Comparison operators

Equal (=)

Selects spans where an attribute or intrinsic equals the given value. Attribute names take a leading dot (.service_name); scoped forms (resource., span.) restrict where the attribute is looked up. String values are quoted; numbers, durations, and enums like span kind are not.

Syntax

{ .<attribute> = "<value>" }

Parameters

Example

Find traces containing spans from the demo-python-service.

{.service_name = "demo-python-service"}

Not equal (!=)

Selects spans where an attribute or intrinsic is not equal to the given value. Combine with a positive condition to keep the search scoped.

Syntax

{ .<attribute> != "<value>" }

Parameters

Example

Find demo traces from every service except the Python one.

{.service_name =~ "demo.*" && .service_name != "demo-python-service"}

Regex not match (!~)

Selects spans where an attribute or intrinsic does not match an RE2 regular expression — exclude several values with one condition.

Syntax

{ .<attribute> !~ "<regex>" }

Parameters

Example

Find demo spans whose operation name does not start with data — the user spans match, the database spans do not.

{.service_name =~ "demo.*" && name !~ "data.*"}

Ordering comparisons (>, >=, <, ⇐)

Compares numeric attributes and duration intrinsics with >, >=, <, and ⇐. Durations take Go-style units (100ms, 2s); the most common use is latency filtering on the duration intrinsic.

Syntax

{ duration > <duration> }    (also >=, <, <=)

Parameters

Example

Find demo spans that took at least 40 milliseconds — the 50 ms root spans match.

{.service_name =~ "demo.*" && duration >= 40ms}

Regex match (=~)

Selects spans where an attribute or intrinsic matches an RE2 regular expression — one condition for a whole family of values.

Syntax

{ .<attribute> =~ "<regex>" }

Parameters

Example

Match all three demo services with a single expression.

{.service_name =~ "demo-.*-service"}