Search traces using TraceQL query builder
Inspired by PromQL and LogQL, TraceQL is a query language designed for selecting traces. TraceQL provides a method for formulating precise queries so you can zoom in to the data you need. Query results are returned faster because the queries limit what is searched.
To learn more about how to query by TraceQL, refer to the TraceQL documentation.
The TraceQL query builder, located on the Explore > Query type > Search in Grafana, provides drop-downs and text fields to help you write a query.
Enable Search with the query builder
This feature is automatically available in Grafana 10 (and newer) and Grafana Cloud.
To enable the TraceQL query builder in self-hosted Grafana through version 10.1, enable the traceqlSearch
feature toggle.
Write TraceQL queries using Search
The TraceQL query builder, located on the Explore > Query type > Search in Grafana, provides drop-downs and text fields to help you write a query.
The builder lets you run the most common queries in as few clicks as possible. You don’t need to know the underlying query language or database architecture to use it.
The builder supports a subset of TraceQL capabilities. For example, if you wish to use structural operators (>>
, >
, ~
), you need to use the query editor on the TraceQL tab.
You can use the query builder’s drop-downs to compose TraceQL queries. The selections you make automatically generate a TraceQL query.
To access Search, select your Tempo data source, and then choose Explore and select Query type > Search. You can use the query builder to search trace data by resource service name, span name, duration, and one or more tags. The examples on this page use the default filters.
In addition, you can add query builder blocks, view the query history, and use the Inspector to see details.
![Screenshot of the Tempo Search query type Screenshot of the Tempo Search query type](/media/docs/tempo/traceql/screenshot-tempods-query-search.png)
Perform a search
To perform a search, you need to select filters and/or tags and then run the query. The results appear underneath the query builder. The screenshot identifies the areas used to perform a search.
![Parts of Tempo Search query type Parts of Tempo Search query type](/media/docs/tempo/traceql/screenshot-tempods-query-search-parts.png)
Number | Name | Action | Comment |
---|---|---|---|
1 | Data source | Use the data source drop-down to select a Tempo data source. | Each data source has its own version of search. This Search is specific to the Tempo data source. |
2 | Query type tab | Select Search. | |
3 | Choose filter | Choose whether to filter using Resource Service Name, Span Name, and/or Duration. | Optional. You can execute an empty query in the Search tab. In TraceQL, {} is a valid query and is the default query until you choose options. |
4 | Filters conditions | Select options for one or more filters. For example, you can define a filter where Resource Service Name (resource.service.name ) equals (= ) cloud-logs-archiver . | Optional. At least one tag or filter must be defined. |
5 | Tags | Add tags for span, resource, or unscoped and define their conditions. | Optional. |
6 | TraceQL query | Displays the TraceQL query constructed by your selections. | This TraceQL query is executed when you select Run query. |
Every query searches the data for the selected time frame. By default, queries run against data from the last hour. Select Time range to the left of Run query to choose the time range for the data your query runs against. Read the dashboard time range documentation to learn more.
To access Search, use the following steps:
- Sign into Grafana.
- Select your Tempo data source.
- From the menu, choose Explore and select Query type > Search.
Define filters
Using filters, you refine the data returned from the query by selecting Resource Service Name, Span Name, or Duration. The Duration represents span time, calculated by subtracting the end time from the start time of the span.
Grafana administrators can change the default filters using the Tempo data source configuration.
Filters can be limited by the operators. The available operators are determined by the field type.
For example, Span Name and Resource Service Name are string fields so the comparison operators are equals (=
), not equal (!=
), or regular expressions (=~
).
Duration is a duration field type and uses range selections (>
, >=
, <
, <=
).
When you select multiple values for the same filter, Grafana automatically changes the operator to the regex operator =~
and concatenates the values with a |
. This capability only applies to fields with drop-down value selection.
For example, if you choose Span Name = get
and then Span Name = log_results_cache,
operator drop-down changes from =
to =~
and both get
and log_results_cache
are listed in the Span Name field. The resulting query is updated with this:
{duration>5ms && duration<10ms && name=~"get|log_results_cache"}
To define filters, follow these steps:
- Choose one of the filters.
- Select a comparison operator from the drop-down.
- Resource Service Name and Span Name only: Select one or more values from the drop-down.
- Duration only: Enter values and units for the range and choose comparison operators for the drop-downs. Units can be nanoseconds (
ns
), milliseconds (ms
), seconds (s
), minutes (m
), and hours (h
).
You can either select Run query to execute the query or define tags and then run the query.
Define tags
You can add any tags to your query to further filter the results. Tags can be selected by scoped (span or resource) or unscoped. If you select unscoped, then all tags are searched for matches.
To add a tag, follow these steps:
- Select span, resource, or unscoped.
- Select a tag from the Select tag drop-down.
- Select a comparison operator.
- Select a value from the Select value drop-down. This field is populated based upon the tag.
- Optional: Select + to add an additional tag.
Optional: Use Aggregate by
Warning
Aggregate by is an experimental feature. Engineering and on-call support is not available. Documentation is either limited or not provided outside of code comments. No SLA is provided. Enable themetricsSummary
feature toggle in Grafana to use this feature. Your Grafana Tempo data source must also point to a Tempo database with the Metrics Summary API enabled. Contact Grafana Support to enable this feature in Grafana Cloud.
Using Aggregate by, you can calculate RED metrics (total span count, percent erroring spans, and latency information) for spans of kind=server
that match your filter criteria, grouped by one or more attributes.
This capability is based on the metrics summary API.
Metrics summary only calculates summaries based on spans received within the last hour.
For additional information, refer to Traces to metrics: Ad-hoc RED metrics in Grafana Tempo with Aggregate by
.
When you use Aggregate by, the selections you make determine how the information is reported in the Table. Every combination that matches selections in your data is listed in the table.
Each aggregate value, for example intrinsic
:name
, has a corresponding column in the results table.
For example, names matching GET /:endpoint
with a span.http.user_agent of k6/0.46
appeared in 31,466 spans. Instead of being listed by traces and associated spans, the query results are grouped by the selections in Aggregate by.
The RED metrics are calculated for every name and user agent combination found in your data.
The screenshot shows all of the successful HTTP status_code
API calls against the mystical-server
service.
The results are shown in the same order used in Aggregate by.
For example, Aggregate by lists intrinsic.name
followed by span.http.user_agent
.
The first column in the results Table shows name and then span.http.user_agent.
To use this capability:
- In the Aggregate by row, select a scope from the first drop-down box. For example,
span
. - Select an attribute from the second drop-down.
- Optional: Select + to add an Aggregate by row.
- Optional: Select a Time range to expand or narrow the data set for an hour’s range.
- Select Run query.
Optional: Add queries
Using Add query, you can have successive queries that run in sequential order. For example, query A runs and then query B. You can reorder the queries by dragging and dropping them above or below other queries. Select + Add query to add another query block.
Run queries and view results
Select Run query to run the TraceQL query (1 in the screenshot).
Queries can take a little while to return results. The results appear in a table underneath the query builder. Selecting a Trace ID (2 in the screenshot) displays more detailed information (3 in the screenshot).
![Tempo Search query type results Tempo Search query type results](/media/docs/tempo/traceql/screenshot-tempods-query-results.png)
Streaming results
The Tempo data source supports streaming responses to TraceQL queries so you can see partial query results as they come in without waiting for the whole query to finish.
Note
To use this experimental feature, enable thetraceQLStreaming
feature toggle. If you’re using Grafana Cloud and would like to enable this feature, please contact customer support.
Streaming is available for both the Search and TraceQL query types, and you’ll get immediate visibility of incoming traces on the results table.
Was this page helpful?
Related resources from Grafana Labs
![Getting started with the Grafana LGTM Stack](/static/assets/featured/getting-started-with-grafana-lgtm-stack-amer_featured.png?w=200 200w, /static/assets/featured/getting-started-with-grafana-lgtm-stack-amer_featured.png?w=400 400w)
![Intro to Kubernetes monitoring in Grafana Cloud](/media/webinar/Screenshot-2024-02-12-at-4.09.30-PM.png?w=200 200w, /media/webinar/Screenshot-2024-02-12-at-4.09.30-PM.png?w=400 400w)
![Building advanced Grafana dashboards](/media/webinar/AMER_buildadv_notxt.png?w=200 200w, /media/webinar/AMER_buildadv_notxt.png?w=400 400w)