ECS Fields for Function as a Service (FaaS) environments

[AlexanderWert]

Hi ECS team,

Summary
Using APM agents in the context of serverless environments (e.g. AWS Lambda) allows to capture function as a service (faas) specific context that can be of great value for the end users and provide correlation points with other sources of data.

Are there plans / can we extend ECS to include meta-data fields for faas environments?
The existing specification in OpenTelemetry can serve as a good orientation: https://github.com/open-telemetry/opentelemetry-specification/blob/main/specification/trace/semantic_conventions/faas.md#example

Detailed Design:
I'm proposing to add the following fields:

Field	Example	Description
faas.trigger	"http"	one of http,pubsub,datasource, timer, other
faas.execution	"af9d5aa4-a685-4c5f-a22b-444f80b3cc28"	The execution ID of the current function execution.
faas.coldstart	true	Boolean value indicating a cold start of a function
faas.name	"my-lambda-function"	the name of the function
faas.id	"arn:aws:lambda:us-west-2:123456789012:function:my-lambda-function"	The ID of the function
faas.version	"semver:2.0.0"	The version of the function
faas.instance	"my-lambda-function:instance-0001"	The instance of the function

[djptek]

Hi @AlexanderWert as this involves a new Field Set, please could you follow the RFC process documented here:

https://github.com/elastic/ecs/blob/master/rfcs/README.md

Thanks!

[djptek]

Thanks for opening RFC FaaS Fields - Stage 0 @AlexanderWert I'll close this issue so we can follow up with your PR

[cyrille-leclerc]

@axw did we map OpenTelemetry FaaS attributes to these new ECS fields?

[axw]

@cyrille-leclerc I have not, but I believe @AlexanderWert may have. IIANM, OTel has an extra field or two (e.g. faas.max_memory). We intend to map some FaaS fields to our existing service and transaction fields.

[AlexanderWert]

@cyrille-leclerc The faas ECS fields proposal is now in RFC stage 2. Once the process is finished and the fields are in ECS, the mapping should be the following:

OTel	ECS
cloud.provider	cloud.provider
cloud.region	cloud.region
faas.trigger	faas.trigger.type
faas.execution	faas.execution
faas.coldstart	faas.coldstart
faas.name	service.name
faas.id	service.id
faas.version	service.version
faas.instance	service.node.name

[cyrille-leclerc]

Thanks @AlexanderWert . Did you understand why Otel decided to differentiate faas.name /faas.version from service.name / service.version ? I didn't have the time to investigate.