🚧 WIP 🚧 Replace _source in the APM queries

packages/kbn-apm-types/src/es_fields/apm.ts

@@ -8,6 +8,7 @@
  */
 
 export const TIMESTAMP = 'timestamp.us';
+export const AT_TIMESTAMP = '@timestamp';
 export const AGENT = 'agent';
 export const AGENT_NAME = 'agent.name';
 export const AGENT_VERSION = 'agent.version';
@@ -20,12 +21,18 @@ export const CLOUD_AVAILABILITY_ZONE = 'cloud.availability_zone';
 export const CLOUD_PROVIDER = 'cloud.provider';
 export const CLOUD_REGION = 'cloud.region';
 export const CLOUD_MACHINE_TYPE = 'cloud.machine.type';
+export const CLOUD_PROJECT_ID = 'cloud.project.id';
+export const CLOUD_PROJECT_NAME = 'cloud.project.name';
+export const CLOUD_IMAGE_ID = 'cloud.image.id';
 export const CLOUD_ACCOUNT_ID = 'cloud.account.id';
+export const CLOUD_ACCOUNT_NAME = 'cloud.account.name';
 export const CLOUD_INSTANCE_ID = 'cloud.instance.id';
 export const CLOUD_INSTANCE_NAME = 'cloud.instance.name';
 export const CLOUD_SERVICE_NAME = 'cloud.service.name';
 
 export const EVENT_SUCCESS_COUNT = 'event.success_count';
+export const EVENT_SUCCESS_COUNT_SUM = 'event.success_count.sum';
+export const EVENT_SUCCESS_COUNT_VALUE_COUNT = 'event.success_count.value_count';
 
 export const SERVICE = 'service';
 export const SERVICE_NAME = 'service.name';
@@ -39,18 +46,28 @@ export const SERVICE_RUNTIME_VERSION = 'service.runtime.version';
 export const SERVICE_NODE_NAME = 'service.node.name';
 export const SERVICE_VERSION = 'service.version';
 export const SERVICE_TARGET_TYPE = 'service.target.type';
+export const SERVICE_TARGET_NAME = 'service.target.name';
 export const SERVICE_OVERFLOW_COUNT = 'service_transaction.aggregation.overflow_count';
 
 export const URL_FULL = 'url.full';
 export const HTTP_REQUEST_METHOD = 'http.request.method';
 export const HTTP_RESPONSE_STATUS_CODE = 'http.response.status_code';
+
 export const USER_ID = 'user.id';
 export const USER_AGENT_ORIGINAL = 'user_agent.original';
 export const USER_AGENT_NAME = 'user_agent.name';
+export const USER_AGENT_DEVICE_NAME = 'user_agent.device.name';
+export const USER_AGENT_VERSION = 'user_agent.version';
 
 export const OBSERVER_HOSTNAME = 'observer.hostname';
+export const OBSERVER_ID = 'observer.id';
+export const OBSERVER_TYPE = 'observer.type';
+export const OBSERVER_NAME = 'observer.name';
+export const OBSERVER_VERSION = 'observer.version';
 export const OBSERVER_LISTENING = 'observer.listening';
+export const OBSERVER_VERSION_MAJOR = 'observer.version_major';
 export const PROCESSOR_EVENT = 'processor.event';
+export const PROCESSOR_NAME = 'processor.name';
 
 export const TRANSACTION_DURATION = 'transaction.duration.us';
 export const TRANSACTION_DURATION_HISTOGRAM = 'transaction.duration.histogram';
@@ -67,6 +84,9 @@ export const TRANSACTION_OVERFLOW_COUNT = 'transaction.aggregation.overflow_coun
 // for transaction metrics
 export const TRANSACTION_ROOT = 'transaction.root';
 export const TRANSACTION_PROFILER_STACK_TRACE_IDS = 'transaction.profiler_stack_trace_ids';
+export const TRANSACTION_NAME_TEXT = 'transaction.name.text';
+export const TRANSACTION_REPRESENTATIVE_COUNT = 'transaction.representative_count';
+export const TRANSACTION_SPAN_COUNT_STARTED = 'transaction.span_count.started';
 
 export const EVENT_OUTCOME = 'event.outcome';
 
@@ -95,6 +115,7 @@ export const SPAN_COMPOSITE_SUM = 'span.composite.sum.us';
 export const SPAN_COMPOSITE_COMPRESSION_STRATEGY = 'span.composite.compression_strategy';
 
 export const SPAN_SYNC = 'span.sync';
+export const SPAN_REPRESENTATIVE_COUNT = 'span.representative_count';
 
 // Parent ID for a transaction or span
 export const PARENT_ID = 'parent.id';
@@ -145,14 +166,19 @@ export const HOST_NAME = 'host.name';
 export const HOST_OS_PLATFORM = 'host.os.platform';
 export const HOST_ARCHITECTURE = 'host.architecture';
 export const HOST_OS_VERSION = 'host.os.version';
+export const HOST_IP = 'host.ip';
 
 export const CONTAINER_ID = 'container.id';
 export const CONTAINER = 'container';
 export const CONTAINER_IMAGE = 'container.image.name';
+export const CONTAINER_OS = 'container.os';
+export const CONTAINER_TTL_INSTANCES = 'container.totalNumberInstances';
 
 export const KUBERNETES = 'kubernetes';
 export const KUBERNETES_POD_NAME = 'kubernetes.pod.name';
 export const KUBERNETES_POD_UID = 'kubernetes.pod.uid';
+export const KUBERNETES_NAMESPACE = 'kubernetes.namespace';
+export const KUBERNETES_NODE_NAME = 'kubernetes.node.name';
 
 export const FAAS_ID = 'faas.id';
 export const FAAS_NAME = 'faas.name';
@@ -180,6 +206,8 @@ export const VALUE_OTEL_JVM_PROCESS_MEMORY_NON_HEAP = 'non_heap';
 export const TIER = '_tier';
 export const INDEX = '_index';
 export const DATA_STEAM_TYPE = 'data_stream.type';
+export const DATA_STREAM_NAMESPACE = 'data_stream.namespace';
+export const DATA_STREAM_DATASET = 'data_stream.dataset';
 
 // Mobile
 export const NETWORK_CONNECTION_TYPE = 'network.connection.type';
@@ -194,6 +222,7 @@ export const CLIENT_GEO_REGION_ISO_CODE = 'client.geo.region_iso_code';
 export const CLIENT_GEO_COUNTRY_NAME = 'client.geo.country_name';
 export const CLIENT_GEO_CITY_NAME = 'client.geo.city_name';
 export const CLIENT_GEO_REGION_NAME = 'client.geo.region_name';
+export const CLIENT_IP = 'client.ip';
 
 export const CHILD_ID = 'child.id';
 

x-pack/plugins/observability_solution/apm/common/correlations/types.ts

@@ -26,8 +26,13 @@ export interface ResponseHitSource {
   [s: string]: unknown;
 }
 
+export interface ResponseHitFields {
+  [s: string]: unknown;
+}
+
 export interface ResponseHit {
-  _source: ResponseHitSource;
+  _source?: ResponseHitSource;
+  fields: ResponseHitFields;
 }
 
 export interface CommonCorrelationsQueryParams {

x-pack/plugins/observability_solution/apm/common/es_fields/infra_metrics.ts

@@ -7,9 +7,12 @@
 
 // Kubernetes
 export const KUBERNETES_CONTAINER_NAME = 'kubernetes.container.name';
+export const KUBERNETES_NODE_NAME = 'kubernetes.node.name';
+export const KUBERNETES_CONTAINER_ID = 'kubernetes.container.id';
 export const KUBERNETES_DEPLOYMENT = 'kubernetes.deployment';
 export const KUBERNETES_DEPLOYMENT_NAME = 'kubernetes.deployment.name';
 export const KUBERNETES_NAMESPACE_NAME = 'kubernetes.namespace.name';
 export const KUBERNETES_NAMESPACE = 'kubernetes.namespace';
 export const KUBERNETES_REPLICASET = 'kubernetes.replicaset';
 export const KUBERNETES_REPLICASET_NAME = 'kubernetes.replicaset.name';
+export const KUBERNETES_POD_NAME = 'kubernetes.pod.name';

x-pack/plugins/observability_solution/apm/public/components/app/error_group_details/error_sampler/error_sample_detail.tsx

@@ -160,7 +160,7 @@ export function ErrorSampleDetails({
   const status = error.http?.response?.status_code;
   const environment = error.service.environment;
   const serviceVersion = error.service.version;
-  const isUnhandled = error.error.exception?.[0].handled === false;
+  const isUnhandled = error.error.exception?.[0]?.handled === false;
 
   const traceExplorerLink = router.link('/traces/explorer/waterfall', {
     query: {
@@ -352,8 +352,8 @@ export function ErrorSampleDetailTabContent({
   currentTab: ErrorTab;
 }) {
   const codeLanguage = error?.service.language?.name;
-  const exceptions = error?.error.exception || [];
-  const logStackframes = error?.error.log?.stacktrace;
+  const exceptions = error?.error?.exception || [];
+  const logStackframes = error?.error?.log?.stacktrace;
   const isPlaintextException =
     !!error?.error.stack_trace && exceptions.length === 1 && !exceptions[0].stacktrace;
   switch (currentTab.key) {
@@ -362,8 +362,8 @@ export function ErrorSampleDetailTabContent({
     case ErrorTabKey.ExceptionStacktrace:
       return isPlaintextException ? (
         <PlaintextStacktrace
-          message={exceptions[0].message}
-          type={exceptions[0].type}
+          message={exceptions[0]?.message}
+          type={exceptions[0]?.type}
           stacktrace={error?.error.stack_trace}
           codeLanguage={codeLanguage}
         />

x-pack/plugins/observability_solution/apm/public/components/app/transaction_details/waterfall_with_summary/waterfall_container/waterfall/waterfall_helpers/waterfall_helpers.ts

@@ -174,7 +174,8 @@ function getErrorItem(
   const errorItem: IWaterfallError = {
     docType: 'error',
     doc: error,
-    id: error.error.id,
+    // To be fixed after https://github.com/elastic/opentelemetry-lib/issues/86
+    id: error?.error?.id ?? '',
     parent,
     parentId: parent?.id,
     offset: error.timestamp.us - entryTimestamp,

x-pack/plugins/observability_solution/apm/public/components/app/transaction_details/waterfall_with_summary/waterfall_container/waterfall/waterfall_item.tsx

@@ -193,7 +193,7 @@ function NameLabel({ item }: { item: IWaterfallSpanOrTransaction }) {
   switch (item.docType) {
     case 'span':
       let name = item.doc.span.name;
-      if (item.doc.span.composite) {
+      if (item.doc.span.composite && item.doc.span.composite.count) {
         const compositePrefix =
           item.doc.span.composite.compression_strategy === 'exact_match' ? 'x' : '';
         name = `${item.doc.span.composite.count}${compositePrefix} ${name}`;

x-pack/plugins/observability_solution/apm/server/lib/apm_telemetry/collect_data_telemetry/tasks.ts

@@ -54,10 +54,7 @@ import {
   SavedServiceGroup,
 } from '../../../../common/service_groups';
 import { asMutableArray } from '../../../../common/utils/as_mutable_array';
-import { APMError } from '../../../../typings/es_schemas/ui/apm_error';
 import { AgentName } from '../../../../typings/es_schemas/ui/fields/agent';
-import { Span } from '../../../../typings/es_schemas/ui/span';
-import { Transaction } from '../../../../typings/es_schemas/ui/transaction';
 import {
   APMDataTelemetry,
   APMPerService,
@@ -74,6 +71,7 @@ import {
   APM_CUSTOM_DASHBOARDS_SAVED_OBJECT_TYPE,
   SavedApmCustomDashboard,
 } from '../../../../common/custom_dashboards';
+import { serviceVersionMapping } from '../../../utils/es_fields_mappings';
 
 type ISavedObjectsClient = Pick<SavedObjectsClient, 'find'>;
 const TIME_RANGES = ['1d', 'all'] as const;
@@ -690,10 +688,11 @@ export const tasks: TelemetryTask[] = [
           sort: {
             '@timestamp': 'desc',
           },
+          fields: ['observer.version'],
         },
       });
 
-      const hit = response.hits.hits[0]?._source as Pick<Transaction | Span | APMError, 'observer'>;
+      const hit = serviceVersionMapping(response.hits.hits[0]?.fields);
 
       if (!hit || !hit.observer?.version) {
         return {};

x-pack/plugins/observability_solution/apm/server/routes/assistant_functions/get_observability_alert_details_context/get_downstream_dependency_name.ts

@@ -39,7 +39,6 @@ export async function getDownstreamServiceResource({
     body: {
       track_total_hits: false,
       size: 1,
-      _source: ['span.destination.service'],
       query: {
         bool: {
           filter: [
@@ -50,9 +49,10 @@ export async function getDownstreamServiceResource({
           ],
         },
       },
+      fields: ['span.destination.service'],
     },
   });
 
   const hit = response.hits.hits[0];
-  return hit?._source?.span.destination?.service.resource;
+  return hit?.fields?.['span.destination?.service?.resource']?.[0] as string;
 }

x-pack/plugins/observability_solution/apm/server/routes/dependencies/get_metadata_for_dependency.ts

@@ -8,8 +8,13 @@
 import { rangeQuery } from '@kbn/observability-plugin/server';
 import { ProcessorEvent } from '@kbn/observability-plugin/common';
 import { maybe } from '../../../common/utils/maybe';
-import { SPAN_DESTINATION_SERVICE_RESOURCE } from '../../../common/es_fields/apm';
+import {
+  SPAN_DESTINATION_SERVICE_RESOURCE,
+  SPAN_SUBTYPE,
+  SPAN_TYPE,
+} from '../../../common/es_fields/apm';
 import { APMEventClient } from '../../lib/helpers/create_es_client/create_apm_event_client';
+import { metadataForDependencyMapping } from '../../utils/es_fields_mappings';
 
 export interface MetadataForDependencyResponse {
   spanType: string | undefined;
@@ -46,16 +51,18 @@ export async function getMetadataForDependency({
           ],
         },
       },
+      fields: [SPAN_TYPE, SPAN_SUBTYPE],
       sort: {
         '@timestamp': 'desc',
       },
     },
   });
 
-  const sample = maybe(sampleResponse.hits.hits[0])?._source;
+  const sample = maybe(sampleResponse.hits.hits[0])?.fields;
+  const sampleNorm = sample ? metadataForDependencyMapping(sample) : null;
 
   return {
-    spanType: sample?.span.type,
-    spanSubtype: sample?.span.subtype,
+    spanType: sampleNorm?.span.type,
+    spanSubtype: sampleNorm?.span.subtype,
   };
 }

x-pack/plugins/observability_solution/apm/server/routes/dependencies/get_top_dependency_spans.ts

@@ -28,6 +28,10 @@ import { environmentQuery } from '../../../common/utils/environment_query';
 import { maybe } from '../../../common/utils/maybe';
 import { AgentName } from '../../../typings/es_schemas/ui/fields/agent';
 import { APMEventClient } from '../../lib/helpers/create_es_client/create_apm_event_client';
+import {
+  topDependencySpansMapping,
+  transactionsForDependencySpansMapping,
+} from '../../utils/es_fields_mappings';
 
 const MAX_NUM_SPANS = 1000;
 
@@ -98,7 +102,7 @@ export async function getTopDependencySpans({
             ],
           },
         },
-        _source: [
+        fields: [
           SPAN_ID,
           TRACE_ID,
           TRANSACTION_ID,
@@ -112,7 +116,7 @@ export async function getTopDependencySpans({
         ],
       },
     })
-  ).hits.hits.map((hit) => hit._source);
+  ).hits.hits.map((hit) => topDependencySpansMapping(hit?.fields));
 
   const transactionIds = spans.map((span) => span.transaction!.id);
 
@@ -129,13 +133,13 @@ export async function getTopDependencySpans({
             filter: [...termsQuery(TRANSACTION_ID, ...transactionIds)],
           },
         },
-        _source: [TRANSACTION_ID, TRANSACTION_TYPE, TRANSACTION_NAME],
+        fields: [TRANSACTION_ID, TRANSACTION_TYPE, TRANSACTION_NAME],
         sort: {
           '@timestamp': 'desc',
         },
       },
     })
-  ).hits.hits.map((hit) => hit._source);
+  ).hits.hits.map((hit) => transactionsForDependencySpansMapping(hit.fields));
 
   const transactionsById = keyBy(transactions, (transaction) => transaction.transaction.id);
 

x-pack/plugins/observability_solution/apm/server/routes/entities/get_entity_latest_services.ts

@@ -17,6 +17,7 @@ import { environmentQuery } from '../../../common/utils/environment_query';
 import { EntitiesESClient } from '../../lib/helpers/create_es_client/create_entities_es_client/create_entities_es_client';
 import { entitiesRangeQuery } from './get_entities';
 import { EntityLatestServiceRaw, EntityType } from './types';
+import { normalizeFields } from '../../utils/normalize_fields';
 
 export async function getEntityLatestServices({
   entitiesESClient,
@@ -40,7 +41,7 @@ export async function getEntityLatestServices({
       body: {
         size,
         track_total_hits: false,
-        _source: [AGENT_NAME, ENTITY, DATA_STEAM_TYPE, SERVICE_NAME, SERVICE_ENVIRONMENT],
+        fields: [AGENT_NAME, ENTITY, DATA_STEAM_TYPE, SERVICE_NAME, SERVICE_ENVIRONMENT],
         query: {
           bool: {
             filter: [
@@ -54,7 +55,7 @@ export async function getEntityLatestServices({
         },
       },
     })
-  ).hits.hits.map((hit) => hit._source);
+  ).hits.hits.map((hit) => normalizeFields(hit?.fields ?? {}) as unknown as EntityLatestServiceRaw);
 
   return latestEntityServices;
 }

x-pack/plugins/observability_solution/apm/server/routes/errors/erroneous_transactions/get_top_erroneous_transactions.ts

@@ -93,7 +93,7 @@ async function getTopErroneousTransactions({
             sample: {
               top_hits: {
                 size: 1,
-                _source: [TRANSACTION_TYPE],
+                fields: [TRANSACTION_TYPE],
               },
             },
             timeseries: {
@@ -117,7 +117,9 @@ async function getTopErroneousTransactions({
       ({ key, doc_count: docCount, sample, timeseries }) => {
         return {
           transactionName: key as string,
-          transactionType: sample.hits.hits[0]._source.transaction?.type,
+          transactionType: sample.hits.hits[0].fields?.['transaction.type']?.[0] as
+            | string
+            | undefined,
           occurrences: docCount,
           timeseries: timeseries.buckets.map((timeseriesBucket) => {
             return {

x-pack/plugins/observability_solution/apm/server/routes/errors/get_error_groups/get_error_group_sample_ids.ts

@@ -66,16 +66,16 @@ export async function getErrorGroupSampleIds({
           should: [{ term: { [TRANSACTION_SAMPLED]: true } }], // prefer error samples with related transactions
         },
       },
-      _source: [ERROR_ID, 'transaction'],
+      fields: [ERROR_ID, 'transaction'],
       sort: asMutableArray([
         { _score: { order: 'desc' } }, // sort by _score first to ensure that errors with transaction.sampled:true ends up on top
         { '@timestamp': { order: 'desc' } }, // sort by timestamp to get the most recent error
       ] as const),
     },
   });
   const errorSampleIds = resp.hits.hits.map((item) => {
-    const source = item._source;
-    return source.error.id;
+    const source = item?._source;
+    return source?.error?.id;
   });
 
   return {