Elastic Observability Labs
14 August 2026
Correlate logs, metrics, and traces in one ES|QL query
Walk through four investigations, from CPU saturation to pod memory pressure, each answered by a single query across signal types.
Featured
CrashLoopBackOff to root cause in seconds: automating the 20-minute Kubernetes investigation with Elastic Observability
Elastic's Kubernetes Experience fires alongside the CrashLoopBackOff alert and delivers a root-cause hypothesis with evidence before you even open it.
Skip writing alert rules: 6 ready-made ES|QL templates ship inside the NGINX OTel integration
Elastic integrations come with alerting rule templates, each one an ES|QL query with a threshold already set. Create Elasticsearch alert rules in minutes, tune them to your traffic, and catch silent data streams early.
You have the IP, you want the hostname: building a lookup processor for OpenTelemetry
Look up any value from YAML, CSV or DNS inside the OpenTelemetry Collector or wire in your own source through a processor Elastic built and shipped to Collector Contrib.
Elastic ML predicts when your disk will fill up: How to make it alert you
Use a single Kibana Workflows YAML to run daily ML forecasts on disk usage and get Slack alerts listing which hosts will hit capacity and when.
6x faster at 500 services: how we rebuilt the Kibana APM service map from canvas to React DOM
Each service node shows alert, SLO and anomaly health so you can filter to breaching services only and embed the result on any Kibana dashboard, with full keyboard navigation across the topology.
Your SLO is on fire; here's how to find the arsonist in Elastic Observability
When SLO alerting flags a burn rate spike, follow the SLI from the alert detail page through bad event spans and trace waterfalls to find the exact dependency burning your SLO error budget, all without leaving the investigation.
Four clicks from alert to root cause: how Elastic Observability links APM services to Kubernetes infrastructure
Check service dependencies and compare per-pod CPU, memory and network trends on the Infrastructure tab to find which instance is causing trouble, all without leaving the alert investigation.
Three clicks from alert to error log: breaking down RED metrics by any span attribute in Elastic Observability
See which pod, deployment or version is driving a RED metrics change by breaking down span attributes in Discover, then trace a failing span to the error log behind it.
From alert to failing dependency in four clicks: Elastic APM's embedded service map
The APM service map is now embedded on alert pages with filters, connection metrics and a service fly-out so you can analyse dependencies and find the root cause without leaving the alert.
Migrate Datadog Kubernetes dashboards to Elastic Observability in under an hour
See how the migration CLI translates a real Datadog Kubernetes dashboard into validated Kibana panels and uploads it to your cluster in under an hour, no manual widget rebuilds required.
Migrate your Grafana Kubernetes dashboard to Elastic Observability: same PromQL, 30x faster queries
Take a real Grafana Kubernetes dashboard covering pod CPU, memory, node pressure, and restart counts, then migrate it into Elastic Observability with native PromQL in under an hour.
How Elastic cut OpenTelemetry tail sampling memory by 65% with disk-backed trace storage
Elastic contributed two features upstream to the OTel Collector's tail sampling processor. The span-ingest strategy lets sampling decisions happen earlier, and Pebble tail storage moves trace buffering to disk. It costs more CPU, but operators can raise decision_wait and num_traces without OOM kills.