@oneuptime/common 10.8.2 → 11.0.1

package/Tests/Utils/Telemetry/EntityKey.test.ts

@@ -0,0 +1,150 @@
+import {
+  canonicalizeEntityValue,
+  computeEntityKey,
+  keyForService,
+  setSha256Provider,
+} from "../../../Utils/Telemetry/EntityKey";
+import Crypto from "../../../Utils/Crypto";
+import EntityType from "../../../Types/Telemetry/EntityType";
+import { describe, expect, test } from "@jest/globals";
+import { createHash } from "crypto";
+import CryptoJS from "crypto-js";
+
+const PROJECT: string = "proj1";
+
+describe("canonicalizeEntityValue", () => {
+  test("trims and lowercases", () => {
+    expect(canonicalizeEntityValue("  Web-1 ")).toBe("web-1");
+    expect(canonicalizeEntityValue("PRIMARY01")).toBe("primary01");
+  });
+
+  test("undefined coerces to empty string", () => {
+    expect(canonicalizeEntityValue(undefined)).toBe("");
+  });
+});
+
+describe("computeEntityKey — preimage escaping", () => {
+  test("values containing separators do not collide with structurally different identity sets", () => {
+    /*
+     * Without escaping, both would build the preimage
+     * `proj1|service|service.name=a|service.namespace=b`.
+     */
+    const smuggled: string = computeEntityKey({
+      projectId: PROJECT,
+      entityType: EntityType.Service,
+      identifyingAttributes: { "service.name": "a|service.namespace=b" },
+    });
+    const split: string = computeEntityKey({
+      projectId: PROJECT,
+      entityType: EntityType.Service,
+      identifyingAttributes: {
+        "service.name": "a",
+        "service.namespace": "b",
+      },
+    });
+    expect(smuggled).not.toBe(split);
+  });
+
+  test("the escape character itself is escaped (no backslash smuggling)", () => {
+    /*
+     * A literal backslash in a value must be doubled in the preimage, so a
+     * trailing backslash cannot masquerade as an escape of the following
+     * separator.
+     */
+    const trailingBackslash: string = computeEntityKey({
+      projectId: PROJECT,
+      entityType: EntityType.Service,
+      identifyingAttributes: { a: "x\\", b: "y" },
+    });
+    expect(trailingBackslash).toBe(
+      createHash("sha256")
+        .update("proj1|service|a=x\\\\|b=y")
+        .digest("hex")
+        .slice(0, 16),
+    );
+    const literalSeparators: string = computeEntityKey({
+      projectId: PROJECT,
+      entityType: EntityType.Service,
+      identifyingAttributes: { a: "x\\|b=y" },
+    });
+    expect(trailingBackslash).not.toBe(literalSeparators);
+  });
+
+  test("normal values keep the historical preimage (already-stamped keys unchanged)", () => {
+    const key: string = computeEntityKey({
+      projectId: PROJECT,
+      entityType: EntityType.Service,
+      identifyingAttributes: { "service.name": "checkout" },
+    });
+    // Unescaped preimage, exactly as stamped before escaping existed.
+    const historical: string = createHash("sha256")
+      .update("proj1|service|service.name=checkout")
+      .digest("hex")
+      .slice(0, 16);
+    expect(key).toBe(historical);
+    /*
+     * Pinned so any preimage drift (separator, ordering, hash, slice
+     * length) fails loudly — this exact key is stamped in ClickHouse rows.
+     */
+    expect(key).toBe("904989abd67aec3f");
+    expect(keyForService(PROJECT, "checkout")).toBe("904989abd67aec3f");
+  });
+});
+
+describe("sha256 provider injection", () => {
+  test("node:crypto and crypto-js produce identical hex for the same input", () => {
+    const inputs: Array<string> = [
+      "proj1|service|service.name=checkout",
+      "projB|k8s.cluster|k8s.cluster.name=prod-us",
+      "p|host|host.name=ünïcode-höst",
+    ];
+    for (const input of inputs) {
+      expect(CryptoJS.SHA256(input).toString()).toBe(
+        createHash("sha256").update(input).digest("hex"),
+      );
+    }
+  });
+
+  test("setSha256Provider is honored by computeEntityKey", () => {
+    try {
+      setSha256Provider(() => {
+        return "f".repeat(64);
+      });
+      expect(
+        computeEntityKey({
+          projectId: PROJECT,
+          entityType: EntityType.Host,
+          identifyingAttributes: { "host.name": "web-1" },
+        }),
+      ).toBe("f".repeat(16));
+    } finally {
+      setSha256Provider((input: string) => {
+        return Crypto.getSha256Hash(input);
+      });
+    }
+  });
+
+  test("swapping in the node:crypto provider does not change keys", () => {
+    const before: string = computeEntityKey({
+      projectId: PROJECT,
+      entityType: EntityType.Host,
+      identifyingAttributes: { "host.name": "web-1" },
+    });
+    try {
+      setSha256Provider((input: string) => {
+        return createHash("sha256").update(input).digest("hex");
+      });
+      expect(
+        computeEntityKey({
+          projectId: PROJECT,
+          entityType: EntityType.Host,
+          identifyingAttributes: { "host.name": "web-1" },
+        }),
+      ).toBe(before);
+    } finally {
+      setSha256Provider((input: string) => {
+        return Crypto.getSha256Hash(input);
+      });
+    }
+  });
+});

package/Tests/Utils/Telemetry/EntityKeySqlParity.test.ts

@@ -0,0 +1,40 @@
+import { keyForHost } from "../../../Utils/Telemetry/EntityKey";
+import { describe, expect, test } from "@jest/globals";
+
+/*
+ * Pins keyForHost against the ClickHouse SQL formula used by the
+ * RekeyMetricHostRollupToEntityKey migration to backfill
+ * MetricItemAggMV1mByHostV2 from the old hostIdentifier-keyed rollup:
+ *
+ *   substring(lower(hex(SHA256(concat(
+ *     projectId, '|host|host.name=', lower(trimBoth(hostIdentifier))
+ *   )))), 1, 16)
+ *
+ * The expected values below are the literal outputs of that SQL run on a
+ * live ClickHouse (25.7) — if keyForHost's canonicalization, preimage
+ * layout, hash, or slice length ever drifts, this fails loudly and the
+ * backfilled rollup rows stop matching ingest-stamped hostEntityKeys.
+ *
+ * (Hostnames containing '\\', '|' or '=' are escaped by keyForHost but
+ * not by the SQL — a documented, vanishingly-rare caveat of the backfill,
+ * deliberately not pinned here.)
+ */
+describe("keyForHost — parity with the migration's SQL key computation", () => {
+  test("matches ClickHouse-computed keys for representative hostnames", () => {
+    // [projectId, raw hostIdentifier, SQL-computed key from live ClickHouse]
+    const vectors: Array<[string, string, string]> = [
+      // Mixed case + trailing whitespace exercise canonicalization.
+      ["proj-123", "Web-Server-01 ", "dba90fb9cca1242e"],
+      [
+        "8f3c2a1e-0000-4a4a-9c9c-aabbccddeeff",
+        "ip-10-0-1-23.ec2.internal",
+        "7f5d90eeeeb0b48b",
+      ],
+      ["proj-xyz", "NODE.example.COM", "8825a6c0687b16d9"],
+    ];
+
+    for (const [projectId, hostIdentifier, sqlKey] of vectors) {
+      expect(keyForHost(projectId, hostIdentifier)).toBe(sqlKey);
+    }
+  });
+});

package/Tests/Utils/Telemetry/EntityRelationship.test.ts

@@ -0,0 +1,150 @@
+import {
+  EntityRelationshipEdge,
+  deriveRelationships,
+  inferRelationshipType,
+} from "../../../Utils/Telemetry/EntityRelationship";
+import EntityRelationshipType from "../../../Types/Telemetry/EntityRelationshipType";
+import EntityType from "../../../Types/Telemetry/EntityType";
+import { describe, expect, test } from "@jest/globals";
+
+describe("inferRelationshipType", () => {
+  test("infers documented directed relationships", () => {
+    expect(
+      inferRelationshipType(
+        EntityType.KubernetesPod,
+        EntityType.KubernetesNode,
+      ),
+    ).toBe(EntityRelationshipType.RunsOn);
+    expect(
+      inferRelationshipType(
+        EntityType.KubernetesPod,
+        EntityType.KubernetesCluster,
+      ),
+    ).toBe(EntityRelationshipType.MemberOf);
+    expect(inferRelationshipType(EntityType.Service, EntityType.Host)).toBe(
+      EntityRelationshipType.HostedOn,
+    );
+    expect(
+      inferRelationshipType(EntityType.Container, EntityType.KubernetesPod),
+    ).toBe(EntityRelationshipType.PartOf);
+    expect(
+      inferRelationshipType(EntityType.ServiceInstance, EntityType.Service),
+    ).toBe(EntityRelationshipType.InstanceOf);
+  });
+
+  test("is directional (the reverse pair yields nothing)", () => {
+    expect(
+      inferRelationshipType(
+        EntityType.KubernetesNode,
+        EntityType.KubernetesPod,
+      ),
+    ).toBeNull();
+    expect(
+      inferRelationshipType(EntityType.Host, EntityType.Service),
+    ).toBeNull();
+  });
+
+  test("unrelated or self type pairs yield null", () => {
+    expect(
+      inferRelationshipType(EntityType.TelemetrySdk, EntityType.Host),
+    ).toBeNull();
+    expect(
+      inferRelationshipType(EntityType.Service, EntityType.Service),
+    ).toBeNull();
+  });
+
+  test("depends-on is never inferred from co-occurrence (span-derived only)", () => {
+    /*
+     * Service → service dependency edges come from cross-service
+     * parent/child span pairs (the ComputeServiceDependencies cron) —
+     * a caller and its callee never share one resource, so no ordered
+     * type pair may ever infer DependsOn.
+     */
+    const types: Array<EntityType> = Object.values(EntityType);
+    for (const fromType of types) {
+      for (const toType of types) {
+        expect(inferRelationshipType(fromType, toType)).not.toBe(
+          EntityRelationshipType.DependsOn,
+        );
+      }
+    }
+  });
+});
+
+describe("EntityRelationshipType", () => {
+  test("pins the depends-on wire value (stored in Postgres rows)", () => {
+    expect(EntityRelationshipType.DependsOn).toBe("depends-on");
+  });
+});
+
+describe("deriveRelationships", () => {
+  function hasEdge(
+    edges: Array<EntityRelationshipEdge>,
+    from: string,
+    to: string,
+    rel: EntityRelationshipType,
+  ): boolean {
+    return edges.some((e: EntityRelationshipEdge) => {
+      return (
+        e.fromEntityKey === from &&
+        e.toEntityKey === to &&
+        e.relationshipType === rel
+      );
+    });
+  }
+
+  test("derives the full directed edge set for a k8s resource", () => {
+    const edges: Array<EntityRelationshipEdge> = deriveRelationships([
+      { entityType: EntityType.Service, entityKey: "svc" },
+      { entityType: EntityType.Host, entityKey: "host" },
+      { entityType: EntityType.KubernetesPod, entityKey: "pod" },
+      { entityType: EntityType.KubernetesNode, entityKey: "node" },
+      { entityType: EntityType.KubernetesCluster, entityKey: "cluster" },
+      { entityType: EntityType.Container, entityKey: "ctr" },
+    ]);
+
+    expect(hasEdge(edges, "svc", "host", EntityRelationshipType.HostedOn)).toBe(
+      true,
+    );
+    expect(hasEdge(edges, "svc", "pod", EntityRelationshipType.RunsOn)).toBe(
+      true,
+    );
+    expect(hasEdge(edges, "pod", "node", EntityRelationshipType.RunsOn)).toBe(
+      true,
+    );
+    expect(
+      hasEdge(edges, "pod", "cluster", EntityRelationshipType.MemberOf),
+    ).toBe(true);
+    expect(
+      hasEdge(edges, "node", "cluster", EntityRelationshipType.MemberOf),
+    ).toBe(true);
+    expect(hasEdge(edges, "ctr", "pod", EntityRelationshipType.PartOf)).toBe(
+      true,
+    );
+    // No reverse edge.
+    expect(hasEdge(edges, "host", "svc", EntityRelationshipType.HostedOn)).toBe(
+      false,
+    );
+  });
+
+  test("empty / single-entity sets produce no edges", () => {
+    expect(deriveRelationships([])).toEqual([]);
+    expect(
+      deriveRelationships([{ entityType: EntityType.Host, entityKey: "h" }]),
+    ).toEqual([]);
+  });
+
+  test("deduplicates repeated entities", () => {
+    const edges: Array<EntityRelationshipEdge> = deriveRelationships([
+      { entityType: EntityType.KubernetesPod, entityKey: "pod" },
+      { entityType: EntityType.KubernetesCluster, entityKey: "cluster" },
+      { entityType: EntityType.KubernetesCluster, entityKey: "cluster" },
+    ]);
+    const memberEdges: Array<EntityRelationshipEdge> = edges.filter(
+      (e: EntityRelationshipEdge) => {
+        return e.relationshipType === EntityRelationshipType.MemberOf;
+      },
+    );
+    expect(memberEdges.length).toBe(1);
+  });
+});

package/Tests/Utils/UUID.test.ts

@@ -3,6 +3,14 @@ import UUID from "../../Utils/UUID";
 const UUID_V4_REGEX: RegExp =
   /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/;
 
+const UUID_V7_REGEX: RegExp =
+  /^[0-9a-f]{8}-[0-9a-f]{4}-7[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/;
+
+// First 12 hex chars (hyphen removed) = the 48-bit unix-ms timestamp prefix.
+function timestampPrefixOf(uuid: string): number {
+  return parseInt(uuid.replace(/-/g, "").slice(0, 12), 16);
+}
+
 describe("UUID", () => {
   test("UUID.generate() should generate a valid UUID", () => {
     const uuid: string = UUID.generate();
@@ -11,6 +19,45 @@ describe("UUID", () => {
     expect(uuid.length).toBe(36);
   });
 
+  test("UUID.generateTimeOrdered() should generate a valid UUIDv7", () => {
+    const uuid: string = UUID.generateTimeOrdered();
+    expect(uuid).toMatch(UUID_V7_REGEX);
+    expect(uuid.length).toBe(36);
+  });
+
+  test("UUID.generateTimeOrdered() prefix should encode the current unix-ms time", () => {
+    const before: number = Date.now();
+    const uuid: string = UUID.generateTimeOrdered();
+    const after: number = Date.now();
+
+    const prefix: number = timestampPrefixOf(uuid);
+    expect(prefix).toBeGreaterThanOrEqual(before);
+    expect(prefix).toBeLessThanOrEqual(after);
+  });
+
+  test("UUID.generateTimeOrdered() prefixes should be monotonically non-decreasing", async () => {
+    const first: string = UUID.generateTimeOrdered();
+
+    // Cross a millisecond boundary so the prefix strictly advances.
+    await new Promise((resolve: (value: unknown) => void) => {
+      setTimeout(resolve, 5);
+    });
+
+    const second: string = UUID.generateTimeOrdered();
+
+    expect(timestampPrefixOf(second)).toBeGreaterThan(timestampPrefixOf(first));
+    // Time-ordered ids sort lexicographically by generation time.
+    expect(second > first).toBe(true);
+
+    // Same burst: prefixes never go backwards.
+    let previous: number = timestampPrefixOf(UUID.generateTimeOrdered());
+    for (let i: number = 0; i < 100; i++) {
+      const current: number = timestampPrefixOf(UUID.generateTimeOrdered());
+      expect(current).toBeGreaterThanOrEqual(previous);
+      previous = current;
+    }
+  });
+
   test("UUID.generate() should fall back to getRandomValues when randomUUID is unavailable", () => {
     const cryptoObj: Crypto = globalThis.crypto;
     const originalRandomUUID: typeof cryptoObj.randomUUID =

package/Types/AnalyticsDatabase/AnalyticsTableName.ts

@@ -1,12 +1,12 @@
 enum AnalyticsTableName {
-  Log = "LogItemV2",
-  Metric = "MetricItemV2",
-  ExceptionInstance = "ExceptionItemV2",
-  Span = "SpanItemV2",
-  MonitorLog = "MonitorLogV2",
-  Profile = "ProfileItemV2",
-  ProfileSample = "ProfileSampleItemV2",
-  AuditLog = "AuditLogV1",
+  Log = "LogItemV3",
+  Metric = "MetricItemV3",
+  ExceptionInstance = "ExceptionItemV3",
+  Span = "SpanItemV3",
+  MonitorLog = "MonitorLogV3",
+  Profile = "ProfileItemV3",
+  ProfileSample = "ProfileSampleItemV3",
+  AuditLog = "AuditLogV2",
   /*
    * Materialized-view target tables. These hold AggregateFunction
    * states populated by attached MVs on the source `Metric` table.
@@ -14,7 +14,12 @@ enum AnalyticsTableName {
    * named here (they aren't queried directly).
    */
   MetricItemAggMV1m = "MetricItemAggMV1m",
-  MetricItemAggMV1mByHost = "MetricItemAggMV1mByHost",
+  /*
+   * Successor of MetricItemAggMV1mByHost (dropped by the
+   * RekeyMetricHostRollupToEntityKey migration), keyed by the stable
+   * hostEntityKey instead of the raw host.name spelling.
+   */
+  MetricItemAggMV1mByHostV2 = "MetricItemAggMV1mByHostV2",
   MetricBaselineHourly = "MetricBaselineHourly",
 }
 

package/Types/AnalyticsDatabase/TableColumnType.ts

@@ -38,6 +38,7 @@ enum ColumnType {
    * UInt sizes can be added if there's a reason.
    */
   UInt8 = "UInt8",
+  UInt64 = "UInt64",
 }
 
 export default ColumnType;

package/Types/Dashboard/DashboardComponentType.ts

@@ -6,6 +6,7 @@ enum DashboardComponentType {
   Gauge = `Gauge`,
   LogStream = `LogStream`,
   TraceList = `TraceList`,
+  TraceChart = `TraceChart`,
   IncidentList = `IncidentList`,
   AlertList = `AlertList`,
   MonitorList = `MonitorList`,

package/Types/Dashboard/DashboardComponents/DashboardTraceChartComponent.ts

@@ -0,0 +1,37 @@
+import ObjectID from "../../ObjectID";
+import DashboardComponentType from "../DashboardComponentType";
+import BaseComponent from "./DashboardBaseComponent";
+
+export default interface DashboardTraceChartComponent extends BaseComponent {
+  componentType: DashboardComponentType.TraceChart;
+  componentId: ObjectID;
+  arguments: {
+    title?: string | undefined;
+    /*
+     * Span aggregation to chart — one of the trace analytics metrics:
+     * count, errorCount, avgDuration, p50Duration, p90Duration,
+     * p95Duration, p99Duration, minDuration, maxDuration.
+     */
+    metric?: string | undefined;
+    // Substring filter on span name (e.g. "/Shipment/ShipShipment").
+    spanNameContains?: string | undefined;
+    /*
+     * Attribute equality filters, ANDed — "key=value; key2=value2"
+     * (e.g. "url.host=torginol.starship.online").
+     */
+    attributeFilters?: string | undefined;
+    /*
+     * Optional split dimension: a span attribute key (e.g. url.host,
+     * resource.service.instance.id) or a top-level column (name,
+     * primaryEntityId, statusCode, kind). One series per value.
+     */
+    groupByAttribute?: string | undefined;
+    // Cap on the number of series when split (default 10).
+    topLimit?: number | undefined;
+    /*
+     * Include non-root spans. Off by default so "Request Count" matches the
+     * traces explorer, which is root-spans-only.
+     */
+    includeChildSpans?: boolean | undefined;
+  };
+}

package/Types/Dashboard/DashboardTemplates.ts

@@ -15,11 +15,10 @@ import { DashboardValueTrendDirection } from "./DashboardComponents/DashboardVal
 
 /*
  * Trace / Exception / Profiles entries are intentionally not in this
- * enum: their metric catalogs (SpanMetricType, ExceptionMetricType,
- * ProfileMetricType) define names that are not emitted anywhere in the
- * codebase, so the templates only ever rendered empty widgets. Reach
- * for the Logs / Traces / Exceptions pages directly until those metrics
- * exist.
+ * enum: their metric catalogs (e.g. SpanMetricType, ExceptionMetricType)
+ * define names that are not emitted anywhere in the codebase, so the
+ * templates only ever rendered empty widgets. Reach for the Logs /
+ * Traces / Exceptions pages directly until those metrics exist.
  */
 export enum DashboardTemplateType {
   Blank = "Blank",

package/Types/Log/LogQueryParser.ts

@@ -9,7 +9,7 @@
  *   - Field-specific:      `severity:error`           → severityText = 'error'
  *   - Attribute access:    `@http.status_code:500`    → attributes.http.status_code = '500'
  *   - Negation (prefix):   `-severity:debug`          → severityText != 'debug'
- *   - Wildcard:            `service:api-*`            → serviceId ILIKE 'api-%'
+ *   - Wildcard:            `service:api-*`            → primaryEntityId ILIKE 'api-%'
  *   - Numeric range:       `@duration:>1000`          → attributes.duration > 1000
  *   - Boolean:             `severity:error AND service:api` (AND is default between tokens)
  *
@@ -46,7 +46,7 @@ export interface ParsedToken {
 const FIELD_ALIASES: Record<string, string> = {
   severity: "severityText",
   level: "severityText",
-  service: "serviceId",
+  service: "primaryEntityId",
   trace: "traceId",
   span: "spanId",
   message: "body",

package/Types/Log/LogQueryToFilter.ts

@@ -19,7 +19,7 @@ import LessThanOrEqual from "../BaseDatabase/LessThanOrEqual";
 export interface LogFilter {
   body?: string | Search<string>;
   severityText?: string;
-  serviceId?: string;
+  primaryEntityId?: string;
   traceId?: string;
   spanId?: string;
   attributes?: Record<string, unknown>;
@@ -28,7 +28,7 @@ export interface LogFilter {
 
 const TOP_LEVEL_FIELDS: Set<string> = new Set([
   "severityText",
-  "serviceId",
+  "primaryEntityId",
   "traceId",
   "spanId",
   "body",

package/Types/Monitor/MonitorStepExceptionMonitor.ts

@@ -9,6 +9,13 @@ import ObjectID from "../ObjectID";
 
 export default interface MonitorStepExceptionMonitor {
   telemetryServiceIds: Array<ObjectID>;
+  /*
+   * Stable telemetry entity keys (host / pod / container / ...) — scopes
+   * the monitor to exceptions carrying any of these in their entityKeys
+   * column. Optional: monitors saved before this field existed have it
+   * undefined.
+   */
+  entityKeys?: Array<string> | undefined;
   exceptionTypes: Array<string>;
   message: string;
   includeResolved: boolean;
@@ -26,11 +33,19 @@ export class MonitorStepExceptionMonitorUtil {
       monitorStepExceptionMonitor.telemetryServiceIds &&
       monitorStepExceptionMonitor.telemetryServiceIds.length > 0
     ) {
-      query.serviceId = new Includes(
+      query.primaryEntityId = new Includes(
         monitorStepExceptionMonitor.telemetryServiceIds,
       );
     }
 
+    // Compiles to hasAny(entityKeys, [...]) server-side. Undefined/empty is a no-op.
+    if (
+      monitorStepExceptionMonitor.entityKeys &&
+      monitorStepExceptionMonitor.entityKeys.length > 0
+    ) {
+      query.entityKeys = new Includes(monitorStepExceptionMonitor.entityKeys);
+    }
+
     if (
       monitorStepExceptionMonitor.exceptionTypes &&
       monitorStepExceptionMonitor.exceptionTypes.length > 0
@@ -59,6 +74,7 @@ export class MonitorStepExceptionMonitorUtil {
   public static getDefault(): MonitorStepExceptionMonitor {
     return {
       telemetryServiceIds: [],
+      entityKeys: [],
       exceptionTypes: [],
       message: "",
       includeResolved: false,
@@ -72,6 +88,7 @@ export class MonitorStepExceptionMonitorUtil {
       telemetryServiceIds: ObjectID.fromJSONArray(
         (json["telemetryServiceIds"] as Array<JSONObject>) || [],
       ),
+      entityKeys: (json["entityKeys"] as Array<string>) || [],
       exceptionTypes: (json["exceptionTypes"] as Array<string>) || [],
       message: (json["message"] as string) || "",
       includeResolved: Boolean(json["includeResolved"]) || false,
@@ -84,6 +101,7 @@ export class MonitorStepExceptionMonitorUtil {
   public static toJSON(monitor: MonitorStepExceptionMonitor): JSONObject {
     return {
       telemetryServiceIds: ObjectID.toJSONArray(monitor.telemetryServiceIds),
+      entityKeys: monitor.entityKeys || [],
       exceptionTypes: monitor.exceptionTypes,
       message: monitor.message,
       includeResolved: monitor.includeResolved,

package/Types/Monitor/MonitorStepLogMonitor.ts

@@ -14,6 +14,12 @@ export default interface MonitorStepLogMonitor {
   body: string;
   severityTexts: Array<LogSeverity>;
   telemetryServiceIds: Array<ObjectID>;
+  /*
+   * Stable telemetry entity keys (host / pod / container / ...) — scopes
+   * the monitor to logs carrying any of these in their entityKeys column.
+   * Optional: monitors saved before this field existed have it undefined.
+   */
+  entityKeys?: Array<string> | undefined;
   lastXSecondsOfLogs: number;
 }
 
@@ -27,7 +33,17 @@ export class MonitorStepLogMonitorUtil {
       monitorStepLogMonitor.telemetryServiceIds &&
       monitorStepLogMonitor.telemetryServiceIds.length > 0
     ) {
-      query.serviceId = new Includes(monitorStepLogMonitor.telemetryServiceIds);
+      query.primaryEntityId = new Includes(
+        monitorStepLogMonitor.telemetryServiceIds,
+      );
+    }
+
+    // Compiles to hasAny(entityKeys, [...]) server-side. Undefined/empty is a no-op.
+    if (
+      monitorStepLogMonitor.entityKeys &&
+      monitorStepLogMonitor.entityKeys.length > 0
+    ) {
+      query.entityKeys = new Includes(monitorStepLogMonitor.entityKeys);
     }
 
     if (
@@ -66,6 +82,7 @@ export class MonitorStepLogMonitorUtil {
       body: "",
       severityTexts: [],
       telemetryServiceIds: [],
+      entityKeys: [],
       lastXSecondsOfLogs: 60,
     };
   }
@@ -79,6 +96,7 @@ export class MonitorStepLogMonitorUtil {
       telemetryServiceIds: ObjectID.fromJSONArray(
         json["telemetryServiceIds"] as Array<JSONObject>,
       ),
+      entityKeys: (json["entityKeys"] as Array<string>) || [],
       lastXSecondsOfLogs: json["lastXSecondsOfLogs"] as number,
     };
   }
@@ -89,6 +107,7 @@ export class MonitorStepLogMonitorUtil {
       body: monitor.body,
       severityTexts: monitor.severityTexts,
       telemetryServiceIds: ObjectID.toJSONArray(monitor.telemetryServiceIds),
+      entityKeys: monitor.entityKeys || [],
       lastXSecondsOfLogs: monitor.lastXSecondsOfLogs,
     };
   }