Firetiger Query

Firetiger Query

Firetiger stores telemetry in Apache Iceberg tables with dynamic schema inference. Run DuckDB SQL against it with the Firetiger MCP server's query tool (parameter: sql).

Quick Start

-- 1. Discover which tables exist
SHOW TABLES;

-- 2. Inspect a table's columns before querying it
DESCRIBE "opentelemetry/traces/checkout-service";

-- 3. Query it — time-filter first; add a LIMIT to bound the result
SELECT trace_id, name, end_time - start_time AS duration, start_time
FROM "opentelemetry/traces/checkout-service"
WHERE start_time >= NOW() - INTERVAL '1 hour'
ORDER BY start_time DESC
LIMIT 100;

Key gotcha: the query tool auto-injects USE "connections/iceberg-gateway", so you reference tables by their quoted name ("opentelemetry/traces/checkout-service") — you don't prefix a catalog path. There is no enforced row cap, but the tool returns every row as JSON, so always add a LIMIT (and explicit columns, not SELECT *) to avoid dumping huge nested rows.

Table naming

Tables are namespaced by signal type and service name. Names with slashes must be double-quoted. The {service_name} layout is the default shard key; a deployment can configure a different one, so always SHOW TABLES; to see the real names.

Metrics use a per-metric table with values inline — there is no series join and no opentelemetry_metrics_gauges/_series tables. There is no separate "spans" or "events" table — a span's events and links are nested LIST<STRUCT> columns inside the traces table.

Essential facts

Querying connected sources

The same query tool can also reach sources you've connected to Firetiger — and join across them in one query. Firetiger's own telemetry is the default source; other sources are addressed two ways:

• SQL sources (Postgres, MySQL, ClickHouse) — fully-qualify the table with the connection name. "connections/{name}" is a quoted identifier (it contains a /), followed by schema/database and table:

  SELECT id, email FROM "connections/prod-postgres".public.users WHERE created_at >= NOW() - INTERVAL '1 day' LIMIT 100;
  

  Prefer this to USE — it's self-contained and lets one query join across connections. (USE "connections/{name}"; is an optional shorthand that sets the default for unqualified names.)
• Observability backends (Datadog, Prometheus, GCP Monitoring) — call a function with the connection name as a string argument and the vendor's own query language:

  SELECT * FROM datadog_search_logs('connections/prod-datadog', 'status:error service:api', NOW() - INTERVAL '1 hour', NOW(), max_rows => 500);
  

Run list with resource: "connections" to see configured sources, and SELECT * FROM confit_functions(); to see which functions your connections unlock. Full patterns, PromQL/GCP examples, cross-source joins, and gotchas are in references/querying-connections.md. (Trino and Elasticsearch aren't reachable through the query tool.)

What do you need?

Common Mistakes

Related

• No data to query? Verify instrumentation with firetiger-instrument.
• Diagnosing an incident? firetiger-investigate wraps these queries in a tracked workflow.