APM, traces, and digital experience monitoring
Domain 4: APM, traces, and digital experience monitoring
This domain tests the APM data model, distributed tracing, service maps, and the tools that measure user-facing experience: RUM, Synthetics, and Uptime.
APM data model and instrumentation
APM agents instrument applications and send transactions (requests or jobs) and spans (units of work). Key fields are service.name, service.environment, transaction.id, trace.id, span.id, parent.id, span.type, span.subtype, event.outcome, and transaction.duration.us. A trace is the set of transactions and spans sharing trace.id. Elastic Agent's APM integration (or a standalone APM Server) receives data; OpenTelemetry data can be sent through the OTLP endpoint. Agent configuration sets service name, environment, sample rate, and transaction sample rate.
Service maps and diagnostics
The APM app shows service inventory, latency, throughput, error rate, and dependencies. Service maps are built from span destinations and trace relationships. If service.name changes between deployments, one service appears as two. Sampling keeps overhead down but can drop rare traces; tail-based sampling in the APM integration can retain errors and slow traces.
Digital experience monitoring
RUM uses a JavaScript agent to capture page loads, user interactions, and errors, and requires a reachable APM endpoint plus CORS and CSP allowances. Synthetics runs browser and lightweight monitors from public or private locations, checking availability and scripted journeys. Uptime monitors are simpler HTTP/TCP/ICMP checks with TLS and status assertions. SLOs can be defined on APM and Synthetics data.
Worked example
A checkout request is slow, and the trace shows the browser transaction but no call to the payment service. Reasoning: check whether the payment service propagates traceparent and whether its agent is sending spans; verify the APM integration endpoint and sampling; inspect the service map for the payment dependency. If the browser span exists but the server transaction is missing, RUM is configured but the backend agent or endpoint is not. If service.name is set per pod, the service map fragments.
Traps
A missing trace.id propagation breaks distributed traces even when each service reports data. Sampling at 100% in production is expensive; low sampling hides errors. RUM requires the APM endpoint to be reachable from the browser, not just from the cluster. Synthetics private locations need a running agent. Service maps do not show dependencies when spans lack destination fields. Changing service.environment splits dashboards and SLOs.