Looking to get some feedback on my observations on querying for o11y and if this resonates with more folks here
I feel that current observability tooling significantly lags behind user expectations by failing to support a critical capability: querying across different telemetry signals.
This limitation turns what should be powerful correlation capabilities into mere “correlation theater”, a superficial simulation of insights rather than true analytical power.
Here’s the current gaps I see
1/ Suppose I want to retrieve logs from the host which have the highest CPU in the last 13 minutes. It’s not possible to query this seamlessly today unless you query the metrics first and paste the results into logs query builder and retrieve your results. Seamless correlation across signal querying is nearly impossible today.
2/ COUNT distinct on multiple columns is not possible today. Most platforms let you perform a count distinct on one col, say count unique of source OR count unique of host OR count unique of service etc. Adding multiple dimensions and drilling down deeper into this is also a serious pain-point.
and some points on how we at SigNoz are thinking these gaps can be addressed,
1/ Sub-query support: The ability to use the results of one query as input to another, mainly for getting filtered output
2/ Cross-signal joins: Support for joining data across different telemetry signals, for seeing signals side-by-side along with a couple of more stuff.
Early thoughts in this blog[1], what do you think? does it resonate or seems like a use case not many ppl have?
[0] https://github.com/signoz/signoz [1] https://signoz.io/blog/observability-requires-querying-across-signals/