Trace query syntax - Application Real-Time Monitoring Service

Trace Explorer offers three interconnected methods to query your data: the search bar, the filter panel, and the Quick Filter pane. Use the method that best fits your workflow.

Use the search bar

Enter filter conditions directly into the Trace Explorer search bar.

Trace Explorer supports the query syntax of Simple Log Service (SLS).

For a detailed description of query fields, see Trace Explorer parameters.
For a detailed description of SLS query operators, see Query operators. Analysis statements are not supported.

Note

To use the * and ? wildcard characters in your filter conditions, select the Allow Fuzzy Search checkbox.
The duration field is measured in nanoseconds. For example, to filter for traces with a duration greater than 500 ms, enter the expression duration >= 500000000. To query for traces within a specific range, such as 0 ms to 500 ms, enter duration in (0 500000000). The range includes the start value but excludes the end value.
To query fields in Attributes or Resources, add the attributes. or resources. prefix to the field name.

Query examples:

Find traces for the /components/api/v1/ads/data span with an HTTP status code of 500:
```
spanName : "/components/api/v1/ads/data" and attributes.http.status_code : 500
```

Find traces with errors from the opentelemetry-demo-adservice application:

serviceName : "opentelemetry-demo-adservice" and attributes.excep.ids : *

Use the filter panel

On the Trace Explorer page, click the search bar to open the filter panel. In this panel, you can set values for filter conditions and add criteria for Attributes and Resources.

Common query conditions include serviceName (application name), spanName (span name), ip (host address), traceId (trace ID), and duration. Each condition supports various operators, such as :, =, and !=. You can further refine results by selecting checkboxes such as Only show traces with code hotspots, Only show root span traces, Only show slow spans, and Only show error spans. The advanced query area contains the kind (span kind) and statusCode (status) fields.

Note

To select multiple values for a condition, use the oneOf operator. To exclude a set of values, use the not oneOf operator.
The duration field is measured in nanoseconds. For example, to filter for traces with a duration greater than 500 ms, enter the expression duration >= 500000000. To query for traces within a specific range, such as 0 ms to 500 ms, enter duration in (0 500000000). The range includes the start value but excludes the end value.
To query by Attributes and Resources, click + Add Query Condition.

Use the Quick Filter pane

In the Quick Filter pane on the left side of the Trace Explorer page, you can quickly filter traces by status, duration, application name, span name, and host address.

For example, selecting Error under the Status filter quickly finds traces with errors, which correspond to statusCode=2.
Select a specific application or span name to quickly show only its associated traces.

The Quick Filter pane supports multi-level filtering. It displays a real-time distribution of trace data for your selected criteria, helping you identify potential anomalies.