Fields "filter for value" does not work in the "Logs" type panel.

[dezzzm]

What happened:

If I want get logs in grafana panel "Logs" with datasource type "clickhouse", I get sql query and its worked.

SELECT Timestamp as "timestamp", Body as "body", SeverityText as "level", LogAttributes as "labels", TraceId as "traceID" FROM "otel"."otel_logs" WHERE ( timestamp >= toDateTime(1739774208) AND timestamp <= toDateTime(1739776008) ) ORDER BY timestamp DESC LIMIT 10

If I want to select some filter by fields in grafana panel "Logs" with datasource type "clickhouse"

i get sql query:

SELECT Timestamp as "timestamp", Body as "body", SeverityText as "level", LogAttributes as "labels", TraceId as "traceID" FROM "otel"."otel_logs" LIMIT 1000 settings additional_table_filters={'otel.otel_logs' : ' container = \'busybox\' '}

and error (probably the sql query is not valid).

Error example: "Status: 500. Message: error querying the database: code: 47, message: Unknown expression or function identifier 'container' in scope container = 'busybox'"

I check this SQL query in clickhouse and its not valid too.

Valid SQL query:

SELECT Timestamp as "timestamp", Body as "body", SeverityText as "level", LogAttributes as "labels", TraceId as "traceID" FROM "otel"."otel_logs" LIMIT 1000 settings additional_table_filters={'otel.otel_logs' : 'LogAttributes[\'container\'] = \'busybox\' '}

or better

SELECT Timestamp as "timestamp", Body as "body", SeverityText as "level", LogAttributes as "labels", TraceId as "traceID" FROM "otel"."otel_logs" LIMIT 1000 
settings additional_result_filter=' labels[\'container\'] = \'busybox\' '

It looks like this SQL query is generated here. Is it possible to fix this behavior please?

https://github.com/grafana/clickhouse-datasource/blob/main/src/data/adHocFilter.ts#L53

What you expected to happen:

I expected the logs to be filtered according to the selected filter as it works in "datasource">"Explore"

SELECT Timestamp as "timestamp", Body as "body", SeverityText as "level", LogAttributes as "labels", TraceId as "traceID" FROM "otel"."otel_logs" WHERE ( timestamp >= $__fromTime AND timestamp <= $__toTime ) AND ( labels['container'] = 'busybox' ) ORDER BY timestamp DESC LIMIT 10

How to reproduce it (as minimally and precisely as possible):

1. Create panel with type "Logs" and datasource "clickhouse" with configuration for logs:
   Logs configuration
   Default log database: otel
   Default log table: otel_logs
   Default columns:
   Use OTel: latest (1.2.9)
   Time column: Timestamp
   Log Level column: SeverityText
   Log Message column: Body

2. View logs

3. Expand any log line

4. Select any "Filter for value" or "Filter out value" in Fields

5. View error

Screenshots

Anything else we need to know?:

Environment:

Grafana version: v11.2.4
Plugin version: 4.8.0
OS Grafana is installed on: Ubuntu
User OS & Browser: chrome

[SpencerTorres]

Adhoc filters are always trouble to workaround since it often depends on parsing the SQL into an AST. In this case it's tougher because we have to first identify the column that it came from in the labels. This might be fixable, but perhaps there's another workaround.

In the past I've changed the name of the map keys to from a to MyMap['a'] so that it would automatically fix this in the UI