fix(eap): Move timestamp to common eap column (#95333)

Timestamp gets special treatment and should be the same across eap
datasets. This moves it into the common columns so the behaviour is
shared.

Fixes LOGS-210

Author: Zylphrex

src/sentry/search/eap/common_columns.py

@@ -1,5 +1,5 @@
 from sentry.search.eap import constants
-from sentry.search.eap.columns import ResolvedAttribute
+from sentry.search.eap.columns import ResolvedAttribute, datetime_processor
 
 COMMON_COLUMNS = [
     ResolvedAttribute(
@@ -30,4 +30,11 @@
         internal_name="sentry.organization_id",
         private=True,
     ),
+    ResolvedAttribute(
+        public_alias="timestamp",
+        internal_name="sentry.timestamp",
+        internal_type=constants.DOUBLE,
+        search_type="string",
+        processor=datetime_processor,
+    ),
 ]

src/sentry/search/eap/ourlogs/attributes.py

@@ -4,7 +4,6 @@
 from sentry.search.eap.columns import (
     ResolvedAttribute,
     VirtualColumnDefinition,
-    datetime_processor,
     project_context_constructor,
     project_term_resolver,
     simple_sentry_field,
@@ -37,12 +36,6 @@
             search_type="string",
             validator=is_event_id_or_list,
         ),
-        ResolvedAttribute(
-            public_alias="timestamp",
-            internal_name="sentry.timestamp",
-            search_type="string",
-            processor=datetime_processor,
-        ),
         simple_sentry_field("browser.name"),
         simple_sentry_field("browser.version"),
         simple_sentry_field("environment"),

src/sentry/search/eap/spans/attributes.py

@@ -10,7 +10,6 @@
 from sentry.search.eap.columns import (
     ResolvedAttribute,
     VirtualColumnDefinition,
-    datetime_processor,
     project_context_constructor,
     project_term_resolver,
     simple_measurements_field,
@@ -236,13 +235,6 @@
             internal_name="sentry.sampling_factor",
             search_type="percentage",
         ),
-        ResolvedAttribute(
-            public_alias="timestamp",
-            internal_name="sentry.timestamp",
-            internal_type=constants.DOUBLE,
-            search_type="string",
-            processor=datetime_processor,
-        ),
         ResolvedAttribute(
             public_alias="cache.hit",
             internal_name="cache.hit",

tests/snuba/api/endpoints/test_organization_events_ourlogs.py

@@ -2,6 +2,7 @@
 
 import pytest
 
+from sentry.testutils.helpers.datetime import before_now
 from sentry.utils.cursors import Cursor
 from tests.snuba.api.endpoints.test_organization_events import OrganizationEventsEndpointTestBase
 
@@ -217,3 +218,53 @@ def test_trace_id_list_filter(self):
             {"message": "foo", "trace": trace_id_1},
         ]
         assert meta["dataset"] == self.dataset
+
+    def test_filter_timestamp(self):
+        one_day_ago = before_now(days=1).replace(microsecond=0)
+        three_days_ago = before_now(days=3).replace(microsecond=0)
+
+        log1 = self.create_ourlog(
+            {"body": "foo"},
+            timestamp=one_day_ago,
+        )
+        log2 = self.create_ourlog(
+            {"body": "bar"},
+            timestamp=three_days_ago,
+        )
+        self.store_ourlogs([log1, log2])
+
+        request = {
+            "field": ["message"],
+            "project": self.project.id,
+            "dataset": self.dataset,
+        }
+
+        response = self.do_request(
+            {
+                **request,
+                "query": "timestamp:-2d",
+            }
+        )
+        assert response.status_code == 200, response.content
+        assert response.data["data"] == [{"message": "foo"}]
+
+        timestamp = before_now(days=2).isoformat()
+        timestamp = timestamp.split("T", 2)[0]
+
+        response = self.do_request(
+            {
+                **request,
+                "query": f"timestamp:>{timestamp}",
+            }
+        )
+        assert response.status_code == 200, response.content
+        assert response.data["data"] == [{"message": "foo"}]
+
+        response = self.do_request(
+            {
+                **request,
+                "query": f"timestamp:<{timestamp}",
+            }
+        )
+        assert response.status_code == 200, response.content
+        assert response.data["data"] == [{"message": "bar"}]