aggregate_spans
Aggregate spans into RED metrics: request count, error rate, throughput, and latency percentiles (p50/p90/p95/p99), grouped by operation and optionally its immediate parent.
START HERE for "where are errors / latency concentrated?", "what changed between two windows?", "is this operation slow?". By default this reads a pre-aggregated rollup, so it stays cheap over wide windows. Drill into raw spans (spans / get_trace) once this points you at a specific (service, operation).
Parent breakdown: the same operation behaves differently per caller. Add "parent_operation" to groupBy to split an operation by its immediate parent — e.g. "http.client" might be 8% errors overall but 92% under one caller and 0% under others. The parent breakdown is computed on demand over raw spans, so keep it scoped: pass a tight from/to and a service/name filter when using it.
Params: from, to: ISO-8601 window (required). step: "", units s m h d w mo y (e.g. "30s", "15m", "2h", "1d", "1w", "1mo", "1y") — omit for a single window per group. groupBy: any of service, operation, parent_operation (default service, operation). service / name: optional filters.
Returns buckets[], each with group, spanCount/okCount/errorCount/unsetCount, errorRate (percentage, 0-100), throughputPerSecond, avg/min/maxDurationNanos, and quantileNanos (p50/p90/p95/p99), plus queryStats.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| to | Yes | End of window, ISO-8601 instant (exclusive) | |
| from | Yes | Start of window, ISO-8601 instant (inclusive) | |
| name | No | Filter by operation name | |
| step | No | Time bucket <amount><unit>, units: s m h d w mo y (e.g. 30s, 15m, 2h, 1d, 1w, 1mo, 1y); omit for one window | |
| groupBy | No | Group-by keys: service, operation, parent_operation | |
| service | No | Filter by service |