A newer version is available. For the latest information, see the current release documentation.

›

General APM fields

edit

General APM fields

edit

Fields common to various APM events.

processor.name

Processor name.

type: keyword

processor.event

Processor event.

type: keyword

timestamp.us

Timestamp of the event in microseconds since Unix epoch.

type: long

url

edit

A complete Url, with scheme, host and path.

url.scheme

The protocol of the request, e.g. "https:".

type: keyword

url.full

The full, possibly agent-assembled URL of the request, e.g https://example.com:443/search?q=elasticsearch#top.

type: keyword

url.domain

The hostname of the request, e.g. "example.com".

type: keyword

url.port

The port of the request, e.g. 443.

type: long

url.path

The path of the request, e.g. "/search".

type: keyword

url.query

The query string of the request, e.g. "q=elasticsearch".

type: keyword

url.fragment

A fragment specifying a location in a web page , e.g. "top".

type: keyword

http.version

The http version of the request leading to this event.

type: keyword

http.request.method

The http method of the request leading to this event.

type: keyword

http.request.headers

The canonical headers of the monitored HTTP request.

type: object

Object is not enabled.

http.response.status_code

The status code of the HTTP response.

type: long

http.response.finished

Used by the Node agent to indicate when in the response life cycle an error has occurred.

type: boolean

http.response.headers

The canonical headers of the monitored HTTP response.

type: object

Object is not enabled.

labels

A flat mapping of user-defined labels with string, boolean or number values.

type: object

service

edit

Service fields.

service.name

Immutable unique name of the service emitting this event.

type: keyword

service.version

Version of the service emitting this event.

type: keyword

service.environment

Service environment.

type: keyword

service.language.name

Name of the programming language used.

type: keyword

service.language.version

Version of the programming language used.

type: keyword

service.runtime.name

Name of the runtime used.

type: keyword

service.runtime.version

Version of the runtime used.

type: keyword

service.framework.name

Name of the framework used.

type: keyword

service.framework.version

Version of the framework used.

type: keyword

transaction.id

The transaction ID.

type: keyword

transaction.sampled

Transactions that are sampled will include all available information. Transactions that are not sampled will not have spans or context.

type: boolean

transaction.type

Keyword of specific relevance in the service’s domain (eg. request, backgroundjob, etc)

type: keyword

transaction.name

Generic designation of a transaction in the scope of a single service (eg. GET /users/:id).

type: keyword

transaction.name.text

type: text

duration

edit

None

transaction.duration.count: type: long
transaction.duration.sum.us: type: long

self_time

edit

Portion of the transaction’s duration where no direct child was running

transaction.self_time.count: type: long
transaction.self_time.sum.us: type: long

breakdown

edit

Counter for collected breakdowns for the transaction

transaction.breakdown.count

type: long

span.type

Keyword of specific relevance in the service’s domain (eg: db.postgresql.query, template.erb, cache, etc).

type: keyword

span.subtype

A further sub-division of the type (e.g. postgresql, elasticsearch)

type: keyword

self_time

edit

Portion of the span’s duration where no direct child was running

span.self_time.count

type: long

span.self_time.sum.us

type: long

trace.id

The ID of the trace to which the event belongs to.

type: keyword

parent.id

The ID of the parent event.

type: keyword

agent.name

Name of the agent used.

type: keyword

agent.version

Version of the agent used.

type: keyword

agent.ephemeral_id

The Ephemeral ID identifies a running process.

type: keyword

container

edit

Container fields are used for meta information about the specific container that is the source of information. These fields help correlate data based containers from any runtime.

container.id

Unique container id.

type: keyword

kubernetes

edit

Kubernetes metadata reported by agents

kubernetes.namespace

Kubernetes namespace

type: keyword

kubernetes.node.name

Kubernetes node name

type: keyword

kubernetes.pod.name

Kubernetes pod name

type: keyword

kubernetes.pod.uid

Kubernetes Pod UID

type: keyword

host

edit

Optional host fields.

host.architecture

The architecture of the host the event was recorded on.

type: keyword

host.hostname

The hostname of the host the event was recorded on.

type: keyword

host.ip

IP of the host that records the event.

type: ip

os

edit

The OS fields contain information about the operating system.

host.os.platform

The platform of the host the event was recorded on.

type: keyword

process

edit

Information pertaining to the running process where the data was collected

process.args

Process arguments. May be filtered to protect sensitive information.

type: keyword

process.pid

Numeric process ID of the service process.

type: long

process.ppid

Numeric ID of the service’s parent process.

type: long

process.title

Service process title.

type: keyword

observer.listening

Address the server is listening on.

type: keyword

observer.hostname

Hostname of the APM Server.

type: keyword

observer.version

APM Server version.

type: keyword

observer.version_major

Major version number of the observer

type: byte

observer.type

The type will be set to apm-server.

type: keyword

user.name

The username of the logged in user.

type: keyword

user.id

Identifier of the logged in user.

type: keyword

user.email

Email of the logged in user.

type: keyword

client.ip

IP of the user where the event is recorded, typically a web browser. This is obtained from the X-Forwarded-For header, of which the first entry is the IP of the original client. This value however might not be necessarily trusted, as it can be forged by a malicious user.

type: ip

user_agent

edit

The user_agent fields normally come from a browser request. They often show up in web service logs coming from the parsed user agent string.

user_agent.original

Unparsed version of the user_agent.

type: keyword

example: Mozilla/5.0 (iPhone; CPU iPhone OS 12_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0 Mobile/15E148 Safari/604.1

user_agent.original.text

Software agent acting in behalf of a user, eg. a web browser / OS combination.

type: text

user_agent.name

Name of the user agent.

type: keyword

example: Safari

user_agent.version

Version of the user agent.

type: keyword

example: 12.0

device

edit

Information concerning the device.

user_agent.device.name

Name of the device.

type: keyword

example: iPhone

os

edit

The OS fields contain information about the operating system.

user_agent.os.platform

Operating system platform (such centos, ubuntu, windows).

type: keyword

example: darwin

user_agent.os.name

Operating system name, without the version.

type: keyword

example: Mac OS X

user_agent.os.full

Operating system name, including the version or code name.

type: keyword

example: Mac OS Mojave

user_agent.os.family

OS family (such as redhat, debian, freebsd, windows).

type: keyword

example: debian

user_agent.os.version

Operating system version as a raw string.

type: keyword

example: 10.14.1

user_agent.os.kernel

Operating system kernel version as a raw string.

type: keyword

example: 4.4.0-112-generic

experimental

Additional experimental data sent by the agents.

type: object

« Exported fields APM Error fields »