), "1747947419000000000", "1747983448000000000", uint64(1747945619), uint64(1747983448), float64(400)},
 			},
 			expectedErr: nil,

pkg/telemetrymetadata/metadata.go

@@ -180,7 +180,7 @@ func (t *telemetryMetaStore) getTracesKeys(ctx context.Context, fieldKeySelector
 		`CASE
 			// WHEN tagType = 'spanfield' THEN 1
 			WHEN tagType = 'resource' THEN 2
-			// WHEN tagType = 'scope' THEN 3
+			WHEN tagType = 'scope' THEN 3
 			WHEN tagType = 'tag' THEN 4
 			ELSE 5
 		END as priority`,

pkg/telemetryschema/logstelemetryschema/condition_builder.go

@@ -105,14 +105,14 @@ func (c *conditionBuilder) conditionForArrayFunction(
 			"function `%s` supports only body JSON search", operator.FunctionName()).WithUrl(functionBodyJSONSearchDocURL)
 	}
 
-	element := value
+	needle := value
 	if args, ok := value.([]any); ok && len(args) > 0 {
-		element = args[0]
+		needle = args[0]
 	}
 
 	if c.fl.BooleanOrEmpty(ctx, flagger.FeatureUseJSONBody, featuretypes.NewFlaggerEvaluationContext(orgID)) {
 		// JSON access plan: data-type collision handling, nested array paths.
-		valueType, element := InferDataType(element, operator, key)
+		valueType, needle := InferDataType(needle, operator, key)
 		// A not-found (synthesized) body path carries no metadata plan; build an exhaustive
 		// one so the query runs against the underlying data (with the not-found warning)
 		// instead of erroring, matching the regular-operator path.
@@ -123,21 +123,21 @@ func (c *conditionBuilder) conditionForArrayFunction(
 			}
 			key = keyCopy
 		}
-		return NewJSONConditionBuilder(key, valueType).buildArrayFunctionCondition(operator, element, sb)
+		return NewJSONConditionBuilder(key, valueType).buildArrayFunctionCondition(operator, needle, sb)
 	}
 
 	// legacy string-body path: type-matched array extraction, OR-ed with a scalar comparison
 	// for a scalar body value (coalesced to false so NOT has() matches missing-key rows).
-	elemType := legacyElemType(element)
+	elemType := legacyElemType(needle)
 	arrayExpr := getBodyJSONArrayKey(key, elemType)
 	scalarExpr, scalarGuard, hasScalar := getBodyJSONScalarKey(key, elemType)
-	if list, ok := element.([]any); ok {
+	if list, ok := needle.([]any); ok {
 		vals := make([]any, len(list))
 		for i, v := range list {
-			vals[i] = legacyCoerceElement(v, elemType)
+			vals[i] = legacyCoerceNeedle(v, elemType)
 		}
-		// Pin the element array type to the array it is tested against; scalar fallback below coerces value-level.
-		arrayCond := fmt.Sprintf("%s(%s, %s)", operator.FunctionName(), arrayExpr, castElementArray(elemType, sb.Var(vals)))
+		// Pin the needle array type to the haystack; scalar fallback below coerces value-level.
+		arrayCond := fmt.Sprintf("%s(%s, %s)", operator.FunctionName(), arrayExpr, castNeedleArray(elemType, sb.Var(vals)))
 		if !hasScalar {
 			return arrayCond, nil
 		}
@@ -153,17 +153,17 @@ func (c *conditionBuilder) conditionForArrayFunction(
 		}
 		return fmt.Sprintf("(%s OR ifNull(%s, false))", arrayCond, sb.And(membership, scalarGuard)), nil
 	}
-	typedElement := legacyCoerceElement(element, elemType)
-	arrayCond := fmt.Sprintf("%s(%s, %s)", operator.FunctionName(), arrayExpr, sb.Var(typedElement))
+	typedNeedle := legacyCoerceNeedle(needle, elemType)
+	arrayCond := fmt.Sprintf("%s(%s, %s)", operator.FunctionName(), arrayExpr, sb.Var(typedNeedle))
 	if !hasScalar {
 		return arrayCond, nil
 	}
-	return fmt.Sprintf("(%s OR ifNull(%s, false))", arrayCond, sb.And(sb.E(scalarExpr, typedElement), scalarGuard)), nil
+	return fmt.Sprintf("(%s OR ifNull(%s, false))", arrayCond, sb.And(sb.E(scalarExpr, typedNeedle), scalarGuard)), nil
 }
 
-// castElementArray pins an Int64 element array to Array(Int64) so it matches the Array(Nullable(Int64))
-// it is tested against; without it an element >= 2^32 binds as Array(UInt64) and hasAny/hasAll error (code 386).
-func castElementArray(elemType telemetrytypes.FieldDataType, arg string) string {
+// castNeedleArray pins an Int64 needle array to Array(Int64) so it matches the Array(Nullable(Int64))
+// haystack; without it a needle >= 2^32 binds as Array(UInt64) and hasAny/hasAll error (code 386).
+func castNeedleArray(elemType telemetrytypes.FieldDataType, arg string) string {
 	if elemType == telemetrytypes.FieldDataTypeInt64 {
 		return fmt.Sprintf("CAST(%s AS Array(Int64))", arg)
 	}
@@ -191,24 +191,24 @@ func (c *conditionBuilder) conditionForHasToken(
 	value any,
 	sb *sqlbuilder.SelectBuilder,
 ) (string, error) {
-	// hasToken takes a single token; unwrap it from the function-argument slice.
-	token := value
+	// hasToken takes a single needle; unwrap it from the function-argument slice.
+	needle := value
 	if args, ok := value.([]any); ok && len(args) > 0 {
-		token = args[0]
+		needle = args[0]
 	}
 
 	// hasToken matches string tokens only.
-	tokenStr, ok := token.(string)
+	needleStr, ok := needle.(string)
 	if !ok {
 		return "", errors.NewInvalidInputf(errors.CodeInvalidInput,
 			"function `hasToken` expects value parameter to be a string").WithUrl(hasTokenFunctionDocURL)
 	}
 
-	// A multi-token value makes CH hasToken error (code 36); reject up front as a 400. Both modes flow here.
-	if sep, found := firstTokenSeparator(tokenStr); found {
+	// A multi-token needle makes CH hasToken error (code 36); reject up front as a 400. Both modes flow here.
+	if sep, found := firstTokenSeparator(needleStr); found {
 		return "", errors.NewInvalidInputf(errors.CodeInvalidInput,
 			"function `hasToken` matches a single whole token, but %q contains the separator %q; use a substring filter (e.g. `body CONTAINS '%s'`) to search across separators",
-			tokenStr, sep, tokenStr).WithUrl(hasTokenFunctionDocURL)
+			needleStr, sep, needleStr).WithUrl(hasTokenFunctionDocURL)
 	}
 
 	bodyJSONEnabled := c.fl.BooleanOrEmpty(ctx, flagger.FeatureUseJSONBody, featuretypes.NewFlaggerEvaluationContext(orgID))
@@ -219,7 +219,7 @@ func (c *conditionBuilder) conditionForHasToken(
 			return "", errors.NewInvalidInputf(errors.CodeInvalidInput,
 				"function `hasToken` only supports body field as first parameter").WithUrl(hasTokenFunctionDocURL)
 		}
-		return fmt.Sprintf("hasToken(LOWER(%s), LOWER(%s))", LogsV2BodyColumn, sb.Var(token)), nil
+		return fmt.Sprintf("hasToken(LOWER(%s), LOWER(%s))", LogsV2BodyColumn, sb.Var(needle)), nil
 	}
 
 	// JSON mode: a bare body/body.message key searches the body.message column; any other body
@@ -228,7 +228,7 @@ func (c *conditionBuilder) conditionForHasToken(
 	// falls through and emits dynamicElement over the already-typed String column, which errors.
 	if key.Name == LogsV2BodyColumn || key.Name == bodyMessageField ||
 		(key.FieldContext == telemetrytypes.FieldContextBody && key.Name == messageSubField) {
-		return fmt.Sprintf("hasToken(LOWER(%s), LOWER(%s))", bodyMessageField, sb.Var(token)), nil
+		return fmt.Sprintf("hasToken(LOWER(%s), LOWER(%s))", bodyMessageField, sb.Var(needle)), nil
 	}
 	if key.FieldContext == telemetrytypes.FieldContextBody {
 		// A not-found (synthesized) body path carries no metadata plan; build an exhaustive
@@ -240,7 +240,7 @@ func (c *conditionBuilder) conditionForHasToken(
 			}
 			key = keyCopy
 		}
-		return NewJSONConditionBuilder(key, telemetrytypes.FieldDataTypeString).buildTokenFunctionCondition(token, sb)
+		return NewJSONConditionBuilder(key, telemetrytypes.FieldDataTypeString).buildTokenFunctionCondition(needle, sb)
 	}
 	return "", errors.NewInvalidInputf(errors.CodeInvalidInput,
 		"function `hasToken` only supports the body field or a body JSON string field as first parameter").WithUrl(hasTokenFunctionDocURL)
@@ -254,21 +254,12 @@ func (c *conditionBuilder) conditionForResolvedKey(
 	operator qbtypes.FilterOperator,
 	value any,
 	sb *sqlbuilder.SelectBuilder,
-) (condition string, err error) {
+) (string, error) {
 	// hasToken resolves from the key name + flag alone (no column resolution), so handle it first.
 	if operator == qbtypes.FilterOperatorHasToken {
 		return c.conditionForHasToken(ctx, orgID, key, value, sb)
 	}
 
-	// What the legacy body JSON path implies over the indexed LOWER(body), ANDed onto whichever
-	// condition the operator builds below — which still decides the row.
-	var bodyIndexPredicates []string
-	defer func() {
-		if err == nil && len(bodyIndexPredicates) > 0 {
-			condition = sb.And(append([]string{condition}, bodyIndexPredicates...)...)
-		}
-	}()
-
 	columns, err := c.fm.ColumnFor(ctx, orgID, startNs, endNs, key)
 	if errors.Is(err, qbtypes.ErrColumnNotFound) && key.FieldContext == telemetrytypes.FieldContextUnspecified {
 		key = telemetrytypes.NewTelemetryFieldKey(key.Name, telemetrytypes.FieldContextBody, key.FieldDataType)
@@ -278,20 +269,14 @@ func (c *conditionBuilder) conditionForResolvedKey(
 		return "", err
 	}
 
-	useJSONBody := c.fl.BooleanOrEmpty(ctx, flagger.FeatureUseJSONBody, featuretypes.NewFlaggerEvaluationContext(orgID))
-	legacyBodyJSONSearch := isBodyJSONSearch(key, columns) && !useJSONBody
-
 	// has/hasAny/hasAll take the body-JSON path, not the normal operator paths.
 	if operator.IsArrayFunctionOperator() {
-		if legacyBodyJSONSearch {
-			bodyIndexPredicates = legacyBodyIndexPredicates(key, operator, value, sb)
-		}
 		return c.conditionForArrayFunction(ctx, orgID, key, operator, value, columns, sb)
 	}
 
 	// TODO(Piyush): Update this to support multiple JSON columns based on evolutions
 	for _, column := range columns {
-		if column.Type.GetType() == schema.ColumnTypeEnumJSON && isBodyJSONSearch(key, columns) && useJSONBody && key.Name != messageSubField {
+		if column.Type.GetType() == schema.ColumnTypeEnumJSON && isBodyJSONSearch(key, columns) && c.fl.BooleanOrEmpty(ctx, flagger.FeatureUseJSONBody, featuretypes.NewFlaggerEvaluationContext(orgID)) && key.Name != messageSubField {
 			valueType, value := InferDataType(value, operator, key)
 			if len(key.JSONPlan) == 0 {
 				keyCopy := telemetrytypes.NewTelemetryFieldKey(key.Name, key.FieldContext, key.FieldDataType)
@@ -320,9 +305,8 @@ func (c *conditionBuilder) conditionForResolvedKey(
 	}
 
 	// Check if this is a body JSON search (legacy string-body path, JSON flag off).
-	if legacyBodyJSONSearch {
+	if isBodyJSONSearch(key, columns) && !c.fl.BooleanOrEmpty(ctx, flagger.FeatureUseJSONBody, featuretypes.NewFlaggerEvaluationContext(orgID)) {
 		fieldExpression, value = GetBodyJSONKey(ctx, key, operator, value)
-		bodyIndexPredicates = legacyBodyIndexPredicates(key, operator, value, sb)
 	}
 
 	fieldExpression, value = querybuilder.DataTypeCollisionHandledFieldName(key, value, fieldExpression, operator)
@@ -330,21 +314,10 @@ func (c *conditionBuilder) conditionForResolvedKey(
 	// make use of case insensitive index for body
 	if fieldExpression == "body" || fieldExpression == messageSubColumn {
 		switch operator {
-		case qbtypes.FilterOperatorEqual:
-			// Bloom filters index lower(body), not the column; `=` still decides the row.
-			if _, ok := value.(string); ok && fieldExpression == LogsV2BodyColumn {
-				return sb.And(
-					sb.E(fieldExpression, value),
-					fmt.Sprintf("LOWER(%s) = LOWER(%s)", fieldExpression, sb.Var(value)),
-				), nil
-			}
 		case qbtypes.FilterOperatorLike:
-			if _, ok := value.(string); ok && fieldExpression == LogsV2BodyColumn {
-				return sb.And(
-					sb.Like(fieldExpression, value),
-					sb.ILike(fieldExpression, value),
-				), nil
-			}
+			return sb.ILike(fieldExpression, value), nil
+		case qbtypes.FilterOperatorNotLike:
+			return sb.NotILike(fieldExpression, value), nil
 		case qbtypes.FilterOperatorRegexp:
 			// Note: Escape $$ to $$$$ to avoid sqlbuilder interpreting materialized $ signs
 			// Only needed because we are using sprintf instead of sb.Match (not implemented in sqlbuilder)
@@ -383,7 +356,7 @@ func (c *conditionBuilder) conditionForResolvedKey(
 		return sb.NotILike(fieldExpression, value), nil
 
 	case qbtypes.FilterOperatorExists, qbtypes.FilterOperatorNotExists:
-		if legacyBodyJSONSearch {
+		if isBodyJSONSearch(key, columns) && !c.fl.BooleanOrEmpty(ctx, flagger.FeatureUseJSONBody, featuretypes.NewFlaggerEvaluationContext(orgID)) {
 			if operator == qbtypes.FilterOperatorExists {
 				return GetBodyJSONKeyForExists(ctx, key, operator, value), nil
 			}

pkg/telemetryschema/logstelemetryschema/condition_builder_test.go

@@ -168,9 +168,9 @@ func TestConditionFor(t *testing.T) {
 				FieldContext: telemetrytypes.FieldContextLog,
 			},
 			operator:      qbtypes.FilterOperatorEqual,
-			value:         "Error Message",
-			expectedSQL:   "(body = ? AND LOWER(body) = LOWER(?))",
-			expectedArgs:  []any{"Error Message", "Error Message"},
+			value:         "error message",
+			expectedSQL:   "body = ?",
+			expectedArgs:  []any{"error message"},
 			expectedError: nil,
 		},
 		{
@@ -207,8 +207,8 @@ func TestConditionFor(t *testing.T) {
 			},
 			operator:      qbtypes.FilterOperatorLike,
 			value:         "%error%",
-			expectedSQL:   "(body LIKE ? AND LOWER(body) LIKE LOWER(?))",
-			expectedArgs:  []any{"%error%", "%error%"},
+			expectedSQL:   "LOWER(body) LIKE LOWER(?)",
+			expectedArgs:  []any{"%error%"},
 			expectedError: nil,
 		},
 		{
@@ -219,7 +219,7 @@ func TestConditionFor(t *testing.T) {
 			},
 			operator:      qbtypes.FilterOperatorNotLike,
 			value:         "%error%",
-			expectedSQL:   "body NOT LIKE ?",
+			expectedSQL:   "LOWER(body) NOT LIKE LOWER(?)",
 			expectedArgs:  []any{"%error%"},
 			expectedError: nil,
 		},
@@ -619,8 +619,8 @@ func TestConditionForMultipleKeys(t *testing.T) {
 			},
 			operator:      qbtypes.FilterOperatorEqual,
 			value:         "error message",
-			expectedSQL:   "(body = ? AND LOWER(body) = LOWER(?)) AND severity_text = ?",
-			expectedArgs:  []any{"error message", "error message", "error message"},
+			expectedSQL:   "body = ? AND severity_text = ?",
+			expectedArgs:  []any{"error message", "error message"},
 			expectedError: nil,
 		},
 	}
@@ -906,8 +906,8 @@ func TestConditionForJSONBodySearch(t *testing.T) {
 	}
 }
 
-// IN on the body column routes each value back through the `=` path, so every arm picks up
-// the lower(body) companion — including the values a mixed-type list stringifies.
+// IN on the body column routes each value back through the `=` path; the SQL it produces
+// must stay what the shared IN handling produced before, including for a mixed-type list.
 func TestConditionForBodyIn(t *testing.T) {
 	testCases := []struct {
 		name         string
@@ -918,14 +918,14 @@ func TestConditionForBodyIn(t *testing.T) {
 		{
 			name:         "strings",
 			values:       []any{"alpha", "beta"},
-			expectedSQL:  "((body = ? AND LOWER(body) = LOWER(?)) OR (body = ? AND LOWER(body) = LOWER(?)))",
-			expectedArgs: []any{"alpha", "alpha", "beta", "beta"},
+			expectedSQL:  "(body = ? OR body = ?)",
+			expectedArgs: []any{"alpha", "beta"},
 		},
 		{
 			name:         "mixed types are stringified before they reach the column",
 			values:       []any{"alpha", float64(1), true},
-			expectedSQL:  "((body = ? AND LOWER(body) = LOWER(?)) OR (body = ? AND LOWER(body) = LOWER(?)) OR (body = ? AND LOWER(body) = LOWER(?)))",
-			expectedArgs: []any{"alpha", "alpha", "1", "1", "true", "true"},
+			expectedSQL:  "(body = ? OR body = ? OR body = ?)",
+			expectedArgs: []any{"alpha", "1", "true"},
 		},
 	}
 
@@ -954,213 +954,3 @@ func TestConditionForBodyIn(t *testing.T) {
 		})
 	}
 }
-
-// ClickHouse treats `\` as an escape only before `%`, `_` and itself.
-func TestLikePatternLiterals(t *testing.T) {
-	testCases := []struct {
-		name     string
-		pattern  string
-		expected []string
-	}{
-		{"contains wraps a plain value", "%error%", []string{"error"}},
-		{"wildcards split runs", "%foo%bar%", []string{"foo", "bar"}},
-		{"underscore splits too", "a_b", []string{"a", "b"}},
-		{"escaped wildcards stay literal", `%100\%\_off%`, []string{`100%_off`}},
-		{"escaped backslash collapses", `%C:\\tmp%`, []string{`C:\tmp`}},
-		{"backslash before other chars is literal", `%C:\tmp%`, []string{`C:\tmp`}},
-		{"trailing backslash is literal", `%path\`, []string{`path\`}},
-		{"no literals at all", "%_%", nil},
-	}
-
-	for _, tc := range testCases {
-		t.Run(tc.name, func(t *testing.T) {
-			assert.Equal(t, tc.expected, likePatternLiterals(tc.pattern))
-		})
-	}
-}
-
-// The literals have to hold whichever encoder wrote the body, so the runs stop at every byte
-// one of them may rewrite.
-func TestJSONTextRuns(t *testing.T) {
-	testCases := []struct {
-		name     string
-		value    string
-		expected []string
-	}{
-		{"plain text is one run", "checkout failed", []string{"checkout failed"}},
-		{"shorter than an ngram yields nothing", "abc", nil},
-		{"quote splits the run", `say "hello there"`, []string{"say ", "hello there"}},
-		{"slash splits the run, PHP escapes it", "/api/v1/users", []string{"users"}},
-		{"ampersand and angles split, Go escapes them", "a&b<c>dddd", []string{"dddd"}},
-		{"non-ascii splits, Python escapes it", "order café latte", []string{"order caf", " latte"}},
-		{"newline splits", "line one\nline two", []string{"line one", "line two"}},
-	}
-
-	for _, tc := range testCases {
-		t.Run(tc.name, func(t *testing.T) {
-			assert.Equal(t, tc.expected, jsonTextRuns(tc.value))
-		})
-	}
-}
-
-func TestBodyPathLiterals(t *testing.T) {
-	testCases := []struct {
-		name     string
-		key      string
-		expected []string
-	}{
-		{"quoting lifts a short name over the ngram size", "id", []string{`"id"`}},
-		{"one literal per component", "response.status_code", []string{`"response"`, `"status_code"`}},
-		{"array suffixes are trimmed", "items[*].sku", []string{`"items"`, `"sku"`}},
-		{"single-character components are dropped", "a.b.count", []string{`"count"`}},
-		{"a component an encoder may rewrite is dropped", "user/name.email", []string{`"email"`}},
-		{"nothing usable", "a.b", nil},
-	}
-
-	for _, tc := range testCases {
-		t.Run(tc.name, func(t *testing.T) {
-			key := telemetrytypes.NewTelemetryFieldKey(tc.key, telemetrytypes.FieldContextBody, telemetrytypes.FieldDataTypeUnspecified)
-			assert.Equal(t, tc.expected, bodyPathLiterals(key))
-		})
-	}
-}
-
-// The path literals ride on the existence assertion and the value literals on the comparison, so
-// a filter carries each at most once. Nothing rides on a negated operator: it matches rows
-// without the path, which say nothing about the body text.
-func TestLegacyBodyIndexPredicates(t *testing.T) {
-	testCases := []struct {
-		name         string
-		key          string
-		operator     qbtypes.FilterOperator
-		value        any
-		expected     string
-		expectedArgs []any
-	}{
-		{
-			name:         "exists carries the path",
-			key:          "user_id",
-			operator:     qbtypes.FilterOperatorExists,
-			expected:     `LOWER(body) LIKE LOWER(?)`,
-			expectedArgs: []any{`%"user\_id"%`},
-		},
-		{
-			name:         "equality carries the value",
-			key:          "status",
-			operator:     qbtypes.FilterOperatorEqual,
-			value:        "timeout_error",
-			expected:     `LOWER(body) LIKE LOWER(?)`,
-			expectedArgs: []any{`%timeout\_error%`},
-		},
-		{
-			name:         "contains carries the value",
-			key:          "message",
-			operator:     qbtypes.FilterOperatorContains,
-			value:        "upstream refused",
-			expected:     `LOWER(body) LIKE LOWER(?)`,
-			expectedArgs: []any{`%upstream refused%`},
-		},
-		{
-			name:         "like carries one literal per run of the pattern",
-			key:          "message",
-			operator:     qbtypes.FilterOperatorLike,
-			value:        "%conn%refused%",
-			expected:     `LOWER(body) LIKE LOWER(?)`,
-			expectedArgs: []any{`%conn%refused%`},
-		},
-		{
-			name:     "has carries the path and the element",
-			key:      "tags[*]",
-			operator: qbtypes.FilterOperatorHas,
-			value:    []any{"production"},
-			// The element rides on its own predicate rather than being pinned next to the key:
-			// has() over the extracted array says nothing about where in the text it sits.
-			expected:     `LOWER(body) LIKE LOWER(?) AND LOWER(body) LIKE LOWER(?)`,
-			expectedArgs: []any{`%"tags"%`, "%production%"},
-		},
-		{
-			name:         "hasAll carries one literal per element",
-			key:          "tags[*]",
-			operator:     qbtypes.FilterOperatorHasAll,
-			value:        []any{[]any{"production", "webserver"}},
-			expected:     `LOWER(body) LIKE LOWER(?) AND LOWER(body) LIKE LOWER(?) AND LOWER(body) LIKE LOWER(?)`,
-			expectedArgs: []any{`%"tags"%`, "%production%", "%webserver%"},
-		},
-		{
-			// hasAny asks for one of the elements, so the arms are ORed — ANDing them would
-			// demand every element be present.
-			name:         "hasAny ORs the element literals",
-			key:          "tags[*]",
-			operator:     qbtypes.FilterOperatorHasAny,
-			value:        []any{[]any{"production", "webserver"}},
-			expected:     `LOWER(body) LIKE LOWER(?) AND (LOWER(body) LIKE LOWER(?) OR LOWER(body) LIKE LOWER(?))`,
-			expectedArgs: []any{`%"tags"%`, "%production%", "%webserver%"},
-		},
-		{
-			// one element with no usable literal voids the whole OR: the filter can still match
-			// through that element, so nothing about the text is implied.
-			name:         "hasAny drops the OR when an element is too short",
-			key:          "tags[*]",
-			operator:     qbtypes.FilterOperatorHasAny,
-			value:        []any{[]any{"production", "web"}},
-			expected:     `LOWER(body) LIKE LOWER(?)`,
-			expectedArgs: []any{`%"tags"%`},
-		},
-		{
-			name:         "numeric elements carry nothing",
-			key:          "ids[*]",
-			operator:     qbtypes.FilterOperatorHasAny,
-			value:        []any{[]any{"9007199254740993", "9007199254740994"}},
-			expected:     `LOWER(body) LIKE LOWER(?)`,
-			expectedArgs: []any{`%"ids"%`},
-		},
-		{
-			name:     "a number carries nothing",
-			key:      "user_id",
-			operator: qbtypes.FilterOperatorEqual,
-			value:    int64(123),
-		},
-		{
-			name:     "IN leaves it to the equalities it delegates to",
-			key:      "status",
-			operator: qbtypes.FilterOperatorIn,
-			value:    []any{"timeout_error", "conn_refused"},
-		},
-		{
-			name:     "not equal carries nothing",
-			key:      "status",
-			operator: qbtypes.FilterOperatorNotEqual,
-			value:    "timeout_error",
-		},
-		{
-			name:     "not exists carries nothing",
-			key:      "user_id",
-			operator: qbtypes.FilterOperatorNotExists,
-		},
-		{
-			name:     "not contains carries nothing",
-			key:      "message",
-			operator: qbtypes.FilterOperatorNotContains,
-			value:    "upstream refused",
-		},
-	}
-
-	for _, tc := range testCases {
-		t.Run(tc.name, func(t *testing.T) {
-			sb := sqlbuilder.NewSelectBuilder()
-			sb.Select("1").From("t")
-			key := telemetrytypes.NewTelemetryFieldKey(tc.key, telemetrytypes.FieldContextBody, telemetrytypes.FieldDataTypeUnspecified)
-
-			predicates := legacyBodyIndexPredicates(key, tc.operator, tc.value, sb)
-			if tc.expected == "" {
-				assert.Empty(t, predicates)
-				return
-			}
-
-			sb.Where(predicates...)
-			query, args := sb.BuildWithFlavor(sqlbuilder.ClickHouse)
-			assert.Contains(t, query, tc.expected)
-			assert.Equal(t, tc.expectedArgs, args)
-		})
-	}
-}

pkg/telemetryschema/logstelemetryschema/filter_expr_logs_body_json_test.go

@@ -44,169 +44,168 @@ func TestFilterExprLogsBodyJSON(t *testing.T) {
 			category:              "json",
 			query:                 "has(body.requestor_list[*], 'index_service')",
 			shouldPass:            true,
-			expectedQuery:         `WHERE ((has(JSONExtract(JSON_QUERY(body, '$."requestor_list"[*]'), 'Array(Nullable(String))'), ?) OR ifNull((JSON_VALUE(body, '$."requestor_list"') = ? AND JSONType(body, 'requestor_list') NOT IN ('Array', 'Object', 'Null')), false)) AND LOWER(body) LIKE LOWER(?) AND LOWER(body) LIKE LOWER(?))`,
-			expectedArgs:          []any{"index_service", "index_service", "%\"requestor\\_list\"%", "%index\\_service%"},
+			expectedQuery:         `WHERE (has(JSONExtract(JSON_QUERY(body, '$."requestor_list"[*]'), 'Array(Nullable(String))'), ?) OR ifNull((JSON_VALUE(body, '$."requestor_list"') = ? AND JSONType(body, 'requestor_list') NOT IN ('Array', 'Object', 'Null')), false))`,
+			expectedArgs:          []any{"index_service", "index_service"},
 			expectedErrorContains: "",
 		},
 		{
 			category:              "json",
 			query:                 "has(body.int_numbers[*], 2)",
 			shouldPass:            true,
-			expectedQuery:         `WHERE ((has(JSONExtract(JSON_QUERY(body, '$."int_numbers"[*]'), 'Array(Nullable(Float64))'), ?) OR ifNull((JSONExtract(JSON_VALUE(body, '$."int_numbers"'), 'Nullable(Float64)') = ? AND JSONType(body, 'int_numbers') NOT IN ('Array', 'Object', 'Null')), false)) AND LOWER(body) LIKE LOWER(?))`,
-			expectedArgs:          []any{float64(2), float64(2), "%\"int\\_numbers\"%"},
+			expectedQuery:         `WHERE (has(JSONExtract(JSON_QUERY(body, '$."int_numbers"[*]'), 'Array(Nullable(Float64))'), ?) OR ifNull((JSONExtract(JSON_VALUE(body, '$."int_numbers"'), 'Nullable(Float64)') = ? AND JSONType(body, 'int_numbers') NOT IN ('Array', 'Object', 'Null')), false))`,
+			expectedArgs:          []any{float64(2), float64(2)},
 			expectedErrorContains: "",
 		},
 		{
 			category:              "json",
 			query:                 "has(body.bool[*], true)",
 			shouldPass:            true,
-			expectedQuery:         `WHERE ((has(JSONExtract(JSON_QUERY(body, '$."bool"[*]'), 'Array(Nullable(String))'), ?) OR ifNull((JSON_VALUE(body, '$."bool"') = ? AND JSONType(body, 'bool') NOT IN ('Array', 'Object', 'Null')), false)) AND LOWER(body) LIKE LOWER(?))`,
-			expectedArgs:          []any{"true", "true", "%\"bool\"%"},
+			expectedQuery:         `WHERE (has(JSONExtract(JSON_QUERY(body, '$."bool"[*]'), 'Array(Nullable(String))'), ?) OR ifNull((JSON_VALUE(body, '$."bool"') = ? AND JSONType(body, 'bool') NOT IN ('Array', 'Object', 'Null')), false))`,
+			expectedArgs:          []any{"true", "true"},
 			expectedErrorContains: "",
 		},
 		{
 			category:              "json",
 			query:                 "NOT has(body.nested_num[*].float_nums[*], 2.2)",
 			shouldPass:            true,
-			expectedQuery:         `WHERE NOT ((has(JSONExtract(JSON_QUERY(body, '$."nested_num"[*]."float_nums"[*]'), 'Array(Nullable(Float64))'), ?) AND LOWER(body) LIKE LOWER(?)))`,
-			expectedArgs:          []any{float64(2.2), "%\"nested\\_num\"%\"float\\_nums\"%"},
+			expectedQuery:         `WHERE NOT (has(JSONExtract(JSON_QUERY(body, '$."nested_num"[*]."float_nums"[*]'), 'Array(Nullable(Float64))'), ?))`,
+			expectedArgs:          []any{float64(2.2)},
 			expectedErrorContains: "",
 		},
 		{
 			category:              "json",
 			query:                 "has(body.tags, 'production')",
 			shouldPass:            true,
-			expectedQuery:         `WHERE ((has(JSONExtract(JSON_QUERY(body, '$."tags"[*]'), 'Array(Nullable(String))'), ?) OR ifNull((JSON_VALUE(body, '$."tags"') = ? AND JSONType(body, 'tags') NOT IN ('Array', 'Object', 'Null')), false)) AND LOWER(body) LIKE LOWER(?) AND LOWER(body) LIKE LOWER(?))`,
-			expectedArgs:          []any{"production", "production", "%\"tags\"%", "%production%"},
+			expectedQuery:         `WHERE (has(JSONExtract(JSON_QUERY(body, '$."tags"[*]'), 'Array(Nullable(String))'), ?) OR ifNull((JSON_VALUE(body, '$."tags"') = ? AND JSONType(body, 'tags') NOT IN ('Array', 'Object', 'Null')), false))`,
+			expectedArgs:          []any{"production", "production"},
 			expectedErrorContains: "",
 		},
 		{
 			category:              "json",
 			query:                 "hasAny(body.tags, ['critical', 'test'])",
 			shouldPass:            true,
-			expectedQuery:         `WHERE ((hasAny(JSONExtract(JSON_QUERY(body, '$."tags"[*]'), 'Array(Nullable(String))'), ?) OR ifNull((JSON_VALUE(body, '$."tags"') IN (?, ?) AND JSONType(body, 'tags') NOT IN ('Array', 'Object', 'Null')), false)) AND LOWER(body) LIKE LOWER(?) AND (LOWER(body) LIKE LOWER(?) OR LOWER(body) LIKE LOWER(?)))`,
-			expectedArgs:          []any{[]any{"critical", "test"}, "critical", "test", "%\"tags\"%", "%critical%", "%test%"},
+			expectedQuery:         `WHERE (hasAny(JSONExtract(JSON_QUERY(body, '$."tags"[*]'), 'Array(Nullable(String))'), ?) OR ifNull((JSON_VALUE(body, '$."tags"') IN (?, ?) AND JSONType(body, 'tags') NOT IN ('Array', 'Object', 'Null')), false))`,
+			expectedArgs:          []any{[]any{"critical", "test"}, "critical", "test"},
 			expectedErrorContains: "",
 		},
 		{
 			category:              "json",
 			query:                 "hasAll(body.tags, ['production', 'web'])",
 			shouldPass:            true,
-			expectedQuery:         `WHERE ((hasAll(JSONExtract(JSON_QUERY(body, '$."tags"[*]'), 'Array(Nullable(String))'), ?) OR ifNull(((JSON_VALUE(body, '$."tags"') = ? AND JSON_VALUE(body, '$."tags"') = ?) AND JSONType(body, 'tags') NOT IN ('Array', 'Object', 'Null')), false)) AND LOWER(body) LIKE LOWER(?) AND LOWER(body) LIKE LOWER(?))`,
-			expectedArgs:          []any{[]any{"production", "web"}, "production", "web", "%\"tags\"%", "%production%"},
+			expectedQuery:         `WHERE (hasAll(JSONExtract(JSON_QUERY(body, '$."tags"[*]'), 'Array(Nullable(String))'), ?) OR ifNull(((JSON_VALUE(body, '$."tags"') = ? AND JSON_VALUE(body, '$."tags"') = ?) AND JSONType(body, 'tags') NOT IN ('Array', 'Object', 'Null')), false))`,
+			expectedArgs:          []any{[]any{"production", "web"}, "production", "web"},
 			expectedErrorContains: "",
 		},
 		{
 			category:              "json",
 			query:                 "has(body.ids, \"200\")",
 			shouldPass:            true,
-			expectedQuery:         `WHERE ((has(JSONExtract(JSON_QUERY(body, '$."ids"[*]'), 'Array(Nullable(Int64))'), ?) OR ifNull((JSONExtract(JSON_VALUE(body, '$."ids"'), 'Nullable(Int64)') = ? AND JSONType(body, 'ids') NOT IN ('Array', 'Object', 'Null')), false)) AND LOWER(body) LIKE LOWER(?))`,
-			expectedArgs:          []any{int64(200), int64(200), "%\"ids\"%"},
+			expectedQuery:         `WHERE (has(JSONExtract(JSON_QUERY(body, '$."ids"[*]'), 'Array(Nullable(Int64))'), ?) OR ifNull((JSONExtract(JSON_VALUE(body, '$."ids"'), 'Nullable(Int64)') = ? AND JSONType(body, 'ids') NOT IN ('Array', 'Object', 'Null')), false))`,
+			expectedArgs:          []any{int64(200), int64(200)},
 			expectedErrorContains: "",
 		},
 		{
-			// Big-int element CAST to Array(Int64) to match the array it is tested against (else 386).
+			// Big-int needle CAST to Array(Int64) to match the haystack (else 386).
 			category:              "json",
 			query:                 `hasAny(body.ids, ['9007199254740993', '9007199254740994'])`,
 			shouldPass:            true,
-			expectedQuery:         `WHERE ((hasAny(JSONExtract(JSON_QUERY(body, '$."ids"[*]'), 'Array(Nullable(Int64))'), CAST(? AS Array(Int64))) OR ifNull((JSONExtract(JSON_VALUE(body, '$."ids"'), 'Nullable(Int64)') IN (?, ?) AND JSONType(body, 'ids') NOT IN ('Array', 'Object', 'Null')), false)) AND LOWER(body) LIKE LOWER(?))`,
-			expectedArgs:          []any{[]any{int64(9007199254740993), int64(9007199254740994)}, int64(9007199254740993), int64(9007199254740994), "%\"ids\"%"},
+			expectedQuery:         `WHERE (hasAny(JSONExtract(JSON_QUERY(body, '$."ids"[*]'), 'Array(Nullable(Int64))'), CAST(? AS Array(Int64))) OR ifNull((JSONExtract(JSON_VALUE(body, '$."ids"'), 'Nullable(Int64)') IN (?, ?) AND JSONType(body, 'ids') NOT IN ('Array', 'Object', 'Null')), false))`,
+			expectedArgs:          []any{[]any{int64(9007199254740993), int64(9007199254740994)}, int64(9007199254740993), int64(9007199254740994)},
 			expectedErrorContains: "",
 		},
 		{
 			category:              "json",
 			query:                 `hasAll(body.ids, ['9007199254740993', '9007199254740994'])`,
 			shouldPass:            true,
-			expectedQuery:         `WHERE ((hasAll(JSONExtract(JSON_QUERY(body, '$."ids"[*]'), 'Array(Nullable(Int64))'), CAST(? AS Array(Int64))) OR ifNull(((JSONExtract(JSON_VALUE(body, '$."ids"'), 'Nullable(Int64)') = ? AND JSONExtract(JSON_VALUE(body, '$."ids"'), 'Nullable(Int64)') = ?) AND JSONType(body, 'ids') NOT IN ('Array', 'Object', 'Null')), false)) AND LOWER(body) LIKE LOWER(?))`,
-			expectedArgs:          []any{[]any{int64(9007199254740993), int64(9007199254740994)}, int64(9007199254740993), int64(9007199254740994), "%\"ids\"%"},
+			expectedQuery:         `WHERE (hasAll(JSONExtract(JSON_QUERY(body, '$."ids"[*]'), 'Array(Nullable(Int64))'), CAST(? AS Array(Int64))) OR ifNull(((JSONExtract(JSON_VALUE(body, '$."ids"'), 'Nullable(Int64)') = ? AND JSONExtract(JSON_VALUE(body, '$."ids"'), 'Nullable(Int64)') = ?) AND JSONType(body, 'ids') NOT IN ('Array', 'Object', 'Null')), false))`,
+			expectedArgs:          []any{[]any{int64(9007199254740993), int64(9007199254740994)}, int64(9007199254740993), int64(9007199254740994)},
 			expectedErrorContains: "",
 		},
 		{
 			category:              "json",
 			query:                 "body.message = hello",
 			shouldPass:            true,
-			expectedQuery:         `WHERE ((JSON_VALUE(body, '$."message"') = ? AND LOWER(body) LIKE LOWER(?)) AND (JSON_EXISTS(body, '$."message"') AND LOWER(body) LIKE LOWER(?)))`,
-			expectedArgs:          []any{"hello", "%hello%", "%\"message\"%"},
+			expectedQuery:         `WHERE (JSON_VALUE(body, '$."message"') = ? AND JSON_EXISTS(body, '$."message"'))`,
+			expectedArgs:          []any{"hello"},
 			expectedErrorContains: "",
 		},
 		{
 			category:              "json",
 			query:                 "body.status = 1",
 			shouldPass:            true,
-			expectedQuery:         `WHERE (JSONExtract(JSON_VALUE(body, '$."status"'), 'Float64') = ? AND (JSON_EXISTS(body, '$."status"') AND LOWER(body) LIKE LOWER(?)))`,
-			expectedArgs:          []any{float64(1), "%\"status\"%"},
+			expectedQuery:         `WHERE (JSONExtract(JSON_VALUE(body, '$."status"'), 'Float64') = ? AND JSON_EXISTS(body, '$."status"'))`,
+			expectedArgs:          []any{float64(1)},
 			expectedErrorContains: "",
 		},
 		{
 			category:              "json",
 			query:                 "body.status = 1.1",
 			shouldPass:            true,
-			expectedQuery:         `WHERE (JSONExtract(JSON_VALUE(body, '$."status"'), 'Float64') = ? AND (JSON_EXISTS(body, '$."status"') AND LOWER(body) LIKE LOWER(?)))`,
-			expectedArgs:          []any{float64(1.1), "%\"status\"%"},
+			expectedQuery:         `WHERE (JSONExtract(JSON_VALUE(body, '$."status"'), 'Float64') = ? AND JSON_EXISTS(body, '$."status"'))`,
+			expectedArgs:          []any{float64(1.1)},
 			expectedErrorContains: "",
 		},
 		{
 			category:              "json",
 			query:                 "body.boolkey = true",
 			shouldPass:            true,
-			expectedQuery:         `WHERE (JSONExtract(JSON_VALUE(body, '$."boolkey"'), 'Bool') = ? AND (JSON_EXISTS(body, '$."boolkey"') AND LOWER(body) LIKE LOWER(?)))`,
-			expectedArgs:          []any{true, "%\"boolkey\"%"},
+			expectedQuery:         `WHERE (JSONExtract(JSON_VALUE(body, '$."boolkey"'), 'Bool') = ? AND JSON_EXISTS(body, '$."boolkey"'))`,
+			expectedArgs:          []any{true},
 			expectedErrorContains: "",
 		},
 		{
 			category:              "json",
 			query:                 "body.status > 200",
 			shouldPass:            true,
-			expectedQuery:         `WHERE (JSONExtract(JSON_VALUE(body, '$."status"'), 'Float64') > ? AND (JSON_EXISTS(body, '$."status"') AND LOWER(body) LIKE LOWER(?)))`,
-			expectedArgs:          []any{float64(200), "%\"status\"%"},
+			expectedQuery:         `WHERE (JSONExtract(JSON_VALUE(body, '$."status"'), 'Float64') > ? AND JSON_EXISTS(body, '$."status"'))`,
+			expectedArgs:          []any{float64(200)},
 			expectedErrorContains: "",
 		},
 		{
 			category:              "json",
 			query:                 "body.message REGEXP 'a*'",
 			shouldPass:            true,
-			expectedQuery:         `WHERE (match(JSON_VALUE(body, '$."message"'), ?) AND (JSON_EXISTS(body, '$."message"') AND LOWER(body) LIKE LOWER(?)))`,
-			expectedArgs:          []any{"a*", "%\"message\"%"},
+			expectedQuery:         `WHERE (match(JSON_VALUE(body, '$."message"'), ?) AND JSON_EXISTS(body, '$."message"'))`,
+			expectedArgs:          []any{"a*"},
 			expectedErrorContains: "",
 		},
 		{
 			category:              "json",
 			query:                 `body.message CONTAINS "hello 'world'"`,
 			shouldPass:            true,
-			expectedQuery:         `WHERE ((LOWER(JSON_VALUE(body, '$."message"')) LIKE LOWER(?) AND LOWER(body) LIKE LOWER(?)) AND (JSON_EXISTS(body, '$."message"') AND LOWER(body) LIKE LOWER(?)))`,
-			expectedArgs:          []any{"%hello 'world'%", "%hello 'world'%", "%\"message\"%"},
+			expectedQuery:         `WHERE (LOWER(JSON_VALUE(body, '$."message"')) LIKE LOWER(?) AND JSON_EXISTS(body, '$."message"'))`,
+			expectedArgs:          []any{"%hello 'world'%"},
 			expectedErrorContains: "",
 		},
 		{
 			category:              "json",
 			query:                 `body.message EXISTS`,
 			shouldPass:            true,
-			expectedQuery:         `WHERE (JSON_EXISTS(body, '$."message"') AND LOWER(body) LIKE LOWER(?))`,
-			expectedArgs:          []any{"%\"message\"%"},
+			expectedQuery:         `WHERE JSON_EXISTS(body, '$."message"')`,
 			expectedErrorContains: "",
 		},
 		{
 			category:              "json",
 			query:                 `body.name IN ('hello', 'world')`,
 			shouldPass:            true,
-			expectedQuery:         `WHERE (((JSON_VALUE(body, '$."name"') = ? AND LOWER(body) LIKE LOWER(?)) OR (JSON_VALUE(body, '$."name"') = ? AND LOWER(body) LIKE LOWER(?))) AND (JSON_EXISTS(body, '$."name"') AND LOWER(body) LIKE LOWER(?)))`,
-			expectedArgs:          []any{"hello", "%hello%", "world", "%world%", "%\"name\"%"},
+			expectedQuery:         `WHERE ((JSON_VALUE(body, '$."name"') = ? OR JSON_VALUE(body, '$."name"') = ?) AND JSON_EXISTS(body, '$."name"'))`,
+			expectedArgs:          []any{"hello", "world"},
 			expectedErrorContains: "",
 		},
 		{
 			category:              "json",
 			query:                 `body.value IN (200, 300)`,
 			shouldPass:            true,
-			expectedQuery:         `WHERE ((JSONExtract(JSON_VALUE(body, '$."value"'), 'Float64') = ? OR JSONExtract(JSON_VALUE(body, '$."value"'), 'Float64') = ?) AND (JSON_EXISTS(body, '$."value"') AND LOWER(body) LIKE LOWER(?)))`,
-			expectedArgs:          []any{float64(200), float64(300), "%\"value\"%"},
+			expectedQuery:         `WHERE ((JSONExtract(JSON_VALUE(body, '$."value"'), 'Float64') = ? OR JSONExtract(JSON_VALUE(body, '$."value"'), 'Float64') = ?) AND JSON_EXISTS(body, '$."value"'))`,
+			expectedArgs:          []any{float64(200), float64(300)},
 			expectedErrorContains: "",
 		},
 		{
 			category:              "json",
 			query:                 "body.key-with-hyphen = true",
 			shouldPass:            true,
-			expectedQuery:         `WHERE (JSONExtract(JSON_VALUE(body, '$."key-with-hyphen"'), 'Bool') = ? AND (JSON_EXISTS(body, '$."key-with-hyphen"') AND LOWER(body) LIKE LOWER(?)))`,
-			expectedArgs:          []any{true, "%\"key-with-hyphen\"%"},
+			expectedQuery:         `WHERE (JSONExtract(JSON_VALUE(body, '$."key-with-hyphen"'), 'Bool') = ? AND JSON_EXISTS(body, '$."key-with-hyphen"'))`,
+			expectedArgs:          []any{true},
 			expectedErrorContains: "",
 		},
 	}

pkg/telemetryschema/logstelemetryschema/filter_expr_logs_test.go

@@ -737,8 +737,8 @@ func TestFilterExprLogs(t *testing.T) {
 			category:              "Key-operator-value boundary",
 			query:                 "greater>than",
 			shouldPass:            true,
-			expectedQuery:         `WHERE ((attributes_string['greater'] > ? AND mapContains(attributes_string, 'greater')) OR (JSON_VALUE(body, '$."greater"') > ? AND (JSON_EXISTS(body, '$."greater"') AND LOWER(body) LIKE LOWER(?))))`,
-			expectedArgs:          []any{"than", "than", "%\"greater\"%"},
+			expectedQuery:         `WHERE ((attributes_string['greater'] > ? AND mapContains(attributes_string, 'greater')) OR (JSON_VALUE(body, '$."greater"') > ? AND JSON_EXISTS(body, '$."greater"')))`,
+			expectedArgs:          []any{"than", "than"},
 			expectedErrorContains: "",
 		},
 		{
@@ -753,8 +753,8 @@ func TestFilterExprLogs(t *testing.T) {
 			category:              "Key-operator-value boundary",
 			query:                 "less<than",
 			shouldPass:            true,
-			expectedQuery:         `WHERE ((attributes_string['less'] < ? AND mapContains(attributes_string, 'less')) OR (JSON_VALUE(body, '$."less"') < ? AND (JSON_EXISTS(body, '$."less"') AND LOWER(body) LIKE LOWER(?))))`,
-			expectedArgs:          []any{"than", "than", "%\"less\"%"},
+			expectedQuery:         `WHERE ((attributes_string['less'] < ? AND mapContains(attributes_string, 'less')) OR (JSON_VALUE(body, '$."less"') < ? AND JSON_EXISTS(body, '$."less"')))`,
+			expectedArgs:          []any{"than", "than"},
 			expectedErrorContains: "",
 		},
 		{
@@ -809,8 +809,8 @@ func TestFilterExprLogs(t *testing.T) {
 			category:              "Key-operator-value boundary",
 			query:                 "user=admin",
 			shouldPass:            true,
-			expectedQuery:         `WHERE ((attributes_string['user'] = ? AND mapContains(attributes_string, 'user')) OR ((JSON_VALUE(body, '$."user"') = ? AND LOWER(body) LIKE LOWER(?)) AND (JSON_EXISTS(body, '$."user"') AND LOWER(body) LIKE LOWER(?))))`,
-			expectedArgs:          []any{"admin", "admin", "%admin%", "%\"user\"%"},
+			expectedQuery:         `WHERE ((attributes_string['user'] = ? AND mapContains(attributes_string, 'user')) OR (JSON_VALUE(body, '$."user"') = ? AND JSON_EXISTS(body, '$."user"')))`,
+			expectedArgs:          []any{"admin", "admin"},
 			expectedErrorContains: "",
 		},
 		{
@@ -1561,15 +1561,15 @@ func TestFilterExprLogs(t *testing.T) {
 			expectedArgs:          []any{"download"},
 			expectedErrorContains: "function `hasToken` expects value parameter to be a string",
 		},
-		// A multi-token value (separator/whitespace) is a clean 400, not a CH execution error.
+		// A multi-token needle (separator/whitespace) is a clean 400, not a CH execution error.
 		{
-			category:              "hasTokenUnderscoreSeparator",
+			category:              "hasTokenUnderscoreNeedle",
 			query:                 "hasToken(body, \"user_id\")",
 			shouldPass:            false,
 			expectedErrorContains: "function `hasToken` matches a single whole token",
 		},
 		{
-			category:              "hasTokenWhitespaceSeparator",
+			category:              "hasTokenWhitespaceNeedle",
 			query:                 "hasToken(body, \"production node\")",
 			shouldPass:            false,
 			expectedErrorContains: "function `hasToken` matches a single whole token",
@@ -2052,8 +2052,8 @@ func TestFilterExprLogs(t *testing.T) {
 			category:              "Nested object paths",
 			query:                 "response.body.data.items[].id=123",
 			shouldPass:            true,
-			expectedQuery:         `WHERE ((toFloat64(attributes_number['response.body.data.items[].id']) = ? AND mapContains(attributes_number, 'response.body.data.items[].id')) OR (JSONExtract(JSON_VALUE(body, '$."response"."body"."data"."items"[*]."id"'), 'Float64') = ? AND (JSON_EXISTS(body, '$."response"."body"."data"."items"[*]."id"') AND LOWER(body) LIKE LOWER(?))))`,
-			expectedArgs:          []any{float64(123), float64(123), "%\"response\"%\"body\"%\"data\"%\"items\"%\"id\"%"},
+			expectedQuery:         `WHERE ((toFloat64(attributes_number['response.body.data.items[].id']) = ? AND mapContains(attributes_number, 'response.body.data.items[].id')) OR (JSONExtract(JSON_VALUE(body, '$."response"."body"."data"."items"[*]."id"'), 'Float64') = ? AND JSON_EXISTS(body, '$."response"."body"."data"."items"[*]."id"')))`,
+			expectedArgs:          []any{float64(123), float64(123)},
 			expectedErrorContains: "",
 		},
 		{
@@ -2521,7 +2521,7 @@ func TestFilterExprLogsConflictNegation(t *testing.T) {
 			query:      "body NOT LIKE 'done'",
 			shouldPass: true,
 			// lower index search on body even for LIKE
-			expectedQuery:         "WHERE (body NOT LIKE ? AND attributes_string['body'] NOT LIKE ?)",
+			expectedQuery:         "WHERE (LOWER(body) NOT LIKE LOWER(?) AND attributes_string['body'] NOT LIKE ?)",
 			expectedArgs:          []any{"done", "done"},
 			expectedErrorContains: "",
 		},

pkg/telemetryschema/logstelemetryschema/json_condition_builder.go

@@ -439,27 +439,27 @@ func (c *jsonConditionBuilder) arrayFuncScalarLeaf(node *telemetrytypes.JSONAcce
 // buildTokenFunctionCondition builds a hasToken search over a body JSON string field:
 // hasToken(LOWER(<elem>), LOWER(?)) wrapped in arrayExists over any array hops between the
 // root and the terminal. The field must resolve to a String leaf or a String array.
-func (c *jsonConditionBuilder) buildTokenFunctionCondition(token any, sb *sqlbuilder.SelectBuilder) (string, error) {
+func (c *jsonConditionBuilder) buildTokenFunctionCondition(needle any, sb *sqlbuilder.SelectBuilder) (string, error) {
 	if len(c.key.JSONPlan) == 0 {
 		return "", errors.NewInvalidInputf(errors.CodeInvalidInput, "function `hasToken` could not resolve a JSON access plan for field `%s`", c.key.Name)
 	}
 
 	return c.buildOredRootChains(func(node *telemetrytypes.JSONAccessNode) (string, error) {
-		return c.tokenLeaf(node, token, sb)
+		return c.tokenLeaf(node, needle, sb)
 	}, sb)
 }
 
 // tokenLeaf builds the hasToken match at a terminal node: a direct match for a String leaf
 // (coalesced to false, as in arrayFuncScalarLeaf), or an arrayExists over the elements for a
 // String array leaf. hasToken is string-only, so any other element type is rejected.
-func (c *jsonConditionBuilder) tokenLeaf(node *telemetrytypes.JSONAccessNode, token any, sb *sqlbuilder.SelectBuilder) (string, error) {
+func (c *jsonConditionBuilder) tokenLeaf(node *telemetrytypes.JSONAccessNode, needle any, sb *sqlbuilder.SelectBuilder) (string, error) {
 	switch node.TerminalConfig.ElemType {
 	case telemetrytypes.String:
 		fieldExpr := fmt.Sprintf("dynamicElement(%s, 'String')", node.FieldPath())
-		return fmt.Sprintf("ifNull(hasToken(LOWER(%s), LOWER(%s)), false)", fieldExpr, sb.Var(token)), nil
+		return fmt.Sprintf("ifNull(hasToken(LOWER(%s), LOWER(%s)), false)", fieldExpr, sb.Var(needle)), nil
 	case telemetrytypes.ArrayString:
 		arrayExpr := fmt.Sprintf("dynamicElement(%s, '%s')", node.FieldPath(), node.TerminalConfig.ElemType.StringValue())
-		return fmt.Sprintf("arrayExists(x -> hasToken(LOWER(x), LOWER(%s)), %s)", sb.Var(token), arrayExpr), nil
+		return fmt.Sprintf("arrayExists(x -> hasToken(LOWER(x), LOWER(%s)), %s)", sb.Var(needle), arrayExpr), nil
 	default:
 		return "", errors.NewInvalidInputf(errors.CodeInvalidInput, "function `hasToken` only supports string fields; field `%s` is `%s`", c.key.Name, node.TerminalConfig.Key.FieldDataType.StringValue())
 	}

pkg/telemetryschema/logstelemetryschema/json_string.go

@@ -9,8 +9,6 @@ import (
 
 	qbtypes "github.com/SigNoz/signoz/pkg/types/querybuildertypes/querybuildertypesv5"
 	"github.com/SigNoz/signoz/pkg/types/telemetrytypes"
-
-	"github.com/huandu/go-sqlbuilder"
 )
 
 func parseStrValue(valueStr string, operator qbtypes.FilterOperator) (telemetrytypes.FieldDataType, any) {
@@ -94,200 +92,6 @@ func InferDataType(value any, operator qbtypes.FilterOperator, key *telemetrytyp
 	return closure(value, key)
 }
 
-// bodyNgramSize is the n of the ngrambf_v1 index over lower(body); a shorter literal yields no
-// ngram for it to check.
-const bodyNgramSize = 4
-
-// likePatternLiterals returns the runs of pattern between unescaped wildcards, with `\` escapes
-// resolved; every value the pattern matches holds each run verbatim. ClickHouse treats `\` as an
-// escape only before `%`, `_` and itself, so dropping it elsewhere would yield a run it never requires.
-func likePatternLiterals(pattern string) []string {
-	var (
-		literals []string
-		run      strings.Builder
-	)
-	for i := 0; i < len(pattern); i++ {
-		switch c := pattern[i]; c {
-		case '%', '_':
-			if run.Len() > 0 {
-				literals = append(literals, run.String())
-				run.Reset()
-			}
-		case '\\':
-			if i+1 >= len(pattern) {
-				run.WriteByte('\\')
-				continue
-			}
-			i++
-			if escaped := pattern[i]; escaped != '%' && escaped != '_' && escaped != '\\' {
-				run.WriteByte('\\')
-			}
-			run.WriteByte(pattern[i])
-		default:
-			run.WriteByte(c)
-		}
-	}
-	if run.Len() > 0 {
-		literals = append(literals, run.String())
-	}
-	return literals
-}
-
-// jsonEscapable reports whether a JSON encoder is free to rewrite r: `"` and `\` always, `/` by
-// PHP, `<` `>` `&` by Go, non-printable ASCII by Python's ensure_ascii. The legacy body holds the
-// producer's own text, so a literal spanning one of these may not be there to find.
-func jsonEscapable(r rune) bool {
-	return r < 0x20 || r > 0x7e || strings.ContainsRune(`"\/<>&`, r)
-}
-
-// jsonTextRuns splits s at every byte an encoder may rewrite, keeping the runs long enough for
-// the ngram index. A body whose JSON holds s contains each returned run verbatim, in order.
-func jsonTextRuns(s string) []string {
-	var runs []string
-	for _, run := range strings.FieldsFunc(s, jsonEscapable) {
-		if len(run) >= bodyNgramSize {
-			runs = append(runs, run)
-		}
-	}
-	return runs
-}
-
-// bodyPathLiterals returns one literal per component of key's JSON path, quoted the way JSON writes
-// an object key — which also lets a two-character name reach the ngram size. A component holding a
-// byte an encoder may rewrite is dropped; JSON writes a parent first, so the order carries.
-func bodyPathLiterals(key *telemetrytypes.TelemetryFieldKey) []string {
-	var literals []string
-	for _, part := range strings.Split(key.Name, ".") {
-		if idx := strings.Index(part, "["); idx >= 0 {
-			part = part[:idx]
-		}
-		if literal := `"` + part + `"`; len(literal) >= bodyNgramSize && !strings.ContainsFunc(part, jsonEscapable) {
-			literals = append(literals, literal)
-		}
-	}
-	return literals
-}
-
-// bodyValueLiterals returns the literals a comparison implies in the body text. Only string
-// comparisons qualify: a number is compared after JSONExtract parses it, which reads 1.23e2
-// as 123, so the digits of the filter value need not appear in the body at all.
-func bodyValueLiterals(operator qbtypes.FilterOperator, value any) []string {
-	str, ok := value.(string)
-	if !ok {
-		return nil
-	}
-	switch operator {
-	case qbtypes.FilterOperatorEqual, qbtypes.FilterOperatorContains:
-		return jsonTextRuns(str)
-	case qbtypes.FilterOperatorLike, qbtypes.FilterOperatorILike:
-		var literals []string
-		for _, literal := range likePatternLiterals(str) {
-			literals = append(literals, jsonTextRuns(literal)...)
-		}
-		return literals
-	}
-	return nil
-}
-
-// escapeLikeLiteral escapes the LIKE metacharacters so s matches as literal text. Backslash
-// goes first, being the escape character itself.
-func escapeLikeLiteral(s string) string {
-	s = strings.ReplaceAll(s, `\`, `\\`)
-	s = strings.ReplaceAll(s, "%", `\%`)
-	return strings.ReplaceAll(s, "_", `\_`)
-}
-
-// bodyIndexPredicate asserts the raw body text holds the literals in order. ILike renders as
-// LOWER(body) LIKE LOWER(?) on the ClickHouse flavor — the expression both bloom filters index.
-// They are plain text and backslash-free by construction, so only the LIKE wildcards need escaping.
-func bodyIndexPredicate(literals []string, sb *sqlbuilder.SelectBuilder) string {
-	if len(literals) == 0 {
-		return ""
-	}
-	escaped := make([]string, 0, len(literals))
-	for _, literal := range literals {
-		escaped = append(escaped, escapeLikeLiteral(literal))
-	}
-	pattern := "%" + strings.Join(escaped, "%") + "%"
-	return sb.ILike(LogsV2BodyColumn, pattern)
-}
-
-// legacyBodyIndexPredicates returns what a legacy body JSON filter implies over LOWER(body),
-// which nothing it compares matches. Path literals ride on the existence assertion and value
-// literals on the comparison, so each appears once; a negation carries none, matching rows that
-// lack the path entirely.
-func legacyBodyIndexPredicates(key *telemetrytypes.TelemetryFieldKey, operator qbtypes.FilterOperator, value any, sb *sqlbuilder.SelectBuilder) []string {
-	var predicates []string
-	if operator == qbtypes.FilterOperatorExists || operator.IsArrayFunctionOperator() {
-		if predicate := bodyIndexPredicate(bodyPathLiterals(key), sb); predicate != "" {
-			predicates = append(predicates, predicate)
-		}
-	}
-	if operator.IsArrayFunctionOperator() {
-		return append(predicates, bodyArrayFunctionPredicates(operator, value, sb)...)
-	}
-	if predicate := bodyIndexPredicate(bodyValueLiterals(operator, value), sb); predicate != "" {
-		predicates = append(predicates, predicate)
-	}
-	return predicates
-}
-
-// bodyArrayFunctionPredicates returns what a has-family filter implies about the body text. has
-// and hasAll require every element, so each becomes its own predicate; hasAny requires one, so its
-// arms are ORed, and an element yielding no literal leaves that OR unassertable.
-func bodyArrayFunctionPredicates(operator qbtypes.FilterOperator, value any, sb *sqlbuilder.SelectBuilder) []string {
-	element := value
-	if args, ok := value.([]any); ok && len(args) > 0 {
-		element = args[0]
-	}
-	// the has family compares at the element type it infers, so a quoted number is still a
-	// number here and its digits need not appear in the body — same reason `=` skips them
-	if legacyElemType(element) != telemetrytypes.FieldDataTypeString {
-		return nil
-	}
-
-	values, ok := element.([]any)
-	if !ok {
-		values = []any{element}
-	}
-
-	if operator == qbtypes.FilterOperatorHasAny {
-		// resolve every value before binding anything: one unusable value voids the whole OR
-		runSets := make([][]string, 0, len(values))
-		for _, v := range values {
-			str, ok := v.(string)
-			if !ok {
-				return nil
-			}
-			runs := jsonTextRuns(str)
-			if len(runs) == 0 {
-				return nil
-			}
-			runSets = append(runSets, runs)
-		}
-		if len(runSets) == 0 {
-			return nil
-		}
-		arms := make([]string, 0, len(runSets))
-		for _, runs := range runSets {
-			arms = append(arms, bodyIndexPredicate(runs, sb))
-		}
-		return []string{sb.Or(arms...)}
-	}
-
-	var predicates []string
-	for _, v := range values {
-		str, ok := v.(string)
-		if !ok {
-			continue
-		}
-		if predicate := bodyIndexPredicate(jsonTextRuns(str), sb); predicate != "" {
-			predicates = append(predicates, predicate)
-		}
-	}
-	return predicates
-}
-
 func getBodyJSONPath(key *telemetrytypes.TelemetryFieldKey) string {
 	parts := strings.Split(key.Name, ".")
 	newParts := []string{}
@@ -335,14 +139,14 @@ func GetBodyJSONKeyForExists(_ context.Context, key *telemetrytypes.TelemetryFie
 	return fmt.Sprintf("JSON_EXISTS(body, '$.%s')", getBodyJSONPath(key))
 }
 
-// legacyElemType infers the has-family element type from the arg (legacy has no schema). It
-// scans EVERY value so the chosen array type and all coerced args agree — else ClickHouse
+// legacyElemType infers the has-family element type from the needle (legacy has no schema). It
+// scans EVERY value so the chosen array type and all coerced needles agree — else ClickHouse
 // raises "no supertype ... String" (code 386). Int64 stays distinct from Float64 so a quoted
 // integer is exact past 2^53 (unquoted literals already arrive as float64, parsed upstream).
-func legacyElemType(arg any) telemetrytypes.FieldDataType {
-	list, ok := arg.([]any)
+func legacyElemType(needle any) telemetrytypes.FieldDataType {
+	list, ok := needle.([]any)
 	if !ok {
-		list = []any{arg}
+		list = []any{needle}
 	}
 	if len(list) == 0 {
 		return telemetrytypes.FieldDataTypeString
@@ -363,7 +167,7 @@ func legacyElemType(arg any) telemetrytypes.FieldDataType {
 			}
 		default:
 			// booleans (and anything else) -> String; a bool renders to 'true'/'false', so a
-			// bool arg only matches genuine JSON booleans, not truthy numbers/strings.
+			// bool needle only matches genuine JSON booleans, not truthy numbers/strings.
 			allInt, allNumeric = false, false
 		}
 	}
@@ -377,9 +181,9 @@ func legacyElemType(arg any) telemetrytypes.FieldDataType {
 	}
 }
 
-// legacyCoerceElement coerces an element to elem type dt so its bound-arg type matches the
+// legacyCoerceNeedle coerces a needle to elem type dt so its bound-arg type matches the
 // extracted column (legacyElemType guarantees it's coercible).
-func legacyCoerceElement(v any, dt telemetrytypes.FieldDataType) any {
+func legacyCoerceNeedle(v any, dt telemetrytypes.FieldDataType) any {
 	switch dt {
 	case telemetrytypes.FieldDataTypeInt64:
 		if s, ok := v.(string); ok {
@@ -395,7 +199,7 @@ func legacyCoerceElement(v any, dt telemetrytypes.FieldDataType) any {
 		}
 		return v
 	default:
-		return bodyArrayElementString(v)
+		return bodyArrayNeedleString(v)
 	}
 }
 
@@ -438,7 +242,7 @@ func getBodyJSONScalarKey(key *telemetrytypes.TelemetryFieldKey, dt telemetrytyp
 	return expr, guard, true
 }
 
-func bodyArrayElementString(v any) string {
+func bodyArrayNeedleString(v any) string {
 	switch t := v.(type) {
 	case string:
 		return t

pkg/telemetryschema/metricstelemetryschema/condition_builder.go

@@ -5,7 +5,6 @@ import (
 	"fmt"
 	"slices"
 
-	schema "github.com/SigNoz/signoz-otel-collector/cmd/signozschemamigrator/schema_migrator"
 	"github.com/SigNoz/signoz/pkg/errors"
 	"github.com/SigNoz/signoz/pkg/querybuilder"
 	qbtypes "github.com/SigNoz/signoz/pkg/types/querybuildertypes/querybuildertypesv5"
@@ -23,28 +22,6 @@ func NewConditionBuilder(fm qbtypes.FieldMapper) *conditionBuilder {
 	return &conditionBuilder{fm: fm}
 }
 
-// Labels read back as String from the `labels` JSON whatever type the metadata claims, so the
-// collision is always String vs the literal; intrinsic columns keep their own type.
-func resolveTypeCollisionForFieldName(fieldExpression string, value any) string {
-	if col, isColumn := timeSeriesV4Columns[fieldExpression]; isColumn {
-		columnType := col.Type.GetType()
-		if lowCardinality, ok := col.Type.(schema.LowCardinalityColumnType); ok {
-			columnType = lowCardinality.ElementType.GetType()
-		}
-		if columnType != schema.ColumnTypeEnumString {
-			return fieldExpression
-		}
-	}
-
-	switch value.(type) {
-	case bool:
-		return fmt.Sprintf("accurateCastOrNull(%s, 'Bool')", fieldExpression)
-	case float64:
-		return fmt.Sprintf("toFloat64OrNull(%s)", fieldExpression)
-	}
-	return fieldExpression
-}
-
 func (c *conditionBuilder) conditionFor(
 	ctx context.Context,
 	orgID valuer.UUID,
@@ -65,8 +42,17 @@ func (c *conditionBuilder) conditionFor(
 		return "", err
 	}
 
-	// TODO(srikanthccv): use querybuilder.DataTypeCollisionHandledFieldName when metrics schemas are updated
-	fieldExpression = resolveTypeCollisionForFieldName(fieldExpression, value)
+	// TODO(srikanthccv): use the same data type collision handling when metrics schemas are updated
+	switch v := value.(type) {
+	case float64:
+		fieldExpression = fmt.Sprintf("toFloat64OrNull(%s)", fieldExpression)
+	case []any:
+		if len(v) > 0 && (operator == qbtypes.FilterOperatorBetween || operator == qbtypes.FilterOperatorNotBetween) {
+			if _, ok := v[0].(float64); ok {
+				fieldExpression = fmt.Sprintf("toFloat64OrNull(%s)", fieldExpression)
+			}
+		}
+	}
 
 	switch operator {
 	case qbtypes.FilterOperatorEqual:
@@ -114,8 +100,6 @@ func (c *conditionBuilder) conditionFor(
 		if len(values) != 2 {
 			return "", qbtypes.ErrBetweenValues
 		}
-		// both bounds share one expression, so the lower bound picks the cast
-		fieldExpression = resolveTypeCollisionForFieldName(fieldExpression, values[0])
 		return sb.Between(fieldExpression, values[0], values[1]), nil
 	case qbtypes.FilterOperatorNotBetween:
 		values, ok := value.([]any)
@@ -125,7 +109,6 @@ func (c *conditionBuilder) conditionFor(
 		if len(values) != 2 {
 			return "", qbtypes.ErrBetweenValues
 		}
-		fieldExpression = resolveTypeCollisionForFieldName(fieldExpression, values[0])
 		return sb.NotBetween(fieldExpression, values[0], values[1]), nil
 
 	// in and not in
@@ -134,23 +117,13 @@ func (c *conditionBuilder) conditionFor(
 		if !ok {
 			return "", qbtypes.ErrInValues
 		}
-		// instead of using IN, we use `=` + `OR` to make use of index
-		conditions := []string{}
-		for _, item := range values {
-			conditions = append(conditions, sb.E(resolveTypeCollisionForFieldName(fieldExpression, item), item))
-		}
-		return sb.Or(conditions...), nil
+		return sb.In(fieldExpression, values), nil
 	case qbtypes.FilterOperatorNotIn:
 		values, ok := value.([]any)
 		if !ok {
 			return "", qbtypes.ErrInValues
 		}
-		// instead of using NOT IN, we use `!=` + `AND` to make use of index
-		conditions := []string{}
-		for _, item := range values {
-			conditions = append(conditions, sb.NE(resolveTypeCollisionForFieldName(fieldExpression, item), item))
-		}
-		return sb.And(conditions...), nil
+		return sb.NotIn(fieldExpression, values), nil
 
 	// exists and not exists
 	// in the UI based query builder, `exists` and `not exists` are used for

pkg/telemetryschema/metricstelemetryschema/condition_builder_test.go

@@ -119,8 +119,8 @@ func TestConditionFor(t *testing.T) {
 			},
 			operator:      qbtypes.FilterOperatorIn,
 			value:         []any{"http.server.duration", "http.server.request.duration", "http.server.response.duration"},
-			expectedSQL:   "(metric_name = ? OR metric_name = ? OR metric_name = ?)",
-			expectedArgs:  []any{"http.server.duration", "http.server.request.duration", "http.server.response.duration"},
+			expectedSQL:   "metric_name IN (?)",
+			expectedArgs:  []any{[]any{"http.server.duration", "http.server.request.duration", "http.server.response.duration"}},
 			expectedError: nil,
 		},
 		{
@@ -155,8 +155,8 @@ func TestConditionFor(t *testing.T) {
 			},
 			operator:      qbtypes.FilterOperatorNotIn,
 			value:         []any{"debug", "info", "trace"},
-			expectedSQL:   "(metric_name <> ? AND metric_name <> ? AND metric_name <> ?)",
-			expectedArgs:  []any{"debug", "info", "trace"},
+			expectedSQL:   "metric_name NOT IN (?)",
+			expectedArgs:  []any{[]any{"debug", "info", "trace"}},
 			expectedError: nil,
 		},
 		{
@@ -227,120 +227,6 @@ func TestConditionFor(t *testing.T) {
 			expectedSQL:   "",
 			expectedError: qbtypes.ErrColumnNotFound,
 		},
-		{
-			name: "Equal operator - bool label casts the JSON read to Bool",
-			key: telemetrytypes.TelemetryFieldKey{
-				Name:          "success",
-				FieldContext:  telemetrytypes.FieldContextAttribute,
-				FieldDataType: telemetrytypes.FieldDataTypeBool,
-			},
-			operator:      qbtypes.FilterOperatorEqual,
-			value:         true,
-			expectedSQL:   "accurateCastOrNull(JSONExtractString(labels, 'success'), 'Bool') = ?",
-			expectedArgs:  []any{true},
-			expectedError: nil,
-		},
-		{
-			name: "Not Equal operator - bool label casts the JSON read to Bool",
-			key: telemetrytypes.TelemetryFieldKey{
-				Name:          "success",
-				FieldContext:  telemetrytypes.FieldContextAttribute,
-				FieldDataType: telemetrytypes.FieldDataTypeBool,
-			},
-			operator:      qbtypes.FilterOperatorNotEqual,
-			value:         false,
-			expectedSQL:   "accurateCastOrNull(JSONExtractString(labels, 'success'), 'Bool') <> ?",
-			expectedArgs:  []any{false},
-			expectedError: nil,
-		},
-		{
-			name: "Equal operator - bool value on a label the metadata calls a string",
-			key: telemetrytypes.TelemetryFieldKey{
-				Name:          "success",
-				FieldContext:  telemetrytypes.FieldContextAttribute,
-				FieldDataType: telemetrytypes.FieldDataTypeString,
-			},
-			operator:      qbtypes.FilterOperatorEqual,
-			value:         true,
-			expectedSQL:   "accurateCastOrNull(JSONExtractString(labels, 'success'), 'Bool') = ?",
-			expectedArgs:  []any{true},
-			expectedError: nil,
-		},
-		{
-			name: "In operator - all-bool set casts the JSON read to Bool",
-			key: telemetrytypes.TelemetryFieldKey{
-				Name:          "success",
-				FieldContext:  telemetrytypes.FieldContextAttribute,
-				FieldDataType: telemetrytypes.FieldDataTypeBool,
-			},
-			operator:      qbtypes.FilterOperatorIn,
-			value:         []any{true, false},
-			expectedSQL:   "(accurateCastOrNull(JSONExtractString(labels, 'success'), 'Bool') = ? OR accurateCastOrNull(JSONExtractString(labels, 'success'), 'Bool') = ?)",
-			expectedArgs:  []any{true, false},
-			expectedError: nil,
-		},
-		{
-			name: "In operator - a mixed set casts each value on its own",
-			key: telemetrytypes.TelemetryFieldKey{
-				Name:          "success",
-				FieldContext:  telemetrytypes.FieldContextAttribute,
-				FieldDataType: telemetrytypes.FieldDataTypeBool,
-			},
-			operator:      qbtypes.FilterOperatorIn,
-			value:         []any{true, "maybe"},
-			expectedSQL:   "(accurateCastOrNull(JSONExtractString(labels, 'success'), 'Bool') = ? OR JSONExtractString(labels, 'success') = ?)",
-			expectedArgs:  []any{true, "maybe"},
-			expectedError: nil,
-		},
-		{
-			name: "Greater Than operator - a numeric column is compared without a cast",
-			key: telemetrytypes.TelemetryFieldKey{
-				Name:         "unix_milli",
-				FieldContext: telemetrytypes.FieldContextMetric,
-			},
-			operator:      qbtypes.FilterOperatorGreaterThan,
-			value:         float64(1747947419000),
-			expectedSQL:   "unix_milli > ?",
-			expectedArgs:  []any{float64(1747947419000)},
-			expectedError: nil,
-		},
-		{
-			name: "Equal operator - the is_monotonic column is already Bool, no cast",
-			key: telemetrytypes.TelemetryFieldKey{
-				Name:         "is_monotonic",
-				FieldContext: telemetrytypes.FieldContextMetric,
-			},
-			operator:      qbtypes.FilterOperatorEqual,
-			value:         true,
-			expectedSQL:   "is_monotonic = ?",
-			expectedArgs:  []any{true},
-			expectedError: nil,
-		},
-		{
-			name: "Between operator - the bounds cast the JSON read to Float64",
-			key: telemetrytypes.TelemetryFieldKey{
-				Name:          "latency",
-				FieldContext:  telemetrytypes.FieldContextAttribute,
-				FieldDataType: telemetrytypes.FieldDataTypeFloat64,
-			},
-			operator:      qbtypes.FilterOperatorBetween,
-			value:         []any{float64(10), float64(20)},
-			expectedSQL:   "toFloat64OrNull(JSONExtractString(labels, 'latency')) BETWEEN ? AND ?",
-			expectedArgs:  []any{float64(10), float64(20)},
-			expectedError: nil,
-		},
-		{
-			name: "Between operator - a numeric column is compared without a cast",
-			key: telemetrytypes.TelemetryFieldKey{
-				Name:         "unix_milli",
-				FieldContext: telemetrytypes.FieldContextMetric,
-			},
-			operator:      qbtypes.FilterOperatorBetween,
-			value:         []any{float64(1747947419000), float64(1747947429000)},
-			expectedSQL:   "unix_milli BETWEEN ? AND ?",
-			expectedArgs:  []any{float64(1747947419000), float64(1747947429000)},
-			expectedError: nil,
-		},
 	}
 
 	fm := NewFieldMapper()

pkg/telemetryschema/tracestelemetryschema/condition_builder_test.go

@@ -391,6 +391,83 @@ func TestConditionForResourceWithEvolution(t *testing.T) {
 	}
 }
 
+// TestConditionForScopeIntrinsicFields covers the scope.name/scope.version intrinsic
+// fields against the "scope" JSON column. These are *declared* String paths on that
+// column, so a row without a scope reads as ” and never NULL: presence must be an
+// empty-string check, since "IS NOT NULL" would hold for every row. That also rules
+// out treating them as nested attribute keys under scope.attributes, which are
+// undeclared (Dynamic) paths and genuinely NULL when absent.
+func TestConditionForScopeIntrinsicFields(t *testing.T) {
+	ctx := context.Background()
+	fm := NewFieldMapper(flaggertest.New(t))
+	conditionBuilder := NewConditionBuilder(fm, flaggertest.New(t))
+
+	testCases := []struct {
+		name        string
+		key         telemetrytypes.TelemetryFieldKey
+		operator    qbtypes.FilterOperator
+		value       any
+		expectedSQL string
+	}{
+		{
+			name: "Equal - scope.name",
+			key: telemetrytypes.TelemetryFieldKey{
+				Name:          "scope.name",
+				FieldContext:  telemetrytypes.FieldContextScope,
+				FieldDataType: telemetrytypes.FieldDataTypeString,
+			},
+			operator:    qbtypes.FilterOperatorEqual,
+			value:       "io.signoz.payment",
+			expectedSQL: "(scope.name::String = ? AND scope.name::String <> '')",
+		},
+		{
+			name: "Equal - scope.version",
+			key: telemetrytypes.TelemetryFieldKey{
+				Name:          "scope.version",
+				FieldContext:  telemetrytypes.FieldContextScope,
+				FieldDataType: telemetrytypes.FieldDataTypeString,
+			},
+			operator:    qbtypes.FilterOperatorEqual,
+			value:       "2.3.1",
+			expectedSQL: "(scope.version::String = ? AND scope.version::String <> '')",
+		},
+		{
+			name: "Exists - scope.name",
+			key: telemetrytypes.TelemetryFieldKey{
+				Name:          "scope.name",
+				FieldContext:  telemetrytypes.FieldContextScope,
+				FieldDataType: telemetrytypes.FieldDataTypeString,
+			},
+			operator:    qbtypes.FilterOperatorExists,
+			value:       nil,
+			expectedSQL: "scope.name::String <> ''",
+		},
+		{
+			name: "NotExists - scope.version",
+			key: telemetrytypes.TelemetryFieldKey{
+				Name:          "scope.version",
+				FieldContext:  telemetrytypes.FieldContextScope,
+				FieldDataType: telemetrytypes.FieldDataTypeString,
+			},
+			operator:    qbtypes.FilterOperatorNotExists,
+			value:       nil,
+			expectedSQL: "scope.version::String = ''",
+		},
+	}
+
+	for _, tc := range testCases {
+		sb := sqlbuilder.NewSelectBuilder()
+		t.Run(tc.name, func(t *testing.T) {
+			conds, _, err := conditionBuilder.ConditionFor(ctx, valuer.UUID{}, 0, 0, &tc.key, map[string][]*telemetrytypes.TelemetryFieldKey{tc.key.Name: {&tc.key}}, qbtypes.ConditionBuilderOptions{}, tc.operator, tc.value, sb)
+			require.NoError(t, err)
+			sb.Where(conds...)
+			sql, _ := sb.BuildWithFlavor(sqlbuilder.ClickHouse)
+			assert.Contains(t, sql, tc.expectedSQL)
+			assert.NotContains(t, sql, "scope.`scope.", "must not double-prefix the scope JSON path")
+		})
+	}
+}
+
 // TestConditionForSynthesizedKeys covers the KeyNotFound fallback: when a
 // referenced attribute key has no metadata match, the builder synthesizes key(s) from
 // user input and queries anyway, emitting a warning instead of failing.
@@ -441,12 +518,13 @@ func TestConditionForSynthesizedKeys(t *testing.T) {
 		conds, warnings, err := cb.ConditionFor(ctx, valuer.UUID{}, 0, 0, &key, noMatches, qbtypes.ConditionBuilderOptions{}, qbtypes.FilterOperatorExists, nil, sb)
 		assert.NoError(t, err)
 		assert.NotEmpty(t, warnings)
-		assert.Len(t, conds, 3, "exists should fan out to string/number/bool")
+		assert.Len(t, conds, 4, "exists should fan out to string/number/bool, plus scope attribute")
 		sb.Where(sb.Or(conds...))
 		sql, _ := sb.BuildWithFlavor(sqlbuilder.ClickHouse)
 		assert.Contains(t, sql, "mapContains(attributes_string, 'exception.type')")
 		assert.Contains(t, sql, "mapContains(attributes_number, 'exception.type')")
 		assert.Contains(t, sql, "mapContains(attributes_bool, 'exception.type')")
+		assert.Contains(t, sql, "scope.attributes.`exception.type` IS NOT NULL")
 	})
 
 	t.Run("qualified data type honored without fanout", func(t *testing.T) {
@@ -454,10 +532,11 @@ func TestConditionForSynthesizedKeys(t *testing.T) {
 		key := telemetrytypes.TelemetryFieldKey{Name: "custom.key", FieldDataType: telemetrytypes.FieldDataTypeString}
 		conds, _, err := cb.ConditionFor(ctx, valuer.UUID{}, 0, 0, &key, noMatches, qbtypes.ConditionBuilderOptions{}, qbtypes.FilterOperatorEqual, "v", sb)
 		assert.NoError(t, err)
-		assert.Len(t, conds, 1)
-		sb.Where(conds...)
+		assert.Len(t, conds, 2, "qualified data type skips attribute-type fanout, but the scope attribute candidate still applies")
+		sb.Where(sb.Or(conds...))
 		sql, _ := sb.BuildWithFlavor(sqlbuilder.ClickHouse)
 		assert.Contains(t, sql, "attributes_string['custom.key']")
+		assert.Contains(t, sql, "scope.attributes.`custom.key`")
 	})
 
 	t.Run("bare intrinsic column resolves to the column, not synthesized attributes", func(t *testing.T) {
@@ -519,10 +598,11 @@ func TestConditionForSynthesizedKeys(t *testing.T) {
 		conds, warnings, err := cb.ConditionFor(ctx, valuer.UUID{}, 0, 0, &key, noMatches, qbtypes.ConditionBuilderOptions{}, qbtypes.FilterOperatorEqual, "v", sb)
 		require.NoError(t, err)
 		assert.NotEmpty(t, warnings)
-		require.Len(t, conds, 1)
-		sb.Where(conds...)
+		require.Len(t, conds, 2, "stripped attribute candidate, plus the scope attribute candidate")
+		sb.Where(sb.Or(conds...))
 		sql, _ := sb.BuildWithFlavor(sqlbuilder.ClickHouse)
 		assert.Contains(t, sql, "attributes_string['custom.attr']")
+		assert.Contains(t, sql, "scope.attributes.`custom.attr`")
 		assert.NotContains(t, sql, "span.custom.attr")
 	})
 

pkg/telemetryschema/tracestelemetryschema/const.go

@@ -121,6 +121,20 @@ var (
 			FieldContext:  telemetrytypes.FieldContextSpan,
 			FieldDataType: telemetrytypes.FieldDataTypeString,
 		},
+		"scope.name": {
+			Name:          "scope.name",
+			Description:   "Instrumentation scope name",
+			Signal:        telemetrytypes.SignalTraces,
+			FieldContext:  telemetrytypes.FieldContextScope,
+			FieldDataType: telemetrytypes.FieldDataTypeString,
+		},
+		"scope.version": {
+			Name:          "scope.version",
+			Description:   "Instrumentation scope version",
+			Signal:        telemetrytypes.SignalTraces,
+			FieldContext:  telemetrytypes.FieldContextScope,
+			FieldDataType: telemetrytypes.FieldDataTypeString,
+		},
 	}
 	IntrinsicFieldsDeprecated = map[string]telemetrytypes.TelemetryFieldKey{
 		"traceID": {

pkg/telemetryschema/tracestelemetryschema/field_mapper.go

@@ -53,6 +53,7 @@ var (
 			ValueType: schema.ColumnTypeString,
 		}},
 		"resource": {Name: "resource", Type: schema.JSONColumnType{}},
+		"scope":    {Name: "scope", Type: schema.JSONColumnType{}},
 
 		"events": {Name: "events", Type: schema.ArrayColumnType{
 			ElementType: schema.ColumnTypeString,
@@ -181,7 +182,7 @@ func (m *fieldMapper) getColumn(
 	case telemetrytypes.FieldContextResource:
 		return []*schema.Column{indexV3Columns["resource"], indexV3Columns["resources_string"]}, nil
 	case telemetrytypes.FieldContextScope:
-		return []*schema.Column{}, qbtypes.ErrColumnNotFound
+		return []*schema.Column{indexV3Columns["scope"]}, nil
 	case telemetrytypes.FieldContextAttribute:
 		switch key.FieldDataType {
 		case telemetrytypes.FieldDataTypeString:
@@ -292,14 +293,24 @@ func (m *fieldMapper) resolveColumnExprs(
 
 		switch column.Type.GetType() {
 		case schema.ColumnTypeEnumJSON:
-			// json is only supported for resource context as of now
-			if key.FieldContext != telemetrytypes.FieldContextResource {
-				return nil, nil, nil, errors.Newf(errors.TypeInvalidInput, errors.CodeInvalidInput, "only resource context fields are supported for json columns, got %s", key.FieldContext.String)
-			}
 			// have to add ::string as clickHouse throws an error :- data types Variant/Dynamic are not allowed in GROUP BY
 			// once clickHouse dependency is updated, we need to check if we can remove it.
-			exprs = append(exprs, fmt.Sprintf("%s.`%s`::String", columnName, key.Name))
-			existExprs = append(existExprs, fmt.Sprintf("%s.`%s` IS NOT NULL", columnName, key.Name))
+			switch key.FieldContext {
+			case telemetrytypes.FieldContextResource:
+				exprs = append(exprs, fmt.Sprintf("%s.`%s`::String", columnName, key.Name))
+				existExprs = append(existExprs, fmt.Sprintf("%s.`%s` IS NOT NULL", columnName, key.Name))
+			case telemetrytypes.FieldContextScope:
+				if isDeclaredScopePath(key.Name) {
+					// declared String paths on the scope column read '' for the missing case
+					exprs = append(exprs, fmt.Sprintf("%s::String", key.Name))
+					existExprs = append(existExprs, fmt.Sprintf("%s <> ''", key.Name))
+				} else {
+					exprs = append(exprs, fmt.Sprintf("%s.attributes.`%s`::String", columnName, key.Name))
+					existExprs = append(existExprs, fmt.Sprintf("%s.attributes.`%s` IS NOT NULL", columnName, key.Name))
+				}
+			default:
+				return nil, nil, nil, errors.Newf(errors.TypeInvalidInput, errors.CodeInvalidInput, "only resource and scope context fields are supported for json columns, got %s", key.FieldContext.String)
+			}
 		case schema.ColumnTypeEnumString,
 			schema.ColumnTypeEnumUInt64,
 			schema.ColumnTypeEnumUInt32,
@@ -341,18 +352,58 @@ func (m *fieldMapper) resolveColumnExprs(
 	return exprs, existExprs, columns, nil
 }
 
-// logicalForResolvedColumn upgrades a directly-resolvable key (the FieldFor
-// probe succeeded) to its family when the metadata map proves membership;
-// otherwise the key stays a single-member logical field.
-func (m *fieldMapper) logicalForResolvedColumn(ctx context.Context, orgID valuer.UUID, field *telemetrytypes.TelemetryFieldKey, keys map[string][]*telemetrytypes.TelemetryFieldKey) *telemetrytypes.LogicalField {
-	for _, logical := range querybuilder.MatchingLogicalFields(ctx, orgID, m.fl, field, keys) {
-		if logical.IsFamily() &&
-			logical.FieldContext == field.FieldContext &&
-			(field.FieldDataType == telemetrytypes.FieldDataTypeUnspecified || logical.FieldDataType == field.FieldDataType) {
-			return logical
+// resolveReferencedField resolves a referenced field to the candidate member key(s) a select /
+// group by / order by queries for it, unioning every home the name maps to (a scope field and a
+// same-named scope attribute, an attribute and a resource attribute, ...) flattened to members.
+// Unlike the filter path it does not narrow an attribute+resource collision to resource — select
+// surfaces every home. It returns empty when the name is absent from metadata; the caller
+// synthesizes and upgrades the result back to families.
+func (m *fieldMapper) resolveReferencedField(
+	ctx context.Context,
+	orgID valuer.UUID,
+	startNs, endNs uint64,
+	field *telemetrytypes.TelemetryFieldKey,
+	fieldKeys map[string][]*telemetrytypes.TelemetryFieldKey,
+) []*telemetrytypes.TelemetryFieldKey {
+	var resolved []*telemetrytypes.TelemetryFieldKey
+	for _, logical := range querybuilder.MatchingLogicalFields(ctx, orgID, m.fl, field, fieldKeys) {
+		resolved = append(resolved, logical.Members...)
+	}
+
+	// A bare key that names a real column resolves to the column first, keeping only same-named
+	// metadata keys whose type is consistent with it so a corrupt entry can't shadow the column.
+	if field.FieldContext == telemetrytypes.FieldContextUnspecified && len(resolved) > 0 {
+		var column *schema.Column
+		var columnKey *telemetrytypes.TelemetryFieldKey
+		for _, k := range resolved {
+			if k.FieldContext == telemetrytypes.FieldContextSpan {
+				if cols, err := m.ColumnFor(ctx, orgID, startNs, endNs, k); err == nil && len(cols) > 0 {
+					column, columnKey = cols[0], k
+				}
+				break
+			}
+		}
+		if column == nil {
+			probe := telemetrytypes.NewTelemetryFieldKey(field.Name, telemetrytypes.FieldContextSpan, field.FieldDataType)
+			if cols, err := m.ColumnFor(ctx, orgID, startNs, endNs, probe); err == nil && len(cols) > 0 {
+				column, columnKey = cols[0], probe
+			}
+		}
+		if column != nil {
+			combined := []*telemetrytypes.TelemetryFieldKey{columnKey}
+			for _, k := range resolved {
+				if k == columnKey || k.FieldContext == telemetrytypes.FieldContextSpan {
+					continue
+				}
+				if columnMatchesDataType(column, k.FieldDataType) {
+					combined = append(combined, k)
+				}
+			}
+			resolved = combined
 		}
 	}
-	return telemetrytypes.SingleLogicalField(field.Name, field)
+
+	return resolved
 }
 
 // upgradeToFamilies swaps single-member candidates for their family when the
@@ -415,26 +466,18 @@ func (m *fieldMapper) ColumnExpressionFor(
 	keys map[string][]*telemetrytypes.TelemetryFieldKey,
 ) (string, error) {
 
-	// Resolve the candidate logical field(s).
-	var candidates []*telemetrytypes.LogicalField
-	switch _, err := m.FieldFor(ctx, orgID, startNs, endNs, field); {
-	case err == nil:
-		// A directly-resolvable key upgrades to its family when the metadata
-		// map proves membership; otherwise it stays single-member.
-		candidates = []*telemetrytypes.LogicalField{m.logicalForResolvedColumn(ctx, orgID, field, keys)}
-	case errors.Is(err, qbtypes.ErrColumnNotFound):
-		// The legacy candidate flow, unchanged: column (when the bare name is
-		// one) plus metadata matches, else synthesized type-variant keys. The
-		// family step below only swaps candidates for their family; it never
-		// changes candidate order or non-family behavior.
-		raw := m.CandidateKeys(ctx, orgID, field, nil, keys)
-		if len(raw) == 0 {
-			return "", errors.Wrapf(err, errors.TypeInvalidInput, errors.CodeInvalidInput, "field `%s` not found", field.Name).WithSuggestions(errors.NewSuggestionsOnLevenshteinDistance(field.Name, errors.NounKeys, maps.Keys(keys))...)
-		}
-		candidates = m.upgradeToFamilies(ctx, orgID, field, querybuilder.WrapAsLogicalFields(field.Name, raw), keys)
-	default:
-		return "", err
+	// Resolve the candidate member key(s): the metadata union, or synthesized type-variant keys
+	// when the name is absent. Then upgrade members to their semantic-convention family; the
+	// family step never changes candidate order or non-family behavior.
+	raw := m.resolveReferencedField(ctx, orgID, startNs, endNs, field, keys)
+	if len(raw) == 0 {
+		// Absent from metadata: synthesize the type-variant candidate key(s).
+		raw = m.CandidateKeys(ctx, orgID, field, nil, candidateLookupKeys(field, keys))
 	}
+	if len(raw) == 0 {
+		return "", errors.Wrapf(querybuilder.NewKeyNotFoundError(field.Name), errors.TypeInvalidInput, errors.CodeInvalidInput, "field `%s` not found", field.Name).WithSuggestions(errors.NewSuggestionsOnLevenshteinDistance(field.Name, errors.NounKeys, maps.Keys(keys))...)
+	}
+	candidates := m.upgradeToFamilies(ctx, orgID, field, querybuilder.WrapAsLogicalFields(field.Name, raw), keys)
 
 	// Group-by/order (String) and aggregation (String/Float64): every candidate is
 	// exists-guarded and coerced to requiredDataType, in a single multiIf. Raw select
@@ -590,20 +633,55 @@ func (m *fieldMapper) CandidateKeys(ctx context.Context, _ valuer.UUID, field *t
 	// No metadata: synthesize per context.
 	switch field.FieldContext {
 	case telemetrytypes.FieldContextUnspecified:
-		return querybuilder.SynthesizeKeys(field, value)
+		return append(querybuilder.SynthesizeKeys(field, value), synthScopeAttributeKey(field))
 	case telemetrytypes.FieldContextSpan, telemetrytypes.FieldContextTrace:
-		// honored as-is: the stripped name lives in the attribute maps
+		// honored as-is: the stripped name lives in the attribute or scope attribute maps
 		stripped := telemetrytypes.NewTelemetryFieldKey(field.Name, telemetrytypes.FieldContextUnspecified, field.FieldDataType)
-		return querybuilder.SynthesizeKeys(stripped, value)
+		return append(querybuilder.SynthesizeKeys(stripped, value), synthScopeAttributeKey(stripped))
 	case telemetrytypes.FieldContextAttribute, telemetrytypes.FieldContextResource:
 		// strict context honored as-is: stripped interpretation first, literal spelling second
 		literal := telemetrytypes.NewTelemetryFieldKey(field.FieldContext.StringValue()+"."+field.Name, field.FieldContext, field.FieldDataType)
 		return append(querybuilder.SynthesizeKeys(field, value), querybuilder.SynthesizeKeys(literal, value)...)
+	case telemetrytypes.FieldContextScope:
+		return []*telemetrytypes.TelemetryFieldKey{synthScopeAttributeKey(field)}
 	}
-	// contexts that don't exist on spans (log, body, scope, …) have nothing to synthesize
+	// contexts that don't exist on spans (log, body, …) have nothing to synthesize
 	return nil
 }
 
+// synthScopeAttributeKey guesses a scope attribute (scope.attributes.<name>) for a name absent
+// from metadata — the scope analog of querybuilder.SynthesizeKeys.
+func synthScopeAttributeKey(field *telemetrytypes.TelemetryFieldKey) *telemetrytypes.TelemetryFieldKey {
+	return telemetrytypes.NewTelemetryFieldKey(field.Name, telemetrytypes.FieldContextScope, telemetrytypes.FieldDataTypeString)
+}
+
+func isDeclaredScopePath(name string) bool {
+	f, ok := IntrinsicFields[name]
+	return ok && f.FieldContext == telemetrytypes.FieldContextScope
+}
+
+// scopeJSONExistsExpression renders the existence predicate for the scope JSON column, the one
+// signal-specific case the generic querybuilder.ExistsExpression must not carry.
+func scopeJSONExistsExpression(key *telemetrytypes.TelemetryFieldKey, fieldExpression string, exists bool) (string, bool) {
+	if key.FieldContext != telemetrytypes.FieldContextScope {
+		return "", false
+	}
+	// Declared String paths are non-Nullable (absent reads '' not NULL).
+	if isDeclaredScopePath(key.Name) {
+		if exists {
+			return fieldExpression + " <> ''", true
+		}
+		return fieldExpression + " = ''", true
+	}
+	// Scope attribute: the value expression casts the JSON path to String, which folds a missing
+	// key's NULL to '', so presence must test the raw path — drop the ::String cast.
+	path := strings.TrimSuffix(fieldExpression, "::String")
+	if exists {
+		return path + " IS NOT NULL", true
+	}
+	return path + " IS NULL", true
+}
+
 // ExistsFor implements the per-key existence primitive of qbtypes.FieldMapper.
 func (m *fieldMapper) ExistsFor(
 	ctx context.Context,
@@ -620,5 +698,8 @@ func (m *fieldMapper) ExistsFor(
 	if err != nil {
 		return "", err
 	}
+	if expr, ok := scopeJSONExistsExpression(key, fieldExpression, exists); ok {
+		return expr, nil
+	}
 	return querybuilder.ExistsExpression(columns, key, tsStart, tsEnd, fieldExpression, exists)
 }

pkg/telemetryschema/tracestelemetryschema/field_mapper_test.go

@@ -84,6 +84,33 @@ func TestGetFieldKeyName(t *testing.T) {
 			expectedResult: "multiIf(resource.`deployment.environment` IS NOT NULL, resource.`deployment.environment`::String, `resource_string_deployment$$environment_exists`, `resource_string_deployment$$environment`, NULL)",
 			expectedError:  nil,
 		},
+		{
+			name: "Scope field - scope.name",
+			key: telemetrytypes.TelemetryFieldKey{
+				Name:         "scope.name",
+				FieldContext: telemetrytypes.FieldContextScope,
+			},
+			expectedResult: "scope.name::String",
+			expectedError:  nil,
+		},
+		{
+			name: "Scope field - scope.version",
+			key: telemetrytypes.TelemetryFieldKey{
+				Name:         "scope.version",
+				FieldContext: telemetrytypes.FieldContextScope,
+			},
+			expectedResult: "scope.version::String",
+			expectedError:  nil,
+		},
+		{
+			name: "Scope field - custom attribute",
+			key: telemetrytypes.TelemetryFieldKey{
+				Name:         "custom.attr",
+				FieldContext: telemetrytypes.FieldContextScope,
+			},
+			expectedResult: "scope.attributes.`custom.attr`::String",
+			expectedError:  nil,
+		},
 		{
 			// Query like `attribute.attribute_string:string` should resolve to `attributes_string['attribute_string']`.
 			name: "Attribute key whose name collides with contextual map column resolves as a map lookup",
@@ -250,7 +277,7 @@ func TestColumnExpressionForTemporalColumn(t *testing.T) {
 				FieldDataType: telemetrytypes.FieldDataTypeString,
 			},
 			requiredDataType: telemetrytypes.FieldDataTypeString,
-			expectedResult:   "multiIf(mapContains(attributes_string, 'user.id'), attributes_string['user.id'], NULL)",
+			expectedResult:   "multiIf(mapContains(attributes_string, 'user.id'), attributes_string['user.id'], mapContains(attributes_string, 'attribute.user.id'), attributes_string['attribute.user.id'], NULL)",
 		},
 	}
 
@@ -304,3 +331,78 @@ func TestColumnExpressionForTimestampAttributeCollision(t *testing.T) {
 		assert.Contains(t, result, "attributes_number['timestamp']")
 	})
 }
+
+// TestColumnExpressionForScopeUnion covers select-side resolution of scope names that
+// collide with a declared scope path. A short name under scope context (or the bare
+// `scope.<x>` spelling that normalizes to it) binds to the declared path, and unions a
+// same-named scope attribute when one is also in metadata. The full `scope.<x>` name under
+// explicit scope context addresses the declared path alone.
+func TestColumnExpressionForScopeUnion(t *testing.T) {
+	ctx := context.Background()
+
+	scopeKey := func(name string) *telemetrytypes.TelemetryFieldKey {
+		return &telemetrytypes.TelemetryFieldKey{
+			Name:          name,
+			Signal:        telemetrytypes.SignalTraces,
+			FieldContext:  telemetrytypes.FieldContextScope,
+			FieldDataType: telemetrytypes.FieldDataTypeString,
+		}
+	}
+	declaredOnly := map[string][]*telemetrytypes.TelemetryFieldKey{
+		"scope.name":    {scopeKey("scope.name")},
+		"scope.version": {scopeKey("scope.version")},
+	}
+	withAttr := map[string][]*telemetrytypes.TelemetryFieldKey{
+		"scope.name":    {scopeKey("scope.name")},
+		"scope.version": {scopeKey("scope.version")},
+		"name":          {scopeKey("name")},
+		"version":       {scopeKey("version")},
+	}
+
+	testCases := []struct {
+		name           string
+		key            telemetrytypes.TelemetryFieldKey
+		keys           map[string][]*telemetrytypes.TelemetryFieldKey
+		expectedResult string
+	}{
+		{
+			name:           "short name under scope context binds to the declared path",
+			key:            telemetrytypes.TelemetryFieldKey{Name: "version", FieldContext: telemetrytypes.FieldContextScope},
+			keys:           declaredOnly,
+			expectedResult: "multiIf(scope.version::String <> '', scope.version::String, NULL)",
+		},
+		{
+			name:           "short name unions the declared path and a same-named scope attribute",
+			key:            telemetrytypes.TelemetryFieldKey{Name: "version", FieldContext: telemetrytypes.FieldContextScope},
+			keys:           withAttr,
+			expectedResult: "multiIf(scope.attributes.`version` IS NOT NULL, toString(scope.attributes.`version`::String), scope.version::String <> '', toString(scope.version::String), NULL)",
+		},
+		{
+			name:           "full scope.version name under scope context addresses the declared path alone",
+			key:            telemetrytypes.TelemetryFieldKey{Name: "scope.version", FieldContext: telemetrytypes.FieldContextScope},
+			keys:           withAttr,
+			expectedResult: "multiIf(scope.version::String <> '', scope.version::String, NULL)",
+		},
+		{
+			name:           "short scope name unions the declared scope.name and a same-named attribute",
+			key:            telemetrytypes.TelemetryFieldKey{Name: "name", FieldContext: telemetrytypes.FieldContextScope},
+			keys:           withAttr,
+			expectedResult: "multiIf(scope.attributes.`name` IS NOT NULL, toString(scope.attributes.`name`::String), scope.name::String <> '', toString(scope.name::String), NULL)",
+		},
+		{
+			name:           "full scope.name name under scope context addresses the declared path alone",
+			key:            telemetrytypes.TelemetryFieldKey{Name: "scope.name", FieldContext: telemetrytypes.FieldContextScope},
+			keys:           withAttr,
+			expectedResult: "multiIf(scope.name::String <> '', scope.name::String, NULL)",
+		},
+	}
+
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			fm := NewFieldMapper(flaggertest.New(t))
+			result, err := fm.ColumnExpressionFor(ctx, valuer.UUID{}, 0, 0, &tc.key, telemetrytypes.FieldDataTypeUnspecified, tc.keys)
+			require.NoError(t, err)
+			assert.Equal(t, tc.expectedResult, result)
+		})
+	}
+}

pkg/telemetryschema/tracestelemetryschema/test_data.go

@@ -113,6 +113,20 @@ func BuildCompleteFieldKeyMap(releaseTime time.Time) map[string][]*telemetrytype
 				FieldDataType: telemetrytypes.FieldDataTypeBool,
 			},
 		},
+		"scope.name": {
+			{
+				Name:          "scope.name",
+				FieldContext:  telemetrytypes.FieldContextScope,
+				FieldDataType: telemetrytypes.FieldDataTypeString,
+			},
+		},
+		"scope.version": {
+			{
+				Name:          "scope.version",
+				FieldContext:  telemetrytypes.FieldContextScope,
+				FieldDataType: telemetrytypes.FieldDataTypeString,
+			},
+		},
 		// both spellings of an enabled semantic-convention family
 		"deployment.environment.name": {
 			{

pkg/types/telemetrytypes/field_test.go

@@ -294,6 +294,17 @@ func TestNormalize(t *testing.T) {
 				FieldDataType: FieldDataTypeString,
 			},
 		},
+		{
+			name: "Normalize keeps a prefix that does not match the set context",
+			input: TelemetryFieldKey{
+				Name:         "scope.name",
+				FieldContext: FieldContextAttribute,
+			},
+			expected: TelemetryFieldKey{
+				Name:         "scope.name",
+				FieldContext: FieldContextAttribute,
+			},
+		},
 		{
 			name: "Normalize body field",
 			input: TelemetryFieldKey{

tests/fixtures/querier.py

@@ -253,27 +253,6 @@ def get_preview_sql(response: requests.Response, name: str) -> str:
     return statements[0]["db.statement.query"]
 
 
-def get_preview_skip_indexes(response: requests.Response, name: str) -> dict[str, dict[str, Any]]:
-    """The skip-index steps of the named query's read funnel, keyed by index name.
-
-    Needs a verbose preview. ClickHouse lists a skip index only when the predicate matches its
-    expression, so an absent entry means it was never consulted."""
-    statements = get_preview_statements(response, name)
-    assert len(statements) == 1, f"expected 1 statement for query {name}, got {len(statements)}"
-    granules = statements[0]["granules"]
-    assert granules is not None, f"query {name} reads no MergeTree table: {statements[0]}"
-    return {step["name"]: step for read in granules["reads"] for step in read["steps"] if step["type"] == "Skip"}
-
-
-def get_preview_selected_granules(response: requests.Response, name: str) -> int:
-    """Granules surviving every index step of the named query's read funnel."""
-    statements = get_preview_statements(response, name)
-    assert len(statements) == 1, f"expected 1 statement for query {name}, got {len(statements)}"
-    granules = statements[0]["granules"]
-    assert granules is not None, f"query {name} reads no MergeTree table: {statements[0]}"
-    return granules["selected"]
-
-
 def aligned_epoch(ago: timedelta, step_seconds: int = DEFAULT_STEP_INTERVAL) -> int:
     """Epoch seconds for `now - ago`, floored to a step boundary so seeded
     points land exactly on the query's toStartOfInterval buckets."""
@@ -1020,6 +999,8 @@ def generate_traces_with_corrupt_metadata() -> list[Traces]:
                 "cloud.provider": "integration",
                 "cloud.account.id": "000",
                 "trace_id": "corrupt_data",
+                "scope_name": "corrupt_data",
+                "scope.scope.name": "corrupt_data",
             },
             attributes={
                 "net.transport": "IP.TCP",
@@ -1028,7 +1009,10 @@ def generate_traces_with_corrupt_metadata() -> list[Traces]:
                 "http.request.method": "POST",
                 "http.response.status_code": "200",
                 "timestamp": "corrupt_data",
+                "version": "1.0.0",
+                "scope.scope.version": "1.0.0",
             },
+            scope={"name": "io.signoz.http.server", "version": "2.0.0"},
         ),
         Traces(
             timestamp=now - timedelta(seconds=3.5),
@@ -1048,12 +1032,24 @@ def generate_traces_with_corrupt_metadata() -> list[Traces]:
                 "cloud.provider": "integration",
                 "cloud.account.id": "000",
                 "timestamp": "corrupt_data",
+                "scope.attributes.name": "corrupt_data",
             },
             attributes={
                 "db.name": "integration",
                 "db.operation": "SELECT",
                 "db.statement": "SELECT * FROM integration",
                 "trace_d": "corrupt_data",
+                "scope.attributes.version": "corrupt_data",
+            },
+            scope={
+                "name": "io.opentelemetry.contrib.http",
+                "version": "1.0.0",
+                "attributes": {
+                    "telemetry.sdk.language": "cpp",
+                    "name": "not-the-real-name",
+                    "version": "not-the-real-version",
+                    "attributes": "literally-a-key-named-attributes",
+                },
             },
         ),
         Traces(
@@ -1074,12 +1070,15 @@ def generate_traces_with_corrupt_metadata() -> list[Traces]:
                 "cloud.provider": "integration",
                 "cloud.account.id": "000",
                 "duration_nano": "corrupt_data",
+                "scope.scope.attributes.version": "corrupt_data",
             },
             attributes={
                 "http.request.method": "PATCH",
                 "http.status_code": "404",
                 "id": "1",
+                "scope.scope.version": "corrupt_data",
             },
+            scope={"name": "io.signoz.http.client", "version": "2.0.0"},
         ),
         Traces(
             timestamp=now - timedelta(seconds=1),
@@ -1098,6 +1097,7 @@ def generate_traces_with_corrupt_metadata() -> list[Traces]:
                 "host.name": "linux-001",
                 "cloud.provider": "integration",
                 "cloud.account.id": "001",
+                "scope.scope.version": "corrupt_data",
             },
             attributes={
                 "message.type": "SENT",
@@ -1105,7 +1105,10 @@ def generate_traces_with_corrupt_metadata() -> list[Traces]:
                 "messaging.message.id": "001",
                 "duration_nano": "corrupt_data",
                 "id": 1,
+                "scope": "corrupt_data",
+                "scope.attributes.name": "corrupt_data",
             },
+            scope={"name": "io.signoz.messaging", "version": "3.0.0"},
         ),
     ]
 

tests/fixtures/traces.py

@@ -302,6 +302,7 @@ class Traces(ABC):
     db_operation: str
     has_error: bool
     is_remote: str
+    scope_json: dict[str, Any]
 
     resource: list[TracesResource]
     tag_attributes: list[TracesTagAttributes]
@@ -327,6 +328,7 @@ class Traces(ABC):
         links: list[TracesLink] = [],
         trace_state: str = "",
         flags: np.uint32 = 0,
+        scope: dict[str, Any] = {},
         resource_write_mode: Literal["legacy_only", "dual_write"] = "dual_write",
     ) -> None:
         if timestamp is None:
@@ -408,6 +410,33 @@ class Traces(ABC):
         # Calculate resource fingerprint
         self.resource_fingerprint = LogsOrTracesFingerprint(self.resources_string).calculate()
 
+        # Process scope mirroring the InstrumentationScope on the OTLP span.
+        scope_name = scope.get("name", "")
+        scope_version = scope.get("version", "")
+        scope_string = {k: str(v) for k, v in scope.get("attributes", {}).items()}
+        self.scope_json = {
+            "name": scope_name,
+            "version": scope_version,
+            "attributes": scope_string,
+        }
+
+        scope_keys = {"scope.name": scope_name, "scope.version": scope_version}
+        scope_keys.update(scope_string)
+        for k, v in scope_keys.items():
+            if v == "":
+                continue
+            self.tag_attributes.append(
+                TracesTagAttributes(
+                    timestamp=timestamp,
+                    tag_key=k,
+                    tag_type="scope",
+                    tag_data_type="string",
+                    string_value=v,
+                    number_value=None,
+                )
+            )
+            self.attribute_keys.append(TracesResourceOrAttributeKeys(name=k, datatype="string", tag_type="scope"))
+
         # Process attributes by type and populate custom fields
         self.attribute_string = {}
         self.attributes_number = {}
@@ -659,6 +688,7 @@ class Traces(ABC):
                 self.has_error,
                 self.is_remote,
                 self.resource_json,
+                self.scope_json,
             ],
             dtype=object,
         )
@@ -689,6 +719,7 @@ class Traces(ABC):
             attributes=data.get("attributes", {}),
             trace_state=data.get("trace_state", ""),
             flags=data.get("flags", 0),
+            scope=data.get("scope", {}),
         )
 
     @classmethod
@@ -828,6 +859,7 @@ def insert_traces_to_clickhouse(conn, traces: list[Traces]) -> None:
             "has_error",
             "is_remote",
             "resource",
+            "scope",
         ],
         data=[trace.np_arr() for trace in traces],
     )

tests/integration/tests/querier_json_body/06_body_equality.py

@@ -1,90 +0,0 @@
-from collections.abc import Callable
-from datetime import UTC, datetime, timedelta
-from http import HTTPStatus
-
-import pytest
-
-from fixtures import types
-from fixtures.auth import USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD
-from fixtures.logs import Logs
-from fixtures.querier import build_order_by, build_raw_query, get_rows, make_query_request
-
-LOWER = "alpha"
-UPPER = "ALPHA"
-PLAIN = "beta"
-NON_ASCII = "Mixed CASE Ünïcode"
-SLASH = "GET /api/v1/users"
-SUPERSTRING = "GET /api/v1/users/42"
-QUOTE = 'say "hi" now'
-BACKSLASH = "C:\\tmp\\log"
-LIKE_META = "100% _off"
-TAB = "tab\there"
-CTRL = "ctrl\x01here"
-
-BODIES = [LOWER, UPPER, PLAIN, NON_ASCII, SLASH, SUPERSTRING, QUOTE, BACKSLASH, LIKE_META, TAB, CTRL]
-
-
-# querierlogs/16_body_equality.py with use_json_body on: `body` resolves to body_v2.message,
-# which the lower(body) companion skips, and the same expressions must still answer alike.
-@pytest.mark.parametrize(
-    "expression,expected_bodies",
-    [
-        pytest.param(f"body = '{LOWER}'", {LOWER}, id="equality_exact"),
-        pytest.param(f"body = '{UPPER}'", {UPPER}, id="equality_other_case"),
-        pytest.param("body = 'Alpha'", set(), id="equality_case_must_match"),
-        pytest.param(f"body = '{NON_ASCII}'", {NON_ASCII}, id="equality_non_ascii"),
-        pytest.param("body = 'gamma'", set(), id="equality_no_match"),
-        pytest.param(f"body = '{SLASH}'", {SLASH}, id="equality_slash"),
-        pytest.param("body = 'say \"hi\" now'", {QUOTE}, id="equality_quote"),
-        pytest.param(r"body = 'C:\\tmp\\log'", {BACKSLASH}, id="equality_backslash"),
-        pytest.param(f"body = '{LIKE_META}'", {LIKE_META}, id="equality_like_metacharacters"),
-        pytest.param("body = 'tab\there'", {TAB}, id="equality_tab"),
-        pytest.param("body = 'ctrl\x01here'", {CTRL}, id="equality_control_char"),
-        pytest.param("body = 'GET /api/v1'", set(), id="equality_prefix_does_not_match"),
-        pytest.param(f"body IN ('{LOWER}', '{PLAIN}')", {LOWER, PLAIN}, id="in_excludes_other_case"),
-        pytest.param(f"body IN ('{SLASH}', '{LIKE_META}')", {SLASH, LIKE_META}, id="in_escaped_values"),
-        pytest.param(f"body NOT IN ('{LOWER}', '{UPPER}')", set(BODIES) - {LOWER, UPPER}, id="not_in"),
-    ],
-)
-def test_logs_body_equality_json(
-    signoz: types.SigNoz,
-    create_user_admin: None,  # pylint: disable=unused-argument
-    get_token: Callable[[str, str], str],
-    insert_logs: Callable[[list[Logs]], None],
-    expression: str,
-    expected_bodies: set[str],
-) -> None:
-    now = datetime.now(tz=UTC).replace(second=0, microsecond=0)
-    insert_logs(
-        [
-            Logs(
-                timestamp=now - timedelta(seconds=i + 1),
-                resources={"service.name": "api"},
-                body=body,
-            )
-            for i, body in enumerate(BODIES)
-        ]
-    )
-
-    token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
-    response = make_query_request(
-        signoz,
-        token,
-        start_ms=int((now - timedelta(minutes=5)).timestamp() * 1000),
-        end_ms=int(now.timestamp() * 1000),
-        request_type="raw",
-        queries=[
-            build_raw_query(
-                "A",
-                "logs",
-                filter_expression=expression,
-                order=[build_order_by("timestamp", "desc"), build_order_by("id", "desc")],
-                limit=100,
-            )
-        ],
-    )
-
-    assert response.status_code == HTTPStatus.OK, response.text
-    assert response.json()["status"] == "success"
-    # body_v2 comes back parsed; a plain-string body is {"message": <body>}.
-    assert {row["data"]["body"]["message"] for row in get_rows(response)} == expected_bodies

tests/integration/tests/querierlogs/16_body_equality.py

@@ -1,92 +0,0 @@
-from collections.abc import Callable
-from datetime import UTC, datetime, timedelta
-from http import HTTPStatus
-
-import pytest
-
-from fixtures import types
-from fixtures.auth import USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD
-from fixtures.logs import Logs
-from fixtures.querier import build_order_by, build_raw_query, get_column_data_from_response, make_query_request
-
-LOWER = "alpha"
-UPPER = "ALPHA"
-PLAIN = "beta"
-NON_ASCII = "Mixed CASE Ünïcode"
-SLASH = "GET /api/v1/users"
-SUPERSTRING = "GET /api/v1/users/42"
-QUOTE = 'say "hi" now'
-BACKSLASH = "C:\\tmp\\log"
-LIKE_META = "100% _off"
-TAB = "tab\there"
-CTRL = "ctrl\x01here"
-
-BODIES = [LOWER, UPPER, PLAIN, NON_ASCII, SLASH, SUPERSTRING, QUOTE, BACKSLASH, LIKE_META, TAB, CTRL]
-
-
-# `body = ?` carries a case-insensitive LOWER(body) companion for the bloom filters, so a
-# body differing only in case must still not come back.
-@pytest.mark.parametrize(
-    "expression,expected_bodies",
-    [
-        pytest.param(f"body = '{LOWER}'", {LOWER}, id="equality_exact"),
-        pytest.param(f"body = '{UPPER}'", {UPPER}, id="equality_other_case"),
-        pytest.param("body = 'Alpha'", set(), id="equality_case_must_match"),
-        pytest.param(f"body = '{NON_ASCII}'", {NON_ASCII}, id="equality_non_ascii"),
-        pytest.param("body = ''", set(), id="equality_empty"),
-        pytest.param("body = 'gamma'", set(), id="equality_no_match"),
-        # the companion is a LIKE-free equality, so none of these are metacharacters to it
-        pytest.param(f"body = '{SLASH}'", {SLASH}, id="equality_slash"),
-        pytest.param("body = 'say \"hi\" now'", {QUOTE}, id="equality_quote"),
-        pytest.param(r"body = 'C:\\tmp\\log'", {BACKSLASH}, id="equality_backslash"),
-        pytest.param(f"body = '{LIKE_META}'", {LIKE_META}, id="equality_like_metacharacters"),
-        pytest.param("body = 'tab\there'", {TAB}, id="equality_tab"),
-        pytest.param("body = 'ctrl\x01here'", {CTRL}, id="equality_control_char"),
-        # a prefix of another body must not match it
-        pytest.param("body = 'GET /api/v1'", set(), id="equality_prefix_does_not_match"),
-        pytest.param(f"body IN ('{LOWER}', '{PLAIN}')", {LOWER, PLAIN}, id="in_excludes_other_case"),
-        pytest.param(f"body IN ('{SLASH}', '{LIKE_META}')", {SLASH, LIKE_META}, id="in_escaped_values"),
-        pytest.param(f"body NOT IN ('{LOWER}', '{UPPER}')", set(BODIES) - {LOWER, UPPER}, id="not_in"),
-    ],
-)
-def test_logs_body_equality(
-    signoz: types.SigNoz,
-    create_user_admin: None,  # pylint: disable=unused-argument
-    get_token: Callable[[str, str], str],
-    insert_logs: Callable[[list[Logs]], None],
-    expression: str,
-    expected_bodies: set[str],
-) -> None:
-    now = datetime.now(tz=UTC).replace(second=0, microsecond=0)
-    insert_logs(
-        [
-            Logs(
-                timestamp=now - timedelta(seconds=i + 1),
-                resources={"service.name": "api"},
-                body=body,
-            )
-            for i, body in enumerate(BODIES)
-        ]
-    )
-
-    token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
-    response = make_query_request(
-        signoz,
-        token,
-        start_ms=int((now - timedelta(minutes=5)).timestamp() * 1000),
-        end_ms=int(now.timestamp() * 1000),
-        request_type="raw",
-        queries=[
-            build_raw_query(
-                "A",
-                "logs",
-                filter_expression=expression,
-                order=[build_order_by("timestamp", "desc"), build_order_by("id", "desc")],
-                limit=100,
-            )
-        ],
-    )
-
-    assert response.status_code == HTTPStatus.OK, response.text
-    assert response.json()["status"] == "success"
-    assert set(get_column_data_from_response(response.json(), "body")) == expected_bodies

tests/integration/tests/querierlogs/17_index_pruning.py

@@ -1,226 +0,0 @@
-import json
-from collections.abc import Callable
-from datetime import UTC, datetime, timedelta
-from http import HTTPStatus
-
-import pytest
-
-from fixtures import types
-from fixtures.auth import USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD
-from fixtures.logs import Logs
-from fixtures.querier import (
-    build_order_by,
-    build_raw_query,
-    get_preview_selected_granules,
-    get_preview_skip_indexes,
-    get_rows,
-    make_preview_query_request,
-    make_query_request,
-)
-
-# The legacy body holds the text the producer wrote, so the same value reaches ClickHouse under
-# different encodings: PHP escapes `/`, Go escapes `&` `<` `>`, Python escapes non-ASCII. The
-# LOWER(body) predicates the filters carry for the bloom filters must find all of them.
-BODIES = {
-    "plain": '{"tag":"plain","url":"https://signoz.io/docs","user_id":4242,"status":"timeout_error"}',
-    "php": '{"tag":"php","url":"https:\\/\\/signoz.io\\/docs"}',
-    "go": '{"tag":"go","note":"connection reset \\u0026 retry aborted"}',
-    "python": '{"tag":"python","city":"caf\\u00e9 municipal district"}',
-    "other_case": '{"tag":"other_case","status":"TIMEOUT_ERROR"}',
-    "no_user_id": '{"tag":"no_user_id","status":"ok","url":"https://signoz.io/pricing"}',
-    "tagged": '{"tag":"tagged","labels":["production","webserver"]}',
-    "tagged_escaped": '{"tag":"tagged_escaped","labels":["batch \\u0026 stream","webserver"]}',
-}
-
-
-@pytest.mark.parametrize(
-    "expression,expected_tags",
-    [
-        pytest.param("body.user_id = 4242", {"plain"}, id="numeric_equality"),
-        pytest.param("body.user_id EXISTS", {"plain"}, id="exists"),
-        # a negated comparison matches the rows without the path, so it carries no predicate
-        pytest.param("body.user_id != 4242", set(BODIES) - {"plain"}, id="not_equal_keeps_pathless_rows"),
-        pytest.param("body.status NOT EXISTS", {"php", "go", "python", "tagged", "tagged_escaped"}, id="not_exists"),
-        pytest.param("body.url = 'https://signoz.io/docs'", {"plain", "php"}, id="equality_escaped_slashes"),
-        pytest.param("body.url CONTAINS 'signoz.io/docs'", {"plain", "php"}, id="contains_escaped_slashes"),
-        pytest.param("body.note = 'connection reset & retry aborted'", {"go"}, id="equality_escaped_ampersand"),
-        pytest.param("body.city = 'café municipal district'", {"python"}, id="equality_escaped_non_ascii"),
-        # the value predicate is case-insensitive where the equality is not
-        pytest.param("body.status = 'timeout_error'", {"plain"}, id="equality_underscore"),
-        pytest.param("body.status = 'TIMEOUT_ERROR'", {"other_case"}, id="equality_other_case"),
-        pytest.param("body.status IN ('timeout_error', 'ok')", {"plain", "no_user_id"}, id="in_carries_one_value_per_arm"),
-        # has and hasAll assert every element, hasAny only one of them
-        pytest.param("has(body.labels[*], 'production')", {"tagged"}, id="has_element"),
-        pytest.param("has(body.labels[*], 'batch & stream')", {"tagged_escaped"}, id="has_escaped_element"),
-        pytest.param("hasAll(body.labels[*], ['production', 'webserver'])", {"tagged"}, id="has_all_needs_every_element"),
-        pytest.param(
-            "hasAny(body.labels[*], ['production', 'batch & stream'])",
-            {"tagged", "tagged_escaped"},
-            id="has_any_needs_one_element",
-        ),
-        # 'webserver' is in both, so an ORed literal set must not exclude either row
-        pytest.param(
-            "hasAny(body.labels[*], ['webserver', 'nothing here'])",
-            {"tagged", "tagged_escaped"},
-            id="has_any_across_both",
-        ),
-    ],
-)
-def test_logs_body_json_index_predicates(
-    signoz: types.SigNoz,
-    create_user_admin: None,  # pylint: disable=unused-argument
-    get_token: Callable[[str, str], str],
-    insert_logs: Callable[[list[Logs]], None],
-    expression: str,
-    expected_tags: set[str],
-) -> None:
-    now = datetime.now(tz=UTC).replace(second=0, microsecond=0)
-    insert_logs(
-        [
-            Logs(
-                timestamp=now - timedelta(seconds=i + 1),
-                resources={"service.name": "api"},
-                body=body,
-            )
-            for i, body in enumerate(BODIES.values())
-        ]
-    )
-
-    token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
-    response = make_query_request(
-        signoz,
-        token,
-        start_ms=int((now - timedelta(minutes=5)).timestamp() * 1000),
-        end_ms=int(now.timestamp() * 1000),
-        request_type="raw",
-        queries=[
-            build_raw_query(
-                "A",
-                "logs",
-                filter_expression=expression,
-                order=[build_order_by("timestamp", "desc"), build_order_by("id", "desc")],
-                limit=100,
-            )
-        ],
-    )
-
-    assert response.status_code == HTTPStatus.OK, response.text
-    assert response.json()["status"] == "success"
-    assert {json.loads(row["data"]["body"])["tag"] for row in get_rows(response)} == expected_tags
-
-
-# JSON_VALUE matches no index expression, so the literals are what get the bloom filters consulted
-# at all; the read funnel is what catches one that stops matching.
-BODY_BLOOM_FILTERS = {"body_index_v2_token", "body_index_v2_ngram"}
-
-
-@pytest.mark.parametrize(
-    "expression,prunes_every_granule",
-    [
-        pytest.param("body.status = 'timeout_error'", False, id="value_needle_present"),
-        pytest.param("body.status = 'zz_no_seeded_body_holds_this'", True, id="value_needle_absent"),
-        pytest.param("body.zz_no_seeded_body_holds_this EXISTS", True, id="path_needle_absent"),
-        # a number is compared after JSONExtract parses it, so it carries no value literal - only
-        # its path, which every row holding the key satisfies
-        pytest.param("body.user_id = 999999", False, id="number_carries_only_its_path"),
-    ],
-)
-def test_logs_body_json_index_prunes_granules(
-    signoz: types.SigNoz,
-    create_user_admin: None,  # pylint: disable=unused-argument
-    get_token: Callable[[str, str], str],
-    insert_logs: Callable[[list[Logs]], None],
-    expression: str,
-    prunes_every_granule: bool,
-) -> None:
-    now = datetime.now(tz=UTC).replace(second=0, microsecond=0)
-    insert_logs(
-        [
-            Logs(
-                timestamp=now - timedelta(seconds=i + 1),
-                resources={"service.name": "api"},
-                body=body,
-            )
-            for i, body in enumerate(BODIES.values())
-        ]
-    )
-
-    token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
-    response = make_preview_query_request(
-        signoz,
-        token,
-        start_ms=int((now - timedelta(minutes=5)).timestamp() * 1000),
-        end_ms=int(now.timestamp() * 1000),
-        request_type="raw",
-        queries=[
-            build_raw_query(
-                "A",
-                "logs",
-                filter_expression=expression,
-                order=[build_order_by("timestamp", "desc"), build_order_by("id", "desc")],
-                limit=100,
-            )
-        ],
-    )
-
-    assert response.status_code == HTTPStatus.OK, response.text
-    skip_indexes = get_preview_skip_indexes(response, "A")
-    assert BODY_BLOOM_FILTERS <= set(skip_indexes), f"body bloom filters not consulted, only: {sorted(skip_indexes)}"
-
-    selected = get_preview_selected_granules(response, "A")
-    if prunes_every_granule:
-        assert selected == 0, f"expected every granule pruned, {selected} survived"
-    else:
-        assert selected > 0, "the granule holding the match must survive"
-
-
-# `body = ?` matches no index expression on its own; the lowered companion is what the filters
-# prune on, so its absence from the funnel is the regression this catches.
-@pytest.mark.parametrize(
-    "expression,prunes_every_granule",
-    [
-        pytest.param("body = 'alpha'", False, id="equality_present_value"),
-        pytest.param("body = 'zz_no_seeded_body_holds_this'", True, id="equality_absent_value"),
-        # IN delegates to the equalities, so every arm carries its own companion
-        pytest.param("body IN ('alpha', 'beta')", False, id="in_present_values"),
-        pytest.param("body IN ('zz_absent_one', 'zz_absent_two')", True, id="in_absent_values"),
-    ],
-)
-def test_logs_body_equality_prunes_granules(
-    signoz: types.SigNoz,
-    create_user_admin: None,  # pylint: disable=unused-argument
-    get_token: Callable[[str, str], str],
-    insert_logs: Callable[[list[Logs]], None],
-    expression: str,
-    prunes_every_granule: bool,
-) -> None:
-    now = datetime.now(tz=UTC).replace(second=0, microsecond=0)
-    insert_logs([Logs(timestamp=now - timedelta(seconds=i + 1), resources={"service.name": "api"}, body=body) for i, body in enumerate(["alpha", "ALPHA", "beta"])])
-
-    token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
-    response = make_preview_query_request(
-        signoz,
-        token,
-        start_ms=int((now - timedelta(minutes=5)).timestamp() * 1000),
-        end_ms=int(now.timestamp() * 1000),
-        request_type="raw",
-        queries=[
-            build_raw_query(
-                "A",
-                "logs",
-                filter_expression=expression,
-                order=[build_order_by("timestamp", "desc"), build_order_by("id", "desc")],
-                limit=100,
-            )
-        ],
-    )
-
-    assert response.status_code == HTTPStatus.OK, response.text
-    skip_indexes = get_preview_skip_indexes(response, "A")
-    assert BODY_BLOOM_FILTERS <= set(skip_indexes), f"body bloom filters not consulted, only: {sorted(skip_indexes)}"
-
-    selected = get_preview_selected_granules(response, "A")
-    if prunes_every_granule:
-        assert selected == 0, f"expected every granule pruned, {selected} survived"
-    else:
-        assert selected > 0, "the granule holding the match must survive"

tests/integration/tests/queriermetrics/13_bool_label_filter.py

@@ -1,66 +0,0 @@
-from collections.abc import Callable
-from datetime import UTC, datetime, timedelta
-from http import HTTPStatus
-
-from fixtures import querier, types
-from fixtures.auth import USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD
-from fixtures.metrics import Metrics
-
-METRIC = "test.metric.boollabel"
-
-
-def test_metrics_filter_bool_label(
-    signoz: types.SigNoz,
-    create_user_admin: None,  # pylint: disable=unused-argument
-    get_token: Callable[[str, str], str],
-    insert_metrics: Callable[[list[Metrics]], None],
-) -> None:
-    now = datetime.now(tz=UTC).replace(second=0, microsecond=0)
-    insert_metrics(
-        [
-            Metrics(
-                metric_name=METRIC,
-                labels=labels,
-                timestamp=now - timedelta(seconds=1),
-                temporality="Unspecified",
-                type_="Gauge",
-                is_monotonic=False,
-                value=value,
-            )
-            for labels, value in [
-                ({"success": "true"}, 30.0),
-                ({"success": "false"}, 10.0),
-                ({"success": "1"}, 5.0),
-                ({"success": "maybe"}, 3.0),
-                ({"region": "us"}, 7.0),
-            ]
-        ]
-    )
-    token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
-
-    # `true` selects "true" and "1"; `false` selects only "false". "maybe" and the series
-    # carrying no `success` label cast to NULL, so they are in neither result.
-    for expr, expected in [
-        ("success = true", 35.0),
-        ("success = false", 10.0),
-        ("success != true", 10.0),
-        ("success IN [true]", 35.0),
-        ("success IN [true, false]", 45.0),
-    ]:
-        response = querier.make_scalar_query_request(
-            signoz,
-            token,
-            now,
-            [
-                querier.build_scalar_query(
-                    name="A",
-                    signal="metrics",
-                    aggregations=[querier.build_metrics_aggregation(METRIC, "latest", "sum", "unspecified", reduce_to="last")],
-                    filter_expression=expr,
-                )
-            ],
-        )
-        assert response.status_code == HTTPStatus.OK, f"{expr}: {response.text}"
-        data = querier.get_scalar_table_data(response.json())
-        assert len(data) == 1, f"{expr}: {data}"
-        assert data[0][-1] == expected, f"{expr}: {data}"

tests/integration/tests/queriertraces/01_list.py

@@ -1240,6 +1240,13 @@ def test_traces_list_span_scope(
             lambda x: {"duration_nano": int(x[1].duration_nano), "span_id": x[1].span_id, "timestamp": format_timestamp(x[1].timestamp), "trace_id": x[1].trace_id},
             id="select_attribute_duration_order_intrinsic",
         ),
+        # Case 9: filter on the intrinsic scope.version. Only x[1] should match.
+        pytest.param(
+            BuilderQuery(signal="traces", name="A", select_fields=[TelemetryFieldKey("timestamp")], filter_expression="scope.version = '1.0.0'", limit=1),
+            HTTPStatus.OK,
+            lambda x: {"span_id": x[1].span_id, "timestamp": format_timestamp(x[1].timestamp), "trace_id": x[1].trace_id},
+            id="filter_scope_version",
+        ),
     ],
 )
 def test_traces_list_with_corrupt_data(
@@ -1283,6 +1290,156 @@ def test_traces_list_with_corrupt_data(
         assert get_rows(response)[0]["data"] == expected(traces)
 
 
+@pytest.mark.parametrize(
+    "filter_expression,expected_indices",
+    [
+        # Intrinsic scope.name / scope.version resolve to the JSON sub-columns.
+        pytest.param("scope.name = 'io.signoz.payment'", [1], id="intrinsic_scope_name"),
+        pytest.param("scope.version = '2.3.1'", [0], id="intrinsic_scope_version"),
+        # A scope attribute resolves against the scope JSON column's attributes.
+        pytest.param("scope.telemetry.sdk.language = 'python'", [1], id="scope_attribute"),
+        # `env.tier` is a span attribute on span 0 and a scope attribute on
+        # span 1. Unprefixed -> no explicit context, so it is checked in every
+        # applicable context (attribute OR scope) and both spans match.
+        pytest.param("env.tier = 'gold'", [0, 1], id="bare_cross_context"),
+        # The explicit `scope.` prefix forces scope context only, so span 0's
+        # span attribute is ignored — only span 1 matches.
+        pytest.param("scope.env.tier = 'gold'", [1], id="scope_prefixed_cross_context"),
+        # `scope.name` matches BOTH the intrinsic scope.name field (span 0) and a
+        # scope attribute literally named `name` (span 1's scope attribute
+        # name='io.signoz.checkout').
+        pytest.param("scope.name = 'io.signoz.checkout'", [0, 1], id="scope_name_collision"),
+        # `scope.name` also matches a span attribute literally named `scope.name`
+        # (attribute context) — span 2 carries attribute scope.name='attr-scope-name'.
+        pytest.param("scope.name = 'attr-scope-name'", [2], id="scope_name_attribute_collision"),
+        # An unprefixed `name` resolves to the intrinsic span `name` column and a
+        # `name` scope attribute, but NOT the scope.name field. Span 2's span
+        # name and span 1's scope attribute `name` both equal 'io.signoz.checkout';
+        # span 0's scope.name field equals it too but is NOT matched.
+        pytest.param("name = 'io.signoz.checkout'", [1, 2], id="bare_name_excludes_scope_name_field"),
+        # A value that no resolvable key holds (scope.name/scope.version field,
+        # a `name`/`version` scope attribute, or a same-named attribute/resource)
+        # returns nothing.
+        pytest.param("scope.version = 'corrupt_data'", [], id="scope_version_no_match"),
+        pytest.param("scope.name = 'corrupt_data'", [], id="scope_name_no_match"),
+    ],
+)
+def test_traces_list_with_scope_filter(
+    signoz: types.SigNoz,
+    create_user_admin: None,  # pylint: disable=unused-argument
+    get_token: Callable[[str, str], str],
+    insert_traces: Callable[[list[Traces]], None],
+    filter_expression: str,
+    expected_indices: list[int],
+) -> None:
+    """
+    Setup three spans with different scope key resolution:
+    - x[0]: scope.name/version 'io.signoz.checkout'/'2.3.1'; span attribute
+      env.tier='gold'.
+    - x[1]: scope.name/version 'io.signoz.payment'/'4.5.6'; scope attributes
+      telemetry.sdk.language='python', env.tier='gold', and a `name` scope
+      attribute colliding with x[0]'s scope.name value.
+    - x[2]: span name 'io.signoz.checkout' (colliding with x[0]'s scope.name
+      value) and a span attribute literally named `scope.name`.
+
+    Tests:
+    - Filtering on scope.name / scope.version / a scope attribute.
+    - An unprefixed key is resolved across contexts (scope checked alongside
+      attribute / intrinsic), while a `scope.`-prefixed key is scope-only.
+    - `scope.name` hits the intrinsic field, a `name` scope attribute, and a
+      span attribute `scope.name` (cross-context), while a bare `name` hits
+      the span name column (and a `name` scope attribute) but never the
+      scope.name field.
+    """
+    now = datetime.now(tz=UTC).replace(microsecond=0)
+    trace_id = TraceIdGenerator.trace_id()
+    span_ids = [TraceIdGenerator.span_id() for _ in range(3)]
+
+    traces = [
+        Traces(
+            timestamp=now - timedelta(seconds=4),
+            duration=timedelta(seconds=2),
+            trace_id=trace_id,
+            span_id=span_ids[0],
+            parent_span_id="",
+            name="GET /checkout",
+            kind=TracesKind.SPAN_KIND_SERVER,
+            status_code=TracesStatusCode.STATUS_CODE_OK,
+            resources={"service.name": "checkout"},
+            attributes={"http.request.method": "GET", "env.tier": "gold"},
+            scope={
+                "name": "io.signoz.checkout",
+                "version": "2.3.1",
+                "attributes": {"telemetry.sdk.language": "go"},
+            },
+        ),
+        Traces(
+            timestamp=now - timedelta(seconds=2),
+            duration=timedelta(seconds=1),
+            trace_id=trace_id,
+            span_id=span_ids[1],
+            parent_span_id="",
+            name="POST /pay",
+            kind=TracesKind.SPAN_KIND_SERVER,
+            status_code=TracesStatusCode.STATUS_CODE_OK,
+            resources={"service.name": "payment"},
+            attributes={"http.request.method": "POST"},
+            # env.tier is a scope attribute here (cross-context with span 0);
+            # `name` is a scope attribute colliding with span 0's scope.name.
+            scope={
+                "name": "io.signoz.payment",
+                "version": "4.5.6",
+                "attributes": {
+                    "telemetry.sdk.language": "python",
+                    "env.tier": "gold",
+                    "name": "io.signoz.checkout",
+                },
+            },
+        ),
+        Traces(
+            timestamp=now - timedelta(seconds=1),
+            duration=timedelta(seconds=1),
+            trace_id=trace_id,
+            span_id=span_ids[2],
+            parent_span_id="",
+            # span name collides with span 0's scope.name value
+            name="io.signoz.checkout",
+            kind=TracesKind.SPAN_KIND_SERVER,
+            status_code=TracesStatusCode.STATUS_CODE_OK,
+            resources={"service.name": "probe"},
+            # a span attribute named `scope.name`
+            attributes={"scope.name": "attr-scope-name"},
+            scope={"name": "span-gamma", "version": "9.9.9"},
+        ),
+    ]
+    insert_traces(traces)
+
+    token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
+    start_ms, end_ms = _query_window(now)
+
+    response = make_query_request(
+        signoz,
+        token,
+        start_ms=start_ms,
+        end_ms=end_ms,
+        request_type=RequestType.RAW,
+        queries=[
+            BuilderQuery(
+                signal="traces",
+                name="A",
+                select_fields=[TelemetryFieldKey("timestamp")],
+                filter_expression=filter_expression,
+                limit=10,
+            ).to_dict()
+        ],
+    )
+
+    assert response.status_code == HTTPStatus.OK, response.text
+    got_span_ids = {row["data"]["span_id"] for row in get_rows(response)}
+    expected_span_ids = {traces[i].span_id for i in expected_indices}
+    assert got_span_ids == expected_span_ids
+
+
 @pytest.mark.parametrize("surface", ["filter", "select", "order"])
 def test_traces_list_unknown_span_context_synthesizes(
     signoz: types.SigNoz,