[TraceQL] Add ability to search for parent span id

CHANGELOG.md

@@ -34,6 +34,7 @@
 * [ENHANCEMENT] update dskit to latest version[#4681](https://github.com/grafana/tempo/pull/4681) (@javiermolinar)
 * [ENHANCEMENT] Improve TraceQL perf by reverting EqualRowNumber to an inlineable function.[#4705](https://github.com/grafana/tempo/pull/4705) (@joe-elliott)
 * [ENHANCEMENT] rhythm: fair partition consumption in blockbuilders[#4655](https://github.com/grafana/tempo/pull/4655) (@javiermolinar)
+* [ENHANCEMENT] TraceQL: add support for querying by parent span id [#4692](https://github.com/grafana/tempo/pull/4692) (@ie-pham)
 * [BUGFIX] Choose a default step for a gRPC streaming query range request if none is provided. [#4546](https://github.com/grafana/tempo/pull/4576) (@joe-elliott)
   Correctly copy exemplars for metrics like `| rate()` when gRPC streaming.
 * [BUGFIX] Fix performance bottleneck and file cleanup in block builder [#4550](https://github.com/grafana/tempo/pull/4550) (@mdisibio)

docs/sources/tempo/traceql/_index.md

@@ -252,6 +252,7 @@ The following table shows the current available scoped intrinsic fields:
 | `span:name`              | string      | operation or span name                                          | `{ span:name = "HTTP POST" }`           |
 | `span:kind`              | kind enum   | kind: server, client, producer, consumer, internal, unspecified | `{ span:kind = server }`                |
 | `span:id`                | string      | span id using hex string                                        | `{ span:id = "0000000000000001" }`      |
+| `span:parentID`          | string      | parent span id using hex string                                 | `{ span:parentID = "000000000000001" }` |
 | `trace:duration`         | duration    | max(end) - min(start) time of the spans in the trace            | `{ trace:duration > 100ms }`            |
 | `trace:rootName`         | string      | if it exists, the name of the root span in the trace            | `{ trace:rootName = "HTTP GET" }`       |
 | `trace:rootService`      | string      | if it exists, the service name of the root span in the trace    | `{ trace:rootService = "gateway" }`     |

modules/ingester/instance_search.go

@@ -429,7 +429,8 @@ func (i *instance) SearchTagValuesV2(ctx context.Context, req *tempopb.SearchTag
 	if tag == traceql.IntrinsicLinkTraceIDAttribute ||
 		tag == traceql.IntrinsicLinkSpanIDAttribute ||
 		tag == traceql.IntrinsicSpanIDAttribute ||
-		tag == traceql.IntrinsicTraceIDAttribute {
+		tag == traceql.IntrinsicTraceIDAttribute ||
+		tag == traceql.IntrinsicParentIDAttribute {
 		// do not return tag values for IDs
 		return &tempopb.SearchTagValuesV2Response{}, nil
 	}

pkg/traceql/ast.go

@@ -1062,6 +1062,8 @@ func (a Attribute) impliedType() StaticType {
 		return TypeString
 	case IntrinsicSpanID:
 		return TypeString
+	case IntrinsicParentID:
+		return TypeString
 	}
 
 	return TypeAttribute

pkg/traceql/enum_attributes.go

@@ -97,6 +97,7 @@ const (
 
 	IntrinsicTraceID
 	IntrinsicSpanID
+	IntrinsicParentID
 	ScopedIntrinsicSpanStatus
 	ScopedIntrinsicSpanStatusMessage
 	ScopedIntrinsicSpanDuration
@@ -122,6 +123,7 @@ var (
 	IntrinsicStatusMessageAttribute          = NewIntrinsic(IntrinsicStatusMessage)
 	IntrinsicKindAttribute                   = NewIntrinsic(IntrinsicKind)
 	IntrinsicSpanIDAttribute                 = NewIntrinsic(IntrinsicSpanID)
+	IntrinsicParentIDAttribute               = NewIntrinsic(IntrinsicParentID)
 	IntrinsicChildCountAttribute             = NewIntrinsic(IntrinsicChildCount)
 	IntrinsicTraceIDAttribute                = NewIntrinsic(IntrinsicTraceID)
 	IntrinsicTraceRootServiceAttribute       = NewIntrinsic(IntrinsicTraceRootService)
@@ -193,6 +195,8 @@ func (i Intrinsic) String() string {
 		return "trace:duration"
 	case IntrinsicSpanID:
 		return "span:id"
+	case IntrinsicParentID:
+		return "span:parentID"
 	case IntrinsicInstrumentationName:
 		return "instrumentation:name"
 	case IntrinsicInstrumentationVersion:
@@ -248,6 +252,8 @@ func intrinsicFromString(s string) Intrinsic {
 		return IntrinsicTraceStartTime
 	case "span:id":
 		return IntrinsicSpanID
+	case "span:parentID":
+		return IntrinsicParentID
 	case "span:status":
 		return IntrinsicStatus
 	case "span:statusMessage":

pkg/traceql/expr.y

@@ -94,7 +94,7 @@ import (
                         KIND_UNSPECIFIED KIND_INTERNAL KIND_SERVER KIND_CLIENT KIND_PRODUCER KIND_CONSUMER
                         IDURATION CHILDCOUNT NAME STATUS STATUS_MESSAGE PARENT KIND ROOTNAME ROOTSERVICENAME 
                         ROOTSERVICE TRACEDURATION NESTEDSETLEFT NESTEDSETRIGHT NESTEDSETPARENT ID 
-                        TRACE_ID SPAN_ID TIMESINCESTART VERSION
+                        TRACE_ID SPAN_ID PARENT_ID TIMESINCESTART VERSION
                         PARENT_DOT RESOURCE_DOT SPAN_DOT TRACE_COLON SPAN_COLON 
                         EVENT_COLON EVENT_DOT LINK_COLON LINK_DOT INSTRUMENTATION_COLON INSTRUMENTATION_DOT
                         COUNT AVG MAX MIN SUM
@@ -412,6 +412,7 @@ scopedIntrinsicField:
   | SPAN_COLON STATUS               { $$ = NewIntrinsic(IntrinsicStatus)                 }
   | SPAN_COLON STATUS_MESSAGE       { $$ = NewIntrinsic(IntrinsicStatusMessage)          }
   | SPAN_COLON ID                   { $$ = NewIntrinsic(IntrinsicSpanID)                 }
+  | SPAN_COLON PARENT_ID            { $$ = NewIntrinsic(IntrinsicParentID)               }
 // event:             
   | EVENT_COLON NAME                { $$ = NewIntrinsic(IntrinsicEventName)              }
   | EVENT_COLON TIMESINCESTART      { $$ = NewIntrinsic(IntrinsicEventTimeSinceStart)    }