[8.19] [Discover][APM] Use accessKnownApmEventFields in Trace Error API calls (#242727)

x-pack/solutions/observability/plugins/apm/server/routes/traces/get_apm_trace_error_query.ts

@@ -0,0 +1,95 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { rangeQuery, termQuery } from '@kbn/observability-plugin/server';
+import { asMutableArray } from '../../../common/utils/as_mutable_array';
+import type { APMEventClient } from '../../lib/helpers/create_es_client/create_apm_event_client';
+import { ApmDocumentType } from '../../../common/document_type';
+import { RollupInterval } from '../../../common/rollup';
+
+import {
+  ERROR_CULPRIT,
+  ERROR_EXC_HANDLED,
+  ERROR_EXC_MESSAGE,
+  ERROR_EXC_TYPE,
+  ERROR_GROUP_ID,
+  ERROR_ID,
+  ERROR_LOG_LEVEL,
+  ERROR_LOG_MESSAGE,
+  PARENT_ID,
+  PROCESSOR_EVENT,
+  SERVICE_NAME,
+  SPAN_DESTINATION_SERVICE_RESOURCE,
+  SPAN_ID,
+  TIMESTAMP_US,
+  TRACE_ID,
+  TRANSACTION_ID,
+} from '../../../common/es_fields/apm';
+
+export const requiredFields = asMutableArray([
+  TIMESTAMP_US,
+  TRACE_ID,
+  SERVICE_NAME,
+  ERROR_ID,
+  ERROR_GROUP_ID,
+  PROCESSOR_EVENT,
+] as const);
+
+export const optionalFields = asMutableArray([
+  PARENT_ID,
+  TRANSACTION_ID,
+  SPAN_ID,
+  SPAN_DESTINATION_SERVICE_RESOURCE,
+  ERROR_CULPRIT,
+  ERROR_LOG_MESSAGE,
+  ERROR_EXC_MESSAGE,
+  ERROR_EXC_HANDLED,
+  ERROR_EXC_TYPE,
+] as const);
+
+const excludedLogLevels = ['debug', 'info', 'warning'];
+
+export function getApmTraceErrorQuery({
+  apmEventClient,
+  traceId,
+  docId,
+  start,
+  end,
+}: {
+  apmEventClient: APMEventClient;
+  traceId: string;
+  docId?: string;
+  start: number;
+  end: number;
+}) {
+  return apmEventClient.search('get_errors_docs', {
+    apm: {
+      sources: [
+        {
+          documentType: ApmDocumentType.ErrorEvent,
+          rollupInterval: RollupInterval.None,
+        },
+      ],
+    },
+    body: {
+      track_total_hits: false,
+      size: 1000,
+      query: {
+        bool: {
+          filter: [
+            ...termQuery(TRACE_ID, traceId),
+            ...termQuery(SPAN_ID, docId),
+            ...rangeQuery(start, end),
+          ],
+          must_not: { terms: { [ERROR_LOG_LEVEL]: excludedLogLevels } },
+        },
+      },
+      fields: [...requiredFields, ...optionalFields],
+      _source: [ERROR_LOG_MESSAGE, ERROR_EXC_MESSAGE, ERROR_EXC_HANDLED, ERROR_EXC_TYPE],
+    },
+  });
+}

x-pack/solutions/observability/plugins/apm/server/routes/traces/get_trace_items.ts

@@ -7,39 +7,19 @@
 
 import type { Logger } from '@kbn/logging';
 import type { SortResults } from '@elastic/elasticsearch/lib/api/types';
-import { rangeQuery } from '@kbn/observability-plugin/server';
 import { last } from 'lodash';
-import { unflattenKnownApmEventFields } from '@kbn/apm-data-access-plugin/server/utils';
-import { asMutableArray } from '../../../common/utils/as_mutable_array';
+import { accessKnownApmEventFields } from '@kbn/apm-data-access-plugin/server/utils';
 import type { APMConfig } from '../..';
-import {
-  ERROR_CULPRIT,
-  ERROR_EXC_HANDLED,
-  ERROR_EXC_MESSAGE,
-  ERROR_EXC_TYPE,
-  ERROR_GROUP_ID,
-  ERROR_ID,
-  ERROR_LOG_LEVEL,
-  ERROR_LOG_MESSAGE,
-  PARENT_ID,
-  PROCESSOR_EVENT,
-  SERVICE_NAME,
-  SPAN_DESTINATION_SERVICE_RESOURCE,
-  SPAN_ID,
-  TIMESTAMP_US,
-  TRACE_ID,
-  TRANSACTION_ID,
-} from '../../../common/es_fields/apm';
 import type {
   WaterfallError,
   WaterfallSpan,
   WaterfallTransaction,
 } from '../../../common/waterfall/typings';
 import type { APMEventClient } from '../../lib/helpers/create_es_client/create_apm_event_client';
 import { getSpanLinksCountById } from '../span_links/get_linked_children';
-import { ApmDocumentType } from '../../../common/document_type';
-import { RollupInterval } from '../../../common/rollup';
 import { getTraceDocsPerPage } from './get_trace_docs_per_page';
+import { getApmTraceErrorQuery, requiredFields } from './get_apm_trace_error_query';
+import { compactMap } from '../../utils/compact_map';
 
 export type TraceDoc = WaterfallTransaction | WaterfallSpan;
 
@@ -52,27 +32,6 @@ export interface TraceItems {
   maxTraceItems: number;
 }
 
-export const requiredFields = asMutableArray([
-  TIMESTAMP_US,
-  TRACE_ID,
-  SERVICE_NAME,
-  ERROR_ID,
-  ERROR_GROUP_ID,
-  PROCESSOR_EVENT,
-] as const);
-
-export const optionalFields = asMutableArray([
-  PARENT_ID,
-  TRANSACTION_ID,
-  SPAN_ID,
-  SPAN_DESTINATION_SERVICE_RESOURCE,
-  ERROR_CULPRIT,
-  ERROR_LOG_MESSAGE,
-  ERROR_EXC_MESSAGE,
-  ERROR_EXC_HANDLED,
-  ERROR_EXC_TYPE,
-] as const);
-
 export async function getTraceItems({
   traceId,
   config,
@@ -130,59 +89,38 @@ export async function getTraceItems({
 }
 
 export const MAX_ITEMS_PER_PAGE = 10000; // 10000 is the max allowed by ES
-const excludedLogLevels = ['debug', 'info', 'warning'];
 
-export async function getApmTraceError({
-  apmEventClient,
-  traceId,
-  start,
-  end,
-}: {
+export async function getApmTraceError(params: {
   apmEventClient: APMEventClient;
   traceId: string;
   start: number;
   end: number;
 }) {
-  const response = await apmEventClient.search('get_errors_docs', {
-    apm: {
-      sources: [
-        {
-          documentType: ApmDocumentType.ErrorEvent,
-          rollupInterval: RollupInterval.None,
-        },
-      ],
-    },
-    body: {
-      track_total_hits: false,
-      size: 1000,
-      query: {
-        bool: {
-          filter: [{ term: { [TRACE_ID]: traceId } }, ...rangeQuery(start, end)],
-          must_not: { terms: { [ERROR_LOG_LEVEL]: excludedLogLevels } },
-        },
-      },
-      fields: [...requiredFields, ...optionalFields],
-      _source: [ERROR_LOG_MESSAGE, ERROR_EXC_MESSAGE, ERROR_EXC_HANDLED, ERROR_EXC_TYPE],
-    },
-  });
+  const response = await getApmTraceErrorQuery(params);
 
-  return response.hits.hits.map((hit) => {
+  return compactMap(response.hits.hits, (hit) => {
     const errorSource = 'error' in hit._source ? hit._source : undefined;
+    const event = hit.fields
+      ? accessKnownApmEventFields(hit.fields).requireFields(requiredFields)
+      : undefined;
+
+    if (!event) {
+      return undefined;
+    }
 
-    const event = unflattenKnownApmEventFields(hit.fields, requiredFields);
+    const { parent, error, ...unflattened } = event.unflatten();
 
     const waterfallErrorEvent: WaterfallError = {
-      ...event,
+      ...unflattened,
       parent: {
-        ...event?.parent,
-        id: event?.parent?.id ?? event?.span?.id,
+        id: parent?.id ?? unflattened.span?.id,
       },
       error: {
-        ...(event.error ?? {}),
+        ...error,
         exception:
           (errorSource?.error.exception?.length ?? 0) > 0
             ? errorSource?.error.exception
-            : event?.error.exception && [event.error.exception],
+            : error.exception && [error.exception],
         log: errorSource?.error.log,
       },
     };