Show/Find Trace doesn't working

[using-system]

Dear Support Team,

We are currently using SEQ version 2024.3, and we are unable to display traces (please refer to the file seq1.png).

However, the TraceId is correctly indexed (as shown in seq2.png). The search function for all property types (Find) works well, except for TraceId! Additionally, the traces have been successfully exported by the OpenTelemetry endpoint (see seq3.png).

Do you have any suggestions on how to resolve this issue?

Thank you for your assistance.

Best regards,
Matthieu

[liammclennan]

Hi Matthieu,

Does the query shown in seq1.png find any spans?

[using-system]

Hello @liammclennan

I found the problem.

When we use show/find trace, SEQ executes a query like this:

`
api/data?q=select%20coalesce(%40Resource.service.name%2C%20Application)%20as%20serviceName%2C%20%0A%20%20%20%20%20%20%20%20%40StructuredMessage%20as%20structuredMessage%2C%0A%20%20%20%20%20%20%20%20%40Id%20as%20id%2C%20%0A%20%20%20%20%20%20%20%20%40Level%20as%20level%2C%20%0A%20%20%20%20%20%20%20%20%40TraceId%20as%20traceId%2C%20%0A%20%20%20%20%20%20%20%20%40SpanId%20as%20spanId%2C%20%0A%20%20%20%20%20%20%20%20%40ParentId%20as%20parentId%2C%20%0A%20%20%20%20%20%20%20%20TotalMilliseconds(%40Elapsed)%20as%20elapsedMs%2C%0A%20%20%20%20%20%20%20%20ToIsoString(%40Start)%20as%20start%2C%20%0A%20%20%20%20%20%20%20%20ToIsoString(%40Timestamp)%20as%20timestamp%2C%0A%20%20%20%20%20%20%20%20%40SpanKind%20as%20kind%2C%0A%20%20%20%20%20%20%20%20%40EventType%20as%20eventType%0A%20%20%20%20%20%20%20%20%0A%20%20%20%20%20%20%20%20from%20stream%20%0A%20%20%20%20%20%20%20%20where%20Has(%40Start)%20and%20Has(%40SpanId)%20and%20%40TraceId%20%3D%20%276a0e40364f0e5ba6a09a1aa57daf7bd4%27%0A%20%20%20%20%20%20%20%20limit%201000&timeoutMS=10000

`

This query is blocked by our company's WAF due to multiple rules, particularly those for potential SQL injection attacks.

Would it be possible in a future version to perform this querying via POST/body or another method (graphql ?) instead of using query strings?

Thank you.

Best regards,

(And to answer the question: Yes, spans are indeed found for the traceId. They are correctly ingested via the OTel endpoint.)

[liammclennan]

Hi @using-system,

It is certainly possible, but no plans at the moment. I note that if your security software is blocking it now then presumably it would block the same query as body content.

Well done finding the problem and thank you for letting us know.

[using-system]

Hi @liammclennan

OK, noted that it's not currently planned to work on this. We will negotiate on our side with Cyber regarding the WAF rules.

As for the POST, the idea isn't to directly transpose what's in the query into the body, but rather to create a structured request that would be WAF-compliant.

or Alternatively with GraphQL.

a body request like this

query {
getSpans(
filter: {
logLevel: "Error",
}
) {
message
}
}

Many thanks for your support.

Matthieu