A newer version is available. For the latest information, see the current release documentation.

›

General APM fields

edit

IMPORTANT: This documentation is no longer updated. Refer to Elastic's version policy and the latest documentation.

General APM fields

edit

Fields common to various APM events.

listening

type: keyword

Address the server is listening on.

processor.name

type: keyword

Processor name.

processor.event

type: keyword

Processor event.

timestamp.us

type: long

Timestamp of the event in microseconds since Unix epoch.

context fields

edit

Any arbitrary contextual information regarding the event, captured by the agent, optionally provided by the user.

context.custom

type: object

Object is not enabled.

context.db.instance

type: keyword

Field is not indexed.

context.db.statement

type: keyword

Field is not indexed.

context.db.type

type: keyword

Field is not indexed.

context.db.user

type: keyword

Field is not indexed.

context.http.method

type: keyword

Field is not indexed.

context.http.status_code

type: long

The status code of the http response.

context.http.url

type: keyword

Field is not indexed.

context.tags

type: object

A flat mapping of user-defined tags with string values.

context.user.username

type: keyword

The username of the logged in user.

context.user.id

type: keyword

Identifier of the logged in user.

context.user.email

type: keyword

Email of the logged in user.

context.user.ip

type: ip

IP of the user where the event is recorded, typically a web browser. This is obtained from the X-Forwarded-For header, of which the first entry is the IP of the original client. This value however might not be necessarily trusted, as it can be forged by a malicious user.

context.user.user-agent

type: text

Software agent acting in behalf of a user, eg. a web browser / OS combination.

context.request.body

type: object

Object is not enabled.

context.request.cookies

type: object

Object is not enabled.

context.request.headers

type: object

Object is not enabled.

context.request.env

type: object

Object is not enabled.

context.request.socket

type: object

Object is not enabled.

url fields

edit

A complete Url, with scheme, host and path.

context.request.url.raw

type: keyword

The raw, unparsed URL of the request, e.g https://example.com:443/search?q=elasticsearch#top.

context.request.url.protocol

type: keyword

The protocol of the request, e.g. "https:".

context.request.url.full

type: keyword

The full, possibly agent-assembled URL of the request, e.g https://example.com:443/search?q=elasticsearch#top.

context.request.url.hostname

type: keyword

The hostname of the request, e.g. "example.com".

context.request.url.port

type: keyword

The port of the request, e.g. 443.

context.request.url.pathname

type: keyword

The path of the request, e.g. "/search".

context.request.url.search

type: keyword

The search describes the query string of the request, e.g. "q=elasticsearch".

context.request.url.hash

type: keyword

The hash of the request URL, e.g. "top".

context.request.http_version

type: keyword

The http version of the request leading to this event.

context.request.method

type: keyword

The http method of the request leading to this event.

context.response.headers

type: object

Object is not enabled.

context.response.headers_sent

type: boolean

Field is not indexed.

context.response.status_code

type: long

The http status code of the response, eg. 200.

context.response.finished

type: boolean

A boolean indicating whether the response was finished or not.

system fields

edit

Optional system fields.

context.system.hostname

type: keyword

The hostname of the system the event was recorded on.

context.system.architecture

type: keyword

The architecture of the system the event was recorded on.

context.system.platform

type: keyword

The platform of the system the event was recorded on.

context.system.ip

type: ip

IP of the host that records the event.

process fields

edit

Information pertaining to the running process where the data was collected

context.process.argv

type: object

Object is not enabled.

context.process.pid

type: long

Numeric process ID of the service process.

context.process.ppid

type: long

Numeric ID of the service’s parent process.

context.process.title

type: keyword

Service process title.

service fields

edit

Service fields.

context.service.name

type: keyword

format: url

Immutable unique name of the service emitting this event.

context.service.version

type: keyword

Version of the service emitting this event.

context.service.environment

type: keyword

Service environment.

context.service.language.name

type: keyword

Name of the programming language used.

context.service.language.version

type: keyword

Version of the programming language used.

context.service.runtime.name

type: keyword

Name of the runtime used.

context.service.runtime.version

type: keyword

Version of the runtime used.

context.service.framework.name

type: keyword

Name of the framework used.

context.service.framework.version

type: keyword

Version of the framework used.

context.service.agent.name

type: keyword

Name of the agent used.

context.service.agent.version

type: keyword

Version of the agent used.

transaction.id

type: keyword

format: url

The transaction ID.

transaction.sampled

type: boolean

Transactions that are sampled will include all available information. Transactions that are not sampled will not have spans or context.

trace.id

type: keyword

The ID of the trace to which the event belongs to.

parent.id

type: keyword

The ID of the parent event.

« Alias fields APM Error fields »