Jump from trace-id in discovery mode to apm trace view

Elastic Observability APM
,
1

I can use the Trace Overview to view the logs of a specific trace. Is it vice versa possible to use the trace ID in the discovery overview to display the corresponding trace in the APM App?
In other words, with a respective shortcut and not via the filter- search function function in the APM App

2

Yes, that’s possible from within the actions menu of the logs app if your log has the trace.id field.

3

How do I enable the trace.id field for my filebeat logs?
Are there any specific settings I can adjust?

4

Refer to your specific agent’s log correlation documentation for that. For example https://www.elastic.co/guide/en/apm/agent/java/current/log-correlation.html

5

I followed along the instructions.
Added ECS-based logging for Java applications as:

<dependency>
      <groupId>co.elastic.logging</groupId>
      <artifactId>logback-ecs-encoder</artifactId>
      <version>0.4.0</version>
  </dependency>

Adjusted filebeat-config.yml:

filebeat.inputs:
  - type: container
    json:
      message_key: message
      keys_under_root: true
      overwrite_keys: true
      add_error_key: true
    multiline:
      pattern: '([0-9]{4}-[0-9]{2}-[0-9]{2}(T|\s)[0-9]{2}:[0-9]{2}:[0-9]{2}(\.[0-9]{3})?Z?)'
      negate: true
      match: after
    paths:
      - '/var/lib/docker/containers/*/*.log'
    processors:
      - add_docker_metadata: ~
output.elasticsearch:
  hosts: 
    - elasticsearch:9200
filebeat.config:
  modules:
    path: ${path.config}/modules.d/*.yml
    reload.enabled: false
filebeat.autodiscover:
  providers:
    - type: docker
      hints.enabled: true
      containers.ids:
        - "${data.docker.container.id}"
setup.kibana:
  host: "kibana:5601"

Added environment variable in my docker-compose file to the agent:
- "ELASTIC_APM_ENABLE_LOG_CORRELATION=true"

Still no tracing.trace.id field logs in for spring boot application in the filebeat logs.
do you have any idea what might have gone wrong?

6

With that config you should be able to see field "trace.id" when executing docker logs <container-id>. Is that not the case?

Note that the trace.id will only be injected for lines logged within the context of a transaction. Are you seeing your transactions in the APM App? Which framework are you using? Spring boot?

7

No there is no trace.id in my docker logs spring-boot-app logs.
I can see the transactions in the apm app.
I'm using spring boot for the framework

8

Could you share your debug logs as described here: https://www.elastic.co/guide/en/apm/agent/java/current/trouble-shooting.html?

9

I got transaction.id and trace.id in my filebeat message but no fields in kibana. What to do now?
{"@timestamp":"2020-06-11T09:25:28.500Z", "log.level":"DEBUG", "message":"Using 'application/json', given [*/*] and supported [application/json, application/*+json, application/json, application/*+json]", "service.name":"spring-template","event.dataset":"spring-template.log","process.thread.name":"http-nio-8080-exec-7","log.logger":"org.springframework.web.servlet.mvc.method.annotation.RequestResponseBodyMethodProcessor","transaction.id":"b8b21f97ff49f2ed","trace.id":"7576d6aa71bb5c7242b6a0c52df33d18"}

10

Check out the recommended Filebeat configuration: https://github.com/elastic/ecs-logging-java#step-3-filebeat-configuration

11

This topic was automatically closed 20 days after the last reply. New replies are no longer allowed.