Issue when searching for Tags/Logs in the UI

[cptkng23]

Hi everyone.

I have a question around searching for Tags/Logs in the Jaeger UI. I have the feeling searching with wildcards/regex does not work if the Log or Tag content is longer than a certain threshold. I wasn't able to find any documentation around this (also not in github issues), so I wanted to confirm here.

For example, we have Spans with a Log entry named log1, value is hello, and maximum length of all Logs of those is 80 chars. Then we have a Log entry named log2, one of the values is world, and the maximum length of all entries is 2kb.
Now searching with log1=.*ell.* in the UI returns results, but searching with log2=.*orl.* not.

How can I make the log2 field also searchable?

EDIT: We are using ES on AWS as storage backend.

PS:

• I'm not sure if this is a limitation (if any) in the UI or in the backend, therefore opening the discussion in this repo.
• Also, I have asked in #jaeger some time ago, but didn't get the answer I was looking for.

[jpkrohling]

@rubenvp8510, would you know what's going on?

[cptkng23]

Hi @rubenvp8510 .

Were you by chance able to reproduce this?

[cptkng23]

Hi @rubenvp8510
We are still facing this issue. Is there any more data/hints I can provide you with that would help in pinpointing the issue?

[rubenvp8510]

Hi @cptkng23 sorry for the delay on this. I still not able to reproduce this. There should not be any limitation on the query service or the UI. IIRC there is no limitation on the ES storage.

Could you verify that you indeed have spans with those log values stored on your ElasticSearch instance?

I used this code to generate the spans with logs as you described in your initial comment: https://gist.github.com/rubenvp8510/d6b12a1fcbcff56af5126b99fe7cd9db

[cptkng23]

Thanks so much for checking. I'll have a deeper look myself on Monday.

[cptkng23]

Hi @rubenvp8510
I checked everything twice. The data is there. I now used real data and didn't make it up with hello and world like in my first message.
For the example/screenshot below I use a trace with ID e6041b5.

First a successful search for a log field:

Below is a screenshot prooving that the data is also actually there.

Now the one that doesn't work:

But below you can see that the data is actually there.

I also downloaded this trace from the UI as json, and data is available. The size of the overall trace is ~30kb, and the length of the field demandResponseHeaders is 84kB, and the bidRequest is 1.9kB

If it's not about the size, maybe I'm missing something else here? Maybe the search term I use is wrong and just luckily returns results for the first query? Any help/hint is appreciated.

[cptkng23]

Could it be related to the mappings that have an ignore_above of 256? https://github.com/jaegertracing/jaeger/blob/main/plugin/storage/es/mappings/jaeger-span.json#L84