Semantic Conventions for Elasticsearch

Status: Experimental

The Semantic Conventions for Elasticsearch extend and override the Database Semantic Conventions.

db.system MUST be set to "elasticsearch" and SHOULD be provided at span creation time.

Span Name

The span name follows the general database span name guidelines with the endpoint identifier stored in db.operation.name, and the index stored in db.collection.name.

Attributes

AttributeTypeDescriptionExamplesRequirement LevelStability
db.operation.namestringThe name of the operation or command being executed. [1]search; ml.close_job; cat.aliasesRequiredExperimental
http.request.methodstringHTTP request method. [2]GET; POST; HEADRequiredStable
url.fullstringAbsolute URL describing a network resource according to RFC3986 [3]https://localhost:9200/index/_search?q=user.id:kimchyRequiredStable
db.elasticsearch.path_parts.<key>stringA dynamic value in the url path. [4]db.elasticsearch.path_parts.index=test-index; db.elasticsearch.path_parts.doc_id=123Conditionally Required when the url has dynamic valuesExperimental
db.response.status_codestringThe HTTP response code returned by the Elasticsearch cluster. [5]200; 201; 429Conditionally Required If response was received.Experimental
error.typestringDescribes a class of error the operation ended with. [6]timeout; java.net.UnknownHostException; server_certificate_invalid; 500Conditionally Required If and only if the operation failed.Stable
server.portintServer port number. [7]80; 8080; 443Conditionally Required [8]Stable
db.collection.namestringThe index or data stream against which the query is executed. [9]my_index; index1, index2RecommendedExperimental
db.elasticsearch.node.namestringRepresents the human-readable identifier of the node/instance to which a request was routed. [10]instance-0000000001RecommendedExperimental
db.namespacestringThe name of the Elasticsearch cluster which the client connects to. [11]customers; test.usersRecommendedExperimental
db.operation.batch.sizeintThe number of queries included in a batch operation. [12]2; 3; 4RecommendedExperimental
db.query.textstringThe request body for a search-type query, as a json string. [13]"{\"query\":{\"term\":{\"user.id\":\"kimchy\"}}}"Recommended [14]Experimental
server.addressstringName of the database host. [15]example.com; 10.1.2.80; /tmp/my.sockRecommendedStable

[1]: The db.operation.name SHOULD match the endpoint identifier provided in the request (see the Elasticsearch schema).

[2]: HTTP request method value SHOULD be “known” to the instrumentation. By default, this convention defines “known” methods as the ones listed in RFC9110 and the PATCH method defined in RFC5789.

If the HTTP request method is not known to instrumentation, it MUST set the http.request.method attribute to _OTHER.

If the HTTP instrumentation could end up converting valid HTTP request methods to _OTHER, then it MUST provide a way to override the list of known HTTP methods. If this override is done via environment variable, then the environment variable MUST be named OTEL_INSTRUMENTATION_HTTP_KNOWN_METHODS and support a comma-separated list of case-sensitive known HTTP methods (this list MUST be a full override of the default known method, it is not a list of known methods in addition to the defaults).

HTTP method names are case-sensitive and http.request.method attribute value MUST match a known HTTP method name exactly. Instrumentations for specific web frameworks that consider HTTP methods to be case insensitive, SHOULD populate a canonical equivalent. Tracing instrumentations that do so, MUST also set http.request.method_original to the original value.

[3]: For network calls, URL usually has scheme://host[:port][path][?query][#fragment] format, where the fragment is not transmitted over HTTP, but if it is known, it SHOULD be included nevertheless. url.full MUST NOT contain credentials passed via URL in form of https://username:password@www.example.com/. In such case username and password SHOULD be redacted and attribute’s value SHOULD be https://REDACTED:REDACTED@www.example.com/. url.full SHOULD capture the absolute URL when it is available (or can be reconstructed). Sensitive content provided in url.full SHOULD be scrubbed when instrumentations can identify it.

[4]: Many Elasticsearch url paths allow dynamic values. These SHOULD be recorded in span attributes in the format db.elasticsearch.path_parts.<key>, where <key> is the url path part name. The implementation SHOULD reference the elasticsearch schema in order to map the path part values to their names.

[5]: The status code returned by the database. Usually it represents an error code, but may also represent partial success, warning, or differentiate between various types of successful outcomes. Semantic conventions for individual database systems SHOULD document what db.response.status_code means in the context of that system. This attribute has stability level RELEASE CANDIDATE.

[6]: The error.type SHOULD match the db.response.status_code returned by the database or the client library, or the canonical name of exception that occurred. When using canonical exception type name, instrumentation SHOULD do the best effort to report the most relevant type. For example, if the original exception is wrapped into a generic one, the original exception SHOULD be preferred. Instrumentations SHOULD document how error.type is populated.

[7]: When observed from the client side, and when communicating through an intermediary, server.port SHOULD represent the server port behind any intermediaries, for example proxies, if it’s available.

[8]: If using a port other than the default port for this DBMS and if server.address is set.

[9]: The query may target multiple indices or data streams, in which case it SHOULD be a comma separated list of those. If the query doesn’t target a specific index, this field MUST NOT be set.

[10]: When communicating with an Elastic Cloud deployment, this should be collected from the “X-Found-Handling-Instance” HTTP response header.

[11]: When communicating with an Elastic Cloud deployment, this should be collected from the “X-Found-Handling-Cluster” HTTP response header.

[12]: Operations are only considered batches when they contain two or more operations, and so db.operation.batch.size SHOULD never be 1.

[13]: For sanitization see Sanitization of db.query.text. For batch operations, if the individual operations are known to have the same query text then that query text SHOULD be used, otherwise all of the individual query texts SHOULD be concatenated with separator ; or some other database system specific separator if more applicable. Even though parameterized query text can potentially have sensitive data, by using a parameterized query the user is giving a strong signal that any sensitive data will be passed as parameter values, and the benefit to observability of capturing the static part of the query text by default outweighs the risk. This attribute has stability level RELEASE CANDIDATE.

[14]: Should be collected by default for search-type queries and only if there is sanitization that excludes sensitive information.

[15]: When observed from the client side, and when communicating through an intermediary, server.address SHOULD represent the server address behind any intermediaries, for example proxies, if it’s available.

The following attributes can be important for making sampling decisions and SHOULD be provided at span creation time (if provided at all):

error.type has the following list of well-known values. If one of them applies, then the respective value MUST be used; otherwise, a custom value MAY be used.

ValueDescriptionStability
_OTHERA fallback error value to be used when the instrumentation doesn’t define a custom value.Stable

http.request.method has the following list of well-known values. If one of them applies, then the respective value MUST be used; otherwise, a custom value MAY be used.

ValueDescriptionStability
_OTHERAny HTTP method that the instrumentation has no prior knowledge of.Stable
CONNECTCONNECT method.Stable
DELETEDELETE method.Stable
GETGET method.Stable
HEADHEAD method.Stable
OPTIONSOPTIONS method.Stable
PATCHPATCH method.Stable
POSTPOST method.Stable
PUTPUT method.Stable
TRACETRACE method.Stable

Example

KeyValue
Span name"search my-index"
db.system"elasticsearch"
server.address"elasticsearch.mydomain.com"
server.port9200
http.request.method"GET"
db.query.text"{\"query\":{\"term\":{\"user.id\":\"kimchy\"}}}"
db.operation.name"search"
db.collection.name"my-index"
url.full"https://elasticsearch.mydomain.com:9200/my-index-000001/_search?from=40&size=20"
db.elasticsearch.path_parts.index"my-index-000001"
db.namespace"my-cluster"
db.elasticsearch.node.name"instance-0000000001"