Explore Tracing
Concepts
Distributed tracing helps you observe modern applications by following individual requests as they pass through multiple services. A trace captures the key details of a request, allowing you to understand what happened, where time was spent, and why an incident occurred or is occurring.
Tracing is especially useful when you need to evaluate system performance end-to-end, pinpoint slow or overloaded components, track latency, and view the full sequence of work that completes a request.
To get the most value from Explore Tracing, it is helpful to understand the following concepts.
Traces and spans
A trace captures the end-to-end path of a single request or action as it flows through the components of a distributed system, including microservices and containerized environments. Traces are especially useful for spotting latency hot spots, dependencies, and cross-service communication problems.
A trace is made up of one or more spans. Each span represents a single operation within the trace and includes a start time (relative to the trace start), a duration, and an operation name. Spans typically form a hierarchy: most spans point to a parent span, except for the first span in the trace, called the root span. Spans often include relevant key/value attributes such as the HTTP method, along with additional metadata like the service name, events within the span, and links to related spans.
Rate, error, and duration (RED) metrics
Traces lets you analyze rate, error, and duration metrics derived from your Tempo traces. These RED signals help you quickly assess traffic volume, failure levels, and request latency.
| Useful for investigating | Metric | Meaning |
|---|---|---|
| Sudden increases in traffic | Rate | Requests per second |
| Failures across services or instrumentation gaps | Error | Number of requests that fail |
| Slow responses and latency patterns | Duration | Time spent per request, shown as a histogram |
Overview
With Tracing, you can follow every request across services, identify latency issues, troubleshoot bottlenecks, and correlate traces directly with logs—all in a streamlined, visual workflow. This allows teams to move quickly from high-level symptoms to precise root causes, even in complex, distributed environments.
The Explore tracing workspace is where investigations come together. It enables you to visualize flows end-to-end, compare traces, and analyze spans at scale to uncover patterns, errors, breached durations, and performance anomalies. The goal is to reduce the time and effort required to answer critical questions such as:
- What’s happening in my business flow right now?
- What caused this alert?
- Which services and business areas are impacted?
- Who owns the issue?
From there, you can drill directly into the exact trace or span responsible.
Investigation tools
- Drilldown: Dive deeper into the metadata, logs, and context associated with a selected trace or span without leaving your workflow.
- Highlights: Instantly understand how spans are distributed across key fields, making it easy to spot patterns, anomalies, outliers, and potential root-cause indicators at a glance.
Together, these capabilities empower teams to move from detection to diagnosis faster, ensuring reliable performance and clear ownership across distributed systems.
Query traces and spans
To access the Tracing function:
From the Coralogix navigation toolbar, select Explore, then Tracing.
Choose whether to view spans or traces using the Span/Traces toggle in the toolbar.
Note
You can view only Frequent Search (high-priority) data or All priorities (high, medium, and low-priority).
Use filters or a query to search for traces or spans of interest.
- When viewing spans, you can run Lucene or DataPrime queries.
- When viewing traces, Coralogix displays the 50 latest traces that meet your filter criteria.
- When viewing spans, 15,000 rows are displayed, sorted by timestamp (ascending or descending).
Hover over a trace or span number and select more actions menu to:
- Visualize data
- Copy the ID
- View the raw span
- Export as JSON or CSV
Note
In the Action column, the value N/A appears when a trace’s root span is missing or when multiple root spans exist for a trace. See the Troubleshooting section below for more details.
Troubleshooting when N/A appears in the Action column
If you see N/A in the Action column when viewing traces, this usually indicates that the root span is missing from the trace data.
Follow these steps to confirm and resolve the issue:
Check for a parentId in the spans.
Select a trace that shows N/A in the Action column.
Select the trace to open its details and copy the traceId.
Go to the Spans view and search using that traceId.
From the results list, select the ellipsis (...) next to a span and select View Raw Span.
Search the raw span data for the field parentId.
If parentId is present, the trace’s root span was not ingested in Coralogix.
Explanation
The presence of a parentId means the span is a child span, and its root span is missing.
A span without a parentId is considered a root span.
When no root span exists, Coralogix cannot determine the action name, and the Action column displays N/A.
In rare cases, N/A also appears when a trace includes two root spans, which causes ambiguity.
Take action
Review your instrumentation setup and verify that:
The root span is being properly created and included when traces are sent to Coralogix.
The trace export configuration includes all spans in the trace, including the root.
If the issue persists after verifying instrumentation, contact Support for assistance.
Filter
On the left-hand sidebar, you will find the following default filters:
- Teams: When a user is a member of multiple teams, they can search for a trace across multiple teams in a single action. The list of teams will be displayed under the Teams filter.
- Duration: Find traces that last a long time or are within a certain min-max range that you can easily define, either by adjusting the double range slider from each side or by inputting the exact time in milliseconds in the start-end boxes above the slider.
- Show only errors toggle
- Show only root spans toggle
- Application & Subsystem
- Service
- Action
Once you have added all of the relevant filters, select APPLY.
Save your traces view
If you want to use the same filters and column order in the future:
- Navigate to Unsaved View at the top of the grid.
- Select more actions menu and open CREATE A NEW VIEW field.
- Enter a name for your new view.
- Select whether you want to keep the view private or share it with your team.
- Select whether you would also like to save the query parameters.
Select if you want to set this as your default view.
To access your saved views or your team’s public views, select All Views.
Note
When you save the view, Logs and Tracing tabs are saved at the same time.
Aggregation function
In the tracing screen, the graphs in the top section give you the ability to calculate statistics using any of the supported arithmetic options: Count, AVG, MIN, MAX SUM and Percentiles (50th / 95th / 99th). You have the option of Grouping by: Application, Subsystem, Service and Action.
The tracing screen has 3 default graphs:
- Max Duration grouped by Action
- Spans (count) grouped by Application
- Errors (count) grouped by Service
Note
Choosing any aggregation other than Count changes the Y scale units of the graph into milliseconds.
Visualize traces and spans
Select a trace of interest to view its underlying spans. Select your preferred visualization mode — Dependencies, Gantt, or Flame view — to explore varied views of the span data.
Find out more here.
Highlight and Compare
Highlights allow you see how spans are distributed across fields, so you can quickly spot commonalities, outliers, and root causes.
Compare mode shows what changed between two time periods—whether a sudden spike, a regression, or a recurring pattern.
Find out more here.
APM features
Go to the trace of interest and select Related Data in the Span data window to access our APM features: related logs, events, pod, and host.
Related logs tab
Define the mapping between the trace spans to the related logs by accessing the RELATED LOGS tab and selecting Setup Correlation. This opens a menu where you can add the relevant field containing the span ID.
Redirect to the relevant logs by selecting Open Logs Query. This will direct you to a Logs screen, showing you the log containing the correlated span ID.
Additional resources
