Explore traces in Discover

Important

This functionality is experimental and not supported. It may change or be removed at anytime.

Discover offers a dedicated experience for exploring trace data. When Discover detects data in traces-* indices, it automatically selects relevant fields and enables features that help you investigate distributed traces more effectively. The traces experience includes a pre-selected set of trace fields in the data grid, a structured overview of each document's key attributes, latency comparisons for similar spans, and a waterfall visualization of the full trace timeline.

If you're just getting started with Discover and want to learn its main principles, you should get familiar with the default experience.

Requirements

Data recognition

By default, data stored in traces-* indices is recognized as trace data and triggers the Discover experience described on this page.

Required Kibana privileges

Viewing trace data in Discover requires at least read privileges for Discover.

For more information, refer to Kibana privileges.

Load trace data

The traces experience is available in:

Data view mode: Select a data view that matches a traces-* index pattern from the Discover main page.
ES|QL mode: Select ES|QL and use the FROM command to query your trace data:
```
FROM traces-*
		
```
You can also query a specific index:
```
FROM traces-apm-default
		
```

Traces-specific features

When Discover recognizes trace data, it pre-selects a set of relevant fields as columns in the data grid: service.name, transaction.name, span.name, transaction.duration.us, span.duration.us, and event.outcome.

Overview charts (ES|QL)

In ES|QL mode, Discover displays three summary charts above the results:

Latency: Average response time over the selected time range.
Error Rate: Percentage of failed trace events over time.
Throughput: Number of trace events per unit of time.

ES|QL mode showing Latency, Error Rate, and Throughput summary charts above the trace results.

Trace document overview

Select in any row to open the document detail panel. The Overview tab shows the key attributes of the selected trace document:

Span ID and Span name: Identify the specific operation.
Trace ID: Links all documents that belong to the same trace.
Service name: The service that generated this span.
Duration: How long the operation took, and what percentage of the total trace duration it represents.
Start time: When the operation started.
Type and Subtype: The category of the operation, for example db / postgresql or external / http.