Follow one request.

What a span contains

Your OpenTelemetry SDK creates spans around operations such as an incoming HTTP request, a database call or a task. Lantern reads the fields your instrumentation exports.

Parent and child spans

An operation can create child spans in the same trace. An instrumented outgoing HTTP call can become the parent of the receiving service’s span when context is propagated correctly.

Here, the checkout service’s client span and the payments service’s server span describe two sides of the same call. They are separate observations, not two customer requests. A dependency can also have only a client span when the remote system is not instrumented.

Sampling, broken propagation, delayed exports and retention can leave parents or children missing. Lantern preserves original parent links and reports orphan or duplicate span IDs. A visible root still cannot prove every descendant arrived.

Read duration without double-counting

A span’s elapsed time can include waiting on its children. Adding a parent’s duration to all its children therefore overcounts. Concurrent children can also overlap.

Use the trace waterfall to locate a long operation, inspect its children and compare the same operation across requests. Clock skew between services can distort cross-service placement; within-span duration is separate from that placement.

A slow span is evidence of elapsed time. It does not establish CPU consumption, allocated bytes or a memory leak. Read resource metrics and their limits when investigating host or process behavior.

Use attributes as investigation fields

Attributes provide the detail behind an operation: an HTTP route, database system, deployment environment or a safe business identifier. Use stable operation names and put variable details into attributes. Avoid secrets, personal data and unbounded payloads.

Lantern keeps span, resource and scope attributes separate and retains their types. A span attribute can be addressed as span.http.route; a resource value as resource.service.name. Bare attribute keys default to the span namespace.

Use Query or MCP list_fields to discover the fields actually present before filtering or grouping. Discovery samples recent matching records, so a rare key may be absent from the list. Field names depend on the instrumentation and semantic-convention version.

For example, filter to service == checkout-api and duration > 250ms, then group by an observed route field. These describe matching spans, not automatically all requests or unique users.

Inspect errors in context

An error status is a value exported by the SDK or instrumentation. HTTP status attributes and exception events offer more context, but do not assume a recorded exception always sets span status to error. Check both.

1. Find a span with status == error in a narrow time window.
2. Open its trace and inspect the original status, exception events and relevant typed attributes.
3. Follow parent and child spans to understand which operations observed the failure.
4. Check logs carrying that trace ID, then compare similar successful requests.

Keep incomplete and truncated flags visible. Use a compact trace overview first and load the selected span’s original evidence when needed. See dependencies and HTTP context for cross-service investigation.