Open in ChatGPTOpen in Claude

Spans, Traces, and Flows

The results area of Explore spans has three tabs. Spans, Traces, and Flows. Spans and Traces render your query as a table. Flows renders the same data as an interactive service map. The active query and time range apply to every tab, so you can switch between them without losing context.

Choose a view

Tab	What you see
Spans (default)	One row per span. Use this tab to find a specific operation that explains a symptom.
Traces	One row per trace. Use this tab to compare end-to-end requests.
Flows	Service map of the traces in the current query. Use this tab to understand how services communicate.

Spans tab

The Spans tab lists the spans that match the active query, sorted by timestamp.

Columns

Column	Description
Timestamp	When the span began.
Service name	The service that produced the span. The icon reflects the SDK language (telemetry.sdk.language).
Operation	Operation name, for example, Lambda.Invoke or index.continuous_data_....
Span kind	SERVER, CLIENT, PRODUCER, CONSUMER, or INTERNAL, with a directional arrow. See Span kind.
Resource	Human-readable resource label derived from span attributes. See Resource column, configurable display keys.
Duration	Span duration in ms or a larger unit.
Status	Error status, color-coded when applicable, or a dash when the span has no status. See Error.
Span ID	Unique identifier for the span.

Traces tab

The Traces tab lists one row per trace. Columns are aggregated at the trace level, and all fields and tags shown for a trace come from its root span.

How span filters match

When you filter by a span attribute in the Traces tab, the filter matches individual spans but returns one row per trace: you get every trace that contains at least one span matching your query, and each result represents the whole trace, including the spans that don't match. For example, filtering by tags.span.kind:server returns every trace that has a server span. Because a trace usually also contains client, internal, and other spans, those still appear when you open the trace. The filter selects traces, not individual spans, so seeing non-matching spans in your results is normal. To list only the spans that match your query, switch to the Spans tab. For more precise investigation, such as finding a specific span or spans in a particular relationship to each other rather than any trace that contains a matching span, use a relational filter.

Columns

Column	Description
Timestamp	The earliest span start time in the trace (typically the root span).
Root service name	The service that initiated the trace.
Operation	Operation name of the root span.
Resource	Human-readable resource label for the root span.
Span count	Number of spans in the trace.
Errors	Spans marked as errors.
Duration	End-to-end duration from root-span start to root-span end. Hover the cell to see a per-service trace duration breakdown, for example, Cumulative span duration: 211.17ms shows the sum of all span durations within the trace.
Trace ID	Unique identifier for the trace.

The Span count, Errors, and Duration columns reflect the entire trace, independent of the query time range. Even when your selected time range covers only part of a trace, these columns report the trace's true totals, so you can identify large or long-running traces before you open them. See Investigate large and long-running traces.

Row display options

Select Options in the results toolbar to control how each row renders on the Spans and Traces tabs. Both tabs share the same settings, so a change on one applies to the other. The popover holds:

• Row size: how tall a row can grow. S keeps every span on a single truncated line, M wraps each row over up to three lines, and L over up to six, so a long operation name or resource stays readable without opening the span.
• Span format: how a span is laid out in an expanded row. List shows key fields without raw JSON, JSON shows the formatted JSON tree, and Condensed is a denser layout. Hover the icon beside the label for a reminder that the format applies to expanded rows.
• Expand nested fields: a switch that appears under Span format only while the format is JSON. Turn it on to open every nested field of a span by default when you expand a row.
• Manage keys: select Modify to open the Manage keys drawer, where you set the keys the Resource column uses and the keys pinned at the top of expanded rows. See Resource column: configurable display keys.

Unlike the logs table, the spans and traces grids have no Content column, so the popover has no Content control. For the logs equivalent, see Row display options in the logs table.

Expand a row

Each span row has an expand chevron in its row actions, with the tooltip Show span details. Select it to open a full-width details row beneath the span holding the complete span document, rendered in the Span format you set in Options. On the Traces tab, the chevron reads Show root span details and the details row shows the trace's root span. A trace with no root span has no chevron.

With a row highlighted, you can also press the right arrow key to expand it and the left arrow key to collapse it.

The details row has its own Copy span button at the top right, which copies the span document as formatted JSON. When the format is JSON, the row also offers Expand all / Collapse all to open or close every nested key at once. Select the chevron again, now Hide span details or Hide root span details, to close the row.

Selecting the row itself still opens the drilldown drawer. Only the chevron and the arrow keys expand a row in place.

Resource column: configurable display keys

The Resource column (present in both the Spans and Traces tabs) displays a human-readable label derived from span attributes. By default, Coralogix selects the most informative attribute available for each span based on its span type.

Change the attributes Resource uses

Select Options in the results toolbar, then select Modify next to Manage keys. The Manage keys drawer opens from either the Spans or the Traces tab, and the keys you set apply to the Resource column on both tabs. The drawer has two tabs, and one Apply commits the changes you make on both:

• Prioritized keys: the attributes the Resource column uses, in priority order.
• Pinned keys: span attributes that show at the top of a span's expanded details row, in the order you set, for every span that contains them. Pinned span keys are kept separately from the pinned keys of the logs table, so pinning a span attribute doesn't change your logs. Because the spans grid has no Content column, pinned keys appear only in expanded rows, not in the collapsed row.

Resource shows the most descriptive attribute for the operation type found on the span, such as HTTP, gRPC, a database query, or a messaging topic, and the order of the list decides which attribute wins.

The Prioritized keys tab works the same way as Manage keys for the logs Content column:

• Prioritized keys: the attributes in priority order, as numbered chips. Resource uses the first key the span carries and falls back to the next one down when that key is missing. The heading carries a live count, for example Prioritized keys (41/61), where 61 is the most you can prioritize.
• Available keys: every other key found on your spans, with its own count and a Search keys box. Select a key to move it into the prioritized list.
• Reorder: drag a chip to a new position, or focus it and use the arrow keys. The number is the key's position.
• Remove: select the × on a chip, or press Delete or Backspace while the chip is focused. The key returns to Available keys.
• Return to default: restores the built-in priority shown below.
• Apply: commits your changes. It stays disabled until you make one, and nothing takes effect until you select it.

When you select more than one dataset, the Available keys list shows a coverage badge, such as 2/3, for how many of the selected span datasets contain each key, with an Available in tooltip listing them, the same as Manage keys across multiple datasets for logs.

A saved view stores your Resource column selection along with the rest of its table settings.

Default field priority by span type:

#	Span type	Fields	Example
1	HTTP	http.method, http.route, http.target, http.url, http.request.method	GET /checkout
2	RUM	cx_rum.network_request_context.url	https://app.store.com/cart
3	gRPC / RPC	rpc.service, rpc.method	CartService.GetCart
4	GraphQL	graphql.operation.type, graphql.operation.name	query getCart
5	GenAI	gen_ai.operation.name, gen_ai.system, gen_ai.request.model, gen_ai.usage.total_tokens	chat.completions (gpt-4o)
6	Messaging	messaging.system, messaging.operation, messaging.destination.name	kafka publish orders-topic
7	Database	db.system, db.operation, db.operation.name, db.namespace, db.name	SELECT users
8	Object Storage	object_storage.operation, object_storage.bucket, object_storage.service	s3 PUT user-uploads
9	Serverless / FaaS	faas.name, faas.trigger	http processOrder
10	Spark / Airflow / DBT	dbt.model, dbt.project, airflow.dag_id, spark.job.id	airflow etl-pipeline
11	Network	net.peer.name, net.peer.port, network.protocol.name, network.transport	api.stripe.com:443
12	Runtime	process.runtime.name	node.js v18
13	Checkly	checkly.check.name	checkout-flow-check
14	CloudEvents	cloudevents.event_type, cloudevents.event_source	com.store.order.created

Error

The Error column is color-coded so you can scan for failures. A dash (-) means no status was recorded. When multiple status types exist on the same span (for example, both http.status_code and otel.status_code) Coralogix prioritizes them in the order: HTTP → gRPC → OpenTelemetry span status.

Coralogix reads the span's error tag as the primary error signal: a span counts as an explicit error only when it carries an error tag set to true. This is the same signal the Errors toggle filters on.

When a span returns a failing HTTP or gRPC status but carries no error tag, the badge is orange rather than red, an error status that wasn't explicitly flagged, so it doesn't read as a critical failure. This follows the OpenTelemetry HTTP span conventions: a 4xx response leaves span status unset on a SERVER span, the server correctly rejected a bad client request, and sets it to Error only on a CLIENT span.

HTTP (http.response.status_code, http.status_code):

• Green, 2xx success
• Yellow, 1xx informational, or a 3xx redirect on a span flagged with an error tag
• Red. 4xx or 5xx on a span flagged with an error tag
• Orange, a 3xx, 4xx, or 5xx status on a span with no error tag

gRPC (rpc.grpc.status_code):

• Green. OK (0)
• Yellow. Client-related codes on a span flagged with an error tag: CANCELLED, INVALID_ARGUMENT, NOT_FOUND, ALREADY_EXISTS, PERMISSION_DENIED, FAILED_PRECONDITION, ABORTED, OUT_OF_RANGE, UNAUTHENTICATED
• Red. Server-side codes on a span flagged with an error tag: UNKNOWN, DEADLINE_EXCEEDED, RESOURCE_EXHAUSTED, UNIMPLEMENTED, INTERNAL, UNAVAILABLE, DATA_LOSS
• Orange, any non-OK code on a span with no error tag

OpenTelemetry span status (otel.status_code):

• Green. OK
• Yellow. UNSET (no explicit status recorded)
• Red. ERROR

The OpenTelemetry span status is itself an explicit error signal, so the orange rule doesn't apply to it.

Span kind

The Span kind column (Spans tab) shows the OpenTelemetry span kind along with a directional arrow indicating call direction. Span kind is set by the instrumentation library and cannot be changed after ingestion.

Kind	Arrow	Meaning
SERVER	←	Handles an inbound request into this service.
CLIENT	→	Makes an outbound request to another service.
PRODUCER	→	Publishes a message to a queue, broker, or topic.
CONSUMER	←	Receives and processes a message from a queue or broker.
INTERNAL	-	Performs in-process work (no direction).

Columns

Add, remove, reorder, and reset columns to customize the Spans or Traces table.

1. Select Columns in the table header.
2. Search for a field by name or browse the list.
3. Select the field to add it as a column.
4. Drag the field to reorder it.
5. Select Apply or close the panel to save changes.

Tip

In the Spans tab you manage span attributes. In the Traces tab you manage trace-aggregated metrics such as service count and total duration. Column values in the Traces tab are sourced from each trace's root span.

When you select more than one dataset, column management adds a view selector (Common fields / All datasets / a single dataset) and a coverage badge, such as 2/3, on each field with an Available in tooltip, the same as in the logs table.

Reset column layout

In Columns, select Reset to default to restore the original columns.

Sort columns

The default sort order is by timestamp, newest first. Select a column header to sort by that column. Select again to reverse the order. An indicator shows the active sort column and direction.

Export

Use Export in the table header to download the current result set. The Spans tab exports per-span fields and runs against the backend. The Traces tab exports trace-summary fields, sourced from each trace's root span, for the rows already loaded into the grid.

For supported formats, row caps, and file-name rules, see Export data.

Row actions

Open the more actions menu for row-level actions.

Action	What it does
Copy span	Copies the full span payload to the clipboard.
Copy trace ID	Copies the trace ID for the current row.
Show trace	Opens the full trace that contains the selected span.
Show surrounding spans	Expands a submenu to load spans that share this span's service and operation. Pick a time window (5 Seconds to 10 Minutes) or a span count (10, 30, or 50 Spans); Coralogix loads that many before and after the span, up to 100 total, and opens them in a separate Explore tab centered on it.
Show surrounding root spans	The same action for a trace row, scoped to the trace's root service and operation and anchored on its root span.
Copy URL	Copies a link to the selected span. Opening the link reopens that span in Explore, so you can share it with a teammate or paste it into an incident ticket.
Export span JSON	Downloads the selected span as <spanId>.json.
Export root span JSON	Downloads the trace's root span as <traceId>-root.json.
Export trace CSV	Downloads every span in the trace as <traceId>.csv, with nested attributes flattened into dotted columns. Capped at 50,000 spans per trace.

Messages you might see during a trace CSV export:

• Exporting trace CSV… while Coralogix builds the trace CSV.
• This trace has no spans to export. when the trace is empty.
• This trace has no root span to export. when no root span exists.

Selecting a row anywhere outside the more actions menu and the expand chevron opens the drilldown drawer.

To act on several spans at once, see Select multiple rows.

Add a span to Olly context

Send a specific span to Olly when you want to ask about that exact operation instead of the full query result. The action lives in a right-pinned column in the spans table. The column has no header, and the button appears only when you hover the row.

1. Hover the span row you want to send to Olly. The Olly icon appears at the right edge of the row.
2. Select Add to Olly context.

Olly opens in a drawer with the span already attached as a data-context chip. Labelled with the span's start time, with an entity icon, and a tooltip that reads Span: <timestamp>. Add more rows by hovering other spans and selecting the same action; each one becomes its own chip. See Page and data context for chip behavior and removal.

The Olly column stays pinned to the end of the table and isn't part of the column layout. You can't move it, hide it from Manage columns, or include it in a saved view. The button doesn't appear on rows where the span has no resolvable ID.

Cell and key actions

Select any value in the table to open the cell action menu. By default it filters on the exact value; to filter on a substring, first select only the part of the value you want.

Action	What it does
Custom Actions	Opens a submenu listing every action that matches the selected value. Use the search box or the All / Private / Shared tabs to find an action, then select it to open the destination URL in a new tab. Select Manage actions at the bottom to create or edit actions. See Custom actions.
Filter by	Adds the field-value pair as an exact-match filter on the current query. Shown when the whole value is selected.
Add to filter	Adds a substring filter that matches the selected text wherever it appears. Replaces Filter by when you select only part of a value.
Exclude	Excludes the field-value pair from the current query, the exact value, or the selected substring on a partial selection.
Copy path	Copies the full field path, including parent keys.
Copy value	Copies the value.
Copy key	Copies the field name.
Value across time	Opens a time-series chart of the selected value over the active time range. Use this to quickly identify if a value is anomalous compared to its historical pattern.

Search matches in the grid

When you search with Add to filter, a Contains filter in the query builder, or a DataPrime query, the spans grid highlights the matching text in each row, the same way the logs table does. Matches are marked in the Service name, Operation, Resource, and Span ID columns and in any tag columns you add. A filter scoped to a field marks matches in that field's column only, while a free-text search marks matching text in every one of these columns. Span kind and Status aren't highlighted.

Flows tab

Flows renders the traces in your current query as an interactive service map. The map behavior (nodes, edges, hover metrics, depth control, filters, pan, and zoom) mirrors the Analyze tab in Service Catalog. See that doc for the full reference.

A node count indicator at the top of the map shows how many nodes are visible based on the active filters. Use the minimap in the corner to navigate large service maps without losing context.

Behaviors unique to the Flows tab in Explore spans:

• Query-scoped map: the map aggregates every trace that matches the active query and time range, not a single service in the catalog.
• Cross-tab drilldown: selecting a node filters the Spans and Traces tabs to the traces that pass through that node, so you can jump from the map straight to the underlying rows.
• Errors toggle: filter the map to error paths only.
• Duration filter: narrow the map to slow operations.
• Refine with filters: use the side bar filters or the Errors toggle and Duration filter in the query builder to narrow the traces feeding the service map.

Next steps

Break the spans matching your query down by field in the Highlights tab.