ElasticAPMSpanId does not show up

@NoviceESCoder this is very likely because there is no active span when the log event is generated.

These 3 fields are added when there are active APM events.traceid and transactionid is present when there is an active APM Transaction, spanid is only added when there is an active span. An APM transaction is for example in ASP.NET Core an HTTP request - so the transaction starts when the HTTP request hits the ASP.NET Core pipeline and ends when a response is sent back. Now, a span is some action within the transaction - e.g. an outgoing HTTP call, a call to a database, a call to Elasticsearch, or some span started manually with the Agent API.

The APM-Log correlation in Kibana right now is mainly based on the transaction id - so with the missing spanid you won't really miss any functionality. But even if there would be some other functionality based on this field - it still is normal and would be expected that the field is not present on the log event when there is no active transaction.

This part of our docs is a good start to understand the APM data model and learn about what a transaction and what a span is.