Add trace.id and transaction.id

docs/field-details.asciidoc

@@ -2910,6 +2910,47 @@ type: long
 // ===============================================================
 
 
+|=====
+
+[[ecs-tracing]]
+=== Tracing Fields
+
+Distributed tracing makes it possible to analyze performance throughout a microservice architecture all in one view. This is accomplished by tracing all of the requests - from the initial web request in the front-end service - to queries made through multiple back-end services.
+
+==== Tracing Field Details
+
+[options="header"]
+|=====
+| Field  | Description | Level
+
+// ===============================================================
+
+| trace.id
+| Unique identifier of the trace.
+
+A trace groups multiple events like transactions that belong together. For example, a user request handled by multiple inter-connected services.
+
+type: keyword
+
+example: `4bf92f3577b34da6a3ce929d0e0e4736`
+
+| extended
+
+// ===============================================================
+
+| transaction.id
+| Unique identifier of the transaction.
+
+A transaction is the highest level of work measured within a service, such as a request to a server.
+
+type: keyword
+
+example: `00f067aa0ba902b7`
+
+| extended
+
+// ===============================================================
+
 |=====
 
 [[ecs-url]]

docs/fields.asciidoc

@@ -70,6 +70,8 @@ all fields are defined.
 
 | <<ecs-source,Source>> | Fields about the source side of a network connection, used with destination.
 
+| <<ecs-tracing,Tracing>> | Fields related to distributed tracing.
+
 | <<ecs-url,URL>> | Fields that let you store URLs in various forms.
 
 | <<ecs-user,User>> | Fields to describe the user relevant to the event.

generated/beats/fields.ecs.yml

@@ -2278,6 +2278,33 @@
       ignore_above: 1024
       description: Short name or login of the user.
       example: albert
+  - name: tracing
+    title: Tracing
+    group: 2
+    description: Distributed tracing makes it possible to analyze performance throughout
+      a microservice architecture all in one view. This is accomplished by tracing
+      all of the requests - from the initial web request in the front-end service
+      - to queries made through multiple back-end services.
+    type: group
+    fields:
+    - name: trace.id
+      level: extended
+      type: keyword
+      ignore_above: 1024
+      description: 'Unique identifier of the trace.
+
+        A trace groups multiple events like transactions that belong together. For
+        example, a user request handled by multiple inter-connected services.'
+      example: 4bf92f3577b34da6a3ce929d0e0e4736
+    - name: transaction.id
+      level: extended
+      type: keyword
+      ignore_above: 1024
+      description: 'Unique identifier of the transaction.
+
+        A transaction is the highest level of work measured within a service, such
+        as a request to a server.'
+      example: 00f067aa0ba902b7
   - name: url
     title: URL
     group: 2

generated/csv/fields.csv

@@ -297,6 +297,8 @@ source.user.group.name,keyword,extended,,1.1.0-dev
 source.user.hash,keyword,extended,,1.1.0-dev
 source.user.id,keyword,core,,1.1.0-dev
 source.user.name,keyword,core,albert,1.1.0-dev
+trace.id,keyword,extended,4bf92f3577b34da6a3ce929d0e0e4736,1.1.0-dev
+transaction.id,keyword,extended,00f067aa0ba902b7,1.1.0-dev
 url.domain,keyword,extended,www.elastic.co,1.1.0-dev
 url.fragment,keyword,extended,,1.1.0-dev
 url.full,keyword,extended,https://www.elastic.co:443/search?q=elasticsearch#top,1.1.0-dev

generated/ecs/ecs_flat.yml

@@ -3314,6 +3314,32 @@ tags:
   order: 1
   short: List of keywords used to tag each event.
   type: keyword
+trace.id:
+  description: 'Unique identifier of the trace.
+
+    A trace groups multiple events like transactions that belong together. For example,
+    a user request handled by multiple inter-connected services.'
+  example: 4bf92f3577b34da6a3ce929d0e0e4736
+  flat_name: trace.id
+  ignore_above: 1024
+  level: extended
+  name: trace.id
+  order: 0
+  short: Unique identifier of the trace.
+  type: keyword
+transaction.id:
+  description: 'Unique identifier of the transaction.
+
+    A transaction is the highest level of work measured within a service, such as
+    a request to a server.'
+  example: 00f067aa0ba902b7
+  flat_name: transaction.id
+  ignore_above: 1024
+  level: extended
+  name: transaction.id
+  order: 1
+  short: Unique identifier of the transaction.
+  type: keyword
 url.domain:
   description: 'Domain of the url, such as "www.elastic.co".
 

generated/ecs/ecs_nested.yml

@@ -3737,6 +3737,45 @@ source:
   short: Fields about the source side of a network connection, used with destination.
   title: Source
   type: group
+tracing:
+  description: Distributed tracing makes it possible to analyze performance throughout
+    a microservice architecture all in one view. This is accomplished by tracing all
+    of the requests - from the initial web request in the front-end service - to queries
+    made through multiple back-end services.
+  fields:
+    trace.id:
+      description: 'Unique identifier of the trace.
+
+        A trace groups multiple events like transactions that belong together. For
+        example, a user request handled by multiple inter-connected services.'
+      example: 4bf92f3577b34da6a3ce929d0e0e4736
+      flat_name: trace.id
+      ignore_above: 1024
+      level: extended
+      name: trace.id
+      order: 0
+      short: Unique identifier of the trace.
+      type: keyword
+    transaction.id:
+      description: 'Unique identifier of the transaction.
+
+        A transaction is the highest level of work measured within a service, such
+        as a request to a server.'
+      example: 00f067aa0ba902b7
+      flat_name: transaction.id
+      ignore_above: 1024
+      level: extended
+      name: transaction.id
+      order: 1
+      short: Unique identifier of the transaction.
+      type: keyword
+  group: 2
+  name: tracing
+  prefix: ''
+  root: true
+  short: Fields related to distributed tracing.
+  title: Tracing
+  type: group
 url:
   description: URL fields provide support for complete or partial URLs, and supports
     the breaking down into scheme, domain, path, and so on.

generated/elasticsearch/6/template.json

@@ -1414,6 +1414,22 @@
           "ignore_above": 1024, 
           "type": "keyword"
         }, 
+        "trace": {
+          "properties": {
+            "id": {
+              "ignore_above": 1024, 
+              "type": "keyword"
+            }
+          }
+        }, 
+        "transaction": {
+          "properties": {
+            "id": {
+              "ignore_above": 1024, 
+              "type": "keyword"
+            }
+          }
+        }, 
         "url": {
           "properties": {
             "domain": {

generated/elasticsearch/7/template.json

@@ -1413,6 +1413,22 @@
         "ignore_above": 1024, 
         "type": "keyword"
       }, 
+      "trace": {
+        "properties": {
+          "id": {
+            "ignore_above": 1024, 
+            "type": "keyword"
+          }
+        }
+      }, 
+      "transaction": {
+        "properties": {
+          "id": {
+            "ignore_above": 1024, 
+            "type": "keyword"
+          }
+        }
+      }, 
       "url": {
         "properties": {
           "domain": {

generated/legacy/template.json

@@ -848,6 +848,26 @@
           "ignore_above": 1024,
           "type": "keyword"
         },
+        "tracing": {
+          "properties": {
+            "trace": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "transaction": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
         "url": {
           "properties": {
             "domain": {

schema.json

@@ -2053,6 +2053,35 @@
     "title": "Source", 
     "type": "group"
   }, 
+  "tracing": {
+    "description": "Distributed tracing makes it possible to analyze performance throughout a microservice architecture all in one view. This is accomplished by tracing all of the requests - from the initial web request in the front-end service - to queries made through multiple back-end services.\n", 
+    "fields": {
+      "tracing.trace.id": {
+        "description": "Unique identifier of the trace.\nA trace groups multiple events like transactions that belong together. For example, a user request handled by multiple inter-connected services.", 
+        "example": "4bf92f3577b34da6a3ce929d0e0e4736", 
+        "footnote": "", 
+        "group": 2, 
+        "level": "extended", 
+        "name": "tracing.trace.id", 
+        "required": false, 
+        "type": "keyword"
+      }, 
+      "tracing.transaction.id": {
+        "description": "Unique identifier of the transaction.\nA transaction is the highest level of work measured within a service, such as a request to a server.", 
+        "example": "00f067aa0ba902b7", 
+        "footnote": "", 
+        "group": 2, 
+        "level": "extended", 
+        "name": "tracing.transaction.id", 
+        "required": false, 
+        "type": "keyword"
+      }
+    }, 
+    "group": 2, 
+    "name": "tracing", 
+    "title": "Tracing", 
+    "type": "group"
+  }, 
   "url": {
     "description": "URL fields provide support for complete or partial URLs, and supports the breaking down into scheme, domain, path, and so on.\n", 
     "fields": {

schemas/tracing.yml

@@ -0,0 +1,30 @@
+---
+- name: tracing
+  title: Tracing
+  root: true
+  group: 2
+  short: Fields related to distributed tracing. 
+  description: >
+    Distributed tracing makes it possible to analyze performance throughout a microservice architecture all in one view.
+    This is accomplished by tracing all of the requests - from the initial web request in the front-end service - to queries made through multiple back-end services.
+  type: group
+  fields:
+    - name: trace.id
+      level: extended
+      type: keyword
+      example: 4bf92f3577b34da6a3ce929d0e0e4736
+      short: Unique identifier of the trace.
+      description: >
+        Unique identifier of the trace.
+
+        A trace groups multiple events like transactions that belong together.
+        For example, a user request handled by multiple inter-connected services.
+    - name: transaction.id
+      level: extended
+      type: keyword
+      example: 00f067aa0ba902b7
+      short: Unique identifier of the transaction.
+      description: >
+        Unique identifier of the transaction.
+
+        A transaction is the highest level of work measured within a service, such as a request to a server.

use-cases/apm.yml

@@ -55,3 +55,4 @@ fields:
       description: >
         Version of the service the agent is running in. This depends
         on if the service is given a version.
+