diff --git a/src/config/src/config.rs b/src/config/src/config.rs
index b1a39ba479..b7ac2a53fe 100644
--- a/src/config/src/config.rs
+++ b/src/config/src/config.rs
@@ -117,20 +117,27 @@ pub static SQL_FULL_TEXT_SEARCH_FIELDS: Lazy<Vec<String>> = Lazy::new(|| {
     fields
 });
 
+const _DEFAULT_SQL_SECONDARY_INDEX_SEARCH_FIELDS: [&str; 3] =
+    ["trace_id", "service_name", "operation_name"];
 pub static SQL_SECONDARY_INDEX_SEARCH_FIELDS: Lazy<Vec<String>> = Lazy::new(|| {
-    let mut fields = get_config()
-        .common
-        .feature_secondary_index_extra_fields
-        .split(',')
-        .filter_map(|s| {
-            let s = s.trim();
-            if s.is_empty() {
-                None
-            } else {
-                Some(s.to_string())
-            }
-        })
-        .collect::<Vec<_>>();
+    let mut fields = chain(
+        _DEFAULT_SQL_SECONDARY_INDEX_SEARCH_FIELDS
+            .iter()
+            .map(|s| s.to_string()),
+        get_config()
+            .common
+            .feature_secondary_index_extra_fields
+            .split(',')
+            .filter_map(|s| {
+                let s = s.trim();
+                if s.is_empty() {
+                    None
+                } else {
+                    Some(s.to_string())
+                }
+            }),
+    )
+    .collect::<Vec<_>>();
     fields.sort();
     fields.dedup();
     fields
diff --git a/src/handler/http/request/status/mod.rs b/src/handler/http/request/status/mod.rs
index 2c2d5647c8..de0433a4ba 100644
--- a/src/handler/http/request/status/mod.rs
+++ b/src/handler/http/request/status/mod.rs
@@ -24,7 +24,8 @@ use actix_web::{
 };
 use arrow_schema::Schema;
 use config::{
-    Config, META_ORG_ID, QUICK_MODEL_FIELDS, SQL_FULL_TEXT_SEARCH_FIELDS, TIMESTAMP_COL_NAME,
+    Config, META_ORG_ID, QUICK_MODEL_FIELDS, SQL_FULL_TEXT_SEARCH_FIELDS,
+    SQL_SECONDARY_INDEX_SEARCH_FIELDS, TIMESTAMP_COL_NAME,
     cluster::LOCAL_NODE,
     get_config, get_instance_id,
     meta::{
@@ -92,6 +93,7 @@ struct ConfigResponse<'a> {
     build_date: String,
     build_type: String,
     default_fts_keys: Vec<String>,
+    default_secondary_index_fields: Vec<String>,
     default_quick_mode_fields: Vec<String>,
     telemetry_enabled: bool,
     default_functions: Vec<ZoFunction<'a>>,
@@ -288,6 +290,10 @@ pub async fn zo_config() -> Result<HttpResponse, Error> {
             .iter()
             .map(|s| s.to_string())
             .collect(),
+        default_secondary_index_fields: SQL_SECONDARY_INDEX_SEARCH_FIELDS
+            .iter()
+            .map(|s| s.to_string())
+            .collect(),
         default_quick_mode_fields: QUICK_MODEL_FIELDS.to_vec(),
         default_functions: DEFAULT_FUNCTIONS.to_vec(),
         sql_base64_enabled: cfg.common.ui_sql_base64_enabled,
diff --git a/src/service/alerts/mod.rs b/src/service/alerts/mod.rs
index b2d772afdd..ee3cfd1ba0 100644
--- a/src/service/alerts/mod.rs
+++ b/src/service/alerts/mod.rs
@@ -689,7 +689,7 @@ async fn build_sql(
     let where_sql = conditions
         .to_sql(&schema)
         .await
-        .map_err(|err| anyhow::anyhow!("Error building SQL on stream {}: {}", &stream_name, err))?;
+        .map_err(|err| anyhow::anyhow!("Error building SQL on stream {stream_name}: {err}"))?;
     if query_condition.aggregation.is_none() {
         return Ok(format!("SELECT * FROM \"{stream_name}\" WHERE {where_sql}"));
     }
@@ -702,9 +702,8 @@ async fn build_sql(
             Ok(field) => field.data_type(),
             Err(_) => {
                 return Err(anyhow::anyhow!(
-                    "Aggregation column {} not found on stream {}",
+                    "Aggregation column {} not found on stream {stream_name}",
                     &agg.having.column,
-                    &stream_name
                 ));
             }
         };
@@ -766,17 +765,17 @@ fn build_expr(
                 cond.value.to_string()
             };
             match cond.operator {
-                Operator::EqualTo => format!("\"{}\" {} '{}'", field_alias, "=", val),
-                Operator::NotEqualTo => format!("\"{}\" {} '{}'", field_alias, "!=", val),
-                Operator::GreaterThan => format!("\"{}\" {} '{}'", field_alias, ">", val),
+                Operator::EqualTo => format!("\"{field_alias}\" = '{val}'"),
+                Operator::NotEqualTo => format!("\"{field_alias}\" != '{val}'"),
+                Operator::GreaterThan => format!("\"{field_alias}\" > '{val}'"),
                 Operator::GreaterThanEquals => {
-                    format!("\"{}\" {} '{}'", field_alias, ">=", val)
+                    format!("\"{field_alias}\" >= '{val}'")
                 }
-                Operator::LessThan => format!("\"{}\" {} '{}'", field_alias, "<", val),
-                Operator::LessThanEquals => format!("\"{}\" {} '{}'", field_alias, "<=", val),
-                Operator::Contains => format!("\"{}\" {} '%{}%'", field_alias, "LIKE", val),
+                Operator::LessThan => format!("\"{field_alias}\" < '{val}'"),
+                Operator::LessThanEquals => format!("\"{field_alias}\" <= '{val}'"),
+                Operator::Contains => format!("str_match(\"{field_alias}\", '%{val}%')"),
                 Operator::NotContains => {
-                    format!("\"{}\" {} '%{}%'", field_alias, "NOT LIKE", val)
+                    format!("\"{field_alias}\" NOT LIKE '%{val}%'")
                 }
             }
         }
@@ -790,30 +789,27 @@ fn build_expr(
                     .parse()
                     .map_err(|e| {
                         anyhow::anyhow!(
-                            "Column [{}] dataType is [{}] but value is [{}], err: {}",
+                            "Column [{}] dataType is [{field_type}] but value is [{}], err: {e}",
                             cond.column,
-                            field_type,
                             cond.value,
-                            e
                         )
                     })?
             };
             match cond.operator {
-                Operator::EqualTo => format!("\"{}\" {} {}", field_alias, "=", val),
-                Operator::NotEqualTo => format!("\"{}\" {} {}", field_alias, "!=", val),
-                Operator::GreaterThan => format!("\"{}\" {} {}", field_alias, ">", val),
+                Operator::EqualTo => format!("\"{field_alias}\" = {val}"),
+                Operator::NotEqualTo => format!("\"{field_alias}\" != {val}"),
+                Operator::GreaterThan => format!("\"{field_alias}\" > {val}"),
                 Operator::GreaterThanEquals => {
-                    format!("\"{}\" {} {}", field_alias, ">=", val)
+                    format!("\"{field_alias}\" >= {val}")
                 }
-                Operator::LessThan => format!("\"{}\" {} {}", field_alias, "<", val),
+                Operator::LessThan => format!("\"{field_alias}\" < {val}"),
                 Operator::LessThanEquals => {
-                    format!("\"{}\" {} {}", field_alias, "<=", val)
+                    format!("\"{field_alias}\" <= {val}")
                 }
                 _ => {
                     return Err(anyhow::anyhow!(
-                        "Column {} has data_type [{}] and it does not supported operator [{:?}]",
+                        "Column {} has data_type [{field_type}] and it does not supported operator [{:?}]",
                         cond.column,
-                        field_type,
                         cond.operator
                     ));
                 }
@@ -829,30 +825,27 @@ fn build_expr(
                     .parse()
                     .map_err(|e| {
                         anyhow::anyhow!(
-                            "Column [{}] dataType is [{}] but value is [{}], err: {}",
+                            "Column [{}] dataType is [{field_type}] but value is [{}], err: {e}",
                             cond.column,
-                            field_type,
                             cond.value,
-                            e
                         )
                     })?
             };
             match cond.operator {
-                Operator::EqualTo => format!("\"{}\" {} {}", field_alias, "=", val),
-                Operator::NotEqualTo => format!("\"{}\" {} {}", field_alias, "!=", val),
-                Operator::GreaterThan => format!("\"{}\" {} {}", field_alias, ">", val),
+                Operator::EqualTo => format!("\"{field_alias}\" = {val}"),
+                Operator::NotEqualTo => format!("\"{field_alias}\" != {val}"),
+                Operator::GreaterThan => format!("\"{field_alias}\" > {val}"),
                 Operator::GreaterThanEquals => {
-                    format!("\"{}\" {} {}", field_alias, ">=", val)
+                    format!("\"{field_alias}\" >= {val}")
                 }
-                Operator::LessThan => format!("\"{}\" {} {}", field_alias, "<", val),
+                Operator::LessThan => format!("\"{field_alias}\" < {val}"),
                 Operator::LessThanEquals => {
-                    format!("\"{}\" {} {}", field_alias, "<=", val)
+                    format!("\"{field_alias}\" <= {val}")
                 }
                 _ => {
                     return Err(anyhow::anyhow!(
-                        "Column {} has data_type [{}] and it does not supported operator [{:?}]",
+                        "Column {} has data_type [{field_type}] and it does not supported operator [{:?}]",
                         cond.column,
-                        field_type,
                         cond.operator
                     ));
                 }
@@ -868,22 +861,19 @@ fn build_expr(
                     .parse()
                     .map_err(|e| {
                         anyhow::anyhow!(
-                            "Column [{}] dataType is [{}] but value is [{}], err: {}",
+                            "Column [{}] dataType is [{field_type}] but value is [{}], err: {e}",
                             cond.column,
-                            field_type,
                             cond.value,
-                            e
                         )
                     })?
             };
             match cond.operator {
-                Operator::EqualTo => format!("\"{}\" {} {}", field_alias, "=", val),
-                Operator::NotEqualTo => format!("\"{}\" {} {}", field_alias, "!=", val),
+                Operator::EqualTo => format!("\"{field_alias}\" = {val}"),
+                Operator::NotEqualTo => format!("\"{field_alias}\" != {val}"),
                 _ => {
                     return Err(anyhow::anyhow!(
-                        "Column {} has data_type [{}] and it does not supported operator [{:?}]",
+                        "Column {} has data_type [{field_type}] and it does not supported operator [{:?}]",
                         cond.column,
-                        field_type,
                         cond.operator
                     ));
                 }
@@ -891,9 +881,8 @@ fn build_expr(
         }
         _ => {
             return Err(anyhow::anyhow!(
-                "Column {} has data_type [{}] and it does not supported by alert, if you think this is a bug please report it to us",
+                "Column {} has data_type [{field_type}] and it does not supported by alert, if you think this is a bug please report it to us",
                 cond.column,
-                field_type
             ));
         }
     };