Merge pull request #452 from eugenesk24/add-observability-documentation-1.3

[1.3] Add observability documentation

_observability-plugin/app-analytics.md

@@ -0,0 +1,63 @@
+---
+layout: default
+title: Application analytics
+nav_order: 80
+---
+
+# Application analytics
+
+Application analytics can now create custom Observability Applications to view the availability status of all their systems, where log events can be combined with trace and metric data, into a single view of system health empowering developers and IT Ops to resolve issues faster and with fewer escalations.Application analytics in Observability is where you can select logs, traces, and metrics to be part of an Observability Application that can be monitored for overall health and visualized on one page. This allows you to quickly pivot between logs, traces, and metrics to dig into the source of any issues. Many teams use similar logs and similar traces and need a structured view.
+
+## Get started with application analytics
+
+To get started, choose **Observability** in OpenSearch Dashboards, and then choose **Application analytics**. 
+
+### Create an application
+
+1. Choose **Create application**
+1. Enter a name for your application and optionally add a description
+1. Do at least one of the following
+- Use [PPL]({{site.url}}{{site.baseurl}}/observability-plugin/ppl/index) to specify the base query.
+
+You can't change the base query after the application is created.
+{: .note }
+
+- Select services & entities from the dropdown or the service map.
+- Select trace groups from the dropdown or the table.
+1. Choose **Create**.
+
+### Create a visualization
+
+1. Choose the **Log Events** tab
+1. Use [PPL]({{site.url}}{{site.baseurl}}/observability-plugin/ppl/index) to build upon your base query
+1. Move to the **Visualizations** tab to see your visualizations
+1. Expand the **Save** dropdown menu, enter a name for your visualization, then choose **Save**.
+
+To see your visualizations, move to the **Panel** tab. 
+
+### Configure availability
+
+Availability is the status of your application determined by availability levels set on a [time series metric]({{site.url}}{{site.baseurl}}/observability-plugin/app-analytics/#time-series-metric). 
+
+To create an availability level you must configure the following
+- color: The color of the availability badge on the home page.
+- name: The text in the availability badge on the home page.
+- expression: Comparison operator to determine the availability. 
+- value: Value to use when calculating availability.
+
+![Configuring availability]({{site.url}}{{site.baseurl}}/images/app_availability_level.gif)
+
+By default, Application analytics shows results from the last 24 hours of your data. To see data from a different timeframe, use the date and time selector.
+
+#### Time series metric
+
+A time series metric is any visualization that has a query that spans over a timestamp and is a line chart. Users can use the power of the PPL language to define arbitrary conditions on their logs to create a visualization over time.
+
+##### Example
+```
+source = <index_name> | ... | ... | stats ... by span(<timestamp_field>, 1h)
+```
+
+Users can then choose **Line** in visualization configurations to create a time series metric.
+
+![Changing visualization to line chart]({{site.url}}{{site.baseurl}}/images/visualization-line-type.gif)

_observability-plugin/event-analytics.md

@@ -30,4 +30,26 @@ For more information about building PPL queries, see [Piped Processing Language]
 
 After Dashboards generates a visualization, you must save it if you want to return to it at a later time or if you want to add it to an [operational panel]({{site.url}}{{site.baseurl}}/observability-plugin/operational-panels).
 
-To save a visualization, expand the save dropdown menu next to **Run**, enter a name for your visualization, then choose **Save**. You can reopen any saved visualizations on the event analytics page.
+To save a visualization, expand the save dropdown menu next to **Refresh**, enter a name for your visualization, then choose **Save**. You can reopen any saved visualizations on the event analytics page.
+
+## View logs
+
+Users have several ways to view their logs.
+
+### Trace log correlation
+
+Users who regularly track events across applications have the capability to correlate logs and traces. To view the correlation, users have to index the traces as per the Open Telemetry standards (similar to Trace analytics). Once users add a **TraceId** field to their logs, they can view the trace information that corresponds to the same execution context as the log.
+
+![Trace Log Correlation]({{site.url}}{{site.baseurl}}/images/trace_log_correlation.gif)
+
+### Surrounding events
+
+Users who want to know more about a log event that they are looking at can select **View surrounding events** to get a bigger picture of what was happening around the time of interest. 
+
+![Surrounding Events]({{site.url}}{{site.baseurl}}/images/surrounding_events.gif)
+
+### Live Tail
+
+Users watching a live event take place can now configure the interval in which content is refreshed saving the hassle of manually refreshing. This provides users with a faster debugging experience, and allows them to monitor their logs in real-time. Users also have the convenience of choosing the interval at which live tail should update. As this feature mimics the "tail -f" command in command line, it only retrieves the most recent live logs by possibly eliminating a heavy load of live logs.
+
+![Live Tail]({{site.url}}{{site.baseurl}}/images/live_tail.gif)