[SOLVED] Elastic APM traces link to logs

Elastic APM traces link to logs

I would like to link my logs in elastics to APM traces. I'm using .net core 7 with couple of libraries:

<PackageReference Include="Elastic.Apm.AspNetCore" Version="1.19.0"/>
<PackageReference Include="Elastic.Apm.SerilogEnricher" Version="1.5.3"/>
<PackageReference Include="Elastic.Apm.SqlClient" Version="1.19.0"/>

APM traces looks nice in Kibana - I can see traces across multiple services, DB and so on.

I've got my logs in elastic with necessary fields:

ElasticApmTraceId
ElasticApmTransactionId

I also see my logs in Observability -> Logs -> Stream.

But when I open Observability -> APM -> Service -> MyServiceName I see nice overview with traces, but without linked logs. I got following message:

There are no log messages to display.

I also tried to added following fields to log message, but it did not help:

TransactionId
TraceId
transaction.id
trace.id

My services are running in Kubernetes.

Elastic stack version is 8.4.3

Any ideas which configuration is missing in ELK?

Solution

I've managed to add logs to Observability -> APM -> Service -> MyServiceName -> Logs tab.

ELK expects you to have service.name property in your log documents. This property could be added by your log aggregator or by app itself. I used following code to do it:

public class ElasticApmLogEnricher : ILogEventEnricher
{
    private readonly string ServiceName; 
    
    public ElasticApmLogEnricher(string serviceName)
    {
        ServiceName = serviceName;
    }

    public void Enrich(LogEvent logEvent, ILogEventPropertyFactory propertyFactory)
    {
        if (!Agent.IsConfigured) return;
        if (Agent.Tracer?.CurrentTransaction == null) return;

        logEvent.AddPropertyIfAbsent(propertyFactory.CreateProperty(
            "service.name", ServiceName));
    }
}