Fields for spans

The Fields side bar on the left of Explore spans lists every field and tag detected on the spans matching your current query, organized by OpenTelemetry semantic convention. Grouping fields into named sections lets you find the right filter without knowing the exact attribute path. With hundreds of fields potentially present in a trace, sections are what make the side bar navigable rather than overwhelming.

The side bar stays in sync with the query builder. When you add a field-value pair from the side bar, it appears in the query bar; when you edit the query bar, the side bar reflects what is applied.

Spans tab vs. Traces tab

• Spans tab: filters apply to span fields. Each value count reflects the number of matching spans.
• Traces tab: filters apply to trace-aggregated attributes (for example, total duration, error count). Each value count reflects the number of matching traces.

Switching tabs preserves the active filters and re-evaluates them against the new aggregation level.

Core filters

Core sits at the top of the side bar with the most common identifiers and selectors. Core filters are always visible, regardless of the data in the current results.

Filter	Description
Service	Filters by the service that produced the span.
Application	Filters by the Coralogix application label.
Subsystem	Filters by the Coralogix subsystem label.
Operation name	Filters by the span operation.
Span kind	Restricts to one of Internal, Server, Client, Producer, Consumer.
Span type	Restricts to spans of a given type — for example, Web, DB, Cache, Messaging, Job, Spark, Airflow, Dbt, or Custom. In the Traces tab, this is a trace-level filter that returns traces containing at least one span of the selected type.

Fields by section

Below Core, the side bar lists every other span field and tag, grouped by domain. Within each section, fields are sorted alphabetically by default.

Each section pulls fields whose key matches one of the listed prefixes. Coralogix strips tags. and process.tags. prefixes from incoming field keys before classifying them, so a field named tags.http.status_code is grouped under HTTP, not Other.

Section	Field prefixes
Exceptions	exception.*
HTTP	http.*
gRPC / RPC	grpc.*, rpc.*
GraphQL	graphql.*
Messaging	messaging.*
Database	db.*
Cache	cache.*
GenAI / LLM	gen_ai.*, gen.*
RUM / Frontend	cx_rum.*
Object Storage	objectstore.*, object_storage.*
Serverless	faas.*, cloud.*
Spark	spark.*
Airflow	airflow.*
DBT	dbt.*
Infrastructure	k8s.*, ecs.*, aws.*, host.*, deployment.*, container.*
Network	network.*, net.*, server.*
Runtime	process.*, service.*, telemetry.*, thread.*, os.*
Checkly	checkly.*
OTel	otel.*
Events	event.*
CloudEvents	cloudevents.*
Other	Any field that does not match the prefixes above

Sections that have no matching fields in the current results are hidden.

Expand and collapse

Each entry in the side bar supports expand and collapse:

• The whole list, to focus on a single section.
• Each section, to browse its fields.
• Each field, to inspect its values.

Field actions

Expand a field to see its top values with a count beside each. Counts update dynamically as you apply other filters elsewhere in the side bar or query bar.

Filter on a value

Hover any value to reveal inline filter controls:

• Select + In to add the value to the query as an inclusion filter.
• Select − Out to add it as an exclusion filter.
• For an already-filtered value, hover to reveal Remove from query and select it to clear the filter.

When a value is filtered, an In or Out badge appears next to it so you can spot active filters at a glance. Filter changes stay in sync with the query bar.

Search values within a field

Each expanded field has its own Search values input above the value list. Use it to filter the visible values by substring — useful for fields with long-tail values like operation names or URLs.

Show more, show less

Long value lists are truncated by default. Select Show More at the end of the list to load the rest, and Show Less to collapse it again.

More actions menu

The 3-dots menu on each field provides actions that apply to the entire field:

• Add to favorites — pin the field at the top of the side bar for quick access.
• Add as a column — add the field as a new column in the results table.
• Copy full path — copy the full field path (for example, tags.http.status_code), including parent keys.
• Show the graph for the key — open a time-series chart of the field over the active time range, grouped by the field's values.
• Add as Grouping — add the field to the Group by clause in the query builder. The table transforms from individual span rows into aggregated groups.

Search the side bar

Use the search box at the top of the side bar to find a field by name when many attributes are present. Search matches against the field key — matched fields appear under their section, and sections without any match are hidden.

Fast and Full mode

Use the mode toggle at the top of the side bar (next to the field count) to control how many fields the panel loads:

• Fast — loads a limited set of fields for quicker responsiveness on large datasets.
• Full — loads every field detected on the spans matching your current query.

Coralogix remembers your last-used mode for this dataset. Switch to Full when you need to inspect or filter on less-common attributes; stay on Fast for everyday investigation.

Next steps

Investigate a span or trace in depth in Span drilldown.