Salesforce’s Tracer platform ingests 300 billion trace spans daily across a federated Elasticsearch deployment, but raw spans are a poor unit of analysis for incident triage. This talk shares how we shifted to trace-level analysis—reconstructing span trees to pinpoint the service responsible for latency, backed by an S3/Parquet caching layer that keeps 84% of queries off Elasticsearch and cuts query times 60-70%.

