[BUG] query_source embeds the user's output style, so exact-match filters silently match nothing
What's Wrong?
query_source on api_request is not repl_main_thread. The real value is:
repl_main_thread:outputStyle:Concise
So @query_source:repl_main_thread matches zero events. No error, the query stays valid, it just
matches nothing. That emptied two of our dashboard widgets and a notebook query for an unknown period
before anyone noticed, because a silently-empty widget looks the same as one waiting for data.
The suffix also carries a display preference the developer chose, so no single value is correct across
a fleet. A filter that works for one person fails for anyone on a different output style. A prefix
wildcard (repl_main_thread*) is the only form that holds, which is not obvious from the docs.
The field mixes two unrelated facts: where the request came from (main thread, subagent, compaction,
summary) and how the user configured output.
query_source is also missing entirely from roughly half of api_request events, 2351 of 4709 over
30 days in our data. That limits it as a filter even with a wildcard.
What Should Happen?
query_source should carry the request origin only. Output style belongs in its own attribute, if it
is worth exporting at all. The values that already look like true origins work well:agent:builtin:Plan, agent:builtin:Explore, compact, away_summary, agent_summary,prompt_suggestion, sdk, web_search_tool.
If the combined form is deliberate, documenting the shape would let people write a prefix match from
the start instead of discovering it after their dashboards have been quietly empty.
Steps to Reproduce
- Enable OTLP log export and set an output style. Ours is Concise.
- Query
api_requestevents and inspectquery_source. - Filter
@query_source:repl_main_thread. Zero results. Filter@query_source:repl_main_thread*.
Results appear.
Environment
Claude Code 2.1.259. macOS darwin 25.6.0 arm64. OTLP gRPC to otelcol-contrib 0.160.0, viewed in
Datadog.