Intrinsic fields

Table of Contents

duration
- Syntax
- Example
event:name
- Syntax
- Example
kind
- Syntax
- Example
name
- Syntax
- Example
status
- Syntax
- Example
traceDuration
- Syntax
- Example

Intrinsics are fields every span carries, independent of instrumentation attributes. They are written without a leading dot and cover the span’s timing, identity, and outcome.

duration

The elapsed time of the span. Compare it with duration literals to find slow (or suspiciously fast) operations — the single most used intrinsic in trace search.

Syntax

{ duration > <duration> }

none

Example

Find demo spans that ran for 40 milliseconds or longer.

{.service_name =~ "demo.*" && duration >= 40ms}

Expected output
Root service	Root span	Duration
demo-java-service	database	50 ms
demo-go-service	database	51 ms
demo-java-service	database	50 ms

duration is the span’s own time, including its children; for whole-trace latency use traceDuration.

event:name

Matches spans that carry a span event with the given name — most commonly exception, which OpenTelemetry SDKs attach when a span records an error. Link attributes use the link: scope the same way.

Syntax

{ event:name = "<event>" }

none

Example

Search for spans that recorded an exception event. The demo services never fail, so the result is empty — on production data this returns the failing spans.

{event:name = "exception"}

Expected output

(no matching traces — the demo services emit no such data)

none

kind

The span kind assigned by the instrumentation: server, client, producer, consumer, or internal. Use it to separate inbound handling from outbound calls within the same service.

Syntax

{ kind = server }    (values: server, client, producer, consumer, internal)

none

Example

Find the demo services' inbound (server) spans — the database root spans.

{.service_name =~ "demo.*" && kind = server}

Expected output
Root service	Root span	Duration
demo-python-service	database	50 ms
demo-java-service	database	50 ms
demo-python-service	database	50 ms

Kind values are unquoted keywords. The attribute form .span_kind = "SPAN_KIND_SERVER" also works on Kloudfuse.

name

The operation name of the span, as set by the instrumentation — an HTTP route, database statement type, or logical step name. Supports all string comparisons including regex.

Syntax

{ name = "<operation>" }

none

Example

Find the demo services' child operation, user.

{name = "user"}

Expected output
Root service	Root span	Duration
demo-go-service	database	50 ms
demo-python-service	database	50 ms
demo-java-service	database	50 ms

status

The span status set by the instrumentation: ok, error, or unset. { status = error } is the standard entry point for failure investigation.

Syntax

{ status = error }    (values: ok, error, unset)

none

Example

The demo services do not set an explicit status, so their spans match unset.

{.service_name =~ "demo.*" && status = unset}

Expected output
Root service	Root span	Duration
demo-python-service	database	50 ms
demo-go-service	database	50 ms
demo-java-service	database	50 ms

Status values are unquoted keywords, not strings.

traceDuration

The end-to-end elapsed time of the entire trace, measured across all its spans. Use it to find slow requests regardless of which span inside them was slow.

Syntax

{ traceDuration > <duration> }

none

Example

Find demo traces that took at least 10 milliseconds end to end.

{.service_name =~ "demo.*" && traceDuration > 10ms}

Expected output
Root service	Root span	Duration
demo-go-service	database	50 ms
demo-java-service	database	50 ms
demo-go-service	database	50 ms

A trace matches when any span satisfies the other conditions and the whole trace exceeds the duration.