Intrinsic fields

duration

The elapsed time of the span. Compare it with duration literals to find slow (or suspiciously fast) operations — the single most used intrinsic in trace search.

Syntax

{ duration > <duration> }

Example

Find demo spans that ran for 40 milliseconds or longer.

{.service_name =~ "demo.*" && duration >= 40ms}

Expected output

event:name

Matches spans that carry a span event with the given name — most commonly exception, which OpenTelemetry SDKs attach when a span records an error. Link attributes use the link: scope the same way.

Syntax

{ event:name = "<event>" }

Example

Search for spans that recorded an exception event. The demo services never fail, so the result is empty — on production data this returns the failing spans.

{event:name = "exception"}

Expected output

(no matching traces — the demo services emit no such data)

kind

The span kind assigned by the instrumentation: server, client, producer, consumer, or internal. Use it to separate inbound handling from outbound calls within the same service.

Syntax

{ kind = server }    (values: server, client, producer, consumer, internal)

Example

Find the demo services' inbound (server) spans — the database root spans.

{.service_name =~ "demo.*" && kind = server}

Expected output

name

The operation name of the span, as set by the instrumentation — an HTTP route, database statement type, or logical step name. Supports all string comparisons including regex.

Syntax

{ name = "<operation>" }

Example

Find the demo services' child operation, user.

{name = "user"}

Expected output

status

The span status set by the instrumentation: ok, error, or unset. { status = error } is the standard entry point for failure investigation.

Syntax

{ status = error }    (values: ok, error, unset)

Example

The demo services do not set an explicit status, so their spans match unset.

{.service_name =~ "demo.*" && status = unset}

Expected output

traceDuration

The end-to-end elapsed time of the entire trace, measured across all its spans. Use it to find slow requests regardless of which span inside them was slow.

Syntax

{ traceDuration > <duration> }

Example

Find demo traces that took at least 10 milliseconds end to end.

{.service_name =~ "demo.*" && traceDuration > 10ms}

Expected output