Global field reference

The following reference contains a list of global fields that have a well defined semantic meaning in Dynatrace and can be used across different monitoring types. The fields are organized in namespaces that are separated with dots.

Top level fields

The top level fields contain generally relevant information for all monitoring data

Attribute
Type
Description
Examples
timestamp
timestamp
stable
The time (UNIX Epoch time in nanoseconds) when the event originated, typically when the source created it. If no original timestamp is available, it will be populated at ingest time and required for all events. In the case of a correlated event (for example, ITIL events), this time could be different from the event.start time, as this time represents the actual timestamp when the "update" for the event was created.
1649822520123123123
timeframe
record[]
stable
The timeframe represented by a timeseries record.
start_time
timestamp
stable
Start time of a data point. Value is an UNIX Epoch time in nanoseconds and less or equal the end_time.
1649822520123123123
end_time
timestamp
stable
End time of a data point. Value is an UNIX Epoch time in nanoseconds and greater or equal the start_time.
1649822520123123165
duration
duration
stable
The difference of start_time and end_time in nanoseconds.
42
interval
string
stable
Denotes the timeframe of represented by individual timeseries measurements returned by a timeseries record.
1 min

Adobe

Fields

Attribute
Type
Description
Examples
adobe.em.env_type
string
experimental
Adobe Experience Manager (AEM) environment type.
dev; stage; prod
adobe.em.program
string
experimental
Adobe Experience Manager (AEM) service. Contains the customer defined name of the AEM environment.
adobe.em.service
string
experimental
Adobe Experience Manager (AEM) service. Contains the program and environment IDs the customer is exposed to.
adobe.em.tier
string
experimental
Adobe Experience Manager (AEM) tier.
author; publish; preview

Aggregation

OneAgent might aggregate spans having the same parent span into a single one. The aggregated span contains attributes to indicated that aggregation happened and to allow to reconstruct details.

For aggregated spans the start_time holds the earliest start_time, end_time holds the latest end_time of all aggregated spans.

Fields

Attribute
Type
Description
Examples
aggregation.count
long
experimental
The number of spans aggregated into the this span. This means this span represents multiple spans therefore value is >1.
3
aggregation.duration_max
duration
experimental
The duration in nanoseconds for longest aggregated span.
482
aggregation.duration_min
duration
experimental
The duration in nanoseconds for shortest aggregated span.
42
aggregation.duration_samples
duration[]
experimental
Array of reservoir sampled span durations of the aggregated spans. The duration samples can be used to estimate a more accurate duration distribution of aggregated spans rather then using the average value.
[42, 482, 301]
aggregation.duration_sum
duration
experimental
The duration sum in nanoseconds for all aggregated spans.
123
aggregation.exception_count
long
experimental
The number of aggregated spans which included an exception.
0; 6
aggregation.parallel_execution
boolean
experimental
true indicates that aggregated spans may have been executed in parallel. Therefore start_time + duration_sum may exceed end_time.

Apache HTTP Server

Fields

Attribute
Type
Description
Examples
apache.httpd.config.path
string
experimental

Apache Spark

Fields

Attribute
Type
Description
Examples
apache.spark.master.ip
string
experimental

Apache Tomcat

Fields

Attribute
Type
Description
Examples
apache.tomcat.base
string
experimental
The server's base directory. This is what usually is referred to as CATALINA_BASE.
/usr/share/tomcat6
apache.tomcat.home
string
experimental
The server's home directory. This is what usually is referred to as CATALINA_HOME.
/usr/share/tomcat6

App

The app namespace contains information on the application sending the event.

Fields

Attribute
Type
Description
Examples
app.bundle
string
stable
Name of the bundle or package.
com.example.easytravel
app.id
string
stable
An optional unique application identifier. Chosen by the customer
easytravel
app.short_version
string
stable
Human readable version of the application, usually major & minor version.
5.23
app.version
string
stable
Full version of the application. This can include more verbose information, such as the build number.
5.23.15789; 143542

Artifact

The artifact namespace contains information about software artifacts.

Fields

Attribute
Type
Description
Examples
artifact.attestation.filename
string
experimental
The provenance filename of the built attestation. It directly relates to the artifact.filename.
carts-service-amd64-0.1.1.tar.gz.intoto.json1
artifact.attestation.hash
string
experimental
The full hash value of the built attestation.
b4e370270ac4fe8d728b845ab8d190a7c931f09ff7b0156dd4d6abf797f1fe6a
artifact.attestation.id
string
experimental
The ID of the build software attestation.
1337
artifact.filename
string
experimental
The filename of the software artifact, typically generated by the build process. This is similar to the artifact.id, but can contain the artifact.version and other data like file extension.
carts-service-amd64-0.1.1.tar.gz
artifact.hash
string
experimental
The full hash value of the software artifact. This value is used to verify the integrity of the software artifact.
6c323d126547f71fafb4bffa02cdc480fb284678644ef0b6c69029f051fe5137
artifact.id
string
experimental
The identifier of the software artifact, typically the name of the artifact.
carts-service
artifact.name
string
experimental
The human-readable name of the software artifact.
Carts service
artifact.purl
string
experimental
The Package URL of the package artifact. This value is used to identify and locate the artifact.
pkg:npm/%40dynatrace/backstage@2.0.0; pkg:deb/debian/curl@7.50.3-1?arch=i386&distro=jessie
artifact.version
string
experimental
The version of the software artifact, typically in Semantic Versioning format.
0.1.1

ASP.NET Core

Fields

Attribute
Type
Description
Examples
aspnetcore.appl.path
string
experimental

Authentication

Authentication type and method used to login to a Dynatrace system.

Fields

Attribute
Type
Description
Examples
authentication.client.id
string
experimental
The OAuth2 client id if of type 'CLIENT_CREDENTIALS'.
dt0s02.UZCK6ENL.2YQ2A3DZUEISRJSUU5544J3SC3TMPXSEEMNA5HK7RW54SJ6XKLYGMWJNKL7B2DNH
authentication.grant.type
string
experimental
The grant type used during OAuth2 authentication.
AUTHORIZATION_CODE; CLIENT_CREDENTIALS
authentication.token
string
experimental
The public token identifier of authentication.type 'TOKEN'.
dt0c01.AM4SEYKIBROBEJ2N3HAXZ4IX
authentication.type
string
experimental
The method of authentication.
OAUTH2

authentication.grant.type MUST be one of the following:

Value
Description

authentication.type MUST be one of the following:

Value
Description
DEVOPSTOKEN
Authenticated via DevOps token
NONE
Not authenticated (authentication not necessary)
TOKEN
Authenticated via API access token or personal access token

authentication.client.id and authentication.token MUST follow the Dynatrace token format definition.

Specifically, authentication.client.id MUST be prefixed with dt0s02.

Availability

Information about entity availability. Sample usage is reporting hosts and PGI-s availability by OS Agent. Value of availability.state can be used for calculating aggregate availability (dividing count of "successful" requests by count of all requests). With constant frequency of requests it can be treated as a time-base availability, showing percentage of time that the monitored entity was available.

Fields

Attribute
Type
Description
Examples
availability.state
string
stable
State of entity (host or PGI) availability.
up

availability.state has the following list of well-known values. If one of them applies, then the respective value MUST be used, otherwise a custom value MAY be used.

Value
Description
available
[PGI] PGI is available and reported.
no_data
[HOST] Host is working, agent active but no data are sent.
no_data_agent_inactive
[HOST] Host is working, agent inactive (disabled manually in configuration). No data are sent.
reboot_graceful
[HOST] Host has started after graceful shutdown.
reboot_ungraceful
[HOST] Host has started after ungraceful shutdown.
shutdown_host
[HOST] Host has been shut down.
unavailable
[PGI] PGI is unavailable and not reported.
unimportant
[PGI] PGI is available but not reported because it became unimportant.
unmonitored_agent_stopped
[HOST] Host is unmonitored because agent stopped.
unmonitored_agent_uninstalled
[HOST] Host is unmonitored because agent has been uninstalled.
unmonitored_agent_upgrade
[HOST] Host is unmonitored because agent is upgrading.
up
[HOST] Host is working, agent active and sending data.

Amazon Web Services (AWS)

Fields that can come from applications running on AWS.

Fields

Resource attributes

Attribute
Type
Description
Examples
aws.account.id
string
experimental
A 12-digit number, such as 123456789012, that uniquely identifies an AWS account.
Tags: permission
123456789012
aws.alb.name
string
experimental
Application load balancer name that instance is behind
my-alb
aws.arn
string
experimental
Amazon Resource Name (ARN)
arn:aws:lambda:us-east-1:478983378254:function:acceptanceWeatherBackend
aws.availability_zone
string
experimental
A specific availability zone in given AWS region.
us‑east‑1a; us‑east‑1b
aws.ecr.account.id
string
experimental
aws.ecr.region
string
experimental
aws.ecs.cluster
string
experimental
aws.ecs.container.arn
string
experimental
The full Amazon Resource Name (ARN) of the container.
arn:aws:ecs:us-west-2:111122223333:container/05966557-f16c-49cb-9352-24b3a0dcd0e1
aws.ecs.container.name
string
experimental
aws.ecs.docker.id
string
experimental
The Docker ID for the container.
cd189a933e5849daa93386466019ab50-2495160603
aws.ecs.docker.name
string
experimental
The name of the container supplied to Docker.
curl-image
aws.ecs.family
string
experimental
aws.ecs.revision
string
experimental
aws.ecs.task.arn
string
experimental
The full Amazon Resource Name (ARN) of the task to which the container belongs.
arn:aws:ecs:us-west-2:111122223333:task/default/cd189a933e5849daa93386466019ab50
aws.lambda.function.name
string
experimental
aws.lambda.initialization_type
string
experimental
The AWS Lambda initialization type. Same string value as available in AWS_LAMBDA_INITIALIZATION_TYPE.
snap_start
aws.log_group
string
experimental
Amazon CloudWatch group of log streams that share the same retention, monitoring, and access control settings.
/aws/lambda/a-SomeFumction-1AWHD6W1QC5DH
aws.log_stream
string
experimental
A sequence of log events that share the same source.
2021/01/04/[$LATEST]b2e34f11da04232cb9f9d3d5799a5c12
aws.region
string
experimental
A specific geographical AWS Cloud location.
us-east-1
aws.resource.id
string
experimental
The unique identifier of the resource
i-0922cda4579db3a45
aws.resource.name
string
experimental
The name of the resource - value of Name tag in AWS
my-ec2-instance
aws.resource.type
string
experimental
The name of a resource type
group; cluster; instance
aws.service
string
experimental
The service that identifies the AWS product.
s3

aws.lambda.initialization_type has the following list of well-known values. If one of them applies, then the respective value MUST be used, otherwise a custom value MAY be used.

Value
Description
on-demand
On demand
provisioned-concurrency
Provisioned concurrency
snap-start
SnapStart

Span attributes

Attribute
Type
Description
Examples
aws.lambda.invoked_arn
string
experimental
The full invoked ARN as provided on the Context passed to the function (Lambda-Runtime-Invoked-Function-Arn response header from the request to /runtime/invocation/next).
arn:aws:lambda:us-east-1:123456789012:function:acceptanceWeatherBackend:production
aws.x_amzn_request_id
string
experimental
Contains the value of the AWS 'X-Amzn-RequestId' HTTP header.
123344566
aws.x_amzn_trace_id
string
experimental
Contains the X-Amzn-Trace-Id HTTP header for AWS X-Ray tracing.
Root=1-63441c4a-abcdef012345678912345678; Self=1-63441c4a-12456789abcdef012345678;Root=1-67891233-abcdef012345678912345678

Azure

Fields that can come from applications running on Azure.

Fields

Resource attributes

Attribute
Type
Description
Examples
azure.class_name
string
experimental
The full qualified name of the class executing an Azure function.
Host.Functions
azure.event_hub_namespace.name
string
experimental
Azure Event Hub Namespace name.
my-event-hub
azure.location
string
experimental
A specific geographical location of Azure Cloud resource.
East US
azure.management_group
string
experimental
A group of Azure subscriptions used for governance use cases.
Tenant Root Group; My Custom Group
azure.resource.group
string
experimental
A resource group is a container that holds related resources for an Azure solution.
Tags: permission
demo-backend-rg
azure.resource.id
string
experimental
A unique, immutable, identifier assigned to each Azure cloud resource.
/subscriptions/27e9b03f-04d2-2b69-b327-32f433f7ed21/resourceGroups/demo-backend-rg/providers/Microsoft.ContainerService/managedClusters/demo-aks
azure.resource.name
string
experimental
User provided name of Azure cloud resource.
demo-aks
azure.resource.type
string
experimental
The name of a resource type in the format: {resource-provider}/{resource-type}.
Microsoft.ContainerService/managedClusters
azure.service_bus_namespace.name
string
experimental
Azure Service Bus name.
my-service-bus
azure.site_name
string
experimental
Globally unique deployment information about an Azure function.
dt-function-scripted
azure.sql_elastic_pool.name
string
experimental
Azure SQL Server Elastic Pool name.
contoso-elastic-pool
azure.sql_server.name
string
experimental
Azure SQL Server name.
contoso-sql-server
azure.subscription
string
experimental
An Azure subscription is a logical container used to provision resources in Azure.
Tags: permission
27e9b03f-04d2-2b69-b327-32f433f7ed21
azure.vm.name
string
experimental
Azure Virtual Machine name.
my-virtual-machine
azure.vm_scale_set.name
string
experimental
Azure Virtual Machine Scale Set name.
my-vmss
azure.vmid
string
experimental
Azure Virtual Machine unique 128bits identifier
090556DA-D4FA-764F-A9F1-63614EDA019A

BOSH

Fields that are integral to applications managed by BOSH.

Fields

Resource attributes

Attribute
Type
Description
Examples
bosh.availability_zone
string
experimental
A specific geographical BOSH location.
us-east-1a
bosh.instance_id
string
experimental
A unique identifier assigned to each deployed instance.
af318409-9e9d-4a18-aca4-0fb52bbdc526
bosh.name
string
experimental
A unique identifier to a deployment or instance.
isolated_diego_cell_devima

Browser

The browser namespace contains information on the browser running an application.

Fields

Attribute
Type
Description
Examples
browser.name
string
stable
Browser name
Mozilla
browser.type
string
stable
Type of browser
desktop; mobile; tablet; robot; other
browser.user_agent
string
stable
Full user agent string as provided by the browser.
Mozilla/5.0 (Windows NT 10.0; Win64; x64)
browser.version
string
stable
Browser version
5.0

Captured Attributes

Span scoped attributes (e.g. method parameters, return values, class names, …) captured by the OneAgent based on a request attribute rule. The actual name of the attribute is the prefix "captured_attribute" plus the "request attribute name" defined in the request attributes configuration. In contrast to request attributes, captured attributes contain the raw values reported by the OneAgent at the location (i.e. on the active span) where they appeared. No aggregation (first/last value, distinct values, ...), type conversion or normalization is performed on them. They are the basis for request attributes.

Fields

Attribute
Type
Description
Examples
captured_attribute.__attribute_name__
array
experimental
Contains the span scoped raw values that were captured under the name __attribute_name__ defined by the request attribute configuration. The values are always mapped as array according to the type of the captured attributes, so either boolean, double, long or string. If the captured attributes have mixed types (e.g. long and string, or double and long, etc.), all attributes are converted to string and stored as string array.
[42]; ['Platinum']; [32, 16, 8]; ['Special Offer', '1702']; ['18.35', '16']

Cassandra

Fields

Attribute
Type
Description
Examples
cassandra.cluster.name
string
experimental

Continuous Integration/Continuous Deployment

The cicd namespace contains information about Continuous Integration and Continuous Deployment systems.

Fields

Attribute
Type
Description
Examples
cicd.pipeline.id
string
experimental
The CI/CD pipeline's identifier, which is unique within one CI/CD system.
12345
cicd.pipeline.name
string
experimental
The human-readable name of the CI/CD pipeline.
CI pipeline for main branch
cicd.pipeline.run.id
string
experimental
An identifier for a pipeline run, which is unique within one CI/CD system.
9876
cicd.pipeline.run.outcome
string
experimental
The outcome of one pipeline run.
success
cicd.pipeline.run.url.full
string
experimental
The URL pointing to one specific pipeline run.
https://github.com/ACME/ACME-repo/actions/runs/9876
cicd.pipeline.url.full
string
experimental
The CI/CD pipeline's full URL.
https://github.com/ACME/ACME-repo/actions/workflows/ci-build.yml
cicd.upstream_pipeline.id
string
experimental
The identifier of the upstream CI/CD pipeline. If a pipeline run was triggered by another pipeline, this attribute is used to reference the triggering pipeline.
12345
cicd.upstream_pipeline.run.id
string
experimental
The identifier of the upstream CI/CD pipeline run. If a pipeline run was triggered by another pipeline, this attribute is used to reference the triggering pipeline run.
1337

cicd.pipeline.run.outcome has the following list of well-known values. If one of them applies, then the respective value MUST be used, otherwise a custom value MAY be used.

Value
Description
canceled
The pipeline run was canceled and did not complete.
error
The pipeline run failed with an error.
failure
The pipeline run failed.
skipped
The pipeline did not run, but was skipped.
success
The pipeline run completed successfully.
timed_out
The pipeline run timed out, and therefore did not complete.
warning
The pipeline run completed with at least one warning.

Client

The client namespace contains information on the initiator of a network connection.

Fields

Attribute
Type
Description
Examples
client.ip
ipAddress
experimental
IP address of the client (IPv4 or IPv6) making the request.
Tags: sensitive-spans
194.232.104.141; 2a01:468:1000:9::140
client.ip.is_public
boolean
experimental
Indicates whether IP is a public IP.
true
client.isp
string
experimental
The name of the Internet Service Provider (ISP) associated with the IP address of the client.
Internet Service Provider Name
client.port
long
experimental
Client port number.
65123; 80

Cloud

Fields related to cloud deployments that can be used across different providers.

Fields

Attribute
Type
Description
Examples
cloud.account.id
string
stable
The cloud account ID the resource is assigned to.
111111111111; opentelemetry
cloud.availability_zone
string
stable
Identifier referring to the availability zone within a cloud vendor's region.
us-east-1a
cloud.platform
string
stable
The cloud platform in use. 1
alibaba_cloud_ecs
cloud.provider
string
experimental
Name of the cloud provider.
alibaba_cloud
cloud.region
string
stable
Identifier referring to a geographic region of a cloud vendor's datacenter.
us-east-1
cloud.resource_id
string
stable
Cloud provider-specific native identifier of the monitored cloud resource (e.g. an ARN on AWS, a fully qualified resource ID on Azure, a full resource name on GCP).
arn:aws:lambda:REGION:ACCOUNT_ID:function:my-function; //run.googleapis.com/projects/PROJECT_ID/locations/LOCATION_ID/services/SERVICE_ID; /subscriptions/<SUBSCIPTION_GUID>/resourceGroups/<RG>/providers/Microsoft.Web/sites/<FUNCAPP>/functions/<FUNC>
1

The prefix of the service matches the one specified in cloud.provider.

cloud.platform MUST be one of the following:

Value
Description
alibaba_cloud_ecs
Alibaba Cloud Elastic Compute Service
alibaba_cloud_fc
Alibaba Cloud Function Compute
alibaba_cloud_openshift
Red Hat OpenShift on Alibaba Cloud
aws_app_runner
AWS App Runner
aws_ec2
AWS Elastic Compute Cloud
aws_ecs
AWS Elastic Container Service
aws_eks
AWS Elastic Kubernetes Service
aws_elastic_beanstalk
AWS Elastic Beanstalk
aws_lambda
AWS Lambda
aws_openshift
Red Hat OpenShift on AWS (ROSA)
azure_aks
Azure Kubernetes Service
azure_app_service
Azure App Service
azure_container_instances
Azure Container Instances
azure_functions
Azure Functions
azure_openshift
Azure Red Hat OpenShift
azure_vm
Azure Virtual Machines
gcp_app_engine
Google Cloud App Engine (GAE)
gcp_cloud_functions
Google Cloud Functions (GCF)
gcp_cloud_run
Google Cloud Run
gcp_compute_engine
Google Cloud Compute Engine (GCE)
gcp_kubernetes_engine
Google Cloud Kubernetes Engine (GKE)
gcp_openshift
Red Hat OpenShift on Google Cloud
ibm_cloud_openshift
Red Hat OpenShift on IBM Cloud
tencent_cloud_cvm
Tencent Cloud Cloud Virtual Machine (CVM)
tencent_cloud_eks
Tencent Cloud Elastic Kubernetes Service (EKS)
tencent_cloud_scf
Tencent Cloud Serverless Cloud Function (SCF)

cloud.provider has the following list of well-known values. If one of them applies, then the respective value MUST be used, otherwise a custom value MAY be used.

Value
Description
alibaba_cloud
Alibaba Cloud
aws
Amazon Web Services
azure
Microsoft Azure
gcp
Google Cloud Platform
heroku
Heroku Platform as a Service
ibm_cloud
IBM Cloud
tencent_cloud
Tencent Cloud

Cloudfoundry

Fields

Attribute
Type
Description
Examples
cloudfoundry.application.id
string
experimental
cloudfoundry.application.name
string
experimental
cloudfoundry.instance.index
string
experimental
cloudfoundry.space.id
string
experimental
cloudfoundry.space.name
string
experimental

Code

Fields

Attribute
Type
Description
Examples
code.call_stack
string
experimental
The call stack of the code.function. The call stack starts with the code.function and the stack frames are separated by a line feed.
com.example.SampleClass.doProcessing(SampleClass.java) com.example.SampleClass.doSomeWork(SampleClass.java) com.example.SampleClass.main(SampleClass.java)
code.filepath
string
experimental
The source code file name that identifies the code unit as uniquely as possible.
/usr/local/MyApplication/content_root/app/index.php
code.function
string
experimental
The method or function name, or equivalent (usually rightmost part of the code unit's name). Represents the name of the function, that is represented by this span.
serveRequest
code.invoked.filepath
string
experimental
Like code.filepath, only it represents the file path of the function that was active when a span has been started. Typically it is the function that has been instrumented. Should only be set if it differs from code.filepath.
/usr/local/MyApplication/content_root/app/index.php
code.invoked.function
string
experimental
Like code.function, only it represents the function that was active when a span has been started. Typically it is the function that has been instrumented. The spans duration does not reflect the duration of this function execution. Should only be set if it differs from code.function.
invoke
code.invoked.namespace
string
experimental
Like code.namespace, only it represents the namespace of the function that was active when a span has been started. Typically it is the function that has been instrumented. Should only be set if it differs from code.namespace.
com.sun.xml.ws.server.InvokerTube$2
code.namespace
string
experimental
The "namespace" within which code.function is defined. Usually the qualified class or module name, such that code.namespace + some separator + code.function form a unique identifier for the code unit.
com.example.MyHttpService

Coldfusion

Fields

Attribute
Type
Description
Examples
coldfusion.jvm.config.file
string
experimental
coldfusion.service.name
string
experimental

Compilation Timings

For some technologies compilation of code might be a significant contributor to request execution time. Compilation timings provide insight into this, where available.

Fields

Attribute
Type
Description
Examples
compilation_timings.compilation_count
long
experimental
The number of compilations contributing to compilation_timings.duration_sum.
7
compilation_timings.duration_sum
duration
experimental
The total duration in nanoseconds spent compiling.
6723
compilation_timings.top_compilations
record
experimental
The top N compilations contributing to compilation_timings.duration_sum, represented as map from compilation unit name to duration in nanoseconds spent.
{'/home/user/test/php/build/tmp/php-htdocs/memcached/memcachedCli.php': 1952, '/home/user/test/php/build/tmp/php-htdocs/curl_cli_uri_filtering.php': 1306}

Container

Fields

Attribute
Type
Description
Examples
container.id
string
experimental
Container ID. Usually a UUID, as for example used to identify Docker containers. The UUID might be abbreviated.
a3bf90e006b2
container.image.name
string
experimental
Name of the image the container was built on.
gcr.io/opentelemetry/operator
container.image.version
string
experimental
0.1
container.name
string
experimental
Container name used by container runtime.
opentelemetry-autoconf

CICS Transaction Gateway

CTG (shorthand for "CICS Transaction Gateway") is a connector for enterprise modernization of CICS assets. It empowers various application platforms, such as Java servlets, to incorporate CICS programs.

CICS (shorthand for "Customer Information Control System") is a middleware to support rapid, high-volume online transaction processing on IBM mainframe systems on z/OS. CTG features a client and a server, which communicate via so-called GatewayRequests.

Fields

Attribute
Type
Description
Examples
ctg.request.call_type
long
experimental
Integer representing the call type of the CTG GatewayRequest. The set of possible values varies per request type. 1
2
ctg.request.commarea_length
long
experimental
Length of the COMMAREA. Only set when request type is ECI.
0
ctg.request.extend_mode
long
experimental
Integer representing the extend mode of the CTG GatewayRequest. Only set when request type is ECI. 2
11
ctg.request.flow_type
long
experimental
Integer representing the flow type of the CTG GatewayRequest. 3
5
ctg.request.gateway_url
string
experimental
URL of the gateway. Only set on client-side spans.
tcp://1.2.3.4:5678/
ctg.request.object_name
string
experimental
Name of the request object. Only set when request type is ADMIN.
ctg.request.server_id
string
experimental
ID of the server. Not set for all request types.
IPICTEST
ctg.request.term_id
string
experimental
Name of the terminal resource. Only set when request type is EPI.
CN02
ctg.request.type
string
experimental
Type of the CTG GatewayRequest.
BASE
ctg.response.code
long
experimental
CTG response code. The set of possible values varies per request type. 4
-23

ctg.request.type MUST be one of the following:

Value
Description
ADMIN
Admin request.
AUTH
Authentication request.
BASE
Base. A base GatewayRequest without a further subtype. 1
ECI
External Call Interface. Enables a client application to call a CICS program synchronously or asynchronously. 2
EPI
External Presentation Interface. Enables a user application to install a virtual IBM 3270 terminal into a CICS server. 3
ESI
External Security Interface. Enables user applications to perform security-related tasks. 4
XA
CICS Request Exit. Can be used for request retry, dynamic server selection and for rejecting non-valid requests. 5

Custom Services

Fields

Attribute
Type
Description
Examples
custom_service.method
string
experimental
The service method of a custom service. This field is only present if a custom service was directly created via Dynatrace OneAgent SDK.
startTask; run; authenticate
custom_service.name
string
experimental
The name of a custom service. This field is only present if a custom service was directly created via Dynatrace OneAgent SDK.
MyCustomService; AuthenticationComponent

Database

Fields

Attribute
Type
Description
Examples
db.affected_item_count
long
experimental
The number of items (rows, documents,…) affected.
32
db.collection.name
string
experimental
The name of a collection (table, container) within the database.
customers; public.users
db.connection_string
string
experimental
The connection string for a database connection.
Tags: sensitive-spans
jdbc:dynamodb:Access Key=XXX;Secret Key=XXX;Domain=amazonaws.com;Region
db.cosmosdb.request_charge
double
experimental
The cost of the request in Azure Cosmos DB request units (RU).
4.95; 2.0
db.dynamodb.region
string
experimental
The region of the dynamodb (see also cloud.region).
us-east-1
db.dynamodb.table_names
string[]
experimental
The list of tables the request targets.
[Cats, Dogs]
db.namespace
string
experimental
The name of the database, fully qualified within the server address and port.
customers; test.users
db.operation.name
string
experimental
The name of the operation or command executed, e.g. the MongoDB command name, SQL keyword, Redis command name,… 1
drop; findAndModify; SELECT; PREPARE; GetItem; set; LPUSH; mutateIn; ReadItems
db.query.parameters
record[]
experimental
The query parameters used in db.query.text represented as a key and value map. For database systems which do not have named keys the map key is the string representation of the index starting with 0. Several database requests may get aggregated into a single span. Each entry in the array holds the bind parameters for one database request.
Tags: sensitive-spans
[{'name': 'paul', 'age': '23'}, {'name': 'mary', 'age': '32'}]; [{'0': 'paul', '1': '23'}, {'0': 'mary', '1': '32'}]
db.query.text
string
experimental
The database query being executed. 2
SELECT * FROM wuser_table; SET mykey "WuValue"
db.result.duration_max
duration
experimental
The maximum duration in nanoseconds used for fetching the result.
345
db.result.duration_min
duration
experimental
The minimum duration in nanoseconds used for fetching the result.
123
db.result.duration_sum
duration
experimental
The total duration in nanoseconds used for fetching the result.
234
db.result.exception_count
long
experimental
The number of exceptions encountered while fetching the result.
2
db.result.execution_count
long
experimental
The number of operations executed on the result (e.g. fetches from SQL result set, MongoDB cursor operations).
12
db.result.roundtrip_count
long
experimental
The number of round-trips triggered by fetching the result.
2
db.system
string
experimental
An identifier for the database management system (DBMS) product being used. See below for a list of well-known identifiers.
mongodb; mysql
1

Depending on the data provided on ingest this attribute may be derived by e.g. parse of db.query.text. Parsing might fail or result might be inaccurate.

2

The value may be sanitized to exclude sensitive information.

db.system has the following list of well-known values. If one of them applies, then the respective value MUST be used, otherwise a custom value MAY be used.

Value
Description
adabas
Adabas (Adaptable Database System)
cache
InterSystems Caché
cassandra
Apache Cassandra
clickhouse
ClickHouse
cloudscape
Cloudscape
cockroachdb
CockroachDB
coldfusion
ColdFusion IMQ
cosmosdb
Microsoft Azure Cosmos DB
couchbase
Couchbase
couchdb
CouchDB
db2
IBM Db2
derby
Apache Derby
dl/i
IBM DL/I
dynamodb
Amazon DynamoDB
edb
EnterpriseDB
elasticsearch
Elasticsearch
filemaker
FileMaker
firebird
Firebird
firstsql
FirstSQL
geode
Apache Geode
h2
H2
hanadb
SAP HANA
hbase
Apache HBase
hive
Apache Hive
hsqldb
HyperSQL DataBase
informix
Informix
ingres
Ingres
instantdb
InstantDB
interbase
InterBase
mariadb
MariaDB
maxdb
SAP MaxDB
memcached
Memcached
mongodb
MongoDB
mssql
Microsoft SQL Server
mssqlcompact
Microsoft SQL Server Compact
mysql
MySQL
neo4j
Neo4j
netezza
Netezza
opensearch
OpenSearch
oracle
Oracle Database
other_sql
Some other SQL database. Fallback only. See notes.
pervasive
Pervasive PSQL
pointbase
PointBase
postgresql
PostgreSQL
progress
Progress Database
redis
Redis
redshift
Amazon Redshift
spanner
Cloud Spanner
sqlite
SQLite
sybase
Sybase
teradata
Teradata
vertica
Vertica

Deployment Attributes

Fields

Attribute
Type
Description
Examples
deployment.release_build_version
string
experimental
The build version of the deployed product.
2021-03-24
deployment.release_product
string
experimental
The name of the deployed product.
WoGo Main
deployment.release_stage
string
experimental
The stage the product is deployed to.
production
deployment.release_version
string
experimental
The version of the deployed product.
0.4.1

Device

The device namespace contains information on the device running an application. This should only be used for end-user devices or devices outside of a private infrastructure. In line with the naming conventions and guidelines, we are in this case adhering to the emerging Open Telemetry convention around this, with some additions.

Fields

Attribute
Type
Description
Examples
device.battery.level
long
experimental
The battery level of the device.
100
device.is_rooted
boolean
experimental
Indicates if a rooted device was detected.
false
device.manufacturer
string
experimental
The manufacturer of the device.
Apple
device.model.identifier
string
experimental
The model identifier of the device.
iPhone3,4
device.orientation
string
experimental
The orientation of the device.
landscape
device.screen.height
long
experimental
Screen size height.
1152
device.screen.width
long
experimental
Screen size width.
2048

Disk

Fields describing a disk.

Fields

Resource attributes

Attribute
Type
Description
Examples
disk.all_mountpoints
string[]
experimental
List of all mountpoints
[/mnt/storage, /home, /var/log]
disk.device_name
string
experimental
Disk device name (Linux, AIX)
sda
disk.mountpoint
string
experimental
Primary mountpoint
/mnt/storage
disk.remote_disk_id
long
stable
Unique identifier of remote disk
0; 16864135562327138441; 18446744073709551615

DL/I Database Attachment

Fields

Attribute
Type
Description
Examples
db.dli.pcb
string
experimental
The name of the program communication block associated with this DL/I method.
3; MYPCBNAM
db.dli.pcb_type
string
experimental
The PCB type.
DC; DL/I; F/P
db.dli.processing_options
string
experimental
The PCB processing options.
GR
db.dli.segment_level
string
experimental
The hierarchical level of the segment that was matched or returned.
3; 24
db.dli.segment_name
string
experimental
The name of the last segment that was matched or returned.
PARTROOT
db.dli.status_code
string
experimental
The DL/I status code.
QC
db.dli.terminal_name
string
experimental
The DL/I database or logical terminal name associated with this DL/I method.
HWSAM5ZD; 10505

db.dli.pcb_type MUST be one of the following:

Value
Description
DC
Data communications.
DL/I
DL/I db.
F/P
Fast Path.

Dotnet

Fields

Attribute
Type
Description
Examples
dotnet.dll.file
string
experimental
Filename of main dotnet assembly.
dotnet.dll.path
string
experimental
Filepath of main dotnet assembly.

Dynatrace ActiveGate

Metadata with ActiveGate realated information.

Fields

Attribute
Type
Description
Examples
dt.active_gate.group.name
string
experimental
The name of group ActiveGate instance belongs to
GdanskLab
dt.active_gate.id
string
experimental
Hexadecimal identifier of the ActiveGate prefixed with 0x
0xef3d21c3
dt.active_gate.working_mode
string
experimental
Working mode of the ActiveGate
cluster

dt.active_gate.working_mode MUST be one of the following:

Value
Description
cluster
Cluster ActiveGate
embedded
Embedded ActiveGate
environment
Environment ActiveGate
multitenant
Multitenant ActiveGate

API connector fields

Attribute
Type
Description
Examples
dt.active_gate.api_connector.config_id
string
experimental
Config long id of the endpoint configuration as a string.
123; 9276
dt.active_gate.api_connector.pipeline_identifier
string
experimental
String identifier of an api connector pipeline
Kubernetes/Topology
dt.active_gate.api_connector.pipeline_status
string
experimental
Status of an api connector pipeline run
failed
dt.active_gate.api_connector.technology_id
string
experimental
String identifier of an api connector technology
Kubernetes; CloudFoundry; AWS; Dynatrace Extension; Azure

dt.active_gate.api_connector.pipeline_status MUST be one of the following:

Value
Description
failed
Pipeline execution failed
skipped
Pipeline execution skipped
succeeded
Pipeline execution succeeded

Dynatrace OneAgent Metadata

Metadata of the OneAgent module that reported a signal. These attributes are what one would also see in OneAgent Health.

Fields

Attribute
Type
Description
Examples
dt.agent.module.id
uid
experimental
OneAgent module ID.
031f613871fab0b4; fc3cd1bb276f0bed
dt.agent.module.parent_id
uid
experimental
OneAgent parent module ID, in case this is a so-called sub-agent
ea89eef5db8b85a9
dt.agent.module.type
string
experimental
OneAgent module type
apache
dt.agent.module.version
string
experimental
OneAgent full module version
1.269.17.20221117-132428
dt.agent.module.version_short
string
experimental
OneAgent short module version, to be expected only on record types where dt.agent.module.version's cardinality would be a problem
1.269

dt.agent.module.type has the following list of well-known values. If one of them applies, then the respective value MUST be used, otherwise a custom value MAY be used.

Value
Description
apache
apache
dotnet
dotnet
dumpproc
dumpproc
extensions
extensions
go
go
iis
iis
java
java
log_analytics
log_analytics
net
net
nettracer
nettracer
nginx
nginx
nodejs
nodejs
opentracingnative
opentracingnative
os
os
php
php
plugin
plugin
process
process
python
python
remote_plugin
remote_plugin
ruby
ruby
sdk
sdk
support
support
updater
updater
varnish
varnish
wsmb
wsmb
z
z_

Dynatrace AutomationEngine fields

Fields defined in this namespace are used by Dynatrace to describe various aspects of events emitted by the AutomationEngine.

Fields

Attribute
Type
Description
Examples
dt.automation_engine.action.app
string
experimental
The app id of the app containing the executed action.
dynatrace.workflows
dt.automation_engine.action.function
string
experimental
Name of the function implementing the action.
task_1
dt.automation_engine.action_execution.id
string
experimental
The unique identifier of a action execution as UUID.
23e7b55a-884f-4497-8ad6-8d49d52b4348
dt.automation_engine.action_execution.loop.index
long
experimental
Loop index of the action execution.
dt.automation_engine.action_execution.retry.count
long
experimental
Retry count of the action execution.
dt.automation_engine.state
string
experimental
The state of an execution. Values depend on type of execution (workflow-, task-, or action execution).
IDLE; RUNNING; WAITING; SUCCESS; ERROR; CANCELLED
dt.automation_engine.state.is_final
boolean
experimental
Indicates if dt.automation_engine.state is a final and immutable state or if further processing will happen.
true; false
dt.automation_engine.state_info
string
experimental
Additional info about current state of execution. Typically holds error details.
ERROR
dt.automation_engine.task.name
string
experimental
The identifier of a task within a workflow.
task_1
dt.automation_engine.task_execution.id
string
experimental
The unique identifier of a task execution as UUID.
6580d4af-6b1f-4e54-92fa-f47e94507acd
dt.automation_engine.workflow.id
string
experimental
The unique identifier of a workflow as UUID.
26c0334e-a3e1-4585-8cd8-2d72742fe141
dt.automation_engine.workflow.title
string
experimental
The title of the workflow.
My Workflow
dt.automation_engine.workflow.type
string
experimental
Workflow type, either SIMPLE or STANDARD, where SIMPLE comes with restrictions.
SIMPLE; STANDARD
dt.automation_engine.workflow_execution.id
string
experimental
The unique identifier of a workflow execution as UUID.
737a248b-d1cb-49a4-bf08-7d4c37dbfb1e
dt.automation_engine.workflow_execution.trigger.type
string
experimental
The identifier describing the trigger of the workflow.
Schedule; Event; Manual
dt.automation_engine.workflow_execution.trigger.user.id
string
experimental
The unique identifier of the user who triggered the workflow execution manually/via API.
dad18fa7-3c11-40a1-b760-1d8281bb5dcc

Davis metadata

Some attributes are used in the context of the Davis engine.

Fields

Configuration fields

These fields can be set in events to influence the Davis engine behavior.

Attribute
Type
Description
Examples
dt.davis.analysis_time_budget
long
stable
The time budget (in seconds) that the Davis® engine is granted before it must raise a problem. The analysis time budget can be set per event and controls the balance of sending out alerts early and granting the AI analysis enough time to finish its analysis. The trade-off of a short analysis budget is that the root cause and event merge analysis is limited or even skipped. For example, the time budget of 0 seconds means that the event raises a problem and sends the alert immediately, without any analysis.
dt.davis.analysis_trigger_delay
long
stable
The time delay (in seconds) before the trigger of Davis® analysis. For example, the delay of 0 seconds triggers a Davis® problem and the root cause analysis immediately. The trigger delay can be used to hold the analysis until all the relevant root cause data has arrived to Dynatrace. For example, it might be beneficial for cloud integrations or log integrations that report data in different schedules - you can delay the analysis until data from all sources is available. Note that while longer delays means more data is available for root cause analysis, it also delays alerts delivery.
dt.davis.is_entity_remapping_allowed
boolean
stable
This flag defines whether the remapping of the target entity is enabled (true) or disabled (false). If the remapping is enabled, Dynatrace can map the event to an entity extracted from the event metadata. If the remapping is disabled or the extraction is not possible, Dynatrace maps the event to the entity specified in the event configuration (for example, a specific host) or to the global environment entity.
dt.davis.is_frequent_issue_detection_allowed
boolean
stable
The flag controls whether the Davis® engine should consider suppressing frequent events (true) or bypassing frequent issues check (false).
dt.davis.is_merging_allowed
boolean
stable
This flag controls whether the Davis® engine is allowed to merge this event into a larger problem (true) or if a new problem must be created (false).
dt.davis.is_problem_suppressed
boolean
stable
This flag controls whether the Davis® engine suppresses the problem from showing up in the UI and sending notifications.
dt.davis.is_rootcause_relevant
boolean
stable
This flag controls whether the Davis® engine should include this event within the root cause analysis (true) or if it is not (false) relevant.
dt.davis.preferred_entity_type
string
stable
The preferred entity type for remapping. You can find possible values in Dynatrace UI under Settings > Topology model > Generic types. If the remapping (dt.event.allow_entity_remapping) is enabled, this property defines the entity type to which the event should be mapped. If no entity of the preferred type is extracted, no remapping is applied.
my.custom.entity.type
dt.davis.timeout
long
stable
The event timeout period (in minutes). Various event sources use this event property to keep an event active by regularly refreshing an initial event. The timeout defines how fast the event source must refresh an event to keep it active. To keep the event active, the event source must send the refresh within the timeout period. If no refresh is sent, the event is automatically closed by Dynatrace after the timeout period. Note that metric sources use their own configurable de-alerting windows to close events. Setting the timeout shorter than the de-alerting window will force events to close and increase the risk of false-positive alerts.

System fields

These fields can be set by Davis routines.

Attribute
Type
Description
Examples
dt.davis.anomaly_detection.alert
long
stable
Boolean time series of 0 and 1 showing whether a single timespan was alerted due to continuous violations.
dt.davis.anomaly_detection.anomaly
long
stable
Boolean timeseries of 0 and 1 showing whether a single timespan is outside the normal value range and therefore considered as abnormal.
dt.davis.anomaly_detection.lower
long
stable
The lower value range limit where any value below this point is considered abnormal.
dt.davis.anomaly_detection.upper
long
stable
The upper value range limit where any value above this point is considered abnormal.
dt.davis.forecast.lower
long
stable
The lower bound of the prediction interval of a given metric forecast.
dt.davis.forecast.point
long
stable
The point value of a metric forecast.
dt.davis.forecast.upper
long
stable
The upper bound of the prediction interval of a given metric forecast.

Dynatrace Entity IDs

The Dynatrace OneAgent associates monitoring data with a so called Monitored Entity ID (ME ID). On OneAgent monitored environments, whenever ME IDs are accessible within the monitored system they should be used to enrich monitoring data to facilitate correlations with data primarily addressed through ME IDs coming from other channels.

The structure for keys that signify entity IDs is dt.entity.{type of entity}. The value associated with such a key must be valid Dynatrace entity identifier (see Monitored entities API).

To allow linking Entity IDs across various different monitoring artifacts (logs, metrics, etc.), all string representations of Entity IDs are required to follow a canonical form, which for all current entities is defined as PREFIX-0123456789ABCDEF.

Consumers should treat the token as an opaque value and must not infer any semantics on the ID itself. Producers need to match the Entity ID that is being returned by Dynatrace Entity API verbatim.

Producers of string representation must treat the string as if it was parsed case-sensitively, even though some parts of the product may be more lenient. The structure of the entity ID is currently as follows: <ID-NAMESPACE>-<16-digit-hex-string>. The <ID-NAMESPACE> is type specific but cannot be used to determine the actual entity type reliably, especially in cases of CUSTOM_DEVICE. The <16-digit-hex-string> needs to be zero-padded (prefix) to a length of 16 digits and must use upper case letters A-F.

Current entity IDs in cannonical form can be represented structurally with the following regular expression: [A-Z][A-Z_]*-[0-9A-F]{16}.

Additional characters or changes in the format may happen in the future but will not invalidate existing IDs or ID generation rules.

When adding a name to an entity ID via the Grail function entityName, by default, the name of the respective entity will be represented as dt.entity.{type of entity}.name. Similarly, further entity attributes can be added via the Grail function entityAttr, resulting in additional field(s) following the naming convention dt.entity.{type of entity}.{name of attribute}.

Fields

Attribute
Type
Description
Examples
dt.entity.application
string
stable
The ME ID of a web application.
Tags: entity-id
APPLICATION-DC92E74A7A844E6E
dt.entity.aws_availability_zone
string
stable
An entity ID of an entity of type AWS_AVAILABILITY_ZONE
Tags: entity-id
AWS_AVAILABILITY_ZONE-6000A4E2BD2AB971
dt.entity.azure_region
string
stable
An entity ID of an entity of type AZURE_REGION
Tags: entity-id
AZURE_REGION-0DD5C79E4034F0AA
dt.entity.azure_vm
string
stable
An entity ID of an entity of type AZURE_VM
Tags: entity-id
AZURE_VM-326478B733D6CFB0
dt.entity.cloud_application
string
stable
An entity ID of an entity of type CLOUD_APPLICATION.
Tags: entity-id
CLOUD_APPLICATION-3AB5BBF3E09A7942
dt.entity.cloud_application_instance
string
stable
An entity ID of an entity of type CLOUD_APPLICATION_INSTANCE.
Tags: entity-id
CLOUD_APPLICATION_INSTANCE-E0D8F94D9065F24F
dt.entity.cloud_application_namespace
string
stable
An entity ID of an entity of type CLOUD_APPLICATION_NAMESPACE. A CLOUD_APPLICATION_NAMESPACE is a Kubernetes namespace.
Tags: entity-id
CLOUD_APPLICATION_NAMESPACE-C61324AA70F57BCB
dt.entity.container_group
string
stable
An entity ID of an entity of type CONTAINER_GROUP.
Tags: entity-id
CONTAINER_GROUP-7C2B1C24FFB288CB
dt.entity.container_group_instance
string
stable
An entity ID of an entity of type CONTAINER_GROUP_INSTANCE.
Tags: entity-id
CONTAINER_GROUP_INSTANCE-F4A1347110826781
dt.entity.custom_application
string
stable
The ME ID of a custom application.
Tags: entity-id
CUSTOM_APPLICATION-343A92501A51F286
dt.entity.custom_device
string
stable
An entity ID of an entity of type CUSTOM_DEVICE.
Tags: entity-id
CUSTOM_DEVICE-E0D8F94D9065F24F
dt.entity.disk
string
stable
An entity ID of an entity of type DISK
Tags: entity-id
DISK-5472CBC1ED0981D6
dt.entity.ec2_instance
string
stable
An entity ID of an entity of type EC2_INSTANCE
Tags: entity-id
EC2_INSTANCE-0004DD30F142D18C
dt.entity.external_synthetic_test
string
stable
An entity ID of an entity of type EXTERNAL_SYNTHETIC_TEST.
Tags: entity-id
EXTERNAL_SYNTHETIC_TEST-A140F3B85BCCBD1A
dt.entity.gcp_zone
string
stable
An entity ID of an entity of type GCP_ZONE
Tags: entity-id
GCP_ZONE-3699CB75E19C8505
dt.entity.host
string
stable
An entity ID of an entity of type HOST.
Tags: entity-id
HOST-E0D8F94D9065F24F
dt.entity.host_group
string
stable
An entity ID of an entity of type HOST_GROUP.
Tags: entity-id
HOST_GROUP-E7FBBCF7B1467174
dt.entity.http_check
string
stable
An entity ID of an entity of type HTTP_CHECK.
Tags: entity-id
HTTP_CHECK-A140F3B85BCCBD1A
dt.entity.http_check_step
string
stable
An entity ID of an entity of type HTTP_CHECK_STEP.
Tags: entity-id
HTTP_CHECK_STEP-A140F3B85BCCBD1A
dt.entity.kubernetes_cluster
string
stable
An entity ID of an entity of type KUBERNETES_CLUSTER.
Tags: entity-id
KUBERNETES_CLUSTER-E0D8F94D9065F24F
dt.entity.kubernetes_node
string
stable
An entity ID of an entity of type KUBERNETES_NODE.
Tags: entity-id
KUBERNETES_NODE-874C66B68CE15070
dt.entity.kubernetes_service
string
stable
An entity ID of an entity of type KUBERNETES_SERVICE.
Tags: entity-id
KUBERNETES_SERVICE-FE6E75BB9DF02347
dt.entity.mobile_application
string
stable
The ME ID of a mobile application.
Tags: entity-id
MOBILE_APPLICATION-E8A8751A60D5BCE8
dt.entity.multiprotocol_monitor
string
stable
An entity ID of an entity of type MULTIPROTOCOL_MONITOR.
Tags: entity-id
MULTIPROTOCOL_MONITOR-A140F3B85BCCBD1A
dt.entity.network_interface
string
stable
An entity ID of an entity of type NETWORK_INTERFACE
Tags: entity-id
NETWORK_INTERFACE-FC7B4A5937FC125C
dt.entity.process_group
string
stable
An entity ID of an entity of type PROCESS_GROUP.
Tags: entity-id
PROCESS_GROUP-E0D8F94D9065F24F
dt.entity.process_group_instance
string
stable
An entity ID of an entity of type PROCESS_GROUP_INSTANCE.
Tags: entity-id
PROCESS_GROUP_INSTANCE-E0D8F94D9065F24F
dt.entity.service
string
stable
An entity ID of an entity of type SERVICE.
Tags: entity-id
SERVICE-57EC3CFC1FE72449
dt.entity.service_method
string
stable
An entity ID of an entity of type SERVICE_METHOD.
Tags: entity-id
SERVICE_METHOD-659B35CA9AAC96C1
dt.entity.service_method_group
string
stable
An entity ID of an entity of type SERVICE_METHOD_GROUP.
Tags: entity-id
SERVICE_METHOD_GROUP-02000E1DB1CDAF9F
dt.entity.synthetic_location
string
stable
An entity ID of an entity of type SYNTHETIC_LOCATION.
Tags: entity-id
SYNTHETIC_LOCATION-D140F3B85BCCBD1A
dt.entity.synthetic_test
string
stable
An entity ID of an entity of type SYNTHETIC_TEST.
Tags: entity-id
SYNTHETIC_TEST-A140F3B85BCCBD1A
dt.entity.synthetic_test_step
string
stable
An entity ID of an entity of type SYNTHETIC_TEST_STEP.
Tags: entity-id
SYNTHETIC_TEST_STEP-A140F3B85BCCBD1A

Dynatrace Extensions

Additional extension information sent via self-monitoring.

Fields

Attribute
Type
Description
Examples
dt.extension.config.id
string
experimental
Extension's monitoring configuration identifier.
vu9U3hXa3q0AAAABAAtleHQ6ZXh0LTA0MAAIYWdfZ3JvdXAAA0FHMQAkMjY2YTIyM2YtZDgxYi0zNTNjLThlYzctYzk2YzliZjg4OGQ3vu9U3hXa3q0
dt.extension.ds
string
experimental
Name of the data source.
SNMPTrap
dt.extension.endpoint.hints
string[]
experimental
Hints to provide for the cluster in order to find proper endpoint in task registry.
[nat-test.lab.dynatrace.org, 1521, orc]
dt.extension.name
string
experimental
Name of the extension.
com.snmptrap.generic
dt.extension.status
string
experimental
The status of the component reporting SFM event
AUTHENTICATION_ERROR

dt.extension.status has the following list of well-known values. If one of them applies, then the respective value MUST be used, otherwise a custom value MAY be used.

Value
Description
AUTHENTICATION_ERROR
Unable to connect to EEC
DEVICE_CONNECTION_ERROR
Failed to establish connection with the device
EEC_CONNECTION_ERROR
Unable to connect to EEC
GENERIC_ERROR
Generic status used to communicate job failed
INVALID_ARGS_ERROR
Invalid arguments
INVALID_CONFIG_ERROR
Config provided by EEC is invalid
OK
Extension works fine
UNKNOWN_ERROR
Uninitialized/unknown error

Process Grouping Fields

Attributes used for Process Group enrichment in extensions.

Dynatrace ingest fields

Attributes defined in this namespace are used by Dynatrace to describe different aspects of the ingested data.

Fields

Attribute
Type
Description
Examples
dt.ingest.debug_messages
string[]
experimental
An array of strings that represent debug messages that provide a detailed debugging information. That could include even variable parts, like which attribute was modified, or which processing rules were applied.
[MyATTribute mapped to myAttribute]
dt.ingest.format
string
experimental
The format of the data ingested in Dynatrace via the various ingest channels. E.g., Generic log ingest, OTLP logs ingest
dtapi/json; otlp/protobuf
dt.ingest.warnings
string[]
experimental
An array of strings that represent markers on not-expected situations that might affect correctness or completness of incomming data point. It may be for instance limits applied or processing rule failing. It should not be detailed log with what happened, just high-level class of issue that occured.
[attr_count_trimmed, content_trimmed]

dt.ingest.format MUST be one of the following:

Value
Description
dtapi/json
JSON data ingested via the Dynatrace APIs
dtapi/plaintext
Plain text data ingested via the Dynatrace APIs
otlp/json
OpenTelemetry Protocol (OTLP) JSON data ingested via the Dynatrace APIs
otlp/protobuf
OpenTelemetry Protocol (OTLP) Protobuf data ingested via the Dynatrace APIs

dt.ingest.warnings MUST contain only values from the following list:

Value
Description
content_trimmed
The content was trimmed, right after receiving it by Cluster/ActiveGate, because it exceeded the event content max byte size limit.
content_trimmed_pipe
The content was trimmed in post-processing (after applying processing rules) because it exceeded the event content max byte size limit
attr_count_trimmed
The number of attributes was trimmed, right after receiving it by Cluster/ActiveGate, because it exceeded the max number of attributes limit.
attr_count_trimmed_pipe
The number of attributes was trimmed in post-processing (after applying processing rules) because it exceeded the max number of attributes limit.
attr_key_case_mismatch
The attribute key is detected that matches the custom attribute key or the semantic attribute key, but there is the attribute key case mismatch.
attr_val_count_trimmed
At least one multi-value attribute had values number trimmed, right after receiving it by Cluster/ActiveGate, because it exceeded the max number of attributes limit.
attr_val_count_trimmed_pipe
After applying processing rules, at least one multi-value attribute had its values number trimmed (after using processing rules) because it exceeded the maximum number of attributes limit.
attr_val_size_trimmed
At least one attribute had its value size trimmed, right after receiving it by Cluster/ActiveGate, because it exceeded the max value size in bytes limit.
attr_val_size_trimmed_pipe
At least one attribute had its value size trimmed (after applying processing rules) because it exceeded the max value size in bytes limit.
timestamp_corrected
Timestamp was too far in the future and was corrected to current time.
common_attr_corrected
STATUS, LOG_LEVEL or EVENT_TYPE attribute was corrected.
processing_batch_timeout
Batch timeout occurred during processing pipeline.
processing_transformer_timeout
Execution timeout in one of processing transformers occurred during processing pipeline.
processing_transformer_error
Execution error in one of processing transformers occurred during processing pipeline.
processing_transformer_throttled
Execution throttled in one of processing transformers during processing pipeline.
processing_output_record_conversion_error
Output conversion error occurred for some record during processing pipeline.
processing_prepare_input_error
Prepare input error occurred in one of enabled processing pipeline rules.

Dynatrace

Fields

Attribute
Type
Description
Examples
dt.cost.costcenter
string
stable
Can be used to assign usage to a Cost Center.
Team A
dt.cost.product
string
stable
Can be used to assign usage to a Product or Application ID.
Product A
dt.host_group.id
string
experimental
see Organize your environment using host groups. Note that host groups are identified by their name. This is not the entity ID of Host Group Entity, for which see dt.entity.host_group
Tags: permission
myHostGroup
dt.metrics.source
string
experimental
The source from which metrics are ingested. 1
telegraf; com.dynatrace.extension.sql-oracle
dt.pg_detection.cluster.id
string
experimental
DT_CLUSTER_ID environment variable; also see Process group detection
dt.pg_detection.custom_entry
string
dt.pg_detection.declarative.id
string
experimental
dt.pg_detection.environment.id
string
experimental
DT_ENVIRONMENT_ID environment variable
dt.pg_detection.node.id
string
experimental
DT_NODE_ID environment variable; also see Process group detection
dt.process_group.detected_name
string
experimental
The name of the process group as it was detect by the agent.
Apache Web Server httpd; Redis unguard-redis-* redis
dt.query
string
experimental
A query in the DQL format, see Dynatrace Query Langauge.
timeseries avg(dt.host.cpu.idle); fetch logs
dt.security_context
string
stable
The security context is used in access permissions to limit the visibility. Learn more about the Dynatrace permission model
Tags: permission
dt.source_entity
string
stable
The ID of the entity considered the source of the measurement. The string needs to be in the format of any MONITORED_ENTITY type. 2
Tags: entity-id
HOST-E0D8F94D9065F24F; PROCESS_GROUP_INSTANCE-E0D8F94D9065F24F
dt.source_entity.type
string
stable
The entity type of the entity whose identifier is held in dt.source_entity. The value must be a valid entity type and consistent with dt.source_entity. Note, though, that the type identifiers are expected to be lower cased in alignment with suffixes of dt.entity.* keys.
host; process_group_instance; cloud:azure:resource_group
1

This is the framework used for capturing, processing and forwarding metrics, not the emitting monitored entity. Exemplary custom value: name of an extension sending metrics.

2

Value of this attribute will be based on one of dt.entity.<type> attributes value. That means that both attributes dt.source_entity and corresponding dt.entity.<type> will be set to the same ID.

dt.metrics.source has the following list of well-known values. If one of them applies, then the respective value MUST be used, otherwise a custom value MAY be used.

Value
Description
dynatrace_codemodule
dynatrace_codemodule
dynatrace_ingest
dynatrace_ingest
dynatrace_osagent
OsAgent
micrometer
Micrometer
oneagent_metric_api
OneAgentMetricAPI
opentelemetry
OpenTelemetry
statsd
StatsD
telegraf
Telegraf

Dynatrace OpenPipeline fields

Fields defined in this namespace are used by Dynatrace to describe various aspects of the data ingested through OpenPipeline, providing detailed insights into the ingestion process.

Fields

Attribute
Type
Description
Examples
dt.openpipeline.pipelines
string[]
experimental
Collects the identifiers of all pipelines through which a record has passed during the ingestion process in OpenPipeline, providing a complete trace of its journey.
[[logs:default], [logs:pipeline_haproxy_2656, bizevents:default]]
dt.openpipeline.source
string
experimental
Identifies the source (such as API endpoints or OneAgent) used for ingesting the record into OpenPipeline.
/platform/ingest/v1/events; oneagent

Dynatrace RUM

The dt.rum namespace contains Dynatrace RUM specific fields.

Fields

Attribute
Type
Description
Examples
dt.rum.application.id
string
stable
The Dynatrace RUM application ID (UUID for Mobile, MEid for Web).
ea7c4b59f27d43eb; 89b1a1e7-fe89-4151-81e9-410fa0235f0d
dt.rum.instance.id
string
stable
The RUM application instance id. (Formerly known as visitor id, the internal user id, the rxVisitor cookie value.)
3735928559
dt.rum.schema_version
string
stable
The Dynatrace RUM enrichment version.
0.1
dt.rum.session.id
string
stable
The user session id.
HOPCPWKILUKHFHWRRQGBHHPAFLUJUOSH-0; 23626166142035610_1-0

Settings

Fields for referencing Settings 2.0 objects, schemas and scopes.

Considerations on which fields to use

Although the dt.settings.object_id is enough to identify a specific settings value within a dynatrace environment, adding explicit information about the schema, scope and/or scope type can be useful nonetheless. If your use-case will only ever involve a single schema, scope type and/or scope, documenting this is good enough - if multiple schemas, scope types and/or scopes can be involved, filling the corresponding fields is strongly recommended.

dt.settings.references can be used if multiple settings objects need to be referenced. In that case, each entry in the array can hold a reference to a single settings object.

Top level fields

The top level fields contain generally relevant information for all monitoring data.

Attribute
Type
Description
Examples
dt.settings.object_id
string
experimental
The object ID of a settings value. This corresponds to the 'objectId' field/parameter in the Settings API.
vu9U3hXa3q0AAAABACFidWlsdGluOnJ1bS51c2VyLWV4cGVyaWVuY2Utc2NvcmUABnRlbmFudAAGdGVuYW50ACRhMzZmYmYwMy00NDY1LTNlNTYtOTZiOS1kOWMzOGQ3MzU1NmO-71TeFdrerQ
dt.settings.object_summary
string
experimental
The human-readable summary or name of a single value of a multi-value settings schema. This corresponds to the 'summary' field in the Settings API.
Journey Service all errors; Really, this can be anything; My alerting rule
dt.settings.references
record[]
experimental
A collection of references to settings objects. Each entry in the array holds a reference to a single settings object.
[{'dt.settings.object_id': 'vu9U3hXa3q0AAAABACFidWlsdGluOnJ1bS51c2VyLWV4cGVyaWVuY2Utc2NvcmUABnRlbmFudAAGdGVuYW50ACRhMzZmYmYwMy00NDY1LTNlNTYtOTZiOS1kOWMzOGQ3MzU1NmO-71TeFdrerQ', 'dt.settings.relationship': 'matched_rule'}, {'dt.settings.object_id': 'vu9U3hXa3q0AAAABAB9idWlsdGluOmRhdmlzLmFub21hbHktZGV0ZWN0b3JzAAZ0ZW5hbnQABnRlbmFudAAkMzM2NTc3MTgtYWNjYi0zOGY1LTlmOGUtMTg5NTBiYmNjNmRhvu9U3hXa3q0', 'dt.settings.relationship': 'triggered_alert'}]
dt.settings.relationship
string
experimental
The type of relationship to the referenced settings object. You can use arbitrary values (in snake_case) here that describe the relationship for your use-case.
matched_rule; triggered_alert
dt.settings.schema_id
string
experimental
The schema ID of a settings schema, as used in the Settings APIs.
builtin:problem.notifications; app:dynatrace.jenkins:connection
dt.settings.schema_version
string
experimental
The version of the schema referenced by dt.settings.schema_id, as declared by the schema itself. Typically a semantic version number.
1.0.0; 1.2.3
dt.settings.scope_id
string
experimental
The ID of the scope that a settings object is persisted on. This corresponds to the 'scope' field/parameter in the Settings API.
environment; HOST-EFAB6D2FE7274823
dt.settings.scope_name
string
experimental
The human-readable name of the scope that a settings object is persisted on.
deb-10-k3s-oi-01.lab.dynatrace.org
dt.settings.scope_type
string
experimental
The type of the scope that a settings object is persisted on.
environment; host_group; host

Dynatrace Synthetic

The dt.synthetic namespace contains Dynatrace synthetic specific fields.

Fields

Attribute
Type
Description
Examples
dt.synthetic.batch.id
long
experimental
The identifier of the batch (defined for on-demand executions only).
dt.synthetic.custom_log.loglevel
string
experimental
The log event severity level.
info
dt.synthetic.custom_log.message
string
experimental
The custom log message.
log message
dt.synthetic.custom_log.timestamp
timestamp
experimental
The custom log timestamp.
1629891695487
dt.synthetic.execution.end_timestamp
timestamp
experimental
The timestamp when execution was finished, in UTC milliseconds.
1629891695487
dt.synthetic.execution.id
long
experimental
The identifier of the execution.
100681465183
dt.synthetic.execution.type
string
experimental
The type of the execution.
on-demand
dt.synthetic.failed_execution.execution.id
long
experimental
The identifier of the execution.
dt.synthetic.failed_execution.execution.stage
string
experimental
The stage of the execution.
Data retrieved
dt.synthetic.failed_execution.execution.timestamp
timestamp
experimental
The timestamp when execution was finished, in UTC milliseconds.
1629891693487
dt.synthetic.failed_execution.location.id
string
experimental
The identifier of the location from where the monitor was executed.
SYNTHETIC_LOCATION-9BB04DAEBA71B8CA
dt.synthetic.failed_execution.monitor.id
string
experimental
The identifier of the monitor.
HTTP_CHECK-6349B98E1CD87352
dt.synthetic.failed_execution.status.code
long
experimental
Numeric representation of the status.
599
dt.synthetic.failed_execution.status.details
string
experimental
Status details.
connection timed out after 5000 ms: google.com
dt.synthetic.failed_execution.status.message
string
experimental
The message returned by an execution or a status message.
TIMEOUT
dt.synthetic.failed_execution.status.on_demand.details
string
experimental
The details of the status.
PERFORMANCE_THRESHOLD_VIOLATION
dt.synthetic.failed_execution.status.on_demand.message
string
experimental
The on-demand status message.
Success
dt.synthetic.location.id
string
experimental
The identifier of the location from where the monitor was executed.
SYNTHETIC_LOCATION-9BB04DAEBA71B8CA
dt.synthetic.location.ids
array
experimental
IDs of synthetic locations from where synthetic monitor was executed.
SYNTHETIC_LOCATION-9BB04DAEBA71B8CA
dt.synthetic.monitor.id
string
experimental
The identifier of the monitor.
HTTP_CHECK-6349B98E1CD87352
dt.synthetic.multi_protocol.request.targets
array
experimental
Request target addresses with DNS record type or TCP port number.
127.0.0.1:22
dt.synthetic.result.statistics.duration
duration
experimental
The duration of the step/sum of all step.
456
dt.synthetic.result.statistics.start_timestamp
timestamp
experimental
The start timestamp of the execution.
dt.synthetic.step.id
string
experimental
The identifier of the step.
HTTP_CHECK_STEP-6349B98E1CD87352
dt.synthetic.step.ids
array
experimental
IDs of synthetic steps.
HTTP_CHECK_STEP-6349B98E1CD87352
dt.synthetic.step.sequence_number
long
experimental
The sequence number of the step (numbered from 0).
0
dt.synthetic.triggering_problem.cause
string
experimental
The cause of not triggering entity.
Location not found
dt.synthetic.triggering_problem.details
string
experimental
The details of triggering problem.
Throttling on the location. Minimum duration between successive executions for a single user is 60 sec
dt.synthetic.triggering_problem.entity.id
string
experimental
The identifier of the entity.
HTTP_CHECK-6349B98E1CD87352
dt.synthetic.triggering_problem.execution.id
long
experimental
The identifier of the execution.
dt.synthetic.triggering_problem.location.id
string
experimental
The identifier of the location from where the monitor was executed.
SYNTHETIC_LOCATION-9BB04DAEBA71B8CA

dt.synthetic.failed_execution.execution.stage MUST be one of the following:

Value
Description
Data retrieved
Data retrieved
Executed
Executed
Not triggered
Not triggered
Timed out
Not triggered
Triggered
Triggered
Waiting
Waiting

Dynatrace system fields

The namespace dt.system is reserved for Grail. These fields cannot be ingested but instead will be set by Grail directly. Every record that is fetched from Grail provides these fields, but by default they are hidden. You can display them by using the fieldsAdd command.

Example query:

// display the bucket for each log record
fetch logs
| fieldsAdd dt.system.bucket

Fields

Attribute
Type
Description
Examples
dt.system.bucket
string
stable
The Grail bucket that the record is stored in.
default_logs; default_spans; default_bizevents
dt.system.environment
string
stable
The Dynatrace environment that the record belongs to.
wkf10640
dt.system.monitoring_source
string
stable
Identifies the license under which the source is running.
fullstack_host; infrastructure
dt.system.sampling_ratio
long
stable
The selected sampling ratio.
1
dt.system.segment_id
string
stable
The segment that the record belongs to.
5d97c09e-7337-443e-bab5-2f0474804687
dt.system.storage_interval
string
stable
Identifies the timeframe represented by individual data structures stored under a metric key.
1 min
dt.system.table
string
stable
The table that the record belongs to.
logs; bizevents

dt.system.monitoring_source MUST be one of the following:

Value
Description
discovery
The source is running under the discovery license.
fullstack_container
The source is running under the full-stack container license.
fullstack_host
The source is running under the full-stack host license.
infrastructure
The source is running under the infrastructure license.
mainframe
The source is running under the mainframe license.

dt.system.storage_interval MUST be one of the following:

Value
Description
1 min
The timeframe represented by individual measurements of a metrics record in storage.

Dynatrace specific tracing fields

Fields defined in this namespace are used by Dynatrace to describe different aspects of the context propagation between spans.

Fields

Attribute
Type
Description
Examples
dt.tracing.custom_link.id
uid
experimental
The custom link id to identify spans calling each other. The id is derived from the custom link bytes.
736bd2684696c4a8
dt.tracing.custom_link.original_bytes
binary
experimental
The original binary data of the custom link.
ycXlxUBAQEDee9lm8pBcA8nF5cVAQEBA3nvZZvKQXAPee9lm8s4SAQ==
dt.tracing.custom_link.transformed_bytes
binary
experimental
The transformed binary data of the custom link, only available if a mapping was applied.
ycXlxUBAQEDee9lm8pBcA8nF5cVAQEBA3nvZZvKQXAPee9lm8s4SAQ==
dt.tracing.custom_link.type
string
experimental
The type of the custom link defines if a mapping of the dt.tracing.custom_link.original_bytes to the dt.tracing.custom_link.transformed_bytes was applied.
generic
dt.tracing.foreign_link.bytes
binary
experimental
An incoming foreign link (could be cross-environment, or cross-product).
00000004000000010000000200000003000000040000002300000001
dt.tracing.foreign_link.text
string
experimental
An incoming foreign link (could be cross-environment, or cross-product).
FW4;129;12;-2023406815;4539717;0;17;66;c511;2h02;3h12345678;4h676767; FW1;129;4711;59959450;-1859959450;3;17;0
dt.tracing.link.direction
string
experimental
The direction of the span link to define the correct order between spans.
outgoing
dt.tracing.link.id
uid
experimental
Unique identifier for a dynatrace link.
dt.tracing.link.is_sync
boolean
experimental
true indicates that caller waits on the response. Only available on span links with dt.tracing.link.direction set to outgoing.
dt.tracing.response.headers
record
experimental
A collection of key-value pairs containing received response headers related to tracing from an outgoing call. There may be multiple values for each header. Used for cross-environment linking.
{'traceresponse': ['00-7b9e3e4068167838398f50017bfad358-d4ffc7e33530967a-01'], 'x-dt-tracestate': ['9651e1a8-19506b7c@dt']}

dt.tracing.custom_link.type MUST be one of the following:

Value
Description
generic
The dt.tracing.custom_link.original_bytes have no special meaning.
ibm_mq
The dt.tracing.custom_link.original_bytes are an IBM MQ custom link.
ibm_mq_ignore_qname
The dt.tracing.custom_link.original_bytes are an IBM MQ custom link, but the qname part should be ignored in mapping.

dt.tracing.link.direction MUST be one of the following:

Value
Description
incoming
Indicates that the link represents an incoming call (the child in a parent-child relationship).
outgoing
Indicates that the link represents an outgoing call (the parent in a parent-child relationship).

Elasticsearch

Fields

Attribute
Type
Description
Examples
elasticsearch.cluster.name
string
experimental
elasticsearch.node.name
string
experimental

Endpoint

Endpoints define the public interface of services.

Fields

Attribute
Type
Description
Examples
endpoint.name
string
stable
The endpoint name is derived from endpoint detection rules and uniquely identifies one endpoint of a particular service. Endpoint names are usually technology specific and should be defined by attributes with low cardinality like http.route or rpc.method. Endpoints are exclusively detected on request root spans.
/; /get-cart; /productpage; Reviews.GetReviews

Entity fields

Fields that describe entities.

Attribute
Type
Description
Examples
entity.conditional_name
string
stable
The entity name as defined by conditional naming rules. This name will be calculated based on a rules on the cluster side.
Cl-Prod1 Ser-1
entity.customized_name
string
stable
The entity name as defined in the entity settings screen. This name is statically defined by the user for a particular entity.
Host 1234
entity.detected_name
string
stable
The entity name as detected by Dynatrace or defined by the data source of the entity. Depending on the entity type this can involve different heuristics.
ip-10-100-200-5.eu-west-1.compute.internal
entity.name
string
stable
All entities have an entity.name field. The following fields will be considered in order to determine the value: entity.customized_name, entity.conditional_name, entity.detected_name.
easyTravel
entity.type
string
stable
The entity type
host; service

Equinox

Fields

Attribute
Type
Description
Examples
equinox.config.path
string
experimental

ESB

Fields

Attribute
Type
Description
Examples
esb.application.name
string
experimental
The name of the application that holds the workflows of the business logic.
myBusinessApp; YourServiceApp; any_work
esb.library.name
string
experimental
The name of the library that hosts commonly used workflows to be re-used in applications.
myWebServicesLib; YourMessagingLibrary; any_tools
esb.vendor
string
experimental
The vendor of the ESB technology used.
ibm; tibco
esb.workflow.name
string
experimental
The name of the workflow, aka. the message flow for the IBM ESB.
myMessageFlow; YourBusinessWorkflow; any_flow

Event

The event namespace contains common identification, categorization and context on events in Dynatrace.

Fields

Attribute
Type
Description
Examples
event.category
string
stable
Standard categorization based on the significance of an event (similar to the severity level in the previous Dynatrace).
Availability
event.description
string
stable
Human-readable description of an event.
The current response time (11 s) exceeds the auto-detected baseline (767 ms) by 1,336 %
event.end
string
stable
The event end timestamp in UTC (given in Grail preferred Linux timestamp nano precision format).
16481073970000
event.group_label
string
experimental
Group label of an event.
Availability
event.id
string
stable
Unique identifier string of an event, is stable across multiple refreshes and updates.
5547782627070661074_1647601320000
event.kind
string
stable
Gives high-level information about what kind of information the event contains without being specific to the contents of the event. It helps to determine the record type of a raw event.
Tags: permission
INFRASTRUCTURE_EVENT; DAVIS_EVENT; BIZ_EVENT; RUM_EVENT; AUDIT_EVENT; BILLING_USAGE_EVENT
event.name
string
stable
The human readable display name of an event type.
Process crashed; CPU Saturation
event.original_content
string
experimental
The original raw data of the event as received from the source.
{"severity_id": 3,"state_id": 1,"time": "2024-06-26T07:15:06.139000Z","state": "New","type_uid": 200101}
event.outcome
string
stable
Denotes whether the event represents a success or a failure from the perspective of the entity that produced the event (e.g. an HTTP response code).
200; success; failure
event.parent_id
string
experimental
Unique identifier string of a parent event to link parent and child events.
5547782627070661074_1647601319999
event.provider
string
stable
Source of the event, for example, the name of the component or system that generated the event.
Tags: permission
OneAgent; K8S; Davis; VMWare; GCP; AWS; LIMA_USAGE_STREAM
event.reason
string
stable
Describes why a certain event.outcome was set, typically this is some form of error description in case if a failure
user is missing permission "logs.read"
event.start
string
stable
The event start timestamp in UTC (given in Grail preferred Linux timestamp nano precision format).
16481073970000
event.status
string
stable
Status of an event as being either Active or Closed.
Active
event.status_transition
string
experimental
An enum that shows the transition of the above event state.
Recovered
event.type
string
stable
The unique type identifier of a given event.
Tags: permission
ESXI_HOST_MEMORY_SATURATION; PROCESS_RESTART; CPU_SATURATION; MEMORY_SATURATION; Automation Workflow; AppEngine Functions - Small
event.version
string
stable
Describes the version of the event.
1.0.0

Values

Values are either in title-case or screaming snake case.

event.category SHOULD be one of the following:

Value
Description
Availability
availability
Error
error
Slowdown
slowdown
Resource contention
resource_contention
Warning
warning
Info
info
Vulnerability management
vulnerability_management

event.status SHOULD be one of the following:

Value
Description
Active
active
Closed
closed

event.status_transition SHOULD be one of the following:

Value
Description
Created
created
Updated
updated
Refreshed
refreshed
Resolved
resolved
Recovered
recovered
Closed
closed
Timed out
timed out
Reopened
reopened

Exception

Fields

Attribute
Type
Description
Examples
exception.caused_by_id
uid
experimental
The exception.id of the exception the current exception was caused by.
exception.column_number
long
experimental
The column number where the exception happened.
12304
exception.escaped
boolean
experimental
true indicates that the exception was recorded at a point where it is known that the exception escaped the scope of the span.
exception.file.domain
string
experimental
The URI domain component extracted out of exception.file.full.
www.foo.bar
exception.file.full
string
experimental
The full file location available when the exception happened. Can be an absolute URL or just the name of the file.
https://www.foo.bar/path/main.js; main.js
exception.file.path
string
experimental
The URI path component extracted out of exception.file.full.
/path/main.js
exception.id
uid
experimental
The identifier of an exception, it should be unique within a list of exceptions. The identifier is used to reference the exception.
exception.is_caused_by_root
boolean
experimental
Is set to true if the exception is first exception of a caused by chain.
exception.line_number
long
experimental
The line number where the exception happened.
1401
exception.message
string
experimental
The exception message.
Division by zero
exception.stack_trace
string
experimental
The stack trace of the exception. The format depends on the technology and source. While OneAgent formats stack traces to unify them across technologies, are stack traces from an OpenTelemetry source in the format they were sent to Dynatrace.
@https://www.foo.bar/path/main.js:59:26 e@https://www.foo.bar/path/lib/1.1/lib.js:2:30315
exception.type
string
experimental
The type of the exception (its fully-qualified class name, if applicable).
java.net.ConnectException; OSError

Function as a Service (FaaS)

Fields that can be expected from serverless functions or Function as a Service (FaaS) on various cloud platforms.

Fields

Resource attributes

Attribute
Type
Description
Examples
faas.max_memory
long
experimental
The amount of memory available to the serverless function in Bytes.
faas.name
string
experimental
The name of the single function that this runtime instance executes. 1
my-function; myazurefunctionapp/some-function-name; test_function
faas.version
string
experimental
The immutable version of the function being executed. 2
14; 254
1

This is the name of the function as configured/deployed on the FaaS platform and is usually different from the name of the callback function (which may be stored in the code.namespace/code.function span attributes).

2

Value of the field depends on a cloud provider. This field is not set for Azure.

Span attributes

Attribute
Type
Description
Examples
faas.coldstart
boolean
experimental
A boolean that is true if the serverless function is executed for the first time (aka cold-start).
faas.invoked_name
string
experimental
The name of the invoked function.
my-function
faas.invoked_provider
string
experimental
The cloud provider of the invoked function. Will be equal to the cloud.provider resource attribute of the invoked function.
alibaba_cloud
faas.invoked_region
string
experimental
The cloud region of the invoked function. 1
eu-central-1
faas.trigger
string
experimental
Type of the trigger which caused this function invocation.
datasource
1

Will be equal to the cloud.region resource attribute of the invoked function.

faas.invoked_provider has the following list of well-known values. If one of them applies, then the respective value MUST be used, otherwise a custom value MAY be used.

Value
Description
alibaba_cloud
Alibaba Cloud
aws
Amazon Web Services
azure
Microsoft Azure
gcp
Google Cloud Platform
tencent_cloud
Tencent Cloud

faas.trigger MUST be one of the following:

Value
Description
datasource
A response to some data source operation such as a database or filesystem read/write.
http
To provide an answer to an inbound HTTP request
other
If none of the others apply
pubsub
A function is set to be executed when messages are sent to a messaging system.
timer
A function is scheduled to be executed regularly.

Feature Flag

Attribute
Type
Description
Examples
feature_flag.key
string
experimental
The unique identifier of the feature flag.
logo-color
feature_flag.provider_name
string
experimental
The name of the service provider that performs the flag evaluation.
Flag Manager
feature_flag.variant
string
experimental
SHOULD be a semantic identifier for a value. If one is unavailable, a stringified version of the value can be used. 1
red; true; on
1

A semantic identifier, commonly referred to as a variant, provides a means for referring to a value without including the value itself. This can provide additional context for understanding the meaning behind a value. For example, the variant red maybe be used for the value #c05543.

A stringified version of the value can be used in situations where a semantic identifier is unavailable. String representation of the value should be determined by the implementer.

Google Cloud Platform

Fields

Attribute
Type
Description
Examples
gcp.app_engine.instance
string
experimental
gcp.app_engine.service
string
experimental
gcp.cloud_run.service
string
experimental
gcp.instance.id
string
experimental
A permanent identifier that is unique within your Google Cloud project.
6639848141313102286
gcp.instance.name
string
experimental
The name to display for the instance in the Cloud Console.
single-vm-test
gcp.location
string
experimental
Region or zone the instance of the GCP resource is running on.
europe-west3-c
gcp.project.id
string
experimental
The identifier of the GCP project associated with this resource.
Tags: permission
dynatrace-gcp-extension
gcp.region
string
experimental
A region is a specific geographical location where you can host your resources.
europe-west3
gcp.resource.name
string
experimental
The globally unique resource name in Google Cloud Platform convention
//cloudfunctions.googleapis.com/projects/gcp-example-project/locations/us-central1/functions/examplefunction
gcp.resource.type
string
experimental
The name of a resource type.
cloudsql_database
gcp.zone
string
experimental
A zone is a subset of a region. Each region has three or more zones.
europe-west3-c

Geolocation

The geo namespace contains geo location information. This section only holds all currently agreed upon fields in the Dynatrace Semantic Dictionary. Aligned closely to the ECS, with some adaptions around field groupings

Fields

Attribute
Type
Description
Examples
geo.city.name
string
stable
English name of the city.
Montreal
geo.continent.name
string
stable
English name of the continent.
North America
geo.country.name
string
stable
English name of the country.
Canada
geo.region.name
string
stable
English name of the region.
Quebec

Glassfish

Fields

Attribute
Type
Description
Examples
glassfish.domain.name
string
experimental
The name of the domain this instance belongs to.
glassfish.instance.name
string
experimental
The instance's name.

Go

Fields

Attribute
Type
Description
Examples
go.linkage
string
experimental

Host

Fields describing a host.

Host naming

Dynatrace aims to use the best fitting name for the field host.name. See below, how Dynatrace determines the host name in an ordered by precedence fashion:

1. Customized host name

Dynatrace supports customizing the host.name property. A custom set host name takes precedence over the auto detection mechanisms described further down.

  • Place a configuration file containing the desired name in a specific directory as described in this Documentation
  • Alternatively, the oneagentctl tool can be used to set a custom host name. See Documentation for details.

2. Cloud vendor metadata

If no customized name is set locally, the OneAgent attempts to determine the host.name value by accessing cloud metadata where applicable.

3a. Linux & AIX

  • The result of the system call to the standard C library's gethostname() if it can be interpreted as a fully qualified domain name (FQDN) and doesn't contain "localhost".
  • Otherwise, a system call to getaddrinfo() for port 80 is issued, again sanity checking whether the returned name is an FQDN and doesn't contain "localhost".

3b. Windows

  • On Windows, the system call GetComputerNameExA is used to determine a host's name. In particular, the resulting name is composed of <hostname>.<domainname> with the following details
    • hostname = ComputerNameDnsHostname retrieved by GetComputerNameEx
    • domainname = ComputerNameDnsDomain retrieved by GetComputerNameEx
  • Defaults to the string EmptyHostName if neither property can be resolved.

Fields

Attribute
Type
Description
Examples
host.fqdn
string[]
experimental
A list of FQDNs of this host
[ec2-43-213-176-3.compute-1.amazonaws.com, localhost.example.com]
host.ip
ipAddress[]
experimental
A list of IP adresses (IPv4 or IPv6) of this host.
[194.232.104.141, 2a01:468:1000:9::140]
host.name
string
experimental
The host name as determined on the data source (e.g. OneAgent, extensions, OpenTelemetry, …).
Important: This is not the name of the host entity, which can be modified based on naming rules.
Tags: permission
ip-10-178-54-32.ec2.internal

HTTP

Attribute
Type
Description
Examples
http.request.body.size
long
experimental
The size of the request payload body in bytes. This is the number of bytes transferred excluding headers and is often, but not always, present as the Content-Length header. For requests using transport encoding, this should be the compressed size.
3495
http.request.header.__key__
string
experimental
HTTP request headers, __key__ being the lowercase HTTP header name, e.g. "http.request.header.accept-encoding". The value is a string. If there are multiple headers with the same name or multiple header values, the values will be comma separated into a single string.
Tags: sensitive-spans
https://www.foo.bar/; gzip, deflate, br; 1.2.3.4, 1.2.3.5
http.request.method
string
experimental
HTTP request method.
GET; POST; HEAD
http.request.parameter.__key__
string
experimental
HTTP request parameters, __key__ for example, "http.request.parameter.username". The value is a string. If there are multiple parameters with the same name or multiple parameter values, the values will be a single, comma-separated string.
admin; premium
http.response.body.size
long
experimental
The size of the response payload body in bytes. This is the number of bytes transferred excluding headers and is often, but not always, present as the Content-Length header. For requests using transport encoding, this should be the compressed size.
3495
http.response.header.__key__
string
experimental
HTTP response headers, __key__ being the lowercase HTTP header name, e.g. "http.response.header.content-type". The value is a string. If there are multiple headers with the same name or multiple header values, the values will be comma separated into a single string.
909; text/html; charset=utf-8; abc, def
http.response.reason_phrase
string
experimental
The HTTP reason phrase (HTTP1 only).
Not found
http.response.status_code
long
200
http.route
string
experimental
The matched route (path template in the format used by the respective server framework).
/users/:userID?; Home/Index/{id?}
Attribute
Type
Description
Examples
http.server_name
string
experimental
The server name as configured by the webserver if available. If no such name exists the local hostname and bound port. In Kubernetes the base pod name is used.
MyServer; localhost:8000

Hybris

Fields

Attribute
Type
Description
Examples
hybris.bin.dir
string
experimental
/opt/hybris-60/hybris/bin
hybris.config.dir
string
experimental
/opt/hybris-60/hybris/config
hybris.data.dir
string
experimental
/opt/hybris-60/hybris/data

Reference

IBM

Fields

Attribute
Type
Description
Examples
ibm.ace.integration_node.name
string
experimental
The name of the integration node (aka. broker) that manages one or more integration server.
myIntegrationNode; YourBroker; the_management_instance
ibm.ace.integration_server.name
string
experimental
The name of the either broker-managed or standalone integration server (formerly known as execution group or dataflow engine).
myIntegrationServer; YourExecutionGroup; dataflow_engine
ibm.cics.aor
string
experimental
ibm.cics.program
string
experimental
The name of the CICS program.
EDUCHAN
ibm.cics.region
string
experimental
ibm.cics.tor
string
experimental
ibm.ctg.name
string
experimental
ibm.ims.connect
string
experimental
ibm.ims.control
string
experimental
ibm.ims.mpr
string
experimental
ibm.ims.soap_gw.name
string
experimental

Iis

Fields

Attribute
Type
Description
Examples
iis.app_pool.name
string
experimental
iis.role.name
string
experimental

Java

Fields

Attribute
Type
Description
Examples
java.jar.file
string
experimental
java.jar.path
string
experimental
java.main.class
string
experimental
java.main.module
string
experimental

JBoss

Fields

Attribute
Type
Description
Examples
jboss.home
string
experimental
The instance's home directory.
jboss.mode
string
experimental
The instance's operating mode.
org.jboss.as.standalone; org.jboss.as.server
jboss.server.name
string
experimental
The instance's server name.

JDBC

Fields

Attribute
Type
Description
Examples
jdbc.connection.pool.name
string
stable
The name of the JDBC connection pool.
jdbc/db2

Journald

Fields

Attribute
Type
Description
Examples
journald.unit
string
experimental
A unit is a systemd object that performs or controls a particular task or action; concerns unix-based systems
cron.service; oneagent.service; kubepods.slice

Kubernetes

Fields

Attribute
Type
Description
Examples
k8s.cluster.name
string
stable
(Optional) The name of the cluster in Dynatrace. Doesn't need to be unique, nor immutable.
Tags: permission
unguard-dev; k3s-oneagent
k8s.cluster.uid
string
stable
A pseudo-ID for the cluster, set to the UID of the kube-system namespace.
1c7a24c7-ff51-46e0-bcc9-c52637ceec57
k8s.container.name
string
stable
The name of the Container from Pod specification, must be unique within a Pod. Container runtime usually uses different globally unique name (container.name).
redis
k8s.namespace.name
string
stable
The name of the namespace that the pod is running in.
Tags: permission
default
k8s.node.name
string
stable
The name of the Node.
cluster-pool-1-c3c7423d-azth
k8s.pod.name
string
stable
The name of the Pod.
opentelemetry-pod-autoconf
k8s.pod.uid
string
stable
The UID of the Pod.
275ecb36-5aa8-4c2a-9c47-d8bb681b9aff
k8s.service.name
string
stable
The name of the Kubernetes Service.
my-service
k8s.workload.kind
string
stable
The type of the Workload.
deployment; statefulset; cronjob; job; daemonset; replicaset
k8s.workload.name
string
stable
The name of the Workload.
checkoutservice

Standard fields used for log events

Fields relevant for log events

Fields

Attribute
Type
Description
Examples
log.file.name
string
experimental
The basename of the file.
messages; agent.log
log.file.path
string
experimental
The full path to the file.
/var/log/messages; /var/log/dynatrace/agent.log
log.iostream
string
stable
The I/O stream to which the log was emitted.
stdout; stderr
log.source
string
stable
Human readable attribute which allows to identify log stream. 1
Tags: permission
/var/log/messages; Windows Event Log; Docker Container Output; stdout
log.source.origin
string
stable
The log source origin indicates where the log derives from.
CUSTOM; IIS_LOG_DETECTOR
loglevel
string
stable
The log event severity level.
ERROR; INFO; TRACE
1

Can contain e.g. a file path, standard output, an URI etc., depending on log stream type. The value should be stable for one logical source, so e.g. not affected by log file rotation digits.

log.iostream MUST be one of the following:

Value
Description
stderr
std_err
stdout
std_out

log.source.origin MUST be one of the following:

Value
Description
CONTAINER_LOG_DETECTOR
Container log detector.
CUSTOM_LOG
Custom log source configuration.
IIS_LOG_DETECTOR
IIS log detector.
JOURNALD_LOG_DETECTOR
Journald log detector.
OPEN_LOG_DETECTOR
Open log file detector.
SYSTEM_LOG_DETECTOR
System log detector.

loglevel MUST be one of the following:

Value
Description
ALERT
alert
CRITICAL
critical
DEBUG
debug
EMERGENCY
emergency
ERROR
error
FATAL
fatal
INFO
info
NONE
none
NOTICE
notice
SEVERE
severe
TRACE
trace
WARN
warn

Messaging

Fields

Attribute
Type
Description
Examples
messaging.destination.kind
string
experimental
The kind of message destination
queue; topic
messaging.destination.manager_name
string
experimental
The destination's manager name 1
MyBroker
messaging.destination.name
string
experimental
The message destination name 2
MyQueue; MyTopic
messaging.destination.temporary
boolean
experimental
A boolean that is true if the message destination is temporary and might not exist anymore after messages are processed.
messaging.message.body.size
long
experimental
The (uncompressed) size of the message payload in bytes.
2738
messaging.message.conversation_id
string
experimental
The conversation ID identifying the conversation to which the message belongs, represented as a string. Sometimes called "Correlation ID".
MyConversationId
messaging.message.id
string
experimental
A value used by the messaging system as an identifier for the message, represented as a string.
452a7c7c7c7048c2f887f61572b18fc2
messaging.operation.type
string
experimental
A string identifying the kind of messaging operation. 3
peek
messaging.source.kind
string
experimental
The kind of message source
queue; topic
messaging.source.manager_name
string
experimental
The source's manager name 4
MyBroker
messaging.source.name
string
experimental
The message source name 5
MyQueue; MyTopic
messaging.source.temporary
boolean
experimental
A boolean that is true if the message source is temporary and might not exist anymore after messages are processed.
messaging.system
string
experimental
An identifier for the messaging system. See below for a list of well-known identifiers.
kafka; rabbitmq
1

Manager name SHOULD uniquely identify the broker.

2

Destination name SHOULD uniquely identify a specific queue, topic or other entity within the broker.

3

If a custom value is used for messaging.operation.type, it MUST be of low cardinality.

4

Manager name SHOULD uniquely identify the broker.

5

Source name SHOULD uniquely identify a specific queue, topic, or other entity within the broker.

messaging.destination.kind MUST be one of the following:

Value
Description
queue
A message sent to a queue
topic
A message sent to a topic

messaging.operation.type has the following list of well-known values. If one of them applies, then the respective value MUST be used, otherwise a custom value MAY be used.

Value
Description
peek
A message is received from a destination by a message consumer/server, but left there.
process
A message that was previously received from a destination is processed by a message consumer/server.
publish
A message is sent to a destination by a message producer/client.
receive
A message is received from a destination by a message consumer/server.

messaging.source.kind MUST be one of the following:

Value
Description
queue
A message received from a queue
topic
A message received from a topic

messaging.system has the following list of well-known values. If one of them applies, then the respective value MUST be used, otherwise a custom value MAY be used.

Value
Description
activemq
ActiveMQ
artemis
ActiveMQ Artemis
aws_eventbridge
Amazon EventBridge
aws_sns
Amazon Simple Notification Service (SNS)
aws_sqs
Amazon Simple Queue Service (SQS)
azure_eventgrid
Azure Event Grid
azure_eventhubs
Azure Event Hubs
azure_servicebus
Azure Service Bus
gcp_pubsub
Google Cloud Pub/Sub
hornetq
HornetQ
jms
Java Message Service
kafka
Apache Kafka
mqseries
IBM MQ
msmq
MSMQ
rabbitmq
RabbitMQ
rocketmq
Apache RocketMQ
sag_webmethods_is
Software AG, webMethods Integration Server
tibco_ems
Tibco EMS
weblogic
Oracle WebLogic
websphere
IBM WebSphere Application Server

Akka Messaging

Attribute
Type
Description
Examples
messaging.akka.actor.kind
string
experimental
Name of the top level actor. See The Akka actor hierarchy
system; user
messaging.akka.actor.path
string
experimental
Path to actor inside actor system.
/system/log1-Logging$DefaultLogger; /remote/akka.tcp/RequesterSystem@localhost:52133/user/requestActor/$a
messaging.akka.actor.system
string
experimental
Name of the actor system.
RequesterSystem; ResponseSystem
messaging.akka.actor.type
string
experimental
Fully qualified type name of actor.
com.acme.RespondingActor
messaging.akka.message.type
string
experimental
Fully qualified type name of the message.
java.lang.String; akka.event.Logging$Info2; com.acme.twosuds.ResponseActor$RequestMessage

Module Insights

In webserver technologies a multitude of modules might be contributing to handling a single web request. Module insights provides timings for these, where available.

Fields

Attribute
Type
Description
Examples
module_insights.modules
record
experimental
Modules executed as part of this web request, represented as map from module name to duration in nanoseconds spent.
{'HttpRedirectionModule': 10299, 'BasicAuthenticationModule': 4665}

Network

These attributes may be used for any network related operation.

Fields

Attribute
Type
Description
Examples
network.carrier.name
string
experimental
Name of the mobile carrier.
Magenta; AT&T
network.connection.subtype
string
experimental
Details connection.type, like cellular or wifi technology.
lte; 802.11x
network.connection.type
string
experimental
Internet connection type.
cell; wifi
network.protocol.name
string
experimental
OSI Application Layer or non-OSI equivalent.
amqp; http; mqtt
network.protocol.version
string
experimental
Version of the application layer protocol used.
1.1; 3.1.1
network.transport
string
tcp; udp
network.type
string
experimental
OSI Network Layer or non-OSI equivalent.
ipv4; ipv6

network.connection.type has the following list of well-known values. If one of them applies, then the respective value MUST be used, otherwise a custom value MAY be used.

Value
Description
cell
cell
unavailable
unavailable
unknown
unknown
wifi
wifi
wired
wired

network.transport has the following list of well-known values. If one of them applies, then the respective value MUST be used, otherwise a custom value MAY be used.

Value
Description
inproc
In-process communication. 1
other
Something else (non IP-based).
pipe
Named or anonymous pipe.
tcp
TCP
udp
UDP
unix
Unix domain socket.
1

Signals that there is only in-process communication not using a "real" network protocol in cases where network attributes would normally be expected. Usually all other network attributes can be left out in that case.

network.type has the following list of well-known values. If one of them applies, then the respective value MUST be used, otherwise a custom value MAY be used.

Value
Description
ipv4
IPv4
ipv6
IPv6

Network device

Fields that are used in extensions to describe network devices.

Fields

Attribute
Type
Description
Examples
device
string
deprecated
Used in Extension Framework 2.0

Address (IP address with port) used by a monitored device to communicate with an extension.
10.102.0.45:161
device.address
ipAddress
deprecated
Used in Extension Framework 2.0

IP address used by a monitored device to communicate with an extension.
10.102.0.45
device.name
string
deprecated
Used in Extension Framework 2.0

Name of a device monitored by an extension.
AT1i-WLC-TestingLab.dynatrace.org
device.port
string
deprecated
Used in Extension Framework 2.0

Port used by a monitored device to communicate with an extension.
161

Nodejs

Fields

Attribute
Type
Description
Examples
nodejs.app.base.dir
string
experimental
nodejs.app.name
string
experimental
nodejs.script.name
string
experimental

Openstack

Fields that can come from applications running on Openstack.

Fields

Resource attributes

Attribute
Type
Description
Examples
openstack.availability_zone
string
experimental
A specific availability zone in given openstack region.
us-east-1a
openstack.instance_uuid
string
experimental
UUID of specific openstack instance.
6790cb48-f8e9-4773-bcea-001469de0599

Origin

The origin of a request associated with this event.

Attribute
Type
Description
Examples
origin.address
string
experimental
Source IP address of the request associated with this event if not of 'LOCAL' type.
10.11.12.13
origin.session
string
experimental
The id of the browser session (if present) associated with the event.
node0hfznc
origin.type
string
experimental
Origin type of the request associated with this event.
REST; LOCAL
origin.x_forwarded_for
string
experimental
The verbatim value of the X-Forwarded-For HTTP request header (if present) of the request associated with the event.
1.2.3.4

origin.type MUST be one of the following:

Value
Description
LOCAL
The event provider issued the request locally.
REST
The event provider received an external REST API call.

OS

The os namespace contains information on the operating system running an application.

Fields

Attribute
Type
Description
Examples
os.name
string
stable
Human readable operating system name.
iOS
os.version
string
stable
Version of the operating system.
15.3.1

OpenTelemetry scope

Fields

Attribute
Type
Description
Examples
otel.scope.name
string
experimental
The name of the instrumentation scope - (InstrumentationScope.Name in OTLP).
io.opentelemetry.contrib.mongodb
otel.scope.version
string
experimental
The version of the instrumentation scope - (InstrumentationScope.Version in OTLP).
1.0.0

Php

Fields

Attribute
Type
Description
Examples
php.cli.script.path
string
experimental
php.cli.working.dir
string
experimental
php.drupal.application.name
string
experimental
php.fpm.pool.name
string
experimental
php.symfony.application.name
string
experimental
php.wordpress.blog.name
string

Process

Fields

Attribute
Type
Description
Examples
process.executable.name
string
experimental
The name of the process executable. On Linux based systems, can be set to the Name in proc/[pid]/status. On Windows, can be set to the base name of GetProcessImageFileNameW.
otelcol
process.executable.path
string
experimental
The full path to the process executable. On Linux based systems, can be set to the target of proc/[pid]/exe. On Windows, can be set to the result of GetProcessImageFileNameW.
/usr/bin/cmd/otelcol
process.pid
long
experimental
Process Identifier (PID) as observed by the monitored process.
1234

Request

Fields

Attribute
Type
Description
Examples
request.id
uid
experimental
Present on every span of a request. All spans within one request share the same identifier. The ID is a hex-encoded numerical value and not globally unique, but guaranteed to be unique within one particular trace.
95efd70fcdb5b7b3; 96835e1d65490b48
request.is_failed
boolean
experimental
Indicates that the request is considered failed according to the failure detection rules. Only present on the request root span.
request.is_root_span
boolean
experimental
Marks the root of a request. This means the first span that is the start of the request within a service.

Request Attributes

Request scoped attributes (e.g. method parameters, return values, class names, …) captured by the OneAgent based on a request attribute definition. The actual name of the attribute is the prefix "request_attribute" plus the "request attribute name" defined in the request attributes configuration. Request attributes are built based on captured attributes and other attributes like HTTP header values or "normal" span attributes, on which the aggregations (first/last value, distinct values, ...), type conversion and normalizations defined in the request attribute configuration are performed. They are evaluated for an entire request (possibly consisting of multiple spans) and are stored only on the request root node.

Fields

Attribute
Type
Description
Examples
request_attribute.__attribute_name__
array
experimental
Contains the request scoped reconciled values of the attribute named __attribute_name__ defined by the request attribute configuration. The data type of the value depends on the request attribute definition.
Tags: sensitive-spans
42; Platinum; ['Product A', 'Product B']; ['Special Offer', '1702']

Remote Procedure Calls

Fields

Attribute
Type
Description
Examples
rpc.method
string
experimental
The name of the (logical) method being called 1
exampleMethod
rpc.namespace
string
experimental
The namespace of the method being called. In SOAP, it would be the XML namespace.
tempuri.org
rpc.service
string
experimental
The full (logical) name of the service being called, including its package name, if applicable. 2
myservice.EchoService
rpc.system
string
experimental
A string identifying the remoting system or framework. See below for a list of well-known identifiers.
apache_cxf; dotnet_wcf; grpc; jax_ws
1

This is the logical name of the method from the RPC interface perspective, which can be different from the name of any implementing method/function. The code.function attribute may be used to store the latter (e.g., method actually executing the call on the server side, RPC client stub method on the client side).

2

This is the logical name of the service from the RPC interface perspective, which can be different from the name of any implementing class. The code.namespace attribute may be used to store the latter (despite the attribute name, it may include a class name; e.g., class with method actually executing the call on the server side, RPC client stub class on the client side).

rpc.system has the following list of well-known values. If one of them applies, then the respective value MUST be used, otherwise a custom value MAY be used.

Value
Description
apache_axis
Apache Axis
apache_cxf
Apache CXF
apache_wink
Apache Wink
dotnet_remoting
.NET Remoting
dotnet_wcf
.NET WCF
grpc
gRPC
java_rmi
Java RMI
jax_ws
JAX-WS
jboss
JBoss
jersey
Jersey
openedge
Progress OpenEdge
resteasy
JBoss RESTEasy
restlet
Restlet
spring_ws
Spring Web Services
tibco_ws
Tibco Web Services
weblogic_ws
WebLogic Web Services
webmethods
Webmethods
Attribute
Type
Description
Examples
rpc.grpc.status_code
long
experimental
The numeric status code of the gRPC request.

Server

The server namespace contains information on the responder of a network connection.

Fields

Attribute
Type
Description
Examples
server.address
string
experimental
Logical server hostname, matches server FQDN if available, and IP or socket address if FQDN is not known.
example.com
server.port
long
experimental
Logical server port number.
65123; 80
server.resolved_ips
ipAddress[]
experimental
A list of IP adresses that are the result of DNS resolution of server.address.
[194.232.104.141, 2a01:468:1000:9::140]

Service

Fields

Attribute
Type
Description
Examples
service.name
string
stable
The logical name of the service.
shoppingcart

Servlet

Fields

Attribute
Type
Description
Examples

SNMP

Fields that are used in SNMP extensions.

Fields

Attribute
Type
Description
Examples
trap_oid
string
deprecated
Used in Extension Framework 2.0

The trap OID of a given event.
SNMPv2-MIB::coldStart
version
string
deprecated
Used in Extension Framework 2.0

The SNMP version.
SNMPv3

Softwareag

Fields

Attribute
Type
Description
Examples
softwareag.install.root
string
experimental
softwareag.product.prop.name
string
experimental

Span

Fields

Attribute
Type
Description
Examples
span.alternate_parent_id
uid
experimental
The alternative span.id of this span's parent span. In case a trace is monitored by more tracing systems (e.g. OneAgent + OpenTelemetry) there might be two potential parent spans. If these two spans differ, span.parent_id holds the span.id of the parent which is known to originate from same tenant and this attribute shows the other. The span.alternate_parent_id is a 8-byte id and hex-encoded if shown as a string.
f76281848bd8288c
span.events
record[]
experimental
A collection of events. An event is an optional time-stamped annotation of the span, consisting of a name and key-value pairs.
span.exit_by_exception_id
uid
experimental
The exception.id of the exception the its span.events with the current span exited. The referenced exception has set the attribute exception.escaped to true.
span.id
uid
stable
A unique identifier for a span within a trace. The span.id is a 8-byte id and hex-encoded if shown as a string.
f76281848bd8288c
span.is_exit_by_exception
boolean
experimental
Set to true if the span was exited by an exception. If set to false the span has exception events but the span was not exited by one of them.
span.is_subroutine
boolean
experimental
true indicates that this span is a subroutine of its parent span. The spans represent functions running on the same thread on the same call stack.
span.kind
string
stable
Distinguishes between spans generated in a particular context.
server
span.links
record[]
experimental
A collection of links. A link is a reference from this span to a whole trace or a span in the same or different trace.
span.name
string
experimental
The span name identifies the work represented by the span, for example, the route in an HTTP controller, an RPC method name, a function name, or the name of a subtask or stage within a larger computation.
prepareOrderItemsAndShippingQuoteFromCart; org.example.CheckoutService/PlaceOrder; orders process; GET /products/{product_id}; HTTP POST
span.parent_id
uid
stable
The span.id of this span's parent span. The span.parent_id is a 8-byte id and hex-encoded if shown as a string.
f76281848bd8288c
span.status_code
string
experimental
Defines the status of a span, predominantly used to indicate a processing error. This field is not present if the reported span status is unset.
error
span.status_message
string
experimental
An optional text that can provide a descriptive error message in case the span.status_code is error.
Connection closed before message completed; Error sending request for url
span.timing.cpu
duration
experimental
The overall CPU time spent executing the span including the CPU times of child spans which are running on the same thread on the same call stack.
span.timing.cpu_self
duration
experimental
The CPU time spent exclusively on executing this span not including the CPU times of any children.

span.kind MUST be one of the following:

Value
Description
client
Indicates that the span describes a request to some remote service.
consumer
Indicates that a span describes a child of an asynchronous producer request.
internal
Default Value. Indicates that the span represents an internal operation.
link
Indicates that the span describes a Dynatrace link node.
producer
Indicates that the span describes the initiator of an asynchronous request.
server
Indicates that the span covers server-side handling of a synchronous RPC or other remote request.

span.status_code MUST be one of the following:

Value
Description
error
An error happened while processing the span.
ok
The span was explicitly validated as having completed successfully, despite maybe even containing information about an error.

Span Event

Fields

Attribute
Type
Description
Examples
span_event.name
string
experimental
Some span events have a defined semantics based on the name of the span event.
exception

span_event.name has the following list of well-known values. If one of them applies, then the respective value MUST be used, otherwise a custom value MAY be used.

Value
Description
bizevent
Indicates that the span event represents a business event
exception
Indicates that the span event represents an exception
feature_flag
Indicates that the span event represents a feature flag

Reference

Language Independent Interface Types For OpenTelemetry

Spring

Fields

Attribute
Type
Description
Examples
spring.application.name
string
spring.profile.name
string
experimental
the active profile (last value of spring.profiles.active)
spring.startup.class
string
experimental

Disk extension

Fields

Disk

Attribute
Type
Description
Examples
storage.disk.encrypted
boolean
stable
Is encrypted disk
storage.disk.fstype
string
stable
Type of file system on the disk
ext4; btrfs
storage.disk.kname
string
stable
Kernel name of the disk device. It's also the disk ID in relation to other devices.
sda
storage.disk.model
string
stable
Disk model
baracuda
storage.disk.mountpoint
string
stable
Primary mountpoint
/mnt/disk1
storage.disk.other-mountpoints
string[]
stable
List of other mount points of the disk
[/home/user1/mydisk, /opt/volume1]
storage.disk.path
string
stable
Path to the disk
/dev/sda
storage.disk.read-only
boolean
stable
Is read-only disk
storage.disk.removable
boolean
stable
Is removable disk
storage.disk.serial
string
stable
Disk serial number
1234-56789
storage.disk.type
string
stable
Disk device type
disk; hardware raid
storage.disk.vendor
string
stable
Vendor of the disk
seagate

Partition

Attribute
Type
Description
Examples
storage.partition.encrypted
boolean
stable
Is encrypted partition
storage.partition.fstype
string
stable
Type of file system on the partition
ext4; btrfs
storage.partition.kname
string
stable
Kernel name of the partition device. It's also the partition ID in relation to other devices.
sda1
storage.partition.mountpoint
string
stable
Primary mountpoint
/mnt/diskA
storage.partition.other-mountpoints
string[]
stable
List of other mount points of the partition
[/home/user1/mydiskA, /opt/volumeA]
storage.partition.path
string
stable
Path to the partition
/dev/sda1
storage.partition.read-only
boolean
stable
Is read-only partition
storage.partition.removable
boolean
stable
Is removable partition (true when disk is removable)
storage.partition.type
string
stable
partition device type
partition

Volume

Attribute
Type
Description
Examples
storage.volume.display-name
string
stable
Name of the volume device.
vg0-lv1; vg1-lv2; my-volume
storage.volume.fstype
string
stable
Type of file system on the volume
ext4; btrfs
storage.volume.kname
string
stable
Kernel name of the volume device. It's also the volume ID in relation to other devices.
dm-1; dm-2; dm-5
storage.volume.mountpoint
string
stable
Primary mountpoint
/mnt/diskA
storage.volume.other-mountpoints
string[]
stable
List of other mount points of the software RAID
[/home/user1/mydiskA, /opt/volumeA]
storage.volume.path
string
stable
Path to the volume device
/dev/mapper/vg0-lv1
storage.volume.read-only
boolean
stable
Is read-only volume
storage.volume.removable
boolean
stable
Is removable volume
storage.volume.type
string
stable
volume device type
lvm

Software RAID

Attribute
Type
Description
Examples
storage.software-raid.encrypted
boolean
stable
Is encrypted software RAID
storage.software-raid.fstype
string
stable
Type of file system on the software RAID
ext4; btrfs
storage.software-raid.kname
string
stable
Kernel name of the software RAID device. It's also the software RAID ID in relation to other devices.
md0; md1; md3
storage.software-raid.mountpoint
string
stable
Primary mount point
/mnt/diskA
storage.software-raid.other-mountpoints
string[]
stable
List of other mount points of the software RAID
[/home/user1/mydiskA, /opt/volumeA]
storage.software-raid.parent
string
stable
ID of parent software RAID in which this software RAID is nested
md0
storage.software-raid.path
string
stable
Path to the software RAID device
/dev/md0
storage.software-raid.read-only
boolean
stable
Is read-only software RAID
storage.software-raid.removable
boolean
stable
Is removable software RAID
storage.software-raid.type
string
stable
software RAID device type
raid0, raid10

Supportability

Additional information about the attributes of a data point.

Fields

Attribute
Type
Description
Examples
supportability.alr_sampling_ratio
long
experimental
The denominator of the sampling ratio of the Dynatrace cluster, the attribute is only set if adaptive load redution (ALR) is active on the Dynatrace cluster. A numerator is not specified as it is always 1. If for example the Dynatrace cluster samples with a probability of 1/8 (12,5%) the value of supportability.alr_sampling_ratio would be 8 and the numerator is 1.
8
supportability.atm_sampling_ratio
long
experimental
The denominator of the sampling ratio of an adative traffic management (ATM) aware sampler. The attribute is always present if a ATM aware sampler is active (this applies for example to the Dynatrace OneAgent). A numerator is not specified as it is always 1. If for example the Dynatrace OneAgent samples with a probability of 1/16 (6,25%) the value of supportability.atm_sampling_ratio would be 16 and the numerator is 1.
16
supportability.custom_service.rule_id
uid
experimental
The id of a custom service configuration rule. This field is only present if a custom service was configured as automatic instrumentation rule in Dynatrace.
4d76194c11a9426197a9062548f9e66e
supportability.dropped_attributes_count
long
experimental
The number of attributes that were discarded on the source. Attributes can be discarded because their keys are too long or because there are too many attributes.
1
supportability.dropped_events_count
long
experimental
The number of span events that were discarded on the source.
1
supportability.dropped_http_request_headers_count
long
experimental
The number of http.request.header.__key__ that were discarded.
1
supportability.dropped_http_request_parameters_count
long
experimental
The number of http.request.parameter.__key__ that were discarded.
1
supportability.dropped_links_count
long
experimental
The number of span links that were discarded on the source.
1
supportability.endpoint_name_rule
string
experimental
Name of the pipeline rule that generated the unified service endpoint.name.
http.route; rpc.method
supportability.flaws
string[]
experimental
A string array of one or multiple error codes indicating issues in the assembly of a trace in Dynatrace. Typically, issues come from erroneous (3rd party) instrumentations (e.g. not sending a required field), data loss due to network connectivity (e.g. missing parent span) or conditions implied by the nature of the trace (e.g. trace exceeding the depth limit). The attribute is only present in case an assembly issue was detected (the list will not be empty). For more information and details about specific error codes, please reach out to Dynatrace support.
[C4, S3, A2]
supportability.non_persisted_attribute_keys
string[]
experimental
A string array of attributes keys which where not stored as they where not allow-listed or where removed during the pipeline steps.
["my_span_attribute", "db.name"]
supportability.original_start_time
timestamp
experimental
The original start time of the span. Only available if the value of the start_time attribute was truncated. Truncating the start time is technically required for long running spans that have a start time older than three days in the past.
1649822520123123123
supportability.serverid.addressee
long
experimental
The id of the Dynatrace cluster node this span was addressed to. This is only available if it differs from the value of supportability.serverid.processing.
5
supportability.serverid.processing
long
experimental
The id of the Dynatrace cluster node that received and processed this span.
5

Telemetry

The telemetry.sdk.* fields are used to describe the telemetry SDK in OpenTelemetry or ODIN ingest. It can be considered the closest equivalent of ODIN/OTel data to dt.agent.module.*.

The telemetry.exporter.* fields are used to define the exporter that exports telemetry data and is expected to be different for each exporter in case when multiple exporters co-exist.

Fields

Attribute
Type
Description
Examples
telemetry.exporter.name
string
experimental
The exporter name.
odin
telemetry.exporter.package_version
string
experimental
The version as exposed to the package manager (e.g. npm).
1.285.1
telemetry.exporter.version
string
experimental
The full agent/exporter version.
1.285.1.20240101-256988
telemetry.sdk.language
string
experimental
The programming language/tech of the telemetry SDK.
nodejs; python; java
telemetry.sdk.name
string
experimental
The name of the telemetry SDK.
odin; opentelemetry
telemetry.sdk.version
string
experimental
The version string of the telemetry SDK.
1.20.0

Thread

Fields

Attribute
Type
Description
Examples
thread.id
long
experimental
Current "managed" thread id (as opposed to OS thread id).
42
thread.name
string
experimental
Current thread name.
main
thread.pool.name
string
stable
The name of the thread pool.
WorkerThreadPool

TIBCO Business Works

Fields

Attribute
Type
Description
Examples
tibco.businessworks.app.node.name
string
experimental
tibco.businessworks.app.space.name
string
experimental
tibco.businessworks.domain.name
string
experimental
tibco.businessworks.home
string
experimental
tibco.businessworks.property.file.name
string
experimental
tibco.businessworks.property.file.path
string
experimental
tibco.businessworks_ce.app.name
string
experimental
tibco.businessworks_ce.version
string
experimental

Time correction

The time_correction namespace contains information on time corrections applied to the timestamps of an event, for example, start_time, timestamp or event.end. Time corrections may be necessary if events are reported with timestamps that are completely off compared to cluster time. For example, Dynatrace RUM reported data can be off depending on client time.

Fields

Attribute
Type
Description
Examples
time_correction.is_applied
boolean
experimental
Gives hint if the time correction has already been applied to the timestamps of this event.
false
time_correction.offset
long
experimental
The offset of the original timestamps to the corrected timestamps in nanoseconds (<corrected timestamp> = <original timestamp> + <offset>). May be a negative number. Example: original timestamp: 1670399998423233001, offset: 127927969312, corrected timestamp: 1670400126351202313
127927969312

Trace

Fields

Attribute
Type
Description
Examples
trace.alternate_id
uid
experimental
The preserved trace id when OneAgent and other tracing systems monitor the same process and the trace id from the other tracing system was replaced by the OneAgent trace id. The trace.alternate_id is a 16-byte id and hex-encoded if shown as a string.
357bf70f3c617cb34584b31bd4616af8
trace.id
uid
stable
A unique identifier for a trace. The trace.id is a 16-byte id and hex-encoded if shown as a string.
357bf70f3c617cb34584b31bd4616af8
trace.is_sampled
boolean
experimental
Flag indicating whether the trace was sampled out.
trace.state
string
experimental
The trace state in the w3c-trace-context format.
f4fe05b2-bd92206c@dt=fw4;3;abf102d9;c4592;0;0;0;2ee;5607;2h01;3habf102d9;4h0c4592;5h01;6h5f9a543f1184a52b1b744e383038911c;7h6564df6f55bd6eae,apmvendor=boo,foo=bar

URL

The url namespace contains semantic conventions for URL and its components.

Fields

Attribute
Type
Description
Examples
url.domain
string
experimental
The URI domain component.
www.foo.bar; google.com; wikipedia.org
url.fragment
string
experimental
The URI fragment component.
SemConv
url.full
string
experimental
Absolute URL describing a network resource according to RFC3986.
Tags: sensitive-spans
https://www.foo.bar/docs/search?q=OpenTelemetry#SemConv
url.path
string
experimental
The URI path component.
/docs/search
url.port
long
experimental
The URI port component.
443; 80
url.query
string
experimental
The URI query component.
Tags: sensitive-spans
q=OpenTelemetry
url.scheme
string
experimental
The URI scheme component identifying the used protocol.
https; ftp; telnet
url.truncated_path
string
experimental
Truncated URI path component for endpoint detection of certain technologies that do not provide a http.route. The truncation logic depends on the technology and is a best effort to provide a stable value. Example Adobe Experience Manager (AEM): First two parts of url.path. Truncated value of /content/wknd/us/en/ is /content/wknd.
/docs

User

Representation of a physical or logical user.

Attribute
Type
Description
Examples
user.email
string
stable
E-mail of the user.
user@mail.com
user.id
string
stable
Unique UUID of a human user. If the system itself has to be represented, the constant 'system' is used.
35ba9499-f87c-4047-962c-14dc32e255e5; system
user.name
string
experimental
Full name of the user. If the system itself has to be represented, the constant 'System' is used.
Wolfgang Amadeus Mozart; System
user.organization
string
experimental
Organization the user belongs to.
DYNATRACE; CUSTOMER; PARTNER

user.organization MUST be one of the following:

Value
Description
CUSTOMER
Customer organization
DYNATRACE
Dynatrace organization
PARTNER
Dynatrace partner organization

user.organization MUST be one of the following:

Value
Description
DYNATRACE
Dynatrace organization
CUSTOMER
Customer organization
PARTNER
Dynatrace partner organization

VCS Repository

The vcs namespace contains information about Version Control Systems.

Fields

Attribute
Type
Description
Examples
vcs.repository.change.id
string
experimental
The identifier of the change, for example, pull request ID or merge request ID. It is typically unique per repository and generated by the version control system itself.
1234
vcs.repository.change.title
string
experimental
The human-readable title of the change, for example, pull request title or merge request title.
CA-1234: Fix some stuff; [chore] update dependency
vcs.repository.ref.name
string
experimental
The name of the reference in the repository. This can be a branch name or a tag name.
my-branch-name
vcs.repository.ref.revision
string
experimental
The revision in the repository. For Git this is a synonym for a commit hash, whereas in SVN it is a revision number.
d4322ab6cba38d21ad83c9de304a6a214ecf2cdc; main; 1337
vcs.repository.ref.type
string
experimental
The reference type in the repository.
branch; tag
vcs.repository.url.full
string
experimental
The repository's full URL.
https://github.com/dynatrace-oss/terraform-provider-dynatrace

VMware

Fields that can come from applications running on VMware.

Fields

Resource attributes

Attribute
Type
Description
Examples
vmware.datacenter.name
string
experimental
The name of data center hypervisor is running in.
srvwasapp1Cell01
vmware.disk.name
string
experimental
ESXi Host Disk.
srvwasapp1Cell01
vmware.hypervisor.name
string
experimental
ESXi Host.
my-hypervisor.lab.dynatrace.org
vmware.nic.name
string
experimental
ESXi Host Network Interface.
vmnic0; vmnic1; vmnic2
vmware.vcenter.name
string
experimental
The name of the vCenter server with multi-hypervisor environment.
my-vcenter.lab.dynatrace.org
vmware.vm.name
string
experimental
The name of the virtual machine.
easytravel-demo

Vulnerability

Fields

Attribute
Type
Description
Examples
vulnerability.code_location.name
string
stable
Name of the code location where the code-level vulnerability was detected.
org.dynatrace.profileservice.BioController.markdownToHtml(String):80
vulnerability.cvss.base_score
double
stable
Vulnerability's CVSS base score provided by NVD.
8.1
vulnerability.cvss.version
string
stable
Vulnerability's CVSS score version.
3.1
vulnerability.davis_assessment.assessment_mode
string
stable
Availability of the information based on which the vulnerability assessment has been done.
FULL; NOT_AVAILABLE; REDUCED
vulnerability.davis_assessment.assessment_mode_reasons
string[]
experimental
Reasons for the assessment mode.
[LIMITED_BY_CONFIGURATION, LIMITED_AGENT_SUPPORT]
vulnerability.davis_assessment.data_assets_status
string
stable
Vulnerability's reachability of related data assets by affected entities.
NOT_AVAILABLE; NOT_DETECTED; REACHABLE
vulnerability.davis_assessment.exploit_status
string
stable
Vulnerability's public exploits status.
AVAILABLE; NOT_AVAILABLE
vulnerability.davis_assessment.exposure_status
string
stable
Vulnerability's internet exposure status.
NOT_AVAILABLE; NOT_DETECTED; PUBLIC_NETWORK; ADJACENT_NETWORK
vulnerability.davis_assessment.level
string
stable
Vulnerability's risk level based on Davis Security Score.
LOW; MEDIUM; HIGH; CRITICAL; NONE
vulnerability.davis_assessment.score
double
stable
Vulnerability's Davis Security Score (1-10) calculated by Dynatrace.
8.1
vulnerability.davis_assessment.vulnerable_function_status
string
stable
Usage status of the vulnerable functions causing the vulnerability.
IN_USE; NOT_AVAILABLE; NOT_IN_USE
vulnerability.description
string
stable
Description of the vulnerability.
More detailed description about improper input validation vulnerability.
vulnerability.display_id
string
stable
Dynatrace user-readable identifier for the vulnerability.
S-1234
vulnerability.external_id
string
stable
External provider's unique identifier for the vulnerability.
SNYK-JAVA-ORGAPACHEHTTPCOMPONENTS-30646
vulnerability.external_url
string
stable
External provider's URL to the details page of the vulnerability.
https://example.com
vulnerability.first_seen
timestamp
stable
Timestamp of when the vulnerability was first detected.
2023-03-22T13:19:36.945Z
vulnerability.id
string
stable
Dynatrace unique identifier for the vulnerability.
2039861408676243188
vulnerability.is_fix_available
boolean
experimental
Indicates if a vulnerability fix is available.
vulnerability.mute.change_date
timestamp
stable
Timestamp of the vulnerability's last muted or unmuted action.
2023-03-22T13:19:36.945Z
vulnerability.mute.comment
string
experimental
Comment when muting or unmuting the vulnerability.
Muted because it's a false positive.
vulnerability.mute.reason
string
stable
Reason for muting or unmuting the vulnerability.
FALSE_POSITIVE; IGNORE; AFFECTED; CONFIGURATION_NOT_AFFECTED; OTHER
vulnerability.mute.status
string
stable
Vulnerability's mute status.
MUTED; NOT_MUTED
vulnerability.mute.user
string
stable
User who last changed the vulnerability's mute status.
user@example.com
vulnerability.parent.davis_assessment.assessment_mode
string
stable
Availability of the information based on which the vulnerability assessment has been done.
FULL; NOT_AVAILABLE; REDUCED
vulnerability.parent.davis_assessment.data_assets_status
string
stable
Vulnerability's reachability of related data assets by affected entities.
NOT_AVAILABLE; NOT_DETECTED; REACHABLE
vulnerability.parent.davis_assessment.exposure_status
string
stable
Vulnerability's internet exposure status.
NOT_AVAILABLE; NOT_DETECTED; PUBLIC_NETWORK; ADJACENT_NETWORK
vulnerability.parent.davis_assessment.level
string
stable
Vulnerability's Davis Security Score level.
LOW; MEDIUM; HIGH; CRITICAL; NONE
vulnerability.parent.davis_assessment.score
double
stable
Vulnerability's Davis Security Score (1-10) calculated by Dynatrace.
8.1
vulnerability.parent.davis_assessment.vulnerable_function_status
string
stable
Usage status of vulnerable functions causing the vulnerability. Status is IN_USE when there's at least one vulnerable function in use by an application.
IN_USE; NOT_AVAILABLE; NOT_IN_USE
vulnerability.parent.first_seen
string
stable
Timestamp of when the vulnerability was first detected.
2023-03-22T13:19:36.945Z
vulnerability.parent.mute.change_date
timestamp
stable
Timestamp of the last mute or unmute action of the vulnerability.
2023-03-22T13:19:36.945Z
vulnerability.parent.mute.reason
string
stable
Reason for muting or unmuting the vulnerability.
FALSE_POSITIVE; IGNORE; AFFECTED; CONFIGURATION_NOT_AFFECTED; OTHER
vulnerability.parent.mute.status
string
stable
Vulnerability's mute status.
MUTED; NOT_MUTED
vulnerability.parent.mute.user
string
stable
User who last changed the vulnerability's mute status.
user@example.com
vulnerability.parent.resolution.change_date
string
stable
Timestamp of the vulnerability's last resolution status change.
2023-03-22T13:19:37.466Z
vulnerability.parent.resolution.status
string
stable
Current status of the vulnerability.
OPEN; RESOLVED
vulnerability.parent.risk.level
string
stable
Vulnerability's risk score level defined by the provider. For Dynatrace, the Davis Security Score level.
LOW; MEDIUM; HIGH; CRITICAL; NONE
vulnerability.parent.risk.score
double
stable
Vulnerability's risk score defined by the provider. For Dynatrace, Davis Security Score.
8.1
vulnerability.previous.cvss.base_score
double
stable
Vulnerability's previous CVSS base score (in case the CVSS base score has changed).
8.1
vulnerability.previous.davis_assessment.data_assets_status
string
stable
Vulnerability's previous reachability of related data assets by affected entities (in case the reachability has changed).
NOT_AVAILABLE; NOT_DETECTED; REACHABLE
vulnerability.previous.davis_assessment.exploit_status
string
stable
Vulnerability's previous public exploit status (in case the public exploit status has changed).
AVAILABLE; NOT_AVAILABLE
vulnerability.previous.davis_assessment.exposure_status
string
stable
Vulnerability's previous internet exposure status (in case the internet exposure status has changed).
NOT_AVAILABLE; NOT_DETECTED; PUBLIC_NETWORK; ADJACENT_NETWORK
vulnerability.previous.davis_assessment.level
string
stable
Vulnerability's previous risk level (in case the risk level has changed).
LOW; MEDIUM; HIGH; CRITICAL; NONE
vulnerability.previous.davis_assessment.score
double
stable
Vulnerability's previous Davis Security Score (in case Davis Security Score has changed).
8.1
vulnerability.previous.davis_assessment.vulnerable_function_status
string
stable
Vulnerability's previous vulnerable function status (in case the vulnerable function status has changed).
IN_USE; NOT_AVAILABLE; NOT_IN_USE
vulnerability.previous.mute.change_date
string
stable
Timestamp of the vulnerability's previous mute status (in case the mute status has changed).
2023-03-22T13:19:36.945Z
vulnerability.previous.mute.comment
string
experimental
Comment of the vulnerability's previous mute status.
Muted because it's a false positive.
vulnerability.previous.mute.reason
string
stable
Reason for last muting or unmuting the vulnerability (in case the reason for muting or unmuting the vulnerability has changed).
Muted: False positive
vulnerability.previous.mute.status
string
stable
Vulnerability's previous mute status (in case the mute status has changed).
MUTED; NOT_MUTED
vulnerability.previous.mute.user
string
stable
User who last changed the vulnerability's mute status (in case the mute status was last changed by a different user).
user@example.com
vulnerability.previous.resolution.status
string
stable
Vulnerability's previous resolution status (in case the resolution status has changed).
OPEN; RESOLVED
vulnerability.previous.risk.level
string
stable
Vulnerability's previous risk score level (in case the risk score level has changed).
LOW; MEDIUM; HIGH; CRITICAL
vulnerability.previous.risk.score
double
stable
Vulnerability's previous risk score (in case the risk score has changed).
8.1
vulnerability.references.cve
string[]
stable
List of the vulnerability's CVE IDs.
[CVE-2021-41079]
vulnerability.references.cwe
string[]
stable
List of the vulnerability's CWE IDs.
[CWE-20]
vulnerability.references.owasp
string[]
stable
List of vulnerability's OWASP IDs.
[2021:A3]
vulnerability.remediation.description
string
experimental
Description of the vulnerability's remediation advice.
Upgrade component to version 1.2.3 or higher
vulnerability.resolution.change_date
timestamp
stable
Timestamp of the vulnerability's last resolution status change.
2023-03-22T13:19:37.466Z
vulnerability.resolution.status
string
stable
Vulnerability's resolution status.
OPEN; RESOLVED
vulnerability.risk.level
string
stable
Vulnerability's risk score level defined by the provider. For Dynatrace, the Davis Security Score level.
LOW; MEDIUM; HIGH; CRITICAL; NONE
vulnerability.risk.scale
string
stable
Scale by which the vulnerability's risk score and risk score level defined by the provider are measured.
Davis Security Score
vulnerability.risk.score
double
stable
Vulnerability's risk score defined by the provider. For Dynatrace, Davis Security Score.
8.1
vulnerability.stack
string
experimental
Level of the vulnerable component in the technological stack.
CODE; CODE_LIBRARY; SOFTWARE; CONTAINER_ORCHESTRATION
vulnerability.technology
string
stable
Technology of the vulnerable component.
JAVA; DOTNET; GO; PHP; NODE_JS
vulnerability.title
string
stable
Title of the vulnerability.
Improper Input Validation
vulnerability.type
string
stable
Classification of the vulnerability based on commonly accepted enums, such as CWE.
Improper Input Validation
vulnerability.url
string
stable
Dynatrace URL to the details page of the vulnerability. |
https://example.com

vulnerability.davis_assessment.assessment_mode has the following list of well-known values. If one of them applies, then the respective value MUST be used, otherwise a custom value MAY be used.

Value
Description
FULL
full
NOT_AVAILABLE
not_available
REDUCED
reduced

vulnerability.davis_assessment.data_assets_status has the following list of well-known values. If one of them applies, then the respective value MUST be used, otherwise a custom value MAY be used.

Value
Description
NOT_AVAILABLE
not_available
NOT_DETECTED
not_detected
REACHABLE
reachable

vulnerability.davis_assessment.exploit_status has the following list of well-known values. If one of them applies, then the respective value MUST be used, otherwise a custom value MAY be used.

Value
Description
AVAILABLE
available
NOT_AVAILABLE
not_available

vulnerability.davis_assessment.exposure_status has the following list of well-known values. If one of them applies, then the respective value MUST be used, otherwise a custom value MAY be used.

Value
Description
ADJACENT_NETWORK
adjacent_network
NOT_AVAILABLE
not_available
NOT_DETECTED
not_detected
PUBLIC_NETWORK
public_network

vulnerability.davis_assessment.level has the following list of well-known values. If one of them applies, then the respective value MUST be used, otherwise a custom value MAY be used.

Value
Description
CRITICAL
critical
HIGH
high
LOW
low
MEDIUM
medium
NONE
none

vulnerability.davis_assessment.vulnerable_function_status has the following list of well-known values. If one of them applies, then the respective value MUST be used, otherwise a custom value MAY be used.

Value
Description
IN_USE
in_use
NOT_AVAILABLE
not_available
NOT_IN_USE
not_in_use

vulnerability.mute.reason has the following list of well-known values. If one of them applies, then the respective value MUST be used, otherwise a custom value MAY be used.

Value
Description
AFFECTED
affected
CONFIGURATION_NOT_AFFECTED
configuration_not_affected
FALSE_POSITIVE
false_positive
IGNORE
ignore
OTHER
other

vulnerability.mute.status has the following list of well-known values. If one of them applies, then the respective value MUST be used, otherwise a custom value MAY be used.

Value
Description
MUTED
muted
NOT_MUTED
not_muted

vulnerability.parent.davis_assessment.assessment_mode has the following list of well-known values. If one of them applies, then the respective value MUST be used, otherwise a custom value MAY be used.

Value
Description
FULL
full
NOT_AVAILABLE
not_available
REDUCED
reduced

vulnerability.parent.davis_assessment.data_assets_status has the following list of well-known values. If one of them applies, then the respective value MUST be used, otherwise a custom value MAY be used.

Value
Description
NOT_AVAILABLE
not_available
NOT_DETECTED
not_detected
REACHABLE
reachable

vulnerability.parent.davis_assessment.exposure_status has the following list of well-known values. If one of them applies, then the respective value MUST be used, otherwise a custom value MAY be used.

Value
Description
ADJACENT_NETWORK
adjacent_network
NOT_AVAILABLE
not_available
NOT_DETECTED
not_detected
PUBLIC_NETWORK
public_network

vulnerability.parent.davis_assessment.level has the following list of well-known values. If one of them applies, then the respective value MUST be used, otherwise a custom value MAY be used.

Value
Description
CRITICAL
critical
HIGH
high
LOW
low
MEDIUM
medium
NONE
none

vulnerability.parent.davis_assessment.vulnerable_function_status has the following list of well-known values. If one of them applies, then the respective value MUST be used, otherwise a custom value MAY be used.

Value
Description
IN_USE
in_use
NOT_AVAILABLE
not_available
NOT_IN_USE
not_in_use

vulnerability.parent.mute.reason has the following list of well-known values. If one of them applies, then the respective value MUST be used, otherwise a custom value MAY be used.

Value
Description
AFFECTED
affected
CONFIGURATION_NOT_AFFECTED
configuration_not_affected
FALSE_POSITIVE
false_positive
IGNORE
ignore
OTHER
other

vulnerability.parent.mute.status has the following list of well-known values. If one of them applies, then the respective value MUST be used, otherwise a custom value MAY be used.

Value
Description
MUTED
muted
NOT_MUTED
not_muted

vulnerability.parent.resolution.status has the following list of well-known values. If one of them applies, then the respective value MUST be used, otherwise a custom value MAY be used.

Value
Description
OPEN
open
RESOLVED
resolved

vulnerability.parent.risk.level has the following list of well-known values. If one of them applies, then the respective value MUST be used, otherwise a custom value MAY be used.

Value
Description
CRITICAL
critical
HIGH
high
LOW
low
MEDIUM
medium
NONE
none

vulnerability.previous.davis_assessment.data_assets_status has the following list of well-known values. If one of them applies, then the respective value MUST be used, otherwise a custom value MAY be used.

Value
Description
NOT_AVAILABLE
not_available
NOT_DETECTED
not_detected
REACHABLE
reachable

vulnerability.previous.davis_assessment.exploit_status has the following list of well-known values. If one of them applies, then the respective value MUST be used, otherwise a custom value MAY be used.

Value
Description
AVAILABLE
available
NOT_AVAILABLE
not_available

vulnerability.previous.davis_assessment.exposure_status has the following list of well-known values. If one of them applies, then the respective value MUST be used, otherwise a custom value MAY be used.

Value
Description
ADJACENT_NETWORK
adjacent_network
NOT_AVAILABLE
not_available
NOT_DETECTED
not_detected
PUBLIC_NETWORK
public_network

vulnerability.previous.davis_assessment.level has the following list of well-known values. If one of them applies, then the respective value MUST be used, otherwise a custom value MAY be used.

Value
Description
CRITICAL
critical
HIGH
high
LOW
low
MEDIUM
medium
NONE
none

vulnerability.previous.davis_assessment.vulnerable_function_status has the following list of well-known values. If one of them applies, then the respective value MUST be used, otherwise a custom value MAY be used.

Value
Description
IN_USE
in_use
NOT_AVAILABLE
not_available
NOT_IN_USE
not_in_use

vulnerability.previous.mute.status has the following list of well-known values. If one of them applies, then the respective value MUST be used, otherwise a custom value MAY be used.

Value
Description
MUTED
muted
NOT_MUTED
not_muted

vulnerability.previous.resolution.status has the following list of well-known values. If one of them applies, then the respective value MUST be used, otherwise a custom value MAY be used.

Value
Description
OPEN
open
RESOLVED
resolved

vulnerability.previous.risk.level has the following list of well-known values. If one of them applies, then the respective value MUST be used, otherwise a custom value MAY be used.

Value
Description
CRITICAL
critical
HIGH
high
LOW
low
MEDIUM
medium
NONE
none

vulnerability.resolution.status has the following list of well-known values. If one of them applies, then the respective value MUST be used, otherwise a custom value MAY be used.

Value
Description
OPEN
open
RESOLVED
resolved

vulnerability.risk.level has the following list of well-known values. If one of them applies, then the respective value MUST be used, otherwise a custom value MAY be used.

Value
Description
CRITICAL
critical
HIGH
high
LOW
low
MEDIUM
medium
NONE
none

vulnerability.stack has the following list of well-known values. If one of them applies, then the respective value MUST be used, otherwise a custom value MAY be used.

Value
Description
CODE
code
CODE_LIBRARY
code_library
CONTAINER_ORCHESTRATION
container_orchestration
SOFTWARE
software

vulnerability.technology has the following list of well-known values. If one of them applies, then the respective value MUST be used, otherwise a custom value MAY be used.

Value
Description
DOTNET
dotnet
GO
go
JAVA
java
NODE_JS
node_js
PHP
php

WebLogic

Fields

Attribute
Type
Description
Examples
weblogic.cluster.name
string
experimental
The name of the cluster this instance belongs to.
OrderManagement2
weblogic.domain.name
string
experimental
The name of the domain this instance belongs to.
CustomerManagementFulfillmentSvc
weblogic.home
string
experimental
The instance's home directory.
/apps/infra/wls/bin/10.3.6_64/wlserver_10.3/server
weblogic.server.name
string
experimental
The instance's server name.
OrderManagement2Srv1

WebSphere

Fields

Attribute
Type
Description
Examples
websphere.cell.name
string
experimental
The name of the cell this instance belongs to.
srvwasapp1Cell01
websphere.cluster.name
string
experimental
The name of the cluster this instance belongs to.
CluApp1
websphere.node.name
string
experimental
The name of the node this instance belongs to.
nodeSrvApp2
websphere.server.name
string
experimental
The instance's server name.
SrvApp2

WebSphere Liberty

Fields

Attribute
Type
Description
Examples
websphere_liberty.server.name
string
experimental
The instance's server name.
defaultServer

Winlog

Fields

Attribute
Type
Description
Examples
winlog.eventid
long
experimental
Event ID is a unique identifier assigned to each event logged by the system. Each event ID corresponds to a specific type of event, such as an error, warning, or informational message. (4624 -> successful logon, 1000 -> application error)
4624; 1000
winlog.keywords
string
experimental
Keywords are used to categorize and group events. This categorization allows to quickly identify and focus on specific types of events that are relevant to your troubleshooting or monitoring needs.
Classic; Started
winlog.level
string
experimental
Level of an event indicates its severity or importance
Critical; Error; Warrning
winlog.opcode
string
experimental
Opcode is a value that identifies a specific activity or a point within an activity that the application was performing when it raised the event. This helps in understanding the context of the event more precisely.
Info; Download
winlog.provider
string
experimental
Provider is a component or service that generates events. Providers are responsible for writing specific types of events to the event logs, such as application errors, security events, or system warnings.
Avecto Service; Security-SPP
winlog.task
long
experimental
Task refers to the specific operation or activity that an event is associated with. Each event is categorized under a task, which helps in identifying what the system or application was doing when the event was logged. This can be particularly useful for troubleshooting and understanding the context of the event. (5 -> HTTP Configuration Property Trace Task, 12804 -> Other Object Access Events)
5; 12804
winlog.username
string
experimental
Username refers to the account name associated with specific events, such as logon or logoff activities. This is particularly useful for tracking user activity and identifying who was logged into the system at a given time.
SYSTEM; N/A

z/OS

Fields zos resource attributes

Attribute
Type
Description
Examples
zos.address_space_id
long
experimental
The address space identifier (ASID) of the z/OS address space.
1; 296
zos.job_id
string
experimental
The job id of the z/OS address space.
JOB12345
zos.job_name
string
experimental
The jobname of the z/OS address space.
CICSAOR0; CTGATM00; IMSCR15
zos.job_step_id
string
experimental
The step id within the job within the z/OS address space.
00000001; 00000002
zos.lpar_name
string
experimental
The name of the LPAR that the z/OS address space executes within.
S0W1; ABCD
zos.sys_id
string
experimental
The system ID of the CICS/IMS address space.
C259; CICS; IMSF

Fields zos transactions general

Attribute
Type
Description
Examples
zos.transaction.call_type
string
experimental
The type of transaction call that was invoked.
CTG
zos.transaction.id
string
experimental
The ID of this transaction.
CEMT; DTAX; IVTNO
zos.transaction.job_name
string
experimental
The jobname of the z/OS address space that the transaction executed in.
CICSAOR0; CTGATM00; IMSCR15
zos.transaction.lpar_name
string
experimental
The name of the LPAR that the transaction executed on.
S0W1; ABCD
zos.transaction.program_type
string
experimental
The type of transaction that was executed.
DLI_DB; DLI_DC; MQ; DB2

zos.transaction.call_type MUST be one of the following:

Value
Description
CTG
A CTG request triggered this transaction.
DPL
A CICS DPL request triggered this transaction.
HTTP
An HTTP or HTTPS request triggered this transaction.
IMS_CONNECT
An IMS Connect request triggered this transaction.
IMS_CONNECT_API
An IMS Connect API request triggered this transaction.
ITRA
An IMS TM Resource Adapter request triggered this transaction.
MQ
An MQ operation triggered this transaction.
MSC
An IMS MSC request triggered this transaction.
PGM_SWITCH
An IMS Program Switch request triggered this transaction.
SDK
An SDK call triggered this transaction.
SHARED_QUEUE
An IMS Shared Queue request triggered this transaction.
SOAP
A SOAP request triggered this transaction.
START
An EXEC CICS START triggered this transaction.
TTX
A green screen terminal transaction code triggered this transaction.
TX
A CICS or IMS transaction code triggered this transaction.
ZOS_CONNECT
A z/OS Connect request triggered this transaction.

zos.transaction.program_type MUST be one of the following:

Value
Description
DB2
The transaction performs DB2 database actions.
DLI_DB
The transaction performs DLI database actions.
DLI_DC
The transaction performs DLI data communications actions.
MQ
The transaction performs MQ Queue actions.

Fields cics transactions

Attribute
Type
Description
Examples
cics.transaction.class_name
string
experimental
The name of the transaction class of this transaction.
null; DFHTCL00
cics.transaction.client.ip
ipAddress
experimental
IP address of the client (IPv4 or IPv6) that made the request that triggered the transaction.
194.232.104.141; 2a01:468:1000:9::140
cics.transaction.client.port
long
experimental
Port number of the client that made the request that triggered the transaction.
65123; 80
cics.transaction.path.name
string
experimental
The path name, only applicable for web requests.
/dtrouter
cics.transaction.system_id
string
experimental
The system ID of the CICS region that this transaction executed on.
C259; CICS
cics.transaction.task_id
long
experimental
The CICS task ID of this transaction.
1234
cics.transaction.transaction_group_id
string
experimental
The transaction group ID assigned at transaction attach time.
160dd5c5e3c44bc8e5c5c1c3f4f4f9df9fa2d8b049cb800000000000
cics.transaction.unit_of_work_id
long
experimental
The unit of work ID for this transaction, which is normally represented as a hex value.
15977055984148641282; 15977055491352760323
cics.transaction.user_id
string
experimental
The user ID of the user who triggered this transaction.
USER1; anon
cics.transaction.wlm.reporting_service_class_name
string
experimental
The name of the z/OS Workload Manager (WLM) reporting service class of this transaction.
null; BAT_ATM; RC_CICS
cics.transaction.wlm.service_class_name
string
experimental
The name of the z/OS Workload Manager (WLM) service class of this transaction.
null; SYSSTC; VEL15I5

Fields cics files

Attribute
Type
Description
Examples
cics.file.defining_region_name
string
experimental
The system ID of the CICS region that is defined on the request.
C259; CICS
cics.file.is_local
boolean
experimental
A boolean that is true if the file is defined within the CICS region that it executed in.
true
cics.file_name
string
experimental
The logical name of the file, as defined in CEDA.
EXMPCAT; CICSFILE

Fields ims transactions

Attribute
Type
Description
Examples
ims.message.transaction.message.segment_count
long
experimental
The number of segments in the message.
1; 5
ims.message.transaction.message.size
long
experimental
The size of the message.
10; 421
ims.message.transaction.terminal_name
string
experimental
The terminal name that this IMS transaction executed on.
HWSAM5ZD; 10505
ims.message.transaction.unit_of_work_id
long
experimental
The unit of work ID for this transaction, which is normally represented as a hex value.
5981228500318430862871015129591113287966852300630664295044916520394057871645605888; 5981112713529734741010744557477214433959078921583025076794253743298954785382793216
ims.message.transaction.user_id
string
experimental
The user ID of the user who triggered this transaction.
USER1; anon

Fields ims execution transactions

Attribute
Type
Description
Examples
ims.execution.transaction.commit_count
long
experimental
The commit count for this transaction.
4; 5
ims.execution.transaction.current_priority
long
experimental
The current priority of this transaction.
1; 5
ims.execution.transaction.execution_class
long
experimental
The execution class of this transaction.
45; 66
ims.execution.transaction.psb_name
string
experimental
The PSB name that this IMS transaction executed on.
HWSAM5ZD; 10505
ims.execution.transaction.schedule_count
long
experimental
The schedule count for this transaction.
346613; 421
ims.execution.transaction.unit_of_work_id
long
experimental
The unit of work ID for this transaction, which is normally represented as a hex value.
5981228500318430862871015129591113287966852300630664295044916520394057871645605888; 5981112713529734741010744557477214433959078921583025076794253743298954785382793216

Fields ims connect transactions

Attribute
Type
Description
Examples
ims.connect.transaction.client.ip
ipAddress
experimental
IP address of the client (IPv4 or IPv6) that made the request that triggered the transaction.
194.232.104.141; 2a01:468:1000:9::140
ims.connect.transaction.server.port
long
experimental
Port number on the IMS Connect server that received the request for this transaction
65123; 80
ims.connect.transaction.user_id
string
experimental
The user ID of the user who triggered this transaction.
USER1; anon

Fields ims tm resource adapter (ITRA) transactions

Attribute
Type
Description
Examples
ims.tm.resource.adapter.semantic_detection_version
string
experimental
The detection version for this transaction.
1
ims.tm.resource.adapter.transaction.client.ip
ipAddress
experimental
IP address of the client (IPv4 or IPv6) that made the request that triggered the transaction.
194.232.104.141; 2a01:468:1000:9::140
ims.tm.resource.adapter.transaction.client.port
long
experimental
Port number of the client that made the request that triggered the transaction.
65123; 80
ims.tm.resource.adapter.transaction.commit_mode
long
experimental
The commit mode of the transaction.
0
ims.tm.resource.adapter.transaction.datastore_name
string
experimental
The datastore name used by this transaction.
IMS1500
ims.tm.resource.adapter.transaction.interaction_verb
long
experimental
The interaction verb that triggered the transaction.
0
ims.tm.resource.adapter.transaction.lpar_name
string
experimental
The name of the LPAR that the transaction executed on.
S0W1; ABCD
ims.tm.resource.adapter.transaction.sync_level
long
experimental
Indicates the synchronization level of the transaction. This only applies when the interaction verb is set to "SYNC_SEND_RECEIVE", "SYNC_SEND", or "SYNC_RECEIVE_CALLOUT". This attribute applies to both conversational and non-conversational applications. It is used in conjuction with the ims.transaction.request.transaction.commit_mode attribute.
0

ims.tm.resource.adapter.transaction.commit_mode MUST be one of the following:

Value
Description
0
The commit happens before sending the response.
1
The commit is deferred until the response has been sent and acknowledged.

ims.tm.resource.adapter.transaction.interaction_verb MUST be one of the following:

Value
Description
0
SYNC_SEND
1
SYNC_SEND_RECEIVE
3
SYNC_END_CONVERSATION
4
SYNC_RECEIVE_ASYNCOUTPUT
5
SYNC_RECEIVE_ASYNCOUTPUT_SINGLE_NOWAIT
6
SYNC_RECEIVE_ASYNCOUTPUT_SINGLE_WAIT
7
SYNC_RECEIVE_CALLOUT

ims.tm.resource.adapter.transaction.sync_level MUST be one of the following:

Value
Description
0
There will be no synchronization.
1
Synchronization will be confirmed.

z/OS Connect

Fields

Attribute
Type
Description
Examples
zosconnect.api.description
string
experimental
The z/OS Connect API description.
API for the CICS catalog manager sample application
zosconnect.api.name
string
experimental
The z/OS Connect API name.
catalog
zosconnect.api.version
string
experimental
The z/OS Connect API version.
1.0.0
zosconnect.request.body.size
long
experimental
The size of the request payload in bytes.
234
zosconnect.request.id
long
experimental
The z/OS Connect request ID.
2215
zosconnect.request.type
string
experimental
The type of the REST request. 1
ADMIN
zosconnect.response.body.size
long
experimental
The size of the response payload in bytes.
125
zosconnect.service.description
string
experimental
The z/OS Connect service description.
EDUCHAN service using the CICS Service Provider
zosconnect.service.name
string
experimental
The z/OS Connect service name.
placeOrder
zosconnect.service.provider.name
string
experimental
The service provider name.
CICS-1.0
zosconnect.service.version
string
experimental
The z/OS Connect service version.
2.0
zosconnect.sor.identifier
string
experimental
The system of record identifier. The format differs depending on the SOR type. 2
localhost:8080
zosconnect.sor.reference
string
experimental
The system of record reference.
cicsConn
zosconnect.sor.resource
string
experimental
Identifier for the resource invoked on the system of record. The format differs depending on the SOR type. 3
01,DFH0XCMN
zosconnect.sor.type
string
experimental
The system of record type.
CICS

zosconnect.request.type MUST be one of the following:

Value
Description
ADMIN
admin
API
api
SERVICE
service
UNKNOWN
unknown

zosconnect.sor.type MUST be one of the following:

Value
Description
CICS
cics
IMS
ims
MQ
mq
REST
rest
WOLA
wola