Filters
How to filter traces in Observe: the filter modes, every filterable property, the metrics you can filter and aggregate on, and ready-to-paste queries.
The Filter panel in the trace explorer narrows which traces are shown. It offers three modes: plain-language AI search, a Basic property/condition/value builder, and a Query expression for power users. This page lists the modes, every property you can filter on, the metrics you can filter and aggregate by, and a set of ready-to-paste queries.
Filter modes
| Mode | Use it for |
|---|---|
| AI search | Describe what you want in plain English (e.g. “errors on gpt-4o today”) and the filter is built for you |
| Basic | Pick a property, a condition, and a value. Add several; they apply together (AND) |
| Query | Write a filter expression directly, for conditions the Basic builder can’t express |
Note
Query mode uses symbolic operators (=, !=, contains, >, <), while Basic mode uses the word equivalents (is, is not, contains, greater than, less than). They mean the same thing: the property table below lists the word forms, and the ready-to-use queries use the symbols.
Filterable properties
Each property maps to a span attribute key. Use the property name in the Basic builder, or the attribute key in a Query expression.
| Property | Attribute key | Example value | Operators |
|---|---|---|---|
| Trace ID | trace.id | 7f3c1a9b… | is, is not |
| Trace Name | trace.name | support_agent.run | is, is not, contains |
| Span Name | span.name | tool.check_order_status | is, is not, contains |
| Status | status | OK, ERROR | is, is not |
| Model | llm.model_name | gpt-4o | is, is not, contains |
| Node Type | node.type | llm, chain, tool | is, is not |
| Span Kind | fi.span.kind | LLM, RETRIEVER, TOOL | is, is not |
| User ID | user.id | user_8821 | is, is not, contains |
| Provider | llm.provider | openai, anthropic | is, is not |
| Service / Trace Name | service.name | checkout-service | is, is not, contains |
| Latency | latency | 5000 (ms, numeric) | greater than, less than |
| Eval score | eval.score / scores.<name> | 0.5 (numeric) | greater than, less than |
| Tag | tag.tags | needs-review (list of strings) | contains |
In addition, annotation values attached to a span are filterable, using is / is not on an annotation value.
Note
Property names and attribute keys are case-sensitive in Query mode. Status values are upper-case (OK, ERROR); model and provider names match what the SDK reported.
Ready-to-use filters
Paste any of these into the Query tab. Each line finds a common class of trace.
status = ERROR AND llm.model_name = gpt-4o # errors on a specific model
latency > 5000 # slow spans, over 5 seconds
user.id = user_8821 # every trace for one end user
eval.score < 0.5 # low-scoring responses
fi.span.kind = RETRIEVER # retriever spans only
tag.tags contains needs-review # traces carrying a tag
Tip
Combine conditions with AND to narrow, and reuse the same expression as a saved view in the trace explorer so the whole team sees the same slice.
Basic operators
| Operator | Applies to |
|---|---|
is / is not | Exact match (status, model, provider, enums) |
contains | Substring match (names, inputs, user ID) |
greater than / less than | Numeric values (latency, tokens, eval score) |
Metrics
Alongside the properties above, these are the metrics Observe computes from your spans: the values you sort the trace table by and aggregate on a dashboard widget. Nothing is precomputed, each is derived from the spans that match your filters and time window.
| Metric | Unit | What it measures |
|---|---|---|
| Span count | count | Number of spans matching the filters |
| Error count | count | Number of spans or traces with ERROR status |
| Span response time | ms | Latency of a span |
| LLM response time | ms | Latency of LLM spans specifically |
| Token usage | tokens | Tokens consumed (prompt + completion) |
| Cost | USD | Computed cost of model calls |
| Eval pass-rate | % | Share of evaluated spans that passed their eval |
- Latency is per span, not per trace. Span response time measures one operation; a whole request’s wall-clock time is the root span’s duration, so filter to root spans to compare requests.
- Cost and token usage only populate on LLM spans. A tool or retrieval span adds to span count but contributes zero tokens and zero cost.
Aggregations and granularity
Aggregate a metric with Sum, Average, Median, Count, Distinct count, or Min / Max, over a time bucket of minute, hour, day, week, or month. The available granularities adjust to the selected time range, a 12-month range will not offer minute granularity.
If a dashboard number looks wrong, see Dashboard numbers look wrong.
Questions & Discussion