Table & column reference

The SQL Editor and Builder run against ClickHouse. The database is `observekit` — the editor defaults to it, so you can write FROM logs (unqualified) instead of FROM observekit.logs.

> Two gotchas up front. Durations are stored in nanoseconds (duration_ns), not milliseconds — divide by 1e6 for ms. The source column is `source_id`, not source. attributes / labels / parsed_fields are JSON strings — extract with JSONExtractString(col, 'key').

`logs`

Every log line (agent- or OTLP-collected).

Column	Type	Notes
`timestamp`	DateTime64(9, UTC)	Nanosecond precision, UTC
`source_id`	String	The source the line belongs to
`namespace`	String	K8s namespace (empty for non-k8s)
`pod_name`	String
`container_name`	String
`container_id`	String
`node_name`	String
`stream`	String	`stdout` / `stderr`
`level`	String	`debug`, `info`, `warn`, `error`, `trace`, `unknown` (unparseable)
`message`	String	The log body
`labels`	String (JSON)	Pod labels / OTLP attributes
`parsed_fields`	String (JSON)	Structured fields parsed from the line
`trace_id`	String	Links to a span (if correlated)
`span_id`	String
`exception_fingerprint`	String	Groups repeated stack traces (see Exceptions)
`workload`	String	Deployment/StatefulSet/DaemonSet name
`workload_kind`	String	e.g. `Deployment`

Ordered by (source_id, timestamp).

`spans`

Trace spans from OTLP.

Column	Type	Notes
`trace_id`	String	One trace = many spans
`span_id`	String
`parent_span_id`	String	Empty for the root span
`name`	String	Operation name, e.g. `GET /checkout`
`service_name`	String	From the OTLP `service.name` attribute
`kind`	String	`server`, `client`, `internal`, …
`start_time`	DateTime64(9, UTC)	Use this for time filters, not `timestamp`
`end_time`	DateTime64(9, UTC)
`duration_ns`	Int64	Nanoseconds — `duration_ns/1e6` for ms
`status_code`	String	`OK`, `ERROR`, `UNSET`
`status_message`	String
`attributes`	String (JSON)	Span attributes (e.g. `http.status_code`)
`events`	String (JSON)	Span events
`source_id`	String

Ordered by (service_name, start_time, trace_id).

`metrics`

Time-series points.

Column	Type	Notes
`timestamp`	DateTime64(9, UTC)
`name`	String	Metric name, e.g. `container_cpu_usage_percent`
`type`	String	`gauge`, `counter`, …
`value`	Float64
`source_id`	String
`labels`	String (JSON)	Metric dimensions

Ordered by (name, source_id, timestamp).

Rollup / tiered / meta tables

`log_summary` — pre-aggregated per-pod log counts (cheap for volume charts).
`error_summary` — pre-aggregated error/warn rollups.
`cold_logs` — logs aged out of hot storage (older than the hot window; slower).
`unified_logs` — a view over hot + cold; query it when your window may cross the tier boundary.
`meta.sources` — source rows from the metadata store (name, type, status). Fully-qualified because it lives in the meta database, not observekit.

Time helpers

$from / $to — bound to the editor's time picker (SQL mode). Example: WHERE timestamp BETWEEN $from AND $to.
Or use ClickHouse directly: WHERE timestamp > now() - INTERVAL 1 HOUR.

See Query reference for operators, JSON extraction, wildcards/regex, and limits.