Log correlation

In order to correlate logs from your app with transactions captured by the Elastic APM Node.js Agent, your logs must contain one or more of the following identifiers:

The Node.js Agent provides the apm.currentTraceIds method to help with this task.

apm.currentTraceIds produces an object containing trace.id and either transaction.id or span.id when a current transaction or span is available. When no transaction or span is available it will return an empty object. This enables log correlation to APM traces with structured loggers.

{
  "trace.id": "abc123",
  "transaction.id": "abc123"
}
// or ...
{
  "trace.id": "abc123",
  "span.id": "abc123"
}

All current trace id objects, including the empty form, include a toString() implementation. This enables log correlation to APM traces with text-only loggers.

"trace.id=abc123 transaction.id=abc123"
// or ...
"trace.id=abc123 span.id=abc123"

Using your favorite logging framework, you’d then need to inject this information into your logs.

When your logs contain the appropriate identifiers, the final step is to ingest them into the same Elasticsearch instance that contains your APM data. See Ingest your logs into Elasticsearch for more information.