Jump from trace-id in discovery mode to apm trace view


I can use the Trace Overview to view the logs of a specific trace. Is it vice versa possible to use the trace ID in the discovery overview to display the corresponding trace in the APM App?
In other words, with a respective shortcut and not via the filter- search function function in the APM App

Yes, that’s possible from within the actions menu of the logs app if your log has the trace.id field.

How do I enable the trace.id field for my filebeat logs?
Are there any specific settings I can adjust?

Refer to your specific agent’s log correlation documentation for that. For example https://www.elastic.co/guide/en/apm/agent/java/current/log-correlation.html

I followed along the instructions.
Added ECS-based logging for Java applications as:


Adjusted filebeat-config.yml:

  - type: container
      message_key: message
      keys_under_root: true
      overwrite_keys: true
      add_error_key: true
      pattern: '([0-9]{4}-[0-9]{2}-[0-9]{2}(T|\s)[0-9]{2}:[0-9]{2}:[0-9]{2}(\.[0-9]{3})?Z?)'
      negate: true
      match: after
      - '/var/lib/docker/containers/*/*.log'
      - add_docker_metadata: ~
    - elasticsearch:9200
    path: ${path.config}/modules.d/*.yml
    reload.enabled: false
    - type: docker
      hints.enabled: true
        - "${data.docker.container.id}"
  host: "kibana:5601"

Added environment variable in my docker-compose file to the agent:

Still no tracing.trace.id field logs in for spring boot application in the filebeat logs.
do you have any idea what might have gone wrong?

With that config you should be able to see field "trace.id" when executing docker logs <container-id>. Is that not the case?

Note that the trace.id will only be injected for lines logged within the context of a transaction. Are you seeing your transactions in the APM App? Which framework are you using? Spring boot?

No there is no trace.id in my docker logs spring-boot-app logs.
I can see the transactions in the apm app.
I'm using spring boot for the framework

Could you share your debug logs as described here: https://www.elastic.co/guide/en/apm/agent/java/current/trouble-shooting.html?

I got transaction.id and trace.id in my filebeat message but no fields in kibana. What to do now?
{"@timestamp":"2020-06-11T09:25:28.500Z", "log.level":"DEBUG", "message":"Using 'application/json', given [*/*] and supported [application/json, application/*+json, application/json, application/*+json]", "service.name":"spring-template","event.dataset":"spring-template.log","process.thread.name":"http-nio-8080-exec-7","log.logger":"org.springframework.web.servlet.mvc.method.annotation.RequestResponseBodyMethodProcessor","transaction.id":"b8b21f97ff49f2ed","trace.id":"7576d6aa71bb5c7242b6a0c52df33d18"}

Check out the recommended Filebeat configuration: https://github.com/elastic/ecs-logging-java#step-3-filebeat-configuration

This topic was automatically closed 20 days after the last reply. New replies are no longer allowed.