diff --git a/CHANGELOG.next.md b/CHANGELOG.next.md index f87d61f45f..7b217c5c81 100644 --- a/CHANGELOG.next.md +++ b/CHANGELOG.next.md @@ -41,6 +41,9 @@ Thanks, you're awesome :-) --> #### Improvements +* Added a notice highlighting that the `tracing` fields are not nested under the + namespace `tracing.` #1162 + #### Deprecated diff --git a/code/go/ecs/tracing.go b/code/go/ecs/tracing.go index 16e1707065..a0f6b2508d 100644 --- a/code/go/ecs/tracing.go +++ b/code/go/ecs/tracing.go @@ -23,6 +23,9 @@ package ecs // microservice architecture all in one view. This is accomplished by tracing // all of the requests - from the initial web request in the front-end service // - to queries made through multiple back-end services. +// Unlike most field sets in ECS, the tracing fields are *not* nested under the +// field set name. In other words, the correct field name is `trace.id`, not +// `tracing.trace.id`, and so on. type Tracing struct { // Unique identifier of the trace. // A trace groups multiple events like transactions that belong together. diff --git a/docs/field-details.asciidoc b/docs/field-details.asciidoc index 0d41f4462c..eebf2524f2 100644 --- a/docs/field-details.asciidoc +++ b/docs/field-details.asciidoc @@ -7187,6 +7187,8 @@ example: `tls` Distributed tracing makes it possible to analyze performance throughout a microservice architecture all in one view. This is accomplished by tracing all of the requests - from the initial web request in the front-end service - to queries made through multiple back-end services. +Unlike most field sets in ECS, the tracing fields are *not* nested under the field set name. In other words, the correct field name is `trace.id`, not `tracing.trace.id`, and so on. + [discrete] ==== Tracing Field Details diff --git a/experimental/generated/beats/fields.ecs.yml b/experimental/generated/beats/fields.ecs.yml index 15f8b78a38..5f47853e54 100644 --- a/experimental/generated/beats/fields.ecs.yml +++ b/experimental/generated/beats/fields.ecs.yml @@ -5215,10 +5215,14 @@ - name: tracing title: Tracing group: 2 - description: Distributed tracing makes it possible to analyze performance throughout + description: 'Distributed tracing makes it possible to analyze performance throughout a microservice architecture all in one view. This is accomplished by tracing all of the requests - from the initial web request in the front-end service - to queries made through multiple back-end services. + + Unlike most field sets in ECS, the tracing fields are *not* nested under the + field set name. In other words, the correct field name is `trace.id`, not `tracing.trace.id`, + and so on.' type: group fields: - name: span.id diff --git a/experimental/generated/ecs/ecs_nested.yml b/experimental/generated/ecs/ecs_nested.yml index ae2bf5b32c..60deb5c23b 100644 --- a/experimental/generated/ecs/ecs_nested.yml +++ b/experimental/generated/ecs/ecs_nested.yml @@ -9228,10 +9228,14 @@ tls: title: TLS type: group tracing: - description: Distributed tracing makes it possible to analyze performance throughout + description: 'Distributed tracing makes it possible to analyze performance throughout a microservice architecture all in one view. This is accomplished by tracing all of the requests - from the initial web request in the front-end service - to queries made through multiple back-end services. + + Unlike most field sets in ECS, the tracing fields are *not* nested under the field + set name. In other words, the correct field name is `trace.id`, not `tracing.trace.id`, + and so on.' fields: span.id: dashed_name: span-id diff --git a/generated/beats/fields.ecs.yml b/generated/beats/fields.ecs.yml index d0f31c1f43..c6234631fd 100644 --- a/generated/beats/fields.ecs.yml +++ b/generated/beats/fields.ecs.yml @@ -5302,10 +5302,14 @@ - name: tracing title: Tracing group: 2 - description: Distributed tracing makes it possible to analyze performance throughout + description: 'Distributed tracing makes it possible to analyze performance throughout a microservice architecture all in one view. This is accomplished by tracing all of the requests - from the initial web request in the front-end service - to queries made through multiple back-end services. + + Unlike most field sets in ECS, the tracing fields are *not* nested under the + field set name. In other words, the correct field name is `trace.id`, not `tracing.trace.id`, + and so on.' type: group fields: - name: span.id diff --git a/generated/ecs/ecs_nested.yml b/generated/ecs/ecs_nested.yml index 6c05ca5aba..f1ee2ecde8 100644 --- a/generated/ecs/ecs_nested.yml +++ b/generated/ecs/ecs_nested.yml @@ -9316,10 +9316,14 @@ tls: title: TLS type: group tracing: - description: Distributed tracing makes it possible to analyze performance throughout + description: 'Distributed tracing makes it possible to analyze performance throughout a microservice architecture all in one view. This is accomplished by tracing all of the requests - from the initial web request in the front-end service - to queries made through multiple back-end services. + + Unlike most field sets in ECS, the tracing fields are *not* nested under the field + set name. In other words, the correct field name is `trace.id`, not `tracing.trace.id`, + and so on.' fields: span.id: dashed_name: span-id diff --git a/schemas/tracing.yml b/schemas/tracing.yml index fc44bd4e53..8e23514e3d 100644 --- a/schemas/tracing.yml +++ b/schemas/tracing.yml @@ -6,7 +6,12 @@ short: Fields related to distributed tracing. description: > Distributed tracing makes it possible to analyze performance throughout a microservice architecture all in one view. - This is accomplished by tracing all of the requests - from the initial web request in the front-end service - to queries made through multiple back-end services. + This is accomplished by tracing all of the requests - from the initial web + request in the front-end service - to queries made through multiple back-end services. + + Unlike most field sets in ECS, the tracing fields are *not* nested under the + field set name. In other words, the correct field name is `trace.id`, + not `tracing.trace.id`, and so on. type: group fields: - name: trace.id