Elastic APM traces link to logs

Question

I would like to link my logs in elastics to APM traces. I'm using .net core 7 with couple of libraries:

<PackageReference Include="Elastic.Apm.AspNetCore" Version="1.19.0"/>
<PackageReference Include="Elastic.Apm.SerilogEnricher" Version="1.5.3"/>
<PackageReference Include="Elastic.Apm.SqlClient" Version="1.19.0"/>

APM traces looks nice in Kibana - I can see traces across multiple services, DB and so on.

I've got my logs in elastic with necessary fields:

ElasticApmTraceId
ElasticApmTransactionId

I also see my logs in Observability -> Logs -> Stream.

But when I open Observability -> APM -> Service -> MyServiceName I see nice overview with traces, but without linked logs. I got following message:

There are no log messages to display.

I also tried to added following fields to log message, but it did not help:

TransactionId
TraceId
transaction.id
trace.id

My services are running in Kubernetes.

Elastic stack version is 8.4.3

Any ideas which configuration is missing in ELK?

Answer 1

I've managed to add logs to Observability -> APM -> Service -> MyServiceName -> Logs tab.

ELK expects you to have service.name property in your log documents. This property could be added by your log aggregator or by app itself. I used following code to do it:

public class ElasticApmLogEnricher : ILogEventEnricher
{
    private readonly string ServiceName; 
    
    public ElasticApmLogEnricher(string serviceName)
    {
        ServiceName = serviceName;
    }

    public void Enrich(LogEvent logEvent, ILogEventPropertyFactory propertyFactory)
    {
        if (!Agent.IsConfigured) return;
        if (Agent.Tracer?.CurrentTransaction == null) return;

        logEvent.AddPropertyIfAbsent(propertyFactory.CreateProperty(
            "service.name", ServiceName));
    }
}