Spans, Traces, and Flows

The results area of Explore spans has three tabs—Spans, Traces, and Flows. Spans and Traces render your query as a table. Flows renders the same data as an interactive service map. The active query and time range apply to every tab, so you can switch between them without losing context.

Choose a view

Spans tab

The Spans tab lists the spans that match the active query, sorted by timestamp.

Columns

Traces tab

The Traces tab lists one row per trace. Columns are aggregated at the trace level, and all fields and tags shown for a trace come from its root span.

Columns

Resource column — configurable display keys

The Resource column (present in both the Spans and Traces tabs) displays a human-readable label derived from span attributes. By default, Coralogix selects the most informative attribute available for each span based on its span type.

You can customize which span attributes are used as the Resource column from the Resource Column displayed values panel—similar to the Content column configuration in Logs.

Default field priority by span type:

#	Span type	Fields	Example
1	HTTP	http.method, http.route, http.target, http.url, http.request.method	GET /checkout
2	RUM	cx_rum.network_request_context.url	https://app.store.com/cart
3	gRPC / RPC	rpc.service, rpc.method	CartService.GetCart
4	GraphQL	graphql.operation.type, graphql.operation.name	query getCart
5	GenAI	gen_ai.operation.name, gen_ai.system, gen_ai.request.model, gen_ai.usage.total_tokens	chat.completions (gpt-4o)
6	Messaging	messaging.system, messaging.operation, messaging.destination.name	kafka publish orders-topic
7	Database	db.system, db.operation, db.operation.name, db.namespace, db.name	SELECT users
8	Object Storage	object_storage.operation, object_storage.bucket, object_storage.service	s3 PUT user-uploads
9	Serverless / FaaS	faas.name, faas.trigger	http processOrder
10	Spark / Airflow / DBT	dbt.model, dbt.project, airflow.dag_id, spark.job.id	airflow etl-pipeline
11	Network	net.peer.name, net.peer.port, network.protocol.name, network.transport	api.stripe.com:443
12	Runtime	process.runtime.name	node.js v18
13	Checkly	checkly.check.name	checkout-flow-check
14	CloudEvents	cloudevents.event_type, cloudevents.event_source	com.store.order.created

Error

The Error column is color-coded so you can scan for failures. A dash (-) means no status was recorded. When multiple status types exist on the same span—for example, both http.status_code and otel.status_code—Coralogix prioritizes them in the order: HTTP → gRPC → OpenTelemetry span status.

HTTP (http.response.status_code, http.status_code):

• Green—2xx success
• Yellow—1xx informational, 3xx redirect, or some 4xx client-side responses
• Red—4xx and 5xx server errors

gRPC (rpc.grpc.status_code):

• Green—OK (0)
• Yellow—client-related errors: CANCELLED, INVALID_ARGUMENT, NOT_FOUND, ALREADY_EXISTS, PERMISSION_DENIED, FAILED_PRECONDITION, ABORTED, OUT_OF_RANGE, UNAUTHENTICATED
• Red—server-side failures: UNKNOWN, DEADLINE_EXCEEDED, RESOURCE_EXHAUSTED, UNIMPLEMENTED, INTERNAL, UNAVAILABLE, DATA_LOSS

OpenTelemetry span status (otel.status_code):

• Green—OK
• Yellow—UNSET (no explicit status recorded)
• Red—ERROR

Span kind

The Span kind column (Spans tab) shows the OpenTelemetry span kind along with a directional arrow indicating call direction. Span kind is set by the instrumentation library and cannot be changed after ingestion.

Kind	Arrow	Meaning
SERVER	←	Handles an inbound request into this service.
CLIENT	→	Makes an outbound request to another service.
PRODUCER	→	Publishes a message to a queue, broker, or topic.
CONSUMER	←	Receives and processes a message from a queue or broker.
INTERNAL	—	Performs in-process work (no direction).

Manage columns

Add, remove, reorder, and reset columns to customize the Spans or Traces table.

1. Select Manage columns in the table header.
2. Search for a field by name or browse the list.
3. Select the field to add it as a column.
4. Drag the field to reorder it.
5. Select Apply or close the panel to save changes.

Reset column layout

In Manage columns, select Reset to default to restore the original columns.

Sort columns

The default sort order is by timestamp, newest first. Select a column header to sort by that column. Select again to reverse the order. An indicator shows the active sort column and direction.

Export

Export the current result set for offline analysis or sharing.

1. Select Export in the top-right area of the table.
2. Choose JSON or CSV.
3. Confirm the export.

The Spans tab exports per-span fields. The Traces tab exports trace-summary fields sourced from each trace's root span.

Row actions

Open the more actions menu for row-level actions.

Action	What it does
Copy span	Copies the full span payload to the clipboard.
Copy trace ID	Copies the trace ID for the current row.
Show trace	Opens the full trace that contains the selected span.
Show surrounding similar spans	Expands a submenu to find nearby spans similar by service or operation. Pick a timeframe to scope the search.
Copy permalink	Copies a direct URL to the selected span so you can share it with a teammate or paste it into an incident ticket.

Selecting a row anywhere outside the more actions menu opens the drilldown drawer.

Cell and key actions

Select any value in the table to open the cell action menu.

Action	What it does
Include in query	Adds the field-value pair as an inclusion filter on the current query.
Exclude from query	Adds the field-value pair as an exclusion filter on the current query.
Copy full path	Copies the full field path, including parent keys.
Copy value to the clipboard	Copies the value.
Copy key	Copies the field name.
Value across time	Opens a time-series chart of the selected value over the active time range. Use this to quickly identify if a value is anomalous compared to its historical pattern.

Flows tab

Flows renders the traces in your current query as an interactive service map. The map behavior—nodes, edges, hover metrics, depth control, filters, pan, and zoom—mirrors the Analyze tab in Service Catalog. See that doc for the full reference.

A node count indicator at the top of the map shows how many nodes are visible based on the active filters. Use the minimap in the corner to navigate large service maps without losing context.

Behaviors unique to the Flows tab in Explore spans:

• Query-scoped map: the map aggregates every trace that matches the active query and time range, not a single service in the catalog.
• Cross-tab drilldown: selecting a node filters the Spans and Traces tabs to the traces that pass through that node, so you can jump from the map straight to the underlying rows.
• Errors toggle: filter the map to error paths only.
• Duration filter: narrow the map to slow operations.
• Refine with filters: use the side bar filters or the Errors toggle and Duration filter in the query builder to narrow the traces feeding the service map.

Next steps

Refine your results with error filters, duration filters, and groupings in Query builder for spans.