Advanced Filtering Criteria for Distributed Tracing

You can use criteria to build an Advanced Filter for Trace data. The Advanced Filter uses the following operations to filter data:

• Match
• Commands
• Reserved Keywords
• Reserved Tags

Match

You can match specific tags that are present in the span with a pattern. The matching operation uses the following criteria:

• Operation and Resource
• Resource attributes
• Duration attributes
• Error/no error span
• Root/non-root span

Operation and Resource

The following table displays the operations and resource criteria you can use in an Advanced Filter:

Scenario	Query	Description
Basic	http.method=GET	Searches and displays where key equals value
Value with spaces	tag32=’tags with32′ tag32=”tags with32″	Returns keys equal to ‘tags with32’ If there are spaces, value must be enclosed in quotes (‘), (“)
Wildcard support (Asterisk *)	Parent*=yes operation=*Resource* resource=us-west* service*=tracegenclient39* ‘tag8’=*	Wildcard can be used for cases where the partial strict pattern must match
Partial support	~tag23 ~’parent tag37′	Partial match
AND/OR	*=* AND child-tag=NO AnimalN OR Chi*=* operation=*name-generator* AND resources=*name-services* OR ‘parent tag’=NO child-tag24=YES AND ‘parent tag24’=NO	AND, OR, and combination Precedence is given to AND and then OR
NOT	NOT(operation=*Resource)	Not of operation
Parentheses ()	(‘test numeric static-auto_version’=1.12 AND http.method=GET OR http.method=POST) NOT(Resource=name-generator-service-j-01 And (nameSpace=auto-namespace OR ~serviceNam OR not spanType) child-rag58 AND NOT(operation=okeydokeyoper_58 or service=MyTestService58) (test)	Precedence is given to bracket, then AND, and then OR

Resource Attributes

Resource attributes consist of Service, Namespace, Resource, and Operation of Trace data. The following table displays how you can use resource attributes in an Advanced Filter:

Scenario	Query	Description
Basic	service=automation-jkc-01-name-generator-service namespace=Nameresource.name resource=okeydoke* operation=*Resource*	Used to filter span responses on the basis of resource attributes – Service – Namespace – Resource – Operation
Wildcard support (Asterisk *)	service=*	Wildcard can be used for cases where the partial strict pattern must match with resource attributes
AND/OR	service=automation-j-01-scientist-name-services* AND namespace=auto-namespace service=automation-jkc-01-scientist-name-service OR resource=scientist-name-service-jkc-01 service=automation-jkc-01-scientist-name-service AND (namespace=automation-jkc-02 OR namespace=automation-jkc-01)	Filter on resource attribute by using combination of AND/OR
NOT	NOT service.name	Used to filter on NOT criteria Displays results that do not match the pattern
Parentheses ()	(service=automation-localj-01-animal-name-service and namespace=automation-01) NOT(service=automation-localj-01-animal-name-service and namespace=automation-01)	Groups resource attributes using brackets  Precedence is given to bracket, then AND, and then OR
IN	service IN (automation-localj-01-animal-name-service,automation-localj-01-scientist) namespace IN (*NameResource,automation-01) resource IN (automation-localj-01-animal-name-service,automation-localj-01-scientist) operation IN (/api/v1/scientists/random,operation=’HTTP GET’)	IN operator used with resource attributes

Duration Attributes

Duration attributes support numerical operations. The following table displays how you can use duration attributes in Advanced Filtering:

Scenario	Query	Description
Basic	duration=100 duration>100 duration<100 duration>=100 duration<=100 duration>’100′ duration>”100″	Duration attribute is equal to 100 ms Duration attribute is greater than 100 ms Duration attribute is less than 100 ms Duration attribute is greater than equal to  100 ms Duration attribute is less than equal to 100 ms Duration attribute is greater than 100 ms Duration attribute is greater than 100 ms
AND/OR	duration>100 and duration<900 duration>100 or duration<900	Duration is greater than 100 and less than 900 ms Duration is greater than 100 or less than 900 ms
Parenthese ()	(duration>100 and duration<900)	Duration is greater than 100 and less than 900 ms

Error/No Error Span

Trace data can contain errors. You can build an Advanced Filter to find errors present in spans. The following table displays how to build an Advanced Filter to find errors:

Scenario	Description
error=true	Filters span responses where span is of error type
error=false	Filters span responses where span is not of error type

Root/Non-root Span

Span can be a root span where other spans are generated, or a non-root span which originates from the root span. The following table displays how to use Root and Non-root criteria to build an Advanced Filter:

Scenario	Description
root=true	Filters span responses where span is root span only
root=false	Filters span responses where span is not root span

Commands

The following table displays scenarios that are separated from the filter scenario via | operator. This will either add more value to the filter or enhance the filter result.

Scenario	Description
tags=http.status,ip.version	Tags that only need to be shown on Traces page in Tags columns against each filtered result span Filters the list of tags in the Tags column against each row in the list of spans

Reserved Keywords

The following table displays the reserved keywords you can use in an Advanced Filter:

Keyword	Description	Example
service	For service attribute	service=automation-localj-01-animal-name-service
resource	For resource attribute	resource=okeydoke*
operation	For operation attribute	operation=*name-generator*
namespace	For namespace attribute	namespace=automation-01-animal
error	For error attribute for error/no error span	error=true
root	For root attribute to identify root and non-root span	root=true
duration	For duration attribute	duration=100
traceId	For trace ID attribute	traceId=66043b4e2e29484ab8fdedd594f7ee9f
spanId	For span ID attribute	spanId=bde9f10ab4ab4b8f

Reserved Tags

The following table displays reserved tags:

Tag	Description
service	service tag: “service” tag whose value is derived from the combination of namespace and resourceId(separated by “-“).