Skip to content

[azure_application_insights] [app_state] Add dimensions, metric_type to the app_state data stream #7550

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
12 commits merged into from
Oct 17, 2023
Merged

[azure_application_insights] [app_state] Add dimensions, metric_type to the app_state data stream #7550

Show file tree
Hide file tree
Changes from 11 commits
Commits
Show all changes
12 commits
Select commit Hold shift + click to select a range
080c2ab
add dimensions and metric types
mrg-elastic Aug 27, 2023
837a33f
update docs
mrg-elastic Aug 27, 2023
c3bad76
bump package version
mrg-elastic Aug 27, 2023
2524c67
fix pr id
mrg-elastic Aug 27, 2023
987dd5e
bump kibana version
mrg-elastic Aug 27, 2023
9c39d88
remove metrics from package fields
mrg-elastic Sep 7, 2023
3bc84e7
Revert "bump kibana version"
mrg-elastic Sep 7, 2023
28dbde4
build package
mrg-elastic Sep 7, 2023
e31ee54
fix metric types
mrg-elastic Sep 11, 2023
53b3ad2
update docs
mrg-elastic Sep 11, 2023
6c68274
Merge remote-tracking branch 'upstream/main' into azure_app-state_tsdb
mrg-elastic Sep 19, 2023
8d2d658
Merge branch 'main' into azure_app-state_tsdb
Oct 17, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 5 additions & 0 deletions packages/azure_application_insights/changelog.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,3 +1,8 @@
- version: "1.2.0"
changes:
- description: Add dimension and metric_type metadata to the app_state datastream
type: enhancement
link: https://github.com/elastic/integrations/pull/7550
- version: "1.1.0"
changes:
- description: Add app_insights dimensions and metric_type for metrics field.
Expand Down
1 change: 1 addition & 0 deletions packages/azure_application_insights/data_stream/app_state/fields/agent.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -48,6 +48,7 @@
ignore_above: 1024
description: Region in which this host is running.
example: us-east-1
dimension: true

@tetianakravchenko tetianakravchenko Aug 28, 2023

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Is this field actually present in the document?
If yes - could you please update sample_event -

integrations/packages/azure_application_insights/data_stream/app_state/sample_event.json

Lines 15 to 17 in 987dd5e

"cloud": {
"provider": "azure"
},
- https://github.com/elastic/integrations/blob/987dd5ec338d1b278ba7002db6e827f87a989798/packages/azure_application_insights/data_stream/app_state/sample_event.json with the latest sample

- name: project.id
type: keyword
description: Name of the project in Google Cloud.
Expand Down
3 changes: 3 additions & 0 deletions packages/azure_application_insights/data_stream/app_state/fields/ecs.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,3 +15,6 @@
external: ecs
- name: host
external: ecs
- name: agent.id
external: ecs
dimension: true
21 changes: 19 additions & 2 deletions packages/azure_application_insights/data_stream/app_state/fields/fields.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,91 +16,108 @@

- name: requests_count.sum
type: float
metric_type: gauge
description: >
Request count

- name: requests_failed.sum
type: float
metric_type: gauge
description: >
Request failed count

- name: users_count.unique
type: float
metric_type: gauge
description: >
User count

- name: sessions_count.unique
type: float
metric_type: gauge
description: >
Session count

- name: users_authenticated.unique
type: float
metric_type: gauge
description: >
Authenticated users count

- name: browser_timings_network_duration.avg
type: float
metric_type: gauge
description: >
Browser timings network duration

- name: browser_timings_send_duration.avg
type: float
metric_type: gauge
description: >
Browser timings send duration

- name: browser_timings_receive_duration.avg
type: float
metric_type: gauge
description: >
Browser timings receive duration

- name: browser_timings_processing_duration.avg
type: float
metric_type: gauge
description: >
Browser timings processing duration

- name: browser_timings_total_duration.avg
type: float
metric_type: gauge
description: >
Browser timings total duration

- name: exceptions_count.sum
type: float
metric_type: gauge
description: >
Exception count

- name: exceptions_browser.sum
type: float
metric_type: gauge
description: >
Exception count at browser level

- name: exceptions_server.sum
type: float
metric_type: gauge
description: >
Exception count at server level

- name: performance_counters_memory_available_bytes.avg
type: float
metric_type: gauge
description: >
Performance counters memory available bytes

- name: performance_counters_process_private_bytes.avg
type: float
metric_type: gauge
description: >
Performance counters process private bytes

- name: performance_counters_process_cpu_percentage_total.avg
type: float
metric_type: gauge
description: >
Performance counters process cpu percentage total

- name: performance_counters_process_cpu_percentage.avg
type: float
metric_type: gauge
description: >
Performance counters process cpu percentage

- name: performance_counters_processiobytes_per_second.avg
type: float
metric_type: gauge
description: >
Performance counters process IO bytes per second

Performance counters process IO bytes per second
44 changes: 33 additions & 11 deletions packages/azure_application_insights/data_stream/app_state/fields/package-fields.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,6 +4,7 @@
fields:
- name: timegrain
type: keyword
dimension: true
description: >
The Azure metric timegrain

Expand All @@ -25,6 +26,7 @@

- name: id
type: keyword
dimension: true
description: >
The id of the resource

Expand All @@ -40,6 +42,7 @@

- name: namespace
type: keyword
dimension: true
description: >
The namespace selected

Expand All @@ -54,14 +57,33 @@
The application ID

- name: dimensions
type: flattened
description: >
Azure metric dimensions.

- name: metrics.*.*
type: object
object_type: float
object_type_mapping_type: "*"
description: >
Metrics returned.

type: group

@agithomas agithomas Aug 28, 2023

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

What is the purpose behind converting flattened to keyword type? Can this be a breaking change?

Alternate options that can be tried can be found here.

@tetianakravchenko tetianakravchenko Aug 28, 2023

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Somehow I think it could be a backporting mistake that this was changed to flattened, for example in beats is used object - https://github.com/elastic/beats/blob/main/x-pack/metricbeat/module/azure/_meta/fields.yml#L53-L58

maybe worth to double-check with codeowners

@ghost ghost Aug 28, 2023

Copy link
Copy Markdown
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yeah, not sure why flattened was used in the data stream that's why I thought changing it makes sense.

@agithomas agithomas Sep 1, 2023

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Can this be considered as a breaking change?

@zmoog zmoog Sep 3, 2023

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This may not be an isolated mistake but an intentional change.

I see a similar change in mapping the azure.resource.tags field. Here is how we are mapping the azure.resource.tags field in the Beats module and several metrics integrations:

Metrics Mapping
Integrations Azure Metrics object
Metricbeat Azure module object
Integrations Azure Billing flattened
Integrations Azure App Insights flattened
Integrations Azure App State flattened

I agree with @agithomas that we must double-check whether this is a breaking change.

Switching field types should not create mapping exceptions since the mapping will only change at rollover, however the search behavior may vary due to the different mapping types.

@jsoriano jsoriano Sep 4, 2023 •
edited
Loading

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Discussed about this on slack with @gpop63. TLDR; In principle this change looks safe to me, if we are completely sure that this is the list of fields we can have here.

In principle this won't be a breaking change, because keyword fields allow the same operations as individual members of a flattened object (probably more). It could be considered an enhancement because keyword fields probably have better support in Kibana than the flattened type.
It could be breaking only if somehow users put additional fields under azure.dimensions, but I guess there is no reason to think that.

Somehow I think it could be a backporting mistake that this was changed to flattened, for example in beats is used object - https://github.com/elastic/beats/blob/main/x-pack/metricbeat/module/azure/_meta/fields.yml#L53-L58

The flattened type was introduced relatively recently, so this is why you can see it more used in integrations than in Beats. It comes to solve a couple of issues we had with fields with wildcards:

  • You can have mapping conflicts if there are fields with dots (you cannot store labels.app and labels.app.name as different fields in the same index, because labels.app would need to be mapped as an object and a keyword at the same time). subobjects: false can also help with this issue, but is not supported in packages yet.
  • You can have "field mappings explosion" if there are too many different fields under this path. This doesn't happen with flattened because it only requires a single mapping for any number of subfields.

@jsoriano jsoriano Sep 4, 2023

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

But regarding the breaking change, even if it doesn't seem to be actually breaking, please try to do an upgrade from the previous mapping to the proposed here in any case 🙂

@agithomas agithomas Sep 4, 2023

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@zmoog , are you good with the suggestions from @jsoriano or should we take any more input from other engineers?

@ghost ghost Sep 4, 2023

Copy link
Copy Markdown
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@jsoriano tested upgrading and everything is fine, no errors thrown.

@zmoog zmoog Sep 4, 2023

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@jsorianom, thank you for chiming in and sharing more details and backstory!

@agithomas, after these clarifications, I see no reason to dig more. In addition, @gpop63 tested the mapping transition is smooth.

subobjects: false can also help with this issue, but is not supported in packages yet.

I am working on adding subobjects to package-spec, so we'll have this option soon.

fields:
- name: cloud_role_instance

@tetianakravchenko tetianakravchenko Sep 19, 2023

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

where are those fields dimension.* defined?
As I see part of those dimensions here is the same as in segmentNames https://github.com/elastic/beats/blob/main/x-pack/metricbeat/module/azure/app_insights/data.go#L24-L38
wondering if this list of dimensions is complete

I assume that the list defined in beats could need some updates as well

@tetianakravchenko tetianakravchenko Sep 19, 2023

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

used for app_state configuration - https://github.com/elastic/beats/blob/main/x-pack/metricbeat/module/azure/app_state/manifest.yml

type: keyword
dimension: true
description: The unique identifier of the cloud instance where the application is running.
- name: cloud_role_name
type: keyword
dimension: true
description: The name of the role that the cloud instance is performing.
- name: exception_type
type: keyword
dimension: true
description: The type of exception that was thrown.
- name: browser_timing_url_host
type: keyword
dimension: true
description: The host part of the URL that the browser was accessing when timings were captured.
- name: browser_timing_url_path
type: keyword
dimension: true
description: The path part of the URL that the browser was accessing when timings were captured.
- name: request_url_host
type: keyword
dimension: true
description: The host part of the URL that was requested.
- name: request_name
type: keyword
dimension: true
description: The name of the request that was made.
156 changes: 81 additions & 75 deletions packages/azure_application_insights/docs/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -147,81 +147,87 @@ An example event for `app_insights` looks as following:

**Exported fields**

| Field | Description | Type |
|---|---|---|
| @timestamp | Event timestamp. | date |
| azure.app_state.browser_timings_network_duration.avg | Browser timings network duration | float |
| azure.app_state.browser_timings_processing_duration.avg | Browser timings processing duration | float |
| azure.app_state.browser_timings_receive_duration.avg | Browser timings receive duration | float |
| azure.app_state.browser_timings_send_duration.avg | Browser timings send duration | float |
| azure.app_state.browser_timings_total_duration.avg | Browser timings total duration | float |
| azure.app_state.end_date | The end date | date |
| azure.app_state.exceptions_browser.sum | Exception count at browser level | float |
| azure.app_state.exceptions_count.sum | Exception count | float |
| azure.app_state.exceptions_server.sum | Exception count at server level | float |
| azure.app_state.performance_counters_memory_available_bytes.avg | Performance counters memory available bytes | float |
| azure.app_state.performance_counters_process_cpu_percentage.avg | Performance counters process cpu percentage | float |
| azure.app_state.performance_counters_process_cpu_percentage_total.avg | Performance counters process cpu percentage total | float |
| azure.app_state.performance_counters_process_private_bytes.avg | Performance counters process private bytes | float |
| azure.app_state.performance_counters_processiobytes_per_second.avg | Performance counters process IO bytes per second | float |
| azure.app_state.requests_count.sum | Request count | float |
| azure.app_state.requests_failed.sum | Request failed count | float |
| azure.app_state.sessions_count.unique | Session count | float |
| azure.app_state.start_date | The start date | date |
| azure.app_state.users_authenticated.unique | Authenticated users count | float |
| azure.app_state.users_count.unique | User count | float |
| azure.application_id | The application ID | keyword |
| azure.dimensions | Azure metric dimensions. | flattened |
| azure.metrics.\*.\* | Metrics returned. | object |
| azure.namespace | The namespace selected | keyword |
| azure.resource.group | The resource group | keyword |
| azure.resource.id | The id of the resource | keyword |
| azure.resource.name | The name of the resource | keyword |
| azure.resource.tags | Azure resource tags. | flattened |
| azure.resource.type | The type of the resource | keyword |
| azure.subscription_id | The subscription ID | keyword |
| azure.timegrain | The Azure metric timegrain | keyword |
| cloud.account.id | The cloud account or organization id used to identify different entities in a multi-tenant environment. Examples: AWS account id, Google Cloud ORG Id, or other unique identifier. | keyword |
| cloud.availability_zone | Availability zone in which this host is running. | keyword |
| cloud.image.id | Image ID for the cloud instance. | keyword |
| cloud.instance.id | Instance ID of the host machine. | keyword |
| cloud.instance.name | Instance name of the host machine. | keyword |
| cloud.machine.type | Machine type of the host machine. | keyword |
| cloud.project.id | Name of the project in Google Cloud. | keyword |
| cloud.provider | Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean. | keyword |
| cloud.region | Region in which this host is running. | keyword |
| container.id | Unique container id. | keyword |
| container.image.name | Name of the image the container was built on. | keyword |
| container.labels | Image labels. | object |
| container.name | Container name. | keyword |
| container.runtime | Runtime managing this container. | keyword |
| data_stream.dataset | Data stream dataset name. | constant_keyword |
| data_stream.namespace | Data stream namespace. | constant_keyword |
| data_stream.type | Data stream type. | constant_keyword |
| dataset.name | Dataset name. | constant_keyword |
| dataset.namespace | Dataset namespace. | constant_keyword |
| dataset.type | Dataset type. | constant_keyword |
| ecs.version | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | keyword |
| host | A host is defined as a general computing instance. ECS host.\* fields should be populated with details about the host on which the event happened, or from which the measurement was taken. Host types include hardware, virtual machines, Docker containers, and Kubernetes nodes. | group |
| host.architecture | Operating system architecture. | keyword |
| host.containerized | If the host is a container. | boolean |
| host.domain | Name of the domain of which the host is a member. For example, on Windows this could be the host's Active Directory domain or NetBIOS domain name. For Linux this could be the domain of the host's LDAP provider. | keyword |
| host.hostname | Hostname of the host. It normally contains what the `hostname` command returns on the host machine. | keyword |
| host.id | Unique host id. As hostname is not always unique, use values that are meaningful in your environment. Example: The current usage of `beat.name`. | keyword |
| host.ip | Host ip addresses. | ip |
| host.mac | Host mac addresses. | keyword |
| host.name | Name of the host. It can contain what `hostname` returns on Unix systems, the fully qualified domain name, or a name specified by the user. The sender decides which value to use. | keyword |
| host.os.build | OS build information. | keyword |
| host.os.codename | OS codename, if any. | keyword |
| host.os.family | OS family (such as redhat, debian, freebsd, windows). | keyword |
| host.os.kernel | Operating system kernel version as a raw string. | keyword |
| host.os.name | Operating system name, without the version. | keyword |
| host.os.name.text | Multi-field of `host.os.name`. | text |
| host.os.platform | Operating system platform (such centos, ubuntu, windows). | keyword |
| host.os.version | Operating system version as a raw string. | keyword |
| host.type | Type of host. For Cloud providers this can be the machine type like `t2.medium`. If vm, this could be the container, for example, or other information meaningful in your environment. | keyword |
| service.address | Service address | keyword |
| service.type | The type of the service data is collected from. The type can be used to group and correlate logs and metrics from one service type. Example: If logs or metrics are collected from Elasticsearch, `service.type` would be `elasticsearch`. | keyword |
| Field | Description | Type | Metric Type |
|---|---|---|---|
| @timestamp | Event timestamp. | date | |
| agent.id | Unique identifier of this agent (if one exists). Example: For Beats this would be beat.id. | keyword | |
| azure.app_state.browser_timings_network_duration.avg | Browser timings network duration | float | gauge |
| azure.app_state.browser_timings_processing_duration.avg | Browser timings processing duration | float | gauge |
| azure.app_state.browser_timings_receive_duration.avg | Browser timings receive duration | float | gauge |
| azure.app_state.browser_timings_send_duration.avg | Browser timings send duration | float | gauge |
| azure.app_state.browser_timings_total_duration.avg | Browser timings total duration | float | gauge |
| azure.app_state.end_date | The end date | date | |
| azure.app_state.exceptions_browser.sum | Exception count at browser level | float | gauge |
| azure.app_state.exceptions_count.sum | Exception count | float | gauge |
| azure.app_state.exceptions_server.sum | Exception count at server level | float | gauge |
| azure.app_state.performance_counters_memory_available_bytes.avg | Performance counters memory available bytes | float | gauge |
| azure.app_state.performance_counters_process_cpu_percentage.avg | Performance counters process cpu percentage | float | gauge |
| azure.app_state.performance_counters_process_cpu_percentage_total.avg | Performance counters process cpu percentage total | float | gauge |
| azure.app_state.performance_counters_process_private_bytes.avg | Performance counters process private bytes | float | gauge |
| azure.app_state.performance_counters_processiobytes_per_second.avg | Performance counters process IO bytes per second | float | gauge |
| azure.app_state.requests_count.sum | Request count | float | gauge |
| azure.app_state.requests_failed.sum | Request failed count | float | gauge |
| azure.app_state.sessions_count.unique | Session count | float | gauge |
| azure.app_state.start_date | The start date | date | |
| azure.app_state.users_authenticated.unique | Authenticated users count | float | gauge |
| azure.app_state.users_count.unique | User count | float | gauge |
| azure.application_id | The application ID | keyword | |
| azure.dimensions.browser_timing_url_host | The host part of the URL that the browser was accessing when timings were captured. | keyword | |
| azure.dimensions.browser_timing_url_path | The path part of the URL that the browser was accessing when timings were captured. | keyword | |
| azure.dimensions.cloud_role_instance | The unique identifier of the cloud instance where the application is running. | keyword | |
| azure.dimensions.cloud_role_name | The name of the role that the cloud instance is performing. | keyword | |
| azure.dimensions.exception_type | The type of exception that was thrown. | keyword | |
| azure.dimensions.request_name | The name of the request that was made. | keyword | |
| azure.dimensions.request_url_host | The host part of the URL that was requested. | keyword | |
| azure.namespace | The namespace selected | keyword | |
| azure.resource.group | The resource group | keyword | |
| azure.resource.id | The id of the resource | keyword | |
| azure.resource.name | The name of the resource | keyword | |
| azure.resource.tags | Azure resource tags. | flattened | |
| azure.resource.type | The type of the resource | keyword | |
| azure.subscription_id | The subscription ID | keyword | |
| azure.timegrain | The Azure metric timegrain | keyword | |
| cloud.account.id | The cloud account or organization id used to identify different entities in a multi-tenant environment. Examples: AWS account id, Google Cloud ORG Id, or other unique identifier. | keyword | |
| cloud.availability_zone | Availability zone in which this host is running. | keyword | |
| cloud.image.id | Image ID for the cloud instance. | keyword | |
| cloud.instance.id | Instance ID of the host machine. | keyword | |
| cloud.instance.name | Instance name of the host machine. | keyword | |
| cloud.machine.type | Machine type of the host machine. | keyword | |
| cloud.project.id | Name of the project in Google Cloud. | keyword | |
| cloud.provider | Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean. | keyword | |
| cloud.region | Region in which this host is running. | keyword | |
| container.id | Unique container id. | keyword | |
| container.image.name | Name of the image the container was built on. | keyword | |
| container.labels | Image labels. | object | |
| container.name | Container name. | keyword | |
| container.runtime | Runtime managing this container. | keyword | |
| data_stream.dataset | Data stream dataset name. | constant_keyword | |
| data_stream.namespace | Data stream namespace. | constant_keyword | |
| data_stream.type | Data stream type. | constant_keyword | |
| dataset.name | Dataset name. | constant_keyword | |
| dataset.namespace | Dataset namespace. | constant_keyword | |
| dataset.type | Dataset type. | constant_keyword | |
| ecs.version | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | keyword | |
| host | A host is defined as a general computing instance. ECS host.\* fields should be populated with details about the host on which the event happened, or from which the measurement was taken. Host types include hardware, virtual machines, Docker containers, and Kubernetes nodes. | group | |
| host.architecture | Operating system architecture. | keyword | |
| host.containerized | If the host is a container. | boolean | |
| host.domain | Name of the domain of which the host is a member. For example, on Windows this could be the host's Active Directory domain or NetBIOS domain name. For Linux this could be the domain of the host's LDAP provider. | keyword | |
| host.hostname | Hostname of the host. It normally contains what the `hostname` command returns on the host machine. | keyword | |
| host.id | Unique host id. As hostname is not always unique, use values that are meaningful in your environment. Example: The current usage of `beat.name`. | keyword | |
| host.ip | Host ip addresses. | ip | |
| host.mac | Host mac addresses. | keyword | |
| host.name | Name of the host. It can contain what `hostname` returns on Unix systems, the fully qualified domain name, or a name specified by the user. The sender decides which value to use. | keyword | |
| host.os.build | OS build information. | keyword | |
| host.os.codename | OS codename, if any. | keyword | |
| host.os.family | OS family (such as redhat, debian, freebsd, windows). | keyword | |
| host.os.kernel | Operating system kernel version as a raw string. | keyword | |
| host.os.name | Operating system name, without the version. | keyword | |
| host.os.name.text | Multi-field of `host.os.name`. | text | |
| host.os.platform | Operating system platform (such centos, ubuntu, windows). | keyword | |
| host.os.version | Operating system version as a raw string. | keyword | |
| host.type | Type of host. For Cloud providers this can be the machine type like `t2.medium`. If vm, this could be the container, for example, or other information meaningful in your environment. | keyword | |
| service.address | Service address | keyword | |
| service.type | The type of the service data is collected from. The type can be used to group and correlate logs and metrics from one service type. Example: If logs or metrics are collected from Elasticsearch, `service.type` would be `elasticsearch`. | keyword | |



Expand Down
Loading