Compatibility between ARMS and Grafana Tempo - Managed Service for OpenTelemetry

This topic outlines the compatibility between Application Real-Time Monitoring Service (ARMS) and Grafana Tempo, including the compatibility principles, supported Tempo HTTP API endpoints, and TraceQL.

Compatibility

Grafana Tempo is an open-source distributed tracing backend that stores trace data from protocols such as OpenTelemetry, Jaeger, and Zipkin in Object Storage Service (OSS). It provides high-performance query services for large-scale distributed tracing data.

The Grafana Tempo-compatible HTTP API of ARMS maps the TraceQL query syntax to the index-based query syntax and SQL analysis syntax of Simple Log Service. Then, Simple Log Service returns query and analysis results in a format that meets the Grafana Tempo requirements.

Tempo-compatible API endpoints

The endpoint of the Tempo-compatible API is in the https://${sls-endpoint}/trace/tempo/ format, where ${sls-endpoint} specifies the Simple Log Service endpoint for the region where the trace data is located. Example: https://cn-hangzhou.log.aliyuncs.com/trace/tempo.

Supported regions:

Region	Region ID
Hangzhou	cn-hangzhou
Beijing	cn-beijing
Ulanqab	cn-wulanchabu
Heyuan	cn-heyuan
Singapore	ap-southeast-1

For information about the corresponding endpoints, see Endpoints.

Supported Tempo-compatible APIs

The following table lists the API paths for GET requests.

API path	Description
/api/traces/<traceID>	Queries trace details.
/api/v2/traces/<traceID>	Queries trace details (Tempo API V2).
/api/search	Lists traces with search criteria.
/api/search/tags	Gets available tag keys.
/api/v2/search/tags	Gets available tag keys (Tempo API V2).
/api/search/tag/{tags}/values	Queries tag values.
/api/v2/search/tag/{tags}/values	Queries tag values (Tempo API V2).
/ready	Checks service availability.
/api/echo	Validates Tempo data source connectivity.

Supported TraceQL syntax

Keywords

Category	Field	Description	Example
Span	status	Status. Valid values: unset ok error	status=ok
	statusMessage	The status description.	statusMessage="404 NOT FOUND"
	duration	The span duration. You can specify a unit. Otherwise, the default `unit` ns is used. Examples: 500 10 ns 500 ms 12.88 s 10.5 min 1 h	duration > 500 ms
	name	The span name, corresponding to `spanName` in ARMS.	name="/components/api/v1/mall/product"
	kind	The span type. Valid values: unspecified internal server client producer consumer	kind=server
	spanId	The span identifier.	spanId=fe81595a906fe2a4
Trace	traceDuration	The total trace duration.	traceDuration > 100 ms
Trace	traceId	The trace identifier.	traceId="ea1a0100f617397599186332534d0001"
Attribute	Fields that start with `span.`, such as: span.http.path span.db.statement	Span attributes, corresponding to `attributes` in ARMS.	span.http.path="/api/search"
Resource	Fields that start with `resource.`, such as: resource.service.name resource.namespace resource.agentVersion	Resource attributes, corresponding to `resources` in ARMS.	resource.namespace="arms"
Unscoped Attribute	Fields that start with `.`, such as: .http.path .db.statement	Unscoped attributes, corresponding to `attributes` or `resources` in ARMS.	.db.statement="select * from log"

Operators

Category	Operator	Description	Example
Span selector	{expression}	The expression must be enclosed in `{}`.	{status=ok}
Comparison operators	=	Equal to	{name="/components/api/v1/mall/product"}
	!=	Not equal to	{resource.service.name!="mall-gateway"}
	=~	Regex match	{resource.service.name=~"mall-gateway\|mall-client"}
	!~	Regex negation	{service!~"mall-gateway\|mall-client"}
	>	Greater than	{duration>500 ms}
	>=	Greater than or equal to	{duration>=500 ms}
	<	Less than	{duration<1s}
	<=	Less than or equal to	{duration<=1s}
Logical operators	{condA && condB}	AND	{ span.http.status_code >= 200 && span.http.status_code < 300 }
Logical operators	{condA \|\| condB}	OR	{name="/components/api/v1/mall/product" \|\| resource.service.name="mall-gateway"}

Grant permissions to a RAM user

Use either of the following methods to grant a RAM user the permissions to query and write data through the Tempo-compatible API.

Simple mode: easy settings
Custom mode: fine-grained access control but with complex settings

Simple mode

Use system policies to grant required permissions to a RAM user, without the need for parameter settings.

Here are the system policies:

System policy	Query permission	Write permission
AliyunLogFullAccess	Yes	Yes
AliyunLogReadOnlyAccess	Yes	No

Custom mode

Create custom policies to grant a RAM user the permissions to query or write data through the Tempo-compatible API.

The following script shows a sample policy:

{
    "Version": "1",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "log:GetIndex",
                "log:GetLogStoreContextLogs",
                "log:ListLogStores",
                "log:GetLogStoreHistogram",
                "log:GetLogstoreLogs",
                "log:GetLogStoreContextLogs",
                "log:GetCursorOrData",
                "log:GetLogstore"
            ],
            "Resource": "acs:log:*:*:project/*"
        }
    ]
}