{"record":{"id":"bcee3e0fe76a3c80","repo":"SigNoz/signoz","slug":"errors-codeinvalidinput","errorCode":"errors.CodeInvalidInput","errorMessage":"field `%s` not found","messagePattern":"field `(.+?)` not found","errorType":"validation","errorClass":null,"httpStatus":400,"severity":"warning","filePath":"pkg/telemetryschema/audittelemetryschema/field_mapper.go","lineNumber":130,"sourceCode":"\nfunc (m *fieldMapper) ColumnExpressionFor(\n\tctx context.Context,\n\torgID valuer.UUID,\n\ttsStart, tsEnd uint64,\n\tfield *telemetrytypes.TelemetryFieldKey,\n\trequiredDataType telemetrytypes.FieldDataType,\n\tkeys map[string][]*telemetrytypes.TelemetryFieldKey,\n) (string, error) {\n\tresolved := field\n\tfieldExpression, err := m.FieldFor(ctx, orgID, tsStart, tsEnd, field)\n\tif errors.Is(err, qbtypes.ErrColumnNotFound) {\n\t\tkeysForField := keys[field.Name]\n\t\tif len(keysForField) == 0 {\n\t\t\tif _, ok := auditLogColumns[field.Name]; ok {\n\t\t\t\tfield.FieldContext = telemetrytypes.FieldContextLog\n\t\t\t\tfieldExpression, _ = m.FieldFor(ctx, orgID, tsStart, tsEnd, field)\n\t\t\t} else {\n\t\t\t\twrappedErr := errors.Wrapf(err, errors.TypeInvalidInput, errors.CodeInvalidInput, \"field `%s` not found\", field.Name).WithSuggestions(errors.NewSuggestionsOnLevenshteinDistance(field.Name, errors.NounKeys, maps.Keys(keys))...)\n\t\t\t\treturn \"\", wrappedErr\n\t\t\t}\n\t\t} else {\n\t\t\tresolved = keysForField[0]\n\t\t\tfieldExpression, _ = m.FieldFor(ctx, orgID, tsStart, tsEnd, keysForField[0])\n\t\t}\n\t}\n\n\t// Group-by/order (String) and aggregation (String/Float64): exists-guarded and coerced\n\t// to requiredDataType, returned bare (the caller adds any alias). Raw select\n\t// (Unspecified) returns the aliased column expression.\n\tif requiredDataType != telemetrytypes.FieldDataTypeUnspecified {\n\t\tvar dummyValue any = \"\"\n\t\tif requiredDataType == telemetrytypes.FieldDataTypeFloat64 {\n\t\t\tdummyValue = 0.0\n\t\t}\n\t\tcolumns, err := m.getColumn(ctx, resolved)\n\t\tif err != nil {","sourceCodeStart":112,"sourceCodeEnd":148,"githubUrl":"https://github.com/SigNoz/signoz/blob/5069bf80b08f1f00d7e014eccc09902f9871004f/pkg/telemetryschema/audittelemetryschema/field_mapper.go#L112-L148","documentation":"ColumnExpressionFor in the audit-log telemetry schema field mapper throws this when a requested field name resolves to no key in the keys map and is also not one of the known audit log columns. It is an invalid-input error that attaches Levenshtein-distance suggestions ('did you mean...') computed from the available field names, so users can correct typos.","triggerScenarios":"Passing a field with a name that is neither a discovered/registered metadata key nor an audit log column — e.g. Field{Name: \"usr_email\"} when the key is \"user.email\", or referencing a field that only exists in traces/logs but querying the audit schema. The error is returned wrapped with suggestions for the closest known keys.","commonSituations":"Typos or case mismatches in user-supplied group-by/filter field names, field names copied from a different signal's schema (traces vs audit logs), or schema drift after fields were renamed and old queries are replayed.","solutions":["Log/inspect the wrapped error's suggestions — the nearest valid key is usually printed and is the fastest fix","Correct the field name to match an available key (watch case and dot vs underscore separators)","Validate field names against the keys map (or the schema API that produced it) before building the query","If the field should exist, check that discovery/metadata population ran so the keys map is populated for the org","Add a pre-flight validation step in the API layer that rejects unknown fields with the suggestion list"],"exampleFix":"// before\nfield := telemetrytypes.Field{Name: \"usr_email\"}\nexpr, _ := mapper.ColumnExpressionFor(ctx, orgID, start, end, field)\n\n// after\nfield := telemetrytypes.Field{Name: \"user.email\"} // matches a key in `keys`\nexpr, err := mapper.ColumnExpressionFor(ctx, orgID, start, end, field)\nif err != nil { return fmt.Errorf(\"bad field: %w\", err) }","handlingStrategy":"validation","validationCode":"// Validate field names before building the query:\navail := maps.Keys(keys) // or fetch the schema's known fields for orgID\nif _, ok := keys[field.Name]; !ok {\n    if _, isCol := auditLogColumns[field.Name]; !isCol {\n        return fmt.Errorf(\"unknown field %q; available: %v\", field.Name, avail)\n    }\n}","typeGuard":"func isValidAuditField(name string, keys map[string][]K, cols map[string]struct{}) bool {\n    if len(keys[name]) > 0 { return true }\n    _, ok := cols[name]\n    return ok\n}","tryCatchPattern":"expr, err := mapper.ColumnExpressionFor(ctx, orgID, start, end, field)\nif err != nil {\n    if errors.Ast(err, errors.TypeInvalidInput) {\n        // err carries suggestions; surface them to the caller as a 400 with 'did you mean'\n    }\n}","preventionTips":["Offer users an autocomplete from the keys map instead of free-text field entry","Normalize field-name input (trim, case-fold) before lookup","Read the suggestions attached via WithSuggestions to auto-correct small typos"],"tags":["field-mapping","unknown-field","typo","suggestions","go","audit-schema"],"backgroundTag":"unknown-field-name-in-query","analyzedSha":"5069bf80b08f1f00d7e014eccc09902f9871004f","analyzedAt":"2026-08-28T06:22:12.824Z","schemaVersion":2},"datasetVersion":"2026-08-28T11:17:15.048Z"}