A transaction represents one event, captured by an Elastic APM agent within one service. A transaction can for example be a single HTTP request or an asynchrounous background job within one service.

The transaction shows the duration of the event, a unique id, the type and an automatically retrieved name, as well as an indication whether or not the transaction was handled successfully.

If a transaction was sampled, the spans of the transaction were captured and are available as seperate documents. There is a configuration option on how many spans should be captured per transaction.

A transaction can also contain information regarding marks. Marks capture the timing in milliseconds of a significant event during the lifetime of a transaction, set by the user or the agent

An event’s context bundles information regarding the environment in which it is recorded. It describes the service in which the event is captured, the system in which the monitored service is running and the event’s process information.

It can also contain information about the authenticated user.

An event’s context can also include information about the request leading to the event and the response of processing the event. In case a http request is captured, it contains information about the url, cookies, body, headers, etc.

The agents provide some configuration options with which the users can also capture customized information. The non-indexed information is captured within a custom object, while the searchable information is stored within tags.

Spansedit

Several spans can be related to a transaction. The relationship is indicated by a transaction.id.

A span contains information about a specific code path, executed as part of a transaction. Elastic APM agents automatically instrument a variety of libraries, but also support custom instrumentation for code paths. Every code path that is captured by an agent creates a span.

Every span is identified by an unique ID per transaction. Spans at least collect information about when the code path execution started, the duration, and the type of the code path execution.

This means, if for example a database query happens within a recorded transaction, a span representing this database query will be created. In such a case the name of the span will contain information about the query itself, and the type will hold information about the database type.

A span can also contain stack trace information.

Transactions and spans are stored in separated indices by default. Read more about their representation in Elasticsearch in transaction indices and span indices.