skills.rest
opensearch-project
opensearch-projectOFFICIAL
Explore all skills by this author →
WebsiteGitHub

correlation

Correlate OpenTelemetry traces, logs, and metrics using shared fields and PPL queries.

34|32|Updated Jan 28, 2026
Search Tags:#observability#prometheus#correlation#otel#opensearch#ppl#traces-logs-metrics
One-click install
npx skills add https://github.com/opensearch-project/observability-stack --skill correlation
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: correlation
Source: https://github.com/opensearch-project/observability-stack/tree/main/claude-code-observability-plugin/skills/correlation
Command: npx skills add https://github.com/opensearch-project/observability-stack --skill correlation

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Cross-signal correlation across traces, logs, and metrics using OpenTelemetry semantics to enable end-to-end observability investigations.

Core Features & Use Cases

  • Correlate traces, logs, and metrics by shared fields like traceId, spanId, and resource attributes to reconstruct end-to-end requests across OpenTelemetry data.
  • Use PPL queries in OpenSearch and Prometheus exemplars to surface cross-signal context for debugging and performance analysis.
  • Use case: identify a spike in latency, trace it to the failing span, and surface the related logs for root-cause analysis.

Quick Start

Use OpenSearch PPL and Prometheus exemplars to surface linked traces, logs, and metrics for a given service.

Frequently Asked Questions about correlation

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I correlate traces, logs, and metrics for end-to-end observability debugging?▼

Correlate traces, logs, and metrics by matching shared OpenTelemetry fields like traceId, spanId, and resource attributes to reconstruct end-to-end requests across signals for root-cause analysis.

How do I trace a latency spike to a failing span and related logs in OpenSearch?▼

Trace a latency spike by using Prometheus exemplars to link the metric to its trace, then applying PPL queries in OpenSearch to surface correlated logs for the failing span.

Can I use PPL queries in OpenSearch to link OpenTelemetry signals?▼

Yes, you can use PPL queries in OpenSearch to query and link OpenTelemetry signals by shared fields like traceId and spanId, surfacing cross-signal context for performance analysis.

How does cross-signal correlation work with Prometheus exemplars and OpenTelemetry data?▼

Cross-signal correlation uses Prometheus exemplars to link metrics to traces, while OpenTelemetry shared fields like traceId connect those traces to logs, enabling end-to-end service-level investigations.

Do I need OpenTelemetry attributes to correlate metrics with traces and logs?▼

Yes, shared OpenTelemetry attributes like traceId, spanId, and resource attributes are required to link metrics, traces, and logs across signals for end-to-end observability correlation.

What's the best way to investigate metric anomalies across traces and logs in OpenSearch?▼

The best way to investigate metric anomalies is applying PPL queries in OpenSearch to follow shared OpenTelemetry fields from the metric anomaly through its trace to the correlated logs.

Related Skills

Explore More Data & Analytics Skills→
cosmixcosmix
53

grafana

Configures Grafana-based observability dashboards with the LGTM stack, including RBAC and alerting for logs, traces, and metrics.

Community
Advanced
openeuler-mirroropeneuler-mirror
3

root-cause-localization

Correlate logs, trace spans, and dependency graphs to output structured JSON root cause reports.

Official
Advanced
opensearch-projectopensearch-project
34

ppl-reference

Author PPL queries for OpenSearch observability data with commands and functions.

Official
Advanced
zenobi-uszenobi-us
68

error-detective

Analyze distributed system error patterns to identify root causes and prevent cascades.

Official
Advanced