System event models
System events are used to store details about executed queries, auditing events, billing events and more. In order to query system events, you need the storage:system:read
permission.
fetch dt.system.events
Anomaly Detector Status Event
The anomaly detector status events are used for Davis anomaly detection. They track errors and warnings during the execution of an anomaly detector. Examples:
- Query runs into a timeout
- Query fails as unauthorized
- Query result is truncated as the scanned bytes limit was reached
- …
Anomaly detectors status events can be analyzed with the following DQL query:
fetch dt.system.events| filter event.kind == "ANOMALY_DETECTOR_STATUS_EVENT"
client.application_context
A Dynatrace app id
local-dev-mode
; dynatrace.notebooks
; my.biz.carbon
client.internal_service_context
A string that identifies the Dynatrace service that triggered the query.
dt.davis.datadriver
davis.anomaly_detector.message
Additional details about the anomaly detector status
Maximum number of concurrent queries per tenant reached.
davis.anomaly_detector.status
Severity of an anomaly detector status
ERROR
; WARNING
dt.settings.object_id
The object ID of a settings value. This corresponds to the 'objectId' field/parameter in the Settings API.
vu9U3hXa3q0AAAABACFidWlsdGluOnJ1bS51c2VyLWV4cGVyaWVuY2Utc2NvcmUABnRlbmFudAAGdGVuYW50ACRhMzZmYmYwMy00NDY1LTNlNTYtOTZiOS1kOWMzOGQ3MzU1NmO-71TeFdrerQ
event.kind
Gives high-level information about what kind of information the event contains, without being specific to the contents of the event. Helps to determine the record type of a raw event.
Tags:
permission
ANOMALY_DETECTOR_STATUS_EVENT
timestamp
The time (UNIX Epoch time in nanoseconds) when the event originated, typically when it was created by the source. If no original timestamp is available, it will be populated at ingest time. Required for all events. In case of a correlated event (e.g. ITIL events) this time could be different from the event.start time, as this time represents the actual timestamp when the "update" for the event was created.
1649822520123123123
Audit Event
For every API access, Dynatrace stores an audit event in the dt.system.events
table.
Additionally the Audit Event allows to attach an arbitrary key/value map with string keys and string values to the event. Keys are prefixed with "details." during serialization.
You can analyze audit events with the following DQL query:
fetch dt.system.events| filter event.kind == "AUDIT_EVENT"
app.id
The unique application identifier. Dynatrace apps are prefixed with 'dynatrace.', custom apps are prefixed with 'my.'
dynatrace.notebooks
; my.awesome.app
authentication.client.id
The OAuth2 client id if of type 'CLIENT_CREDENTIALS'.
dt0s02.UZCK6ENL.2YQ2A3DZUEISRJSUU5544J3SC3TMPXSEEMNA5HK7RW54SJ6XKLYGMWJNKL7B2DNH
authentication.grant.type
The grant type used during OAuth2 authentication.
AUTHORIZATION_CODE
; CLIENT_CREDENTIALS
authentication.token
The public token identifier of authentication.type 'TOKEN'.
dt0c01.AM4SEYKIBROBEJ2N3HAXZ4IX
authentication.type
The method of authentication.
OAUTH2
dt.security_context
The security context is used in access permissions to limit the visibility. Learn more about the Dynatrace permission model here
Tags:
permission
event.id
Unique identifier string of an event, is stable across multiple refreshes and updates.
5547782627070661074_1647601320000
event.kind
Gives high-level information about what kind of information the event contains, without being specific to the contents of the event. Helps to determine the record type of a raw event.
Tags:
permission
AUDIT_EVENT
event.outcome
Denotes whether the event represents a success or a failure from the perspective of the entity that produced the event (e.g. an HTTP response code).
200
; success
; failure
event.provider
Source of the event, for example the name of the component or system that generated the event.
Tags:
permission
API_GATEWAY
event.type
The unique type identifier of a given event.
Tags:
permission
POST
; PUT
; GET
event.version
Describes the version of the event.
1.0.0
origin.address
Source IP address of the request associated with this event if not of 'LOCAL' type.
10.11.12.13
origin.session
The id of the browser session (if present) associated with the event.
node0hfznc
origin.type
Origin type of the request associated with this event.
REST
; LOCAL
origin.x_forwarded_for
The verbatim value of the X-Forwarded-For HTTP request header (if present) of the request associated with the event.
1.2.3.4
resource
Generic reference to a resource like a REST resource URL or a settings id
/service/resource
; 1234567890
timestamp
The time (UNIX Epoch time in nanoseconds) when the event originated, typically when it was created by the source. If no original timestamp is available, it will be populated at ingest time. Required for all events. In case of a correlated event (e.g. ITIL events) this time could be different from the event.start time, as this time represents the actual timestamp when the "update" for the event was created.
1649822520123123123
user.id
Unique identifer of a user.
35ba9499-f87c-4047-962c-14dc32e255e5
user.name
Full name of the user.
Wolfgang Amadeus Mozart
user.organization
Organization the user belongs to.
DYNATRACE
; CUSTOMER
; PARTNER
Automation Workflow billing usage
Model describing a billing usage event of automation workflows. Billing usage events are stored in the dt.system.events
table. You can analyze billing usage events with the following DQL query:
fetch dt.system.events| filter event.kind == "BILLING_USAGE_EVENT" and event.type == "Automation Workflow"
billing_type
The identifier defining the billing type.
BILLABLE
dt.security_context
The security context is used in access permissions to limit the visibility. Learn more about the Dynatrace permission model here
Tags:
permission
BILLING_USAGE_EVENT
event.end
The event end timestamp in UTC (given in Grail preferred Linux timestamp nano precision format).
16481073970000
event.id
Unique identifier string of an event, is stable across multiple refreshes and updates.
5547782627070661074_1647601320000
event.kind
Gives high-level information about what kind of information the event contains, without being specific to the contents of the event. Helps to determine the record type of a raw event.
Tags:
permission
BILLING_USAGE_EVENT
event.provider
Source of the event, for example the name of the component or system that generated the event.
Tags:
permission
LIMA_USAGE_STREAM
event.start
The event start timestamp in UTC (given in Grail preferred Linux timestamp nano precision format).
16481073970000
event.type
The unique type identifier of a given event.
Tags:
permission
Automation Workflow
event.version
Describes the version of the event.
1.0.0
timestamp
The time (UNIX Epoch time in nanoseconds) when the event originated, typically when it was created by the source. If no original timestamp is available, it will be populated at ingest time. Required for all events. In case of a correlated event (e.g. ITIL events) this time could be different from the event.start time, as this time represents the actual timestamp when the "update" for the event was created.
1649822520123123123
workflow.actor
The entity executing the workflow as UUID.
b22a50a0-2540-4f29-9452-bc330322fb1e
workflow.created_at
The time when the workflow was created.
1649822520123123123
workflow.description
The description of the workflow.
This is a test workflow
workflow.id
The unique identifier of a workflow as UUID.
26c0334e-a3e1-4585-8cd8-2d72742fe141
workflow.is_private
The boolean identifier denoting the visibility of the workflow.
true
; false
workflow.owner
The entity owning the workflow as UUID.
f1358516-8136-4634-9012-d2e3dfee38dc
workflow.title
The title of the workflow.
Test Workflow
workflow.trigger_type
The identifier describing the trigger of the workflow.
schedule
; manual
workflow.updated_by
The entity updating the workflow last.
f1358516-8136-4634-9012-d2e3dfee38dc
Values
event.kind
MUST be one of the following:
BILLING_USAGE_EVENT
event.provider
MUST be one of the following:
LIMA_USAGE_STREAM
event.type
MUST be one of the following:
Automation Workflow
dt.security_context
MUST be one of the following:
BILLING_USAGE_EVENT
Data Deletion Events
Dynatrace stores a data deletion event for each segment that got rewritten in the dt.system.events
table. You can analyze data deletion events with the following DQL query:
fetch dt.system.events| filter event.kind == "DATA_DELETION_EVENT"
bucket
A Dynatrace Grail bucket name
default_logs
; default_events
client.api_version
The REST API version used by the client to perform the request
1
deletion_end
End of a particular deletion
1649822520123123123
deletion_id
The UUID identifying a particular deletion
c454347c-0ba9-4bd3-870e-d06dc1657f71
deletion_start
Start of a particular deletion
1649822520123123123
dt.security_context
The security context is used in access permissions to limit the visibility. Learn more about the Dynatrace permission model here
Tags:
permission
environment
A Dyntrace environment/tenant ID
umsaywsjuo
event.kind
Gives high-level information about what kind of information the event contains, without being specific to the contents of the event. Helps to determine the record type of a raw event.
Tags:
permission
INFRASTRUCTURE_EVENT
; DAVIS_EVENT
; BIZ_EVENT
; RUM_EVENT
; AUDIT_EVENT
; BILLING_USAGE_EVENT
failure_reason
Additional information if query execution has 'FAILED'.
QUEUE_TIMEOUT
; THROTTLED
query_string
The query string
fetch bizevents, from:-30m | limit 1
rewritten_bytes
The number of rewritten bytes in the context of record deletion
1113359256
status
The outcome of the query
SUCCEEDED
timestamp
The time (UNIX Epoch time in nanoseconds) when the event originated, typically when it was created by the source. If no original timestamp is available, it will be populated at ingest time. Required for all events. In case of a correlated event (e.g. ITIL events) this time could be different from the event.start time, as this time represents the actual timestamp when the "update" for the event was created.
1649822520123123123
user.email
E-mail of the user.
user@mail.com
user.id
Unique identifer of a user.
35ba9499-f87c-4047-962c-14dc32e255e5
version
Used in Extension Framework 2.0
The SNMP version.
SNMPv3
AppEngine Functions - Small billing usage
Model describing a billing usage event of function invocations. Billing usage events are stored in the dt.system.events
table. You can analyze billing usage events with the following DQL query:
fetch dt.system.events| filter event.kind == "BILLING_USAGE_EVENT" and event.type == "AppEngine Functions - Small"
billed_invocations
Number of billed invocations. Unit is 1/4 GiB * min
8
billing_type
The identifier defining the billing type.
BILLABLE
caller.app.id
The entity/app invoking the function or not set when not invoked by an app.
dynatrace.hub
dt.security_context
The security context is used in access permissions to limit the visibility. Learn more about the Dynatrace permission model here
Tags:
permission
BILLING_USAGE_EVENT
event.id
Unique identifier string of an event, is stable across multiple refreshes and updates.
5547782627070661074_1647601320000
event.kind
Gives high-level information about what kind of information the event contains, without being specific to the contents of the event. Helps to determine the record type of a raw event.
Tags:
permission
BILLING_USAGE_EVENT
event.provider
Source of the event, for example the name of the component or system that generated the event.
Tags:
permission
LIMA_USAGE_STREAM
event.type
The unique type identifier of a given event.
Tags:
permission
AppEngine Functions - Small
event.version
Describes the version of the event.
1.0.0
function.duration_sec
Duration of the function call in seconds. Measures not the actual execution time but the duration in the function proxy including network roundtrip to the Runtime. If the duration is bigger than the maximum allowed duration (which may happen due to technical reasons) the reported value is set to the maximum allowed duration.
60
function.execution_id
If the execution of a resumable function last for more than 2 minutes, there will be multiple
BILLING_USAGE_EVENT
s created for that execution, which will have the same value in this field. It can therefore be used to join BILLING_USAGE_EVENT
s for long running function invocations.1bfa32fa-679e-4ac9-b683-2d2cdd4b6314
function.id
The unique identifier of a function containing the app id and function id in the form of {app.id}.{function.id}. Missing for adhoc executions.
myapp.test/path/myfunction
function.memory_mib
Runtime memory in MiB. Some of the memory is not available to the javascript code, because it is needed by the runtime itself.
128
function.type
The identifier defining the function type.
STANDARD
; ACTION
; AD_HOC
invocation.type
The identifier defining the invocation type.
API
; SCHEDULE
; EVENT
timestamp
The time (UNIX Epoch time in nanoseconds) when the event originated, typically when it was created by the source. If no original timestamp is available, it will be populated at ingest time. Required for all events. In case of a correlated event (e.g. ITIL events) this time could be different from the event.start time, as this time represents the actual timestamp when the "update" for the event was created.
1649822520123123123
user.email
E-mail of the user.
user@mail.com
user.id
Unique identifer of a user.
35ba9499-f87c-4047-962c-14dc32e255e5
Values
event.kind
MUST be one of the following:
BILLING_USAGE_EVENT
event.provider
MUST be one of the following:
LIMA_USAGE_STREAM
event.type
MUST be one of the following:
AppEngine Functions - Small
dt.security_context
MUST be one of the following:
BILLING_USAGE_EVENT
function.type
MUST be one of the following:
AD_HOC
STANDARD
ACTION
invocation.type
MUST be one of the following:
API
<unspecified>
Events - Ingest & Process billing usage
Model describing a billing usage event of ingest for events. Billing usage events are stored in the dt.system.events
table. You can analyze billing usage events with the following DQL query:
fetch dt.system.events| filter event.kind == "BILLING_USAGE_EVENT" and event.type == "Events - Ingest & Process"| dedup event.id
billed_bytes
The number of bytes that will be billed.
1113359256
dt.security_context
The security context is used in access permissions to limit the visibility. Learn more about the Dynatrace permission model here
Tags:
permission
BILLING_USAGE_EVENT
event.billing.category
Display name for usage details
Business events
; Custom Davis & Kubernetes events
; Kubernetes warning events
; Davis AI problems
; Security events
event.id
Unique identifier string of an event, is stable across multiple refreshes and updates.
5547782627070661074_1647601320000
event.kind
Gives high-level information about what kind of information the event contains, without being specific to the contents of the event. Helps to determine the record type of a raw event.
Tags:
permission
BILLING_USAGE_EVENT
event.provider
Source of the event, for example the name of the component or system that generated the event.
Tags:
permission
LIMA_CLIENT
event.type
The unique type identifier of a given event.
Tags:
permission
Events - Ingest & Process
event.version
Describes the version of the event.
1.0.0
timestamp
Start time of the usage timeframe (inclusive)
2023-05-22T11:15:00.000000Z
usage.end
End time of the usage timeframe (exclusive)
2023-05-22T11:30:00.000000Z
usage.event_bucket
A Dynatrace Grail usage event bucket name
default_davis_custom_events
usage.start
Start time of the usage timeframe (inclusive)
2023-05-22T11:15:00.000000Z
Values
event.kind
MUST be one of the following:
BILLING_USAGE_EVENT
event.provider
MUST be one of the following:
LIMA_CLIENT
event.type
MUST be one of the following:
Events - Ingest & Process
dt.security_context
MUST be one of the following:
BILLING_USAGE_EVENT
Metrics - Ingest & Process billing usage
Model describing a billing usage event of ingest & process for metrics. Billing usage events are stored in the dt.system.events
table. You can analyze billing usage events with the following DQL query:
fetch dt.system.events| filter event.kind == "BILLING_USAGE_EVENT" and event.type == "Metrics - Ingest & Process"
data_points
The number of billable metrics data points.
1500
dt.security_context
The security context is used in access permissions to limit the visibility. Learn more about the Dynatrace permission model here
Tags:
permission
BILLING_USAGE_EVENT
event.id
Unique identifier string of an event, is stable across multiple refreshes and updates.
5547782627070661074_1647601320000
event.kind
Gives high-level information about what kind of information the event contains, without being specific to the contents of the event. Helps to determine the record type of a raw event.
Tags:
permission
BILLING_USAGE_EVENT
event.provider
Source of the event, for example the name of the component or system that generated the event.
Tags:
permission
LIMA_USAGE_STREAM
event.type
The unique type identifier of a given event.
Tags:
permission
Metrics - Ingest & Process
event.version
Describes the version of the event.
1.0.0
metric.type
Identifies the type of metric and therefore the timeseries rollup functions it supports.
summary_stats
monitoring_source
Monitoring source that originally reported the data. See 'dt.system.monitoring_source'.
fullstack_host
timestamp
The time (UNIX Epoch time in nanoseconds) when the event originated, typically when it was created by the source. If no original timestamp is available, it will be populated at ingest time. Required for all events. In case of a correlated event (e.g. ITIL events) this time could be different from the event.start time, as this time represents the actual timestamp when the "update" for the event was created.
1649822520123123123
usage.end
End time of the usage timeframe (exclusive)
2023-05-22T11:30:00.000000Z
usage.event_bucket
A Dynatrace Grail usage event bucket name
default_logs
usage.start
Start time of the usage timeframe (inclusive)
2023-05-22T11:15:00.000000Z
Values
event.kind
MUST be one of the following:
BILLING_USAGE_EVENT
event.provider
MUST be one of the following:
LIMA_USAGE_STREAM
event.type
MUST be one of the following:
Metrics - Ingest & Process
dt.security_context
MUST be one of the following:
BILLING_USAGE_EVENT
Query Execution Events
Dynatrace stores a query execution event for each query that got executed in the dt.system.events
table. You can analyze query execution events with the following DQL query:
fetch dt.system.events| filter event.kind == "QUERY_EXECUTION_EVENT"
DQL query to find the number of succeeded queries:
fetch dt.system.events| filter event.kind == "QUERY_EXECUTION_EVENT"| filter status == "SUCCEEDED"| summarize countDistinct(query_id)
DQL query to find aggregated number of failed queries:
fetch dt.system.events| filter event.kind == "QUERY_EXECUTION_EVENT"| summarize sum(failed_count)
analysis_timeframe.end
End time of query analysis timeframe
2023-05-22T13:15:57.416654000
analysis_timeframe.start
Start time of query analysis timeframe
2023-05-22T11:15:57.416654000
bucket
A Dynatrace Grail bucket name
default_logs
; default_events
client.api_version
The REST API version used by the client to perform the request
1
client.application_context
A Dynatrace app id
local-dev-mode
; dynatrace.notebooks
; my.biz.carbon
client.function_context
Name of the function that executed the query
api/execute-dql-query
; my/function
client.internal_service_context
A string that identifies the Dynatrace service that triggered the query.
dt.davis.datadriver
client.source
The client source URL
https://twqaxovyotonguh5hupot6aqztyf5quf-umsaywsjuo.dev5.dev.apps.dynatracelabs.com/ui/notebook/ec9f1b89-a8a3-4e1e-bf22-193089ecc470
delivered_records
The number of records returned by the query
1000
dt.security_context
The security context is used in access permissions to limit the visibility. Learn more about the Dynatrace permission model here
Tags:
permission
environment
A Dyntrace environment/tenant ID
umsaywsjuo
event.kind
Gives high-level information about what kind of information the event contains, without being specific to the contents of the event. Helps to determine the record type of a raw event.
Tags:
permission
QUERY_EXECUTION_EVENT
execution_duration_ms
The duration of the query in milliseconds.
123
failed_count
Number of failed queries represented by the record.
failed_count > 1
represents cases like 'failure_reason=THROTTLED' with individual queries aggregated into a single record.1
; 321
failure_reason
Additional information if query execution has 'FAILED'.
QUEUE_TIMEOUT
; THROTTLED
query_id
The UUID identifying a particular query. For aggregated events this field is null.
e68e5cc8-c31e-4e57-90d7-c6dde20b19d5
query_pool
The resource pool of the query
DASHBOARDS
query_queue_time_ms
The time query spent in queued state (in milliseconds).
456
query_start
Query start time. For failed queries the start time may be aggregated and not reflect the exact start time but rather the aggregation time.
1683012271413
query_string
The query string. For aggregated events this field is null.
fetch bizevents, from:-30m | limit 1
sampling_ratio
The sampling ration of the executed query
1
scanned_bytes
The number of scanned bytes
1113359256
scanned_data_points
Number of scanned data points for metric queries
20
scanned_records
The number of scanned records
9209037
status
The outcome of the query
SUCCEEDED
timestamp
The time (UNIX Epoch time in nanoseconds) when the event originated, typically when it was created by the source. If no original timestamp is available, it will be populated at ingest time. Required for all events. In case of a correlated event (e.g. ITIL events) this time could be different from the event.start time, as this time represents the actual timestamp when the "update" for the event was created.
1649822520123123123
user
The user ID that triggered the query. For aggregated events this field is null.
john.doe@dynatrace.com
user.email
The user email that triggered the query. For aggregated events this field is null.
john.doe@dynatrace.com
user.id
The user UUID that triggered the query. For aggregated events this field is null.
03962cb6-aefc-4ca0-bad9-326099a977fe
version
Used in Extension Framework 2.0
The record version
1
Values
failure_reason
MUST be one of the following:
QUEUE_TIMEOUT
THROTTLED
Events - Query billing usage
Model describing a billing usage event of a events query execution. Billing usage events are stored in the dt.system.events
table. You can analyze billing usage events with the following DQL query:
fetch dt.system.events| filter event.kind == "BILLING_USAGE_EVENT" and event.type == "Events - Query"
action_type
Indicates if the query was executed to fetch records or to delete them
QUERY
; DELETION
billed_bytes
The number of bytes that will be billed.
1113359256
billing_type
The identifier defining the billing type.
BILLABLE
client.application_context
A Dynatrace app id
local-dev-mode
; dynatrace.notebooks
; my.biz.carbon
client.function_context
Name of the function that executed the query
api/execute-dql-query
; my/function
dt.security_context
The security context is used in access permissions to limit the visibility. Learn more about the Dynatrace permission model here
Tags:
permission
BILLING_USAGE_EVENT
event.billing.category
Display name for usage details
Business events
; Custom Davis & Kubernetes events
; Kubernetes warning events
; Davis AI problems
; Security events
event.id
Unique identifier string of an event, is stable across multiple refreshes and updates.
5547782627070661074_1647601320000
event.kind
Gives high-level information about what kind of information the event contains, without being specific to the contents of the event. Helps to determine the record type of a raw event.
Tags:
permission
BILLING_USAGE_EVENT
event.provider
Source of the event, for example the name of the component or system that generated the event.
Tags:
permission
LIMA_USAGE_STREAM
event.type
The unique type identifier of a given event.
Tags:
permission
Events - Query
event.version
Describes the version of the event.
1.0
; 2.0
query_id
The UUID identifying a particular query
e68e5cc8-c31e-4e57-90d7-c6dde20b19d5
query_start
Query start time
1683012271413
timestamp
The time (UNIX Epoch time in nanoseconds) when the event originated, typically when it was created by the source. If no original timestamp is available, it will be populated at ingest time. Required for all events. In case of a correlated event (e.g. ITIL events) this time could be different from the event.start time, as this time represents the actual timestamp when the "update" for the event was created.
1649822520123123123
usage.event_bucket
A Dynatrace Grail usage event bucket name
default_bizevents
; default_davis_custom_events
user.email
E-mail of the user.
user@mail.com
user.id
Unique identifer of a user.
35ba9499-f87c-4047-962c-14dc32e255e5
Values
event.kind
MUST be one of the following:
BILLING_USAGE_EVENT
event.provider
MUST be one of the following:
LIMA_USAGE_STREAM
event.type
MUST be one of the following:
Events - Query
dt.security_context
MUST be one of the following:
BILLING_USAGE_EVENT
Log Management & Analytics - Query billing usage
Model describing a billing usage event of a logs query execution. Billing usage events are stored in the dt.system.events
table. You can analyze billing usage events with the following DQL query:
fetch dt.system.events| filter event.kind == "BILLING_USAGE_EVENT" and event.type == "Log Management & Analytics - Query"
action_type
Indicates if the query was executed to fetch records or to delete them
QUERY
; DELETION
billed_bytes
The number of bytes that will be billed.
1113359256
billing_type
The identifier defining the billing type.
BILLABLE
client.application_context
A Dynatrace app id
local-dev-mode
; dynatrace.notebooks
; my.biz.carbon
client.function_context
Name of the function that executed the query
api/execute-dql-query
; my/function
dt.security_context
The security context is used in access permissions to limit the visibility. Learn more about the Dynatrace permission model here
Tags:
permission
BILLING_USAGE_EVENT
event.id
Unique identifier string of an event, is stable across multiple refreshes and updates.
5547782627070661074_1647601320000
event.kind
Gives high-level information about what kind of information the event contains, without being specific to the contents of the event. Helps to determine the record type of a raw event.
Tags:
permission
BILLING_USAGE_EVENT
event.provider
Source of the event, for example the name of the component or system that generated the event.
Tags:
permission
LIMA_USAGE_STREAM
event.type
The unique type identifier of a given event.
Tags:
permission
Log Management & Analytics - Query
event.version
Describes the version of the event.
1.0
query_id
The UUID identifying a particular query
e68e5cc8-c31e-4e57-90d7-c6dde20b19d5
query_start
Query start time
1683012271413
timestamp
The time (UNIX Epoch time in nanoseconds) when the event originated, typically when it was created by the source. If no original timestamp is available, it will be populated at ingest time. Required for all events. In case of a correlated event (e.g. ITIL events) this time could be different from the event.start time, as this time represents the actual timestamp when the "update" for the event was created.
1649822520123123123
user.email
E-mail of the user.
user@mail.com
user.id
Unique identifer of a user.
35ba9499-f87c-4047-962c-14dc32e255e5
Values
event.kind
MUST be one of the following:
BILLING_USAGE_EVENT
event.provider
MUST be one of the following:
LIMA_USAGE_STREAM
event.type
MUST be one of the following:
Log Management & Analytics - Query
dt.security_context
MUST be one of the following:
BILLING_USAGE_EVENT
Events - Retain billing usage
Model describing the billing usage event for retention of events per Grail bucket. Billing usage events are stored in the dt.system.events
table. You can analyze billing usage events with the following DQL query:
fetch dt.system.events| filter event.kind == "BILLING_USAGE_EVENT" and event.type == "Events - Retain"
billed_bytes
The number of bytes that will be billed.
1113359256
dt.security_context
The security context is used in access permissions to limit the visibility. Learn more about the Dynatrace permission model here
Tags:
permission
BILLING_USAGE_EVENT
event.billing.category
Display name for usage details
Business events
; Custom Davis & Kubernetes events
; Kubernetes warning events
; Davis AI problems
; Security events
event.id
Unique identifier string of an event, is stable across multiple refreshes and updates.
5547782627070661074_1647601320000
event.kind
Gives high-level information about what kind of information the event contains, without being specific to the contents of the event. Helps to determine the record type of a raw event.
Tags:
permission
BILLING_USAGE_EVENT
event.provider
Source of the event, for example the name of the component or system that generated the event.
Tags:
permission
LIMA_USAGE_STREAM
event.type
The unique type identifier of a given event.
Tags:
permission
Event - Retain
event.version
Describes the version of the event.
1.0.0
timestamp
The time (UNIX Epoch time in nanoseconds) when the event originated, typically when it was created by the source. If no original timestamp is available, it will be populated at ingest time. Required for all events. In case of a correlated event (e.g. ITIL events) this time could be different from the event.start time, as this time represents the actual timestamp when the "update" for the event was created.
1649822520123123123
usage.event_bucket
A Dynatrace Grail usage event bucket name
default_bizevents
; default_davis_custom_events
Values
event.kind
MUST be one of the following:
BILLING_USAGE_EVENT
event.provider
MUST be one of the following:
LIMA_USAGE_STREAM
event.type
MUST be one of the following:
Events - Retain
dt.security_context
MUST be one of the following:
BILLING_USAGE_EVENT
Log Management & Analytics - Retain billing usage
Model describing the billing usage event for retention of events per Grail bucket. Billing usage events are stored in the dt.system.events
table. You can analyze billing usage events with the following DQL query:
fetch dt.system.events| filter event.kind == "BILLING_USAGE_EVENT" and event.type == "Log Management & Analytics - Retain"
billed_bytes
The number of bytes that will be billed.
1113359256
dt.security_context
The security context is used in access permissions to limit the visibility. Learn more about the Dynatrace permission model here
Tags:
permission
BILLING_USAGE_EVENT
event.id
Unique identifier string of an event, is stable across multiple refreshes and updates.
5547782627070661074_1647601320000
event.kind
Gives high-level information about what kind of information the event contains, without being specific to the contents of the event. Helps to determine the record type of a raw event.
Tags:
permission
BILLING_USAGE_EVENT
event.provider
Source of the event, for example the name of the component or system that generated the event.
Tags:
permission
LIMA_USAGE_STREAM
event.type
The unique type identifier of a given event.
Tags:
permission
Log Management & Analytics - Retain
event.version
Describes the version of the event.
1.0.0
timestamp
The time (UNIX Epoch time in nanoseconds) when the event originated, typically when it was created by the source. If no original timestamp is available, it will be populated at ingest time. Required for all events. In case of a correlated event (e.g. ITIL events) this time could be different from the event.start time, as this time represents the actual timestamp when the "update" for the event was created.
1649822520123123123
usage.event_bucket
A Dynatrace Grail usage event bucket name
default_logs
Values
event.kind
MUST be one of the following:
BILLING_USAGE_EVENT
event.provider
MUST be one of the following:
LIMA_USAGE_STREAM
event.type
MUST be one of the following:
Log Management & Analytics - Retain
dt.security_context
MUST be one of the following:
BILLING_USAGE_EVENT
Dynatrace Self-monitoring Event
Events that are generated by Dynatrace components with self-monitoring information (health, status, unexpected situations)
Fields
content
Unstructured content of the record. It should contain human readable message. Often it is raw version of record read from a source.
No keepalive from datasource statsd. Restarting
dt.active_gate.group.name
The name of group ActiveGate instance belongs to
GdanskLab
dt.entity.host
An entity ID of an entity of type HOST.
Tags:
entity-id
HOST-E0D8F94D9065F24F
dt.event.key
Preregistered event key for sfm events whitelisting
extension.status
; extension.engine.eec_status
dt.extension.config.id
Extension's monitoring configuration identifier.
vu9U3hXa3q0AAAABAAtleHQ6ZXh0LTA0MAAIYWdfZ3JvdXAAA0FHMQAkMjY2YTIyM2YtZDgxYi0zNTNjLThlYzctYzk2YzliZjg4OGQ3vu9U3hXa3q0
dt.extension.ds
Name of the data source.
SNMPTrap
dt.extension.name
Name of the extension.
com.snmptrap.generic
dt.extension.status
The status of the component reporting SFM event
AUTHENTICATION_ERROR
dt.source_entity
The ID of the entity considered the source of the measurement. The string needs to be in the format of any MONITORED_ENTITY type. 1
Tags:
entity-id
HOST-E0D8F94D9065F24F
; PROCESS_GROUP_INSTANCE-E0D8F94D9065F24F
log.source
dsfm
; isfm
timestamp
The time (UNIX Epoch time in nanoseconds) when the event originated, typically when it was created by the source. If no original timestamp is available, it will be populated at ingest time. Required for all events. In case of a correlated event (e.g. ITIL events) this time could be different from the event.start time, as this time represents the actual timestamp when the "update" for the event was created.
1649822520123123123
Value of this attribute will be based on one of dt.entity.<type>
attributes value. That means that both attributes dt.source_entity and corresponding dt.entity.<type>
will be set to the same ID.
Can contain e.g. a file path, standard output, an URI etc., depending on log stream type. The value should be stable for one logical source, so e.g. not affected by log file rotation digits.