This message was deleted.

Try converting it to a selected field using old explorer page:- This will create a materialized column for

k8s_container_name

. and then your query will look like

SELECT
  toStartOfInterval(
    fromUnixTimestamp64Nano(timestamp),
    INTERVAL 540 SECOND
  ) AS ts,
  toFloat64(count(*)) as value
from
  signoz_logs.distributed_logs
where
  (
    timestamp >= 1703385720000000000
    AND timestamp <= 1703558520000000000
  )
  AND resource_string_container_name = 'some-service' AND resource_string_container_name_exists = true
group by
  ts
order by
  value DESC

Ofcourse this may or maynot change alone increase the perf due to variables like granularity, but this is the first step and then the next step is to create clickhouse projections.

@nitya-signoz - Thanks for your inputs. Yeah we are not on the latest version. Will upgrade that. Will try the other suggestion as well.

As of now, you will have to create them manually . So if most of your queries include

severity_text and service.name

you can create a projection . Please note that this will increase perf of queries but it will also use more storage. Eg:-

alter table logs on cluster cluster add PROJECTION default_projection
    (
        SELECT *
        ORDER BY
            severity_text,
            `resource_string_service$$name`
    )

https://clickhouse.com/docs/en/sql-reference/statements/alter/projection

thanks @nitya-signoz