Comparison operators

Every TraceQL query is built from spanset filters: conditions in curly braces that select spans by attribute or intrinsic value. Attributes take a leading dot (.service_name), with optional resource. and span. scopes; intrinsics such as name and duration are unprefixed.

Equal (=)

Selects spans where an attribute or intrinsic equals the given value. Attribute names take a leading dot (.service_name); scoped forms (resource., span.) restrict where the attribute is looked up. String values are quoted; numbers, durations, and enums like span kind are not.

Syntax

{ .<attribute> = "<value>" }
none

Parameters

Parameter Required Description

.<attribute>

Required

The span or resource attribute, or an intrinsic such as name, duration, kind, status.

<value>

Required

Quoted string, number, duration (100ms), or enum value.

Example

Find traces containing spans from the demo-python-service.

{.service_name = "demo-python-service"}
Expected output
Root service Root span Duration

demo-python-service

database

51 ms

demo-python-service

database

50 ms

demo-python-service

database

50 ms

An unscoped attribute (.name) searches span attributes and resource attributes; use resource. or span. to pin the scope.

Not equal (!=)

Selects spans where an attribute or intrinsic is not equal to the given value. Combine with a positive condition to keep the search scoped.

Syntax

{ .<attribute> != "<value>" }
none

Parameters

Parameter Required Description

.<attribute>

Required

The attribute or intrinsic to test.

<value>

Required

The value to exclude.

Example

Find demo traces from every service except the Python one.

{.service_name =~ "demo.*" && .service_name != "demo-python-service"}
Expected output
Root service Root span Duration

demo-java-service

database

50 ms

demo-java-service

database

50 ms

demo-java-service

database

50 ms

Spans that do not carry the attribute at all do not match a != condition.

Regex not match (!~)

Selects spans where an attribute or intrinsic does not match an RE2 regular expression — exclude several values with one condition.

Syntax

{ .<attribute> !~ "<regex>" }
none

Parameters

Parameter Required Description

.<attribute>

Required

The attribute or intrinsic to test.

<regex>

Required

Matching spans are excluded.

Example

Find demo spans whose operation name does not start with data — the user spans match, the database spans do not.

{.service_name =~ "demo.*" && name !~ "data.*"}
Expected output
Root service Root span Duration

demo-go-service

database

50 ms

demo-go-service

database

50 ms

demo-go-service

database

50 ms

Ordering comparisons (>, >=, <, ⇐)

Compares numeric attributes and duration intrinsics with >, >=, <, and ⇐. Durations take Go-style units (100ms, 2s); the most common use is latency filtering on the duration intrinsic.

Syntax

{ duration > <duration> }    (also >=, <, <=)
none

Parameters

Parameter Required Description

<duration>

Required

A duration literal such as 40ms or 1s, or a number for numeric attributes.

Example

Find demo spans that took at least 40 milliseconds — the 50 ms root spans match.

{.service_name =~ "demo.*" && duration >= 40ms}
Expected output
Root service Root span Duration

demo-java-service

database

50 ms

demo-java-service

database

50 ms

demo-python-service

database

50 ms

Regex match (=~)

Selects spans where an attribute or intrinsic matches an RE2 regular expression — one condition for a whole family of values.

Syntax

{ .<attribute> =~ "<regex>" }
none

Parameters

Parameter Required Description

.<attribute>

Required

The attribute or intrinsic to test.

<regex>

Required

An RE2 regular expression.

Example

Match all three demo services with a single expression.

{.service_name =~ "demo-.*-service"}
Expected output
Root service Root span Duration

demo-java-service

database

50 ms

demo-python-service

database

50 ms

demo-java-service

database

50 ms

RE2 does not support look-ahead or back-references.