SigNoz

Vendor ID: signoz · Maturity: preview · Categories: Observability, Tools

SigNoz — OTel-native observability. This integration queries your SigNoz instance through the v5 query_range API to find what is failing across your services.

Read-only by construction. The only endpoint any tool here can reach is POST /api/v5/query_range. There is deliberately no alert, dashboard, or settings surface: a workflow that can mutate your observability plane has a far larger blast radius than one that can only read it.

Auth

Credential	Notes
`apiKey`	A SigNoz API key (Settings → API Keys), sent as the `SIGNOZ-API-KEY` header. SigNoz does not use `Authorization: Bearer` for these keys.

Configuration

Field	Notes
`signozBaseUrl`	Base URL of your SigNoz query API, no trailing slash — e.g. `http://signoz-query.internal.scrydon.com:8080`. Required.

SigNoz is self-hosted, so there is no fixed public origin the way there is for a SaaS vendor. The reachable address is yours, which is why it is configuration rather than a constant.

If SigNoz sits behind a private endpoint, two things must both be true or every call is denied: the host must be on the organization's egress allowlist, and private-range egress must be enabled. The SSRF wall blocks RFC1918 destinations by default, and an empty allowlist means deny everything, not no policy.

Capabilities

Tool	Returns
Query Error Spans	Error spans (`has_error = true`) grouped by service, operation, and status message, ranked by occurrence count. This is the "what is failing" query.
Query Error Logs	Raw `ERROR` and `FATAL` log records with body, service, and severity — for when the span status message is too terse to identify the cause.

Both take a bounded window (lookbackHours, default 24, or explicit start/end) and a limit (default 500, hard cap 5 000).

Two behaviors worth knowing

Truncation is reported, never silent. Both tools return a truncated flag when the result hits the limit. A truncated sweep that looks complete is worse than a small one that admits it.

An unrecognized response shape fails the call. SigNoz does not publish a response schema for v5 query_range, so a version bump could reshape it. Rather than degrade to an empty result — which would read as "no errors found" — the integration raises an error. A blind spot you can see beats a clean report you can't trust.

Grouping on `status_message`

Error spans are clustered on service.name + span name + status_message, not on response_status_code. For Dapr CallLocal and binding spans the status code is empty, and the human-readable failure — Code(403): Forbidden, or a verbatim access-control denial — lives in status_message.