Error In Log Explorer witha. different timestamp column

[83bytes]

Hello,
I get the following error in the Explorer page.

Query Error:
Failed to generate histogram data: error generating histogram for source 1: failed to execute histogram query: executing query or processing results: code: 47, message: Unknown expression or function identifier `parsed_timestamp` in scope WITH top_groups AS (SELECT bucket_name AS group_value, count(*) AS total_logs FROM (SELECT * FROM nginx_logs.nginx_access_logs WHERE ((parsed_timestamp >= toDateTime('2025-10-22 15:03:16', 'Asia/Kolkata')) AND (parsed_timestamp <= toDateTime('2025-10-22 15:18:16', 'Asia/Kolkata'))) AND (timestamp != '22/Oct/2025:15:18:16 +0530') ORDER BY parsed_timestamp DESC) AS raw_logs GROUP BY group_value ORDER BY total_logs DESC LIMIT 10) SELECT toStartOfInterval(parsed_timestamp, toIntervalSecond(5), 'UTC') AS bucket, bucket_name AS group_value, count(*) AS log_count FROM (SELECT * FROM nginx_logs.nginx_access_logs WHERE ((parsed_timestamp >= toDateTime('2025-10-22 15:03:16', 'Asia/Kolkata')) AND (parsed_timestamp <= toDateTime('2025-10-22 15:18:16', 'Asia/Kolkata'))) AND (timestamp != '22/Oct/2025:15:18:16 +0530') ORDER BY parsed_timestamp DESC) AS raw_logs WHERE bucket_name GLOBAL IN (SELECT group_value FROM top_groups) GROUP BY bucket, group_value ORDER BY bucket ASC, log_count DESC

The timestamp column in my table is called parsed_timestamp and I think this is the reason though I haven't looked at the code etc to debug this further.

I can take a look and raise a PR if this is indeed a bug.

Thanks :)

[mr-karan]

Hey. Thanks for opening the issue. Can you share a screenshot of the source schema? Did you mention parsed_timestamp is the timestamp column when connecting the source?

Thanks

[83bytes]

Here is the schema.

CREATE TABLE IF NOT EXISTS nginx_access_logs (
    timestamp String,
    parsed_timestamp DateTime64 MATERIALIZED parseDateTimeInJodaSyntax(timestamp, 'dd/MMM/yyyy:HH:mm:ss Z'),
    remote_addr IPv4,
    remote_user String,
    host String,
    method String,
    request_uri String,
    http_version String,
    status UInt16,
    body_bytes_sent UInt64,
    http_referer String,
    http_user_agent String,
    http_x_forwarded_for String,
    bucket_name String,
    object_uri String MATERIALIZED concat('https://', host, request_uri),
    date Date MATERIALIZED toDate(parsed_timestamp),
    date_hour_5min DateTime64 MATERIALIZED toStartOfFiveMinute(parsed_timestamp),
) ENGINE = MergeTree()
PARTITION BY date
ORDER BY (bucket_name, parsed_timestamp)
SETTINGS index_granularity = 8192;

And yes, I did mention that the field parsed_timestamp is the timestamp column when connecting to the db.

Maybe the issue arises because the table has both the timestamp and the parsed_timestamp fields ?

[mr-karan]

Maybe the issue arises because the table has both the timestamp and the parsed_timestamp fields ?

That shouldn't be the case, multiple timestamp fields are supported. I'll investigate this.

[83bytes]

Thank you! I will try replicating this again and share more details when possible. Best, Sohom Bhattacharjee

…

On Wed, Nov 12, 2025 at 10:52 AM Karan Sharma ***@***.***> wrote: Maybe the issue arises because the table has both the timestamp and the parsed_timestamp fields ? That shouldn't be the case, multiple timestamp fields are supported. I'll investigate this. — Reply to this email directly, view it on GitHub <#59 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AC2M42CLKUEI4SSXTNU6RNT34K725AVCNFSM6AAAAACJ4FCWWOVHI2DSMVQWIX3LMV43URDJONRXK43TNFXW4Q3PNVWWK3TUHMYTIOJUGM2DGMQ> . You are receiving this because you authored the thread.Message ID: ***@***.***>

[mr-karan]

This was due to MATERIALIZED column. Fix for the same will land soon in main and will create a new release by end of this month.

Cheers

[83bytes]

Thank You so much. This was great. :) Sohom Bhattacharjee

…

On Wed, 17 Dec, 2025, 15:04 Karan Sharma, ***@***.***> wrote: Closed #59 <#59> as resolved. — Reply to this email directly, view it on GitHub <#59>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AC2M42AFNESKTTYDF7A6W7T4CEPRJAVCNFSM6AAAAACJ4FCWWOVHI2DSMVQWIX3LMV45UABFIRUXGY3VONZWS33OIV3GK3TUHI5E433UNFTGSY3BORUW63R3GIZTCMZYHEZQ> . You are receiving this because you authored the thread.Message ID: ***@***.***>