- Elastic Cloud Serverless
- Elasticsearch
- Elastic Observability
- Get started
- Observability overview
- Elastic Observability Serverless billing dimensions
- Create an Observability project
- Quickstart: Monitor hosts with Elastic Agent
- Quickstart: Monitor your Kubernetes cluster with Elastic Agent
- Quickstart: Monitor hosts with OpenTelemetry
- Quickstart: Unified Kubernetes Observability with Elastic Distributions of OpenTelemetry (EDOT)
- Quickstart: Collect data with AWS Firehose
- Get started with dashboards
- Applications and services
- Application performance monitoring (APM)
- Get started with traces and APM
- Learn about data types
- Collect application data
- View and analyze data
- Act on data
- Use APM securely
- Reduce storage
- Managed intake service event API
- Troubleshooting
- Synthetic monitoring
- Get started
- Scripting browser monitors
- Configure lightweight monitors
- Manage monitors
- Work with params and secrets
- Analyze monitor data
- Monitor resources on private networks
- Use the CLI
- Configure a Synthetics project
- Multifactor Authentication for browser monitors
- Configure Synthetics settings
- Grant users access to secured resources
- Manage data retention
- Scale and architect a deployment
- Synthetics Encryption and Security
- Troubleshooting
- Application performance monitoring (APM)
- Infrastructure and hosts
- Logs
- Inventory
- Incident management
- Data set quality
- Observability AI Assistant
- Machine learning
- Reference
- Get started
- Elastic Security
- Elastic Security overview
- Security billing dimensions
- Create a Security project
- Elastic Security requirements
- Elastic Security UI
- AI for Security
- Ingest data
- Configure endpoint protection with Elastic Defend
- Manage Elastic Defend
- Endpoints
- Policies
- Trusted applications
- Event filters
- Host isolation exceptions
- Blocklist
- Optimize Elastic Defend
- Event capture and Elastic Defend
- Endpoint protection rules
- Identify antivirus software on your hosts
- Allowlist Elastic Endpoint in third-party antivirus apps
- Elastic Endpoint self-protection features
- Elastic Endpoint command reference
- Endpoint response actions
- Cloud Security
- Explore your data
- Dashboards
- Detection engine overview
- Rules
- Alerts
- Advanced Entity Analytics
- Investigation tools
- Asset management
- Manage settings
- Troubleshooting
- Manage your project
- Changelog
Find transaction latency and failure correlations
editFind transaction latency and failure correlations
editCorrelations surface attributes of your data that are potentially correlated with high-latency or erroneous transactions. For example, if you are a site reliability engineer who is responsible for keeping production systems up and running, you want to understand what is causing slow transactions. Identifying attributes that are responsible for higher latency transactions can potentially point you toward the root cause. You may find a correlation with a particular piece of hardware, like a host or pod. Or, perhaps a set of users, based on IP address or region, is facing increased latency due to local data center issues.
To find correlations:
- In your Elastic Observability Serverless project, go to Applications → Service Inventory.
- Select a service.
- Select the Transactions tab.
- Select a transaction group in the Transactions table.
Active queries are applied to correlations.
Find high transaction latency correlations
editThe correlations on the Latency correlations tab help you discover which attributes are contributing to increased transaction latency.

The progress bar indicates the status of the asynchronous analysis, which performs statistical searches across a large number of attributes. For large time ranges and services with high transaction throughput, this might take some time. To improve performance, reduce the time range.
The latency distribution chart visualizes the overall latency of the transactions in the transaction group. If there are attributes that have a statistically significant correlation with slow response times, they are listed in a table below the chart. The table is sorted by correlation coefficients that range from 0 to 1. Attributes with higher correlation values are more likely to contribute to high latency transactions. By default, the attribute with the highest correlation value is added to the chart. To see the latency distribution for other attributes, select their row in the table.
If a correlated attribute seems noteworthy, use the Filter quick links:
-
+
creates a new query in the Applications UI for filtering transactions containing the selected value. -
-
creates a new query in the Applications UI to filter out transactions containing the selected value.
You can also click the icon beside the field name to view and filter its most popular values.
In this example screenshot, there are transactions that are skewed to the right
with slower response times than the overall latency distribution. If you select
the +
filter in the appropriate row of the table, it creates a new query in
the Applications UI for transactions with this attribute. With the "noise" now
filtered out, you can begin viewing sample traces to continue your investigation.
Find failed transaction correlations
editThe correlations on the Failed transaction correlations tab help you discover
which attributes are most influential in distinguishing between transaction
failures and successes. In this context, the success or failure of a transaction
is determined by its event.outcome
value. For example, APM agents set the event.outcome
to failure
when an HTTP
transaction returns a 5xx
status code.
The chart highlights the failed transactions in the overall latency distribution for the transaction group. If there are attributes that have a statistically significant correlation with failed transactions, they are listed in a table. The table is sorted by scores, which are mapped to high, medium, or low impact levels. Attributes with high impact levels are more likely to contribute to failed transactions. By default, the attribute with the highest score is added to the chart. To see a different attribute in the chart, select its row in the table.
For example, in the screenshot below, there are attributes such as a specific node and pod name that have medium impact on the failed transactions.

Select the +
filter to create a new query in the Applications UI for transactions
with one or more of these attributes. If you are unfamiliar with a field, click
the icon beside its name to view its most popular values and optionally filter
on those values too. Each time that you add another attribute, it is filtering
out more and more noise and bringing you closer to a diagnosis.