correlation

Correlate OpenTelemetry traces, logs, and metrics using shared fields and PPL queries.

34|32|Updated Jan 28, 2026

Search Tags:#observability #prometheus #correlation #otel #opensearch #ppl #traces-logs-metrics

Ready to run

npx skills add https://github.com/opensearch-project/observability-stack --skill correlation

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: correlation
Source: https://github.com/opensearch-project/observability-stack/tree/main/claude-code-observability-plugin/skills/correlation
Command: npx skills add https://github.com/opensearch-project/observability-stack --skill correlation

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Cross-signal correlation across traces, logs, and metrics using OpenTelemetry semantics to enable end-to-end observability investigations.

Core Features & Use Cases

Correlate traces, logs, and metrics by shared fields like traceId, spanId, and resource attributes to reconstruct end-to-end requests across OpenTelemetry data.
Use PPL queries in OpenSearch and Prometheus exemplars to surface cross-signal context for debugging and performance analysis.
Use case: identify a spike in latency, trace it to the failing span, and surface the related logs for root-cause analysis.

Quick Start

Use OpenSearch PPL and Prometheus exemplars to surface linked traces, logs, and metrics for a given service.

Frequently Asked Questions about correlation

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I correlate traces, logs, and metrics for end-to-end observability debugging?▼

Correlate traces, logs, and metrics by matching shared OpenTelemetry fields like traceId, spanId, and resource attributes to reconstruct end-to-end requests across signals for root-cause analysis.

How do I trace a latency spike to a failing span and related logs in OpenSearch?▼

Trace a latency spike by using Prometheus exemplars to link the metric to its trace, then applying PPL queries in OpenSearch to surface correlated logs for the failing span.

Can I use PPL queries in OpenSearch to link OpenTelemetry signals?▼

Yes, you can use PPL queries in OpenSearch to query and link OpenTelemetry signals by shared fields like traceId and spanId, surfacing cross-signal context for performance analysis.

How does cross-signal correlation work with Prometheus exemplars and OpenTelemetry data?▼

Cross-signal correlation uses Prometheus exemplars to link metrics to traces, while OpenTelemetry shared fields like traceId connect those traces to logs, enabling end-to-end service-level investigations.

Do I need OpenTelemetry attributes to correlate metrics with traces and logs?▼

Yes, shared OpenTelemetry attributes like traceId, spanId, and resource attributes are required to link metrics, traces, and logs across signals for end-to-end observability correlation.

What's the best way to investigate metric anomalies across traces and logs in OpenSearch?▼

The best way to investigate metric anomalies is applying PPL queries in OpenSearch to follow shared OpenTelemetry fields from the metric anomaly through its trace to the correlated logs.