@oneuptime/common 10.8.1 → 11.0.0

package/Server/Services/IncidentService.ts

@@ -1717,8 +1717,8 @@ ${incident.remediationNotes || "No remediation notes provided."}
             if (resolvedTimeline && resolvedTimeline.startsAt) {
               const postmortemMetric: Metric = new Metric();
               postmortemMetric.projectId = projectId;
-              postmortemMetric.serviceId = incidentId;
-              postmortemMetric.serviceType = ServiceType.Incident;
+              postmortemMetric.primaryEntityId = incidentId;
+              postmortemMetric.primaryEntityType = ServiceType.Incident;
               postmortemMetric.name =
                 IncidentMetricType.PostmortemCompletionTime;
               postmortemMetric.value = OneUptimeDate.getDifferenceInSeconds(
@@ -1971,8 +1971,8 @@ ${incidentSeverity.name}
             try {
               const severityChangeMetric: Metric = new Metric();
               severityChangeMetric.projectId = projectId;
-              severityChangeMetric.serviceId = incidentId;
-              severityChangeMetric.serviceType = ServiceType.Incident;
+              severityChangeMetric.primaryEntityId = incidentId;
+              severityChangeMetric.primaryEntityType = ServiceType.Incident;
               severityChangeMetric.name = IncidentMetricType.SeverityChange;
               severityChangeMetric.value = 1;
               severityChangeMetric.attributes = {
@@ -2445,7 +2445,7 @@ ${incidentSeverity.name}
           await MetricService.deleteBy({
             query: {
               projectId: incident.projectId,
-              serviceId: incident.id,
+              primaryEntityId: incident.id,
             },
             props: {
               isRoot: true,
@@ -2719,7 +2719,7 @@ ${incidentSeverity.name}
      * ones (TimeToAcknowledge / TimeToResolve / IncidentDuration /
      * TimeInState) get rewritten with the latest state-timeline values
      * on this refresh. IncidentCount is excluded from the delete: it is
-     * a constant `value = 1` keyed by `serviceId + bucketTime` that
+     * a constant `value = 1` keyed by `primaryEntityId + bucketTime` that
      * never changes. Re-emitting it across refreshes inflated the
      * 1-minute aggregating materialized view (`MetricItemAggMV1m_mv`),
      * because the MV trigger only fires on inserts — ALTER DELETE
@@ -2731,7 +2731,7 @@ ${incidentSeverity.name}
     await MetricService.deleteBy({
       query: {
         projectId: incident.projectId,
-        serviceId: data.incidentId,
+        primaryEntityId: data.incidentId,
         name: new NotEqual<string>(IncidentMetricType.IncidentCount),
       },
       props: {
@@ -2789,7 +2789,7 @@ ${incidentSeverity.name}
 
     /*
      * Only emit IncidentCount on the very first refresh (i.e. when no
-     * existing IncidentCount row is present for this serviceId). See
+     * existing IncidentCount row is present for this primaryEntityId). See
      * the delete comment above — emitting it on every refresh would
      * accumulate phantom `sumState` entries in the MV that ALTER
      * DELETE can't undo. By keeping the original row alive and never
@@ -2799,7 +2799,7 @@ ${incidentSeverity.name}
     const incidentCountMetricExists: boolean = await MetricService.existsBy({
       query: {
         projectId: incident.projectId,
-        serviceId: data.incidentId,
+        primaryEntityId: data.incidentId,
         name: IncidentMetricType.IncidentCount,
       },
       props: {
@@ -2811,8 +2811,8 @@ ${incidentSeverity.name}
       const incidentCountMetric: Metric = new Metric();
 
       incidentCountMetric.projectId = incident.projectId;
-      incidentCountMetric.serviceId = incident.id!;
-      incidentCountMetric.serviceType = ServiceType.Incident;
+      incidentCountMetric.primaryEntityId = incident.id!;
+      incidentCountMetric.primaryEntityType = ServiceType.Incident;
       incidentCountMetric.name = IncidentMetricType.IncidentCount;
       incidentCountMetric.value = 1;
       incidentCountMetric.attributes = { ...baseMetricAttributes };
@@ -2856,8 +2856,8 @@ ${incidentSeverity.name}
         const timeToAcknowledgeMetric: Metric = new Metric();
 
         timeToAcknowledgeMetric.projectId = incident.projectId;
-        timeToAcknowledgeMetric.serviceId = incident.id!;
-        timeToAcknowledgeMetric.serviceType = ServiceType.Incident;
+        timeToAcknowledgeMetric.primaryEntityId = incident.id!;
+        timeToAcknowledgeMetric.primaryEntityType = ServiceType.Incident;
         timeToAcknowledgeMetric.name = IncidentMetricType.TimeToAcknowledge;
         timeToAcknowledgeMetric.value = OneUptimeDate.getDifferenceInSeconds(
           ackIncidentStateTimeline?.startsAt || OneUptimeDate.getCurrentDate(),
@@ -2909,8 +2909,8 @@ ${incidentSeverity.name}
         const timeToResolveMetric: Metric = new Metric();
 
         timeToResolveMetric.projectId = incident.projectId;
-        timeToResolveMetric.serviceId = incident.id!;
-        timeToResolveMetric.serviceType = ServiceType.Incident;
+        timeToResolveMetric.primaryEntityId = incident.id!;
+        timeToResolveMetric.primaryEntityType = ServiceType.Incident;
         timeToResolveMetric.name = IncidentMetricType.TimeToResolve;
         timeToResolveMetric.value = OneUptimeDate.getDifferenceInSeconds(
           resolvedIncidentStateTimeline?.startsAt ||
@@ -2959,8 +2959,8 @@ ${incidentSeverity.name}
       // save metric.
 
       incidentDurationMetric.projectId = incident.projectId;
-      incidentDurationMetric.serviceId = incident.id!;
-      incidentDurationMetric.serviceType = ServiceType.Incident;
+      incidentDurationMetric.primaryEntityId = incident.id!;
+      incidentDurationMetric.primaryEntityType = ServiceType.Incident;
       incidentDurationMetric.name = IncidentMetricType.IncidentDuration;
       incidentDurationMetric.value = OneUptimeDate.getDifferenceInSeconds(
         incidentEndsAt,
@@ -3006,8 +3006,8 @@ ${incidentSeverity.name}
       const timeInStateMetric: Metric = new Metric();
 
       timeInStateMetric.projectId = incident.projectId;
-      timeInStateMetric.serviceId = incident.id!;
-      timeInStateMetric.serviceType = ServiceType.Incident;
+      timeInStateMetric.primaryEntityId = incident.id!;
+      timeInStateMetric.primaryEntityType = ServiceType.Incident;
       timeInStateMetric.name = IncidentMetricType.TimeInState;
       timeInStateMetric.value = OneUptimeDate.getDifferenceInSeconds(
         timeline.endsAt,

package/Server/Services/Index.ts

@@ -41,7 +41,7 @@ import LogService from "./LogService";
 import MailService from "./MailService";
 import MetricService from "./MetricService";
 import MetricItemAggMV1mService from "./MetricItemAggMV1mService";
-import MetricItemAggMV1mByHostService from "./MetricItemAggMV1mByHostService";
+import MetricItemAggMV1mByHostV2Service from "./MetricItemAggMV1mByHostV2Service";
 import MetricBaselineService from "./MetricBaselineService";
 import MonitorCustomFieldService from "./MonitorCustomFieldService";
 import MonitorGroupOwnerTeamService from "./MonitorGroupOwnerTeamService";
@@ -161,6 +161,8 @@ import WorkflowService from "./WorkflowService";
 import WorkflowVariablesService from "./WorkflowVariableService";
 import AnalyticsBaseModel from "../../Models/AnalyticsModels/AnalyticsBaseModel/AnalyticsBaseModel";
 import TelemetryExceptionService from "./TelemetryExceptionService";
+import TelemetryEntityService from "./TelemetryEntityService";
+import TelemetryEntityRelationshipService from "./TelemetryEntityRelationshipService";
 import ExceptionInstanceService from "./ExceptionInstanceService";
 import ScheduledMaintenanceTemplateService from "./ScheduledMaintenanceTemplateService";
 import ScheduledMaintenanceTemplateOwnerTeamService from "./ScheduledMaintenanceTemplateOwnerTeamService";
@@ -389,6 +391,8 @@ const services: Array<BaseService> = [
   ServiceCodeRepositoryService,
 
   TelemetryExceptionService,
+  TelemetryEntityService,
+  TelemetryEntityRelationshipService,
 
   // scheduled maintenance templates
   ScheduledMaintenanceTemplateService,
@@ -455,7 +459,7 @@ export const AnalyticsServices: Array<
    * DataMigrations that also create them. Both kept for backward compat.
    */
   MetricItemAggMV1mService,
-  MetricItemAggMV1mByHostService,
+  MetricItemAggMV1mByHostV2Service,
   MetricBaselineService,
   ExceptionInstanceService,
   MonitorLogService,

package/Server/Services/LogAggregationService.ts

@@ -1,4 +1,5 @@
 import { SQL, Statement } from "../Utils/AnalyticsDatabase/Statement";
+import { getQuerySettings } from "../Utils/AnalyticsDatabase/QuerySettingsHelper";
 import LogDatabaseService from "./LogService";
 import TableColumnType from "../../Types/AnalyticsDatabase/TableColumnType";
 import { JSONObject } from "../../Types/JSON";
@@ -22,6 +23,7 @@ export interface HistogramRequest {
   endTime: Date;
   bucketSizeInMinutes: number;
   serviceIds?: Array<ObjectID> | undefined;
+  entityKeys?: Array<string> | undefined;
   severityTexts?: Array<string> | undefined;
   bodySearchText?: string | undefined;
   traceIds?: Array<string> | undefined;
@@ -42,6 +44,7 @@ export interface FacetRequest {
   facetKey: string;
   limit?: number | undefined;
   serviceIds?: Array<ObjectID> | undefined;
+  entityKeys?: Array<string> | undefined;
   severityTexts?: Array<string> | undefined;
   bodySearchText?: string | undefined;
   traceIds?: Array<string> | undefined;
@@ -90,16 +93,17 @@ export class LogAggregationService {
   private static readonly TABLE_NAME: string = AnalyticsTableName.Log;
   private static readonly TOP_LEVEL_COLUMNS: Set<string> = new Set([
     "severityText",
-    "serviceId",
+    "primaryEntityId",
     "traceId",
     "spanId",
   ]);
   /*
    * Virtual facet keys that don't correspond to real ClickHouse columns —
-   * they all read out of `serviceId` filtered by `serviceType`. The
-   * discriminator was added so host / docker host / k8s cluster telemetry
-   * could reuse the `serviceId` slot instead of synthesising phantom
-   * Service rows; these facets surface each resource type independently.
+   * they all read out of `primaryEntityId` filtered by `primaryEntityType`.
+   * The discriminator was added so host / docker host / k8s cluster
+   * telemetry could reuse the `primaryEntityId` slot instead of synthesising
+   * phantom Service rows; these facets surface each resource type
+   * independently.
    */
   private static readonly RESOURCE_FACET_KEYS: Map<string, ServiceType> =
     new Map([
@@ -112,6 +116,18 @@ export class LogAggregationService {
     ]);
   private static readonly ATTRIBUTE_KEY_PATTERN: RegExp = /^[a-zA-Z0-9._:/-]+$/;
   private static readonly MAX_FACET_KEY_LENGTH: number = 256;
+  /*
+   * Read-side retention filter (mirrors
+   * AnalyticsDatabaseService.getRetentionReadFilter): rows past their
+   * per-service retention stay queryable until their whole part drops
+   * (ttl_only_drop_parts), so raw-table reads exclude them explicitly.
+   * Deliberately NOT applied to projection-shaped queries (the severity
+   * histogram): an aggregate projection cannot evaluate a predicate on a
+   * column it does not store, so adding it would silently force a full
+   * base-table scan.
+   */
+  private static readonly RETENTION_FILTER: string =
+    " AND retentionDate >= now()";
 
   @CaptureSpan()
   public static async getHistogram(
@@ -178,9 +194,9 @@ export class LogAggregationService {
      * consistent with the minute-bucketed output and only shifts the first/last
      * bucket by the partial boundary minute when the range is not minute-aligned.
      *
-     * A non-projection filter (serviceId, traceId, spanId, attributes) makes
-     * the inner query transparently fall back to a base-table scan — same cost
-     * as before, still correct.
+     * A non-projection filter (primaryEntityId, entityKeys, traceId, spanId,
+     * attributes) makes the inner query transparently fall back to a
+     * base-table scan — same cost as before, still correct.
      */
     const statement: Statement = SQL`
       SELECT
@@ -223,13 +239,22 @@ export class LogAggregationService {
      * Explicitly enable projection use.
      */
     statement.append(
-      " SETTINGS max_execution_time = 45, timeout_overflow_mode = 'break', optimize_use_projections = 1",
+      getQuerySettings({
+        maxExecutionTimeInSeconds: 45,
+        timeoutOverflowMode: "break",
+        additionalSettings: { optimize_use_projections: 1 },
+      }),
     );
 
     return statement;
   }
 
   private static buildFacetStatement(request: FacetRequest): Statement {
+    // Pre-rename alias from stale clients; the V3 column is primaryEntityId.
+    if (request.facetKey === "serviceId") {
+      request.facetKey = "primaryEntityId";
+    }
+
     const limit: number =
       request.limit ?? LogAggregationService.DEFAULT_FACET_LIMIT;
 
@@ -246,23 +271,24 @@ export class LogAggregationService {
 
     if (isResourceFacet) {
       /*
-       * Virtual facet — group serviceId values whose row carries the
+       * Virtual facet — group primaryEntityId values whose row carries the
        * matching ServiceType discriminator (Host / DockerHost /
        * KubernetesCluster).
        */
       statement.append(
-        SQL`SELECT toString(serviceId) AS val, count() AS cnt FROM ${LogAggregationService.TABLE_NAME}`,
+        SQL`SELECT toString(primaryEntityId) AS val, count() AS cnt FROM ${LogAggregationService.TABLE_NAME}`,
       );
     } else if (isTopLevelColumn) {
       statement.append(
         SQL`SELECT toString(${request.facetKey}) AS val, count() AS cnt FROM ${LogAggregationService.TABLE_NAME}`,
       );
     } else {
+      // attributes is Map(String, String) — subscript access, not JSON functions.
       statement.append(
-        SQL`SELECT JSONExtractRaw(attributes, ${{
+        SQL`SELECT attributes[${{
           type: TableColumnType.Text,
           value: request.facetKey,
-        }}) AS val, count() AS cnt FROM ${LogAggregationService.TABLE_NAME}`,
+        }}] AS val, count() AS cnt FROM ${LogAggregationService.TABLE_NAME}`,
       );
     }
 
@@ -281,32 +307,34 @@ export class LogAggregationService {
 
     if (isResourceFacet) {
       statement.append(
-        SQL` AND serviceType = ${{
+        SQL` AND primaryEntityType = ${{
           type: TableColumnType.Text,
           value: resourceServiceType as string,
         }}`,
       );
-    } else if (request.facetKey === "serviceId") {
+    } else if (request.facetKey === "primaryEntityId") {
       /*
        * Constrain the canonical Services facet to rows that actually
-       * belong to a Service. NULL / empty serviceType covers legacy
+       * belong to a Service. NULL / empty primaryEntityType covers legacy
        * rows ingested before the discriminator existed.
        */
       statement.append(
-        SQL` AND (serviceType = '' OR serviceType = ${{
+        SQL` AND (primaryEntityType = '' OR primaryEntityType = ${{
           type: TableColumnType.Text,
           value: ServiceType.OpenTelemetry as string,
         }})`,
       );
     } else if (!isTopLevelColumn) {
       statement.append(
-        SQL` AND JSONHas(attributes, ${{
+        SQL` AND mapContains(attributes, ${{
           type: TableColumnType.Text,
           value: request.facetKey,
-        }}) = 1`,
+        }})`,
       );
     }
 
+    statement.append(LogAggregationService.RETENTION_FILTER);
+
     LogAggregationService.appendCommonFilters(statement, request);
 
     statement.append(
@@ -321,7 +349,10 @@ export class LogAggregationService {
      * 60s proxy_read_timeout so a slow facet never starves the endpoint.
      */
     statement.append(
-      " SETTINGS max_execution_time = 45, timeout_overflow_mode = 'break'",
+      getQuerySettings({
+        maxExecutionTimeInSeconds: 45,
+        timeoutOverflowMode: "break",
+      }),
     );
 
     return statement;
@@ -450,10 +481,10 @@ export class LogAggregationService {
       } else {
         const alias: string = LogAggregationService.groupByAlias(key);
         statement.append(
-          SQL`, JSONExtractRaw(attributes, ${{
+          SQL`, attributes[${{
             type: TableColumnType.Text,
             value: key,
-          }}) AS ${alias}`,
+          }}] AS ${alias}`,
         );
       }
     }
@@ -481,7 +512,7 @@ export class LogAggregationService {
         return `uniqExact(${request.aggregationField})`;
       }
 
-      return `uniqExact(JSONExtractRaw(attributes, '${request.aggregationField.replace(/'/g, "\\'")}'))`;
+      return `uniqExact(attributes['${request.aggregationField.replace(/'/g, "\\'")}'])`;
     }
 
     return "count()";
@@ -542,6 +573,8 @@ export class LogAggregationService {
         }}`,
     );
 
+    statement.append(LogAggregationService.RETENTION_FILTER);
+
     LogAggregationService.appendCommonFilters(statement, request);
 
     statement.append(" GROUP BY bucket");
@@ -558,7 +591,10 @@ export class LogAggregationService {
      * aggregated results rather than holding a pool connection.
      */
     statement.append(
-      " SETTINGS max_execution_time = 45, timeout_overflow_mode = 'break'",
+      getQuerySettings({
+        maxExecutionTimeInSeconds: 45,
+        timeoutOverflowMode: "break",
+      }),
     );
 
     return statement;
@@ -585,7 +621,7 @@ export class LogAggregationService {
         `SELECT toString(${groupByKey}) AS val, ${aggExpr} AS cnt FROM ${LogAggregationService.TABLE_NAME}`,
       );
     } else {
-      statement.append(`SELECT JSONExtractRaw(attributes, `);
+      statement.append(`SELECT attributes[`);
       statement.append(
         SQL`${{
           type: TableColumnType.Text,
@@ -593,7 +629,7 @@ export class LogAggregationService {
         }}`,
       );
       statement.append(
-        `) AS val, ${aggExpr} AS cnt FROM ${LogAggregationService.TABLE_NAME}`,
+        `] AS val, ${aggExpr} AS cnt FROM ${LogAggregationService.TABLE_NAME}`,
       );
     }
 
@@ -612,13 +648,15 @@ export class LogAggregationService {
 
     if (!isTopLevel) {
       statement.append(
-        SQL` AND JSONHas(attributes, ${{
+        SQL` AND mapContains(attributes, ${{
           type: TableColumnType.Text,
           value: groupByKey,
-        }}) = 1`,
+        }})`,
       );
     }
 
+    statement.append(LogAggregationService.RETENTION_FILTER);
+
     LogAggregationService.appendCommonFilters(statement, request);
 
     statement.append(
@@ -633,7 +671,10 @@ export class LogAggregationService {
      * partial results (matches the histogram / facet paths).
      */
     statement.append(
-      " SETTINGS max_execution_time = 45, timeout_overflow_mode = 'break'",
+      getQuerySettings({
+        maxExecutionTimeInSeconds: 45,
+        timeoutOverflowMode: "break",
+      }),
     );
 
     return statement;
@@ -672,6 +713,8 @@ export class LogAggregationService {
         }}`,
     );
 
+    statement.append(LogAggregationService.RETENTION_FILTER);
+
     LogAggregationService.appendCommonFilters(statement, request);
 
     // Build GROUP BY from aliases
@@ -697,7 +740,10 @@ export class LogAggregationService {
      * partial results (matches the histogram / facet paths).
      */
     statement.append(
-      " SETTINGS max_execution_time = 45, timeout_overflow_mode = 'break'",
+      getQuerySettings({
+        maxExecutionTimeInSeconds: 45,
+        timeoutOverflowMode: "break",
+      }),
     );
 
     return statement;
@@ -708,6 +754,7 @@ export class LogAggregationService {
     request: Pick<
       HistogramRequest,
       | "serviceIds"
+      | "entityKeys"
       | "severityTexts"
       | "bodySearchText"
       | "traceIds"
@@ -717,7 +764,7 @@ export class LogAggregationService {
   ): void {
     if (request.serviceIds && request.serviceIds.length > 0) {
       statement.append(
-        SQL` AND serviceId IN (${{
+        SQL` AND primaryEntityId IN (${{
           type: TableColumnType.ObjectID,
           value: new Includes(
             request.serviceIds.map((id: ObjectID) => {
@@ -728,6 +775,15 @@ export class LogAggregationService {
       );
     }
 
+    if (request.entityKeys && request.entityKeys.length > 0) {
+      statement.append(
+        SQL` AND hasAny(entityKeys, ${{
+          type: TableColumnType.ArrayText,
+          value: request.entityKeys,
+        }})`,
+      );
+    }
+
     if (request.severityTexts && request.severityTexts.length > 0) {
       statement.append(
         SQL` AND severityText IN (${{
@@ -757,7 +813,7 @@ export class LogAggregationService {
 
     if (request.bodySearchText && request.bodySearchText.trim().length > 0) {
       statement.append(
-        ` AND body ILIKE ${{
+        SQL` AND body ILIKE ${{
           type: TableColumnType.Text,
           value: `%${request.bodySearchText.trim()}%`,
         }}`,
@@ -806,7 +862,7 @@ export class LogAggregationService {
     const statement: Statement = SQL`
       SELECT
         time,
-        serviceId,
+        primaryEntityId,
         severityText,
         severityNumber,
         body,
@@ -828,6 +884,8 @@ export class LogAggregationService {
         }}
     `;
 
+    statement.append(LogAggregationService.RETENTION_FILTER);
+
     LogAggregationService.appendCommonFilters(statement, request);
 
     statement.append(
@@ -842,7 +900,10 @@ export class LogAggregationService {
      * partial rows rather than holding a pool connection on a large export.
      */
     statement.append(
-      " SETTINGS max_execution_time = 45, timeout_overflow_mode = 'break'",
+      getQuerySettings({
+        maxExecutionTimeInSeconds: 45,
+        timeoutOverflowMode: "break",
+      }),
     );
 
     const dbResult: Results = await LogDatabaseService.executeQuery(statement);
@@ -856,7 +917,7 @@ export class LogAggregationService {
   @CaptureSpan()
   public static async getLogContext(request: {
     projectId: ObjectID;
-    serviceId: ObjectID;
+    primaryEntityId: ObjectID;
     time: Date;
     logId: string;
     count: number;
@@ -868,7 +929,7 @@ export class LogAggregationService {
         _id,
         time,
         timeUnixNano,
-        serviceId,
+        primaryEntityId,
         severityText,
         severityNumber,
         body,
@@ -880,9 +941,9 @@ export class LogAggregationService {
         type: TableColumnType.ObjectID,
         value: request.projectId,
       }}
-        AND serviceId = ${{
+        AND primaryEntityId = ${{
           type: TableColumnType.ObjectID,
-          value: request.serviceId,
+          value: request.primaryEntityId,
         }}
         AND time <= ${{
           type: TableColumnType.Date,
@@ -892,6 +953,7 @@ export class LogAggregationService {
           type: TableColumnType.Text,
           value: request.logId,
         }}
+        AND retentionDate >= now()
       ORDER BY time DESC, timeUnixNano DESC
       LIMIT ${{
         type: TableColumnType.Number,
@@ -904,7 +966,7 @@ export class LogAggregationService {
         _id,
         time,
         timeUnixNano,
-        serviceId,
+        primaryEntityId,
         severityText,
         severityNumber,
         body,
@@ -916,9 +978,9 @@ export class LogAggregationService {
         type: TableColumnType.ObjectID,
         value: request.projectId,
       }}
-        AND serviceId = ${{
+        AND primaryEntityId = ${{
           type: TableColumnType.ObjectID,
-          value: request.serviceId,
+          value: request.primaryEntityId,
         }}
         AND time >= ${{
           type: TableColumnType.Date,
@@ -928,6 +990,7 @@ export class LogAggregationService {
           type: TableColumnType.Text,
           value: request.logId,
         }}
+        AND retentionDate >= now()
       ORDER BY time ASC, timeUnixNano ASC
       LIMIT ${{
         type: TableColumnType.Number,
@@ -985,6 +1048,8 @@ export class LogAggregationService {
         }}
     `;
 
+    totalStatement.append(LogAggregationService.RETENTION_FILTER);
+
     LogAggregationService.appendCommonFilters(totalStatement, request);
 
     /*
@@ -992,7 +1057,10 @@ export class LogAggregationService {
      * returns a partial (lower-bound) count, acceptable for an estimate.
      */
     totalStatement.append(
-      " SETTINGS max_execution_time = 45, timeout_overflow_mode = 'break'",
+      getQuerySettings({
+        maxExecutionTimeInSeconds: 45,
+        timeoutOverflowMode: "break",
+      }),
     );
 
     // Get matching count using the filter query as body search
@@ -1013,6 +1081,8 @@ export class LogAggregationService {
         }}
     `;
 
+    matchStatement.append(LogAggregationService.RETENTION_FILTER);
+
     LogAggregationService.appendCommonFilters(matchStatement, {
       ...request,
       bodySearchText: request.filterQuery,
@@ -1023,7 +1093,10 @@ export class LogAggregationService {
      * returns a partial (lower-bound) count, acceptable for an estimate.
      */
     matchStatement.append(
-      " SETTINGS max_execution_time = 45, timeout_overflow_mode = 'break'",
+      getQuerySettings({
+        maxExecutionTimeInSeconds: 45,
+        timeoutOverflowMode: "break",
+      }),
     );
 
     const [totalResult, matchResult] = await Promise.all([