schemas/tracing.yml: add span.id

CHANGELOG.next.md

@@ -25,6 +25,7 @@ Thanks, you're awesome :-) -->
 * Added `x509.*` field set. (#762)
 * Added more account and project cloud metadata. (#816)
 * Added missing field reuse of `pe` at `process.parent.pe` #868
+* Added `span.id` to the tracing fieldset, for additional log correlation (#882)
 
 #### Improvements
 

docs/field-details.asciidoc

@@ -5904,6 +5904,21 @@ Distributed tracing makes it possible to analyze performance throughout a micros
 
 // ===============================================================
 
+| span.id
+| Unique identifier of the span.
+
+A span represents an operation within a transaction, such as a request to another service, or a database query.
+
+type: keyword
+
+
+
+example: `3ff9a8981b7ccd5a`
+
+| extended
+
+// ===============================================================
+
 | trace.id
 | Unique identifier of the trace.
 

generated/beats/fields.ecs.yml

@@ -5099,6 +5099,16 @@
       - to queries made through multiple back-end services.
     type: group
     fields:
+    - name: span.id
+      level: extended
+      type: keyword
+      ignore_above: 1024
+      description: 'Unique identifier of the span.
+
+        A span represents an operation within a transaction, such as a request to
+        another service, or a database query.'
+      example: 3ff9a8981b7ccd5a
+      default_field: false
     - name: trace.id
       level: extended
       type: keyword

generated/csv/fields.csv

@@ -523,6 +523,7 @@ ECS_Version,Indexed,Field_Set,Field,Type,Level,Normalization,Example,Description
 1.6.0-dev,true,source,source.user.id,keyword,core,,,Unique identifier of the user.
 1.6.0-dev,true,source,source.user.name,keyword,core,,albert,Short name or login of the user.
 1.6.0-dev,true,source,source.user.name.text,text,core,,albert,Short name or login of the user.
+1.6.0-dev,true,span,span.id,keyword,extended,,3ff9a8981b7ccd5a,Unique identifier of the span.
 1.6.0-dev,true,threat,threat.framework,keyword,extended,,MITRE ATT&CK,Threat classification framework.
 1.6.0-dev,true,threat,threat.tactic.id,keyword,extended,array,TA0040,Threat tactic id.
 1.6.0-dev,true,threat,threat.tactic.name,keyword,extended,array,impact,Threat tactic.

generated/ecs/ecs_flat.yml

@@ -6683,6 +6683,20 @@ source.user.name:
   original_fieldset: user
   short: Short name or login of the user.
   type: keyword
+span.id:
+  dashed_name: span-id
+  description: 'Unique identifier of the span.
+
+    A span represents an operation within a transaction, such as a request to another
+    service, or a database query.'
+  example: 3ff9a8981b7ccd5a
+  flat_name: span.id
+  ignore_above: 1024
+  level: extended
+  name: span.id
+  normalize: []
+  short: Unique identifier of the span.
+  type: keyword
 tags:
   dashed_name: tags
   description: List of keywords used to tag each event.

generated/ecs/ecs_nested.yml

@@ -8993,6 +8993,20 @@ tracing:
     of the requests - from the initial web request in the front-end service - to queries
     made through multiple back-end services.
   fields:
+    span.id:
+      dashed_name: span-id
+      description: 'Unique identifier of the span.
+
+        A span represents an operation within a transaction, such as a request to
+        another service, or a database query.'
+      example: 3ff9a8981b7ccd5a
+      flat_name: span.id
+      ignore_above: 1024
+      level: extended
+      name: span.id
+      normalize: []
+      short: Unique identifier of the span.
+      type: keyword
     trace.id:
       dashed_name: trace-id
       description: 'Unique identifier of the trace.

generated/elasticsearch/6/template.json

@@ -2482,6 +2482,14 @@
             }
           }
         },
+        "span": {
+          "properties": {
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
         "tags": {
           "ignore_above": 1024,
           "type": "keyword"

generated/elasticsearch/7/template.json

@@ -2481,6 +2481,14 @@
           }
         }
       },
+      "span": {
+        "properties": {
+          "id": {
+            "ignore_above": 1024,
+            "type": "keyword"
+          }
+        }
+      },
       "tags": {
         "ignore_above": 1024,
         "type": "keyword"

schemas/tracing.yml

@@ -29,3 +29,13 @@
         Unique identifier of the transaction.
 
         A transaction is the highest level of work measured within a service, such as a request to a server.
+
+    - name: span.id
+      level: extended
+      type: keyword
+      example: 3ff9a8981b7ccd5a
+      short: Unique identifier of the span.
+      description: >
+        Unique identifier of the span.
+
+        A span represents an operation within a transaction, such as a request to another service, or a database query.