General APM fieldsedit
Fields common to various APM events.
-
processor.name
-
Processor name.
type: keyword
-
processor.event
-
Processor event.
type: keyword
-
timestamp.us
-
Timestamp of the event in microseconds since Unix epoch.
type: long
urledit
A complete Url, with scheme, host and path.
-
url.scheme
-
The protocol of the request, e.g. "https:".
type: keyword
-
url.full
-
The full, possibly agent-assembled URL of the request, e.g https://example.com:443/search?q=elasticsearch#top.
type: keyword
-
url.domain
-
The hostname of the request, e.g. "example.com".
type: keyword
-
url.port
-
The port of the request, e.g. 443.
type: long
-
url.path
-
The path of the request, e.g. "/search".
type: keyword
-
url.query
-
The query string of the request, e.g. "q=elasticsearch".
type: keyword
-
url.fragment
-
A fragment specifying a location in a web page , e.g. "top".
type: keyword
-
http.version
-
The http version of the request leading to this event.
type: keyword
-
http.request.method
-
The http method of the request leading to this event.
type: keyword
-
http.request.headers
-
The canonical headers of the monitored HTTP request.
type: object
Object is not enabled.
-
http.response.status_code
-
The status code of the HTTP response.
type: long
-
http.response.finished
-
Used by the Node agent to indicate when in the response life cycle an error has occurred.
type: boolean
-
http.response.headers
-
The canonical headers of the monitored HTTP response.
type: object
Object is not enabled.
-
labels
-
A flat mapping of user-defined labels with string, boolean or number values.
type: object
serviceedit
Service fields.
-
service.name
-
Immutable name of the service emitting this event.
type: keyword
-
service.version
-
Version of the service emitting this event.
type: keyword
-
service.environment
-
Service environment.
type: keyword
-
service.node.name
-
Unique meaningful name of the service node.
type: keyword
-
service.language.name
-
Name of the programming language used.
type: keyword
-
service.language.version
-
Version of the programming language used.
type: keyword
-
service.runtime.name
-
Name of the runtime used.
type: keyword
-
service.runtime.version
-
Version of the runtime used.
type: keyword
-
service.framework.name
-
Name of the framework used.
type: keyword
-
service.framework.version
-
Version of the framework used.
type: keyword
-
transaction.id
-
The transaction ID.
type: keyword
-
transaction.sampled
-
Transactions that are sampled will include all available information. Transactions that are not sampled will not have spans or context.
type: boolean
-
transaction.type
-
Keyword of specific relevance in the service’s domain (eg. request, backgroundjob, etc)
type: keyword
-
transaction.name
-
Generic designation of a transaction in the scope of a single service (eg. GET /users/:id).
type: keyword
-
transaction.name.text
-
type: text
durationedit
None
-
transaction.duration.count
-
type: long
-
transaction.duration.sum.us
-
type: long
self_timeedit
Portion of the transaction’s duration where no direct child was running
-
transaction.self_time.count
-
type: long
-
transaction.self_time.sum.us
-
type: long
breakdownedit
Counter for collected breakdowns for the transaction
-
transaction.breakdown.count
-
type: long
-
span.type
-
Keyword of specific relevance in the service’s domain (eg: db.postgresql.query, template.erb, cache, etc).
type: keyword
-
span.subtype
-
A further sub-division of the type (e.g. postgresql, elasticsearch)
type: keyword
self_timeedit
Portion of the span’s duration where no direct child was running
-
span.self_time.count
-
type: long
-
span.self_time.sum.us
-
type: long
-
trace.id
-
The ID of the trace to which the event belongs to.
type: keyword
-
parent.id
-
The ID of the parent event.
type: keyword
-
agent.name
-
Name of the agent used.
type: keyword
-
agent.version
-
Version of the agent used.
type: keyword
-
agent.ephemeral_id
-
The Ephemeral ID identifies a running process.
type: keyword
containeredit
Container fields are used for meta information about the specific container that is the source of information. These fields help correlate data based containers from any runtime.
-
container.id
-
Unique container id.
type: keyword
kubernetesedit
Kubernetes metadata reported by agents
-
kubernetes.namespace
-
Kubernetes namespace
type: keyword
-
kubernetes.node.name
-
Kubernetes node name
type: keyword
-
kubernetes.pod.name
-
Kubernetes pod name
type: keyword
-
kubernetes.pod.uid
-
Kubernetes Pod UID
type: keyword
hostedit
Optional host fields.
-
host.architecture
-
The architecture of the host the event was recorded on.
type: keyword
-
host.hostname
-
The hostname of the host the event was recorded on.
type: keyword
-
host.name
-
Name of the host the event was recorded on. It can contain same information as host.hostname or a name specified by the user.
type: keyword
-
host.ip
-
IP of the host that records the event.
type: ip
osedit
The OS fields contain information about the operating system.
-
host.os.platform
-
The platform of the host the event was recorded on.
type: keyword
processedit
Information pertaining to the running process where the data was collected
-
process.args
-
Process arguments. May be filtered to protect sensitive information.
type: keyword
-
process.pid
-
Numeric process ID of the service process.
type: long
-
process.ppid
-
Numeric ID of the service’s parent process.
type: long
-
process.title
-
Service process title.
type: keyword
-
observer.listening
-
Address the server is listening on.
type: keyword
-
observer.hostname
-
Hostname of the APM Server.
type: keyword
-
observer.version
-
APM Server version.
type: keyword
-
observer.version_major
-
Major version number of the observer
type: byte
-
observer.type
-
The type will be set to
apm-server
.type: keyword
-
user.name
-
The username of the logged in user.
type: keyword
-
user.id
-
Identifier of the logged in user.
type: keyword
-
user.email
-
Email of the logged in user.
type: keyword
-
client.ip
-
IP address of the client of a recorded event. This is typically obtained from a request’s X-Forwarded-For or the X-Real-IP header or falls back to a given configuration for remote address.
type: ip
-
source.ip
-
IP address of the source of a recorded event. This is typically obtained from a request’s X-Forwarded-For or the X-Real-IP header or falls back to a given configuration for remote address.
type: ip
destinationedit
Destination fields describe details about the destination of a packet/event. Destination fields are usually populated in conjunction with source fields.
-
destination.address
-
Some event destination addresses are defined ambiguously. The event will sometimes list an IP, a domain or a unix socket. You should always store the raw address in the
.address
field. Then it should be duplicated to.ip
or.domain
, depending on which one it is.type: keyword
-
destination.ip
-
IP addess of the destination. Can be one of multiple IPv4 or IPv6 addresses.
type: ip
-
destination.port
-
Port of the destination.
type: long
format: string
user_agentedit
The user_agent fields normally come from a browser request. They often show up in web service logs coming from the parsed user agent string.
-
user_agent.original
-
Unparsed version of the user_agent.
type: keyword
example: Mozilla/5.0 (iPhone; CPU iPhone OS 12_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0 Mobile/15E148 Safari/604.1
-
user_agent.original.text
-
Software agent acting in behalf of a user, eg. a web browser / OS combination.
type: text
-
user_agent.name
-
Name of the user agent.
type: keyword
example: Safari
-
user_agent.version
-
Version of the user agent.
type: keyword
example: 12.0
deviceedit
Information concerning the device.
-
user_agent.device.name
-
Name of the device.
type: keyword
example: iPhone
osedit
The OS fields contain information about the operating system.
-
user_agent.os.platform
-
Operating system platform (such centos, ubuntu, windows).
type: keyword
example: darwin
-
user_agent.os.name
-
Operating system name, without the version.
type: keyword
example: Mac OS X
-
user_agent.os.full
-
Operating system name, including the version or code name.
type: keyword
example: Mac OS Mojave
-
user_agent.os.family
-
OS family (such as redhat, debian, freebsd, windows).
type: keyword
example: debian
-
user_agent.os.version
-
Operating system version as a raw string.
type: keyword
example: 10.14.1
-
user_agent.os.kernel
-
Operating system kernel version as a raw string.
type: keyword
example: 4.4.0-112-generic
-
experimental
-
Additional experimental data sent by the agents.
type: object