是否有一个 ID 可以对所有日志进行唯一分组 - APM Elasticsearch

如何解决是否有一个 ID 可以对所有日志进行唯一分组 - APM Elasticsearch

当我运行下面显示的命令时，我会获得在单个活动（从开始到结束）上进行的每个事务的日志。

GET /apm-*-transaction/_search
{
  "size": 100,"query": {
    "range": {
      "@timestamp": {
        "gte": "2021-07-19T12:58:40.710-05:00","lt": "2021-07-19T13:08:40.710-05:00"
      }
    }
  }
}

这是一个示例（5 个结果中的 2 个）如下所示：

{
  "took" : 2,"timed_out" : false,"_shards" : {
    "total" : 2,"successful" : 2,"skipped" : 0,"Failed" : 0
  },"hits" : {
    "total" : {
      "value" : 5,"relation" : "eq"
    },"max_score" : 1.0,"hits" : [
      {
        "_index" : "apm-7.13.0-transaction-000002","_type" : "_doc","_id" : "3CXzv3oB2DAWJifJt8jM","_score" : 1.0,"_source" : {
          "agent" : {
            "name" : "dotnet","version" : "1.11.0+a4eb5008af64ca52fe6973c18810c0c8c7a99554"
          },"source" : {
            "ip" : "::1"
          },"processor" : {
            "name" : "transaction","event" : "transaction"
          },"url" : {
            "path" : "/","original" : "https://localhost:5001/","scheme" : "HTTP","domain" : "localhost","full" : "https://localhost:5001/"
          },"observer" : {
            "hostname" : "ef75b7ae7c69","id" : "de63825b-0f59-4df0-aea9-4a538997f6e6","type" : "apm-server","ephemeral_id" : "d050562a-8d75-4209-b7d0-e81febf38d3d","version" : "7.13.0","version_major" : 7
          },"trace" : {
            "id" : "01c92d329ccd92478b83a238e3c01b4a"
          },"@timestamp" : "2021-07-19T18:07:31.953Z","ecs" : {
            "version" : "1.8.0"
          },"service" : {
            "node" : {
              "name" : "CPX-GLE2FOXH0T3"
            },"environment" : "production","framework" : {
              "name" : "ASP.NET Core","version" : "5.0.0.0"
            },"name" : "AppTest","runtime" : {
              "name" : ".NET 5","version" : "5.0.5"
            },"language" : {
              "name" : "C#"
            },"version" : "1.0.0"
          },"host" : {
            "hostname" : "CPX-GLE2FOXH0T3","ip" : "172.25.0.1","name" : "CPX-GLE2FOXH0T3"
          },"client" : {
            "ip" : "::1"
          },"http" : {
            "request" : {
              "headers" : {
                "Cookie" : [
                  ".AspNetCore.Antiforgery.2p9HK2lhxuY=CfDJ8Dx5pi93XlpAlBM6ht9NsLqRNgukbGGnh78TPr3xX0Z_y_FJlWrdLtle0U6p_8j675OuNHXMLqXvnbxdobN7kccl4XJrbJxXghxxnOD0cG36SGXjN544e9evy3i9_B1gQHMkqcTTSXkRZ1nSbHF5IzQ,.AspNetCore.Antiforgery.xEn_h8jTrzk=CfDJ8Dx5pi93XlpAlBM6ht9NsLpqaVgX_9OZKpxiqrooy-T3QRS3IJYkpHcsZ1bjWDNbaMNKRoVgAM_42kZLLojP3w9roVqV9CeomrfH4W2SLXMZzvDHrpOLfgAGABkeTmIJp5BkuBMhCHg7zKgerE72zT8,.AspNetCore.Antiforgery.pWK10f4-nSU=CfDJ8Dx5pi93XlpAlBM6ht9NsLqE4evscYCvbn8gHWTG2rGBL4PZp77mBFUM0oHV8i3kJoamaj2sYos_ImQ6zFy_fDH-RQj02BT4ZQZAibdknxhEzidBJLmdqI3ZppITONjVz_ZVVjKkMTfnHRramkabzhk,.AspNetCore.Antiforgery.tphuApw-2rM=CfDJ8OKn5Y98jFhFj5OjgFbFoJXDU5pnA7XDUkNggYzhtLK3dCxde5OXjIUuU4zDm_6cJ9b3JK6A0k1i9APKs69jGU8_JmoAqDSi3cgnbLEV7xVEThEhMCdaHifsIXyw7rYZMdVBS5403oZfEUOKvpgviM0,.AspNetCore.Antiforgery.ohccJll1qP4=CfDJ8OKn5Y98jFhFj5OjgFbFoJWjauoWueKtAM1D9QkX575_VDMquYoyTciU3uUxyvwr6EW1fFKtdRjgtQoJUy1QthYYbrwNdJBggB7UfOKRpRgim4cOIL34WJ-0i7ayWW7_fliuPcJyo11XnMaiiUa-f3s,.AspNetCore.Antiforgery.u6V5pe-jSMU=CfDJ8OKn5Y98jFhFj5OjgFbFoJVYEagWGJ9Dfp0_g5dY-WMRwCLIzYQzCswRVRR79ELtrEMZQ58Qls-sMebGfgqUlRo-do0_Tu2kFnEL01_9l6Hv2eFSqx2i29ZDTFBSimXSIeKp6WOKJyvHmxp2S1270Uw,.AspNetCore.Antiforgery.nLROWordfdI=CfDJ8OKn5Y98jFhFj5OjgFbFoJUuL5nrnLNA0QoYDQAWAKeFtnvyETdbnan-EGYuOzwJUkD3qwSxXUa-wHnQ94JWUVfztTs-4tZXbGgjsQ0sYZ6M866kvAj1gLfp1-_BpkIk6JyXytRhb0C7w_eddqlxaZA"
                ],"Sec-Ch-Ua" : [
                  "\" Not;A Brand\";v=\"99\",\"Google Chrome\";v=\"91\",\"Chromium\";v=\"91\""
                ],"Accept" : [
                  "text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9"
                ],"User-Agent" : [
                  "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML,like Gecko) Chrome/91.0.4472.124 Safari/537.36"
                ],"Sec-Fetch-Dest" : [
                  "document"
                ],"sec-fetch-site" : [
                  "none"
                ],"Host" : [
                  "localhost:5001"
                ],"Accept-Encoding" : [
                  "gzip,deflate,br"
                ],"sec-fetch-mode" : [
                  "navigate"
                ],":method" : [
                  "GET"
                ],"Upgrade-Insecure-Requests" : [
                  "1"
                ],":scheme" : [
                  "https"
                ],":path" : [
                  "/"
                ],"Sec-Fetch-User" : [
                  "?1"
                ],"Accept-Language" : [
                  "en-US,en;q=0.9"
                ],"Sec-Ch-Ua-Mobile" : [
                  "?0"
                ],":authority" : [
                  "localhost:5001"
                ]
              },"method" : "GET","socket" : {
                "encrypted" : true,"remote_address" : "::1"
              },"body" : {
                "original" : "[REDACTED]"
              }
            },"response" : {
              "headers" : {
                "Server" : [
                  "Kestrel"
                ],"Date" : [
                  "Mon,19 Jul 2021 18:07:31 GMT"
                ],"Content-Type" : [
                  "text/html; charset=utf-8"
                ]
              },"status_code" : 200,"finished" : true
            },"version" : "2"
          },"event" : {
            "ingested" : "2021-07-19T18:07:38.337682900Z","outcome" : "success"
          },"transaction" : {
            "result" : "HTTP 2xx","duration" : {
              "us" : 663305
            },"name" : "GET Home/Index","span_count" : {
              "dropped" : 0,"started" : 0
            },"id" : "0bd2bd7f8b94944e","type" : "request","sampled" : true
          },"user_agent" : {
            "original" : "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML,like Gecko) Chrome/91.0.4472.124 Safari/537.36","os" : {
              "name" : "Windows","version" : "10","full" : "Windows 10"
            },"name" : "Chrome","device" : {
              "name" : "Other"
            },"version" : "91.0.4472.124"
          },"timestamp" : {
            "us" : 1626718051953315
          }
        }
      },{
        "_index" : "apm-7.13.0-transaction-000002","_id" : "3SXzv3oB2DAWJifJt8jM","url" : {
            "path" : "/Second/SecIndex","original" : "https://localhost:5001/Second/SecIndex","full" : "https://localhost:5001/Second/SecIndex"
          },"trace" : {
            "id" : "92c232e28fe661468065148b329eeed3"
          },"@timestamp" : "2021-07-19T18:07:35.443Z","Referer" : [
                  "https://localhost:5001/"
                ],"sec-fetch-site" : [
                  "same-origin"
                ],":path" : [
                  "/Second/SecIndex"
                ],"response" : {
              "headers" : {
                "Cache-Control" : [
                  "no-cache,no-store"
                ],"Server" : [
                  "Kestrel"
                ],"Pragma" : [
                  "no-cache"
                ],19 Jul 2021 18:07:34 GMT"
                ],"event" : {
            "ingested" : "2021-07-19T18:07:38.439690700Z","transaction" : {
            "duration" : {
              "us" : 64185
            },"result" : "HTTP 2xx","name" : "GET Second/SecIndex","id" : "bc217d42a1806b40","timestamp" : {
            "us" : 1626718055443632
          }
        }
      },

但是，我似乎无法确定是否有一个唯一 ID 可以充当父 ID/会话 ID，可以关联单个活动中的所有日志。起初，我注意到在 observer{} 范围内，有一个 id 和一个 ephemeral_id，当我从查询 dsl cmd 给我的结果中搜索这两个 ID 时，它总共返回了 5 次点击（针对所有 5 次交易）。但是，当我再次运行查询 dsl cmd 但使用不同的时间戳时，我仍然拥有相同的 id 和 ephemeral_id，所以我知道这不是唯一标识每个活动的日志的 ID。 是否有唯一 ID 可以从活动的开始到结束进行唯一标识？

解决方法

Transactions 可以被视为跟踪的 root 跨度，其中采样的事务可能具有与之关联的 spans 集合。这些关联的跨度存储在单独的索引中，索引模式为 apm-*-span，其中 _source.transaction.id 是父事务的 ID。

A distributed trace 可以跨越多个服务，因此可以跨越多个事务。分布式跟踪中的事务将共享唯一的 _source.trace.id，该 const SERVER = JSON_SERVER.create(); . . . SERVER.delete('/api/entities/:id',(req,res) => dbUtils.deleteEntities(req,res)); 通过系统唯一标识分布式跟踪。