Transactions are a special kind of span that have additional attributes associated with them. They describe an event captured by an Elastic APM agent instrumenting a service. You can think of transactions as the highest level of work you’re measuring within a service. As an example, a transaction might be a:

  • request to your server
  • batch job
  • background job
  • custom transaction type.

Agents decide whether to sample transactions or not, and provide settings to control sampling behavior. If sampled, the spans of a transaction are sent and stored as separate documents. Within one transaction there can be 0, 1, or many spans captured.

A transaction contains:

  • The timestamp of the event
  • A unique id, type, and name
  • Data about the environment in which the event is recorded:

    • Service - environment, framework, language, etc.
    • Host - architecture, hostname, IP, etc.
    • Process - args, PID, PPID, etc.
    • URL - full, domain, port, query, etc.
    • User - (if supplied) email, ID, username, etc.
  • Other relevant information depending on the agent. Example: The JavaScript RUM agent captures transaction marks, which are points in time relative to the start of the transaction with some label.

In addition, the agents provide some settings for users to capture customized information. This data is stored as not-indexed in a custom object. Searchable information is stored as labels instead.


Most agents limit keyword fields (e.g. to 1024 characters, and non-keyword fields (e.g. labels) to 10,000 characters.

Transactions are stored in transaction indices.