Filters

How to filter traces in Observe: the filter modes, every filterable property, the metrics you can filter and aggregate on, and ready-to-paste queries.

The Filter panel in the trace explorer narrows which traces are shown. It offers three modes: plain-language AI search, a Basic property/condition/value builder, and a Query expression for power users. This page lists the modes, every property you can filter on, the metrics you can filter and aggregate by, and a set of ready-to-paste queries.

Filter modes

ModeUse it for
AI searchDescribe what you want in plain English (e.g. “errors on gpt-4o today”) and the filter is built for you
BasicPick a property, a condition, and a value. Add several; they apply together (AND)
QueryWrite a filter expression directly, for conditions the Basic builder can’t express

Note

Query mode uses symbolic operators (=, !=, contains, >, <), while Basic mode uses the word equivalents (is, is not, contains, greater than, less than). They mean the same thing: the property table below lists the word forms, and the ready-to-use queries use the symbols.

Filterable properties

Each property maps to a span attribute key. Use the property name in the Basic builder, or the attribute key in a Query expression.

PropertyAttribute keyExample valueOperators
Trace IDtrace.id7f3c1a9b…is, is not
Trace Nametrace.namesupport_agent.runis, is not, contains
Span Namespan.nametool.check_order_statusis, is not, contains
StatusstatusOK, ERRORis, is not
Modelllm.model_namegpt-4ois, is not, contains
Node Typenode.typellm, chain, toolis, is not
Span Kindfi.span.kindLLM, RETRIEVER, TOOLis, is not
User IDuser.iduser_8821is, is not, contains
Providerllm.provideropenai, anthropicis, is not
Service / Trace Nameservice.namecheckout-serviceis, is not, contains
Latencylatency5000 (ms, numeric)greater than, less than
Eval scoreeval.score / scores.<name>0.5 (numeric)greater than, less than
Tagtag.tagsneeds-review (list of strings)contains

In addition, annotation values attached to a span are filterable, using is / is not on an annotation value.

Note

Property names and attribute keys are case-sensitive in Query mode. Status values are upper-case (OK, ERROR); model and provider names match what the SDK reported.

Ready-to-use filters

Paste any of these into the Query tab. Each line finds a common class of trace.

status = ERROR AND llm.model_name = gpt-4o    # errors on a specific model
latency > 5000                                # slow spans, over 5 seconds
user.id = user_8821                           # every trace for one end user
eval.score < 0.5                              # low-scoring responses
fi.span.kind = RETRIEVER                      # retriever spans only
tag.tags contains needs-review               # traces carrying a tag

Tip

Combine conditions with AND to narrow, and reuse the same expression as a saved view in the trace explorer so the whole team sees the same slice.

Basic operators

OperatorApplies to
is / is notExact match (status, model, provider, enums)
containsSubstring match (names, inputs, user ID)
greater than / less thanNumeric values (latency, tokens, eval score)

Metrics

Alongside the properties above, these are the metrics Observe computes from your spans: the values you sort the trace table by and aggregate on a dashboard widget. Nothing is precomputed, each is derived from the spans that match your filters and time window.

MetricUnitWhat it measures
Span countcountNumber of spans matching the filters
Error countcountNumber of spans or traces with ERROR status
Span response timemsLatency of a span
LLM response timemsLatency of LLM spans specifically
Token usagetokensTokens consumed (prompt + completion)
CostUSDComputed cost of model calls
Eval pass-rate%Share of evaluated spans that passed their eval
  • Latency is per span, not per trace. Span response time measures one operation; a whole request’s wall-clock time is the root span’s duration, so filter to root spans to compare requests.
  • Cost and token usage only populate on LLM spans. A tool or retrieval span adds to span count but contributes zero tokens and zero cost.

Aggregations and granularity

Aggregate a metric with Sum, Average, Median, Count, Distinct count, or Min / Max, over a time bucket of minute, hour, day, week, or month. The available granularities adjust to the selected time range, a 12-month range will not offer minute granularity.

If a dashboard number looks wrong, see Dashboard numbers look wrong.

Was this page helpful?

Questions & Discussion