Service map in Elastic APM

A service map is a real-time visual representation of the instrumented services in your application’s architecture. It shows you how these services are connected, along with high-level metrics like average transaction duration, requests per minute, and errors per minute. If enabled, service maps also integrate with machine learning—displaying real-time anomaly indicators based on anomaly detection scores. All of these features can help you quickly and visually assess your services’ status.

You can view all your instrumented services and the connections between them, or focus on the services that interest you most.

Service Maps rely on distributed traces to draw connections between services. As distributed tracing is enabled out-of-the-box for supported technologies, so are service maps. However, if a service isn’t instrumented, or a traceparent header isn’t being propagated to it, distributed tracing will not work, and the connection will not be drawn on the map.

Select the Service Map tab to get started. By default, all instrumented services and connections are shown. Whether you’re onboarding a new engineer, or just trying to grasp the big picture, drag services around, zoom in and out, and begin to visualize how your services are connected.

Customize what the service map displays using either the query bar or the environment selector. The query bar enables you to use advanced queries to customize the service map based on your needs. The environment selector allows you to narrow displayed results to a specific environment. This can be useful if you have two or more services, in separate environments, but with the same name. Use the environment drop-down to only see the data you’re interested in, like dev or production.

Use the map controls to adjust the layout, filter what’s displayed, and navigate large maps:

• Presentation: Switch between Horizontal and Vertical layout to best fit your architecture.
• Find in page: Search for a specific service by name to locate and highlight it on the map.
• Filters: Use the Dependencies, Alert status, SLO status, and Anomaly severity drop-downs to focus the map on specific services.

To save the current service map view to a Kibana dashboard, click the Copy to dashboard icon located in the upper-right corner of the map.

When you select an instrumented service node (circle shape), a service flyout panel opens with a summary of the service’s RED metrics and infrastructure usage. Use the footer menu to open traces, logs, alerts, or SLOs for the service without leaving the map. Dependency nodes (diamond shape) and connections still use a compact popover.

×

A minimap in the corner of the map lets you see where you are in a large architecture and quickly navigate to a different area.

×

You can create machine learning jobs to calculate anomaly scores on APM transaction durations within the selected service. When these jobs are active, service maps display a color-coded anomaly indicator on each service node based on the detected anomaly score.

To learn how to create a machine learning job, refer to Integrate with machine learning.

To investigate a detected anomaly, select the affected service node to open the service flyout. The flyout header shows a badge with the anomaly severity and score. Select the badge to open the service Overview, filtered to the environment where the anomaly was detected.

For a description of what each color means, refer to Anomaly score colors.

Node borders are color-coded based on the maximum anomaly score:

	Max anomaly score ≤25. Service is healthy.
	Max anomaly score 26-74. Anomalous activity detected. Service might be degraded.
	Max anomaly score ≥75. Anomalous activity detected. Service is unhealthy.

If an anomaly has been detected, click View anomalies to view the anomaly detection metric viewer. This time series analysis displays additional details on the severity and time of the detected anomalies.

×

An interactive legend is available directly on the map. Click the Legend button to expand it and see an explanation of node shapes, connections, and anomaly score colors.

Nodes appear on the map in one of three shapes:

• Circle: Instrumented services. Interior icons are based on the language of the APM agent used.
• Diamond: Databases, external, and messaging. Interior icons represent the generic type, with specific icons for known entities, like Elasticsearch. Type and subtype are based on span.type, and span.subtype.
• Grouped resources: Groups of related external resources or dependencies, such as those sharing a namespace or label.

Connections between nodes represent observed communication between services based on distributed trace data:

• One-way: Traffic flows in a single direction between services. The arrow indicates the direction of the request.
• Two-way: Traffic flows in both directions between services.

When anomaly detection is enabled, node borders are color-coded based on the maximum anomaly score detected for that service:

Service Maps are supported for the following APM agent versions: