Skip to main content

Grouping Logs by Request

SPIRL groups many request-related logs by span_id and trace_id.

When a request header of traceparent is present and it follows the W3C Traceparent Header specification, SPIRL will use the traceparent values it has received for the span_id and trace_id. If the traceparent header isn't present, SPIRL will generate a new span ID and trace ID for the request.

Limitations​

  • Some underlying code libraries we use don't support adding these fields for the logs they produce directly
  • Some logs will lack a span and trace ID because they aren't related to requests, like for example, logs related to a server's overall status or health
  • Some areas of our application have not yet been "piped" with this functionality

Examples​

Here's an example of some logs holding these headers:

## Agent Logs - logs from the same component have the same span ID

 spirl-system │ 2025-11-03T22:05:43.357Z	DEBUG	agent.sessionClient	logging/interceptors.go:51	finished call
{
  "span_id": "c21a9c6b7211ad44",
  "trace_id": "75db07abc728622f05c1f1da4dcdc34a",
  "grpc.component": "client",
  "grpc.service": "com.spirl.agent.v1.agent.API",
  "grpc.method": "MintX509SVID",
  "grpc.code": "OK",
}

 spirl-system │ 2025-11-03T22:05:43.359Z	DEBUG	agent.endpoints	logging/interceptors.go:51	finished call
{
  "span_id": "c21a9c6b7211ad44",
  "trace_id": "75db07abc728622f05c1f1da4dcdc34a",
  "grpc.component": "server",
  "grpc.service": "SpiffeWorkloadAPI",
  "grpc.method": "FetchX509SVID",
  "grpc.code": "OK",
}

## Server Logs - server logs use a different span ID than agent logs

2025-11-03T22:05:43.354Z	DEBUG	server.agentServer	logging/interceptors.go:51	finished call	
{
  "span_id": "c0472511cad1b20a",
  "trace_id": "75db07abc728622f05c1f1da4dcdc34a",
  "grpc.component": "server",
  "grpc.service": "com.spirl.agent.v1.agent.API",
  "grpc.method": "MintX509SVID",
  "grpc.code": "OK",
}

All the logs above were triggered by the same request as it progressed through SPIRL. This is evident because they all share the same trace_id:

  • "trace_id": "75db07abc728622f05c1f1da4dcdc34a"

This could have been triggered by the request having a header of:

  • "traceparent:00-75db07abc728622f05c1f1da4dcdc34a-c21a9c6b7211ad44-01"

If the request didn't have a traceparent header, SPIRL generates these values randomly.