Explore Traces | Honeycomb

Explore Traces

Traces describe a complete unit of work for one or more services in an Environment. Each trace is composed of multiple spans. A span is a unit of instrumentation from a single location in your code. A trace allows you to inspect the contextual data captured by each of its spans to discover how your systems performed in a given context.

Traces enable you to:

  • understand how data flows through your systems
  • identify errors
  • find performance issues

Access a Trace 

The trace detail view is accessible through points in a visualization, the trace button Explore a trace button represented in a table, or directly with a permalink.

  1. In Query Builder, VISUALIZE with any clause. This creates the visualization below the Query Builder.

  2. Select a point in the visualization. Choose from a line graph or from a Heatmap.

    From a line graph: Click line to trace.

    From a Heatmap: Click heatmap to trace.

  3. In the menu that appears, select View trace.

    The next screen displays a trace detail view. The displayed trace is the slowest trace with a child span and with a value is less than or equal to the value of your selected point. Therefore, selecting a point on the p90 graph gives a different trace than selecting a point on an overlaid p10 graph.

    You will be automatically taken to the first span in the trace waterfall that matches the query’s filter criteria. Selecting on a point in a graph with an empty WHERE clause will direct you to the root span in the trace waterfall.

  1. Run a query in Query Builder.

  2. Select the Traces tab that appears below any visualizations. The Traces tab displays up to 10 traces with the slowest spans that match your query’s filters. Click to a trace.

  3. To be sent to a trace’s trace detail view, select the trace’s trace button Explore a trace button represented in a table or its hyperlinked Trace ID.

  1. Run a query in Query Builder.

  2. Select the Events tab that appears below any visualizations. The Events tab displays raw data for all spans that match your query’s filters. Click to a trace.

  3. To be sent to a span’s trace detail view, select the span’s trace buttonExplore a trace button represented in a table. In the next screen, the selected span appears highlighted in blue within the trace waterfall display.

Interact with Traces 

The trace detail view displays information in four areas:

Trace view with each section outlined

Trace Identification 

Each trace has a unique identifier presented at the top of page along side navigation elements.

Trace view identification

The left-arrow navigates away from the trace view back to the visualization or results table where the trace was selected.

Honeycomb presents a trace when it has received the root span. Each span has a unique identifier and datetime stamp of when it was created. The Reload Trace button reloads the trace to ensure the waterfall representation contains all spans in the trace.

Traces may display a warning that it is missing spans with a link to resources to assist with troubleshooting the missing spans.

Trace view missing spans

Trace Summary 

The trace summary displays important metadata and provides a condensed view of the trace waterfall diagram. Metadata about the trace includes its total number of spans, the timestamp of the root span, and the total trace duration. Use this view to find long-running spans and spans with errors within your trace without scrolling through the entire trace waterfall. Expand or collapse the summary view by selecting the directional caret.

Trace summary view

The trace summary displays up to 6 levels of span dependency. The first level in the topmost row starts with the root span. The second row shows the root span’s dependent spans, and each following row displays a dependent span level, if applicable. The width of the summary represents the whole duration of the trace.

Hover over any span to see the name of the longest running span at that depth and point in time. Select the span to view its highlighted location in the waterfall representation below.

Trace summary hover view

Use Highlight errors to toggle span error highlighting on and off. Spans with errors appear in red. Select a span with an error to view its location in the waterfall representation below and additional metadata in the trace sidebar.

Highlight errors in the summary

Waterfall Representation 

Honeycomb uses the metadata from each span to reconstruct the relationships between them and generate a trace diagram. This is also called a waterfall diagram because it shows how the order of operations cascades across the total execution time.

Trace view waterfall representation

Each span contains a collection of fields and values.

The diagram displays, at a minimum, the span’s relationship, its name, and a representation of its duration.

Next to each span’s name shows its relationship in the trace. A span with dependencies displays a box with the number of dependent spans. A span without a box represents a span with no dependencies.

The currently selected span’s row is highlighted in blue. Details about the selected span appear to the right in the trace sidebar.

Trace diagram

Collapse and Expand Spans 

When a trace contains many spans, it can be useful to collapse spans that are not of interest, or expand specific parent spans to investigate. Navigate the diagram with either mouse or keyboard navigation.

Collapse and expand spans

Zoom In and Share Subtrees in the Waterfall 

To zoom into a subtree within the trace waterfall view, select the magnifying glass with the plus sign icon next to any parent span. The timeline re-adjusts to that parent span’s duration, and shows the duration of all children spans relative to that parent span, as opposed to the whole trace. The trace summary view also highlights which span is being examined in zoom mode.

Zoom out of the subtree by selecting the magnifying glass icon, which now has a minus sign.

Permalinks for subtrees in zoom mode exist. Copy the URL link in your web browser and share the URL with other users to view the same subtree.

Zoom in on a subtree within the waterfall

Customize Waterfall Representation 

The search field provides the ability to type in a field or value and highlights spans that contain your search term. Error Highlighting shows how many spans with errors exists in the trace. The Fields button customizes the fields in the waterfall representation.

Search Spans 

To search spans, use the search box to type in the field or value you want to find. As you type, the display changes and highlights any spans that contain your search term.

A count of matching spans found appears next to the search box and navigation arrows. Use the navigation arrows to move between the spans that match the search term.

Trace View Search

Error Highlighting 

The count of spans containing errors is displayed above the trace waterfall. Select this count of spans to navigate between the spans with errors. By default, spans that contain errors are displayed in red. The error field is also highlighted at the top of the field list in the trace sidebar. Span error detection is based on the Error field as configured in the Dataset Definition.

Error highlighting

Customize Fields in Waterfall Representation 

To add a field to the waterfall representation, use the Fields button in the upper right corner and type in the target field name. A list of suggested fields appears based on your input. To update the waterfall representation, complete typing the field name and press Enter, or select the target field name from the list of suggested fields. The waterfall representation updates with a new column labeled with the field name and its information.

To remove fields in the span display, use the Fields button to display the current fields. Use the x to right of each field name to remove it. The display updates after any change.

Trace Fields

Resize Columns in Waterfall Representation 

To resize columns in the waterfall representation, drag the gray borders that separate column names to your desired width. A set minimum width exists for each column. To remove a column completely, use the Fields button.

Error highlighting

Change Color in Waterfall Representation 

The color for each span applies to its entire row, such as the count box, relationship tracing, and duration representation.

By default, the color is determined by service.name if there is more than one service name defined; otherwise, they are colored by name. A half-filled water drop icon appears next to the column header of the determining field. Each distinct value in the determining field gets its own color.

Changing the determining field colors the waterfall display differently and may emphasize different attributes.

To change the determining field, select the downward arrow next to the target field’s column header. In the menu that appears, select Color rows based on the values in this field. The display refreshes with the new color scheme, and the half-filled water drop icon appears next to the selected field’s column header.

Trace view changing the color determining field for spans

Trace Sidebar 

When a span is selected, the trace sidebar updates with details about the span, including its fields, span events, and links.

The Span Events tab of the trace sidebar displays details about span events, if applicable. To access, navigate to the Span Events tab and select the Span Event name to show its details. Alternatively, in the waterfall diagram, select the circle that represents a span event to display the span event’s details in the trace sidebar’s Span Events tab.

The Links tab of the trace sidebar displays details about span links, if applicable. To access, navigate to the Links tab to view span link details. Alternatively, in the waterfall diagram, select the link icon that represents a span link to display details in the trace sidebar’s Links tab.

Trace sidebar

The Minigraph 

The minigraph, at the top of the trace sidebar, shows a heatmap view of the selected span relative to others with the same fields displayed in the waterfall. Selecting anywhere in the minigraph sends you to the Query Builder display with a query that corresponds to the minigraph.

Trace Sidebar Filter 

The trace sidebar includes a filter. Enter terms into this sidebar filter and the sidebar display refreshes to show matching fields and/or values. This filter remains in the trace sidebar as you select different spans. Use this behavior to track a particular field as you move between a set of spans.

Refine and Return to The Query Builder 

Any span’s field or value can act as an entry point back to the Query Builder. In the Trace Sidebar, select the three dots to the right of a targeted field to open its context menu. In addition to copy options, the menu includes GROUP BY and WHERE actions, which create a new query that re-uses the original query but adds the selected clause and field.

Trace click to query

The new query may not return results. If the fields you select are only found on child spans, but the original query includes trace.parent_id does-not-exist or is_root, then the new query will be self-contradictory, and will not return any results. Remove any unneeded clauses to get a full result.

Example: Slow API Calls 

Here is an example of investigating a problem using tracing:

A few users are reporting slow API calls. The initial investigation shows one endpoint is periodically slow. One user is making a lot of calls, and that is slowing down responses for everyone.

Query results showing one user making lots of requests to /api/v2/tickets/export

Selecting a representative trace shows the full execution of the API request, helping us understand why these API requests are slow.

Example slow trace

The first part seems normal, but ticketBackend is making more calls than expected to mysql. Clicking on one of the mysql spans shows more information about it in the sidebar, including the specific database query.

Trace showing ticketBackend calling mysql many times sequentially

The information from this trace points to a possible next step. Is the user running a script gone wrong? Or maybe this endpoint needs tighter rate limiting. Traces show a level of detail that can be hard to see otherwise.