[FEATURE] Tracing search functionality - Jaeger gap

[afishler-zz]

Problem: A popular use case for trace analytics is being able to search for specific requests (traces) based on a set of criteria that defines the issue - to troubleshoot, users can search based on service (optional), operation (ALL or a specific one), context (optional, some otel tags, e.g error=true), time frame, min duration (optional), max duration (optional), number of expected results (traces)

This allow focusing on traces that match a certain incident and serves as a good point to start a troubleshooting scenario.

The Jaeger search screen and search results is brought as an example. It allows to execute a search without the need to apply a specific search syntax like Lucene

Results provide a rich description (quick glance) of the traces found as well as a timeline diagram with the traces found mapped to duration and number of spans(size of bubble)

This can be a basis for a friendlier and more effective search experience

[joshuali925]

Thanks for submitting an issue, a few questions for clarification:

1. what does it mean to search based on number of expected results (traces)?
2. what is operation and context? I assume it's similar to name and user defined tags, would be helpful if you could confirm them in our schema: https://github.com/opensearch-project/data-prepper/blob/99ad5ad2f616bd83a408cbc98a44381298ac329b/docs/schemas/trace-analytics/otel-v1-apm-span-index-template.md#fields

[RajivTaori]

Also got similar feedback from another customer. I would also add

• Search for matching spans, in addition to matching traces
• Lets also include searching for tags or attributes that can be added in OTEL format. Customer for example was adding product descriptors to the traces and wanted to search for them

[afishler-zz]

Adding here as a reference - some example on a better ux for searching traces (and spans)

It is highly relevant that the search itself provides a good experience and makes it easier on searching, rather than that having the functionality available

[elfisher]

@anirudha let's label this as jaeger-gap