ElasticAPMSpanId does not show up

Elastic Observability APM
1

I have installed the NuGet package Elastic.Apm.SerilogEnricher to my asp.net core web app (mvc) project. My application is using Serilog to write logs directly to elasticsearch. When I added this NuGet package it tells me that it will include 3 properties. 1) ElasticApmTraceId 2) ElasticApmTransactionId 3) ElasticApmSpanId. On my application I added .Enrich.WithElasticApmCorrelationInfo() inside of my .UseSerilog(), I run the application perform operations on it. Then when I go to the CLI in Kibana and do a DSL query search I get all the logs back, however when trying to search for ElasticApmSpanId it is no where to be found. I only see ElasticApmTraceId and ElasticApmTransactionId. Am I using this package incorrectly?

Inside of my Program.cs file:

public static IHostBuilder CreateHostBuilder(string[] args) =>
            Host.CreateDefaultBuilder(args)
                .UseSerilog((context, configuration) =>
                {
                    configuration.Enrich.FromLogContext()
                        .Enrich.WithElasticApmCorrelationInfo()
                        .Enrich.WithMachineName()
                        .WriteTo.Console()
                        .WriteTo.Elasticsearch(new ElasticsearchSinkOptions(new Uri(context.Configuration["ElasticConfiguration:Uri"]))
                        {
                            IndexFormat = $"{context.Configuration["ApplicationName"]}-logs-{context.HostingEnvironment.EnvironmentName?.ToLower().Replace(".", "-")}-{DateTime.UtcNow:yyyy-MM}",
                            AutoRegisterTemplate = true
                        })
                        .Enrich.WithProperty("Environment", context.HostingEnvironment.EnvironmentName)
                        .ReadFrom.Configuration(context.Configuration);
                })
                .ConfigureWebHostDefaults(webBuilder =>
                {
                    webBuilder.UseStartup<Startup>();
                })
                .UseAllElasticApm();

image
image1910×884 80.2 KB

When I try to search the entire logs for ElasticApmSpanId:

image
image1070×423 33.1 KB

2

@NoviceESCoder this is very likely because there is no active span when the log event is generated.

These 3 fields are added when there are active APM events.traceid and transactionid is present when there is an active APM Transaction, spanid is only added when there is an active span. An APM transaction is for example in ASP.NET Core an HTTP request - so the transaction starts when the HTTP request hits the ASP.NET Core pipeline and ends when a response is sent back. Now, a span is some action within the transaction - e.g. an outgoing HTTP call, a call to a database, a call to Elasticsearch, or some span started manually with the Agent API.

The APM-Log correlation in Kibana right now is mainly based on the transaction id - so with the missing spanid you won't really miss any functionality. But even if there would be some other functionality based on this field - it still is normal and would be expected that the field is not present on the log event when there is no active transaction.

This part of our docs is a good start to understand the APM data model and learn about what a transaction and what a span is.

3

I was not aware of this with the span id, but it is definitely making a lot of sense why it is not populating. Thank you for providing me with this clarification and documentations!

4

In addition to @GregKalapos answer, note that ElasticApmSpanId is included in 1.6.0-alpha1 package version onwards. See the release notes for more details

1 Like
5

This topic was automatically closed 20 days after the last reply. New replies are no longer allowed.