aws: derive OTel-compatible trace.id from X-Ray trace ID in elb_logs

packages/aws/changelog.yml

@@ -1,4 +1,9 @@
 # newer versions go on top
+- version: "6.21.1"
+  changes:
+    - description: Derive the OpenTelemetry-compatible 32-character hex `trace.id` from the X-Ray format trace ID in ELB access logs, enabling correlation with APM traces.
+      type: enhancement
+      link: https://github.com/elastic/integrations/pull/20000
 - version: "6.21.0"
   changes:
     - description: Poll Amazon Inspector findings on `updatedAt` instead of `lastObservedAt` so that findings AWS marks CLOSED or SUPPRESSED are collected and no longer remain stale in Elastic.

packages/aws/data_stream/elb_logs/_dev/test/pipeline/test-alb.log-expected.json

@@ -82,7 +82,7 @@
                 "preserve_original_event"
             ],
             "trace": {
-                "id": "Root=1-58337262-36d228ad5d99923122bbe354"
+                "id": "5833726236d228ad5d99923122bbe354"
             },
             "url": {
                 "domain": "www.example.com",
@@ -172,7 +172,7 @@
                 "preserve_original_event"
             ],
             "trace": {
-                "id": "Root=1-627cac19-4c6df30820daa80e3fd72ced"
+                "id": "627cac194c6df30820daa80e3fd72ced"
             },
             "url": {
                 "domain": "127.0.0.1",

packages/aws/data_stream/elb_logs/elasticsearch/ingest_pipeline/default.yml

@@ -173,11 +173,24 @@ processors:
       field: event.outcome
       value: failure
       if: 'ctx?.http?.response?.status_code != null && ctx.http.response.status_code >= 400'
-  - set:
-      tag: set_trace_id_53565e4a
-      field: trace.id
-      value: '{{aws.elb.trace_id}}'
+  - script:
+      tag: script_derive_trace_id_from_xray
+      lang: painless
+      description: Derive the OpenTelemetry-compatible trace ID from the X-Ray format trace ID (Root=1-{8 hex}-{24 hex}) so ELB access logs and APM spans share the same trace.id. Falls back to the raw value for unrecognized formats.
       if: ctx?.aws?.elb?.trace_id != null
+      source: |-
+        String traceId = ctx.aws.elb.trace_id;
+        String root = traceId.splitOnToken(';')[0];
+        if (root.startsWith('Root=1-')) {
+          String[] parts = root.substring(7).splitOnToken('-');
+          if (parts.length == 2 && parts[0].length() == 8 && parts[1].length() == 24) {
+            traceId = parts[0] + parts[1];
+          }
+        }
+        if (ctx.trace == null) {
+          ctx.trace = new HashMap();
+        }
+        ctx.trace.id = traceId;
   - split:
       tag: split__tmp_actions_executed_to_aws_elb_action_executed_2b54cfea
       field: _tmp.actions_executed

packages/aws/data_stream/elb_logs/sample_event.json

@@ -121,7 +121,7 @@
         "aws-elb-logs"
     ],
     "trace": {
-        "id": "Root=1-58337262-36d228ad5d99923122bbe354"
+        "id": "5833726236d228ad5d99923122bbe354"
     },
     "url": {
         "domain": "www.example.com",

packages/aws/docs/elb.md

@@ -275,7 +275,7 @@ An example event for `elb` looks as following:
         "aws-elb-logs"
     ],
     "trace": {
-        "id": "Root=1-58337262-36d228ad5d99923122bbe354"
+        "id": "5833726236d228ad5d99923122bbe354"
     },
     "url": {
         "domain": "www.example.com",

packages/aws/manifest.yml

@@ -1,7 +1,7 @@
 format_version: 3.4.0
 name: aws
 title: AWS
-version: 6.21.0
+version: 6.21.1
 description: Collect logs and metrics from Amazon Web Services (AWS) with Elastic Agent.
 type: integration
 categories: