Filter Language

You write a filter as one line of terms. A trace must match every term. Press Enter to apply the filter. The bar shows each applied term as a chip with a remove button. The page address holds the filter, so you can share the link.

Syntax

Separate terms with a space. A term is a key with a value, or a free word.

error:true model:gpt-4o duration>2s
env:production -tag:canary
model:gpt-4o model:gpt-4o-mini cost>0.5

• Repeated key. When you repeat the same key with :, a trace matches if it has any of the values. Terms with different keys must all match.
• Case. A key does not depend on case: ERROR:true works. The name after score. or attr. keeps its case.
• Negation. Put - before a term. A negated key term takes : only. -duration>2s is refused. Write duration<=2s.
• Comparisons. >, >=, < and <= work on number keys, duration keys and score.<name>. A text key, error and probes take : and != only.
• Numbers. Digits with an optional decimal part, such as 5 or 0.5. A sign, an exponent and a thousands separator are not allowed.
• Durations. A number with ms, s, m or h: 500ms, 2s, 1.5m, 1h. A number alone means milliseconds.
• Quotes. Put a value in double quotes when it has a space, a quote or a colon: tag:"needs review". A backslash takes the next character as it is, so \" is a quote inside quotes. A space must follow the closing quote.

Keys

The language has 27 keys and two prefix keys. A key takes text unless the table says another form.

prompt, prompt_version and prompt_hash must hold on the same LLM span. The filter prompt:support prompt_version:4 keeps a trace that has one span with both. See Use a Prompt in Code.

score.<name>. A comparison needs a number, and a true or false score counts as 1 or 0. : and != match a label, true, false or the number. Examples: score.quality<0.5 and score.resolved:true. The time of the score must be in the time range or up to 7 days after it. A score term that keeps traces reads at most 10,000 of them. See Scores and Labels.

attr.<key>. It takes : and != only, for example attr.http.method:GET.

A name after score. or attr. may have letters, digits, _, . and -. Quote a name with any other character: score."user rating":4 and attr."http status":500.

Free words

A word without a key matches a trace in three cases:

• A span attribute value holds the word. These values are prompts, answers, tool arguments and model names. The match is on whole tokens and does not depend on case.
• The name of the root span contains the word.
• The trace ID starts with the word.

Put the word in quotes to match a phrase. Put - before a word to leave out the traces that match it. Two words must both match.

Risicare stores content after it removes credentials and personal data, so a removed value cannot be found. A project with content capture off has no content to find. A free word still matches root span names and trace IDs then. See Projects.

A free word reads at most the 10,000 newest matching spans of the time range. At that limit the list says "Showing matches in the first 10,000 spans of this window. Narrow the window." A row that matched on content shows a snippet under its name, with the attribute key. Click the snippet to open the trace on that span.

Special forms

• Trace ID. A bare word of 32 hexadecimal digits becomes trace: and the ID when you apply the filter. This holds alone or beside other terms. In quotes, or after -, it stays a free word.
• Span ID. When the filter is one bare word of 16 hexadecimal digits, the Traces bar opens the trace that holds that span. It looks in the time range of the list. If the span is outside the range, the bar says "No span with this id in the selected range."

Error codes

error_code: matches the typed error code of a span: error_code:TOOL.EXECUTION.TIMEOUT, error_code:ECONNRESET or error_code:429. A code has letters, digits and the characters _ . : / -, with at most 128 characters. It is either dotted or has no lower-case letter.

A value that is not shaped like a code, such as timeout or rate limit, is read as error_message: with the same text. The chip shows error_message and a tooltip says so. See Error Taxonomy.

Limits and error messages

A filter has at most 2,048 characters and 32 terms. The bar checks the filter when you press Enter. If the filter has an error, the bar keeps your text, does not change the page address, and shows the first error under the bar. The message ends with "At character N." and a line with a caret points at the character. The list gives way to one line while the bar holds the error: "The filter is not applied: the message under the filter bar says why. Fix or remove the term to load traces." A link with an invalid filter shows the same line. The bar shows the first error it finds. It checks the length first, then the syntax from left to right, then the number of terms, then each term from left to right. For one term it checks the last four rows of this table in the order shown.

Suggestions

Use the arrow keys to move in the list, Enter or Tab to take a suggestion, and Escape to close the list. Enter with no suggestion selected applies the filter.

• A key prefix lists up to 8 keys, each with a one-line description. A number or duration key ends with >. score. and attr. appear as prefixes.
• error: lists true and false. probes: lists show and hide. experiment: lists any and none.
• score. lists the score names of the project with their type and count. The names load when you first type score.. After a true or false score and :, the bar offers true and false.
• These keys list values with the number of traces: env, environment, agent, error_code, model, tag, user and release. The bar shows up to 10 values, counted over the time range and the filter of the page. It loads them when the bar takes focus. If they do not load, it says "The values did not load; type a value."

Hidden traces

Two kinds of traces stay out of the Traces list until the filter asks for them.

Probe traces. Probe traces (root span control-channel-probe) are hidden until the filter asks for them. A banner counts them: "N probe traces hidden in this window". Show adds probes:show to the filter. A root: term shows them too, unless the term is negated (-root:name or root!=name). When they are shown, Hide removes the probes: terms. The banner is not drawn when the filter has a root: term that is not negated, or a probes: term other than probes:show.

Experiment traces. A trace belongs to an experiment when its spans carry the attribute risicare.experiment.id, as the trial traces of a run do. The list leaves these traces out unless the filter has an experiment term. A note under the bar says "Experiment traces are hidden. Add experiment:any to see them." See Find the trial traces.

• experiment:any keeps the traces that belong to an experiment.
• experiment: and a run ID keeps the traces of that run. Repeat the term for more runs.
• experiment:none keeps the traces with no experiment. This is the default, written out.
• -experiment: and a run ID, or experiment!= and a run ID, keep the traces of other runs and the traces with no experiment.

any and none are words in every case, not run IDs. The note under the bar changes with your terms.

Presets and the address

Presets replaces the filter with one of six filters. When the filter equals a preset, the button shows its name.

The applied filter is the filter parameter of the page address. A new filter returns the list to its first page. Clear filters shows when the filter has terms to clear. It keeps the time range, the columns and the sort, and it keeps probes:show if the filter had it. A link from before the filter language (with q or typed keys) is not read, and a notice says so.

Other pages

• Sessions. The bar takes every key except trace, root and probes, and no free word. A key it does not take is refused, for example "'trace' applies to traces, not to sessions." duration is the wall-clock time of the session. cost, tokens, spans, llm_errors and tool_errors are sums over the session. score.<name> reads the scores recorded on the session itself. A score on a trace does not count. A score term covers the newest 10,000 scores only, and the page says so. See Sessions.
• Agents. The bar takes every key and free word of the Traces bar. It counts agents from the traces the filter selects. It leaves probe traces out unless the filter has probes:show or a root: term that is not negated. A note under the bar says so. See Agents.

The Sessions and Agents bars have no Presets or Views menu. They suggest keys and fixed values, with no counts and no score names.

Alert rules and dashboard charts read this language too. A rule has a Filter: see Alerts. A chart has a filter, and some chart settings add limits: see Charts. To keep a filter with its columns and time range, see Saved Views.