# Traces and Spans
* All applications are instrumented and has spans and traces.
* ALWAYS, first, use get_traces_fields to understand the documents fields, then ALWAYS, search for trace documents based on the fields recieved in the previous call. You MUST filter by the fields names that appears here
* When investigating network errors, latency, or performance issues, ALWAYS check traces and spans
* The search query should always contain the root 'query' element in the search expression
* Search traces using the `fetch_opensearch_logs` tool
* try to search traces based on what you're looking for, and the trace fields available
* Always build the query with '.keyword' when doing exact match
* if time range is not specified, get logs for the last hour
* When investigating numeric errors, these are error codes
* Always search for traces BEFORE checking logs. If the logs contain information that can lead to another trace search, do another trace search
* ALWAYS check for traces to learn about the traffic, latency and errors
