Log management and analytics

audit.identity

string

stable
Display name: Audit identity
User name, service account name, or principal name that executes audited action.

name.surname@example.com

audit.status

string

stable
Display name: Audit status
Status of the audited action.

Started; In Progress; Succeeded; Failed; Active; Resolved

authentication.is_multifactor

boolean

experimental
Display name: Is multifactor authentication
Reports whether the executant of the audited action has performed a multi-factor authentication.

event.type

string

stable
Display name: Event type
The unique type identifier of a given event.
Tags: permission

LOG

log.source

string

stable
Display name: Log source
Human-readable attribute that identifies a log stream. ¹
Tags: permission

/var/log/messages; Windows Event Log; Docker Container Output; stdout

status

string

experimental
Display name: Status
Overall significance of log event, derived from log level. Only INFO and NONE values are allowed.

INFO; NONE

result.detail

string

experimental
Display name: Result detail
Further details regarding the result.

The user did not enter the right credentials

client.ip

ipAddress

experimental
Display name: Client IP address
The IP address of the client that makes the request. This can be IPv4 or IPv6.
Tags: sensitive-spans sensitive-user-events

194.232.104.141; 2a01:468:1000:9::140

actor.geo.country.name

string

experimental
Display name: Actor country name
Name of the country from which the actor operates.

Canada

actor.geo.location.lon

string

experimental
Display name: Actor geo longitude
The approximate WGS84 longitude.

-73.614830

browser.version

string

resource stable
Display name: Browser version
The browser version.

Version 142.0.7444.176

device.name

string

experimental
Display name: Device name
The name associated with the device which is used to perform the audited action.

DEVICE-HOFW9324FJN

azure.tenant.name

string

resource experimental
Display name: Azure tenant name
Name assigned to the Azure tenant.

MyAzureTenant

aws.account.name

string

resource experimental
Display name: AWS account name
Name associated with the AWS account.

example.com

gcp.organization.name

string

resource experimental
Display name: GCP organization name
Name assigned to the GCP organization.

dynatrace.com

dt.entity.process_group

string

resource deprecatedThis field is deprecated and will be removed in the future. Use dt.process_group.id or dt.process_group.detected_name instead. Note that there is no entity type PROCESS_GROUP in Smartscape, so dt.process_group.id exists only for compatibility. Preferably use dt.process_group.detected_name to identify process groups.
Display name: Process group
The entity ID of the process group that has emitted the log.
Note that the log module may report multiple values as an array if a file is opened by multiple processes or multiple processes are run in a single container. To prepare queries for such situations, use matchesValue instead of == for equality checks.
Tags: entity-id

PROCESS_GROUP-E0D8F94D9065F24F

dt.source_entity

string[]

resource deprecatedThis field is deprecated and will be removed in the future. Use dt.smartscape_source.id instead.
Display name: Source entity
The entity IDs of the log's source.
Note that the log module may report multiple values as an array if a file is opened by multiple processes or multiple processes are run in a single container. To prepare queries for such situations, use matchesValue instead of == for equality checks. ¹
Tags: entity-id

['PROCESS_GROUP_INSTANCE-22714B95E4BF6AE0', 'PROCESS_GROUP_INSTANCE-D6DD5FF37FBEF0DF']

log.iostream

string

stable
Display name: Log I/O stream
The I/O stream to which the log was emitted.

stdout; stderr

log.source

string

stable
Display name: Log source
Human-readable attribute that identifies a log stream. ²
Tags: permission

/var/log/messages; Windows Event Log; Docker Container Output; stdout

ordinal

long

stable
The field is used to order records produced by a single source. It is monotonically increasing across successive records, but the step between values is unspecified. The field encodes only a local (source‑specific) ordering, not a global one, so it is typically used as a secondary sort key after the timestamp to preserve the original sequence when timestamp resolution is insufficient. Examples include a byte offset within the source file or the __SEQNUM field in systemd‑journald.

1479670

span_id

string

experimental
Display name: Span ID
A unique identifier for a span within a trace. The span_id is an 8-byte id and hex-encoded if shown as a string.

f76281848bd8288c

timestamp

timestamp

stable
Display name: Timestamp
The time (UNIX Epoch time in nanoseconds) when the event originated, typically when the source created it. If no original timestamp is available, it will be populated at ingest time and required for all events. In the case of a correlated event (for example, ITIL events), this time could be different from the event.start time, as this time represents the actual timestamp when the "update" for the event was created.

1649822520123123123