Skip to content

fix: alert query for null trace id in sample dataset #1382

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 1 commit into from
Jul 21, 2025
Merged

fix: alert query for null trace id in sample dataset #1382

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 2 additions & 3 deletions resources/ingest_demo_data.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -436,9 +436,8 @@ create_alerts() {
echo "Response: $response2"
fi

# Alert 3: Trace ID or Span ID null
alert3_json="{\"severity\":\"high\",\"title\":\"Trace ID or Span ID null\",\"stream\":\"$P_STREAM\",\"alertType\":\"threshold\",\"aggregates\":{\"aggregateConfig\":[{\"aggregateFunction\":\"count\",\"conditions\":{\"operator\":null,\"conditionConfig\":[{\"column\":\"trace_id\",\"operator\":\"is null\",\"value\":\"\"}]},\"column\":\"trace_id\",\"operator\":\">\",\"value\":0}]},\"evalConfig\":{\"rollingWindow\":{\"evalStart\":\"5h\",\"evalEnd\":\"now\",\"evalFrequency\":1}},\"targets\":[\"$target_id\"]}"

# Alert 3: Trace ID null
alert3_json="{\"severity\":\"high\",\"title\":\"Trace ID null\",\"stream\":\"$P_STREAM\",\"alertType\":\"threshold\",\"aggregates\":{\"aggregateConfig\":[{\"aggregateFunction\":\"count\",\"conditions\":{\"operator\":null,\"conditionConfig\":[{\"column\":\"trace_id\",\"operator\":\"is null\",\"value\":null}]},\"column\":\"trace_id\",\"operator\":\">\",\"value\":0}]},\"evalConfig\":{\"rollingWindow\":{\"evalStart\":\"5h\",\"evalEnd\":\"now\",\"evalFrequency\":1}},\"targets\":[\"$target_id\"]}"
response3=$(curl_with_retry "$P_URL/api/v1/alerts" "POST" "$alert3_json" "application/json" 3)
Comment on lines +439 to 441
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Verification agent

❓ Verification inconclusive

count(trace_id) skips NULLs – the alert will never trigger

With the WHERE trace_id IS NULL filter applied, every remaining trace_id value is NULL; the SQL-semantics of COUNT(column) ignore NULLs, so the result is always 0.
Threshold "> 0" can therefore never be met, rendering the alert ineffective.

-{\"aggregateFunction\":\"count\", ... \"column\":\"trace_id\", \"operator\":\">\", \"value\":0}
+{\"aggregateFunction\":\"count\", ... \"column\":\"*\",        \"operator\":\">\", \"value\":0}

(Use *, 1, or the API’s dedicated “countAll”/“rowcount” column, depending on backend expectations.)

Please adjust the column (or switch to an aggregate that counts rows regardless of NULLs) and verify that "operator": "is null" is a supported comparator for your alert engine.

Ensure the alert can ever fire for NULL trace_ids

The current alert filters to trace_id IS NULL but uses count(trace_id), which ignores NULL values—so it always returns 0 and never exceeds the > 0 threshold.

• File: resources/ingest_demo_data.sh (around lines 439–441)
• Key snippet in alert3_json:

- {"aggregateFunction":"count", ... "column":"trace_id", "operator":">", "value":0}
+ {"aggregateFunction":"countAll", ... /* or keep "count" and use */ "column":"*", "operator":">", "value":0}

Also confirm that "operator":"is null" is supported by your alert engine’s API before shipping.

Committable suggestion skipped: line range outside the PR's diff.

🤖 Prompt for AI Agents 
In resources/ingest_demo_data.sh around lines 439 to 441, the alert condition
uses count(trace_id) which excludes NULL values, causing the alert to never fire
despite filtering for trace_id IS NULL. To fix this, change the aggregate
function to count(*) or another method that counts all rows regardless of
trace_id being NULL, ensuring the threshold check works correctly. Also verify
that the "operator":"is null" syntax is supported by the alert engine API before
finalizing the fix.

if [[ $? -eq 0 ]]; then
echo "Alert 3 (Trace ID null) created successfully"
Expand Down
Loading