Hello, we are using the latest Elastic Cloud (ver. 8.4) with APM. We are sending logs using filebeat in ECS format. We can see logs coming in and
trace.id is present in log events. We also have APM data flowing properly and we can see traces. However when trying to lookup logs by the trace we get the following error:
This looks like a bug - the bracket in that KQL query should be outside the quote. Is there a way to fix it?
Hi @schikin-sw , thanks for your message.
This bug was already fixed on this PR [APM] Fix invalid KQL query by kpatticha · Pull Request #139694 · elastic/kibana · GitHub. It was backported to
8.4.1 version. If you can, please update to this minor version and the bug is will be fixed.
Hi I got the same problem. Are you in any case using openTelemetry with an otel collector?
If yes, are able to see labels of span events? Cheers