Logfire Schema Reference

Logfire stores OpenTelemetry data in two tables: records (spans and logs) and metrics. SQL dialect is Apache DataFusion (Postgres-like).

records Table

All spans, logs, and span events are stored in the records table.

Timestamps

Span Tree Structure

Core Fields

Exception Fields

Service / Resource Fields

HTTP / URL Fields

OpenTelemetry Fields

Telemetry SDK Fields

Other

metrics Table

JSON Attribute Access

The attributes column stores arbitrary structured data as JSON. Use ->> to extract text values, -> to extract nested objects.

-- Extract a text value
SELECT attributes->>'user_id' as user_id FROM records

-- Nested access
SELECT attributes->'request'->>'method' as method FROM records

-- Filter by attribute
WHERE attributes->>'http.url' LIKE '%/api/%'

-- Cast extracted values
WHERE CAST(attributes->>'response.status' AS INTEGER) >= 500

Common Filter Patterns

-- Recent errors with details
SELECT start_timestamp, service_name, exception_type, exception_message
FROM records
WHERE is_exception AND start_timestamp > now() - interval '1 hour'
ORDER BY start_timestamp DESC LIMIT 20

-- HTTP errors by route
SELECT http_route, http_response_status_code, count(*) as count
FROM records
WHERE http_response_status_code >= 400
GROUP BY http_route, http_response_status_code
ORDER BY count DESC LIMIT 20

-- Slow endpoints (p95 duration)
SELECT http_route,
       approx_percentile_cont(duration, 0.95) as p95_duration,
       count(*) as count
FROM records
WHERE kind = 'span' AND http_route IS NOT NULL
GROUP BY http_route ORDER BY p95_duration DESC LIMIT 20

-- Trace waterfall
SELECT span_name, message, duration, start_timestamp, span_id, parent_span_id
FROM records WHERE trace_id = '<trace_id>'
ORDER BY start_timestamp

-- Tag filtering
SELECT * FROM records WHERE array_has(tags, 'critical') LIMIT 20

-- Time-bucketed error rate
SELECT time_bucket(interval '5 minutes', start_timestamp) as bucket,
       count(*) FILTER (WHERE is_exception) as errors,
       count(*) as total
FROM records
GROUP BY bucket ORDER BY bucket DESC LIMIT 50

-- Metrics query
SELECT recorded_timestamp, scalar_value, attributes
FROM metrics
WHERE metric_name = 'http.server.request.duration'
ORDER BY recorded_timestamp DESC LIMIT 20