elasticsearch

Topics in the source

• Triage order
• Time range syntax
• Query logs
• Query APM traces
• Query APM errors
• Tips
• Kibana Dashboard API Gotchas

Load xh before querying. Use xh-es-search ' ' with JSON in the Bash PAYLOAD environment variable. xh-apm-error-groups builds its own payload. The APM helper reads nested source fields and pairs the first exception's type and message. A missing exception or trace in any sampled group fails the whole result; its diagnostic is safe to report but does not recover evidence or authorize dispatch. The wrapper uses ESURL when set; otherwise it derives https:// from chezmoi data. Configure the hostname with chezmoi and ensure the matching xh session is provisioned. It fails closed when esHost is missing or invalid. State the hypothesis, bound the time window, and identify the scope (one service / one endpoint / one user / system-wide) before querying anything. Write down what a "confirmed" answer looks like — otherwise absence of evidence reads as evidence of absence. Don't start with logs. Work coarse to fine: error/rate spike (is it real?) → APM traces (which transaction) → APM errors (root-cause code path) → logs (raw context). trace.id links all three indices — pull it from an error or slow trace, then {"term": {"trace.id": " "}} for the surrounding logs. | Symptom | Look first | |---|-

This is an excerpt. Refer to the complete source and its current requirements.