Strange behaviour with APM and negation filters

Elastic Observability APM
,
1

Kibana version: tested on 7.17.8 and latest (8) locally

Elasticsearch version: same

APM Server version: same

APM Agent language and version: python

Browser version: chrome

Original install method (e.g. download page, yum, deb, from source, etc.) and version: all

Fresh install or upgraded from other version? both

Is there anything special in your setup? nothing special

Description of the problem including expected versus actual behavior. Please include screenshots (if relevant): In APM view, I want to filter all transactions which are not POST. Using this doc with a NOT keyword... it does not filter correctly transactions... and when I click on a transaction.. I get a error message "The selected trace can not be found"

Steps to reproduce:

  1. go to a service in APM
  2. filter with NOT http.request.method:POST
  3. look at filtered transaction list > we can still see POST transactions
  4. click on a POST transaction which shouldn't be displayed
  5. error message (stack trace not found)
  6. if you remove the NOT in this transaction page, it seems to bring back to a standard behaviour

Errors in browser console (if relevant): ras

Provide logs and/or server output (if relevant): ras

2

Yeah I can see similar behavior... I think what's going on here is that you're not filtering top level transactions in that view, but rather filtering everything. So, you're left with spans which are not filtered out, but have a transaction ID attached to a POST transaction, so that transaction shows up in the list. However, when you click on the transaction, and it tries to load the waterfall, it can't actually find the transaction due to the filter, and it fails.

I modified the filter and was able to see the relevant transactions disappear:

processor.event : "transaction" and NOT http.request.method : "POST"

That limits to just transaction documents when it's filtering, and appears to accomplish your expected behavior.

3

Thank you @basepi

unfortunately it does'nt seems to help... since event by filtering by processor.event like you proposed, I still see exactly the same behaviour (POST are still here etc...)

4

Strange. I don't think this is actually a python issue, so I added the ui tag and hopefully we can get help from the UI folks.