Techniques facilitating anomaly detection and root cause analysis using distributed trace data. In one example, a system can comprise a processor that executes computer executable components stored in memory. The computer executable components comprise: a preprocessing component; and a monitor component. The preprocessing component can generate a trace frame comprising a vectorized representation of textual trace data produced by microservices of a microservice application. The monitor component can identify a state of the microservice application using the trace frame.