bug(srql): show logs from yesterday where severity = 'info' and service = 'serviceradar-sync' fails #474

New issue

Closed

opened 2026-03-28 04:24:53 +00:00 by mfreeman451 · 0 comments

mfreeman451 commented

2026-03-28 04:24:53 +00:00

Owner

Imported from GitHub.

Original GitHub issue: #1423
Original author: @mfreeman451
Original URL: https://github.com/carverauto/serviceradar/issues/1423
Original created: 2025-07-31T20:32:46Z

Failing:

show logs from yesterday where severity = 'info' and service = 'serviceradar-sync'

Error
API request failed: 500 - {"message":"failed to execute query: query error: failed to execute query: code: 47, message: Missing columns: 'service' while processing query: 'SELECT\n  timestamp, trace_id, span_id, severity_text, severity_number, body, service_name, service_version, service_instance, scope_name, scope_version, attributes, resource_attributes, raw_data, _tp_time\nFROM\n  table(logs)\nWHERE\n  ((timestamp >= to_start_of_day(yesterday())) AND (timestamp <= to_start_of_day(today()))) AND (severity_text = 'info') AND (service = 'serviceradar-sync')\nORDER BY\n  _tp_time DESC, trace_id DESC\nLIMIT 21', required columns: 'timestamp' 'severity_text' 'severity_number' 'body' 'service_name' 'service_version' 'service_instance' 'trace_id' '_tp_time' 'span_id' 'scope_name' 'scope_version' 'resource_attributes' 'raw_data' 'attributes' 'service', maybe you meant: ['timestamp','severity_text','severity_number','body','service_name','service_version','service_instance','trace_id','_tp_time','span_id','scope_name','scope_version','resource_attributes','raw_data','attributes']","status":500}

Working:

show logs from yesterday where severity = 'info' and service_name = 'serviceradar-sync'

Desired Outcome:

We need to alias 'service_name' to 'service' in the SRQL translator

Imported from GitHub. Original GitHub issue: #1423 Original author: @mfreeman451 Original URL: https://github.com/carverauto/serviceradar/issues/1423 Original created: 2025-07-31T20:32:46Z --- Failing: `show logs from yesterday where severity = 'info' and service = 'serviceradar-sync'` ``` Error API request failed: 500 - {"message":"failed to execute query: query error: failed to execute query: code: 47, message: Missing columns: 'service' while processing query: 'SELECT\n timestamp, trace_id, span_id, severity_text, severity_number, body, service_name, service_version, service_instance, scope_name, scope_version, attributes, resource_attributes, raw_data, _tp_time\nFROM\n table(logs)\nWHERE\n ((timestamp >= to_start_of_day(yesterday())) AND (timestamp <= to_start_of_day(today()))) AND (severity_text = 'info') AND (service = 'serviceradar-sync')\nORDER BY\n _tp_time DESC, trace_id DESC\nLIMIT 21', required columns: 'timestamp' 'severity_text' 'severity_number' 'body' 'service_name' 'service_version' 'service_instance' 'trace_id' '_tp_time' 'span_id' 'scope_name' 'scope_version' 'resource_attributes' 'raw_data' 'attributes' 'service', maybe you meant: ['timestamp','severity_text','severity_number','body','service_name','service_version','service_instance','trace_id','_tp_time','span_id','scope_name','scope_version','resource_attributes','raw_data','attributes']","status":500} ``` Working: `show logs from yesterday where severity = 'info' and service_name = 'serviceradar-sync'` Desired Outcome: We need to alias 'service_name' to 'service' in the SRQL translator