Trace a correlation id
es_traceTrace a correlation id (sessionId, transactionId, x-request-id, or MSISDN) across all services, returning a compact timeline of key log fields instead of full documents.
Instructions
Follow one correlation id — sessionId, transactionId, x-request-id, MSISDN — across every service that logged it, returned as a compact timeline. Prefer this over es_search for "what happened to this request": it parses each JSON log line down to time/pod/level/action/detail instead of returning whole documents.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| id | Yes | The correlation id to follow | |
| size | No | Maximum events to return | |
| index | No | Index or pattern to search; defaults to the allowlist, else "*" | |
| window | No | How far back to look, as Elasticsearch date math without "now-": 1h, 24h, 7d | 24h |