TraceQL Basics

TraceQL Syntax Overview

# Basic syntax: { span conditions } | pipeline operators

# Find all traces with at least one span matching conditions
{ span.node_type = "DataFetchNode" }

# Find all spans with specific attribute value
{ span.tenant_id = "tenant-abc-123" }

# Duration filter
{ duration > 5s }

# Status filter
{ status = error }

# Root span name filter
{ rootName = "workflow.execute" }

# Combined conditions (AND)
{ span.node_type = "DataFetchNode" && duration > 2s }

# Find traces containing any error span
{ status = error }

Attribute Namespaces

BizFirstGO TraceQL Examples

# Find all workflows that failed for a specific tenant
{ rootName = "workflow.execute" && status = error && span.tenant_id = "tenant-abc" }

# Find all slow DataFetchNode spans (P99 investigation)
{ name = "node.execute" && span.node_type = "DataFetchNode" && duration > 5s }

# Find all HIL timeout spans
{ name = "node.execute" && span.hil_outcome = "timeout" }

# Find traces for a specific execution
{ span.execution_id = "exec-d1e2f3a4" }

# Find traces where the external API call was slow
{ name = "http.client" && duration > 3s && resource.service_name = "processengine" }

# Find all traces with HIL suspension in the last hour
{ name = "node.execute" && span.node_type = "ApprovalNode" }

# Find workflow executions over 1 hour (long-running)
{ rootName = "workflow.execute" && duration > 1h }

TraceQL Aggregate Functions (Metrics Queries)

# Count of traces per service (RED metrics from traces)
{ } | rate()

# Duration histogram
{ name = "node.execute" } | histogram_over_time(duration)

# Error rate
{ status = error } | rate()

# P99 duration for workflow executions
{ rootName = "workflow.execute" } | quantile_over_time(duration, 0.99)