Support Center Home


Advanced Filtering Criteria for Distributed Tracing

You can use criteria to build an Advanced Filter for Trace data. The Advanced Filter uses the following operations to filter data:

  • Match
  • Commands
  • Reserved Keywords
  • Reserved Tags

Note: If a query is space separated, you must use double quotes(“) or single quotes (‘).

Match

You can match specific tags that are present in the span with a pattern. The matching operation uses the following criteria:

  • Operation and Resource
  • Resource attributes
  • Duration attributes
  • Error/no error span
  • Root/non-root span

Operation and Resource

The following table displays the operations and resource criteria you can use in an Advanced Filter:

ScenarioQueryDescription
Basichttp.method=GETSearches and displays where key equals value
Value with spacestag32=’tags with32′
tag32=”tags with32″
Returns keys equal to ‘tags with32’
If there are spaces, value must be enclosed in quotes (‘), (“)
Wildcard support (Asterisk *)Parent*=yes
operation=*Resource*
resource=us-west*
service*=tracegenclient39*
‘tag8’=*
Wildcard can be used for cases where the partial strict pattern must match
Partial support~tag23
~’parent tag37′
Partial match
AND/OR*=* AND child-tag=NO
AnimalN OR Chi*=*
operation=*name-generator* AND resources=*name-services* OR ‘parent tag’=NO
child-tag24=YES AND ‘parent tag24’=NO
AND, OR, and combination
Precedence is given to AND and then OR
NOTNOT(operation=*Resource)Not of operation
Parentheses ()(‘test numeric static-auto_version’=1.12 AND http.method=GET OR http.method=POST)
NOT(Resource=name-generator-service-j-01 And (nameSpace=auto-namespace OR ~serviceNam OR not spanType)
child-rag58 AND NOT(operation=okeydokeyoper_58 or service=MyTestService58)
(test)
Precedence is given to bracket, then AND, and then OR

Resource Attributes

Resource attributes consist of Service, Namespace, Resource, and Operation of Trace data. The following table displays how you can use resource attributes in an Advanced Filter:

ScenarioQueryDescription
Basicservice=automation-jkc-01-name-generator-service
namespace=Nameresource.name
resource=okeydoke*
operation=*Resource*
Used to filter span responses on the basis of resource attributes
– Service
– Namespace
– Resource
– Operation
Wildcard support (Asterisk *)service=*Wildcard can be used for cases where the partial strict pattern must match with resource attributes
AND/ORservice=automation-j-01-scientist-name-services* AND namespace=auto-namespace
service=automation-jkc-01-scientist-name-service OR resource=scientist-name-service-jkc-01
service=automation-jkc-01-scientist-name-service AND (namespace=automation-jkc-02 OR namespace=automation-jkc-01)
Filter on resource attribute by using combination of AND/OR
NOTNOT service.nameUsed to filter on NOT criteria
Displays results that do not match the pattern
Parentheses ()(service=automation-localj-01-animal-name-service and namespace=automation-01)
NOT(service=automation-localj-01-animal-name-service and namespace=automation-01)
Groups resource attributes using brackets 
Precedence is given to bracket, then AND, and then OR
INservice IN (automation-localj-01-animal-name-service,automation-localj-01-scientist)
namespace IN (*NameResource,automation-01)
resource IN (automation-localj-01-animal-name-service,automation-localj-01-scientist)
operation IN (/api/v1/scientists/random,operation=’HTTP GET’)
IN operator used with resource attributes

Duration Attributes

Duration attributes support numerical operations. The following table displays how you can use duration attributes in Advanced Filtering:

ScenarioQueryDescription
Basicduration=100
duration>100
duration<100
duration>=100
duration<=100
duration>’100′
duration>”100″
Duration attribute is equal to 100 ms
Duration attribute is greater than 100 ms
Duration attribute is less than 100 ms
Duration attribute is greater than equal to  100 ms
Duration attribute is less than equal to 100 ms
Duration attribute is greater than 100 ms
Duration attribute is greater than 100 ms
AND/ORduration>100 and duration<900
duration>100 or duration<900
Duration is greater than 100 and less than 900 ms
Duration is greater than 100 or less than 900 ms
Parenthese ()(duration>100 and duration<900)Duration is greater than 100 and less than 900 ms

Error/No Error Span

Trace data can contain errors. You can build an Advanced Filter to find errors present in spans. The following table displays how to build an Advanced Filter to find errors:

ScenarioDescription
error=trueFilters span responses where span is of error type
error=falseFilters span responses where span is not of error type

Root/Non-root Span

Span can be a root span where other spans are generated, or a non-root span which originates from the root span. The following table displays how to use Root and Non-root criteria to build an Advanced Filter:

ScenarioDescription
root=trueFilters span responses where span is root span only
root=falseFilters span responses where span is not root span

Commands

The following table displays scenarios that are separated from the filter scenario via | operator. This will either add more value to the filter or enhance the filter result.

ScenarioDescription
tags=http.status,ip.versionTags that only need to be shown on Traces page in Tags columns against each filtered result span
Filters the list of tags in the Tags column against each row in the list of spans

Reserved Keywords

The following table displays the reserved keywords you can use in an Advanced Filter:

KeywordDescriptionExample
serviceFor service attributeservice=automation-localj-01-animal-name-service
resourceFor resource attributeresource=okeydoke*
operationFor operation attributeoperation=*name-generator*
namespaceFor namespace attributenamespace=automation-01-animal
errorFor error attribute for error/no error spanerror=true
rootFor root attribute to identify root and non-root spanroot=true
durationFor duration attributeduration=100

Reserved Tags

The following table displays reserved tags:

Warning: Do not create tags with the reserved tags. Creating tags with reserved tags results in conflicts.

TagDescription
serviceservice tag: “service” tag whose value is derived from the combination of namespace and resourceId(separated by “-“).

In This Article