fix: alert query for null trace id in sample dataset #1382
Conversation
WalkthroughThe change updates the JSON payload for creating the third alert in a demo data ingestion script. Specifically, it modifies the alert's title and adjusts the null value indicator for the "trace_id" column from an empty string to a JSON null. Changes
Poem
✨ Finishing Touches
🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
SupportNeed help? Create a ticket on our support page for assistance with any issues or questions. Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments. CodeRabbit Commands (Invoked using PR comments)
Other keywords and placeholders
CodeRabbit Configuration File (
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (1)
resources/ingest_demo_data.sh(1 hunks)
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (10)
- GitHub Check: Quest Smoke and Load Tests for Standalone deployments
- GitHub Check: Quest Smoke and Load Tests for Distributed deployments
- GitHub Check: Build Default aarch64-unknown-linux-gnu
- GitHub Check: Build Default x86_64-apple-darwin
- GitHub Check: Build Default x86_64-unknown-linux-gnu
- GitHub Check: Build Default x86_64-pc-windows-msvc
- GitHub Check: Build Default aarch64-apple-darwin
- GitHub Check: Build Kafka aarch64-apple-darwin
- GitHub Check: Build Kafka x86_64-unknown-linux-gnu
- GitHub Check: coverage
| # Alert 3: Trace ID null | ||
| alert3_json="{\"severity\":\"high\",\"title\":\"Trace ID null\",\"stream\":\"$P_STREAM\",\"alertType\":\"threshold\",\"aggregates\":{\"aggregateConfig\":[{\"aggregateFunction\":\"count\",\"conditions\":{\"operator\":null,\"conditionConfig\":[{\"column\":\"trace_id\",\"operator\":\"is null\",\"value\":null}]},\"column\":\"trace_id\",\"operator\":\">\",\"value\":0}]},\"evalConfig\":{\"rollingWindow\":{\"evalStart\":\"5h\",\"evalEnd\":\"now\",\"evalFrequency\":1}},\"targets\":[\"$target_id\"]}" | ||
| response3=$(curl_with_retry "$P_URL/api/v1/alerts" "POST" "$alert3_json" "application/json" 3) |
There was a problem hiding this comment.
💡 Verification agent
❓ Verification inconclusive
count(trace_id) skips NULLs – the alert will never trigger
With the WHERE trace_id IS NULL filter applied, every remaining trace_id value is NULL; the SQL-semantics of COUNT(column) ignore NULLs, so the result is always 0.
Threshold "> 0" can therefore never be met, rendering the alert ineffective.
-{\"aggregateFunction\":\"count\", ... \"column\":\"trace_id\", \"operator\":\">\", \"value\":0}
+{\"aggregateFunction\":\"count\", ... \"column\":\"*\", \"operator\":\">\", \"value\":0}(Use *, 1, or the API’s dedicated “countAll”/“rowcount” column, depending on backend expectations.)
Please adjust the column (or switch to an aggregate that counts rows regardless of NULLs) and verify that "operator": "is null" is a supported comparator for your alert engine.
Ensure the alert can ever fire for NULL trace_ids
The current alert filters to trace_id IS NULL but uses count(trace_id), which ignores NULL values—so it always returns 0 and never exceeds the > 0 threshold.
• File: resources/ingest_demo_data.sh (around lines 439–441)
• Key snippet in alert3_json:
- {"aggregateFunction":"count", ... "column":"trace_id", "operator":">", "value":0}
+ {"aggregateFunction":"countAll", ... /* or keep "count" and use */ "column":"*", "operator":">", "value":0}Also confirm that "operator":"is null" is supported by your alert engine’s API before shipping.
Committable suggestion skipped: line range outside the PR's diff.
🤖 Prompt for AI Agents
In resources/ingest_demo_data.sh around lines 439 to 441, the alert condition
uses count(trace_id) which excludes NULL values, causing the alert to never fire
despite filtering for trace_id IS NULL. To fix this, change the aggregate
function to count(*) or another method that counts all rows regardless of
trace_id being NULL, ensuring the threshold check works correctly. Also verify
that the "operator":"is null" syntax is supported by the alert engine API before
finalizing the fix.
Summary by CodeRabbit