SigNoz/signoz · warning

errors.CodeInvalidInput

errors.CodeInvalidInput

Error message

field `%s` not found

What it means

ColumnExpressionFor in the audit-log telemetry schema field mapper throws this when a requested field name resolves to no key in the keys map and is also not one of the known audit log columns. It is an invalid-input error that attaches Levenshtein-distance suggestions ('did you mean...') computed from the available field names, so users can correct typos.

Source

Thrown at pkg/telemetryschema/audittelemetryschema/field_mapper.go:130

func (m *fieldMapper) ColumnExpressionFor(
	ctx context.Context,
	orgID valuer.UUID,
	tsStart, tsEnd uint64,
	field *telemetrytypes.TelemetryFieldKey,
	requiredDataType telemetrytypes.FieldDataType,
	keys map[string][]*telemetrytypes.TelemetryFieldKey,
) (string, error) {
	resolved := field
	fieldExpression, err := m.FieldFor(ctx, orgID, tsStart, tsEnd, field)
	if errors.Is(err, qbtypes.ErrColumnNotFound) {
		keysForField := keys[field.Name]
		if len(keysForField) == 0 {
			if _, ok := auditLogColumns[field.Name]; ok {
				field.FieldContext = telemetrytypes.FieldContextLog
				fieldExpression, _ = m.FieldFor(ctx, orgID, tsStart, tsEnd, field)
			} else {
				wrappedErr := errors.Wrapf(err, errors.TypeInvalidInput, errors.CodeInvalidInput, "field `%s` not found", field.Name).WithSuggestions(errors.NewSuggestionsOnLevenshteinDistance(field.Name, errors.NounKeys, maps.Keys(keys))...)
				return "", wrappedErr
			}
		} else {
			resolved = keysForField[0]
			fieldExpression, _ = m.FieldFor(ctx, orgID, tsStart, tsEnd, keysForField[0])
		}
	}

	// Group-by/order (String) and aggregation (String/Float64): exists-guarded and coerced
	// to requiredDataType, returned bare (the caller adds any alias). Raw select
	// (Unspecified) returns the aliased column expression.
	if requiredDataType != telemetrytypes.FieldDataTypeUnspecified {
		var dummyValue any = ""
		if requiredDataType == telemetrytypes.FieldDataTypeFloat64 {
			dummyValue = 0.0
		}
		columns, err := m.getColumn(ctx, resolved)
		if err != nil {

View on GitHub (pinned to 5069bf80b0)

Solutions

1. Log/inspect the wrapped error's suggestions — the nearest valid key is usually printed and is the fastest fix
2. Correct the field name to match an available key (watch case and dot vs underscore separators)
3. Validate field names against the keys map (or the schema API that produced it) before building the query
4. If the field should exist, check that discovery/metadata population ran so the keys map is populated for the org
5. Add a pre-flight validation step in the API layer that rejects unknown fields with the suggestion list

Example fix

// before
field := telemetrytypes.Field{Name: "usr_email"}
expr, _ := mapper.ColumnExpressionFor(ctx, orgID, start, end, field)

// after
field := telemetrytypes.Field{Name: "user.email"} // matches a key in `keys`
expr, err := mapper.ColumnExpressionFor(ctx, orgID, start, end, field)
if err != nil { return fmt.Errorf("bad field: %w", err) }

// Validate field names before building the query:
avail := maps.Keys(keys) // or fetch the schema's known fields for orgID
if _, ok := keys[field.Name]; !ok {
    if _, isCol := auditLogColumns[field.Name]; !isCol {
        return fmt.Errorf("unknown field %q; available: %v", field.Name, avail)
    }
}

func isValidAuditField(name string, keys map[string][]K, cols map[string]struct{}) bool {
    if len(keys[name]) > 0 { return true }
    _, ok := cols[name]
    return ok
}

expr, err := mapper.ColumnExpressionFor(ctx, orgID, start, end, field)
if err != nil {
    if errors.Ast(err, errors.TypeInvalidInput) {
        // err carries suggestions; surface them to the caller as a 400 with 'did you mean'
    }
}

When it happens

Trigger: Passing a field with a name that is neither a discovered/registered metadata key nor an audit log column — e.g. Field{Name: "usr_email"} when the key is "user.email", or referencing a field that only exists in traces/logs but querying the audit schema. The error is returned wrapped with suggestions for the closest known keys.

Common situations: Typos or case mismatches in user-supplied group-by/filter field names, field names copied from a different signal's schema (traces vs audit logs), or schema drift after fields were renamed and old queries are replayed.

Related errors

• errors.CodeInvalidInput
• CodeInvalidInput
• ErrCodeIncorrectPassword
• CodeTooManyRequests
• CodeInvalidInput

AI-assisted analysis of SigNoz/signoz@5069bf80b0 (2026-08-28). Data as JSON: /api/errors/bcee3e0fe76a3c80. Report an issue: GitHub.