[Logs Tab:] Log level info is displayed Blank for apm logs under Logs tab.

[dikshachauhan-qasource]

Kibana version: 7.13.3 Snapshot Kibana Cloud-qa environment

Host OS and Browser version: Windows 10, All

Preconditions:

1. 7.13.3 Snapshot Kibana Cloud-qa environment should be available.

Build Details:

BUILD 40987
COMMIT af2d162c66b5538c40ae179e02e650784f2a081f

2. Apm and Fleet section should be there while creating deployments.

Steps to reproduce:

• Login to Cloud deployment environment.
• Enable logs and metrics at cloud deployment.
• Wait for 1-2 mins for action to complete.
• Got to stack monitoring Tab in kibana.
• Validate data sync at apm & fleet overview resource usage.
• Restart Kibana.
• Copy endpoint url for Apm from cloud deployment page.
• Hit the below command from command prompt in admin mode. curl -i copied_apm_url/invalid OR curl -i copied_apm_url/app/apm/config/v1/agents
• Go to logs tab.
• Apply event.dataset filter for below: "apm.log"

Whats Not working:

• Log level info is displayed Blank for apm logs under Logs tab.
• This issue is also reproducible on 7.13.2 build.

Expected Result:

• Logging level for 'apm.log' logs should be ERROR.

Screenshots:

[elasticmachine]

Pinging @elastic/fleet (Team:Fleet)

[dikshachauhan-qasource]

@manishgupta-qasource Please review

[manishgupta-qasource]

Reviewed & assigned to @EricDavisX

[EricDavisX]

@simitt I imagine this would be on the data sending side from APM agent... can you help transfer / process this on and help assess if it is a bug or urgent (or something else like a known feature / long-term work) please? @ruflin tagged as well. Thank you both.

[andresrc]

Can we check if this is still happening in 7.15?. If so please reopen.

[dikshachauhan-qasource]

Hi @andresrc

We re-attempted to reproduce this issue on 7.15.1 build and found it still reproducible there.

Build details: BUILD 44185 COMMIT c1aa1ef8dc38b511ce4a647fe92ca0348aadd834

Screenshot:

Please let us know if more is required from our end.

Thanks QAS

[andresrc]

@elastic/apm-server can you take a look please?

[axw]

Sorry for the delay, and thanks for raising the issue. This is more an issue with the Logs app in Kibana. I believe it's applying the "generic webserver" rules to APM logs, and we don't set event.module hence why there's a "[]": https://github.com/elastic/kibana/blob/master/x-pack/plugins/infra/server/services/log_entries/message/builtin_rules/generic_webserver.ts

We should probably work with the infra monitoring team to introduce APM-specific rules.