anchor.diff:  http://www.splunk.com/[Splunk] etc. you can order the events that took place. An example of
   Kibana would look like this:
   
  -image::https://raw.githubusercontent.com/spring-cloud/spring-cloud-sleuth/master/docs/src/main/asciidoc/images/kibana.png[Log correlation with Kibana]
  +image::https://raw.githubusercontent.com/spring-cloud/spring-cloud-sleuth/{branch}/docs/src/main/asciidoc/images/kibana.png[Log correlation with Kibana]
   
   If you want to use https://www.elastic.co/guide/en/logstash/current/index.html[Logstash] here is the Grok pattern for Logstash:
   
  
positive.code: 
  This is how the visualization of the parent / child relationship of spans would look like:
  
  image::https://raw.githubusercontent.com/spring-cloud/spring-cloud-sleuth/master/docs/src/main/asciidoc/images/parents.png[Parent child relationship]
  
  === Purpose
  
  
negative.code: 
  ==== Distributed tracing with Zipkin
  
  Altogether there are *7 spans* . If you go to traces in Zipkin you will see this number in the second trace:
  
  image::https://raw.githubusercontent.com/spring-cloud/spring-cloud-sleuth/{branch}/docs/src/main/asciidoc/images/zipkin-traces.png[Traces]
  
  However if you pick a particular trace then you will see *4 spans*:
  
  image::https://raw.githubusercontent.com/spring-cloud/spring-cloud-sleuth/{branch}/docs/src/main/asciidoc/images/zipkin-ui.png[Traces Info propagation]
  
  NOTE: When picking a particular trace you will see merged spans. That means that if there were 2 spans sent to
  Zipkin with Server Received and Server Sent / Client Received and Client Sent
  annotations then they will presented as a single span.
  
  Why is there a difference between the 7 and 4 spans in this case?
  
      - 2 spans come from `http:/start` span. It has the Server Received (SR) and Server Sent (SS) annotations.
      - 2 spans come from the RPC call from `service1` to `service2` to the `http:/foo` endpoint. It has the Client Sent (CS)
       and Client Received (CR) annotations on `service1` side. It also has Server Received (SR) and Server Sent (SS) annotations
       on the `service2` side. Physically there are 2 spans but they form 1 logical span related to an RPC call.
      - 2 spans come from the RPC call from `service2` to `service3` to the `http:/bar` endpoint. It has the Client Sent (CS)
       and Client Received (CR) annotations on `service2` side. It also has Server Received (SR) and Server Sent (SS) annotations
       on the `service3` side. Physically there are 2 spans but they form 1 logical span related to an RPC call.
      - 2 spans come from the RPC call from `service2` to `service4` to the `http:/baz` endpoint. It has the Client Sent (CS)
       and Client Received (CR) annotations on `service2` side. It also has Server Received (SR) and Server Sent (SS) annotations
       on the `service4` side. Physically there are 2 spans but they form 1 logical span related to an RPC call.
  
  So if we count the physical spans we have *1* from `http:/start`, *2* from `service1` calling `service2`, *2* form `service2`
  calling `service3` and *2* from `service2` calling `service4`. Altogether *7* spans.
  
  Logically we see the information of *Total Spans: 4* because we have *1* span related to the incoming request
  to `service1` and *3* spans related to RPC calls.
  
  ==== Visualizing errors
  
  Zipkin allows you to visualize errors in your trace. When an exception was thrown and wasn't caught then we're
  setting proper tags on the span which Zipkin can properly colorize. You could see in the list of traces one
    trace that was in red color. That's because there was an exception thrown.
  
  If you click that trace then you'll see a similar picture
  
  image::https://raw.githubusercontent.com/spring-cloud/spring-cloud-sleuth/{branch}/docs/src/main/asciidoc/images/zipkin-error-traces.png[Error Traces]
  
  Then if you click on one of the spans you'll see the following
  
  image::https://raw.githubusercontent.com/spring-cloud/spring-cloud-sleuth/{branch}/docs/src/main/asciidoc/images/zipkin-error-trace-screenshot.png[Error Traces Info propagation]
  
  As you can see you can easily see the reason for an error and the whole stacktrace related to it.
  
  ==== Live examples
  
  .Click Pivotal Web Services icon to see it live!
  [caption="Click Pivotal Web Services icon to see it live!"]
  image::https://raw.githubusercontent.com/spring-cloud/spring-cloud-sleuth/{branch}/docs/src/main/asciidoc/images/pws.png["Zipkin deployed on Pivotal Web Services", link="http://docssleuth-zipkin-server.cfapps.io/", width=150, height=74]
  
  The dependency graph in Zipkin would look like this:
  
  image::https://raw.githubusercontent.com/spring-cloud/spring-cloud-sleuth/{branch}/docs/src/main/asciidoc/images/dependencies.png[Dependencies]
  
  .Click Pivotal Web Services icon to see it live!
  [caption="Click Pivotal Web Services icon to see it live!"]
  image::https://raw.githubusercontent.com/spring-cloud/spring-cloud-sleuth/{branch}/docs/src/main/asciidoc/images/pws.png["Zipkin deployed on Pivotal Web Services", link="http://docssleuth-zipkin-server.cfapps.io/dependency", width=150, height=74]
  
  
  ==== Log correlation
  