how to search annotations or binaryAnnotations in kibana?

i send trace info to es5, and i want to search annotations or binaryAnnotations from kibana.

i have one span json like this:

{
  "_index": "zipkin-2016-11-17",
  "_type": "span",
  "_id": "AVhw8k-GQpNFwf9ty7hN",
  "_score": null,
  "_source": {
    "traceId": "0f56baad2910df69",
    "timestamp_millis": 1479363860752,
    "annotations": [
      {
        "endpoint": {
          "ipv4": "10.8.0.2",
          "port": 18088,
          "serviceName": "first-example-dev"
        },
        "value": "cs",
        "timestamp": 1479363860752000
      },
      {
        "endpoint": {
          "ipv4": "10.8.0.2",
          "port": 18088,
          "serviceName": "first-example-dev"
        },
        "value": "cr",
        "timestamp": 1479363860903752
      }
    ],
    "parentId": "20c251aac430bf39",
    "duration": 151752,
    "binaryAnnotations": [
      {
        "endpoint": {
          "ipv4": "10.8.0.2",
          "port": 19091,
          "serviceName": "thrift"
        },
        "value": true,
        "key": "sa"
      }
    ],
    "name": "secondadd",
    "collector_timestamp_millis": "2016-11-17T06:21:18.086+0000",
    "id": "f83891ef110158ef",
    "timestamp": 1479363860752000
  },
  "fields": {
    "timestamp_millis": [
      1479363860752
    ],
    "collector_timestamp_millis": [
      1479363678086
    ]
  },
  "sort": [
    1479363678086
  ]
}

i want to search annotations’s endpoint’s serviceName is first-example-dev, and i direct search first-example-dev from kibana, no result 😦, and i search annotations:first-example-dev also nothing.

how can i search this content?

[codefromthecrypt]

well, it could only be better if you use elasticsearch 😃 ps whatever isn’t good should at least be noted for improvement in with a screen shot of what’s better (since good is subjective and not always guessable) https://github.com/openzipkin/zipkin-ui/issues

Anyway, in case it helps, here’s a complex query that the http implementation sends on the wire. It might help you figure out what to do (or not).

ex.

QueryRequest.builder().serviceName("service")
    .spanName("methodcall")
    .addAnnotation("custom")
    .addBinaryAnnotation("BAH", "BEH").build();

becomes this http request:

POST zipkin/span/_search?allow_no_indices=true&expand_wildcards=open&ignore_unavailable=true
...

{
  "size" : 0,
  "query" : {
    "bool" : {
      "must" : {
        "match_all" : { }
      },
      "filter" : {
        "bool" : {
          "must" : [ {
            "range" : {
              "timestamp_millis" : {
                "from" : 0,
                "to" : 1479693481467,
                "include_lower" : true,
                "include_upper" : true
              }
            }
          }, {
            "bool" : {
              "should" : [ {
                "nested" : {
                  "query" : {
                    "term" : {
                      "annotations.endpoint.serviceName" : "service"
                    }
                  },
                  "path" : "annotations"
                }
              }, {
                "nested" : {
                  "query" : {
                    "term" : {
                      "binaryAnnotations.endpoint.serviceName" : "service"
                    }
                  },
                  "path" : "binaryAnnotations"
                }
              } ]
            }
          }, {
            "term" : {
              "name" : "methodcall"
            }
          }, {
            "nested" : {
              "query" : {
                "bool" : {
                  "must" : [ {
                    "term" : {
                      "annotations.value" : "custom"
                    }
                  }, {
                    "term" : {
                      "annotations.endpoint.serviceName" : "service"
                    }
                  } ]
                }
              },
              "path" : "annotations"
            }
          }, {
            "nested" : {
              "query" : {
                "bool" : {
                  "must" : [ {
                    "term" : {
                      "binaryAnnotations.key" : "BAH"
                    }
                  }, {
                    "term" : {
                      "binaryAnnotations.value" : "BEH"
                    }
                  }, {
                    "term" : {
                      "binaryAnnotations.endpoint.serviceName" : "service"
                    }
                  } ]
                }
              },
              "path" : "binaryAnnotations"
            }
          } ]
        }
      }
    }
  },
  "aggregations" : {
    "traceId_agg" : {
      "terms" : {
        "field" : "traceId",
        "size" : 10,
        "order" : {
          "timestamps_agg" : "desc"
        }
      },
      "aggregations" : {
        "timestamps_agg" : {
          "min" : {
            "field" : "timestamp_millis"
          }
        }
      }
    }
  }
}

[codefromthecrypt]

closing as it is antiquated especially now we have a different model