html/server/6.8/exploring-es-data.html

<!DOCTYPE html>
<html lang="en-us">
  <head>
    
<meta charset="UTF-8">
<title>Exploring data in Elasticsearch | APM Server Reference [6.8] | Elastic</title>
<meta class="elastic" name="content" content="Exploring data in Elasticsearch | APM Server Reference [6.8]">

<link rel="home" href="index.html" title="APM Server Reference [6.8]"/>
<link rel="up" href="index.html" title="APM Server Reference [6.8]"/>
<link rel="prev" href="server-info.html" title="Server Information"/>
<link rel="next" href="transaction-indices.html" title="Transaction Indices"/>
<meta class="elastic" name="product_version" content="6.8"/>
<meta class="elastic" name="product_name" content="APM"/>
<meta class="elastic" name="website_area" content="documentation"/>
<meta name="DC.type" content="Learn/Docs/APM Server/Reference/6.8"/>
<meta name="DC.subject" content="APM"/>
<meta name="DC.identifier" content="6.8"/>
<meta name="robots" content="noindex,nofollow"/>

    <meta http-equiv="content-type" content="text/html; charset=utf-8" />
    <meta http-equiv="X-UA-Compatible" content="IE=edge">
    <meta name="viewport" content="width=device-width, initial-scale=1">
    <script src="https://cdn.optimizely.com/js/18132920325.js"></script>
    <link rel="apple-touch-icon" sizes="57x57" href="/apple-icon-57x57.png">
    <link rel="apple-touch-icon" sizes="60x60" href="/apple-icon-60x60.png">
    <link rel="apple-touch-icon" sizes="72x72" href="/apple-icon-72x72.png">
    <link rel="apple-touch-icon" sizes="76x76" href="/apple-icon-76x76.png">
    <link rel="apple-touch-icon" sizes="114x114" href="/apple-icon-114x114.png">
    <link rel="apple-touch-icon" sizes="120x120" href="/apple-icon-120x120.png">
    <link rel="apple-touch-icon" sizes="144x144" href="/apple-icon-144x144.png">
    <link rel="apple-touch-icon" sizes="152x152" href="/apple-icon-152x152.png">
    <link rel="apple-touch-icon" sizes="180x180" href="/apple-icon-180x180.png">
    <link rel="icon" type="image/png" href="/favicon-32x32.png" sizes="32x32">
    <link rel="icon" type="image/png" href="/android-chrome-192x192.png" sizes="192x192">
    <link rel="icon" type="image/png" href="/favicon-96x96.png" sizes="96x96">
    <link rel="icon" type="image/png" href="/favicon-16x16.png" sizes="16x16">
    <link rel="manifest" href="/manifest.json">
    <meta name="apple-mobile-web-app-title" content="Elastic">
    <meta name="application-name" content="Elastic">
    <meta name="msapplication-TileColor" content="#ffffff">
    <meta name="msapplication-TileImage" content="/mstile-144x144.png">
    <meta name="theme-color" content="#ffffff">
    <meta name="naver-site-verification" content="936882c1853b701b3cef3721758d80535413dbfd" />
    <meta name="yandex-verification" content="d8a47e95d0972434" />
    <meta name="localized" content="true" />
    <meta name="st:robots" content="follow,index" />
    <meta property="og:image" content="https://static-www.elastic.co/v3/assets/bltefdd0b53724fa2ce/blt280217a63b82a734/6202d3378b1f312528798412/elastic-logo.svg" />
    <meta property="og:image:width" content="500" />
    <meta property="og:image:height" content="172" />
    <link rel="shortcut icon" href="/favicon.ico" type="image/x-icon">
    <link rel="icon" href="/favicon.ico" type="image/x-icon">
    <link rel="apple-touch-icon-precomposed" sizes="64x64" href="/favicon_64x64_16bit.png">
    <link rel="apple-touch-icon-precomposed" sizes="32x32" href="/favicon_32x32.png">
    <link rel="apple-touch-icon-precomposed" sizes="16x16" href="/favicon_16x16.png">
    <!-- Give IE8 a fighting chance -->
    <!--[if lt IE 9]>
    <script src="https://oss.maxcdn.com/html5shiv/3.7.2/html5shiv.min.js"></script>
    <script src="https://oss.maxcdn.com/respond/1.4.2/respond.min.js"></script>
    <![endif]-->
    <link rel="stylesheet" type="text/css" href="/guide/static/styles-v1.css" />
  </head>

  <!--© 2015-2025 Elasticsearch B.V. -->
  <!-- All Elastic documentation is licensed under a Creative Commons Attribution-NonCommercial-NoDerivatives 4.0 International License. -->
  <!-- http://creativecommons.org/licenses/by-nc-nd/4.0/ -->

  <body>
    <!-- Google Tag Manager -->
    <script>dataLayer = [];</script><noscript><iframe src="//www.googletagmanager.com/ns.html?id=GTM-58RLH5" height="0" width="0" style="display:none;visibility:hidden"></iframe></noscript>
    <script>(function(w,d,s,l,i){w[l]=w[l]||[];w[l].push({'gtm.start': new Date().getTime(),event:'gtm.js'});var f=d.getElementsByTagName(s)[0], j=d.createElement(s),dl=l!='dataLayer'?'&l='+l:'';j.async=true;j.src= '//www.googletagmanager.com/gtm.js?id='+i+dl;f.parentNode.insertBefore(j,f); })(window,document,'script','dataLayer','GTM-58RLH5');</script>
    <!-- End Google Tag Manager -->

    <!-- Global site tag (gtag.js) - Google Analytics -->
    <script async src="https://www.googletagmanager.com/gtag/js?id=UA-12395217-16"></script>
    <script>
      window.dataLayer = window.dataLayer || [];
      function gtag(){dataLayer.push(arguments);}
      gtag('js', new Date());
      gtag('config', 'UA-12395217-16');
    </script>

    <!-- Google Tag Manager for GA4 -->
    <script>(function(w,d,s,l,i){w[l]=w[l]||[];w[l].push({'gtm.start': new Date().getTime(),event:'gtm.js'});var f=d.getElementsByTagName(s)[0], j=d.createElement(s),dl=l!='dataLayer'?'&l='+l:'';j.async=true;j.src='https://www.googletagmanager.com/gtm.js?id='+i+dl;f.parentNode.insertBefore(j,f);})(window,document,'script','dataLayer','GTM-KNJMG2M');</script>
    <noscript><iframe src="https://www.googletagmanager.com/ns.html?id=GTM-KNJMG2M" height="0" width="0" style="display:none;visibility:hidden"></iframe></noscript>
    <!-- End Google Tag Manager for GA4-->

    <div id='elastic-nav' style="display:none;"></div>
    <script src='https://www.elastic.co/elastic-nav.js'></script>

    <div class="main-container">
      <section id="content" >
        <div class="content-wrapper">

          <section id="guide" lang="en">
            <div class="container-fluid">
              <div class="row pb-3">
                <div class="col-12 order-2 col-md-4 order-md-1 col-lg-3 h-almost-full-md sticky-top-md" id="left_col">
                  <!-- The TOC is appended here -->
                </div>

                <div class="col-12 order-1 col-md-8 order-md-2 col-lg-7 order-lg-2 guide-section" id="middle_col">
                  <!-- start body -->
                  
<div class="page_header">
<p>
  <strong>NOTE</strong>: You are looking at documentation for an older release. 
  For the latest information, see the 
  <a href="../current/index.html">current release documentation</a>. 
</p>
</div>
<div class="navheader">
<span class="prev">
<a href="server-info.html">« Server Information</a>
</span>
<span class="next">
<a href="transaction-indices.html">Transaction Indices »</a>
</span>
</div>
<div class="book" lang="en">
<div class="titlepage">
<div class="breadcrumbs">
<span class="breadcrumb-link"><a href="/guide/">Elastic Docs</a></span>
<span class="chevron-right">›</span><span class="breadcrumb-link">
  <div id="related-products" class="dropdown">
  <div class="related-products-title">APM:</div>
  <div class="dropdown-anchor" tabindex="0">Server Reference<span class="dropdown-icon"></span></div>
  <div class="dropdown-content">
  <ul>
  <li class="dropdown-category">APM</li>
  <ul>
  <li><a href="/guide/en/observability/current/apm.html">Observability › APM</a></li>
  </ul>
  <li class="dropdown-category">APM agents</li>
  <ul>
  <li><a href="/guide/en/apm/agent/android/current/intro.html">Android Agent Reference</a></li>
  <li><a href="/guide/en/apm/agent/go/current/introduction.html">Go Agent Reference</a></li>
  <li><a href="/guide/en/apm/agent/swift/current/intro.html">iOS Agent Reference</a></li>
  <li><a href="/guide/en/apm/agent/java/current/intro.html">Java Agent Reference</a></li>
  <li><a href="/guide/en/apm/agent/dotnet/current/intro.html">.NET Agent Reference</a></li>
  <li><a href="/guide/en/apm/agent/nodejs/current/intro.html">Node.js Agent Reference</a></li>
  <li><a href="/guide/en/apm/agent/php/current/intro.html">PHP Agent Reference</a></li>
  <li><a href="/guide/en/apm/agent/python/current/getting-started.html">Python Agent Reference</a></li>
  <li><a href="/guide/en/apm/agent/ruby/current/introduction.html">Ruby Agent Reference</a></li>
  <li><a href="/guide/en/apm/agent/rum-js/current/intro.html">Real User Monitoring JavaScript Agent Reference</a></li>
  </ul>
  <li class="dropdown-category">APM extensions</li>
  <ul>
  <li><a href="/guide/en/apm/lambda/current/aws-lambda-arch.html">AWS Lambda extension</a></li>
  <li><a href="/guide/en/apm/attacher/current/apm-attacher.html">Attacher</a></li>
  </ul>
  </ul>
  </div>
  </div>
</div>
<div>
<div><h1 class="title"><a id="id-1"></a>Exploring data in Elasticsearch</h1><a class="edit_me" rel="nofollow" title="Edit this page on GitHub" href="https://github.com/elastic/apm-server/edit/6.8/docs/exploring-es-data.asciidoc">edit</a></div>
</div>
<!--EXTRA-->
</div>
<div id="content">
<div id="url-to-v3" class="version-warning">
    <strong>IMPORTANT</strong>: This documentation is no longer updated. Refer to <a href="https://www.elastic.co/support/eol">Elastic's version policy</a> and the <a href="https://www.elastic.co/docs">latest documentation</a>.
</div>
<div class="part">
<div class="titlepage"><div><div>
<div class="position-relative"><h2 class="title"><a id="exploring-es-data"></a>Exploring data in Elasticsearch</h2><a class="edit_me" rel="nofollow" title="Edit this page on GitHub" href="https://github.com/elastic/apm-server/edit/6.8/docs/exploring-es-data.asciidoc">edit</a></div>
</div></div></div>
<div class="openblock partintro">
<div class="content">
<div class="note admon">
<div class="icon"></div>
<div class="admon_content">
<p>Templates describing how the APM Server stores data in Elasticsearch have changed in v6.5.
Read the <a class="xref" href="upgrading-to-65.html" title="Upgrading to APM Server v6.5">upgrading to 6.5 guide</a> for more information.</p>
</div>
</div>
<p>By default, Elastic APM data is stored in separated indices in the following formats:</p>
<pre class="screen">apm-%{[version]}-transaction-%{+yyyy.MM.dd}
apm-%{[version]}-span-%{+yyyy.MM.dd}
apm-%{[version]}-error-%{+yyyy.MM.dd}
apm-%{[version]}-metric-%{+yyyy.MM.dd}
apm-%{[version]}-sourcemap</pre>
<p>If you&#8217;re unfamiliar with the data types shown above, they are described in the <a href="/guide/en/apm/get-started/6.8/apm-data-model.html" class="ulink" target="_top">APM data model</a>.</p>
<div class="tip admon">
<div class="icon"></div>
<div class="admon_content">
<p>If your APM data is being stored in a different format, you may be using an outdated <code class="literal">apm-server.yml</code> file. You must update your <code class="literal">apm-server.yml</code> file in order to take advantage of the new format of indices.</p>
</div>
</div>
<p>To get an overview of existing indices you can run:</p>
<div class="pre_wrapper lang-console">
<div class="console_code_copy" title="Copy to clipboard"></div>
<pre class="programlisting prettyprint lang-console">GET _cat/indices/apm*</pre>
</div>
<div class="console_widget" data-snippet="snippets/14.console"></div>
<p>Default APM <code class="literal">template</code> and <code class="literal">indices</code>:</p>
<div class="ulist itemizedlist">
<ul class="itemizedlist">
<li class="listitem">
<a class="xref" href="transaction-indices.html" title="Transaction Indices"><em>Transaction Indices</em></a>
</li>
<li class="listitem">
<a class="xref" href="span-indices.html" title="Span Indices"><em>Span Indices</em></a>
</li>
<li class="listitem">
<a class="xref" href="error-indices.html" title="Error Indices"><em>Error Indices</em></a>
</li>
<li class="listitem">
<a class="xref" href="metricset-indices.html" title="Metric Indices"><em>Metric Indices</em></a>
</li>
<li class="listitem">
<a class="xref" href="sourcemap-indices.html" title="Source Map Indices"><em>Source Map Indices</em></a>
</li>
</ul>
</div>
<p>To query all documents collected with a specific APM Server version:</p>
<div class="pre_wrapper lang-console">
<div class="console_code_copy" title="Copy to clipboard"></div>
<pre class="programlisting prettyprint lang-console">GET apm-6.8.11-*/_search</pre>
</div>
<div class="console_widget" data-snippet="snippets/15.console"></div>
<p>To query a specific type, for example transactions:</p>
<div class="pre_wrapper lang-console">
<div class="console_code_copy" title="Copy to clipboard"></div>
<pre class="programlisting prettyprint lang-console">GET apm-*transactions-*/_search</pre>
</div>
<div class="console_widget" data-snippet="snippets/16.console"></div>
<p>If you are interested in the <em>settings</em> and <em>mappings</em> of the Elastic APM indices,
first, run a query to find template names:</p>
<div class="pre_wrapper lang-console">
<div class="console_code_copy" title="Copy to clipboard"></div>
<pre class="programlisting prettyprint lang-console">GET _cat/templates/apm*</pre>
</div>
<div class="console_widget" data-snippet="snippets/17.console"></div>
<p>Then you can retrieve the specific template you are interested in:</p>
<div class="pre_wrapper lang-console">
<div class="console_code_copy" title="Copy to clipboard"></div>
<pre class="programlisting prettyprint lang-console">GET  /_template/your-template-name</pre>
</div>
<div class="console_widget" data-snippet="snippets/18.console"></div>
<p>Read more about <a href="/guide/en/elasticsearch/reference/6.8/indices-templates.html" class="ulink" target="_top">Index Templates</a> and how they are used.</p>
<p>Alternatively, use the <a href="/guide/en/kibana/6.8/managing-indices.html" class="ulink" target="_top">Kibana Index Management UI</a>.
When clicking on a specific index you can view the <em>settings</em> and <em>mapping</em> for it.</p>
</div>
</div>


</div>
</div>
</div><div class="navfooter">
<span class="prev">
<a href="server-info.html">« Server Information</a>
</span>
<span class="next">
<a href="transaction-indices.html">Transaction Indices »</a>
</span>
</div>

                  <!-- end body -->
                </div>

                <div class="col-12 order-3 col-lg-2 order-lg-3 h-almost-full-lg sticky-top-lg" id="right_col">
                  <div id="sticky_content">
                    <!-- The OTP is appended here -->
                    <div class="row">
                      <div class="col-0 col-md-4 col-lg-0" id="bottom_left_col"></div>
                      <div class="col-12 col-md-8 col-lg-12">
                        <div id="rtpcontainer">
                          <div class="mktg-promo" id="most-popular">
                            <p class="aside-heading">Most Popular</p>
                            <div class="pb-2">
                              <p class="media-type">Video</p>
                              <a href="https://www.elastic.co/webinars/getting-started-elasticsearch?page=docs&placement=top-video">
                                <p class="mb-0">Get Started with Elasticsearch</p>
                              </a>
                            </div>
                            <div class="pb-2">
                              <p class="media-type">Video</p>
                              <a href="https://www.elastic.co/webinars/getting-started-kibana?page=docs&placement=top-video">
                                <p class="mb-0">Intro to Kibana</p>
                              </a>
                            </div>
                            <div class="pb-2">
                              <p class="media-type">Video</p>
                              <a href="https://www.elastic.co/webinars/introduction-elk-stack?page=docs&placement=top-video">
                                <p class="mb-0">ELK for Logs & Metrics</p>
                              </a>
                            </div>
                          </div>
                        </div>

                        <!-- Feedback widget -->
                        <div id="feedbackWidgetContainer"></div>
                      </div>
                    </div>
                  </div>
                </div>
              </div>
            </div>
          </section>

        </div>


        <div id='elastic-footer'></div>
        <script src='https://www.elastic.co/elastic-footer.js'></script>
        <!-- Footer Section end-->

      </section>
    </div>

    <!-- Feedback modal -->
    <div id="feedbackModalContainer"></div>

    <script src="/guide/static/jquery.js"></script>
    <script type="text/javascript" src="/guide/static/docs-v1.js"></script>
    <script type="text/javascript">
  window.initial_state = {}</script>
  </body>
</html>