The following reference contains a list of global fields that have a well defined semantic meaning in Dynatrace and can be used across different monitoring types. The fields are organized in namespaces that are separated with dots.
The top level fields contain generally relevant information for all events and data points.
| Attribute | Type | Description | Examples |
|---|---|---|---|
timestamp | timestamp | stable The time (UNIX Epoch time in nanoseconds) when the event originated, typically when the source created it. If no original timestamp is available, it will be populated at ingest time and required for all events. In the case of a correlated event (for example, ITIL events), this time could be different from the event.start time, as this time represents the actual timestamp when the "update" for the event was created. | 1649822520123123123 |
timeframe | record[] | stable The timeframe represented by a timeseries record. | |
start_time | timestamp | stable Start time of a data point. Value is a UNIX Epoch time in nanoseconds and less than or equal to the end_time. | 1649822520123123123 |
end_time | timestamp | stable End time of a data point. Value is a UNIX Epoch time in nanoseconds and greater than or equal to the start_time. | 1649822520123123165 |
duration | duration | stable The difference between start_time and end_time in nanoseconds. | 42 |
interval | string | stable Denotes the timeframe of represented by individual timeseries measurements returned by a timeseries record. | 1 min |
| Attribute | Type | Description | Examples |
|---|---|---|---|
| string | resource experimentalAdobe Experience Manager (AEM) environment type. |
|
| string | resource experimentalAdobe Experience Manager (AEM) service. Contains the customer defined name of the AEM environment. | |
| string | resource experimentalAdobe Experience Manager (AEM) service. Contains the program and environment IDs the customer is exposed to. | |
| string | resource experimentalAdobe Experience Manager (AEM) tier. |
|
OneAgent might aggregate spans that have the same parent span into a single span. The aggregated span contains attributes to indicate the aggregation and to allow reconstructing details.
For aggregated spans the start_time holds the earliest start_time, end_time holds the latest end_time of all aggregated spans.
| Attribute | Type | Description | Examples |
|---|---|---|---|
| long | stableThe number of spans aggregated into this span. Because this span represents multiple spans, the value is >1. |
|
| duration | stableThe duration in nanoseconds for the longest aggregated span. |
|
| duration | stableThe duration in nanoseconds for the shortest aggregated span. |
|
| duration[] | stableArray of reservoir sampled span durations of the aggregated spans. The duration samples can be used to estimate a more accurate duration distribution of aggregated spans rather than the average value. |
|
| duration | stableThe duration sum in nanoseconds for all aggregated spans. |
|
| long | stableThe number of aggregated spans that included an exception. |
|
| boolean | stable |
| Attribute | Type | Description | Examples |
|---|---|---|---|
| string | resource experimentalThe server's base directory. This is what usually is referred to as CATALINA_BASE. |
|
| string | resource experimentalThe server's home directory. This is what usually is referred to as CATALINA_HOME. |
|
| Attribute | Type | Description | Examples |
|---|---|---|---|
| string | resource experimental | |
| string | resource experimentalThe name of the Apache HTTP Server module that generated the log entry. |
|
| Attribute | Type | Description | Examples |
|---|---|---|---|
| string | resource experimental |
The app namespace contains information on the application sending the event.
| Attribute | Type | Description | Examples |
|---|---|---|---|
| string | resource stableThe name of the bundle, for example, the bundle identifier on iOS or the |
|
| string | resource stableAn optional unique application identifier. Chosen by the customer |
|
| string | resource stableThe application's publicly visible version number, as, for example, displayed in App Store or Google Play. Usually this is just the major and minor version with no patch number. |
|
| string | resource stableThe application's internal build number, which can include information such as patch number and build number. |
|
The argocd namespace contains Argo CD specific deployment attributes.
| Attribute | Type | Description | Examples |
|---|---|---|---|
| string | experimentalThe health state of the tracked resource. 1 |
|
| string | experimentalMessage associated with synchronization operation. 2 |
|
| string | experimentalStatus of the synchronization operation between source and target. 3 |
|
| string | experimentalThe sync status represents the current state of reconciliation. 4 |
|
The value is equal to the app.status.health.status value in Argo CD.
The value is equal to the app.status.operationState.message value in Argo CD.
The value is equal to the app.status.operationState.phase value in Argo CD.
The value is equal to the app.status.sync.status value in Argo CD.
The artifact namespace contains information about software artifacts.
| Attribute | Type | Description | Examples |
|---|---|---|---|
| string | experimentalThe provenance filename of the built attestation. It directly relates to the |
|
| string | experimentalThe full hash value of the built attestation. |
|
| string | experimentalThe ID of the build software attestation. |
|
| string | experimentalThe filename of the software artifact, typically generated by the build process. This is similar to the |
|
| string | experimentalThe full hash value of the software artifact. This value is used to verify the integrity of the software artifact. |
|
| string | experimentalThe identifier of the software artifact, typically the name of the artifact. |
|
| string | experimentalThe human-readable name of the software artifact. |
|
| string | experimentalThe Package URL of the package artifact. This value is used to identify and locate the artifact. |
|
| string | experimentalThe version of the software artifact, typically in Semantic Versioning format. |
|
| Attribute | Type | Description | Examples |
|---|---|---|---|
| string | resource experimental |
Fields that can come from audit logs.
| Attribute | Type | Description | Examples |
|---|---|---|---|
| string | stableAudited action. |
|
| string | experimentalUnique identifier of the audit event. |
|
| string | stableUser name, service account name, or principal name that executes audited action. |
|
| string | stableResult of the audited action. |
|
| string | stableStatus of the audited action. |
|
| timestamp | experimentalTimestamp of the audited action. |
|
Authentication type and method used to login to a Dynatrace system.
| Attribute | Type | Description | Examples |
|---|---|---|---|
| string | experimentalThe OAuth2 client id if of type 'CLIENT_CREDENTIALS'. |
|
| string | experimentalThe grant type used during OAuth2 authentication. |
|
| string | experimentalThe public token identifier of authentication.type 'TOKEN'. |
|
| string | experimentalThe method of authentication. |
|
authentication.grant.type MUST be one of the following:
| Value | Description | Display name |
|---|---|---|
| Authorization Code | |
| Client Credentials |
authentication.type MUST be one of the following:
| Value | Description | Display name |
|---|---|---|
| Authenticated via DevOps token | DevOps Token |
| Not authenticated (authentication not necessary) | No authentication |
| OAuth 2.0 | |
| Authenticated via API access token or personal access token | Token |
authentication.client.id and authentication.token MUST follow the Dynatrace token format definition.
Specifically, authentication.client.id MUST be prefixed with dt0s02.
Information about entity availability. Sample usage is reporting hosts and PGI-s availability by OS Agent. Value of availability.state can be used for calculating aggregate availability (dividing count of "successful" requests by count of all requests). With constant frequency of requests it can be treated as a time-base availability, showing percentage of time that the monitored entity was available.
| Attribute | Type | Description | Examples |
|---|---|---|---|
| string | stableState of entity (host or PGI) availability. |
|
availability.state has the following list of well-known values. If one of them applies, then the respective value MUST be used, otherwise a custom value MAY be used.
| Value | Description | Display name |
|---|---|---|
| [PGI] PGI is available and reported. | Available |
| [HOST] Host is working, agent active but no data are sent. | No data |
| [HOST] Host is working, agent inactive (disabled manually in configuration). No data are sent. | No data agent inactive |
| [HOST] Host has started after graceful shutdown. | Reboot graceful |
| [HOST] Host has started after ungraceful shutdown. | Reboot ungraceful |
| [HOST] Host has been shut down. | Shutdown host |
| [PGI] PGI is unavailable and not reported. | Unavailable |
| [PGI] PGI is available but not reported because it became unimportant. | Unimportant |
| [HOST] Host is unmonitored because agent stopped. | Agent stopped |
| [HOST] Host is unmonitored because agent has been uninstalled. | Agent uninstalled |
| [HOST] Host is unmonitored because agent is upgrading. | Agent upgrading |
| [HOST] Host is working, agent active and sending data. | Up |
Fields that can come from applications running on AWS.
| Attribute | Type | Description | Examples |
|---|---|---|---|
| string | resource stableThe 12-digit number, such as 123456789012, that uniquely identifies an AWS account.Tags: |
|
| string | resource experimentalName associated with the AWS account. |
|
| string | resource experimentalApplication load balancer name that instance is behind. |
|
| string | resource stableAmazon Resource Name (ARN). |
|
| string | resource stableA specific availability zone or array of zones in given AWS region. |
|
| string | resource experimentalID for the availability zone. |
|
| string | resource experimentalExtends the aws.cloudfront.result_type with additional states. See full list under x-edge-detailed-result-type. |
|
| string | resource experimentalHow the server classified the response just before returning the response to the viewer. |
|
| string | resource experimentalHow the server classified the response after the last byte left the server. |
|
| string | resource experimental | |
| string | resource experimental | |
| string | resource experimental | |
| string | resource experimentalThe full Amazon Resource Name (ARN) of the container. |
|
| string | resource experimental | |
| string | resource experimentalThe Docker ID for the container. |
|
| string | resource experimentalThe name of the container supplied to Docker. |
|
| string | resource experimental | |
| string | resource experimental | |
| string | resource experimentalThe full Amazon Resource Name (ARN) of the task to which the container belongs. |
|
| string | resource experimentalThe runtime identifier, prefixed by AWS_Lambda_. Lambda supports multiple languages through the use of runtimes. A runtime provides a language-specific environment that relays invocation events, context information, and responses between Lambda and the function. |
|
| long | resource experimentalThe number of field-level encryption fields that the server encrypted and forwarded to the origin. |
|
| string | resource experimentalWhen field-level encryption is configured for a distribution, this field contains a code that indicates whether the request body was successfully processed. |
|
| string | resource experimental | |
| string | resource experimentalThe AWS Lambda initialization type. Same string value as available in AWS_LAMBDA_INITIALIZATION_TYPE. |
|
| string | resource experimentalAmazon CloudWatch group of log streams that share the same retention, monitoring, and access control settings. |
|
| string | resource experimentalA sequence of log events that share the same source. |
|
| string | resource stableA specific geographical AWS Cloud location.Tags: |
|
| string | resource stableUnique, immutable identifier assigned to the AWS cloud resource. |
|
| string | resource stableName of the resource for named resources, value of the "Name" tag in AWS for non-named resources (if unavailable, same as aws.resource.id). |
|
| string | resource experimentalThe name of a resource type in CloudFormation format. |
|
| string | resource experimentalThe service that identifies the AWS product. |
|
| string | resource experimentalContains the value for the tag with the tag key named |
|
aws.fle.status MUST be one of the following:
| Value | Description | Display name |
|---|---|---|
| A field that is configured to be encrypted exceeds the maximum length allowed. | Field Length Limit Error |
| A request that the distribution is configured to encrypt contains more than the number of fields allowed. | Field Number Limit Error |
| The server forwarded the request to the origin without parsing or encryption because no content type was configured. | Forwarded By Content Type |
| The server forwarded the request to the origin without parsing or encryption because the request contains a query argument that wasn't in the configuration for field-level encryption. | Forwarded By Query Args |
| The server forwarded the request to the origin without parsing or encryption because no profile was specified in the configuration for field-level encryption. | Forwarded No Profile |
| The server rejected the request and returned an HTTP 400 status code to the viewer because the value of the Content-Type header was in an invalid format. | Malformed Content Type Error |
| The server rejected the request and returned an HTTP 400 status code to the viewer because the request body was in an invalid format. | Malformed Input Error |
| The server rejected the request and returned an HTTP 400 status code to the viewer because a query argument was empty or in an invalid format. | Malformed Query Args Error |
| The server successfully processed the request body, encrypted values in the specified fields, and forwarded the request to the origin. | FLE Processed |
| The server rejected the request and returned an HTTP 400 status code to the viewer because no content type was specified in the configuration for field-level encryption. | Rejected By Content Type |
| The server rejected the request and returned an HTTP 400 status code to the viewer because no query argument was specified in the configuration for field-level encryption. | Rejected By Query Args |
| The length of the request body exceeded the maximum length allowed when field-level encryption is configured. | Request Length Limit Error |
| The origin server returned an error. | Server Error |
aws.lambda.initialization_type has the following list of well-known values. If one of them applies, then the respective value MUST be used, otherwise a custom value MAY be used.
| Value | Description | Display name |
|---|---|---|
| On demand | On Demand |
| Provisioned concurrency | Provisioned Concurrency |
| SnapStart | Snap Start |
| Attribute | Type | Description | Examples |
|---|---|---|---|
| string | experimentalAmazon resource name (ARN) of a Kinesis stream or consumer. |
|
| string | experimentalAmazon resource name (ARN) of a Kinesis consumer. |
|
| string | experimentalName of a Kinesis consumer. |
|
| string | experimentalAmazon resource name (ARN) of a Kinesis stream. |
|
| string | experimentalName of a Kinesis stream. |
|
| string | experimentalThe full invoked ARN as provided on the |
|
| string | experimentalThe AWS request ID (e.g., value of |
|
| string | experimentalName of an S3 bucket. |
|
| string | experimentalKey name of the object. |
|
| string | experimentalVersion ID for the specific version of the object. |
|
| long | experimentalPart number in a multi-part upload. |
|
| string | experimentalName of the bucket containing the object to copy. |
|
| string | experimentalKey of the object to copy. |
|
| string | experimentalVersion of the source object to copy. By default, the latest version is copied. |
|
| string | experimentalUpload ID identifying the multipart upload targeted by an operation (abort/complete/upload/…). |
|
| string | experimentalContains the AWS X-Ray trace id (e.g., value of the |
|
| Attribute | Type | Description | Examples |
|---|---|---|---|
| string | experimentalThe Route 53 edge location that responded to the query. Each edge location is identified by a three-letter code and an arbitrary number. |
|
| string | experimentalThe ID of the hosted zone that is associated with all the DNS queries in this log. |
|
| string | experimentalThe IP address of the DNS resolver that submitted the request to Route 53. |
|
| string | experimentalThe domain or subdomain that was specified in the request. |
|
| string | experimentalEither the DNS record type that was specified in the request, or ANY. |
|
| string | experimentalThe DNS response code that Route 53 returned in response to the DNS query. |
|
Fields that can come from applications running on Azure.
| Attribute | Type | Description | Examples |
|---|---|---|---|
| string[] | resource experimentalAvailability zones of Azure cloud resource. |
|
| string | resource experimentalThe fully qualified name of the class executing an Azure function. |
|
| string | resource experimentalThe DNS suffix for the Container Apps environment. |
|
| string | resource experimentalThe revision-specific hostname of the container app. |
|
| string | resource experimentalThe name of the container app. |
|
| string | resource experimentalThe name of the container app replica. |
|
| string | resource experimentalAzure Event Hub Namespace name. |
|
| string | resource stableA specific geographical location of Azure cloud resource.Tags: |
|
| string | resource experimentalA group of Azure subscriptions used for governance use cases. |
|
| string | resource stableA resource group is a container that holds related resources for an Azure solution.Tags: |
|
| string | resource experimentalA unique, immutable identifier assigned to each Azure cloud resource. |
|
| string | resource experimentalUser-provided name of the Azure cloud resource. |
|
| string | resource experimentalThe name of a resource type in the format: {resource-provider}/{resource-type}. |
|
| string | resource experimentalAzure Service Bus name. |
|
| string | resource experimentalGlobally unique deployment information about an Azure function. |
|
| string | resource experimentalAzure SQL Server Elastic Pool name. |
|
| string | resource experimentalAzure SQL Server name. |
|
| string | resource stableAn Azure subscription is a logical container used to provision resources in Azure.Tags: |
|
| string | resource experimentalContains the value for the tag with the tag key named |
|
| string | resource experimentalUnique, immutable identifier assigned to the Azure tenant. |
|
| string | resource experimentalName assigned to the Azure tenant. |
|
| string | resource experimentalAzure Virtual Machine name. |
|
| string | resource experimentalAzure Virtual Machine Scale Set name. |
|
| string | resource experimentalAzure Virtual Machine unique 128bits identifier |
|
| Attribute | Type | Description | Examples |
|---|---|---|---|
| string | experimentalA unique identifier for the invocation of an Azure Function. |
|
| Attribute | Type | Description | Examples |
|---|---|---|---|
| string | experimentalInternal ID from the business flow configured in the Business Flow app. | |
| string | experimentalThe priority of a business process. |
|
| string | experimentalURL to explore the business flow in the Business Flow app from a result in a DQL query against Smartscape nodes. |
Fields that are integral to applications managed by BOSH.
| Attribute | Type | Description | Examples |
|---|---|---|---|
| string | resource experimentalA specific geographical BOSH location. |
|
| string | resource stableBOSH depoloyment ID, retrievied from /var/vcap on monitored host. |
|
| string | resource stableBOSH instance name, retrievied from /var/vcap on monitored host. |
|
| string | resource experimentalA unique identifier assigned to each deployed instance. |
|
| string | resource experimentalA unique identifier to a deployment or instance. |
|
| string | resource stableVersion of BOSH stemcell, retrievied from /var/vcap on monitored host. |
|
The browser namespace contains information on the browser running an application.
| Attribute | Type | Description | Examples |
|---|---|---|---|
| uid | experimentalA unique ID generated by RUM JavaScript to identify the browser frame. The |
|
| uid | experimentalA unique ID generated by RUM JavaScript to identify the browser's next-higher frame (if that frame exists and is reachable). The |
|
| uid | experimentalA unique ID generated by RUM JavaScript to identify the browser tab. The |
|
| double | experimentalThe ratio of the resolution in physical pixels to the resolution in CSS pixels for the current display device. |
|
| long | experimentalThe browser window's inner height, in pixels. |
|
| long | experimentalThe browser window's inner width, in pixels. |
|
| Attribute | Type | Description | Examples |
|---|---|---|---|
| boolean | resource experimentalIf set to |
|
| string | resource stableThe browser name. |
|
| string | resource stableThe browser type. |
|
| string | resource stableThe full user agent string as provided by the browser in the HTTP |
|
| string | resource stableThe browser version. |
|
Span scoped attributes (e.g. method parameters, return values, class names, …) captured by the OneAgent based on a request attribute rule. The actual name of the attribute is the prefix "captured_attribute" plus the "request attribute name" defined in the request attributes configuration. In contrast to request attributes, captured attributes contain the raw values reported by the OneAgent at the location (i.e. on the active span) where they appeared. No aggregation (first/last value, distinct values, ...), type conversion or normalization is performed on them. They are the basis for request attributes.
| Attribute | Type | Description | Examples |
|---|---|---|---|
| array | stableContains the span scoped raw values that were captured under the name |
|
| Attribute | Type | Description | Examples |
|---|---|---|---|
| string | resource experimental |
The cicd namespace contains information about Continuous Integration and Continuous Deployment systems.
| Attribute | Type | Description | Examples |
|---|---|---|---|
| string | experimentalThe identifier of the deployment. |
|
| string | experimentalThe name of the deployment. |
|
| string | experimentalThe destination namespace where the deployment resource is created. |
|
| string | experimentalThe name of the deployment environment, also known as deployment tier. |
|
| string | experimentalThe deployment server URL. |
|
| string | experimentalThe identifier of the service that is deployed. |
|
| string | experimentalThe status of the deployment. |
|
| string | experimentalThe CI/CD pipeline's identifier, which is unique within one CI/CD system. |
|
| string | experimentalThe human-readable name of the CI/CD pipeline. |
|
| string | experimentalAn identifier for a pipeline run, which is unique within one CI/CD system. |
|
| string | experimentalThe outcome of one pipeline run. |
|
| duration | experimentalHow long was the pipeline run queued before it was started, in nanoseconds. |
|
| string | experimentalThe URL pointing to one specific pipeline run. |
|
| string | experimentalThe CI/CD pipeline's full URL. |
|
| string | experimentalThe identifier of the upstream CI/CD pipeline. If a pipeline run was triggered by another pipeline, this attribute is used to reference the triggering pipeline. |
|
| string | experimentalThe identifier of the upstream CI/CD pipeline run. If a pipeline run was triggered by another pipeline, this attribute is used to reference the triggering pipeline run. |
|
cicd.deployment.status has the following list of well-known values. If one of them applies, then the respective value MUST be used, otherwise a custom value MAY be used.
| Value | Description | Display name |
|---|---|---|
| The deployment failed. | Failed |
| The deployment succeeded. | Succeeded |
cicd.pipeline.run.outcome has the following list of well-known values. If one of them applies, then the respective value MUST be used, otherwise a custom value MAY be used.
| Value | Description | Display name |
|---|---|---|
| The pipeline run was canceled and did not complete. | Canceled |
| The pipeline run failed with an error. | Error |
| The pipeline run failed. | Failure |
| The pipeline did not run, but was skipped. | Skipped |
| The pipeline run completed successfully. | Success |
| The pipeline run timed out, and therefore did not complete. | Timed Out |
| The pipeline run completed with at least one warning. | Warning |
The client namespace contains information on the initiator of a network connection.
When observered from the server side, and when communicating through an intermediary,
client.ip and client.port typically represent the client information behind any intermediaries (such as proxies) if it's available.
| Attribute | Type | Description | Examples |
|---|---|---|---|
| string | experimentalClient address - domain name if available without reverse DNS lookup; otherwise, IP address or Unix domain socket name. |
|
| string | experimentalThe name of the client application used to perform the request. |
|
| ipAddress | experimentalThe IP address of the client that makes the request. This can be IPv4 or IPv6.Tags: |
|
| boolean | experimentalIndicates whether IP is a public IP. |
|
| string | experimentalThe name of the Internet Service Provider (ISP) associated with the client's IP address. |
|
| long | stableClient port number. |
|
Fields related to cloud deployments that can be used across different providers.
Fields related to cloud deployments that can be used across different providers.
| Attribute | Type | Description | Examples |
|---|---|---|---|
| string | resource deprecatedDeprecated in favor of cloud specific fields, such as aws.account.id, azure.subscription, gcp.project.id, etc. |
|
| string | resource deprecatedDeprecated in favor of cloud specific fields, such as aws.availability_zone, azure.availability_zones, gcp.zone, etc. |
|
| string | resource deprecatedDeprecated, no replacement available. 1 |
|
| string | resource stableName of the cloud provider. |
|
| string | resource deprecatedDeprecated in favor of cloud specific fields, such as aws.region, azure.location, gcp.region, etc. |
|
| string | resource deprecatedDeprecated in favor of cloud specific fields, such as aws.arn, azure.resource.id, gcp.resource.name, etc. |
|
The prefix of the service matches the one specified in cloud.provider.
cloud.platform MUST be one of the following:
| Value | Description | Display name |
|---|---|---|
| Alibaba Cloud Elastic Compute Service | Alibaba Cloud ECS |
| Alibaba Cloud Function Compute | Alibaba Cloud FC |
| Red Hat OpenShift on Alibaba Cloud | Alibaba Cloud OpenShift |
| AWS App Runner | AWS App Runner |
| AWS Elastic Compute Cloud | AWS EC2 |
| AWS Elastic Container Service | AWS ECS |
| AWS Elastic Kubernetes Service | AWS EKS |
| AWS Elastic Beanstalk | AWS Elastic Beanstalk |
| AWS Lambda | AWS Lambda |
| Red Hat OpenShift on AWS (ROSA) | AWS OpenShift |
| Azure Kubernetes Service | Azure AKS |
| Azure App Service | Azure App Service |
| Azure Container Instances | Azure Container Instances |
| Azure Functions | Azure Functions |
| Azure Red Hat OpenShift | Azure OpenShift |
| Azure Virtual Machines | Azure VMs |
| Google Cloud App Engine (GAE) | GCP App Engine |
| Google Cloud Functions (GCF) | GCP Cloud Functions |
| Google Cloud Run | GCP Cloud Run |
| Google Cloud Compute Engine (GCE) | GCP Compute Engine |
| Google Cloud Kubernetes Engine (GKE) | GCP GKE |
| Red Hat OpenShift on Google Cloud | GCP OpenShift |
| Red Hat OpenShift on IBM Cloud | IBM Cloud OpenShift |
| Tencent Cloud Cloud Virtual Machine (CVM) | Tencent Cloud CVM |
| Tencent Cloud Elastic Kubernetes Service (EKS) | Tencent Cloud EKS |
| Tencent Cloud Serverless Cloud Function (SCF) | Tencent Cloud SCF |
cloud.provider has the following list of well-known values. If one of them applies, then the respective value MUST be used, otherwise a custom value MAY be used.
| Value | Description | Display name |
|---|---|---|
| Alibaba Cloud | Alibaba Cloud |
| Amazon Web Services | AWS |
| Microsoft Azure | Azure |
| Google Cloud Platform | GCP |
| Heroku Platform as a Service | Heroku |
| IBM Cloud | IBM Cloud |
| Tencent Cloud | Tencent Cloud |
The cloud.target group provides information on the entity targeted by outgoing requests.
| Attribute | Type | Description | Examples |
|---|---|---|---|
| string | experimentalThe cloud account ID used to access a cloud resource. |
|
| string | experimentalName of the cloud provider. |
|
| string | experimentalIdentifier of the cloud vendor's data center geographic region. |
|
| string | experimentalCloud provider-specific native identifier of the accessed cloud resource (for example, an ARN on AWS, a fully qualified resource ID on Azure, or a complete resource name on GCP). If the value is not directly extractable for instrumentation, it can be constructed from its components. |
|
cloud.target.provider has the following list of well-known values. If one of them applies, then the respective value MUST be used, otherwise a custom value MAY be used.
| Value | Description | Display name |
|---|---|---|
| Alibaba Cloud | Alibaba Cloud |
| Amazon Web Services | AWS |
| Microsoft Azure | Azure |
| Google Cloud Platform | GCP |
| Heroku Platform as a Service | Heroku |
| IBM Cloud | IBM Cloud |
| Tencent Cloud | Tencent Cloud |
The cloud.origin group provides information on the entity from which incoming requests originate.
| Attribute | Type | Description | Examples |
|---|---|---|---|
| string | experimentalThe cloud account ID used to access a cloud resource. |
|
| string | experimentalName of the cloud provider. |
|
| string | experimentalIdentifier of the cloud vendor's data center geographic region. |
|
| string | experimentalCloud provider-specific native identifier of the accessed cloud resource (for example, an ARN on AWS, a fully qualified resource ID on Azure, or a complete resource name on GCP). If the value is not directly extractable for instrumentation, it can be constructed from its components. |
|
cloud.origin.provider has the following list of well-known values. If one of them applies, then the respective value MUST be used, otherwise a custom value MAY be used.
| Value | Description | Display name |
|---|---|---|
| Alibaba Cloud | Alibaba Cloud |
| Amazon Web Services | AWS |
| Microsoft Azure | Azure |
| Google Cloud Platform | GCP |
| Heroku Platform as a Service | Heroku |
| IBM Cloud | IBM Cloud |
| Tencent Cloud | Tencent Cloud |
| Attribute | Type | Description | Examples |
|---|---|---|---|
| string | resource experimental | |
| string | resource experimental | |
| string | resource experimental | |
| string | resource experimental | |
| string | resource experimental |
| Attribute | Type | Description | Examples |
|---|---|---|---|
| string | experimentalThe call stack of the |
|
| string | experimentalThe source code file name that identifies the code unit as uniquely as possible. |
|
| string | experimentalThe method or function name, or equivalent (usually the rightmost part of the code unit's name). Represents the name of the function that is represented by this span. |
|
| string | experimentalLike |
|
| string | experimentalLike |
|
| string | experimentalLike |
|
| long | experimentalThe line number within the source code file. |
|
| string | experimentalThe namespace within which |
|
| Attribute | Type | Description | Examples |
|---|---|---|---|
| string | resource experimental | |
| string | resource experimental |
For some technologies compilation of code might be a significant contributor to request execution time. Compilation timings provide insight into this, where available.
| Attribute | Type | Description | Examples |
|---|---|---|---|
| long | experimentalThe number of compilations contributing to |
|
| duration | experimentalThe total duration in nanoseconds spent compiling. |
|
| record | experimentalThe top N compilations contributing to |
|
| Attribute | Type | Description | Examples |
|---|---|---|---|
| string | resource experimentalContainer ID. Usually a UUID, as for example used to identify Docker containers. The UUID might be abbreviated. |
|
| string | resource experimentalImmutable SHA‑256 hash of an image that uniquely identifies the exact image content in a registry. |
|
| string | resource experimentalName of the image the container was built on. |
|
| string | resource experimental |
|
| string | resource experimentalContainer name used by container runtime. |
|
| string | resource experimentalRuntime used to run the container. |
|
CTG (shorthand for "CICS Transaction Gateway") is a connector for enterprise modernization of CICS assets. It empowers various application platforms, such as Java servlets, to incorporate CICS programs.
CICS (shorthand for "Customer Information Control System") is a middleware to support rapid, high-volume online transaction processing on IBM mainframe systems on z/OS. CTG features a client and a server, which communicate via so-called GatewayRequests.
| Attribute | Type | Description | Examples |
|---|---|---|---|
| long | experimentalInteger representing the call type of the CTG GatewayRequest. The set of possible values varies per request type. 1 |
|
| long | experimentalLength of the COMMAREA. Only set when the request type is ECI. |
|
| long | experimentalInteger representing the extended mode of the CTG GatewayRequest. Only set when the request type is ECI. 2 |
|
| long | experimentalInteger representing the flow type of the CTG GatewayRequest. 3 |
|
| string | experimentalURL of the gateway. Only set on client-side spans. |
|
| string | experimentalName of the request object. Only set when the request type is ADMIN. | |
| string | experimentalID of the server. Not set for all request types. |
|
| string | experimentalName of the terminal resource. Only set when the request type is EPI. |
|
| string | experimentalType of the CTG GatewayRequest. |
|
| long | experimentalCTG response code. The set of possible values varies per request type. 4 |
|
The values are defined in the IBM CTG API source code.
ctg.request.type MUST be one of the following:
| Value | Description | Display name |
|---|---|---|
| Admin request. | Admin |
| Authentication request. | Authentication request |
| Base. A base GatewayRequest without a further subtype. 1 | Base |
| External Call Interface. Enables a client application to call a CICS program synchronously or asynchronously. 2 | External Call Interface |
| External Presentation Interface. Enables a user application to install a virtual IBM 3270 terminal into a CICS server. 3 | External Presentation Interface |
| External Security Interface. Enables user applications to perform security-related tasks. 4 | External Security Interface |
| CICS Request Exit. It can be used for request retry, dynamic server selection, and rejecting non-valid requests. 5 | CICS Request Exit |
| Attribute | Type | Description | Examples |
|---|---|---|---|
| string | experimentalThe service method of a custom service. This field only exists if a custom service was created via Dynatrace OneAgent SDK. |
|
| string | experimentalThe name of a custom service. This field only exists if a custom service was created via Dynatrace OneAgent SDK. |
|
| Attribute | Type | Description | Examples |
|---|---|---|---|
| long | experimentalThe number of items (rows, documents,…) affected. |
|
| string | stableThe name of a collection (table, container) within the database. |
|
| string | experimentalThe connection string for a database connection.Tags: |
|
| double | experimentalThe cost of the request in Azure Cosmos DB request units (RU). |
|
| string[] | experimentalThe list of tables the request targets. |
|
| string | stableThe name of the database, fully qualified within the server address and port. |
|
| string | stableThe name of the operation or command executed, for example the MongoDB command name, SQL keyword, Redis command name,… 1 |
|
| record[] | experimentalThe query parameters used in db.query.text represented as a key and value map. For database systems without named keys, the map key is the string representation of the index starting with 0. Several database requests may get aggregated into a single span. Each entry in the array holds the bind parameters for one database request.Tags: |
|
| string | stableThe database query being executed. 2 |
|
| duration | experimentalThe maximum duration in nanoseconds used for fetching the result. |
|
| duration | experimentalThe minimum duration in nanoseconds used for fetching the result. |
|
| duration | experimentalThe total duration in nanoseconds used for fetching the result. |
|
| long | experimentalThe number of exceptions encountered while fetching the result. |
|
| long | experimentalThe number of operations executed on the result (for example, fetches from SQL result set, MongoDB cursor operations). |
|
| long | experimentalThe number of items requested in fetching query results. |
|
| long | experimentalThe number of round-trips triggered by fetching the result. |
|
| string | experimentalAn identifier for the database management system (DBMS) product being used. See below for a list of well-known identifiers. |
|
Depending on the data provided on ingest, this attribute may be derived by e.g., parsing db.query.text. Parsing might fail, or the result might be inaccurate.
The value may be sanitized to exclude sensitive information.
db.system has the following list of well-known values. If one of them applies, then the respective value MUST be used, otherwise a custom value MAY be used.
| Value | Description | Display name |
|---|---|---|
| Adabas (Adaptable Database System) | Adabas |
| Amazon DocumentDB | DocumentDB |
| Amazon Aurora MySQL | Aurora MySQL |
| Amazon Aurora PostgreSQL | Aurora PostgreSQL |
| InterSystems Caché | InterSystems Caché |
| Apache Cassandra | Cassandra |
| ClickHouse | ClickHouse |
| Cloudscape | Cloudscape |
| CockroachDB | CockroachDB |
| ColdFusion IMQ | ColdFusion IMQ |
| Microsoft Azure Cosmos DB | Cosmos DB |
| Couchbase | Couchbase |
| CouchDB | CouchDB |
| Databricks Data Platform | Databricks Data Platform |
| IBM Db2 | IBM Db2 |
| Apache Derby | Derby |
| IBM DL/I | IBM DL/I |
| Amazon DynamoDB | DynamoDB |
| EnterpriseDB | EnterpriseDB |
| Elasticsearch | Elasticsearch |
| FileMaker | FileMaker |
| Firebird | Firebird |
| FirstSQL | FirstSQL |
| Apache Geode | Geode |
| H2 | H2 |
| SAP HANA | SAP HANA |
| Apache HBase | HBase |
| Apache Hive | Hive |
| HyperSQL DataBase | HSQLDB |
| Informix | Informix |
| Ingres | Ingres |
| InstantDB | InstantDB |
| InterBase | InterBase |
| Amazon Keyspaces for Apache Cassandra | Keyspaces |
| MariaDB | MariaDB |
| SAP MaxDB | SAP MaxDB |
| Memcached | Memcached |
| MongoDB | MongoDB |
| Microsoft SQL Server | SQL Server |
| Microsoft SQL Server Compact | SQL Server Compact |
| MySQL | MySQL |
| Neo4j | Neo4j |
| Amazon Neptune | Neptune |
| Netezza | Netezza |
| OpenSearch | OpenSearch |
| Oracle Database | Oracle |
| Some other SQL database. Fallback only. See notes. | Other SQL |
| Pervasive PSQL | Pervasive PSQL |
| Apache Phoenix | Apache Phoenix |
| PointBase | PointBase |
| PostgreSQL | PostgreSQL |
| Progress Database | Progress |
| Redis | Redis |
| Amazon Redshift | Redshift |
| Snowflake Data Platform | Snowflake Data Platform |
| Cloud Spanner | Cloud Spanner |
| SQLite | SQLite |
| Sybase | Sybase |
| Teradata | Teradata |
| Valkey | Valkey |
| Vertica | Vertica |
| Attribute | Type | Description | Examples |
|---|---|---|---|
| string | resource experimentalThe build version of the deployed product. |
|
| string | resource experimentalThe name of the deployed product. |
|
| string | resource experimentalThe stage the product is deployed to. |
|
| string | resource experimentalThe version of the deployed product. |
|
The device namespace contains information on the device running an application. This should only be used for end-user devices or devices outside of a private infrastructure. In line with the naming conventions and guidelines, we are in this case adhering to the emerging Open Telemetry convention around this, with some additions.
| Attribute | Type | Description | Examples |
|---|---|---|---|
| long | experimentalThe device's battery level in the range 0% (discharged) to 100% (fully charged). |
|
| string | experimentalThe device orientation. |
|
device.orientation MUST be one of the following:
| Value | Description | Display name |
|---|---|---|
| The device was in landscape mode. | Landscape |
| The device was in portrait mode. | Portrait |
| Attribute | Type | Description | Examples |
|---|---|---|---|
| boolean | resource experimentalIf set to |
|
| string | resource experimentalThe device manufacturer. |
|
| string | resource experimentalThe device model identifier. |
|
| long | resource experimentalThe device's screen height in its natural orientation. |
|
| long | resource experimentalThe device's screen width in its natural orientation. |
|
Fields describing a disk.
| Attribute | Type | Description | Examples |
|---|---|---|---|
| string[] | resource experimentalList of all mountpoints |
|
| string | resource experimentalDisk device name (Linux, AIX) |
|
| string | resource experimentalPrimary mountpoint |
|
| string | resource experimentalThe name of the Smartscape disk. |
|
| long | resource stableUnique identifier of remote disk |
|
| Attribute | Type | Description | Examples |
|---|---|---|---|
| string | experimentalThe name of the program communication block associated with this DL/I method. |
|
| string | experimentalThe PCB type. |
|
| string | experimentalThe PCB processing options. |
|
| string | experimentalThe hierarchical level of the segment that was matched or returned. |
|
| string | experimentalThe name of the last segment that was matched or returned. |
|
| string | experimentalThe DL/I status code. |
|
| string | experimentalThe DL/I database or logical terminal name associated with this DL/I method. |
|
db.dli.pcb_type MUST be one of the following:
| Value | Description | Display name |
|---|---|---|
| Data communications. | Data communications |
| DL/I db. | DL/I |
| Fast Path. | Fast Path |
| Attribute | Type | Description | Examples |
|---|---|---|---|
| string | resource experimentalFilename of main dotnet assembly. | |
| string | resource experimentalFilepath of main dotnet assembly. |
Metadata with ActiveGate related information.
| Attribute | Type | Description | Examples |
|---|---|---|---|
| string | resource experimentalThe name of a group that the ActiveGate instance belongs to. |
|
| string | resource experimentalHexadecimal identifier of the ActiveGate prefixed with |
|
| string | resource experimentalThe name of ActiveGate module |
|
| string | resource experimentalWorking mode of the ActiveGate |
|
dt.active_gate.working_mode MUST be one of the following:
| Value | Description | Display name |
|---|---|---|
| Cluster ActiveGate | Cluster |
| Embedded ActiveGate | Embedded |
| Environment ActiveGate | Environment |
| Multitenant ActiveGate | Multitenant |
| Attribute | Type | Description | Examples |
|---|---|---|---|
| string | resource experimentalConfig long id of the endpoint configuration as a string. |
|
| string | resource experimentalString identifier of an api connector pipeline |
|
| string | resource experimentalStatus of an api connector pipeline run |
|
| string | resource experimentalString identifier of an api connector technology |
|
dt.active_gate.api_connector.pipeline_status MUST be one of the following:
| Value | Description | Display name |
|---|---|---|
| Pipeline execution failed | Failure |
| Pipeline execution skipped | Skipped |
| Pipeline execution succeeded | Success |
Metadata of the OneAgent module that reported a signal. These attributes are what one would also see in OneAgent Health.
| Attribute | Type | Description | Examples |
|---|---|---|---|
| string | resource experimentalOneAgent installer version. |
|
| boolean | resource experimentalIndicates whether live debugging is enabled on this OneAgent. |
|
| string | resource experimentalDeployment properties of the OneAgent module. |
|
| boolean | resource experimentalTrue if FIPS deployment mode is enabled for the OneAgent module. |
|
| timestamp | resource experimentalTimestamp when the OneAgent module first made contact and was registered. |
|
| string | resource experimentalHealth status of the OneAgent module. |
|
| uid | resource stableOneAgent module ID. |
|
| string | resource experimentalInjection Mode of the OneAgent module. |
|
| record[] | resource experimentalList of issue objects detected for the OneAgent module. Each object contains the issue and severity level (CRITICAL, WARNING, or INFO). |
|
| string | resource experimentalName of a specific OneAgent module. |
|
| uid | resource stableOneAgent parent module ID, in case this is a so-called sub-agent. |
|
| timestamp | resource experimentalTimestamp when the OneAgent module was started up. Note that this is not necessarily the same as |
|
| string | resource stableOneAgent module type. |
|
| string | resource stableOneAgent full module version. |
|
| string | resource experimentalOneAgent short module version, to be expected only on record types where |
|
| string | resource experimentalMonitoring Mode in which the OneAgent module operates. |
|
dt.agent.module.health MUST be one of the following:
| Value | Description | Display name |
|---|---|---|
| The OneAgent module has critical issues that need immediate attention to ensure proper functionality. | Critical |
| The OneAgent module is functioning properly without any detected issues. | Healthy |
| The OneAgent module has informational messages that may require attention. | Info |
| The OneAgent module has warnings that indicate potential issues that should be investigated. | Warning |
dt.agent.module.injection_mode MUST be one of the following:
| Value | Description | Display name |
|---|---|---|
| The OneAgent module was automatically injected into the application/process. | Auto |
| The OneAgent module was manually injected or installed, requiring explicit user configuration or deployment. | Manual |
| The injection mode is not known or not determined yet. This is the default/fallback value. | Unknown |
dt.agent.module.type has the following list of well-known values. If one of them applies, then the respective value MUST be used, otherwise a custom value MAY be used.
| Value | Description | Display name |
|---|---|---|
| apache | Apache |
| dotnet | .NET |
| dumpproc | Dump Process |
| extensions | Extensions |
| go | Go |
| iis | IIS |
| java | Java |
| log_analytics | Log Analytics |
| net | .NET Framework |
| nettracer | Network Tracer |
| nginx | NGINX |
| nodejs | Node.js |
| opentracingnative | OpenTracing Native |
| os | OS |
| php | PHP |
| plugin | Plugin |
| process | Process |
| python | Python |
| remote_plugin | Remote Plugin |
| ruby | Ruby |
| sdk | SDK |
| support | Support |
| updater | Updater |
| varnish | Varnish |
| wsmb | WSMB |
| z_ | z/OS |
dt.agent.monitoring_mode MUST be one of the following:
| Value | Description | Display name |
|---|---|---|
| Discovery monitoring mode provides basic metrics enabling you to discover your hosts and processes and learn the potential to extend your monitoring. | Discovery |
| Full stack monitoring mode includes application performance, user experience data, code-level visbility and PurePath insights, as well as everything that is included in Infrastructure monitoring mode. | Full Stack |
| Infrastructure monitoring mode includes topology discovery, detailed health and performance monitoring of your host, and enables Network monitoring, Log monitoring and Extensions. | Infrastructure |
Fields defined in this namespace are used by Dynatrace to describe various aspects of events emitted by the AutomationEngine.
| Attribute | Type | Description | Examples |
|---|---|---|---|
| string | experimentalThe app ID of the app containing the executed action. |
|
| string | experimentalName of the function implementing the action. |
|
| string | experimentalThe unique identifier of a action execution as UUID. |
|
| long | experimentalLoop index of the action execution. | |
| long | experimentalRetry count of the action execution. | |
| boolean | experimentalIndicates whether the triggered workflow execution is based on a workflow draft. |
|
| string | experimentalThe unique identifier of the root workflow. |
|
| string | experimentalThe unique identifier of the execution of the root workflow. |
|
| string | experimentalThe state of an execution. Values depend on type of execution (workflow-, task-, or action execution). |
|
| boolean | experimentalIndicates if |
|
| string | experimentalAdditional info about current state of execution. Typically holds error details. |
|
| string | experimentalThe identifier of a task within a workflow. |
|
| string | experimentalThe unique identifier of a task execution as UUID. |
|
| long | experimentalThe workflow execution per hour limit that has been reached. |
|
| string | experimentalThe unique identifier of a workflow as UUID. |
|
| boolean | experimentalIndicates if the workflow execution state has changed since the last execution, ignoring draft executions. Always false for draft executions. |
|
| string | experimentalThe title of the workflow. |
|
| string | experimentalWorkflow type, either SIMPLE or STANDARD, where SIMPLE comes with restrictions. |
|
| string | experimentalThe unique identifier of the actor as defined in the workflow. |
|
| string | experimentalThe unique identifier of a workflow execution as UUID. |
|
| string | experimentalUnique identifier string ( |
|
| timestamp | experimentalThe timestamp of the event that triggered the workflow execution. |
|
| string | experimentalThe identifier that describes the trigger of the workflow. |
|
| string | experimentalThe unique identifier of the user who triggered the workflow execution manually/via API. |
|
| string | experimentalThe unique identifier of the workflow that triggered the workflow execution. |
|
Attributes defined in this namespace are used by Dynatrace to describe different aspects of the ingested data.
| Attribute | Type | Description | Examples |
|---|---|---|---|
| string | experimentalARN of AWS Data Firehose signal is originating from. |
|
| string | experimentalName of the source Amazon CloudWatch Log group |
|
| string | experimentalName of the source Amazon CloudWatch Log stream |
|
| string | experimentalName of S3 bucket name signal is originating from |
|
| string | experimentalName of S3 bucket name signal is originating from |
|
| string | experimentalThe location of the Event Hub that the signal is originating from |
|
| string | experimentalThe resource ID of the Event Hub that the signal is originating from |
|
| string | experimentalDynatrace source of signal ingestion |
|
dt.da.source has the following list of well-known values. If one of them applies, then the respective value MUST be used, otherwise a custom value MAY be used.
| Value | Description | Display name |
|---|---|---|
| aws-log-ingest | AWS Log Ingest |
| aws-metric-poller | AWS Metric Poller |
| aws-metrics-ingest | AWS Metrics Ingest |
Some attributes are used in the context of the Davis engine.
These fields can be set by Davis routines.
| Attribute | Type | Description | Examples |
|---|---|---|---|
| long | stableBoolean time series of 0 and 1 showing whether a single timespan was alerted due to continuous violations. | |
| long | stableBoolean timeseries of 0 and 1 showing whether a single timespan is outside the normal value range and therefore considered as abnormal. | |
| long | stableThe lower value range limit where any value below this point is considered abnormal. | |
| long | stableThe upper value range limit where any value above this point is considered abnormal. | |
| long | stableThe lower bound of the prediction interval of a given metric forecast. | |
| long | stableThe point value of a metric forecast. | |
| long | stableThe upper bound of the prediction interval of a given metric forecast. |
Fields that can be expected on a Dynatrace span where endpoint detection was applied.
| Attribute | Type | Description | Examples |
|---|---|---|---|
| uid | experimentalThe ID of the endpoint detection rule that was applied to that span. |
|
The dt.enrichment namespace contains fields related to Dynatrace apps and app functions that are used for security intelligence enrichment execution.
| Attribute | Type | Description | Examples |
|---|---|---|---|
| duration | experimentalThe duration of the enrichment execution in nanoseconds. |
|
| string | experimentalThe identifier of the connection settings object used to execute the enrichment. The connection settings object ID refers to the connection in the settings section of the integration app. |
|
| string | experimentalThe unique application identifier of the integration app that provided the enrichment functionality. Dynatrace apps are prefixed with 'dynatrace.', custom apps are prefixed with 'my.'. |
|
| string | experimentalThe integration method ID of the integration app used to execute the enrichment. |
|
| boolean | experimentalIndicates whether the enrichment execution result was retrieved from the cache. |
|
The Dynatrace OneAgent associates monitoring data with a so called Monitored Entity ID (ME ID). On OneAgent monitored environments, whenever ME IDs are accessible within the monitored system they should be used to enrich monitoring data to facilitate correlations with data primarily addressed through ME IDs coming from other channels.
The structure for keys that signify entity IDs is dt.entity.{type of entity}.
The value associated with such a key must be valid Dynatrace entity identifier
(see Monitored entities API).
To allow linking Entity IDs across various different monitoring artifacts (logs, metrics, etc.), all string representations of Entity IDs are required to follow a canonical form, which for all current entities is defined as PREFIX-0123456789ABCDEF.
Consumers should treat the token as an opaque value and must not infer any semantics on the ID itself. Producers need to match the Entity ID that is being returned by Dynatrace Entity API verbatim.
Producers of string representation must treat the string as if it was parsed case-sensitively, even though some parts of the product may be more lenient.
The structure of the entity ID is currently as follows: <ID-NAMESPACE>-<16-digit-hex-string>. The <ID-NAMESPACE> is type specific but cannot be used to determine the actual entity type reliably, especially in cases of CUSTOM_DEVICE. The <16-digit-hex-string> needs to be zero-padded (prefix) to a length of 16 digits and must use upper case letters A-F.
Current entity IDs in cannonical form can be represented structurally with the following regular expression: [A-Z][A-Z_]*-[0-9A-F]{16}.
Additional characters or changes in the format may happen in the future but will not invalidate existing IDs or ID generation rules.
When adding a name to an entity ID via the Grail function entityName, by default, the name of the respective entity will be represented as dt.entity.{type of entity}.name. Similarly, further entity attributes can be added via the Grail function entityAttr, resulting in additional field(s) following the naming convention dt.entity.{type of entity}.{name of attribute}.
| Attribute | Type | Description | Examples |
|---|---|---|---|
| string | resource stableThe ME ID of a web application.Tags: |
|
| string | resource stableAn entity ID of an entity of type AWS_AVAILABILITY_ZONETags: |
|
| string | resource stableAn entity ID of an entity of type AZURE_REGIONTags: |
|
| string | resource stableAn entity ID of an entity of type AZURE_VMTags: |
|
| string | resource stableAn entity ID of an entity of type CLOUD_APPLICATION.Tags: |
|
| string | resource stableAn entity ID of an entity of type CLOUD_APPLICATION_INSTANCE.Tags: |
|
| string | resource stableAn entity ID of an entity of type CLOUD_APPLICATION_NAMESPACE. A CLOUD_APPLICATION_NAMESPACE is a Kubernetes namespace.Tags: |
|
| string | resource stableAn entity ID of an entity of type CONTAINER_GROUP.Tags: |
|
| string | resource stableAn entity ID of an entity of type CONTAINER_GROUP_INSTANCE.Tags: |
|
| string | resource stableThe ME ID of a custom application.Tags: |
|
| string | resource stableAn entity ID of an entity of type CUSTOM_DEVICE.Tags: |
|
| string | resource experimentalThe ME ID of a device application. |
|
| string | resource stableAn entity ID of an entity of type DISKTags: |
|
| string | resource stableAn entity ID of an entity of type EC2_INSTANCETags: |
|
| string | resource stableAn entity ID of an entity of type EXTERNAL_SYNTHETIC_TEST.Tags: |
|
| string | resource stableAn entity ID of an entity of type EXTERNAL_SYNTHETIC_TEST_STEP.Tags: |
|
| string | resource stableAn entity ID of an entity of type GCP_ZONETags: |
|
| string | resource stableAn entity ID of an entity of type HOST.Tags: |
|
| string | resource stableAn entity ID of an entity of type HOST_GROUP.Tags: |
|
| string | resource stableAn entity ID of an entity of type HTTP_CHECK.Tags: |
|
| string | resource stableAn entity ID of an entity of type HTTP_CHECK_STEP.Tags: |
|
| string | resource stableAn entity ID of an entity of type KUBERNETES_CLUSTER.Tags: |
|
| string | resource stableAn entity ID of an entity of type KUBERNETES_NODE.Tags: |
|
| string | resource stableAn entity ID of an entity of type KUBERNETES_SERVICE.Tags: |
|
| string | resource stableThe ME ID of a mobile application.Tags: |
|
| string | resource stableAn entity ID of an entity of type MULTIPROTOCOL_MONITOR.Tags: |
|
| string | resource stableAn entity ID of an entity of type NETWORK_INTERFACETags: |
|
| string | resource stableAn entity ID of an entity of type PROCESS_GROUP.Tags: |
|
| string | resource stableAn entity ID of an entity of type PROCESS_GROUP_INSTANCE.Tags: |
|
| string | resource stableAn entity ID of an entity of type SERVICE.Tags: |
|
| string | resource stableAn entity ID of an entity of type SERVICE_METHOD.Tags: |
|
| string | resource stableAn entity ID of an entity of type SERVICE_METHOD_GROUP.Tags: |
|
| string | resource stableAn entity ID of an entity of type SOFTWARE_COMPONENT.Tags: |
|
| string | resource stableAn entity ID of an entity of type SYNTHETIC_LOCATION.Tags: |
|
| string | resource stableAn entity ID of an entity of type SYNTHETIC_TEST.Tags: |
|
| string | resource stableAn entity ID of an entity of type SYNTHETIC_TEST_STEP.Tags: |
|
Additional extension information sent via self-monitoring.
| Attribute | Type | Description | Examples |
|---|---|---|---|
| string | resource experimentalExtension's monitoring configuration identifier. |
|
| string | resource experimentalExtension controller pod UID. 1 |
|
| string | resource experimentalName of the data source. |
|
| string[] | resource experimentalHints to provide for the cluster in order to find proper endpoint in task registry. |
|
| string | resource experimentalExtension executor pod UID. 2 |
|
| string | resource experimentalName of the extension. |
|
| string | resource experimentalVersion of the Python runtime version used by extension. |
|
| string | resource experimentalThe status of the component reporting a self-monitoring event. |
|
| string | resource experimentalVersion of the extension. |
|
This attribute is only set when the extension is running in a Kubernetes environment.
This attribute is only set when the extension is running in a Kubernetes environment.
dt.extension.status has the following list of well-known values. If one of them applies, then the respective value MUST be used, otherwise a custom value MAY be used.
| Value | Description | Display name |
|---|---|---|
| Unable to connect to EEC | Authentication Error |
| Failed to establish connection with the device | Device Connection Error |
| Unable to connect to EEC | EEC Connection Error |
| Generic status used to communicate job failed | Generic Error |
| Invalid arguments | Invalid Arguments |
| Config provided by EEC is invalid | Invalid Config |
| Extension works fine | OK |
| Uninitialized/unknown error | Unknown Error |
Attributes defined in this namespace are used by Dynatrace to describe different aspects of the ingested data.
| Attribute | Type | Description | Examples |
|---|---|---|---|
| string[] | experimentalAn array of strings that represent debug messages that provide a detailed debugging information. That could include even variable parts, like which attribute was modified, or which processing rules were applied. |
|
| string | experimentalThe format of the data ingested in Dynatrace via the various ingest channels. E.g., Generic log ingest, OTLP logs ingest |
|
| string | experimentalOrigin of the data ingested in Dynatrace. |
|
| long | stableThe size of the ingested data point in bytes. |
|
| string[] | experimentalAn array of strings representing markers of unexpected situations that might affect the correctness or completeness of incoming data points. It might be, for instance, limits applied or a processing rule failing. It should not be a detailed log of what happened, just the high-level class of the issue that occurred. |
|
dt.ingest.format MUST be one of the following:
| Value | Description | Display name |
|---|---|---|
| JSON data ingested via the Dynatrace APIs or via EEC (Extension Execution Controller) | DT API JSON |
| (deprecated: use "plaintext") Plain text data ingested via the Dynatrace API | DT API Plaintext |
| Journald data ingested via OneAgent | Journald |
| OpenTelemetry Protocol (OTLP) JSON data ingested via the Dynatrace APIs | OTLP JSON |
| OpenTelemetry Protocol (OTLP) Protobuf data ingested via the Dynatrace APIs or via EEC (Extension Execution Controller) | OTLP Protobuf |
| Plain text data ingested via the Dynatrace APIs, EEC (Extension Execution Controller) or OneAgent | Plaintext |
| Syslog data ingested via OneAgent or via EEC (Extension Execution Controller) | Syslog |
| The data format was not recognized (only for metrics dimension) | Unknown |
| Windows event log data ingested via OneAgent | Windows Event Log |
dt.ingest.warnings MUST contain only values from the following list:
| Value | Description |
|---|---|
| The content was trimmed, right after receiving it by Cluster/ActiveGate, because it exceeded the event content max byte size limit. |
| The content was trimmed in post-processing (after applying processing rules) because it exceeded the event content max byte size limit |
| The number of attributes was trimmed, right after receiving it by Cluster/ActiveGate, because it exceeded the max number of attributes limit. |
| The number of attributes was trimmed in post-processing (after applying processing rules) because it exceeded the max number of attributes limit. |
| The attribute key is detected that matches the custom attribute key or the semantic attribute key, but there is the attribute key case mismatch. |
| The attribute key was trimmed, right after receiving it by Cluster/ActiveGate, because it exceeded the max key length limit. |
| At least one multi-value attribute had values number trimmed, right after receiving it by Cluster/ActiveGate, because it exceeded the max number of attributes limit. |
| After applying processing rules, at least one multi-value attribute had its values number trimmed (after using processing rules) because it exceeded the maximum number of attributes limit. |
| At least one attribute had its value size trimmed, right after receiving it by Cluster/ActiveGate, because it exceeded the max value size in bytes limit. |
| At least one attribute had its value size trimmed (after applying processing rules) because it exceeded the max value size in bytes limit. |
| Timestamp was too far in the future and was corrected to current time. |
| STATUS, LOG_LEVEL or EVENT_TYPE attribute was corrected. |
| Batch timeout occurred during processing pipeline. |
| Execution timeout in one of processing transformers occurred during processing pipeline. |
| Execution error in one of processing transformers occurred during processing pipeline. |
| Execution throttled in one of processing transformers during processing pipeline. |
| Output conversion error occurred for some record during processing pipeline. |
| Prepare input error occurred in one of enabled processing pipeline rules. |
| Attribute | Type | Description | Examples |
|---|---|---|---|
| string | resource stableCan be used to assign usage to a Cost Center. |
|
| string | resource stableCan be used to assign usage to a Product or Application ID. |
|
| string | resource stableSee Organize your environment using host groups. Note that host groups are identified by their name, not by the entity ID of the host group entity. For details on the entity ID, see |
|
| string | resource experimentalThe source from which metrics are ingested. 1 |
|
| string | resource experimentalThe ID of the network zone. See Dynatrace Documentation |
|
| string | resource experimentalID of the forwarding configuration in OpenPipeline. |
|
| string | resource experimentalForwarded datatype |
|
| string | resource experimental | |
| string | resource experimentalalso see Define metadata via environment variables | |
| string | resource experimental | |
| string | resource experimental | |
| string | resource experimental | |
| string | resource stableThe name of the process group as it was detect by the agent. |
|
| string | resource experimentalThe identifier shared by all entities belonging to a given process group. |
|
| string | resource stableThe security context is used in access permissions to limit the visibility. Learn more about the Dynatrace permission modelTags: | |
| smartscapeId | resource stableThe ID of the entity considered the source of the signal. The string represents an entity ID of an entity that is stored in the Smartscape storage. 2Tags: |
|
| string | resource stableThe entity type of the entity whose identifier is held in dt.smartscape_source.id. |
|
| string | resource stableThe ID of the entity considered the source of the signal. The string represents an entity ID of an entity that is stored in the classic entity storage. 3Tags: |
|
| string | resource stableThe entity type of the entity whose identifier is held in dt.source_entity. The value must be a valid entity type and consistent with |
|
This is the framework used for capturing, processing and forwarding metrics, not the emitting monitored entity. Exemplary custom value: name of an extension sending metrics.
The value of this field will be based on the value of one of the dt.smartscape.<type> fields. That means that the dt.smartscape_source.id and dt.smartscape.<type> fields will both be set to the same ID.
The value of this field will be based on the value of one of the dt.entity.<type> fields. This means that the dt.source_entity and dt.entity.<type> fields will both be set to the same ID.
dt.metrics.source has the following list of well-known values. If one of them applies, then the respective value MUST be used, otherwise a custom value MAY be used.
| Value | Description | Display name |
|---|---|---|
| dynatrace_codemodule | Dynatrace Code Module |
| dynatrace_ingest | Dynatrace Ingest |
| OsAgent | Dynatrace OS Agent |
| Micrometer | Micrometer |
| OneAgentMetricAPI | OneAgent Metric API |
| OpenTelemetry | OpenTelemetry |
| StatsD | StatsD |
| Telegraf | Telegraf |
| Attribute | Type | Description | Examples |
|---|---|---|---|
| boolean | experimentalIndicates that the underlying container of the data point should be considered in Container Application Monitoring license. Set to |
|
| array | experimentalUUIDs of maintenance windows. |
|
| string | experimentalA query in the DQL format, see Dynatrace Query Langauge. |
|
| string | experimentalThe complete content of the record as it was originally accepted by Dynatrace, stored as a string in JSON format. This field captures the unaltered data for reference, debugging, or auditing purposes |
|
Fields defined in this namespace are used by Dynatrace to describe various aspects of the data ingested through OpenPipeline, providing detailed insights into the ingestion process.
| Attribute | Type | Description | Examples |
|---|---|---|---|
| string[] | resource experimentalCollects the identifiers of all pipelines through which a record has passed during the ingestion process in OpenPipeline, providing a complete trace of its journey. |
|
| string | resource experimentalIdentifies the source (such as API endpoints or OneAgent) used for ingesting the record into OpenPipeline. |
|
| string | resource experimentalIdentifies the source type used to ingest data in Dynatrace, for example, from OTLP and OneAgent. |
|
dt.openpipeline.source_type MUST be one of the following:
| Value | Description | Display name |
|---|---|---|
| Logs ingested via one of the ActiveGate APIs | API |
| Logs ingested via Amazon Data Firehose | AWS Firehose |
| Logs ingested via the EEC running on host | Extension |
| Logs ingested via OneAgent | OneAgent |
| Logs ingested via the OpenTelemetry Protocol (OTLP) | OTLP |
| The source type was not recognized (only for metrics dimension) | Unknown |
| Attribute | Type | Description | Examples |
|---|---|---|---|
| boolean | **deprecatedAvailable only for 2nd gen clusters. Replaced with | |
| string | **deprecatedAvailable only for 2nd gen clusters. Replaced with |
|
dt.osservice.status MUST be one of the following:
| Value | Description | Display name |
|---|---|---|
| Service is activating. | Activating |
| Service is active. | Active |
| Service continues pending. | Continue Pending |
| Service is deactivating. | Deactivating |
| Service failed to start. | Failed |
| Service is inactive. | Inactive |
| Service paused pending. | Pause Pending |
| Service is currently paused. | Paused |
| Service is reloading. | Reloading |
| Service is currently running. | Running |
| Service started pending. | Start Pending |
| Service stopped pending. | Stop Pending |
| Service is currently stopped. | Stopped |
| Attribute | Type | Description | Examples |
|---|---|---|---|
| string | resource **deprecatedAvailable only for 2nd gen clusters. Replaced with |
|
| string | resource **deprecatedAvailable only for 2nd gen clusters. Replaced with |
|
| string | resource **deprecatedAvailable only for 2nd gen clusters. Replaced with |
|
| string | resource **deprecatedAvailable only for 2nd gen clusters. Replaced with |
|
| string | resource **deprecatedAvailable only for 2nd gen clusters. Replaced with |
|
dt.osservice.startup_type MUST be one of the following:
| Value | Description | Display name |
|---|---|---|
| Windows specific. Automatic: The service starts at system logon. | Auto |
| Windows specific. Automatic (Delayed Start): The service starts a short while after the system has finished starting up. | Auto Delay |
| Windows specific. Automatic (Delayed Start, Trigger Start) | Auto Delay Trigger |
| Windows specific. Automatic (Trigger Start): This service will start automatically at boot. | Auto Trigger |
| Linux specific. Service is configured to not start when the system boots, but can be started manually, or as a dependency of another service. | Disabled |
| Linux specific. Service is marked for starting up on boot. | Enabled |
| Linux specific. Service is marked for starting up on boot. | Enabled Runtime |
| Linux specific. Service is not enabled directly but can be activated via dependencies or aliases. | |
| Linux specific. Service unit file is symlinked into systemd from an external location persistently. | |
| Linux specific. Service unit file is temporarily symlinked into systemd for the current runtime only. | |
| Windows specific. Manual: The service starts only when explicitly summoned. | Manual |
| Windows specific. Manual (Trigger Start): This service will not start automatically at boot. | Manual Trigger |
| Linux specific. Service is not enabled and can only start when pulled in by dependencies or started manually. | Static |
The dt.rum namespace contains Dynatrace RUM specific fields.
| Attribute | Type | Description | Examples |
|---|---|---|---|
| string | experimentalAn entity ID of an entity of type APPLICATION or MOBILE_APPLICATION.Tags: |
|
| string | stableThe Dynatrace RUM application ID. For mobile applications, a UUID is used. For web applications, an 8-byte HEX string is used. |
|
| string | experimentalA browser session identifier set and read by Dynatrace RUM. Used to correlate RUM Classic user actions with PurePaths during ingest. |
|
| boolean | experimentalIf set to 'true', it indicates that Dynatrace RUM captured a user event that can be linked to this trace. |
|
| string | stableA unique identifier for a user session. Use this field to join user events with user sessions in DQL queries. |
|
| record | **deprecatedReplaced with |
| Attribute | Type | Description | Examples |
|---|---|---|---|
| string | resource experimentalThe Dynatrace RUM agent type. |
|
| string | resource experimentalThe version of the Dynatrace RUM agent. It is provided in the format major.minor.patch.build. The build number is optional. |
|
| string | resource experimentalThe Dynatrace RUM source technology that produced this event. Only used by cross-platform implementations, otherwise the field is omitted. |
|
| string | resource stableA persistent pseudonymous identifier representing the same device (browser user agent or mobile app installation) across multiple user sessions. Used to analyze returning users and long-term journeys. Formerly known as "Visitor ID" or "internal user ID." For information on the real user identity, see |
|
| string | resource stableThe Dynatrace RUM enrichment version. |
|
| string | resource experimentalThe RUM user type. |
|
dt.rum.agent.type MUST be one of the following:
| Value | Description | Display name |
|---|---|---|
| OneAgent for Android | Android |
| OneAgent for iOS | iOS |
| RUM JavaScript | JavaScript |
dt.rum.event.source.type MUST be one of the following:
| Value | Description | Display name |
|---|---|---|
| Flutter | Flutter |
| React Native auto-instrumentation | React Native |
dt.rum.user_type MUST be one of the following:
| Value | Description | Display name |
|---|---|---|
| The user event was produced by a real user. | Real User |
| The user event was produced by a bot user. | Robot |
| The user event was produced by a synthetic test. | Synthetic |
The dt.rum.invalid namespace is used for fields that are removed because of user event ingest validation.
For example, if the calculated web_vitals.largest_contentful_paint value would be less than 0, the value is copied over to dt.rum.invalid.web_vitals.largest_contentful_paint and web_vitals.largest_contentful_paint is removed.
| Attribute | Type | Description | Examples |
|---|---|---|---|
| string | resource stableThe Dynatrace service name derived from service detection rules. It is equal to the Smartscape service node name. |
|
Fields for referencing Settings 2.0 objects, schemas and scopes.
Although the dt.settings.object_id is enough to identify a specific settings value within a dynatrace environment, adding explicit information about the schema, scope and/or scope type can be useful nonetheless. If your use-case will only ever involve a single schema, scope type and/or scope, documenting this is good enough - if multiple schemas, scope types and/or scopes can be involved, filling the corresponding fields is strongly recommended.
dt.settings.references can be used if multiple settings objects need to be referenced. In that case, each entry in the array can hold a reference to a single settings object.
The top level fields contain generally relevant information for all monitoring data.
| Attribute | Type | Description | Examples |
|---|---|---|---|
| string | experimentalThe object ID of a settings value. This corresponds to the 'objectId' field/parameter in the Settings API. |
|
| string | experimentalThe human-readable summary or name of a single value of a multi-value settings schema. This corresponds to the 'summary' field in the Settings API. |
|
| record[] | experimentalA collection of references to settings objects. Each entry in the array holds a reference to a single settings object. |
|
| string | experimentalThe type of relationship to the referenced settings object. You can use arbitrary values (in |
|
| string | experimentalThe schema ID of a settings schema, as used in the Settings APIs. |
|
| string | experimentalThe version of the schema referenced by dt.settings.schema_id, as declared by the schema itself. Typically a semantic version number. |
|
| string | experimentalThe ID of the scope that a settings object is persisted on. This corresponds to the 'scope' field/parameter in the Settings API. |
|
| string | experimentalThe human-readable name of the scope that a settings object is persisted on. |
|
| string | experimentalThe type of the scope that a settings object is persisted on. |
|
This namespace contains all field names that contain entitiy IDs that are stored in Smartscape on Grail. To ensure we can distinguish between classic entity IDs and Smartscape IDs, we use the dt.smartscape.* namespace to enrich entity IDs in signal data.
| Attribute | Type | Description | Examples |
|---|---|---|---|
| smartscapeId | resource stableA Smartscape ID that can be used to query entities from the Smartscape storage. |
|
| smartscapeId | resource stableSmartscape ID referencing an AWS Account entity.Tags: |
|
| smartscapeId | resource stableSmartscape ID referencing an AWS Availability Zone.Tags: |
|
| smartscapeId | resource stableSmartscape ID referencing an AWS Elastic IP.Tags: |
|
| smartscapeId | resource stableSmartscape ID referencing an AWS EC2 Instance.Tags: |
|
| smartscapeId | resource stableSmartscape ID referencing an EC2 Network Interface.Tags: |
|
| smartscapeId | resource stableSmartscape ID referencing an EC2 Security Group.Tags: |
|
| smartscapeId | resource stableSmartscape ID referencing an AWS Lambda Alias.Tags: |
|
| smartscapeId | resource stableSmartscape ID referencing a Lambda Code Signing Config.Tags: |
|
| smartscapeId | resource stableSmartscape ID referencing an AWS Lambda Function.Tags: |
|
| smartscapeId | resource stableSmartscape ID referencing an AWS RDS DB Cluster.Tags: |
|
| smartscapeId | resource stableSmartscape ID referencing an RDS DB Cluster Snapshot.Tags: |
|
| smartscapeId | resource stableSmartscape ID referencing an RDS DB Instance.Tags: |
|
| smartscapeId | resource stableSmartscape ID referencing an RDS Security Group.Tags: |
|
| smartscapeId | resource stableSmartscape ID referencing an RDS DB Snapshot.Tags: |
|
| smartscapeId | resource stableSmartscape ID referencing an RDS Subnet Group.Tags: |
|
| smartscapeId | resource stableSmartscape ID referencing an AWS Region entity.Tags: |
|
| smartscapeId | resource stableSmartscape ID referencing an Azure Availability Zone.Tags: |
|
| smartscapeId | resource stableSmartscape ID referencing an Azure location/region.Tags: |
|
| smartscapeId | resource stableSmartscape ID referencing an Azure Virtual Machine resource.Tags: |
|
| smartscapeId | resource stableSmartscape ID referencing an Azure Function App.Tags: |
|
| smartscapeId | resource stableSmartscape ID referencing an Azure Subscription.Tags: |
|
| smartscapeId | resource stableSmartscape ID referencing a Business Analytics / BizFlow entity.Tags: |
|
| smartscapeId | resource stableSmartscape ID referencing a Container entity.Tags: |
|
| smartscapeId | resource experimentalThe frontend Smartscape ID.Tags: |
|
| smartscapeId | resource stableSmartscape ID referencing a Host entity.Tags: |
|
| smartscapeId | resource stableA Smartscape ID that can be used to query Kubernetes cluster entities from the Smartscape storage.Tags: |
|
| smartscapeId | resource stableSmartscape ID referencing a Kubernetes ConfigMap.Tags: |
|
| smartscapeId | resource stableSmartscape ID referencing a Kubernetes CronJob.Tags: |
|
| smartscapeId | resource stableSmartscape ID referencing a Kubernetes CustomResourceDefinition.Tags: |
|
| smartscapeId | resource stableSmartscape ID referencing a Kubernetes DaemonSet.Tags: |
|
| smartscapeId | resource stableSmartscape ID referencing a Kubernetes Deployment.Tags: |
|
| smartscapeId | resource stableSmartscape ID referencing an OpenShift DeploymentConfig.Tags: |
|
| smartscapeId | resource stableSmartscape ID referencing a Dynatrace DynaKube Kubernetes resource.Tags: |
|
| smartscapeId | resource stableSmartscape ID referencing an EdgeConnect Kubernetes resource.Tags: |
|
| smartscapeId | resource stableSmartscape ID referencing a Kubernetes HorizontalPodAutoscaler.Tags: |
|
| smartscapeId | resource stableSmartscape ID referencing a Kubernetes Ingress resource.Tags: |
|
| smartscapeId | resource stableSmartscape ID referencing a Kubernetes Job.Tags: |
|
| smartscapeId | resource stableSmartscape ID referencing a Kubernetes Namespace.Tags: |
|
| smartscapeId | resource stableSmartscape ID referencing a Kubernetes NetworkPolicy.Tags: |
|
| smartscapeId | resource stableSmartscape ID referencing a Kubernetes Node.Tags: |
|
| smartscapeId | resource stableSmartscape ID referencing a Kubernetes PersistentVolume.Tags: |
|
| smartscapeId | resource stableSmartscape ID referencing a PersistentVolumeClaim.Tags: |
|
| smartscapeId | resource stableSmartscape ID referencing a Kubernetes Pod.Tags: |
|
| smartscapeId | resource stableSmartscape ID referencing a Kubernetes ReplicaSet.Tags: |
|
| smartscapeId | resource stableSmartscape ID referencing a Kubernetes ReplicationController.Tags: |
|
| smartscapeId | resource stableSmartscape ID referencing a Kubernetes Secret.Tags: |
|
| smartscapeId | resource stableSmartscape ID referencing a Kubernetes Service.Tags: |
|
| smartscapeId | resource stableSmartscape ID referencing a Kubernetes StatefulSet.Tags: |
|
| smartscapeId | resource stableSmartscape ID referencing a OneAgent installation entity.Tags: |
|
| smartscapeId | resource stableSmartscape ID referencing a Process entity.Tags: |
|
| smartscapeId | resource stableSmartscape ID referencing a Service entity.Tags: |
|
The dt.synthetic namespace contains Dynatrace synthetic specific fields.
| Attribute | Type | Description | Examples |
|---|---|---|---|
| long | experimentalThe identifier of the batch (defined for on-demand executions only). | |
| boolean | experimentalInformation whether the event is not included in step/monitor level aggregation (in metrics and counters). | |
| array | experimentalNames of missing Synthetic location capabilities. |
|
| string | experimentalThe identifier of the monitor. |
|
| array | experimentalIDs of monitored entities. |
|
| array | experimentalRequest target addresses with DNS record type or TCP port number. |
|
| string | experimentalThe identifier of the monitor step. |
|
| array | experimentalIDs of synthetic monitor or steps. |
|
The dt.synthetic_engine namespace contains Dynatrace synthetic engine specific fields.
| Attribute | Type | Description | Examples |
|---|---|---|---|
| timestamp | experimentalThe end timestamp of the step/monitor execution as reported by executor. |
|
| timestamp | experimentalThe start timestamp of the step/monitor execution as reported by executor. |
|
The namespace dt.system is reserved for Grail. These fields cannot be ingested but instead will be set by Grail directly. Every record that is fetched from Grail provides these fields, but by default they are hidden. You can display them by using the fieldsAdd command.
Example query:
// display the bucket for each log recordfetch logs| fieldsAdd dt.system.bucket
| Attribute | Type | Description | Examples |
|---|---|---|---|
| string | stableThe Grail bucket that the record is stored in. |
|
| string | stableThe Dynatrace environment that the record belongs to. |
|
| string | stableIdentifies the license under which the source is running. |
|
| long | stableThe selected sampling ratio. |
|
| string | stableThe segment that the record belongs to. |
|
| string | stableIdentifies the timeframe represented by individual data structures stored under a metric key. |
|
| string | stableThe table that the record belongs to. |
|
dt.system.monitoring_source MUST be one of the following:
| Value | Description | Display name |
|---|---|---|
| The source is running under the Container Application Monitoring license. | Container App Monitoring |
| The source is running under the discovery license. | Discovery |
| The source is running under the full-stack container license. | Full-Stack Container |
| The source is running under the full-stack host license. | Full-Stack Host |
| The source is running under the infrastructure license. | Infrastructure |
| The source is running under the mainframe license. | Mainframe |
dt.system.storage_interval MUST be one of the following:
| Value | Description | Display name |
|---|---|---|
| The timeframe represented by individual measurements of a metrics record in storage. | One Minute |
Fields defined in this namespace are used by Dynatrace to describe different aspects of the context propagation between spans.
| Attribute | Type | Description | Examples |
|---|---|---|---|
| uid | experimentalThe custom link ID to identify spans calling each other. The ID is derived from the custom link bytes. |
|
| binary | experimentalThe original binary data of the custom link. |
|
| binary | experimentalThe transformed binary data of the custom link. Only available if a mapping was applied. |
|
| string | experimentalThe type of the custom link defines if a mapping of the |
|
| binary | experimentalAn incoming foreign link (cross-environment or cross-product). |
|
| string | experimentalAn incoming foreign link (cross-environment or cross-product). |
|
| string | experimentalThe direction of the span link to define the correct order between spans. |
|
| uid | experimentalUnique identifier for a Dynatrace link. | |
| boolean | experimental | |
| record | experimentalA collection of key-value pairs containing received response headers related to tracing from an outgoing call. There may be multiple values for each header. Used for cross-environment linking. |
|
dt.tracing.custom_link.type MUST be one of the following:
| Value | Description | Display name |
|---|---|---|
| The | Generic |
| The | IBM MQ |
| The | IBM MQ Ignore Queue Name |
dt.tracing.link.direction MUST be one of the following:
| Value | Description | Display name |
|---|---|---|
| Indicates that the link represents an incoming call (the child in a parent-child relationship). | Incoming |
| Indicates that the link represents an outgoing call (the parent in a parent-child relationship). | Outgoing |
| Attribute | Type | Description | Examples |
|---|---|---|---|
| string | resource experimental | |
| string | resource experimental |
Endpoints define the public interface of services.
| Attribute | Type | Description | Examples |
|---|---|---|---|
| string | stableThe endpoint name is derived from endpoint detection rules and uniquely identifies one endpoint of a particular service. Endpoint names are usually technology-specific and should be defined by attributes with low cardinality, like |
|
| Attribute | Type | Description | Examples |
|---|---|---|---|
| string | resource experimental |
The error namespace contains general information on errors.
| Attribute | Type | Description | Examples |
|---|---|---|---|
| long | experimentalThe code of the error. Set for iOS (NSError and Swift Error) and custom errors for C-based languages. |
|
| long | experimentalThe number of CSP rule violations. |
|
| long | experimentalThe number of exceptions that are observed, but which are not captured due to error capture limits. |
|
| long | experimentalThe total number of exceptions that are observed, including exceptions that are not captured. |
|
| boolean | experimentalIf set to |
|
| long | experimentalThe number of HTTP request errors with an |
|
| long | experimentalThe number of HTTP request errors with an |
|
| long | experimentalThe number of HTTP request errors with an |
|
| uid | experimentalA unique identifier for error grouping. The |
|
| boolean | experimentalIf set to |
|
| string | experimentalA human-readable version of |
|
| string | experimentalThe error reason. RUM JavaScript reports a pre-defined set of values. OneAgent for iOS reports |
|
| string | experimentalThe error source. |
|
| string | experimentalThe main error type. This information is determined by Dynatrace RUM error grouping. |
|
error.reason has the following list of well-known values. If one of them applies, then the respective value MUST be used, otherwise a custom value MAY be used.
| Value | Description | Display name |
|---|---|---|
| The request was aborted by the user. | Abort |
| The request failed due to a Content Security Policy (CSP) violation. | CSP |
| The request failed because of no connectivity. | No network |
| The request timed out. | Timeout |
error.source has the following list of well-known values. If one of them applies, then the respective value MUST be used, otherwise a custom value MAY be used.
| Value | Description | Display name |
|---|---|---|
| console | Console |
| document_request | Document request |
| exception | Exception |
| fetch | Fetch |
| promise_rejection | Promise rejection |
| xhr | XHR |
error.type MUST be one of the following:
| Value | Description | Display name |
|---|---|---|
| Application Not Responding (ANR) | Application not responding |
| Crash | Crash |
| Content Security Policy (CSP) violation | CSP |
| Exception | Exception |
| Custom reported error | Reported |
| Failed request | Request |
| Attribute | Type | Description | Examples |
|---|---|---|---|
| string | resource experimentalThe name of the application that holds the workflows of the business logic. |
|
| string | resource experimentalThe name of the library that hosts commonly used workflows to be reused in applications. |
|
| string | resource experimentalThe name of the vendor of the ESB technology of the current workflow. |
|
| string | resource experimentalThe name of the workflow (the message flow for the IBM ESB). |
|
The event namespace contains common identification, categorization and context on events in Dynatrace.
| Attribute | Type | Description | Examples |
|---|---|---|---|
| string | stableStandard categorization based on the significance of an event (similar to the severity level in the previous Dynatrace). |
|
| string | stableHuman-readable description of an event. |
|
| string | stableThe event end timestamp in UTC (given in Grail preferred Linux timestamp nano precision format). |
|
| string | experimentalGroup label of an event. |
|
| string | stableUnique identifier string of an event; is stable across multiple refreshes and updates. |
|
| string | stableGives high-level information about what kind of information the event contains without being specific about the contents of the event. It helps to determine the record type of a raw event.Tags: |
|
| string | stableThe human readable display name of an event type. |
|
| string | experimentalThe original raw data of the event as received from the source. |
|
| string | stableDenotes whether the event represents a success or a failure from the perspective of the entity that produced the event (for example an HTTP response code). |
|
| string | experimentalUnique identifier string of a parent event to link parent and child events. |
|
| string | stableSource of the event, for example, the name of the component or system that generated the event.Tags: |
|
| string | stableDescribes why a certain event.outcome was set. Typically, this is some form of error description in the case of a failure. |
|
| long | experimentalIncident severity on a scale of 1 to 5 (1 = most severe, 5 = least severe), aligned with ITIL severity levels. |
|
| string | stableThe event start timestamp in UTC (given in Grail preferred Linux timestamp nano precision format). |
|
| string | stableStatus of an event as being either Active or Closed. |
|
| string | experimentalAn enum that shows the transition of the above event state. |
|
| string | stableThe unique type identifier of a given event.Tags: |
|
| string | stableDescribes the version of the event. |
|
Values are either in title-case or screaming snake case.
event.category SHOULD be one of the following:
| Value | Description |
|---|---|
| availability |
| error |
| slowdown |
| resource_contention |
| warning |
| info |
| vulnerability_management |
event.status SHOULD be one of the following:
| Value | Description |
|---|---|
| active |
| closed |
event.status_transition SHOULD be one of the following:
| Value | Description |
|---|---|
| created |
| updated |
| refreshed |
| resolved |
| recovered |
| closed |
| timed out |
| reopened |
| Attribute | Type | Description | Examples |
|---|---|---|---|
| uid | stableThe | |
| long | experimentalThe column number where the exception happened. |
|
| boolean | stable | |
| string | experimentalThe URI domain component. This is extracted from |
|
| string | experimentalThe full file location when the exception happened. This is either an absolute URL or a filename. |
|
| string | experimentalThe URI path component. This is extracted from |
|
| uid | stableThe identifier of an exception. It should be unique within a list of exceptions of a span. The identifier is used to reference the exception. | |
| boolean | stableIs set to | |
| long | experimentalThe line number where the exception happened. |
|
| string | experimentalThe line offset mapping for source lines shifted by instrumentation. |
|
| string | stableA message that describes the exception. |
|
| string | experimentalThe stack trace of the exception. The format depends on the technology and source. While OneAgent formats stack traces to unify them across technologies, stack traces from an OpenTelemetry source are in the format they were sent to Dynatrace. |
|
| string | stableThe type of the exception, for example, its fully-qualified class name. |
|
Fields that can be expected from serverless functions or Function as a Service (FaaS) on various cloud platforms.
| Attribute | Type | Description | Examples |
|---|---|---|---|
| long | resource experimentalThe amount of memory available to the serverless function in Bytes. | |
| string | resource experimentalThe name of the single function that this runtime instance executes. 1 |
|
| string | resource experimentalThe immutable version of the function being executed. 2 |
|
This is the name of the function as configured/deployed on the FaaS platform and is usually different from the name of the callback
function (which may be stored in the code.namespace/code.function span attributes).
Value of the field depends on a cloud provider. This field is not set for Azure.
| Attribute | Type | Description | Examples |
|---|---|---|---|
| boolean | experimentalA boolean that is true if the serverless function is executed for the first time (aka cold-start). | |
| string | experimentalThe table/collection name on which the operation |
|
| string | experimentalThe identifier for the specific item that changed after executing the operation above. 2 |
|
| string | experimentalRelevant only for "datasource" trigger. The operation type which triggered the function invocation. |
|
| string | experimentalThe UTC ISO-8601 timestamp of the operation above. 3 |
|
| string | stableFaaS event attribute, the |
|
| string | experimentalThe API action that triggered the FaaS event. 4 |
|
| string | experimentalThe cloud service that originated the event. |
|
| string | experimentalThe name of the invoked function. |
|
| string | experimentalThe cloud provider of the invoked function. Will be equal to the invoked function's |
|
| string | experimentalThe cloud region of the invoked function. 5 |
|
| string | experimentalThe schedule expression that configures the timer trigger for the function invocation (for |
|
| timestamp | experimentalThe timestamp when the timer expired and triggered the function execution (for |
|
| string | experimentalType of the trigger which caused this function invocation. |
|
Relevant only for faas.trigger=datasource trigger
Relevant only for faas.trigger=datasource trigger
Relevant only for faas.trigger=datasource trigger
The value of this attribute is specific to the service that generated the event.
Will be equal to the invoked function's cloud.region resource attribute.
faas.document.operation has the following list of well-known values. If one of them applies, then the respective value MUST be used, otherwise a custom value MAY be used.
| Value | Description | Display name |
|---|---|---|
| delete | Delete |
| edit | Edit |
| insert | Insert |
faas.invoked_provider has the following list of well-known values. If one of them applies, then the respective value MUST be used, otherwise a custom value MAY be used.
| Value | Description | Display name |
|---|---|---|
| Alibaba Cloud | Alibaba Cloud |
| Amazon Web Services | AWS |
| Microsoft Azure | Azure |
| Google Cloud Platform | GCP |
| Tencent Cloud | Tencent Cloud |
faas.trigger has the following list of well-known values. If one of them applies, then the respective value MUST be used, otherwise a custom value MAY be used.
| Value | Description | Display name |
|---|---|---|
| A response to some data source operation such as a database or filesystem read/write. | Datasource |
| To provide an answer to an inbound HTTP request | HTTP |
| If none of the others apply | Other |
| A function is set to be executed when messages are sent to a messaging system. | Pub/Sub |
| A function is scheduled to be executed regularly. | Timer |
Fields that can be expected for a failure detection on a Dynatrace span. For more details and how failure detection is embedded in a span, see Dynatrace Span model.
| Attribute | Type | Description | Examples |
|---|---|---|---|
| boolean | experimentalIndicates that the span is contributing to the result. Marks that this span was evaluated by the failure analysis and considered in the overall failure detection result. It does not indicate the span itself failed. Only applies to failure detection v1. | |
| uid | experimentalThe |
|
| uid | experimentalThe |
|
| uid | experimentalThe |
|
| uid | experimentalThe |
|
| record[] | experimentalA collection of individual failure detection reasons and verdicts for each applied matching rule. If no entries exist, no rules matched, and the attribute does not exist. | |
| uid | experimentalThe |
|
| string | experimentalThe final failure detection verdict based on the results in |
|
dt.failure_detection.verdict MUST be one of the following:
| Value | Description | Display name |
|---|---|---|
| There is at least one result with verdict | Failure |
| There is at least one result with verdict | Success |
| Attribute | Type | Description | Examples |
|---|---|---|---|
| string | experimentalThe unique identifier for the flag evaluation context. For example, the targeting key. |
|
| string | experimentalThe unique identifier of the feature flag. |
|
| string | experimentalThe name of the service provider that performs the flag evaluation. |
|
| string | experimentalThe reason code, which shows how a feature flag value was determined. |
|
| string | experimentalA semantic identifier for an evaluated flag value. 1 |
|
| string | experimentalThe identifier of the flag set to that the feature flag belongs. |
|
| string | experimentalThe version of the ruleset used during the evaluation. This can be any stable value that uniquely identifies the ruleset. |
|
A semantic identifier, commonly referred to as a variant, provides a means
for referring to a value without including the value itself. This can
provide additional context for understanding the meaning behind a value.
For example, the variant red maybe be used for the value #c05543.
feature_flag.result.reason MUST be one of the following:
| Value | Description | Display name |
|---|---|---|
| The resolved value was retrieved from cache. | Cached |
| The resolved value fell back to a pre-configured value (no dynamic evaluation occurred or dynamic evaluation yielded no result). | Default |
| The resolved value was the result of the flag being disabled in the management system. | Disabled |
| The resolved value was the result of an error. | Error |
| The resolved value was the result of pseudorandom assignment. | Split |
| The resolved value is non-authoritative or possibly out of date. | Stale |
| The resolved value is static (no dynamic evaluation). | Static |
| The resolved value was the result of a dynamic evaluation, such as a rule or specific user-targeting. | Targeting Match |
| The reason for the resolved value could not be determined. | Unknown |
| Attribute | Type | Description | Examples |
|---|---|---|---|
| record | experimentalA frontend-backend tracing link that connects a span to a frontend user event and/or user session. Unlike span links, which reference other spans, this links tracing data to frontend monitoring (such as RUM or Synthetic). | |
| string | stableThe frontend name determined at ingest.Tags: |
|
| Attribute | Type | Description | Examples |
|---|---|---|---|
| string | resource experimental | |
| string | resource experimental | |
| string | resource experimental | |
| string | resource experimentalThe unique, numeric identifier of the Google Cloud resource instance (e.g., GCE VM or Cloud SQL), which remains immutable throughout the resource's lifecycle. |
|
| string | resource deprecatedThe name to display for the instance in the Cloud Console. |
|
| string | resource experimentalContains the value for the user labels with the label key named |
|
| string | resource stableRegion or zone where GCP resource instance is running. |
|
| string | resource experimentalUnique, immutable identifier assigned to an organization resource. |
|
| string | resource experimentalName assigned to the GCP organization. |
|
| string | resource stableIdentifier of the GCP project associated with this resource.Tags: |
|
| string | resource stableA region is a specific geographical location where you can host your resources.Tags: |
|
| string | resource stableThe globally unique resource name in Google Cloud Platform convention. |
|
| string | resource stableThe name of a monitored resource type available in Google Cloud Monitoring and Logging. |
|
| string | resource experimentalContains the value for the tags with the tag key named |
|
| string | resource stableA zone is a subset of a region. Each region has three or more zones. |
|
| Attribute | Type | Description | Examples |
|---|---|---|---|
| string | experimentalHuman-readable name of the GenAI agent provided by the application. |
|
| long | experimentalThe number of dimensions the resulting output embeddings should have. |
|
| string | experimentalIdentifier of the guardrail that has been activated for the request. |
|
| record[] | experimentalContent categories that triggered the guardrails on prompts. |
|
| long | experimentalProcessing time of prompt by guardrail in ms. |
|
| string[] | experimentalName of the patterns for sensitive information in prompt that triggered the Guardrail. |
|
| string[] | experimentalPersonal Identifiable Information categories in prompt that triggered the Guardrail. |
|
| string[] | experimentalTopics in prompt that triggered the Guardrail. |
|
| string[] | experimentalWord lists that triggered the guardrail for prompt. |
|
| string[] | experimentalWords in prompt that triggered the Guardrail. |
|
| record[] | experimentalContent categories that triggered the guardrails on response. |
|
| record[] | experimentalContextual check types that triggered the guardrail on the response, along with the score achieved by each triggered grounding check. |
|
| long | experimentalProcessing time of response by guardrail in ms. |
|
| string[] | experimentalName of the patterns for sensitive information in response that triggered the Guardrail. |
|
| string[] | experimentalPersonal Identifiable Information categories in response that triggered the Guardrail. |
|
| string[] | experimentalTopics in response that triggered the Guardrail. |
|
| string[] | experimentalWord lists that triggered the guardrail for response. |
|
| string[] | experimentalWords in response that triggered the Guardrail. |
|
| string | experimentalVersion of the guardrail that has been activated. |
|
| record[] | experimentalList of all user prompts passed to the LLM. This includes "tool" prompts and may include "system" prompts if the instrumented library includes them in the message list. |
|
| string | experimentalAI framework operation being performed. |
|
| string | experimentalName of operation being performed. |
|
| record[] | experimentalList of all LLM responses. |
|
| string | experimentalIndicates how prompt cache has been used when handling the request. |
|
| string | experimentalName of GenAI product being used. |
|
| string[] | experimentalThe encoding formats requested in an embeddings operation, if specified. |
|
| double | experimentalFrequency penalty setting for GenAI request. |
|
| long | experimentalMaximum number of tokens that the model can generate for a request. |
|
| string | experimentalModel chosen to handle the request. |
|
| double | experimentalPresence penalty setting for GenAI request. |
|
| string[] | experimentalList of sequences that will stop the model from generating further tokens. |
|
| double | experimentalTemperature setting for GenAI request. |
|
| long | experimentalTemperature setting for GenAI request. |
|
| double | experimentalTemperature setting for GenAI request. |
|
| string[] | experimentalList of reasons why the model stopped generating tokens, corresponding to each generation received. |
|
| string | experimentalUnique identifier of an LLM response. |
|
| string | experimentalModel that handled the request. |
|
| string | experimentalIdentifier of system used to generate LLM response. |
|
| record[] | experimentalList of all system prompts passed to the LLM, which are not part of input messages list. |
|
| long | experimentalNumber of tokens sent to the model in the request. |
|
| long | experimentalNumber of tokens generated by the model while handling the request. |
|
| long | experimentalNumber of tokens that has been read from cache. |
|
| long | experimentalNumber of tokens used to generate cache checkpoint. |
|
gen_ai.operation.kind has the following list of well-known values. If one of them applies, then the respective value MUST be used, otherwise a custom value MAY be used.
| Value | Description | Display name |
|---|---|---|
| Operation invoking an autonomous component that can make decisions or perform actions. | Agent |
| Operation collecting documents for a RAG pipeline. | Retrieval |
| A specific operation or step within a workflow. | Task |
| Operation invoking a utility or function used within the application. | Tool call |
| A high-level process or chain of operations. | Workflow |
gen_ai.operation.name has the following list of well-known values. If one of them applies, then the respective value MUST be used, otherwise a custom value MAY be used.
| Value | Description | Display name |
|---|---|---|
| Operation of engaging in a conversational exchange with LLM. | Chat |
| Operation of creating embeddings from user input. | Embeddings |
| Operation of completing text based on user input by LLM. | Text Completion |
gen_ai.prompt_caching has the following list of well-known values. If one of them applies, then the respective value MUST be used, otherwise a custom value MAY be used.
| Value | Description | Display name |
|---|---|---|
| Cache hit. Reading from cache. | Read |
| Cache miss. Creating cache checkpoint. | Write |
gen_ai.provider.name has the following list of well-known values. If one of them applies, then the respective value MUST be used, otherwise a custom value MAY be used.
| Value | Description | Display name |
|---|---|---|
| Amazon Bedrock | Amazon Bedrock |
| OpenAI | OpenAI |
The geo namespace contains geo location information. This section only holds all currently agreed upon fields in the Dynatrace Semantic Dictionary. Aligned closely to the ECS, with some adaptions around field groupings
| Attribute | Type | Description | Examples |
|---|---|---|---|
| string | resource stableEnglish name of the city. |
|
| string | resource experimentalTwo-letter code representing the name of the continent. |
|
| string | resource stableEnglish name of the continent. |
|
| string | resource experimentalThe two-letter country code. The format complies with ISO 3166-1 alpha-2. |
|
| string | resource stableEnglish name of the country. |
|
| long | resource experimentalThe accuracy radius in kilometers. |
|
| double | resource experimentalThe approximate latitude. The format complies with WGS 84.Tags: |
|
| double | resource experimentalThe approximate longitude. The format complies with WGS 84.Tags: |
|
| string | resource experimentalISO 3166-2 region code. In case a country has multiple subdivision categories, the field contains the subdivision category preferred by Dynatrace. |
|
| string | resource stableEnglish name of the region. |
|
| Attribute | Type | Description | Examples |
|---|---|---|---|
| string | resource experimentalThe name of the domain this instance belongs to. | |
| string | resource experimentalThe instance's name. |
| Attribute | Type | Description | Examples |
|---|---|---|---|
| string | resource experimental |
Dynatrace aims to use the best fitting name for the field host.name. See below, how Dynatrace determines the host name in an ordered by precedence fashion:
Dynatrace supports customizing the host.name property. A custom set host name takes precedence over the auto detection mechanisms described further down.
oneagentctl tool can be used to set a custom host name. See Documentation for details.If no customized name is set locally, the OneAgent attempts to determine if we're deployed by Dynatrace Operator in Kubernetes or OpenShift and sets host.name to the name of the Node.
If the Kubernetes isn't present, the OneAgent attempts to determine the host.name value by accessing cloud metadata where applicable.
name (case insensitive) is found, the tag's value is used as the host.name.name (case insensitive) instance metadata property is used. See Microsoft Azure documentationhostname instance metadata property is used. See Google Cloud documentation.gethostname() if it can be interpreted as a fully qualified domain name (FQDN) and doesn't contain "localhost".getaddrinfo() for port 80 is issued, again sanity checking whether the returned name is an FQDN and doesn't contain "localhost".gethostname() was successful, and the returned string is not empty and doesn't contain "localhost", then it's used.EmptyHostName if neither property can be resolved.GetComputerNameExA is used to determine a host's name. In particular, the resulting name is composed of <hostname>.<domainname> with the following details
hostname = ComputerNameDnsHostname retrieved by GetComputerNameExdomainname = ComputerNameDnsDomain retrieved by GetComputerNameExGetComputerNameExA is used when it can be interpreted as a fully qualified domain name (FQDN).GetComputerNameExA is used when it's not empty.EmptyHostName if neither property can be resolved.| Attribute | Type | Description | Examples |
|---|---|---|---|
| string[] | resource experimentalA list of FQDNs of this host. |
|
| boolean | resource experimentalIndicates whether the host has public traffic detected via eBPF Discovery. |
|
| ipAddress[] | resource experimentalA list of IP adresses (IPv4 or IPv6) of this host. |
|
| long | resource experimentalLogical CPUs on the monitored host. Applies to AIX LPARs. |
|
| array | resource experimentalA list of MAC adresses associated with this host. |
|
| string | resource experimentalThe host name as determined on the data source (for instance, OneAgent, extensions or OpenTelemetry).Important: This is not the name of the host entity, which can be modified based on naming rules.Tags: |
|
| long | resource experimentalPhysical memory of the monitored host, expressed in bytes. The value might be different than the total available memory, if features such as Active Memory Expansion are used. |
|
| long | resource experimentalNumber of threads for AIX Simultaneous Multithreading feature. |
|
| long | resource experimentalNumber of virtual CPUs for AIX LPAR. |
|
| Attribute | Type | Description | Examples |
|---|---|---|---|
| long | stableThe size of the request payload body in bytes. This is the number of bytes transferred excluding headers and is often, but not always, present as the Content-Length header. For requests using transport encoding, this should be the compressed size. |
|
| string | stableHTTP request headers, |
|
| string | experimentalString that uniquely identifies a request. |
|
| string | stableHTTP request method. |
|
| string | stableHTTP request parameters, |
|
| long | experimentalThe total size of the request in bytes. This value should be the total number of bytes sent over the wire, including the request line (HTTP/1.1), framing (HTTP/2 and HTTP/3), headers, and request body if any. |
|
| long | stableThe size of the response payload body in bytes. This is the number of bytes transferred excluding headers and is often, but not always, present as the Content-Length header. For requests using transport encoding, this should be the compressed size. |
|
| string | stableHTTP response headers, |
|
| long | experimentalWhen the response contains the HTTP Content-Range header, this field contains the range end value. |
|
| long | experimentalWhen the response contains the HTTP Content-Range header, this field contains the range start value. |
|
| string | experimentalThe HTTP reason phrase (HTTP1 only). |
|
| long | experimentalThe total size of the response in bytes. This value should be the total number of bytes sent over the wire, including the status line (HTTP/1.1), framing (HTTP/2 and HTTP/3), headers, and response body and trailers if any. |
|
| long | stableHTTP response status code. |
|
| double | experimentalTime between the browser requesting a page and when it receives the first byte of information from the server. |
|
| string | stableThe matched route (path template in the format used by the respective server framework). |
|
| Attribute | Type | Description | Examples |
|---|---|---|---|
| string | resource experimentalThe server name as configured by the webserver if available. If no such name exists, this is the local hostname and bound port. In Kubernetes, the base pod name is used. |
|
| Attribute | Type | Description | Examples |
|---|---|---|---|
| string | resource experimental |
|
| string | resource experimental |
|
| string | resource experimental |
|
| Attribute | Type | Description | Examples |
|---|---|---|---|
| string | resource experimentalThe name of the integration node (broker) that manages one or more integration servers. |
|
| string | resource experimentalThe name of the broker-managed or standalone integration server (formerly known as execution group or dataflow engine). |
|
| string | resource experimental | |
| string | resource experimentalThe name of the CICS program. |
|
| string | resource experimental | |
| string | resource experimental | |
| string | resource experimental | |
| string | resource experimental | |
| string | resource experimental | |
| string | resource experimental | |
| string | resource experimental |
| Attribute | Type | Description | Examples |
|---|---|---|---|
| string | resource experimental | |
| string | resource experimental |
| Attribute | Type | Description | Examples |
|---|---|---|---|
| string | resource experimental | |
| string | resource experimental | |
| string | resource experimental | |
| string | resource experimental |
| Attribute | Type | Description | Examples |
|---|---|---|---|
| string | resource experimentalThe instance's home directory. | |
| string | resource experimentalThe instance's operating mode. |
|
| string | resource experimentalThe instance's server name. |
| Attribute | Type | Description | Examples |
|---|---|---|---|
| string | stableThe name of the JDBC connection pool. |
|
| Attribute | Type | Description | Examples |
|---|---|---|---|
| string | experimentalA unit is a systemd object that performs or controls a particular task or action; concerns unix-based systems |
|
| Attribute | Type | Description | Examples |
|---|---|---|---|
| string | resource stableThe user-defined name of the cluster in Dynatrace. Doesn't need to be unique or immutable.Tags: |
|
| string | resource stableA pseudo-ID for the cluster, by default set to the UID of the kube-system namespace. |
|
| string | resource experimentalName of the ConfigMap. |
|
| string | resource stableThe name of the container from the pod specification; must be unique within a pod. Container runtime usually uses different globally unique name ( |
|
| string | resource experimentalThe type of the Kubernetes container. |
|
| string | resource experimentalName of the CronJob. |
|
| string | resource experimentalName of the CustomResourceDefinition. |
|
| string | resource experimentalName of the DaemonSet. |
|
| string | resource experimentalName of the Deployment. |
|
| string | resource experimentalName of the DeploymentConfig. |
|
| string | resource experimentalName of the DynaKube. |
|
| string | resource experimentalName of the EdgeConnect. |
|
| string | resource experimentalName of the HorizontalPodAutoscaler. |
|
| string | resource experimentalName of the Ingress. |
|
| string | resource experimentalName of the Job. |
|
| string | resource stableThe name of the namespace that the pod is running in.Tags: |
|
| string | resource experimentalThe UID of the namespace. |
|
| string | resource experimentalName of the NetworkPolicy. |
|
| string | resource stableName of the node. |
|
| string | resource experimentalName of the PersistentVolume. |
|
| string | resource experimentalName of the PersistentVolumeClaim. |
|
| timestamp | resource experimentalThe RFC 3339 date and time at which the Pod will be deleted. |
|
| string | resource stableThe name of the pod. |
|
| string | resource experimentalThe pod phase is a simple status showing where a Pod is in its lifecycle. |
|
| string | resource stableThe UID of the pod. |
|
| string | resource experimentalName of the ReplicaSet. |
|
| string | resource experimentalName of the ReplicationController. |
|
| string | resource experimentalName of the Secret. |
|
| string | resource stableThe name of the Kubernetes service. |
|
| string | resource experimentalName of the StatefulSet. |
|
| string | resource stableThe type of the workload. The value is the Kubernetes object kind of the workload in lowercase. |
|
| string | resource stableThe name of the workload. |
|
| string | resource experimentalThe UID of the workload. |
|
k8s.pod.phase MUST be one of the following:
| Value | Description |
|---|---|
| At least one container terminated with an error (non-zero exit code). |
| Pod is created but not yet running. |
| Pod is scheduled on a node and at least one container is running. |
| All containers finished successfully (exit code 0) and won’t restart. |
| Pod state cannot be determined (usually communication issue with node). |
| Attribute | Type | Description | Examples |
|---|---|---|---|
| string | resource experimentalKubernetes namespace annotation that should be enriched on ingest signals and service metrics. The attribute_name is a placeholder that can freely be chosen. |
|
| string | resource experimentalKubernetes namespace label that should be enriched on ingest signals and service metrics. The attribute_name is a placeholder that can freely be chosen. |
|
| string | resource experimentalKubernetes pod annotation that should be enriched on ingest signals and service metrics. The attribute_name is a placeholder that can freely be chosen. |
|
| string | resource experimentalKubernetes pod label that should be enriched on ingest signals and service metrics. The attribute_name is a placeholder that can freely be chosen. |
|
| string | resource experimentalKubernetes workload annotation that should be enriched on ingest signals and service metrics. The attribute_name is a placeholder that can freely be chosen. |
|
| string | resource experimentalKubernetes workload label that should be enriched on ingest signals and service metrics. The attribute_name is a placeholder that can freely be chosen. |
|
| Attribute | Type | Description | Examples |
|---|---|---|---|
| string | experimentalThe ID of the Kafka broker. |
|
| string | experimentalThe component of the Kafka Connect worker. |
|
| string | experimentalThe name of the Kafka Connect connector. |
|
| string | experimentalThe ID of the Kafka Connect task. |
|
| string | experimentalThe ID of the Kafka Connect worker. |
|
Fields relevant for log events
| Attribute | Type | Description | Examples |
|---|---|---|---|
| string | experimentalThe basename of the file. |
|
| string | experimentalThe full path to the file. |
|
| string | stableThe I/O stream to which the log was emitted. |
|
| string | experimentalThe name of the logger inside an application. This name is usually the name of the class that initialized the logger, but it can be a custom name. |
|
| string | experimentalThe original severity level of the log entry as recorded by the source, before standardization into the log.level format. 1 |
|
| string | experimentalUnique identifier of the log record. Records sharing the same uid are considered duplicates and may be safely deduplicated. Two distinct log records MUST have different uid values. When logs are ingested from an external tool, this attribute will hold the original vendor log ID. |
|
| string | stableHuman-readable attribute that identifies a log stream. 2Tags: |
|
| string | experimentalThe field represents the current monitoring state of a log source. |
|
| string | experimentalThe field represents the log content ingestion status. |
|
| string | stableThe log source origin indicates where the log derives from. |
|
| string | stableThe log event severity level. |
|
The log.raw_level can vary in type depending on the log entry. It may be represented as a string in some cases or as an integer (for example, 30, 40, 50) in others.
Can contain, for example, a file path, standard output, or an URI etc., depending on the log stream type. The value should be stable for one logical source (for example, not affected by log file rotation digits).
log.iostream MUST be one of the following:
| Value | Description | Display name |
|---|---|---|
| std_err | Standard Error |
| std_out | Standard Out |
log.source.origin MUST be one of the following:
| Value | Description | Display name |
|---|---|---|
| Container log detector. | Container Log Detector |
| Custom log source configuration. | Custom Log |
| Event Log channel detector. | Event Log Channel Detector |
| IIS log detector. | IIS Log Detector |
| Journald log detector. | Journald Log Detector |
| Open log file detector. | Open Log Detector |
| System log detector. | System Log Detector |
loglevel MUST be one of the following:
| Value | Description | Display name |
|---|---|---|
| alert | Alert |
| critical | Critical |
| debug | Debug |
| emergency | Emergency |
| error | Error |
| fatal | Fatal |
| info | Info |
| none | No level |
| notice | Notice |
| severe | Severe |
| trace | Trace |
| warn | Warn |
| Attribute | Type | Description | Examples |
|---|---|---|---|
| long | experimentalThe number of messages in the batch for which publishing failed. |
|
| string[] | experimentalThe vendor-provided error codes explaining why an operation on the message broker failed. To limit attribute size, not all error codes might be included. |
|
| long | stableThe number of messages sent, received, or processed in the scope of the batching operation. |
|
| string | stableA unique identifier for the client that consumes or produces a message. |
|
| string | stableThe name of the consumer group with which a consumer is associated. |
|
| string | deprecatedThe kind of message destination |
|
| string | stableThe destination's manager name 1 |
|
| string | stableThe message destination name 2 |
|
| string | stableString representation of the partition ID the message is sent to or received from. |
|
| string | experimentalThe name of the subscription from which the message is received, applicable to topic-based messaging systems. 3 |
|
| boolean | stableA boolean that is true if the message destination is temporary and might not exist anymore after messages are processed. | |
| boolean | **deprecatedReplaced by | |
| long | stableThe (uncompressed) size of the message payload in bytes. |
|
| string | stableThe conversation ID identifying the conversation to which the message belongs, represented as a string. Sometimes called "Correlation ID". |
|
| long | experimentalThe number of deliveries of the message. |
|
| timestamp | experimentalThe timestamp when the message was enqueued in the destination. |
|
| record | stableThe message headers, |
|
| string | stableA value used by the messaging system as an identifier for the message, represented as a string. |
|
| string | stableA string identifying the kind of messaging operation. |
|
| string | deprecatedThe kind of message source |
|
| string | **deprecatedReplaced by |
|
| string | **deprecatedReplaced by |
|
| boolean | **deprecatedReplaced by | |
| string | stableAn identifier for the messaging system. See below for a list of well-known identifiers. |
|
Manager name uniquely identifies the broker.
Destination name uniquely identifies a specific queue, topic or other entity within the broker.
Subscription name identifies a specific subscription to a topic within the messaging system. Applicable to systems such as Azure Service Bus and Google Cloud Pub/Sub.
Manager name uniquely identifies the broker.
Source name uniquely identifies a specific queue, topic, or other entity within the broker.
messaging.destination.kind MUST be one of the following:
| Value | Description | Display name |
|---|---|---|
| A message sent to or received from a queue | Queue |
| A message sent to or received from a topic | Topic |
messaging.operation.type has the following list of well-known values. If one of them applies, then the respective value MUST be used, otherwise a custom value MAY be used.
| Value | Description | Display name |
|---|---|---|
| A message is received from a destination by a message consumer/server, but left there ( | Peek |
| A message previously received from a destination is processed by a message consumer ( | Process |
| A message is sent to a destination by a message producer ( | Publish |
| A message is received from a destination by a message consumer ( | Receive |
messaging.source.kind MUST be one of the following:
| Value | Description | Display name |
|---|---|---|
| A message received from a queue | Queue |
| A message received from a topic | Topic |
messaging.system has the following list of well-known values. If one of them applies, then the respective value MUST be used, otherwise a custom value MAY be used.
| Value | Description | Display name |
|---|---|---|
| ActiveMQ | ActiveMQ |
| ActiveMQ Artemis | ActiveMQ Artemis |
| Amazon EventBridge | AWS EventBridge |
| Amazon Simple Notification Service (SNS) | AWS SNS |
| Amazon Simple Queue Service (SQS) | AWS SQS |
| Azure Event Grid | Azure Event Grid |
| Azure Event Hubs | Azure Event Hub |
| Azure Service Bus | Azure Service Bus |
| Google Cloud Pub/Sub | GCP Pub/Sub |
| HornetQ | HornetQ |
| Java Message Service | JMS |
| Apache Kafka | Kafka |
| IBM MQ | IBM MQ |
| MSMQ | MSMQ |
| RabbitMQ | RabbitMQ |
| Apache RocketMQ | RocketMQ |
| Software AG, webMethods Integration Server | webMethods IS |
| Tibco EMS | TIBCO EMS |
| Oracle WebLogic | WebLogic |
| IBM WebSphere Application Server | WebSphere |
| Attribute | Type | Description | Examples |
|---|---|---|---|
| string | experimentalName of the top-level actor. See The Akka actor hierarchy |
|
| string | experimentalPath to actor inside actor system. |
|
| string | experimentalName of the actor system. |
|
| string | experimentalFully qualified type name of actor. |
|
| string | experimentalFully qualified type name of the message. |
|
| Attribute | Type | Description | Examples |
|---|---|---|---|
| string | experimentalThe |
|
| boolean | experimentalA boolean that is true if the message is a tombstone. 1 |
|
| long | experimentalThe offset of the message. |
|
If the message is a tombstone, the value is true. When missing, the value is assumed to be false.
| Attribute | Type | Description | Examples |
|---|---|---|---|
| string | stableThe identifier of a metric, grouping numeric measurements that share the same measurement semantics (i.e. were measured "the same way".)Tags: |
|
| string | stableIdentifies the type of metric and therefore the timeseries rollup functions it supports. |
|
metric.type MUST be one of the following:
| Value | Description | Display name |
|---|---|---|
| Identifies a metrics record supporting minimum, maximum, average, sum, count, and percentile timeseries rollup functions. | Histogram |
| Identifies a metrics record supporting minimum, maximum, average, sum, and count timeseries rollup functions. | Summary Stats |
In webserver technologies a multitude of modules might be contributing to handling a single web request. Module insights provides timings for these, where available.
| Attribute | Type | Description | Examples |
|---|---|---|---|
| record | experimentalModules executed as part of this web request, represented as map from module name to duration in nanoseconds spent. |
|
These attributes may be used for any network related operation.
| Attribute | Type | Description | Examples |
|---|---|---|---|
| string | experimentalThe mobile carrier name. |
|
| string | experimentalFurther details that specify |
|
| string | experimentalThe internet connection type. |
|
| ipAddress | experimentalLocal address of the network connection. |
|
| ipAddress | experimentalThe immediate peer IP address of the network connection. This is the IP address of the other side of the socket connection. |
|
| long | experimentalThe immediate peer port number of the network connection. This is the port number of the other side of the socket connection. |
|
| string | stableOSI Application Layer or non-OSI equivalent. |
|
| long | experimentalThe IANA protocol number of the traffic. For more information, see Assigned Internet Protocol Numbers. |
|
| string | experimentalVersion of the application layer protocol used. |
|
| record[] | experimentalInformation about proxies or load balancers between a client and a server, parsed out from |
|
| string | stableOSI Transport Layer or Inter-process Communication method |
|
| string | stableOSI Network Layer or non-OSI equivalent. |
|
network.connection.type has the following list of well-known values. If one of them applies, then the respective value MUST be used, otherwise a custom value MAY be used.
| Value | Description | Display name |
|---|---|---|
| cell | Cellular |
| unavailable | Unavailable |
| unknown | Unknown |
| wifi | Wi-Fi |
| wired | Wired |
network.transport has the following list of well-known values. If one of them applies, then the respective value MUST be used, otherwise a custom value MAY be used.
| Value | Description | Display name |
|---|---|---|
| In-process communication. 1 | In-Process |
| Something else (non-IP-based). | Other |
| Named or anonymous pipe. | Pipe |
| TCP | TCP |
| UDP | UDP |
| Unix domain socket. | Unix Domain Socket |
Signals that there is only in-process communication not using a "real" network protocol in cases where network attributes would typically be expected. Usually, all other network attributes can be left out.
network.type has the following list of well-known values. If one of them applies, then the respective value MUST be used, otherwise a custom value MAY be used.
| Value | Description | Display name |
|---|---|---|
| IPv4 | IPv4 |
| IPv6 | IPv6 |
Fields that are used in extensions to describe network devices.
| Attribute | Type | Description | Examples |
|---|---|---|---|
| string | resource deprecatedUsed in Extension Framework 2.0Address (IP address with port) used by a monitored device to communicate with an extension. |
|
| ipAddress | resource deprecatedUsed in Extension Framework 2.0IP address used by a monitored device to communicate with an extension. |
|
| string | resource deprecatedUsed in Extension Framework 2.0Name of a device monitored by an extension. |
|
| string | resource deprecatedUsed in Extension Framework 2.0Port used by a monitored device to communicate with an extension. |
|
Fields relevant for network flows.
| Attribute | Type | Description | Examples |
|---|---|---|---|
| long | experimentalNumber of bytes (octets) received during given interval, direction: to Process (PGI). | |
| long | experimentalNumber of bytes (octets) transmitted during given interval, direction: from Process (PGI). | |
| ipAddress | experimentalDestination IP address. By convention, destination means TCP server (acceptor of the connection). |
|
| long | experimentalFlow destination port. By convention, destination port means TCP server (acceptor of the connection). |
|
| string | experimentalProtocol |
|
| string | experimentalIP protocol version. |
|
| long | experimentalNumber of packets received, used as the base for retransmission rate, direction: to Process (PGI). | |
| long | experimentalNumber of packets sent, used as the base for retransmission rate, direction: from Process (PGI). | |
| long | experimentalNumber of retransmitted packets during given interval, direction: to Process (PGI). | |
| long | experimentalNumber of retransmitted packets during given interval, direction: from Process (PGI). | |
| long | experimentalNumber of packets received during given interval, direction: to Process (PGI). | |
| long | experimentalNumber of packets transmitted during given interval, direction: from Process (PGI). | |
| boolean | experimentalIndicates whether the entity (Process) is acting as a server in the network flow. |
|
| ipAddress | experimentalSource IP address. By convention, source means TCP client (initiator of the connection). |
|
| duration | experimentalMean RTT value [ms]. | |
| duration | experimentalMean RTT ack value [ms]. | |
| long | experimentalNumber of new TCP sessions in the flow. | |
| long | experimentalNumber of reset (rejected) TCP sessions in the flow. | |
| long | experimentalNumber of timed out TCP sessions in flow. |
network_flow.network.type has the following list of well-known values. If one of them applies, then the respective value MUST be used, otherwise a custom value MAY be used.
| Value | Description | Display name |
|---|---|---|
| ipv4 | IPv4 |
| ipv6 | IPv6 |
| Attribute | Type | Description | Examples |
|---|---|---|---|
| string | resource experimentalThe name of the Smartscape network interface. |
|
| Attribute | Type | Description | Examples |
|---|---|---|---|
| string | resource experimental | |
| string | resource experimental | |
| string | resource experimental |
| Attribute | Type | Description | Examples |
|---|---|---|---|
| string | experimentalID of the document stored in OpenSearch. |
|
| string | experimentalX-Opaque-Id http header if one was used. |
|
| string | experimentalThe name of the OpenSearch index. |
|
| string | experimentalThe ID of the node. |
|
| string | experimentalCustom routing value. |
|
| string | experimentalThe ID of the OpenSearch shard. |
|
| string | experimentalSearch group defined in the query. |
|
| string | experimentalExecution time of the request. |
|
| string | experimentalExecution time of the request. |
|
| string | experimentalTotal number of hits returned by the search. |
|
| string | experimentalTotal number of shards. |
|
Fields that can come from applications running on OpenStack.
| Attribute | Type | Description | Examples |
|---|---|---|---|
| string | resource experimentalA specific availability zone in the given OpenStack region. |
|
| string | resource experimentalUUID of specific OpenStack instance. |
|
The origin of a request associated with this event.
| Attribute | Type | Description | Examples |
|---|---|---|---|
| string | experimentalSource IP address of the request associated with this event. Must be set if origin.type is 'REST', must not be set otherwise. |
|
| string | experimentalThe ID of the browser session (if present) associated with the event. |
|
| string | experimentalOrigin type of the request associated with this event. |
|
| string | experimentalThe verbatim value of the X-Forwarded-For HTTP request header (if present) of the request associated with the event. |
|
origin.type MUST be one of the following:
| Value | Description | Display name |
|---|---|---|
| The event provider issued the request locally. | Local |
| The event provider issued the request locally as part of disaster recovery. | Recovery |
| The event provider received an external REST API call. | REST |
The os namespace contains information on the operating system running an application.
| Attribute | Type | Description | Examples |
|---|---|---|---|
| string | resource experimentalArchitecture of the CPU, discovered from the operating system. |
|
| string | resource stableThe OS name in a short, human-readable format. |
|
| string | resource experimentalType of discovered operating system. |
|
| string | resource stableThe complete OS version, including patch, build, and other information. |
|
| Attribute | Type | Description | Examples |
|---|---|---|---|
| boolean | experimentalBoolean attribute deciding whether the service status triggers alerts or not. | |
| string | experimentalCurrent running state. |
|
os_service.status MUST be one of the following:
| Value | Description | Display name |
|---|---|---|
| Service is activating. | Activating |
| Service is active. | Active |
| Service continues pending. | Continue Pending |
| Service is deactivating. | Deactivating |
| Service failed to start. | Failed |
| Service is inactive. | Inactive |
| Service paused pending. | Pause Pending |
| Service is currently paused. | Paused |
| Service is reloading. | Reloading |
| Service is currently running. | Running |
| Service started pending. | Start Pending |
| Service stopped pending. | Stop Pending |
| Service is currently stopped. | Stopped |
| Attribute | Type | Description | Examples |
|---|---|---|---|
| string | resource experimentalHuman-readable name of the service. On Windows, this is the display name as reported by the Service Control Manager, which may differ from os_service.name (e.g., name: |
|
| string | resource experimentalManufacturer of the service. On Linux based systems, the value will always be |
|
| string | resource experimentalUnique OS service name. On Windows, this is the short programmatic key as reported by the Service Control Manager (e.g., |
|
| string | resource experimentalThe full path to the process executable. On Linux based systems, this can be set to the target of |
|
| string | resource experimentalCurrent startup type. |
|
os_service.startup_type MUST be one of the following:
| Value | Description | Display name |
|---|---|---|
| Windows specific. Automatic: The service starts at system logon. | Auto |
| Windows specific. Automatic (Delayed Start): The service starts a short while after the system has finished starting up. | Auto Delay |
| Windows specific. Automatic (Delayed Start, Trigger Start) | Auto Delay Trigger |
| Windows specific. Automatic (Trigger Start): This service will start automatically at boot. | Auto Trigger |
| Linux specific. Service is configured to not start when the system boots, but can be started manually, or as a dependency of another service. | Disabled |
| Linux specific. Service is marked for starting up on boot. | Enabled |
| Linux specific. Service is marked for starting up on boot. | Enabled Runtime |
| Linux specific. Service is not enabled directly but can be activated via dependencies or aliases. | |
| Linux specific. Service unit file is symlinked into systemd from an external location persistently. | |
| Linux specific. Service unit file is temporarily symlinked into systemd for the current runtime only. | |
| Windows specific. Manual: The service starts only when explicitly summoned. | Manual |
| Windows specific. Manual (Trigger Start): This service will not start automatically at boot. | Manual Trigger |
| Linux specific. Service is not enabled and can only start when pulled in by dependencies or started manually. | Static |
| Attribute | Type | Description | Examples |
|---|---|---|---|
| string | stableThe name of the instrumentation scope - ( |
|
| string | stableThe version of the instrumentation scope - ( |
|
| Attribute | Type | Description | Examples |
|---|---|---|---|
| string | resource experimental | |
| string | resource experimental | |
| string | resource experimental | |
| string | resource experimental | |
| string | resource experimental | |
| string | resource experimentalalso see https://developer.wordpress.org/reference/functions/get\_bloginfo/ |
| Attribute | Type | Description | Examples |
|---|---|---|---|
| string | experimentalA unique ID to identify a PostgreSQL database session. |
|
Primary Grail tags are a small set of important, customer-selected tags—such as Kubernetes labels, AWS/Azure tags, or key organizational attributes—that Dynatrace automatically attaches to all raw telemetry data at ingest, using the primary_tags.* prefix. This enrichment enables fast, consistent filtering, grouping, and permission management across all data, without complex joins or proprietary tagging rules. Primary Grail tags are centrally configured and ensure that cloud-native and business-relevant metadata is always available for queries, dashboards, and access control.
| Attribute | Type | Description | Examples |
|---|---|---|---|
| string | resource experimentalPrimary Grail tags are used to tag a resource in a meaningful way. |
|
| Attribute | Type | Description | Examples |
|---|---|---|---|
| string | resource experimentalThe architecture of the monitored entity in terms of how many bits compose a basic value. |
|
| string | resource experimentalThe command used to launch the process (the command name). On Linux-based systems, can be set to the zeroth string in |
|
| string[] | resource experimentalAll the command arguments (including the command/executable itself) as received by the process. On Linux-based systems, can be set according to the list of null-delimited strings extracted from |
|
| string | resource experimentalThe full command used to launch the process as a single string representing the full command. On Windows, can be set to the result of |
|
| boolean | resource experimentalTrue if given process is running inside container. | |
| timestamp | resource experimentalTimestamp of when the process terminated, in ISO 8601 format with millisecond precision and UTC timezone. Only populated in process termination events or in retrospective enrichment. On Windows, available via |
|
| string | resource experimentalThe name of the process executable. On Linux based systems, can be set to the |
|
| string | resource experimentalThe full path to the process executable. On Linux-based systems, can be set to the target of |
|
| boolean | resource experimentalIndicates whether the process has public traffic detected via eBPF Discovery. |
|
| array | resource experimentalAn array of open listen ports. |
|
| record | resource experimentalIt contains a diagnostic collection of input parameters that were used or could have been used in assigning processes to the process entity. |
|
| string | resource experimentalThe name of the Smartscape process. |
|
| string[] | resource experimentalAll the command arguments (including the command/executable itself) as received by the parent process. |
|
| string | resource experimentalThe full command line used to launch the parent process. |
|
| timestamp | resource experimentalTimestamp of when the parent process terminated, in ISO 8601 format. May be empty if the parent process is still running. |
|
| string | resource experimentalThe name of the parent process executable. |
|
| string | resource experimentalFull filesystem path to the parent process executable, including the filename. |
|
| long | resource experimentalOperating system process identifier of the parent process. Subject to the same PID reuse caveat as |
|
| timestamp | resource experimentalTimestamp of when the parent process was started, in ISO 8601 format. |
|
| string | resource experimentalGlobally unique identifier for the parent process instance. Same generation mechanism and uniqueness guarantees as |
|
| string | resource experimentalThe user ID under which the parent process was executing. |
|
| string | resource experimentalThe working directory of the parent process at its creation time. |
|
| long | resource experimentalProcess Identifier (PID) as observed by the monitored process. |
|
| timestamp | resource experimentalTimestamp of when the process was started, in ISO 8601 format with millisecond precision and UTC timezone. On Linux, derivable from |
|
| string | resource experimentalGlobally unique identifier for this specific process instance. Unlike |
|
| string | resource experimentalThe user ID under which the process is executing. On Linux, this is the numeric UID (for example, from |
|
| string | resource experimentalThe working directory of the process at creation time. On Linux, corresponds to |
|
| Attribute | Type | Description | Examples |
|---|---|---|---|
| long | experimentalThe number of arguments the |
|
| string | experimentalThe name of the RabbitMQ function within the |
|
| string | experimentalThe name of the RabbitMQ module that generated the log entry. |
|
| string | experimentalID of the Erlang process. |
|
| Attribute | Type | Description | Examples |
|---|---|---|---|
| string | experimentalThe role of the Redis process (for example, 'M' for Master or 'X' for sentinel). |
|
redis.role MUST be one of the following:
| Value | Description | Display name |
|---|---|---|
| Child process for persistence (RDB/AOF). | Child |
| Master Redis process. | Master |
| Replica Redis process. | Replica |
| Sentinel monitoring process. | Sentinel |
| Attribute | Type | Description | Examples |
|---|---|---|---|
| boolean | **deprecatedReplaced by | |
| boolean | **deprecatedReplaced by |
Request scoped attributes (e.g. method parameters, return values, class names, …) captured by the OneAgent based on a request attribute definition. The actual name of the attribute is the prefix "request_attribute" plus the "request attribute name" defined in the request attributes configuration. Request attributes are built based on captured attributes and other attributes like HTTP header values or "normal" span attributes, on which the aggregations (first/last value, distinct values, ...), type conversion and normalizations defined in the request attribute configuration are performed. They are evaluated for an entire request (possibly consisting of multiple spans) and are stored only on the request root node.
| Attribute | Type | Description | Examples |
|---|---|---|---|
| array | stableContains the request scoped reconciled values of the attribute named |
|
| Attribute | Type | Description | Examples |
|---|---|---|---|
| string | experimentalThe name of the (logical) method being called 1 |
|
| string | experimentalThe namespace of the method being called. In SOAP, it would be the XML namespace. |
|
| string | experimentalThe full (logical) name of the service being called, including its package name, if applicable. 2 |
|
| string | experimentalA string identifying the remoting system or framework. See below for a list of well-known identifiers. |
|
This is the logical name of the method from the RPC interface perspective, which can be different from the name of any implementing method/function. The code.function attribute may be used to store the latter (e.g., method executing the call on the server side, RPC client stub method on the client side).
This is the logical name of the service from the RPC interface perspective, which can be different from the name of any implementing class. The code.namespace attribute may be used to store the latter (despite the attribute name, it may include a class name, e.g., class with method executing actually executing the call on the server side, RPC client stub class on the client side).
rpc.system has the following list of well-known values. If one of them applies, then the respective value MUST be used, otherwise a custom value MAY be used.
| Value | Description | Display name |
|---|---|---|
| Apache Axis | Apache Axis |
| Apache CXF | Apache CXF |
| Apache Wink | Apache Wink |
| AWS API | AWS API |
| .NET Remoting | .NET Remoting |
| .NET WCF | .NET WCF |
| gRPC | gRPC |
| Java RMI | Java RMI |
| JAX-WS | JAX-WS |
| JBoss | JBoss |
| Jersey | Jersey |
| Progress OpenEdge | OpenEdge |
| JBoss RESTEasy | RESTEasy |
| Restlet | Restlet |
| Spring Web Services | Spring Web Services |
| Tibco Web Services | Tibco Web Services |
| WebLogic Web Services | WebLogic Web Services |
| Webmethods | Webmethods |
| Attribute | Type | Description | Examples |
|---|---|---|---|
| long | experimentalThe numeric status code of the gRPC request. |
The server namespace contains information on the server side of a network connection.
| Attribute | Type | Description | Examples |
|---|---|---|---|
| string | stableLogical server hostname, matches server FQDN if available, and IP or socket address if FQDN is not known. |
|
| long | stableLogical server port number. |
|
| ipAddress[] | stableA list of IP addresses that are the result of DNS resolution of |
|
| Attribute | Type | Description | Examples |
|---|---|---|---|
| string | resource stableThe logical name of the service. |
|
| Attribute | Type | Description | Examples |
|---|---|---|---|
| string | resource experimentalalso see https://docs.oracle.com/javaee/6/api/javax/servlet/ServletContext.html#getServletContextName | |
| string | resource experimentalalso see https://docs.oracle.com/javaee/6/api/javax/servlet/ServletContext.html#getContextPath |
Fields that are used in SNMP extensions.
| Attribute | Type | Description | Examples |
|---|---|---|---|
| string | resource stableAn IP address that is enabled for SNMP queries on the device. |
|
| string | resource stableOID 1.3.6.1.2.1.1.2 (SNMPv2-MIB::sysObjectId): The vendor's authoritative identification of the network management subsystem contained in the entity. |
|
| string | resource deprecatedUsed in Extension Framework 2.0The trap OID of a given event. |
|
| string | resource deprecatedUsed in Extension Framework 2.0The SNMP version. |
|
| Attribute | Type | Description | Examples |
|---|---|---|---|
| string | resource experimental | |
| string | resource experimental |
| Attribute | Type | Description | Examples |
|---|---|---|---|
| uid | experimentalThe alternative |
|
| record[] | stableA collection of events. An event is an optional time-stamped annotation of the span and consists of a name and key-value pairs. | |
| uid | stableThe | |
| uid | stableA unique identifier for a span within a trace. The |
|
| boolean | stableSet to | |
| boolean | experimentalIf set to | |
| string | stableDistinguishes between spans generated in a particular context. |
|
| record[] | stableA collection of links. A link is a reference from this span to a whole trace or a span in the same or different trace. | |
| string | stableThe span name identifies the work represented by the span, for example, the route in an HTTP controller, an RPC method name, a function name, or the name of a subtask or stage within a larger computation. |
|
| uid | stableThe |
|
| string | stableDefines the status of a span, predominantly used to indicate a processing error. This field is absent if the reported span status is |
|
| string | experimentalAn optional text that can provide a descriptive error message in case the |
|
| duration | stableThe overall CPU time spent executing the span, including the CPU times of child spans that are running on the same thread on the same call stack. | |
| duration | stableThe CPU time spent exclusively on executing this span, not including the CPU times of any children. |
span.kind MUST be one of the following:
| Value | Description | Display name |
|---|---|---|
| Indicates that the span describes a request to some remote service. | Client |
| Indicates that a span describes a child of an asynchronous | Consumer |
| Default Value. Indicates that the span represents an internal operation. | Internal |
| Indicates that the span describes a Dynatrace link node. | Link |
| Indicates that the span describes the initiator of an asynchronous request. | Producer |
| Indicates that the span covers server-side handling of a synchronous RPC or other remote request. | Server |
span.status_code MUST be one of the following:
| Value | Description | Display name |
|---|---|---|
| An error happened while processing the span. | Error |
| The span was explicitly validated as having completed successfully, despite maybe even containing information about an error. | OK |
| Attribute | Type | Description | Examples |
|---|---|---|---|
| string | stableSome span events have a defined semantics based on the name of the span event. |
|
span_event.name has the following list of well-known values. If one of them applies, then the respective value MUST be used, otherwise a custom value MAY be used.
| Value | Description | Display name |
|---|---|---|
| Indicates that the span event represents a business event | Business Event |
| Indicates that the span event represents an exception | Exception |
| Indicates that the span event represents a feature flag | Feature Flag |
Language Independent Interface Types For OpenTelemetry
| Attribute | Type | Description | Examples |
|---|---|---|---|
| string | resource experimentalAlso see Common Application Properties | |
| string | resource experimentalAlso see Common Application Properties | |
| string | resource experimentalThe active profile (last value of spring.profiles.active) | |
| string | resource experimental |
| Attribute | Type | Description | Examples |
|---|---|---|---|
| boolean | resource stableIs encrypted disk. | |
| string | resource stableType of file system on the disk. |
|
| string | resource stableKernel name of the disk device. It's also the disk ID in relation to other devices. |
|
| string | resource stableDisk model. |
|
| string | resource stablePrimary mount point. |
|
| string[] | resource stableList of other mount points of the disk |
|
| string | resource stablePath to the disk. |
|
| boolean | resource stableIs read-only disk. | |
| boolean | resource stableIs removable disk. | |
| string | resource stableDisk serial number. |
|
| string | resource stableDisk device type. |
|
| string | resource stableVendor of the disk. |
|
| Attribute | Type | Description | Examples |
|---|---|---|---|
| boolean | resource stableIs encrypted partition. | |
| string | resource stableType of file system on the partition. |
|
| string | resource stableKernel name of the partition device. It's also the partition ID in relation to other devices. |
|
| string | resource stablePrimary mount point. |
|
| string[] | resource stableList of other mount points of the partition. |
|
| string | resource stablePath to the partition. |
|
| boolean | resource stableIs read-only partition. | |
| boolean | resource stableIs removable partition (true when disk is removable). | |
| string | resource stablePartition device type. |
|
| Attribute | Type | Description | Examples |
|---|---|---|---|
| string | resource stableName of the volume device. |
|
| string | resource stableType of file system on the volume. |
|
| string | resource stableKernel name of the volume device. It's also the volume ID in relation to other devices. |
|
| string | resource stablePrimary mount point. |
|
| string[] | resource stableList of other mount points of the software RAID. |
|
| string | resource stablePath to the volume device. |
|
| boolean | resource stableIs read-only volume. | |
| boolean | resource stableIs removable volume. | |
| string | resource stableVolume device type. |
|
| Attribute | Type | Description | Examples |
|---|---|---|---|
| boolean | resource stableIs encrypted software RAID. | |
| string | resource stableType of file system on the software RAID, |
|
| string | resource stableKernel name of the software RAID device. It's also the software RAID ID in relation to other devices. |
|
| string | resource stablePrimary mount point. |
|
| string[] | resource stableList of other mount points of the software RAID. |
|
| string | resource stableID of parent software RAID in which this software RAID is nested. |
|
| string | resource stablePath to the software RAID device. |
|
| boolean | resource stableIs read-only software RAID. | |
| boolean | resource stableIs removable software RAID. | |
| string | resource stableSoftware RAID device type. |
|
| Attribute | Type | Description | Examples |
|---|---|---|---|
| uid | experimentalPresent on every span of a subtrace. All spans within one subtrace share the same identifier. The ID is a hex-encoded numerical value and not globally unique, but guaranteed to be unique within one particular trace. |
|
| boolean | experimentalMarks the root of a subtrace. This is typically the first span of a request within a service. Endpoints detection rules are evaluated on subtrace root spans. |
Additional information about the attributes of a data point.
| Attribute | Type | Description | Examples |
|---|---|---|---|
| long | experimentalThe denominator of the sampling ratio of the Dynatrace cluster, the attribute is only set if Adaptive Load Redution (ALR) is active on the Dynatrace cluster. A numerator is not specified, as it's always 1. If, for example, the Dynatrace cluster samples with a probability of 1/8 (12,5%), the value of |
|
| long | experimentalThe denominator of the sampling ratio of an Adaptive Traffic Management (ATM) aware sampler. The attribute is always present if an ATM-aware sampler is active (this applies, for example, to Dynatrace OneAgent). A numerator is not specified, as it is always 1. If, for example, Dynatrace OneAgent samples with a probability of 1/16 (6,25%), the value of |
|
| uid | experimentalThe ID of a custom service configuration rule. This field is only present if a custom service was configured as an automatic instrumentation rule in Dynatrace. |
|
| long | experimentalThe number of attributes that were discarded on the source. Attributes can be discarded because their keys are too long or because there are too many attributes. |
|
| long | experimentalThe number of span events that were discarded on the source. |
|
| long | experimentalNumber of |
|
| long | experimentalNumber of |
|
| long | experimentalThe number of span links that were discarded on the source. |
|
| string | deprecatedThe ID of the external service detected from this client span. The span comes from the service identified by |
|
| string[] | experimentalA string array of one or multiple error codes indicating issues in the assembly of a trace in Dynatrace. Typically, issues come from erroneous (3rd party) instrumentations (e.g. not sending a required field), data loss due to network connectivity (e.g. missing parent span) or conditions implied by the nature of the trace (e.g. trace exceeding the depth limit). The attribute is only present in case an assembly issue was detected (the list will not be empty). For more information and details about specific error codes, please reach out to Dynatrace support. |
|
| boolean | experimentalIndicates that |
|
| boolean | experimentalIndicates that the span stems from a request that was not marked as a key request. |
|
| duration | experimentalThe difference between the Dynatrace cluster node time and the |
|
| string[] | experimentalA string array of attribute keys that were not stored as they were not allow-listed or were removed during the pipeline steps. |
|
| timestamp | experimentalThe original start time of the span. Only available if the value of the |
|
| long | experimentalThe id of the Dynatrace cluster node this span was addressed to. This is only available if it differs from the value of |
|
| long | experimentalThe id of the Dynatrace cluster node that received and processed this span. |
|
Span sensor rules used during ingestion of OpenTelemetry/OpenTracing spans by instrumentation of the OpenTelemetry/OpenTracing Apis are applied at span start time. Therefore these rules can only operate on span attributes given at span start time.
The value at span start time of attributes captured by this instrumentation is preserved to allow proper rule configuration.
| Attribute | Type | Description | Examples |
|---|---|---|---|
| record | experimentalSpan attributes set at span start time in case it changed later. The value at span start is relevant for span rule evaluation done by OpenTelemetry/OpenTracing instrumentation. |
|
| array | experimentalList of attribute names set at span start invocation time. | |
| string | experimentalThe span name at span start time in case it changed later. The value at span start is relevant for span rule evaluation done by OpenTelemetry/OpenTracing instrumentation. |
|
The telemetry.sdk.* fields are used to describe the telemetry SDK in OpenTelemetry or ODIN ingest. It can be considered the closest equivalent of ODIN/OTel data to dt.agent.module.*.
The telemetry.exporter.* fields are used to define the exporter that exports telemetry data and is expected to be different for each exporter in case when multiple exporters co-exist.
| Attribute | Type | Description | Examples |
|---|---|---|---|
| string | resource experimentalThe exporter name. |
|
| string | resource experimentalThe version as exposed to the package manager (for example, npm). |
|
| string | resource experimentalThe full agent/exporter version. |
|
| string | resource stableThe programming language/tech of the telemetry SDK. |
|
| string | resource stableThe name of the telemetry SDK. |
|
| string | resource stableThe version string of the telemetry SDK. |
|
| Attribute | Type | Description | Examples |
|---|---|---|---|
| long | stableCurrent "managed" thread id (as opposed to OS thread id). |
|
| string | stableCurrent thread name. |
|
| string | stableThe name of the thread pool. |
|
The threat.* namespace provides structured fields for classifying security
detections according to industry-standard threat intelligence frameworks. These
are signal-level fields that annotate individual detection events alongside the
finding.* fields.
The threat.attack.* sub-namespace is scoped to the
MITRE ATT&CK framework. It carries tactic,
technique, and sub-technique identifiers for detections classified according to
MITRE ATT&CK. Future sibling namespaces (threat.atlas.*,
threat.kill_chain.*) will cover other threat classification frameworks.
In future updates this namespace could also consider information about IOCs, attribution,
and other threat intelligence data.
| Attribute | Type | Description | Examples |
|---|---|---|---|
| string | resource experimental | |
| string | resource experimental | |
| string | resource experimental | |
| string | resource experimental | |
| string | resource experimental | |
| string | resource experimental | |
| string | resource experimental | |
| string | resource experimental |
The time_correction namespace contains information on time corrections applied to the timestamps of an event, for example, start_time, timestamp or event.end.
Time corrections may be necessary if events are reported with timestamps that are completely off compared to cluster time. For example, Dynatrace RUM reported data can be off depending on client time.
| Attribute | Type | Description | Examples |
|---|---|---|---|
| boolean | experimentalIf set to |
|
| long | experimentalThe offset (in nanoseconds) that is applied to all timestamp fields. The value may be negative. |
|
| Attribute | Type | Description | Examples |
|---|---|---|---|
| timestamp | stableThe end of the timeframe, exclusive. |
|
| timestamp | stableThe start of the timeframe, inclusive. |
|
| Attribute | Type | Description | Examples |
|---|---|---|---|
| string | experimentalString indicating the cipher used during the current connection. |
|
| string | experimentalNormalized lowercase protocol name parsed from the original string of the negotiated SSL/TLS protocol version. |
|
| string | experimentalThe numeric part of the version parsed from the original string of the negotiated SSL/TLS protocol version. |
|
| Attribute | Type | Description | Examples |
|---|---|---|---|
| uid | experimentalThe preserved trace ID when OneAgent and other tracing systems monitor the same process and the trace ID from the other tracing system was replaced by the OneAgent trace ID. The |
|
| string[] | experimentalExplains why this trace was captured, multiple reasons can apply simultaneously. Note: The sampling approach ('atm' or 'fixed') is always placed at the first position in the array. These two values are mutually exclusive, though 'fixed' may appear with other capture triggers. Values: 'atm' (Dynatrace's intelligent sampling automatically adjusted trace capture based on traffic volume and system load), 'fixed' (trace captured due to configured percentage rules - either global settings or specific endpoint rules), 'custom' (trace captured because of custom correlation headers propagated between services or systems), 'mainframe' (trace originated from or includes IBM mainframe/z/OS components), 'serverless' (trace captured from serverless functions like AWS Lambda, Azure Functions, or similar platforms), 'rum' (trace initiated by user interactions in web browsers or mobile apps monitored by Dynatrace RUM agents). |
|
| uid | stableA unique identifier for a trace. The |
|
| boolean | experimentalFlag indicating whether the trace was recorded. If set to |
|
| string | experimentalThe trace state in the w3c-trace-context format. |
|
The url namespace contains semantic conventions for URL and its components.
| Attribute | Type | Description | Examples |
|---|---|---|---|
| string | experimentalThe URI domain component. |
|
| string | stableThe URI fragment component. |
|
| string | stableAbsolute URL describing a network resource according to RFC3986.Tags: |
|
| string | stableThe URI path component. |
|
| string | experimentalThe URL path pattern used to match a set of URLs with variable path segments. |
|
| long | experimentalThe URI port component. |
|
| string | experimentalThe provider type for the host name of |
|
| string | stableThe URI query component.Tags: |
|
| string | stableThe URI scheme component identifying the used protocol. |
|
| string | experimentalTruncated URI path component for endpoint detection of certain technologies that do not provide a |
|
url.provider MUST be one of the following:
| Value | Description | Display name |
|---|---|---|
| CDN (content delivery network). | CDN |
| First-party provider. | First Party |
| Third-party provider. | Third Party |
Representation of a physical or logical user.
| Attribute | Type | Description | Examples |
|---|---|---|---|
| string | stableEmail of the user. |
|
| string | stableUnique UUID of a human user. If the system itself has to be represented, the constant 'system' is used. |
|
| string | experimentalFull name of the user. If the system itself has to be represented, the constant 'System' is used. |
|
| string | experimentalOrganization the user belongs to. |
|
user.organization MUST be one of the following:
| Value | Description | Display name |
|---|---|---|
| Customer organization | Customer |
| Dynatrace organization | Dynatrace |
| Dynatrace partner organization | Partner |
user.organization MUST be one of the following:
| Value | Description |
|---|---|
| Dynatrace organization |
| Customer organization |
| Dynatrace partner organization |
The vcs namespace contains information about Version Control Systems.
| Attribute | Type | Description | Examples |
|---|---|---|---|
| string | experimentalThe identifier of the change, for example, pull request ID or merge request ID. It is typically unique per repository and generated by the version control system itself. |
|
| string | experimentalThe state of the change, for example, the state of a pull request or merge request. |
|
| string | experimentalThe human-readable title of the change, for example, pull request title or merge request title. |
|
| string | experimentalThe full URL to the change, for example, the full URL to the pull request or merge request. |
|
| string | experimentalThe type of line change being measured on a branch or change. |
|
| string | experimentalThe name of the reference in the repository. This can be a branch name or a tag name. 1 |
|
| string | experimentalThe revision in the repository. For Git this is a synonym for a commit hash, whereas in SVN it is a revision number. 2 |
|
| string | experimentalThe reference type in the repository. 3 |
|
| string | experimentalThe name of the reference in the repository. This can be a branch name or a tag name. 4 |
|
| string | experimentalThe revision in the repository. For Git, this is a synonym for a commit hash, whereas in SVN, it is a revision number. 5 |
|
| string | experimentalThe reference type in the repository. 6 |
|
| string | experimentalThe reference type in the repository. |
|
| string | experimentalThe human-readable name of the repository. It should not include any additional identifiers like GitLab group or GitHub organization. 7 |
|
| string | experimentalThe repository's full URL. 8 |
|
| string | experimentalThe type of revision comparison. |
|
The base name refers to the starting point of a change. For example, if a feature branch was created from main,
main is the base reference of type branch.
The base revision refers to the starting revision of a change. For example, if a branch was created from a certain commit, this commit is the base revision.
The base type refers to the reference type of the starting point of a change. For example,
if a feature branch was created from the main branch, branch is the base reference's type.
The head name refers to the current reference's name. For example,
if main is currently checked out, the head name is main.
The head revision refers to the currently referenced revision.
The head type refers to the currently referenced type in the repository. For example,
if the main branch is currently checked out, the head reference is of type branch.
Be aware that the repository name might clash with forked repositories.
For Git VCS, this should not include the .git URL suffix.
vcs.change.state has the following list of well-known values. If one of them applies, then the respective value MUST be used, otherwise a custom value MAY be used.
| Value | Description | Display name |
|---|---|---|
| The change was closed without being merged into the target code base. | Closed |
| The change has successfully been merged into the target code base. | Merged |
| The change is open and ready for review or currently under review. It has not been merged yet, and changes are still possible. | Open |
| The change was re-opened after being | Reopened |
| The change is still a work in progress and not yet ready for review. | Work In Progress |
vcs.line_change.type has the following list of well-known values. If one of them applies, then the respective value MUST be used, otherwise a custom value MAY be used.
| Value | Description | Display name |
|---|---|---|
| How many lines were added. | Added |
| How many lines were removed. | Removed |
vcs.ref.base.type has the following list of well-known values. If one of them applies, then the respective value MUST be used, otherwise a custom value MAY be used.
| Value | Description | Display name |
|---|---|---|
| The base reference type is a branch. | Branch |
| The base reference type is a tag. | Tag |
vcs.ref.head.type has the following list of well-known values. If one of them applies, then the respective value MUST be used, otherwise a custom value MAY be used.
| Value | Description | Display name |
|---|---|---|
| The head reference type is a branch. | Branch |
| The head reference type is a tag. | Tag |
vcs.ref.type has the following list of well-known values. If one of them applies, then the respective value MUST be used, otherwise a custom value MAY be used.
| Value | Description | Display name |
|---|---|---|
| The reference type is a branch. | Branch |
| The reference type is a tag. | Tag |
vcs.revision_delta.direction has the following list of well-known values. If one of them applies, then the respective value MUST be used, otherwise a custom value MAY be used.
| Value | Description | Display name |
|---|---|---|
| How many revisions the change is ahead of the target ref. | Ahead |
| How many revisions the change is behind of the target ref. | Behind |
Fields that can come from applications running on VMware.
| Attribute | Type | Description | Examples |
|---|---|---|---|
| string | resource experimentalThe name of the data center in which the hypervisor is running. |
|
| string | resource experimentalESXi host disk. |
|
| string | resource experimentalESXi host. |
|
| string | resource experimentalESXi host network interface. |
|
| string | resource experimentalName of the VMware vCenter server managing the multi-hypervisor environment. |
|
| string | resource experimentalThe name of the virtual machine. |
|
| Attribute | Type | Description | Examples |
|---|---|---|---|
| string | stableName of the code location where the code-level vulnerability was detected. |
|
| double | stableVulnerability's CVSS base score provided by NVD. |
|
| string | stableVulnerability's CVSS score version. |
|
| string | stableAvailability of the information based on which the vulnerability assessment has been done. |
|
| string[] | experimentalReasons for the assessment mode. |
|
| string | stableVulnerability's reachability of related data assets by affected entities. |
|
| string | stableVulnerability's public exploits status. |
|
| string | stableVulnerability's internet exposure status. |
|
| string | stableVulnerability's risk level based on Davis Security Score. |
|
| double | stableVulnerability's Davis Security Score (1-10) calculated by Dynatrace. |
|
| string | stableUsage status of the vulnerable functions causing the vulnerability. |
|
| string | stableDescription of the vulnerability. |
|
| string | stableDynatrace user-readable identifier for the vulnerability. |
|
| string | experimentalWhether there is a known exploit for the vulnerability. |
|
| string | stableExternal provider's unique identifier for the vulnerability. |
|
| string | stableExternal provider's URL to the details page of the vulnerability. |
|
| timestamp | stableTimestamp of when the vulnerability was first detected. |
|
| string | stableDynatrace unique identifier for the vulnerability. |
|
| boolean | experimentalIndicates if a vulnerability fix is available. | |
| timestamp | stableTimestamp of the vulnerability's last muted or unmuted action. |
|
| string | experimentalComment when muting or unmuting the vulnerability. |
|
| string | stableReason for muting or unmuting the vulnerability. |
|
| string | stableVulnerability's mute status. |
|
| string | stableUser who last changed the vulnerability's mute status. |
|
| string | stableAvailability of the information based on which the vulnerability assessment has been done. |
|
| string | stableVulnerability's reachability of related data assets by affected entities. |
|
| string | stableVulnerability's internet exposure status. |
|
| string | stableVulnerability's Davis Security Score level. |
|
| double | stableVulnerability's Davis Security Score (1-10) calculated by Dynatrace. |
|
| string | stableUsage status of vulnerable functions causing the vulnerability. Status is |
|
| string | stableTimestamp of when the vulnerability was first detected. |
|
| timestamp | stableTimestamp of the last mute or unmute action of the vulnerability. |
|
| string | stableReason for muting or unmuting the vulnerability. |
|
| string | stableVulnerability's mute status. |
|
| string | stableUser who last changed the vulnerability's mute status. |
|
| string | stableTimestamp of the vulnerability's last resolution status change. |
|
| string | stableCurrent status of the vulnerability. |
|
| string | stableVulnerability's risk score level defined by the provider. For Dynatrace, the Davis Security Score level. |
|
| double | stableVulnerability's risk score defined by the provider. For Dynatrace, Davis Security Score. |
|
| double | stableVulnerability's previous CVSS base score (in case the CVSS base score has changed). |
|
| string | stableVulnerability's previous reachability of related data assets by affected entities (in case the reachability has changed). |
|
| string | stableVulnerability's previous public exploit status (in case the public exploit status has changed). |
|
| string | stableVulnerability's previous internet exposure status (in case the internet exposure status has changed). |
|
| string | stableVulnerability's previous risk level (in case the risk level has changed). |
|
| double | stableVulnerability's previous Davis Security Score (in case Davis Security Score has changed). |
|
| string | stableVulnerability's previous vulnerable function status (in case the vulnerable function status has changed). |
|
| string | experimentalVulnerability’s unique identifier from the previous external provider. |
|
| string | stableTimestamp of the vulnerability's previous mute status (in case the mute status has changed). |
|
| string | experimentalComment of the vulnerability's previous mute status. |
|
| string | stableReason for last muting or unmuting the vulnerability (in case the reason for muting or unmuting the vulnerability has changed). |
|
| string | stableVulnerability's previous mute status (in case the mute status has changed). |
|
| string | stableUser who last changed the vulnerability's mute status (in case the mute status was last changed by a different user). |
|
| string | stableVulnerability's previous resolution status (in case the resolution status has changed). |
|
| string | stableVulnerability's previous risk score level (in case the risk score level has changed). |
|
| double | stableVulnerability's previous risk score (in case the risk score has changed). |
|
| string[] | stableList of the vulnerability's CVE IDs. |
|
| string[] | stableList of the vulnerability's CWE IDs. |
|
| string[] | stableList of vulnerability's OWASP IDs. |
|
| string | experimentalDescription of the vulnerability's remediation advice. |
|
| string | experimentalIndicates whether a fix for the vulnerability is available. |
|
| timestamp | stableTimestamp of the vulnerability's last resolution status change. |
|
| string | stableVulnerability's resolution status. |
|
| string | stableVulnerability's risk score level defined by the provider. For Dynatrace, the Davis Security Score level. |
|
| string | stableScale by which the vulnerability's risk score and risk score level defined by the provider are measured. |
|
| double | stableVulnerability's risk score defined by the provider. For Dynatrace, Davis Security Score. |
|
| string | experimentalLevel of the vulnerable component in the technological stack. |
|
| string | stableTechnology of the vulnerable component. |
|
| string | stableTitle of the vulnerability. |
|
| string | stableClassification of the vulnerability based on commonly accepted enums, such as CWE. |
|
| string | stableDynatrace URL to the details page of the vulnerability. | |
|
vulnerability.davis_assessment.assessment_mode has the following list of well-known values. If one of them applies, then the respective value MUST be used, otherwise a custom value MAY be used.
| Value | Description | Display name |
|---|---|---|
| full | Full |
| not_available | Not Available |
| reduced | Reduced |
vulnerability.davis_assessment.data_assets_status has the following list of well-known values. If one of them applies, then the respective value MUST be used, otherwise a custom value MAY be used.
| Value | Description | Display name |
|---|---|---|
| not_available | Not Available |
| not_detected | Not Detected |
| reachable | Reachable |
vulnerability.davis_assessment.exploit_status has the following list of well-known values. If one of them applies, then the respective value MUST be used, otherwise a custom value MAY be used.
| Value | Description | Display name |
|---|---|---|
| available | Available |
| not_available | Not Available |
vulnerability.davis_assessment.exposure_status has the following list of well-known values. If one of them applies, then the respective value MUST be used, otherwise a custom value MAY be used.
| Value | Description | Display name |
|---|---|---|
| adjacent_network | Adjacent Network |
| not_available | Not Available |
| not_detected | Not Detected |
| public_network | Public Network |
vulnerability.davis_assessment.level has the following list of well-known values. If one of them applies, then the respective value MUST be used, otherwise a custom value MAY be used.
| Value | Description | Display name |
|---|---|---|
| critical | Critical |
| high | High |
| low | Low |
| medium | Medium |
| none | No risk |
vulnerability.davis_assessment.vulnerable_function_status has the following list of well-known values. If one of them applies, then the respective value MUST be used, otherwise a custom value MAY be used.
| Value | Description | Display name |
|---|---|---|
| in_use | In Use |
| not_available | Not Available |
| not_in_use | Not In Use |
vulnerability.mute.reason has the following list of well-known values. If one of them applies, then the respective value MUST be used, otherwise a custom value MAY be used.
| Value | Description | Display name |
|---|---|---|
| affected | Affected |
| configuration_not_affected | Configuration Not Affected |
| false_positive | False Positive |
| ignore | Ignore |
| other | Other |
vulnerability.mute.status has the following list of well-known values. If one of them applies, then the respective value MUST be used, otherwise a custom value MAY be used.
| Value | Description | Display name |
|---|---|---|
| muted | Muted |
| not_muted | Not Muted |
vulnerability.parent.davis_assessment.assessment_mode has the following list of well-known values. If one of them applies, then the respective value MUST be used, otherwise a custom value MAY be used.
| Value | Description | Display name |
|---|---|---|
| full | Full |
| not_available | Not Available |
| reduced | Reduced |
vulnerability.parent.davis_assessment.data_assets_status has the following list of well-known values. If one of them applies, then the respective value MUST be used, otherwise a custom value MAY be used.
| Value | Description | Display name |
|---|---|---|
| not_available | Not Available |
| not_detected | Not Detected |
| reachable | Reachable |
vulnerability.parent.davis_assessment.exposure_status has the following list of well-known values. If one of them applies, then the respective value MUST be used, otherwise a custom value MAY be used.
| Value | Description | Display name |
|---|---|---|
| adjacent_network | Adjacent Network |
| not_available | Not Available |
| not_detected | Not Detected |
| public_network | Public Network |
vulnerability.parent.davis_assessment.level has the following list of well-known values. If one of them applies, then the respective value MUST be used, otherwise a custom value MAY be used.
| Value | Description | Display name |
|---|---|---|
| critical | Critical |
| high | High |
| low | Low |
| medium | Medium |
| none | No risk |
vulnerability.parent.davis_assessment.vulnerable_function_status has the following list of well-known values. If one of them applies, then the respective value MUST be used, otherwise a custom value MAY be used.
| Value | Description | Display name |
|---|---|---|
| in_use | In Use |
| not_available | Not Available |
| not_in_use | Not In Use |
vulnerability.parent.mute.reason has the following list of well-known values. If one of them applies, then the respective value MUST be used, otherwise a custom value MAY be used.
| Value | Description | Display name |
|---|---|---|
| affected | Affected |
| configuration_not_affected | Configuration Not Affected |
| false_positive | False Positive |
| ignore | Ignore |
| other | Other |
vulnerability.parent.mute.status has the following list of well-known values. If one of them applies, then the respective value MUST be used, otherwise a custom value MAY be used.
| Value | Description | Display name |
|---|---|---|
| muted | Muted |
| not_muted | Not Muted |
vulnerability.parent.resolution.status has the following list of well-known values. If one of them applies, then the respective value MUST be used, otherwise a custom value MAY be used.
| Value | Description | Display name |
|---|---|---|
| open | Open |
| resolved | Resolved |
vulnerability.parent.risk.level has the following list of well-known values. If one of them applies, then the respective value MUST be used, otherwise a custom value MAY be used.
| Value | Description | Display name |
|---|---|---|
| critical | Critical |
| high | High |
| low | Low |
| medium | Medium |
| none | No risk |
vulnerability.previous.davis_assessment.data_assets_status has the following list of well-known values. If one of them applies, then the respective value MUST be used, otherwise a custom value MAY be used.
| Value | Description | Display name |
|---|---|---|
| not_available | Not Available |
| not_detected | Not Detected |
| reachable | Reachable |
vulnerability.previous.davis_assessment.exploit_status has the following list of well-known values. If one of them applies, then the respective value MUST be used, otherwise a custom value MAY be used.
| Value | Description | Display name |
|---|---|---|
| available | Available |
| not_available | Not Available |
vulnerability.previous.davis_assessment.exposure_status has the following list of well-known values. If one of them applies, then the respective value MUST be used, otherwise a custom value MAY be used.
| Value | Description | Display name |
|---|---|---|
| adjacent_network | Adjacent Network |
| not_available | Not Available |
| not_detected | Not Detected |
| public_network | Public Network |
vulnerability.previous.davis_assessment.level has the following list of well-known values. If one of them applies, then the respective value MUST be used, otherwise a custom value MAY be used.
| Value | Description | Display name |
|---|---|---|
| critical | Critical |
| high | High |
| low | Low |
| medium | Medium |
| none | No risk |
vulnerability.previous.davis_assessment.vulnerable_function_status has the following list of well-known values. If one of them applies, then the respective value MUST be used, otherwise a custom value MAY be used.
| Value | Description | Display name |
|---|---|---|
| in_use | In Use |
| not_available | Not Available |
| not_in_use | Not In Use |
vulnerability.previous.mute.status has the following list of well-known values. If one of them applies, then the respective value MUST be used, otherwise a custom value MAY be used.
| Value | Description | Display name |
|---|---|---|
| muted | Muted |
| not_muted | Not Muted |
vulnerability.previous.resolution.status has the following list of well-known values. If one of them applies, then the respective value MUST be used, otherwise a custom value MAY be used.
| Value | Description | Display name |
|---|---|---|
| open | Open |
| resolved | Resolved |
vulnerability.previous.risk.level has the following list of well-known values. If one of them applies, then the respective value MUST be used, otherwise a custom value MAY be used.
| Value | Description | Display name |
|---|---|---|
| critical | Critical |
| high | High |
| low | Low |
| medium | Medium |
| none | No risk |
vulnerability.resolution.status has the following list of well-known values. If one of them applies, then the respective value MUST be used, otherwise a custom value MAY be used.
| Value | Description | Display name |
|---|---|---|
| open | Open |
| resolved | Resolved |
vulnerability.risk.level has the following list of well-known values. If one of them applies, then the respective value MUST be used, otherwise a custom value MAY be used.
| Value | Description | Display name |
|---|---|---|
| critical | Critical |
| high | High |
| low | Low |
| medium | Medium |
| none | No risk |
vulnerability.stack has the following list of well-known values. If one of them applies, then the respective value MUST be used, otherwise a custom value MAY be used.
| Value | Description | Display name |
|---|---|---|
| code | Code |
| code_library | Code Library |
| container_orchestration | Container Orchestration |
| software | Software |
vulnerability.technology has the following list of well-known values. If one of them applies, then the respective value MUST be used, otherwise a custom value MAY be used.
| Value | Description | Display name |
|---|---|---|
| dotnet | .NET |
| go | Go |
| java | Java |
| node_js | Node.js |
| php | PHP |
| Attribute | Type | Description | Examples |
|---|---|---|---|
| string | resource experimentalThe name of the cluster this instance belongs to. |
|
| string | resource experimentalThe name of the domain this instance belongs to. |
|
| string | resource experimentalThe instance's home directory. |
|
| string | resource experimentalThe instance's server name. |
|
The WebSocket namespace contains information on WebSocket attributes for user events. When this namespace is used, the request fields (URL and network namespace) must also be used, and url.full and network.protocol.name must be set.
| Attribute | Type | Description | Examples |
|---|---|---|---|
| long | experimentalThe WebSocket connection status code. |
|
| Attribute | Type | Description | Examples |
|---|---|---|---|
| string | resource experimentalThe name of the cell this instance belongs to. |
|
| string | resource experimentalThe name of the cluster this instance belongs to. |
|
| string | resource experimentalName of the node to which this instance belongs. |
|
| string | resource experimentalThe instance's server name. |
|
| Attribute | Type | Description | Examples |
|---|---|---|---|
| string | resource experimentalThe instance's server name. |
|
| Attribute | Type | Description | Examples |
|---|---|---|---|
| long | experimentalEvent ID is a unique identifier assigned to each event logged by the system. Each event ID corresponds to a specific type of event, such as an error, warning, or informational message. (4624 -> successful logon, 1000 -> application error) |
|
| string | experimentalKeywords are used to categorize and group events. This categorization allows to quickly identify and focus on specific types of events that are relevant to your troubleshooting or monitoring needs. |
|
| string | experimentalLevel of an event indicates its severity or importance |
|
| string | experimentalOpcode is a value that identifies a specific activity or a point within an activity that the application was performing when it raised the event. This helps in understanding the context of the event more precisely. |
|
| string | experimentalProvider is a component or service that generates events. Providers are responsible for writing specific types of events to the event logs, such as application errors, security events, or system warnings. |
|
| long | experimentalTask refers to the specific operation or activity that an event is associated with. Each event is categorized under a task, which helps in identifying what the system or application was doing when the event was logged. This can be particularly useful for troubleshooting and understanding the context of the event. (5 -> HTTP Configuration Property Trace Task, 12804 -> Other Object Access Events) |
|
| string | experimentalUsername refers to the account name associated with specific events, such as logon or logoff activities. This is particularly useful for tracking user activity and identifying who was logged into the system at a given time. |
|
| Attribute | Type | Description | Examples |
|---|---|---|---|
| string | resource experimentalThe system ID of the CICS region that this transaction executed on. |
|
| long | resource experimentalThe address space identifier (ASID) of the z/OS address space. |
|
| string | resource experimentalThe model number of the CPU assigned to this LPAR. |
|
| string | resource experimentalThe serial number of the CPU assigned to this LPAR. |
|
| string | resource experimentalThe job ID of the z/OS address space. |
|
| string | resource experimentalThe jobname of the z/OS address space. |
|
| string | resource experimentalThe step ID within the job within the z/OS address space. |
|
| string | resource experimentalThe name of the LPAR that the z/OS address space executes within. |
|
| string | resource experimentalThe system ID of the CICS/IMS address space. |
|
| string | resource experimentalThe name of the z/OS system instance. |
|
| long | resource experimentalThe number of general purpose processors (GCPs) assigned for this LPAR. |
|
| long | resource experimentalThe total amount of memory, in terabytes, assigned for this LPAR. |
|
| long | resource experimentalThe number of zIIPs assigned for this LPAR. |
|
| string | resource experimentalThe jobname of the z/OS address space that the transaction executed in. |
|
| string | resource experimentalThe name of the LPAR that the transaction executed on. |
|
| string | resource experimentalType of virtualization on the mainframe. |
|
| Attribute | Type | Description | Examples |
|---|---|---|---|
| string | experimentalThe type of transaction call that was invoked. |
|
| string | experimentalThe ID of this transaction. |
|
| string | experimentalThe type of transaction that was executed. |
|
zos.transaction.call_type MUST be one of the following:
| Value | Description | Display name |
|---|---|---|
| A CTG request triggered this transaction. | CTG |
| A CICS DPL request triggered this transaction. | DPL |
| An HTTP or HTTPS request triggered this transaction. | HTTP |
| An IMS Connect request triggered this transaction. | IMS Connect |
| An IMS Connect API request triggered this transaction. | IMS Connect API |
| The application program being scheduled and running to handle this transaction. | IMS transaction execute |
| An IMS TM Resource Adapter request triggered this transaction. | ITRA |
| An MQ operation triggered this transaction. | MQ |
| An IMS MSC request triggered this transaction. | MSC |
| An IMS Program Switch request triggered this transaction. | Program switch |
| An SDK call triggered this transaction. | SDK |
| An IMS Shared Queue request triggered this transaction. | Shared queue |
| A SOAP request triggered this transaction. | SOAP |
| An EXEC CICS START triggered this transaction. | START |
| A green screen terminal transaction code triggered this transaction. | TTX |
| A CICS or IMS transaction code triggered this transaction. | TX |
| A z/OS Connect request triggered this transaction. | z/OS Connect |
zos.transaction.program_type MUST be one of the following:
| Value | Description | Display name |
|---|---|---|
| The transaction performs DB2 database actions. | DB2 |
| The transaction performs DLI database actions. | DLI database |
| The transaction performs DLI data communications actions. | DLI data communications |
| The transaction performs MQ Queue actions. | MQ |
| Attribute | Type | Description | Examples |
|---|---|---|---|
| string | experimentalThe name of the transaction class of this transaction. |
|
| ipAddress | experimentalIP address of the client (IPv4 or IPv6) that made the request that triggered the transaction. |
|
| long | experimentalPort number of the client that made the request that triggered the transaction. |
|
| string | experimentalThe path name, only applicable for web requests. |
|
| long | experimentalThe CICS task ID of this transaction. |
|
| string | experimentalThe transaction group ID assigned at transaction attach time. |
|
| long | experimentalThe unit of work ID for this transaction, which is normally represented as a hex value. |
|
| string | experimentalThe user ID of the user who triggered this transaction. |
|
| string | experimentalThe name of the z/OS Workload Manager (WLM) reporting service class of this transaction. |
|
| string | experimentalThe name of the z/OS Workload Manager (WLM) service class of this transaction. |
|
| Attribute | Type | Description | Examples |
|---|---|---|---|
| string | experimentalThe system ID of the CICS region that is defined on the request. |
|
| boolean | experimentalA boolean that is true if the file is defined within the CICS region that it executed in. |
|
| string | experimentalThe logical name of the file, as defined in CEDA. |
|
| Attribute | Type | Description | Examples |
|---|---|---|---|
| long | experimentalThe number of segments in the message. |
|
| long | experimentalThe size of the message. |
|
| string | experimentalThe terminal name that this IMS transaction executed on. |
|
| long | experimentalThe unit of work ID for this transaction, which is normally represented as a hex value. |
|
| string | experimentalThe user ID of the user who triggered this transaction. |
|
| Attribute | Type | Description | Examples |
|---|---|---|---|
| long | experimentalThe commit count for this transaction. |
|
| long | experimentalThe current priority of this transaction. |
|
| long | experimentalThe execution class of this transaction. |
|
| string | experimentalThe PSB name that this IMS transaction executed on. |
|
| long | experimentalThe schedule count for this transaction. |
|
| long | experimentalThe unit of work ID for this transaction, which is normally represented as a hex value. |
|
| Attribute | Type | Description | Examples |
|---|---|---|---|
| ipAddress | experimentalIP address of the client (IPv4 or IPv6) that made the request that triggered the transaction. |
|
| long | experimentalPort number on the IMS Connect server that received the request for this transaction |
|
| string | experimentalThe user ID of the user who triggered this transaction. |
|
| Attribute | Type | Description | Examples |
|---|---|---|---|
| string | experimentalThe detection version for this transaction. |
|
| ipAddress | experimentalIP address of the client (IPv4 or IPv6) that made the request that triggered the transaction. |
|
| long | experimentalPort number of the client that made the request that triggered the transaction. |
|
| long | experimentalThe commit mode of the transaction. |
|
| string | experimentalThe datastore name used by this transaction. |
|
| long | experimentalThe interaction verb that triggered the transaction. |
|
| string | experimentalThe name of the LPAR that the transaction executed on. |
|
| long | experimentalIndicates the synchronization level of the transaction. This only applies when the interaction verb is set to "SYNC_SEND_RECEIVE", "SYNC_SEND", or "SYNC_RECEIVE_CALLOUT". This attribute applies to both conversational and non-conversational applications. It is used in conjuction with the ims.transaction.request.transaction.commit_mode attribute. |
|
ims.tm.resource.adapter.transaction.commit_mode MUST be one of the following:
| Value | Description | Display name |
|---|---|---|
| The commit happens before sending the response. | Commit then send |
| The commit is deferred until the response has been sent and acknowledged. | Send then commit |
ims.tm.resource.adapter.transaction.interaction_verb MUST be one of the following:
| Value | Description | Display name |
|---|---|---|
| SYNC_SEND | SYNC_SEND |
| SYNC_SEND_RECEIVE | SYNC_SEND_RECEIVE |
| SYNC_END_CONVERSATION | SYNC_END_CONVERSATION |
| SYNC_RECEIVE_ASYNCOUTPUT | SYNC_RECEIVE_ASYNCOUTPUT |
| SYNC_RECEIVE_ASYNCOUTPUT_SINGLE_NOWAIT | SYNC_RECEIVE_ASYNCOUTPUT_SINGLE_NOWAIT |
| SYNC_RECEIVE_ASYNCOUTPUT_SINGLE_WAIT | SYNC_RECEIVE_ASYNCOUTPUT_SINGLE_WAIT |
| SYNC_RECEIVE_CALLOUT | SYNC_RECEIVE_CALLOUT |
ims.tm.resource.adapter.transaction.sync_level MUST be one of the following:
| Value | Description | Display name |
|---|---|---|
| There will be no synchronization. | No synchronization |
| Synchronization will be confirmed. | Confirm |
| Attribute | Type | Description | Examples |
|---|---|---|---|
| string | experimentalThe z/OS Connect API description. |
|
| string | experimentalThe z/OS Connect API name. |
|
| string | experimentalThe z/OS Connect API version. |
|
| long | experimentalThe size of the request payload in bytes. |
|
| long | experimentalThe z/OS Connect request ID. |
|
| string | experimentalThe type of the REST request. 1 |
|
| long | experimentalThe size of the response payload in bytes. |
|
| string | experimentalThe z/OS Connect service description. |
|
| string | experimentalThe z/OS Connect service name. |
|
| string | experimentalThe service provider name. |
|
| string | experimentalThe z/OS Connect service version. |
|
| string | experimentalThe system of record identifier. The format differs depending on the SOR type. 2 |
|
| string | experimentalThe system of record reference. |
|
| string | experimentalIdentifier for the resource invoked on the system of record. The format differs depending on the SOR type. 3 |
|
| string | experimentalThe system of record type. |
|
zosconnect.request.type MUST be one of the following:
| Value | Description | Display name |
|---|---|---|
| admin | Admin |
| api | API |
| service | Service |
| unknown | Unknown |
zosconnect.sor.type MUST be one of the following:
| Value | Description | Display name |
|---|---|---|
| cics | CICS |
| ims | IMS |
| mq | MQ |
| rest | REST |
| wola | WOLA |