[Discover][Traces] Showing Logs in context of the trace

examples/unified_doc_viewer/kibana.jsonc

@@ -7,10 +7,6 @@
     "id": "unifiedDocViewerExamples",
     "server": false,
     "browser": true,
-    "requiredPlugins": [
-      "data",
-      "developerExamples",
-      "unifiedDocViewer"
-    ]
+    "requiredPlugins": ["data", "developerExamples", "unifiedDocViewer"]
   }
 }

src/platform/plugins/shared/discover_shared/public/services/discover_features/types.ts

@@ -10,6 +10,7 @@
 import type { DataTableRecord } from '@kbn/discover-utils';
 import type { FunctionComponent, PropsWithChildren } from 'react';
 import type { DataGridCellValueElementProps } from '@kbn/unified-data-table';
+import type { Query, TimeRange } from '@kbn/es-query';
 import type { SpanLinks } from '@kbn/apm-types';
 import type { ProcessorEvent } from '@kbn/apm-types-shared';
 import type { FeaturesRegistry } from '../../../common';
@@ -66,6 +67,20 @@ export interface ObservabilityCreateSLOFeature {
   }) => React.ReactNode;
 }
 
+export interface ObservabilityLogEventsFeature {
+  id: 'observability-log-events';
+  render: (props: {
+    query: Query;
+    timeRange: TimeRange;
+    index: string;
+    displayOptions?: {
+      solutionNavIdOverride: 'oblt';
+      enableDocumentViewer: false;
+      enableFilters: false;
+    };
+  }) => JSX.Element;
+}
+
 /** **************** Security Solution ****************/
 
 export interface SecuritySolutionCellRendererFeature {
@@ -91,6 +106,7 @@ export type DiscoverFeature =
   | ObservabilityStreamsFeature
   | ObservabilityLogsAIAssistantFeature
   | ObservabilityCreateSLOFeature
+  | ObservabilityLogEventsFeature
   | ObservabilityTracesSpanLinksFeature
   | SecuritySolutionFeature;
 

src/platform/plugins/shared/discover_shared/tsconfig.json

@@ -3,17 +3,13 @@
   "compilerOptions": {
     "outDir": "target/types"
   },
-  "include": [
-    "common/**/*",
-    "public/**/*",
-    "server/**/*",
-    "../../../../../typings/**/*",
-  ],
+  "include": ["common/**/*", "public/**/*", "server/**/*", "../../../../../typings/**/*"],
   "exclude": ["target/**/*"],
   "kbn_references": [
     "@kbn/discover-utils",
     "@kbn/core",
     "@kbn/unified-data-table",
+    "@kbn/es-query",
     "@kbn/apm-types",
     "@kbn/apm-types-shared"
   ]

src/platform/plugins/shared/unified_doc_viewer/kibana.jsonc

@@ -1,28 +1,16 @@
 {
   "type": "plugin",
   "id": "@kbn/unified-doc-viewer-plugin",
-  "owner": [
-    "@elastic/kibana-data-discovery"
-  ],
+  "owner": ["@elastic/kibana-data-discovery"],
   "group": "platform",
   "visibility": "shared",
   "description": "This plugin contains services reliant on the plugin lifecycle for the unified doc viewer component (see @kbn/unified-doc-viewer).",
   "plugin": {
     "id": "unifiedDocViewer",
     "browser": true,
     "server": false,
-    "requiredPlugins": [
-      "data",
-      "fieldFormats",
-      "share",
-      "embeddable",
-      "discoverShared"
-    ],
-    "optionalPlugins": [
-      "fieldsMetadata"
-    ],
-    "requiredBundles": [
-      "kibanaUtils"
-    ]
+    "requiredPlugins": ["data", "fieldFormats", "share", "embeddable", "discoverShared"],
+    "optionalPlugins": ["fieldsMetadata"],
+    "requiredBundles": ["kibanaUtils"]
   }
 }

src/platform/plugins/shared/unified_doc_viewer/public/components/observability/traces/components/trace_context_log_events/index.tsx

@@ -0,0 +1,72 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the "Elastic License
+ * 2.0", the "GNU Affero General Public License v3.0 only", and the "Server Side
+ * Public License v 1"; you may not use this file except in compliance with, at
+ * your election, the "Elastic License 2.0", the "GNU Affero General Public
+ * License v3.0 only", or the "Server Side Public License, v 1".
+ */
+
+import React, { useMemo } from 'react';
+import { i18n } from '@kbn/i18n';
+import { ContentFrameworkSection } from '../../../../content_framework/section';
+import { getUnifiedDocViewerServices } from '../../../../../plugin';
+import { useDataSourcesContext } from '../../hooks/use_data_sources';
+import { useLogsQuery } from '../../hooks/use_logs_query';
+
+const logsTitle = i18n.translate('unifiedDocViewer.observability.traces.section.logs.title', {
+  defaultMessage: 'Logs',
+});
+
+const logsDescription = i18n.translate(
+  'unifiedDocViewer.observability.traces.section.logs.description',
+  {
+    defaultMessage: 'Correlated logs that occurred during the span',
+  }
+);
+
+export interface TraceContextLogEventsProps {
+  traceId: string;
+  spanId?: string;
+  transactionId?: string;
+}
+export function TraceContextLogEvents({
+  traceId,
+  transactionId,
+  spanId,
+}: TraceContextLogEventsProps) {
+  const { data: dataService, discoverShared } = getUnifiedDocViewerServices();
+  const { indexes } = useDataSourcesContext();
+  const { from, to } = dataService.query.timefilter.timefilter.getTime();
+
+  const timeRange = useMemo(() => ({ from, to }), [from, to]);
+  const query = useLogsQuery({ traceId, spanId, transactionId });
+
+  const savedSearchTimeRange = useMemo(
+    () => ({
+      from: timeRange.from,
+      to: timeRange.to,
+    }),
+    [timeRange.from, timeRange.to]
+  );
+
+  const LogEvents = discoverShared.features.registry.getById('observability-log-events');
+
+  if (!LogEvents || !indexes.logs) {
+    return null;
+  }
+
+  const LogEventsComponent = LogEvents.render;
+
+  return (
+    <ContentFrameworkSection
+      title={logsTitle}
+      description={logsDescription}
+      id="traceContextLogEvents"
+    >
+      <div tabIndex={0} className="eui-yScrollWithShadows" style={{ maxHeight: '400px' }}>
+        <LogEventsComponent query={query} timeRange={savedSearchTimeRange} index={indexes.logs} />
+      </div>
+    </ContentFrameworkSection>
+  );
+}

src/platform/plugins/shared/unified_doc_viewer/public/components/observability/traces/doc_viewer_span_overview/span_overview.tsx

@@ -40,6 +40,7 @@ import {
   getTabContentAvailableHeight,
   DEFAULT_MARGIN_BOTTOM,
 } from '../../../doc_viewer_source/get_height';
+import { TraceContextLogEvents } from '../components/trace_context_log_events';
 
 export type SpanOverviewProps = DocViewRenderProps & {
   indexes: TraceIndexes;
@@ -163,6 +164,14 @@ export function SpanOverview({
                 <EuiSpacer size="m" />
                 <SpanLinks traceId={traceId} docId={spanId} />
               </EuiFlexItem>
+              <EuiFlexItem>
+                <EuiSpacer size="m" />
+                <TraceContextLogEvents
+                  traceId={flattenedDoc[TRACE_ID_FIELD]}
+                  spanId={flattenedDoc[SPAN_ID_FIELD]}
+                  transactionId={transactionId}
+                />
+              </EuiFlexItem>
             </EuiFlexGroup>
           </FieldActionsProvider>
         </RootSpanProvider>

src/platform/plugins/shared/unified_doc_viewer/public/components/observability/traces/doc_viewer_transaction_overview/transaction_overview.tsx

@@ -38,6 +38,7 @@ import {
   DEFAULT_MARGIN_BOTTOM,
   getTabContentAvailableHeight,
 } from '../../../doc_viewer_source/get_height';
+import { TraceContextLogEvents } from '../components/trace_context_log_events';
 import { SpanLinks } from '../components/span_links';
 
 export type TransactionOverviewProps = DocViewRenderProps & {
@@ -156,13 +157,16 @@ export function TransactionOverview({
                 </>
               )}
             </EuiFlexItem>
+            <EuiSpacer size="m" />
+            <SpanLinks
+              traceId={traceId}
+              docId={transactionId}
+              processorEvent={ProcessorEvent.transaction}
+            />
+            <EuiFlexItem />
             <EuiFlexItem>
               <EuiSpacer size="m" />
-              <SpanLinks
-                traceId={traceId}
-                docId={transactionId}
-                processorEvent={ProcessorEvent.transaction}
-              />
+              <TraceContextLogEvents traceId={traceId} transactionId={transactionId} />
             </EuiFlexItem>
           </EuiFlexGroup>
         </FieldActionsProvider>

src/platform/plugins/shared/unified_doc_viewer/public/components/observability/traces/hooks/use_logs_query.test.tsx

@@ -0,0 +1,43 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the "Elastic License
+ * 2.0", the "GNU Affero General Public License v3.0 only", and the "Server Side
+ * Public License v 1"; you may not use this file except in compliance with, at
+ * your election, the "Elastic License 2.0", the "GNU Affero General Public
+ * License v3.0 only", or the "Server Side Public License, v 1".
+ */
+
+import React from 'react';
+import { render, screen } from '@testing-library/react';
+import { useLogsQuery } from './use_logs_query';
+
+function TestComponent({
+  traceId,
+  spanId,
+  transactionId,
+}: {
+  traceId: string;
+  transactionId?: string;
+  spanId?: string;
+}) {
+  const query = useLogsQuery({ traceId, spanId, transactionId });
+  return <div data-test-subj="query">{query.query}</div>;
+}
+
+describe('useLogsQuery', () => {
+  it('builds query for traceId ', () => {
+    render(<TestComponent traceId="trace123" />);
+    const div = screen.getByTestId('query');
+    expect(div.textContent).toBe(`(trace.id:"trace123" OR (not trace.id:* AND "trace123"))`);
+  });
+
+  it('builds query for traceId, transactionId and spanId', () => {
+    render(<TestComponent traceId="trace123" spanId="span456" transactionId="transaction123" />);
+    const div = screen.getByTestId('query');
+    expect(div.textContent).toBe(
+      `(trace.id:"trace123" OR (not trace.id:* AND "trace123")) AND ` +
+        `(transaction.id:"transaction123" OR (not transaction.id:* AND "transaction123")) AND ` +
+        `(span.id:"span456" OR (not span.id:* AND "span456"))`
+    );
+  });
+});

src/platform/plugins/shared/unified_doc_viewer/public/components/observability/traces/hooks/use_logs_query.ts

@@ -0,0 +1,41 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the "Elastic License
+ * 2.0", the "GNU Affero General Public License v3.0 only", and the "Server Side
+ * Public License v 1"; you may not use this file except in compliance with, at
+ * your election, the "Elastic License 2.0", the "GNU Affero General Public
+ * License v3.0 only", or the "Server Side Public License, v 1".
+ */
+
+import { useMemo } from 'react';
+import { SPAN_ID_FIELD, TRACE_ID_FIELD, TRANSACTION_ID_FIELD } from '@kbn/discover-utils';
+export interface GetLogsQueryParams {
+  traceId: string;
+  transactionId?: string;
+  spanId?: string;
+}
+
+export function useLogsQuery({ traceId, spanId, transactionId }: GetLogsQueryParams) {
+  return useMemo(() => {
+    const queryStrings = [
+      `(${TRACE_ID_FIELD}:"${traceId}" OR (not ${TRACE_ID_FIELD}:* AND "${traceId}"))`,
+    ];
+
+    if (transactionId) {
+      queryStrings.push(
+        `(${TRANSACTION_ID_FIELD}:"${transactionId}" OR (not ${TRANSACTION_ID_FIELD}:* AND "${transactionId}"))`
+      );
+    }
+
+    if (spanId) {
+      queryStrings.push(
+        `(${SPAN_ID_FIELD}:"${spanId}" OR (not ${SPAN_ID_FIELD}:* AND "${spanId}"))`
+      );
+    }
+
+    return {
+      language: 'kuery',
+      query: queryStrings.join(' AND '),
+    };
+  }, [traceId, spanId, transactionId]);
+}

src/platform/plugins/shared/unified_doc_viewer/public/types.ts

@@ -10,7 +10,7 @@
 export type { JsonCodeEditorProps } from './components';
 export type { EsDocSearchProps } from './hooks';
 export type { UnifiedDocViewerSetup, UnifiedDocViewerStart } from './plugin';
-
+import type { DiscoverSharedPublicStart } from '@kbn/discover-shared-plugin/public';
 import type { CoreStart } from '@kbn/core-lifecycle-browser';
 import type { AnalyticsServiceStart } from '@kbn/core-analytics-browser';
 import type { DataPublicPluginStart } from '@kbn/data-plugin/public';
@@ -20,9 +20,7 @@ import type { Storage } from '@kbn/kibana-utils-plugin/public';
 import type { IUiSettingsClient } from '@kbn/core-ui-settings-browser';
 import type { SharePluginStart } from '@kbn/share-plugin/public';
 import type { IToasts } from '@kbn/core/public';
-import type { DiscoverSharedPublicStart } from '@kbn/discover-shared-plugin/public';
 import type { UnifiedDocViewerStart } from './plugin';
-
 export interface UnifiedDocViewerServices {
   analytics: AnalyticsServiceStart;
   data: DataPublicPluginStart;

x-pack/platform/plugins/private/transform/kibana.jsonc

@@ -1,20 +1,15 @@
 {
   "type": "plugin",
   "id": "@kbn/transform-plugin",
-  "owner": [
-    "@elastic/kibana-management"
-  ],
+  "owner": ["@elastic/kibana-management"],
   "group": "platform",
   "visibility": "private",
   "description": "This plugin provides access to the transforms features provided by Elastic. Transforms enable you to convert existing Elasticsearch indices into summarized indices, which provide opportunities for new insights and analytics.",
   "plugin": {
     "id": "transform",
     "browser": true,
     "server": true,
-    "configPath": [
-      "xpack",
-      "transform"
-    ],
+    "configPath": ["xpack", "transform"],
     "requiredPlugins": [
       "data",
       "dataViews",
@@ -33,21 +28,8 @@
       "contentManagement",
       "fieldsMetadata"
     ],
-    "optionalPlugins": [
-      "dataViewEditor",
-      "security",
-      "usageCollection",
-      "spaces",
-      "alerting"
-    ],
-    "requiredBundles": [
-      "esUiShared",
-      "discover",
-      "kibanaUtils",
-      "kibanaReact"
-    ],
-    "extraPublicDirs": [
-      "common"
-    ]
+    "optionalPlugins": ["dataViewEditor", "security", "usageCollection", "spaces", "alerting"],
+    "requiredBundles": ["esUiShared", "discover", "kibanaUtils", "kibanaReact"],
+    "extraPublicDirs": ["common"]
   }
 }