Global field reference

Latest Dynatrace
Overview

The following reference contains a list of global fields that have a well defined semantic meaning in Dynatrace and can be used across different monitoring types. The fields are organized in namespaces that are separated with dots.

Base fields

The top level fields contain generally relevant information for all events and data points.

Attribute	Type	Description	Examples
`timestamp`	timestamp	stable Display name: `Timestamp` The time (UNIX Epoch time in nanoseconds) when the event originated, typically when the source created it. If no original timestamp is available, it will be populated at ingest time and required for all events. In the case of a correlated event (for example, ITIL events), this time could be different from the event.start time, as this time represents the actual timestamp when the "update" for the event was created.	`1649822520123123123`
`timeframe`	record[]	stable Display name: `Timeframe` The timeframe represented by a timeseries record.
`start_time`	timestamp	stable Display name: `Start time` Start time of a data point. Value is a UNIX Epoch time in nanoseconds and less than or equal to the `end_time`.	`1649822520123123123`
`end_time`	timestamp	stable Display name: `End time` End time of a data point. Value is a UNIX Epoch time in nanoseconds and greater than or equal to the `start_time`.	`1649822520123123165`
`duration`	duration	stable Display name: `Duration` The difference between `start_time` and `end_time` in nanoseconds.	`42`
`interval`	string	stable Display name: `Interval` Denotes the timeframe of represented by individual timeseries measurements returned by a timeseries record.	`1 min`

Actor

The actor namespace describes the origin of a security detection—the entity or location from which a threat or suspicious activity originates.

Actor fields

Attribute	Type	Description	Examples
`actor.geo.city.name`	string	experimental Display name: `Actor city name` Name of the city from which the actor operates.	`Rome`
`actor.geo.continent.name`	string	experimental Display name: `Actor continent name` Name of the continent from which the actor operates.	`North America`
`actor.geo.country.name`	string	experimental Display name: `Actor country name` Name of the country from which the actor operates.	`Canada`
`actor.ips`	ipAddress[]	stable Display name: `Actor IP addresses` List of the client's IP addresses (IPv4 or IPv6) from which the actor operates.	`[168.10.15.23, 2a01:468:1000:9::140]`
`actor.k8s.cluster.name`	string	experimental Display name: `Actor Kubernetes cluster name` Name of the Kubernetes cluster from which the actor operates (for example, in case of a compromised or malicious pod/node).	`cluster-1`; `rancher01`
`actor.k8s.cluster.uid`	string	experimental Display name: `Actor Kubernetes cluster UID` UID of the Kubernetes cluster from which the actor operates (for example, in case of a compromised or malicious pod/node).	`5585eaa3-ad66-4265-824f-dfd425787f98`; `7af5dc69-47c1-4fe3-8575-9c6312ce0989`
`actor.k8s.container.name`	string	experimental Display name: `Actor Kubernetes container name` Name of the container within a Kubernetes pod from which the actor operates (for example, in case of a compromised or malicious pod).	`nginx`; `envoy`
`actor.k8s.namespace.name`	string	experimental Display name: `Actor Kubernetes namespace name` Name of the Kubernetes namespace from which the actor operates (for example, in case of a compromised or malicious pod).	`default`; `kube-system`
`actor.k8s.namespace.uid`	string	experimental Display name: `Actor Kubernetes namespace UID` UID of the Kubernetes namespace from which the actor operates (for example, in case of a compromised or malicious pod).	`53b47584-8a1b-46f2-b099-528061cbbecd`; `3d8092f4-7fed-4d10-9d99-47c4aec79bcb`
`actor.k8s.pod.name`	string	experimental Display name: `Actor Kubernetes pod name` Name of the Kubernetes pod from which the actor operates (for example, in case of a compromised or malicious pod).	`unguard-ad-service-7ff74956fc-nxx9d`; `unguard-proxy-service-6486fb5755-vjmgq`
`actor.k8s.pod.uid`	string	experimental Display name: `Actor Kubernetes pod UID` UID of the Kubernetes pod from which the actor operates (for example, in case of a compromised or malicious pod).	`52df79a0-f12b-42c8-88be-8ed50ace6b6d`; `51c7c9a1-5905-4eb1-9a13-01efac50cadb`

Adobe

Adobe fields

Attribute	Type	Description	Examples
`adobe.em.env_type`	string	resource experimental Display name: `Adobe Experience Manager environment type` Adobe Experience Manager (AEM) environment type.	`dev`; `stage`; `prod`
`adobe.em.program`	string	resource experimental Display name: `Adobe Experience Manager program` Adobe Experience Manager (AEM) service. Contains the customer defined name of the AEM environment.
`adobe.em.service`	string	resource experimental Display name: `Adobe Experience Manager service` Adobe Experience Manager (AEM) service. Contains the program and environment IDs the customer is exposed to.
`adobe.em.tier`	string	resource experimental Display name: `Adobe Experience Manager tier` Adobe Experience Manager (AEM) tier.	`author`; `publish`; `preview`

Aggregation

OneAgent might aggregate spans that have the same parent span into a single span. The aggregated span contains attributes to indicate the aggregation and to allow reconstructing details.

Aggregation fields

For aggregated spans the start_time holds the earliest start_time, end_time holds the latest end_time of all aggregated spans.

Attribute	Type	Description	Examples
`aggregation.count`	long	stable Display name: `Aggregation count` The number of spans aggregated into this span. Because this span represents multiple spans, the value is >1.	`3`
`aggregation.duration_max`	duration	stable Display name: `Aggregation duration maximum` The duration in nanoseconds for the longest aggregated span.	`482`
`aggregation.duration_min`	duration	stable Display name: `Aggregation duration minimum` The duration in nanoseconds for the shortest aggregated span.	`42`
`aggregation.duration_samples`	duration[]	stable Display name: `Aggregation duration samples` Array of reservoir sampled span durations of the aggregated spans. The duration samples can be used to estimate a more accurate duration distribution of aggregated spans rather than the average value.	`[42, 482, 301]`
`aggregation.duration_sum`	duration	stable Display name: `Aggregation duration sum` The duration sum in nanoseconds for all aggregated spans.	`123`
`aggregation.exception_count`	long	stable Display name: `Aggregation exception count` The number of aggregated spans that included an exception.	`0`; `6`
`aggregation.parallel_execution`	boolean	stable Display name: `Aggregation parallel execution` `true` indicates that aggregated spans may have been executed in parallel. Therefore, `start_time + duration_sum` may exceed `end_time`.

Anomaly

Anomaly signal fields

Signal-level fields for Anomaly telemetry.

Attribute	Type	Description	Examples
`anomaly.detector`	string	experimental Display name: `Anomaly detector` Identifies the workflow or plugin that detected the anomaly. Values follow the `dsoa.<workflow\_name>` convention (for example, `dsoa.data\_volume\_anomaly`) except for the failed-login detector which uses `dsoa.failed\_login\_detection`.	`dsoa.data_volume_anomaly`
`anomaly.direction`	string	experimental Display name: `Anomaly direction` Direction of the anomaly relative to the Davis AI baseline: `above` when the metric exceeded the upper bound, `below` when it dropped under the lower bound.	`above`
`anomaly.subject`	string	experimental Display name: `Anomaly subject` High-level category classifying the anomaly subject within its detector.	`['login']`

anomaly.direction MUST be one of the following:

Value	Description
`above`	Metric value exceeded the expected upper threshold.
`below`	Metric value dropped below the expected lower threshold.

anomaly.subject has the following list of well-known values. If one of them applies, then the respective value MUST be used, otherwise a custom value MAY be used.

Value	Description
`data_scan`	Anomaly in data volume scanned (security anomaly detection workflow).
`disappeared`	Share object no longer present in the account (broken shares detection workflow).
`login`	Anomaly in login attempt counts (security anomaly detection workflow).
`query_count`	Anomaly in query execution counts (security anomaly detection workflow).
`session`	Anomaly in active session counts (security anomaly detection workflow).
`unavailable`	Share object no longer accessible (broken shares detection workflow).
`volume_drop`	Detected drop in data rows for a share (broken shares detection workflow).

Apache HTTP Server

Apache Tomcat fields

Attribute	Type	Description	Examples
`apache.tomcat.base`	string	resource experimental Display name: `Apache Tomcat base directory` The server's base directory. This is what usually is referred to as CATALINA_BASE.	`/usr/share/tomcat6`
`apache.tomcat.home`	string	resource experimental Display name: `Apache Tomcat home directory` The server's home directory. This is what usually is referred to as CATALINA_HOME.	`/usr/share/tomcat6`

Apache HTTP Server fields

Attribute	Type	Description	Examples
`apache.httpd.config.path`	string	resource experimental Display name: `Apache HTTP server configuration path`
`apache.httpd.module.name`	string	resource experimental Display name: `Apache HTTP server module name` The name of the Apache HTTP Server module that generated the log entry.	`core`; `proxy`

Apache Spark fields

Attribute	Type	Description	Examples
`apache.spark.master.ip`	string	resource experimental Display name: `Apache Spark master IP`

App

The app namespace contains information on the application sending the event.

App fields

Attribute	Type	Description	Examples
`app.bundle`	string	resource stable Display name: `App bundle` The name of the bundle, for example, the bundle identifier on iOS or the `applicationId` on Android.	`com.example.easytravel`
`app.id`	string	resource stable Display name: `App ID` An optional unique application identifier. Chosen by the customer	`easytravel`
`app.short_version`	string	resource stable Display name: `App version` The application's publicly visible version number, as, for example, displayed in App Store or Google Play. Usually this is just the major and minor version with no patch number.	`5.23`
`app.version`	string	resource stable Display name: `App build version` The application's internal build number, which can include information such as patch number and build number.	`5.23.15789`; `143542`

Argo Continuous Integration/Continuous Deployment (CICD)

The argocd namespace contains Argo CD specific deployment attributes.

Argo CICD fields

Attribute	Type	Description	Examples
`argocd.app.health.status`	string	experimental Display name: `Argo CD app health status` The health state of the tracked resource. ¹	`Healthy`; `Progressing`; `Degraded`; `Missing`; `Suspended`; `Unknown`
`argocd.sync.operation_state.outcome`	string	experimental Display name: `Argo CD sync operation outcome` Message associated with synchronization operation. ²	`successfully synced (no more tasks)`; `Operation terminated (retried 4 times)`
`argocd.sync.operation_state.phase`	string	experimental Display name: `Argo CD sync operation phase` Status of the synchronization operation between source and target. ³	`Running`; `Succeeded`; `Error`; `Failed`
`argocd.sync.status`	string	experimental Display name: `Argo CD sync status` The sync status represents the current state of reconciliation. ⁴	`SYNCED`; `OUT OF SYNC`; `UNKNOWN`

The value is equal to the app.status.health.status value in Argo CD.

The value is equal to the app.status.operationState.message value in Argo CD.

The value is equal to the app.status.operationState.phase value in Argo CD.

⁴

The value is equal to the app.status.sync.status value in Argo CD.

Artifact

The artifact namespace contains information about software artifacts.

Artifact fields

Attribute	Type	Description	Examples
`artifact.attestation.filename`	string	experimental Display name: `Artifact attestation filename` The provenance filename of the built attestation. It directly relates to the `artifact.filename`.	`carts-service-amd64-0.1.1.tar.gz.intoto.json1`
`artifact.attestation.hash`	string	experimental Display name: `Artifact attestation hash` The full hash value of the built attestation.	`b4e370270ac4fe8d728b845ab8d190a7c931f09ff7b0156dd4d6abf797f1fe6a`
`artifact.attestation.id`	string	experimental Display name: `Artifact attestation ID` The ID of the build software attestation.	`1337`
`artifact.filename`	string	experimental Display name: `Artifact filename` The filename of the software artifact, typically generated by the build process. This is similar to the `artifact.id`, but can contain the `artifact.version` and other data like file extension.	`carts-service-amd64-0.1.1.tar.gz`
`artifact.hash`	string	experimental Display name: `Artifact hash` The full hash value of the software artifact. This value is used to verify the integrity of the software artifact.	`6c323d126547f71fafb4bffa02cdc480fb284678644ef0b6c69029f051fe5137`
`artifact.id`	string	experimental Display name: `Artifact ID` The identifier of the software artifact, typically the name of the artifact.	`carts-service`
`artifact.name`	string	experimental Display name: `Artifact name` The human-readable name of the software artifact.	`Carts service`
`artifact.path`	string	experimental File path of the artifact within its repository or on the scanned host. This differs from `software_component.path`, which is the component referenced in a code artifact, as a third-party library, for example.	`/app/status-service`; `dist/lib/auth-module.jar`
`artifact.purl`	string	experimental Display name: `Artifact package URL` The Package URL of the package artifact. This value is used to identify and locate the artifact.	`pkg:npm/%40dynatrace/backstage@2.0.0`; `pkg:deb/debian/curl@7.50.3-1?arch=i386&distro=jessie`
`artifact.repository`	string	experimental Source code repository from which the artifact originates. For code artifacts, this is analogous to `container_image.repository` for container images.	`appsec-ai-initiative-dev/unguard`; `Dynatrace Remote Plugin Agent`
`artifact.version`	string	experimental Display name: `Artifact version` The version of the software artifact, typically in Semantic Versioning format.	`0.1.1`

ASP.NET Core

ASP.NET Core fields

Attribute	Type	Description	Examples
`aspnetcore.appl.path`	string	resource experimental Display name: `ASP.NET Core application path`

Audit

Audit fields

Fields that can come from audit logs.

Attribute	Type	Description	Examples
`audit.action`	string	stable Display name: `Audit action` Audited action.	`Access to Azure Resource Manager`; `New User Created`; `User added to Group`
`audit.id`	string	experimental Display name: `Audit ID` Unique identifier of the audit event.	`c42dbd31-17b5-4270-b1a7-824a52e0d0e9`
`audit.identity`	string	stable Display name: `Audit identity` User name, service account name, or principal name that executes audited action.	`name.surname@example.com`
`audit.result`	string	stable Display name: `Audit result` Result of the audited action.	`Succeeded`; `Failed`
`audit.status`	string	stable Display name: `Audit status` Status of the audited action.	`Started`; `In Progress`; `Succeeded`; `Failed`; `Active`; `Resolved`
`audit.time`	timestamp	experimental Display name: `Audit time` Timestamp of the audited action.	`16/01/2025, 10:34 AM`

Authentication

Authentication fields

Authentication type and method used to login to a Dynatrace system.

Attribute	Type	Description	Examples
`authentication.client.id`	string	experimental Display name: `Authentication client ID` The OAuth2 client id if of type 'CLIENT_CREDENTIALS'.	`dt0s02.UZCK6ENL.2YQ2A3DZUEISRJSUU5544J3SC3TMPXSEEMNA5HK7RW54SJ6XKLYGMWJNKL7B2DNH`
`authentication.factor.first`	string	stable Display name: `First authentication factor` The first factor used for authentication, typically a password.	`PASSWORD`
`authentication.factor.second`	string	stable Display name: `Second authentication factor` The second factor used for authentication, such as an MFA token. Omitted when only a single factor was used.	`TOTP`
`authentication.grant.type`	string	experimental Display name: `Authentication grant type` The grant type used during OAuth2 authentication.	`AUTHORIZATION_CODE`; `CLIENT_CREDENTIALS`
`authentication.token`	string	experimental Display name: `Authentication token` The public token identifier of authentication.type 'TOKEN'.	`dt0c01.AM4SEYKIBROBEJ2N3HAXZ4IX`
`authentication.type`	string	experimental Display name: `Authentication type` The method of authentication.	`OAUTH2`

authentication.factor.first has the following list of well-known values. If one of them applies, then the respective value MUST be used, otherwise a custom value MAY be used.

Value	Description
`ID_TOKEN`	Authenticated using a Snowflake ID token.
`OAUTH_ACCESS_TOKEN`	Authenticated using an OAuth access token.
`PASSWORD`	Authenticated using a username/password combination.
`PROGRAMMATIC_ACCESS_TOKEN`	Authenticated using a programmatic access token (PAT).
`SAML2_ASSERTION`	Authenticated using a SAML2 assertion (federated SSO).

authentication.factor.second has the following list of well-known values. If one of them applies, then the respective value MUST be used, otherwise a custom value MAY be used.

Value	Description
`TOTP`	Time-based one-time password (MFA token).

authentication.grant.type MUST be one of the following:

Value	Description	Display name
`AUTHORIZATION_CODE`	The OAuth 2.0 "Authorization Code" grant type	Authorization Code
`CLIENT_CREDENTIALS`	The OAuth 2.0 "Client Credentials" grant type	Client Credentials

authentication.type MUST be one of the following:

Value	Description	Display name
`DEVOPSTOKEN`	Authenticated via DevOps token	DevOps Token
`NONE`	Not authenticated (authentication not necessary)	No authentication
`OAUTH2`	The OAuth 2.0 authentication type grant type	OAuth 2.0
`TOKEN`	Authenticated via API access token or personal access token	Token

authentication.client.id and authentication.token MUST follow the Dynatrace token format definition.

Specifically, authentication.client.id MUST be prefixed with dt0s02.

Availability

Availability fields

Information about entity availability. Sample usage is reporting hosts and PGI-s availability by OS Agent. Value of availability.state can be used for calculating aggregate availability (dividing count of "successful" requests by count of all requests). With constant frequency of requests it can be treated as a time-base availability, showing percentage of time that the monitored entity was available.

Attribute	Type	Description	Examples
`availability.state`	string	stable Display name: `Availability state` State of entity (host or PGI) availability.	`up`

availability.state has the following list of well-known values. If one of them applies, then the respective value MUST be used, otherwise a custom value MAY be used.

Value	Description	Display name
`available`	[PGI] PGI is available and reported.	Available
`no_data`	[HOST] Host is working, agent active but no data are sent.	No data
`no_data_agent_inactive`	[HOST] Host is working, agent inactive (disabled manually in configuration). No data are sent.	No data agent inactive
`reboot_graceful`	[HOST] Host has started after graceful shutdown.	Reboot graceful
`reboot_ungraceful`	[HOST] Host has started after ungraceful shutdown.	Reboot ungraceful
`shutdown_host`	[HOST] Host has been shut down.	Shutdown host
`unavailable`	[PGI] PGI is unavailable and not reported.	Unavailable
`unimportant`	[PGI] PGI is available but not reported because it became unimportant.	Unimportant
`unmonitored_agent_stopped`	[HOST] Host is unmonitored because agent stopped.	Agent stopped
`unmonitored_agent_uninstalled`	[HOST] Host is unmonitored because agent has been uninstalled.	Agent uninstalled
`unmonitored_agent_upgrade`	[HOST] Host is unmonitored because agent is upgrading.	Agent upgrading
`up`	[HOST] Host is working, agent active and sending data.	Up

Amazon Web Services (AWS)

AWS resource fields

Fields that can come from applications running on AWS.

Attribute	Type	Description	Examples
`aws.account.id`	string	resource stable Display name: `AWS account ID` The 12-digit number, such as 123456789012, that uniquely identifies an AWS account. Tags: `permission` `primary-field`	`123456789012`
`aws.account.name`	string	resource experimental Display name: `AWS account name` Name associated with the AWS account.	`example.com`
`aws.alb.name`	string	resource experimental Display name: `AWS application load balancer name` Application load balancer name that instance is behind.	`my-alb`
`aws.arn`	string	resource stable Display name: `AWS ARN` Amazon Resource Name (ARN).	`arn:aws:lambda:us-east-1:478983378254:function:acceptanceWeatherBackend`
`aws.availability_zone`	string	resource stable Display name: `Availability zone` A specific availability zone or array of zones in given AWS region.	`us-east-1a`; `us-east-1b`
`aws.availability_zone.id`	string	resource experimental Display name: `AWS availability zone ID` ID for the availability zone.	`use1-az1`; `use1-az2`; `use1-az3`
`aws.cloudfront.detailed_result_type`	string	resource experimental Display name: `AWS CloudFront detailed result type` Extends the aws.cloudfront.result_type with additional states. See full list under x-edge-detailed-result-type.	`OriginShieldHit`; `MissGeneratedResponse`; `InvalidRequest`
`aws.cloudfront.response.result_type`	string	resource experimental Display name: `AWS CloudFront response result type` How the server classified the response just before returning the response to the viewer.	`Hit`; `Miss`; `LimitExceeded`
`aws.cloudfront.result_type`	string	resource experimental Display name: `AWS CloudFront result type` How the server classified the response after the last byte left the server.	`Hit`; `Miss`; `LimitExceeded`
`aws.ecr.account.id`	string	resource experimental Display name: `AWS ECR account ID`
`aws.ecr.region`	string	resource experimental Display name: `AWS ECR region`
`aws.ecs.cluster`	string	resource experimental Display name: `AWS ECS cluster`
`aws.ecs.container.arn`	string	resource experimental Display name: `AWS ECS container ARN` The full Amazon Resource Name (ARN) of the container.	`arn:aws:ecs:us-west-2:111122223333:container/05966557-f16c-49cb-9352-24b3a0dcd0e1`
`aws.ecs.container.name`	string	resource experimental Display name: `AWS ECS container name`
`aws.ecs.docker.id`	string	resource experimental Display name: `AWS ECS Docker ID` The Docker ID for the container.	`cd189a933e5849daa93386466019ab50-2495160603`
`aws.ecs.docker.name`	string	resource experimental Display name: `AWS ECS Docker name` The name of the container supplied to Docker.	`curl-image`
`aws.ecs.family`	string	resource experimental Display name: `AWS ECS task family`
`aws.ecs.revision`	string	resource experimental Display name: `AWS ECS task revision`
`aws.ecs.task.arn`	string	resource experimental Display name: `AWS ECS task ARN` The full Amazon Resource Name (ARN) of the task to which the container belongs.	`arn:aws:ecs:us-west-2:111122223333:task/default/cd189a933e5849daa93386466019ab50`
`aws.execution_environment`	string	resource experimental Display name: `AWS Lambda execution environment` The runtime identifier, prefixed by AWS_Lambda_. Lambda supports multiple languages through the use of runtimes. A runtime provides a language-specific environment that relays invocation events, context information, and responses between Lambda and the function.	`AWS_Lambda_java8`
`aws.fle.fields_number`	long	resource experimental Display name: `AWS field-level encryption fields number` The number of field-level encryption fields that the server encrypted and forwarded to the origin.	`12`; `27`
`aws.fle.status`	string	resource experimental Display name: `AWS field-level encryption status` When field-level encryption is configured for a distribution, this field contains a code that indicates whether the request body was successfully processed.	`FieldLengthLimitClientError`
`aws.lambda.function.name`	string	resource experimental Display name: `Lambda function name`
`aws.lambda.initialization_type`	string	resource experimental Display name: `AWS Lambda initialization type` The AWS Lambda initialization type. Same string value as available in AWS_LAMBDA_INITIALIZATION_TYPE.	`snap_start`
`aws.log_group`	string	resource experimental Display name: `Log group` Amazon CloudWatch group of log streams that share the same retention, monitoring, and access control settings.	`/aws/lambda/a-SomeFunction-1AWHD6W1QC5DH`
`aws.log_stream`	string	resource experimental Display name: `Log stream` A sequence of log events that share the same source.	`2021/01/04/[$LATEST]b2e34f11da04232cb9f9d3d5799a5c12`
`aws.region`	string	resource stable Display name: `AWS region` A specific geographical AWS Cloud location. Tags: `primary-field`	`us-east-1`
`aws.resource.id`	string	resource stable Display name: `AWS resource ID` Unique, immutable identifier assigned to the AWS cloud resource.	`i-0922cda4579db3a45`
`aws.resource.name`	string	resource stable Display name: `AWS resource name` Name of the resource for named resources, value of the "Name" tag in AWS for non-named resources (if unavailable, same as aws.resource.id).	`my-ec2-instance`
`aws.resource.type`	string	resource experimental Display name: `AWS resource type` The name of a resource type in CloudFormation format.	`AWS::EC2::Instance`; `AWS::S3::Bucket`; `AWS::Lambda::Function`
`aws.security_group.id`	string	resource experimental Display name: `AWS security group ID` Assigned Security Group or array of Groups	`sg-184e3ddb341dd478b`; `sg-2b3aa4b9409c734ec`
`aws.service`	string	resource experimental Display name: `AWS service` The service that identifies the AWS product.	`s3`
`aws.subnet.id`	string	resource experimental Display name: `AWS subnet ID` Assigned Subnet or array of Subnets	`subnet-03759a11ef3811b94`; `subnet-011dad1de2a016171`
`aws.tags.__tag_key__`	string	resource experimental Display name: `AWS tag` Contains the value for the tag with the tag key named `__tag_key__` defined in the tag enrichment configuration.	`dt_owner_mail`
`aws.vpc.id`	string	resource experimental Display name: `AWS VPC ID` Assigned VPC (Virtual Private Cloud)	`vpc-0be61db7c5d2d1bd1`

aws.fle.status MUST be one of the following:

Value	Description	Display name
`FieldLengthLimitClientError`	A field that is configured to be encrypted exceeds the maximum length allowed.	Field Length Limit Error
`FieldNumberLimitClientError`	A request that the distribution is configured to encrypt contains more than the number of fields allowed.	Field Number Limit Error
`ForwardedByContentType`	The server forwarded the request to the origin without parsing or encryption because no content type was configured.	Forwarded By Content Type
`ForwardedByQueryArgs`	The server forwarded the request to the origin without parsing or encryption because the request contains a query argument that wasn't in the configuration for field-level encryption.	Forwarded By Query Args
`ForwardedDueToNoProfile`	The server forwarded the request to the origin without parsing or encryption because no profile was specified in the configuration for field-level encryption.	Forwarded No Profile
`MalformedContentTypeClientError`	The server rejected the request and returned an HTTP 400 status code to the viewer because the value of the Content-Type header was in an invalid format.	Malformed Content Type Error
`MalformedInputClientError`	The server rejected the request and returned an HTTP 400 status code to the viewer because the request body was in an invalid format.	Malformed Input Error
`MalformedQueryArgsClientError`	The server rejected the request and returned an HTTP 400 status code to the viewer because a query argument was empty or in an invalid format.	Malformed Query Args Error
`Processed`	The server successfully processed the request body, encrypted values in the specified fields, and forwarded the request to the origin.	FLE Processed
`RejectedByContentType`	The server rejected the request and returned an HTTP 400 status code to the viewer because no content type was specified in the configuration for field-level encryption.	Rejected By Content Type
`RejectedByQueryArgs`	The server rejected the request and returned an HTTP 400 status code to the viewer because no query argument was specified in the configuration for field-level encryption.	Rejected By Query Args
`RequestLengthLimitClientError`	The length of the request body exceeded the maximum length allowed when field-level encryption is configured.	Request Length Limit Error
`ServerError`	The origin server returned an error.	Server Error

aws.lambda.initialization_type has the following list of well-known values. If one of them applies, then the respective value MUST be used, otherwise a custom value MAY be used.

Value	Description	Display name
`on-demand`	On demand	On Demand
`provisioned-concurrency`	Provisioned concurrency	Provisioned Concurrency
`snap-start`	SnapStart	Snap Start

AWS span fields

Attribute	Type	Description	Examples
`aws.kinesis.arn`	string	experimental Display name: `AWS Kinesis ARN` Amazon resource name (ARN) of a Kinesis stream or consumer.	`arn:aws:kinesis:us-east-2:123456789012:stream/MyKinesisStream`; `arn:aws:kinesis:us-west-2:123456789012:stream/MyKinesisStream/consumer/MyKinesisConsumer:1616044553`
`aws.kinesis.consumer.arn`	string	experimental Display name: `AWS Kinesis consumer ARN` Amazon resource name (ARN) of a Kinesis consumer.	`arn:aws:kinesis:us-west-2:123456789012:stream/MyKinesisStream/consumer/MyKinesisConsumer:1616044553`
`aws.kinesis.consumer.name`	string	experimental Display name: `AWS Kinesis consumer name` Name of a Kinesis consumer.	`MyKinesisConsumer`
`aws.kinesis.stream.arn`	string	experimental Display name: `AWS Kinesis stream ARN` Amazon resource name (ARN) of a Kinesis stream.	`arn:aws:kinesis:us-east-2:123456789012:stream/MyKinesisStream`
`aws.kinesis.stream.name`	string	experimental Display name: `AWS Kinesis stream name` Name of a Kinesis stream.	`MyKinesisStream`
`aws.lambda.invoked_arn`	string	experimental Display name: `AWS Lambda invoked ARN` The full invoked ARN as provided on the `Context` passed to the function (`Lambda-Runtime-Invoked-Function-Arn` response header from the request to `/runtime/invocation/next`).	`arn:aws:lambda:us-east-1:123456789012:function:acceptanceWeatherBackend:production`
`aws.request_id`	string	experimental Display name: `AWS request ID` The AWS request ID (e.g., value of `x-amzn-requestid`, `x-amzn-request-id`, or `x-amz-request-id` HTTP header, `awsRequestId` field in AWS lambda context object).	`0e7bc729-a468-57e8-8143-98f2eec5c925`
`aws.s3.bucket`	string	experimental Display name: `AWS S3 bucket` Name of an S3 bucket.	`amzn-s3-demo-bucket`; `amzn-s3-demo-bucket1-a1b2c3d4-5678-90ab-cdef-example11111`
`aws.s3.key`	string	experimental Display name: `AWS S3 key` Key name of the object.	`Development/Projects.xls`; `Finance/statement1.pdf`; `s3-dg.pdf`
`aws.s3.object_version`	string	experimental Display name: `AWS S3 object version` Version ID for the specific version of the object.	`3sL4kqtJlcpXroDTDmJ+rmSpXd3dIbrHY+MTRCxf3vjVBH40Nr8X8gdRQBpUMLUo`
`aws.s3.part_number`	long	experimental Display name: `AWS S3 part number` Part number in a multi-part upload.	`3456`
`aws.s3.source.bucket`	string	experimental Display name: `AWS S3 source bucket` Name of the bucket containing the object to copy.	`amzn-s3-source-bucket`
`aws.s3.source.key`	string	experimental Display name: `AWS S3 source key` Key of the object to copy.	`Finance/statement1.pdf`
`aws.s3.source.object_version`	string	experimental Display name: `AWS S3 source object version` Version of the source object to copy. By default, the latest version is copied.	`3sL4kqtJlcpXroDTDmJ+rmSpXd3dIbrHY+MTRCxf3vjVBH40Nr8X8gdRQBpUMLUo`
`aws.s3.upload_id`	string	experimental Display name: `AWS S3 upload ID` Upload ID identifying the multipart upload targeted by an operation (abort/complete/upload/…).	`dfRtDYWFbkRONycy.Yxwh66Yjlx.cph0gtNBtJ`
`aws.xray.trace_id`	string	experimental Display name: `X-Ray trace ID` Contains the AWS X-Ray trace id (e.g., value of the `x-amzn-trace-id` HTTP header, `_X_AMZN_TRACE_ID` environment variable on AWS lambda)	`Root=1-63441c4a-abcdef012345678912345678`; `Self=1-63441c4a-12456789abcdef012345678;Root=1-67891233-abcdef012345678912345678`

AWS log fields

Attribute	Type	Description	Examples
`aws.elb.actions_executed`	string[]	experimental (ALB) The actions taken when processing the request. Present only when at least one action was successfully taken.	`['forward']`; `['redirect']`; `['authenticate', 'forward']`
`aws.elb.alpn.backend_protocol`	string	experimental (NLB) The application protocol negotiated with the backend target via the ALPN extension. A mismatch between this and aws.elb.alpn.frontend_protocol indicates a protocol negotiation asymmetry between the client and backend.	`h2`; `http/1.1`; `http/1.0`
`aws.elb.alpn.client_preference`	string[]	experimental (NLB) The full list of application protocols advertised by the client in the ALPN extension of the TLS ClientHello message, URL-encoded and truncated at 256 bytes. Not present if no ALPN policy is configured or if the extension is absent.	`['h2', 'http/1.1']`; `['h2']`
`aws.elb.alpn.frontend_protocol`	string	experimental (NLB) The application protocol negotiated with the client via the ALPN extension. Not present if no ALPN policy is configured, if no matching protocol is found, or if the client did not send a valid protocol list.	`h2`; `http/1.1`; `http/1.0`
`aws.elb.chosen_cert_arn`	string	experimental (ALB, NLB) The ARN of the certificate presented to the client. For ALB, set to "session-reused" if the TLS session was resumed. Not present if the listener is not HTTPS or TLS, or if no valid TLS ClientHello was received (NLB).	`arn:aws:acm:us-east-1:123456789012:certificate/abcd1234-abcd-1234-abcd-abcd12345678`; `session-reused`
`aws.elb.conn_trace_id`	string	experimental (ALB) A unique opaque identifier for the client-to-load-balancer connection. All requests routed through the same keep-alive connection share this identifier, enabling correlation of access log entries with connection logs events such as TLS errors or connection resets.	`Root=1-67891233-abcdef012345678912345678`
`aws.elb.connection_time`	long (Millisecond)	experimental (NLB) The total time elapsed (in milliseconds) for the connection to complete, measured from when the load balancer received the TCP SYN to when the connection is closed. Includes the TLS handshake duration (aws.elb.tls_handshake_time). Note: in milliseconds, unlike ALB and Classic LB processing times, which are in seconds.	`150`; `1200`; `45`
`aws.elb.connection_type`	string	experimental (ALB) The type of request or connection. Encodes both the application protocol and transport variant (for example, wss is WebSocket over TLS).	`https`; `h2`; `wss`; `grpcs`; `ws`; `http`
`aws.elb.destination.ip`	ipAddress	experimental (NLB) The IP address of the NLB listener endpoint that received the connection. If the client connects using a VPC Endpoint service, the destination is the VPC endpoint. This is not the backend target IP address.	`10.0.1.100`; `10.0.2.50`
`aws.elb.destination.port`	long	experimental (NLB) The port of the NLB listener endpoint that received the connection. Complements aws.elb.destination.ip.	`443`; `8443`
`aws.elb.desync_mitigation_classification`	string	experimental (ALB) The classification of the request based on HTTP desync mitigation, per RFC 7230 compliance. Present only for requests that do not fully comply with RFC 7230.	`Acceptable`; `Ambiguous`; `Severe`
`aws.elb.desync_mitigation_classification_reason`	string	experimental (ALB) The reason code describing why the request was classified for HTTP desync mitigation. Complements aws.elb.desync_mitigation_classification. Present only when the request does not comply with RFC 7230.	`AmbiguousUri`; `BadHeader`; `MultipleContentLength`
`aws.elb.error_reason`	string	experimental (ALB) The error reason code when a request fails. Set when an error occurs during the authenticate or Lambda target processing action, or when a request is not routable. Present only for failed requests.	`AuthInvalidCookie`; `LambdaInvalidResponse`; `AWSALBTGCookieInvalid`; `JWTHeaderNotPresent`
`aws.elb.incoming_tls_alert`	long	experimental (NLB) The integer value of the TLS alert received from the client, as defined in RFC 5246 (for example, 40 = handshake_failure, 42 = bad_certificate). Present only if a TLS alert was received from the client during the connection.	`40`; `42`; `46`
`aws.elb.listener.id`	string	experimental (NLB) The resource ID of the load balancer listener that processed the connection. Identifies which listener on the NLB handled the connection, useful for multi-listener NLBs routing different ports or protocols.	`1234567890abcdef`; `ead889d3c69590bd`
`aws.elb.redirect_url`	string	experimental (ALB) The URL of the redirect target set in the Location response header when the ALB performed a redirect action. Present only when a redirect action was executed.	`https://example.com/new-path`
`aws.elb.request.processing_time`	double (Second)	experimental (ALB, Classic LB) The total time elapsed (in seconds, with millisecond precision) from when the load balancer received the request from the client until it dispatched the request to a target. Set to -1 if the load balancer could not dispatch the request (for example, if the target closed the connection before the idle timeout expired, or if the client sent a malformed request).	`0.0`; `0.001`; `-1.0`
`aws.elb.request.transform_status`	string	experimental (ALB) The status of the URL rewrite or host-header transform action configured for the listener rule. Present only when a transform action was applied.	`TransformBufferTooSmall`; `TransformInvalidHost`; `TransformSuccess`
`aws.elb.request.transformed_host`	string	experimental (ALB) The value of the Host header after a host-header rewrite transform was applied by the ALB listener rule. Present only when a host-header rewrite transform changed the value of the Host header.	`new-host.example.com`
`aws.elb.request.transformed_uri`	string	experimental (ALB) The request URI after a URL rewrite transform was applied by the ALB listener rule. Present only when a URL rewrite transform changed the URI.	`/new/path?param=value`
`aws.elb.response.processing_time`	double (Second)	experimental (ALB, Classic LB) The total time elapsed (in seconds, with millisecond precision) from when the load balancer received the response header from the target until it started sending the response to the client. Includes both the queuing time at the load balancer and the connection acquisition time from the load balancer to the client. Set to -1 if the target did not respond before the idle timeout expired.	`0.0`; `0.002`; `-1.0`
`aws.elb.rule_priority`	long	experimental (ALB) The priority of the listener rule that processed the request. A value of 0 indicates that the default action was taken. A value of -1 indicates that a rules evaluation error occurred.	`1`; `100`; `50000`; `0`; `-1`
`aws.elb.target.processing_time`	double (Second)	experimental (ALB, Classic LB) The total time elapsed (in seconds, with millisecond precision) from when the load balancer sent the request to a target until the target started sending response headers. Set to -1 if the target did not respond before the idle timeout expired or if the connection was closed before a response was received.	`0.001`; `0.042`; `-1.0`
`aws.elb.target.status_code`	long	experimental (ALB, Classic LB) The HTTP status code of the response received from the backend target. Distinct from http.response.status_code, which is the load balancer's own response code returned to the client. Not present if no connection was established to the target or the target did not send an HTTP response.	`200`; `302`; `500`; `503`
`aws.elb.target_group_arn`	string	experimental (ALB) The Amazon Resource Name (ARN) of the target group that received the request. Identifies which backend pool the listener rule selected.	`arn:aws:elasticloadbalancing:us-east-1:123456789012:targetgroup/my-targets/abcdef1234567890`
`aws.elb.target_port_list`	string[]	experimental (ALB) A space-delimited list of IP address and port combinations for the targets that processed the request. Currently contains one item matching the target selected from the target group. Present only when a request was dispatched to a target. Not present if target is a Lambda function or the request is blocked by AWS WAF.	`['10.0.1.42:8080']`
`aws.elb.target_status_code_list`	long[]	experimental (ALB) A space-delimited list of HTTP status codes returned by the targets. Currently contains one item matching aws.elb.target.status_code. Present only when a target responded.	`[200]`; `[503]`
`aws.elb.tls_handshake_time`	long (Millisecond)	experimental (NLB) The total time elapsed (in milliseconds) for the TLS handshake to complete after the TCP connection was established, including client-side delays. Included in aws.elb.connection_time. Not present if there is no TLS handshake or if the TLS handshake fails.	`12`; `45`; `120`
`aws.elb.tls_key_exchange`	string	experimental (NLB) The key exchange algorithm and, if applicable, the elliptic curve or group used during the TLS or PQ-TLS handshake. Not present if TLS negotiation did not complete. Useful for tracking post-quantum TLS (PQ-TLS) algorithm adoption.	`ECDHE-RSA`; `X25519MLKEM768`; `RSA`
`aws.route53.edge_location_id`	string	experimental Display name: `Route 53 edge location ID` The Route 53 edge location that responded to the query. Each edge location is identified by a three-letter code and an arbitrary number.	`FRA54-SN1`; `DFW3`
`aws.route53.hostedzone_id`	string	experimental Display name: `Route 53 hosted zone ID` The ID of the hosted zone that is associated with all the DNS queries in this log.	`Z1234567890ABCDEFGHIJ`
`aws.route53.resolver_ip_address`	string	experimental Display name: `Route 53 resolver IP address` The IP address of the DNS resolver that submitted the request to Route 53.	`192.168.1.1`; `2001:db8::1234`
`dns.question.name`	string	experimental Display name: `DNS question name` The domain or subdomain that was specified in the request.	`example.com`; `support.dynatrace.com/`
`dns.question.type`	string	experimental Display name: `DNS question type` Either the DNS record type that was specified in the request, or ANY.	`A`; `AAAA`; `CNAME`; `TXT`; `ANY`
`dns.response_code`	string	experimental Display name: `DNS response code` The DNS response code that Route 53 returned in response to the DNS query.	`NOERROR`; `NXDOMAIN`

aws.elb.alpn.backend_protocol has the following list of well-known values. If one of them applies, then the respective value MUST be used, otherwise a custom value MAY be used.

Value	Description
`h2`	HTTP/2 over TLS.
`http/1.0`	HTTP/1.0.
`http/1.1`	HTTP/1.1.

aws.elb.alpn.frontend_protocol has the following list of well-known values. If one of them applies, then the respective value MUST be used, otherwise a custom value MAY be used.

Value	Description
`h2`	HTTP/2 over TLS.
`http/1.0`	HTTP/1.0.
`http/1.1`	HTTP/1.1.

aws.elb.connection_type has the following list of well-known values. If one of them applies, then the respective value MUST be used, otherwise a custom value MAY be used.

Value	Description
`grpcs`	TLS-encrypted gRPC connection.
`h2`	TLS-encrypted HTTP/2 connection.
`http`	Unencrypted HTTP/1.x connection.
`https`	TLS-encrypted HTTP/1.x connection.
`ws`	Unencrypted WebSocket connection.
`wss`	TLS-encrypted WebSocket connection.

aws.elb.desync_mitigation_classification MUST be one of the following:

Value	Description
`Acceptable`	Request is RFC 7230-compliant.
`Ambiguous`	Request is RFC 7230 non-compliant but poses low risk.
`Severe`	Request poses a high risk of HTTP desync.

aws.elb.error_reason has the following list of well-known values. If one of them applies, then the respective value MUST be used, otherwise a custom value MAY be used.

Value	Description
`AWSALBTGCookieInvalid`	ALB target-group stickiness cookie is invalid.
`AuthInvalidCookie`	Authentication cookie is invalid.
`JWTHeaderNotPresent`	JWT header required for authentication is missing.
`LambdaInvalidResponse`	Lambda target returned an invalid response.

Microsoft Azure

Azure resource fields

Fields that can come from applications running on Azure.

Attribute	Type	Description	Examples
`azure.availability_zones`	string[]	resource experimental Display name: `Azure availability zones` Availability zones of Azure cloud resource.	`['1']`
`azure.class_name`	string	resource experimental Display name: `Azure function class name` The fully qualified name of the class executing an Azure function.	`Host.Functions`
`azure.container_app.dnssuffix`	string	resource experimental Display name: `Azure container app DNS suffix` The DNS suffix for the Container Apps environment.	`redbeach-0f8a3e63.northeurope.azurecontainerapps.io`
`azure.container_app.hostname`	string	resource experimental Display name: `Azure container app hostname` The revision-specific hostname of the container app.	`kapitan-bomba-demo--nk4tc46.redbeach-0f8a3e63.northeurope.azurecontainerapps.io`
`azure.container_app.name`	string	resource experimental Display name: `Azure container app name` The name of the container app.	`kapitan-bomba-demo`
`azure.container_app.replica.name`	string	resource experimental Display name: `Azure container app replica name` The name of the container app replica.	`kapitan-bomba-demo--nk4tc46-5d568c5df6-49px7`
`azure.event_hub_namespace.name`	string	resource experimental Display name: `Azure Event Hub namespace` Azure Event Hub Namespace name.	`my-event-hub`
`azure.location`	string	resource stable Display name: `Azure location` A specific geographical location of Azure cloud resource. Tags: `primary-field`	`westeurope`
`azure.management_group`	string	resource experimental Display name: `Azure management group` A group of Azure subscriptions used for governance use cases.	`Tenant Root Group`; `My Custom Group`
`azure.resource.group`	string	resource stable Display name: `Azure resource group` A resource group is a container that holds related resources for an Azure solution. Tags: `permission` `primary-field`	`demo-backend-rg`
`azure.resource.id`	string	resource experimental Display name: `Azure resource ID` A unique, immutable identifier assigned to each Azure cloud resource.	`/subscriptions/27e9b03f-04d2-2b69-b327-32f433f7ed21/resourceGroups/demo-backend-rg/providers/Microsoft.ContainerService/managedClusters/demo-aks`
`azure.resource.name`	string	resource experimental Display name: `Azure resource name` User-provided name of the Azure cloud resource.	`demo-aks`
`azure.resource.type`	string	resource experimental Display name: `Azure resource type` The name of a resource type in the format: {resource-provider}/{resource-type}.	`Microsoft.ContainerService/managedClusters`
`azure.service_bus_namespace.name`	string	resource experimental Display name: `Azure Service Bus namespace` Azure Service Bus name.	`my-service-bus`
`azure.site_name`	string	resource experimental Display name: `Azure site name` Globally unique deployment information about an Azure function.	`dt-function-scripted`
`azure.sql_elastic_pool.name`	string	resource experimental Display name: `Azure SQL elastic pool name` Azure SQL Server Elastic Pool name.	`contoso-elastic-pool`
`azure.sql_server.name`	string	resource experimental Display name: `Azure SQL server name` Azure SQL Server name.	`contoso-sql-server`
`azure.subscription`	string	resource stable Display name: `Azure subscription` An Azure subscription is a logical container used to provision resources in Azure. Tags: `permission` `primary-field`	`27e9b03f-04d2-2b69-b327-32f433f7ed21`
`azure.tags.__tag_key__`	string	resource experimental Display name: `Azure tag` Contains the value for the tag with the tag key named `__tag_key__` defined in the tag enrichment configuration.	`dt_owner_mail`
`azure.tenant.id`	string	resource experimental Display name: `Azure tenant ID` Unique, immutable identifier assigned to the Azure tenant.	`37c4add3-612a-483d-8b24-cccbb35d3306`
`azure.tenant.name`	string	resource experimental Display name: `Azure tenant name` Name assigned to the Azure tenant.	`MyAzureTenant`
`azure.vm.name`	string	resource experimental Display name: `Azure virtual machine name` Azure Virtual Machine name.	`my-virtual-machine`
`azure.vm_scale_set.name`	string	resource experimental Display name: `Azure virtual machine scale set name` Azure Virtual Machine Scale Set name.	`my-vmss`
`azure.vmid`	string	resource experimental Display name: `Azure virtual machine ID` Azure Virtual Machine unique 128bits identifier	`090556DA-D4FA-764F-A9F1-63614EDA019A`

Azure span fields

Attribute	Type	Description	Examples
`azure.client.request.id`	string	experimental Value of the HTTP header `x-ms-client-request-id`, an optional client-generated ID for troubleshooting.	`3adf2f8e-01f8-4b5f-8b8f-6b0e2df1f2a1`
`azure.invocation_id`	string	experimental A unique identifier for the invocation of an Azure Function.	`d41e0952-3822-4871-9cfb-7187cf812fe2`
`azure.service.request.id`	string	experimental Value of the HTTP header `x-ms-request-id`, uniquely identifies the request that was made.	`8b4e3d9e-1001-00e1-4f0a-e4a742000000`
`azure.storage.account.name`	string	experimental Name of the Azure Storage account.	`mystorageaccount`
`azure.storage.blob.block_id`	string	experimental Base64-encoded block ID identifying the block targeted by an operation on a block blob, specified in a request when staging a block and available when listing committed and uncommitted blocks.	`YmxvY2stMQ==`
`azure.storage.blob.container.name`	string	experimental Name of the Blob Storage container.	`mycontainer`
`azure.storage.blob.copy_id`	string	experimental ID identifying a blob copy operation, returned in the `x-ms-copy-id` response header when a copy is initiated and specified in a request when aborting a copy.	`ca17abbc-4e00-4a1e-b0f2-9f5db5c8a1d2`
`azure.storage.blob.name`	string	experimental Name of the blob.	`folder/myblob.txt`
`azure.storage.blob.source.container.name`	string	experimental Name of the container containing the blob to copy.	`mysourcecontainer`
`azure.storage.blob.source.name`	string	experimental Name of the blob to copy.	`folder/mysourceblob.txt`
`azure.storage.blob.source.version_id`	string	experimental Version ID of the source blob to copy.	`2020-06-12T11:50:44.2323212Z`
`azure.storage.blob.version_id`	string	experimental Version ID for the specific version of the blob (value of the `x-ms-version-id` header).	`2020-06-12T11:50:44.2323212Z`

Azure log fields

Attribute	Type	Description	Examples
`azure.resource.log.category`	string	experimental The name of the Azure Monitor resource log category.	`cloud-controller-manager`; `kube-audit-admin`
`azure.resource.log.operation.name`	string	experimental The name of the Azure ARM operation name.	`LoadBalancerHealthEvent`

Bizflow

Bizflow fields

Attribute	Type	Description	Examples
`bizflow.id`	string	experimental Display name: `Business flow ID` Internal ID from the business flow configured in the Business Flow app.
`bizflow.priority`	string	experimental Display name: `Business flow priority` The priority of a business process.	`critical`; `high`; `medium`; `low`
`bizflow.url`	string	experimental Display name: `Business flow URL` URL to explore the business flow in the Business Flow app from a result in a DQL query against Smartscape nodes.

BOSH

BOSH fields

Fields that are integral to applications managed by BOSH.

Attribute	Type	Description	Examples
`bosh.availability_zone`	string	resource experimental Display name: `BOSH availability zone` A specific geographical BOSH location.	`us-east-1a`
`bosh.deployment.id`	string	resource stable Display name: `BOSH deployment ID` BOSH depoloyment ID, retrievied from /var/vcap on monitored host.	`cf-c32ffe771e4ad26b9711`
`bosh.instance.name`	string	resource stable Display name: `BOSH instance name` BOSH instance name, retrievied from /var/vcap on monitored host.	`diego_database`
`bosh.instance_id`	string	resource experimental Display name: `BOSH instance ID` A unique identifier assigned to each deployed instance.	`af318409-9e9d-4a18-aca4-0fb52bbdc526`
`bosh.name`	string	resource experimental Display name: `BOSH name` A unique identifier to a deployment or instance.	`isolated_diego_cell_devima`
`bosh.stemcell.version`	string	resource stable Display name: `BOSH stemcell version` Version of BOSH stemcell, retrievied from /var/vcap on monitored host.	`621.448`

Browser

The browser namespace contains information on the browser running an application.

Browser fields

Attribute	Type	Description	Examples
`browser.frame.instance_id`	uid	stable Display name: `Browser frame instance ID` A unique ID generated by RUM JavaScript to identify the browser frame. The `browser.frame.instance_id` is an 8-byte ID and hex-encoded if shown as a string.	`f76281848bd8288c`
`browser.frame.parent_instance_id`	uid	stable Display name: `Browser parent frame instance ID` A unique ID generated by RUM JavaScript to identify the browser's next-higher frame (if that frame exists and is reachable). The `browser.frame.parent_instance_id` is an 8-byte ID and hex-encoded if shown as a string.	`f76281848bd8288c`
`browser.tab.instance_id`	uid	stable Display name: `Browser tab instance ID` A unique ID generated by RUM JavaScript to identify the browser tab. The `browser.tab.instance_id` is an 8-byte ID and hex-encoded if shown as a string.	`f76281848bd8288c`
`browser.window.device_pixel_ratio`	double	stable Display name: `Browser window device pixel ratio` The ratio of the resolution in physical pixels to the resolution in CSS pixels for the current display device.	`1.0`
`browser.window.height`	long	stable Display name: `Browser window height` The browser window's inner height, in pixels.	`384`
`browser.window.width`	long	stable Display name: `Browser window width` The browser window's inner width, in pixels.	`2048`

Browser resource fields

Attribute	Type	Description	Examples
`browser.is_webdriver`	boolean	resource experimental Display name: `Browser controlled by WebDriver` If set to `true`, WebDriver controls the browser according to the `navigator.webdriver` property.	`true`
`browser.name`	string	resource stable Display name: `Browser name` The browser name.	`Chrome`
`browser.type`	string	resource stable Display name: `Browser type` The browser type.	`desktop`; `mobile`; `tablet`; `robot`; `other`
`browser.user_agent`	string	resource stable Display name: `User agent` The full user agent string as provided by the browser in the HTTP `User-Agent` request header.	`Chrome/Version 142.0.7444.176 (Official Build) (arm64)`
`browser.version`	string	resource stable Display name: `Browser version` The browser version.	`Version 142.0.7444.176`

Captured attribute

Span scoped attributes (e.g. method parameters, return values, class names, …) captured by the OneAgent based on a request attribute rule. The actual name of the attribute is the prefix "captured_attribute" plus the "request attribute name" defined in the request attributes configuration. In contrast to request attributes, captured attributes contain the raw values reported by the OneAgent at the location (i.e. on the active span) where they appeared. No aggregation (first/last value, distinct values, ...), type conversion or normalization is performed on them. They are the basis for request attributes.

Captured attribute fields

Attribute	Type	Description	Examples
`captured_attribute.__attribute_name__`	array	stable Display name: `Captured attribute` Contains the span scoped raw values that were captured under the name `__attribute_name__` defined by the request attribute configuration. The values are mapped as an array according to the type of the captured attributes, so either boolean, double, long, or string. If the captured attributes have mixed types (e.g. long and string, or double and long, etc.), all attributes are converted to string and stored as string array.	`[42]`; `['Platinum']`; `[32, 16, 8]`; `['Special Offer', '1702']`; `['18.35', '16']`

Cassandra

Cassandra fields

Attribute	Type	Description	Examples
`cassandra.cluster.name`	string	resource experimental Display name: `Cassandra cluster name`

Continuous Integration/Continuous Deployment (CI/CD)

The cicd namespace contains information about Continuous Integration and Continuous Deployment systems.

CI/CD fields

Attribute	Type	Description	Examples
`cicd.deployment.id`	string	experimental Display name: `Deployment ID` The identifier of the deployment.	`1337`
`cicd.deployment.name`	string	experimental Display name: `Deployment name` The name of the deployment.	`deploy frontend app`; `deploy cart service`
`cicd.deployment.namespace`	string	experimental Display name: `Deployment namespace` The destination namespace where the deployment resource is created.	`default`
`cicd.deployment.release_stage`	string	experimental Display name: `Deployment stage` The name of the deployment environment, also known as deployment tier.	`development`; `staging`; `production`
`cicd.deployment.server.url.full`	string	experimental Display name: `Deployment server full URL` The deployment server URL.	`https://kubernetes.default.svc`
`cicd.deployment.service.id`	string	experimental Display name: `Deployment service ID` The identifier of the service that is deployed.	`92ba59d6-379e-4ffd-a67e-d544a9c24dea`
`cicd.deployment.status`	string	experimental Display name: `Deployment status` The status of the deployment.	`failed`; `succeeded`
`cicd.pipeline.id`	string	experimental Display name: `Pipeline ID` The CI/CD pipeline's identifier, which is unique within one CI/CD system.	`12345`
`cicd.pipeline.name`	string	experimental Display name: `Pipeline name` The human-readable name of the CI/CD pipeline.	`CI pipeline for main branch`
`cicd.pipeline.run.id`	string	experimental Display name: `Pipeline run ID` An identifier for a pipeline run, which is unique within one CI/CD system.	`9876`
`cicd.pipeline.run.outcome`	string	experimental Display name: `Pipeline run outcome` The outcome of one pipeline run.	`success`
`cicd.pipeline.run.queued.duration`	duration	experimental Display name: `Pipeline run queued duration` How long was the pipeline run queued before it was started, in nanoseconds.	`1234`
`cicd.pipeline.run.url.full`	string	experimental Display name: `Pipeline run full URL` The URL pointing to one specific pipeline run.	`https://github.com/ACME/ACME-repo/actions/runs/9876`
`cicd.pipeline.url.full`	string	experimental Display name: `Pipeline full URL` The CI/CD pipeline's full URL.	`https://github.com/ACME/ACME-repo/actions/workflows/ci-build.yml`
`cicd.upstream_pipeline.id`	string	experimental Display name: `Upstream pipeline ID` The identifier of the upstream CI/CD pipeline. If a pipeline run was triggered by another pipeline, this attribute is used to reference the triggering pipeline.	`12345`
`cicd.upstream_pipeline.run.id`	string	experimental Display name: `Upstream pipeline run ID` The identifier of the upstream CI/CD pipeline run. If a pipeline run was triggered by another pipeline, this attribute is used to reference the triggering pipeline run.	`1337`

cicd.deployment.status has the following list of well-known values. If one of them applies, then the respective value MUST be used, otherwise a custom value MAY be used.

Value	Description	Display name
`failed`	The deployment failed.	Failed
`succeeded`	The deployment succeeded.	Succeeded

cicd.pipeline.run.outcome has the following list of well-known values. If one of them applies, then the respective value MUST be used, otherwise a custom value MAY be used.

Value	Description	Display name
`canceled`	The pipeline run was canceled and did not complete.	Canceled
`error`	The pipeline run failed with an error.	Error
`failure`	The pipeline run failed.	Failure
`skipped`	The pipeline did not run, but was skipped.	Skipped
`success`	The pipeline run completed successfully.	Success
`timed_out`	The pipeline run timed out, and therefore did not complete.	Timed Out
`warning`	The pipeline run completed with at least one warning.	Warning

Client

The client namespace contains information on the initiator of a network connection. When observered from the server side, and when communicating through an intermediary, client.ip and client.port typically represent the client information behind any intermediaries (such as proxies) if it's available.

Client fields

Attribute	Type	Description	Examples
`client.address`	string	experimental Display name: `Client address` Client address - domain name if available without reverse DNS lookup; otherwise, IP address or Unix domain socket name.	`client.example.com`; `10.1.2.80`; `[local]`
`client.app.name`	string	experimental Display name: `Client app name` The name of the client application used to perform the request.	`MS Outlook`
`client.application.id`	string	stable Display name: `Client application ID` The ID of the client application used for the session.	`SnowflakeJDBCDriver`
`client.application.version`	string	experimental Display name: `Client application version` The version of the client application used for the session.	`1.0.0`
`client.build_id`	string	experimental Display name: `Client build ID` The build ID of the client application.	`build123`
`client.environment`	string	stable Display name: `Client environment` The environment of the client application.	`PRODUCTION`
`client.ip`	ipAddress	experimental Display name: `Client IP address` The IP address of the client that makes the request. This can be IPv4 or IPv6. Tags: `sensitive-spans` `sensitive-user-events`	`194.232.104.141`; `2a01:468:1000:9::140`
`client.ip.is_public`	boolean	experimental Display name: `Client IP is public` Indicates whether IP is a public IP.	`true`
`client.isp`	string	experimental Display name: `Client ISP name` The name of the Internet Service Provider (ISP) associated with the client's IP address.	`Internet Service Provider Name`
`client.port`	long	stable Display name: `Client port` Client port number.	`65123`; `80`
`client.type`	string	stable Display name: `Client type` The type of client used to connect to Snowflake, such as JDBC_DRIVER or ODBC_DRIVER.	`JDBC_DRIVER`
`client.version`	string	experimental Display name: `Client version` The version of the client software used to connect to Snowflake.	`1.0.0`

Cloud

Fields related to cloud deployments that can be used across different providers.

Cloud fields

Fields related to cloud deployments that can be used across different providers.

Attribute	Type	Description	Examples
`cloud.account.id`	string	resource deprecated Display name: `Cloud account ID` Deprecated in favor of cloud specific fields, such as aws.account.id, azure.subscription, gcp.project.id, etc.	`111111111111`; `opentelemetry`
`cloud.availability_zone`	string	resource deprecated Display name: `Cloud availability zone` Deprecated in favor of cloud specific fields, such as aws.availability_zone, azure.availability_zones, gcp.zone, etc.	`us-east-1a`
`cloud.platform`	string	resource deprecated Display name: `Cloud platform` Deprecated, no replacement available. ¹	`alibaba_cloud_ecs`
`cloud.provider`	string	resource stable Display name: `Cloud provider` Name of the cloud provider.	`alibaba_cloud`
`cloud.region`	string	resource deprecated Display name: `Cloud region` Deprecated in favor of cloud specific fields, such as aws.region, azure.location, gcp.region, etc.	`us-east-1`
`cloud.resource_id`	string	resource deprecated Display name: `Cloud resource ID` Deprecated in favor of cloud specific fields, such as aws.arn, azure.resource.id, gcp.resource.name, etc.	`arn:aws:lambda:REGION:ACCOUNT_ID:function:my-function`; `//run.googleapis.com/projects/PROJECT_ID/locations/LOCATION_ID/services/SERVICE_ID`; `/subscriptions/<SUBSCIPTION_GUID>/resourceGroups/<RG>/providers/Microsoft.Web/sites/<FUNCAPP>/functions/<FUNC>`

The prefix of the service matches the one specified in cloud.provider.

cloud.platform MUST be one of the following:

Value	Description	Display name
`alibaba_cloud_ecs`	Alibaba Cloud Elastic Compute Service	Alibaba Cloud ECS
`alibaba_cloud_fc`	Alibaba Cloud Function Compute	Alibaba Cloud FC
`alibaba_cloud_openshift`	Red Hat OpenShift on Alibaba Cloud	Alibaba Cloud OpenShift
`aws_app_runner`	AWS App Runner	AWS App Runner
`aws_ec2`	AWS Elastic Compute Cloud	AWS EC2
`aws_ecs`	AWS Elastic Container Service	AWS ECS
`aws_eks`	AWS Elastic Kubernetes Service	AWS EKS
`aws_elastic_beanstalk`	AWS Elastic Beanstalk	AWS Elastic Beanstalk
`aws_lambda`	AWS Lambda	AWS Lambda
`aws_openshift`	Red Hat OpenShift on AWS (ROSA)	AWS OpenShift
`azure_aks`	Azure Kubernetes Service	Azure AKS
`azure_app_service`	Azure App Service	Azure App Service
`azure_container_instances`	Azure Container Instances	Azure Container Instances
`azure_functions`	Azure Functions	Azure Functions
`azure_openshift`	Azure Red Hat OpenShift	Azure OpenShift
`azure_vm`	Azure Virtual Machines	Azure VMs
`gcp_app_engine`	Google Cloud App Engine (GAE)	GCP App Engine
`gcp_cloud_functions`	Google Cloud Functions (GCF)	GCP Cloud Functions
`gcp_cloud_run`	Google Cloud Run	GCP Cloud Run
`gcp_compute_engine`	Google Cloud Compute Engine (GCE)	GCP Compute Engine
`gcp_kubernetes_engine`	Google Cloud Kubernetes Engine (GKE)	GCP GKE
`gcp_openshift`	Red Hat OpenShift on Google Cloud	GCP OpenShift
`ibm_cloud_openshift`	Red Hat OpenShift on IBM Cloud	IBM Cloud OpenShift
`tencent_cloud_cvm`	Tencent Cloud Cloud Virtual Machine (CVM)	Tencent Cloud CVM
`tencent_cloud_eks`	Tencent Cloud Elastic Kubernetes Service (EKS)	Tencent Cloud EKS
`tencent_cloud_scf`	Tencent Cloud Serverless Cloud Function (SCF)	Tencent Cloud SCF

cloud.provider has the following list of well-known values. If one of them applies, then the respective value MUST be used, otherwise a custom value MAY be used.

Value	Description	Display name
`alibaba_cloud`	Alibaba Cloud	Alibaba Cloud
`aws`	Amazon Web Services	AWS
`azure`	Microsoft Azure	Azure
`gcp`	Google Cloud Platform	GCP
`heroku`	Heroku Platform as a Service	Heroku
`ibm_cloud`	IBM Cloud	IBM Cloud
`tencent_cloud`	Tencent Cloud	Tencent Cloud

Cloud target span fields

The cloud.target group provides information on the entity targeted by outgoing requests.

Attribute	Type	Description	Examples
`cloud.target.account.id`	string	experimental Display name: `Target cloud account ID` The cloud account ID used to access a cloud resource.	`111111111111`; `984398786124`
`cloud.target.provider`	string	experimental Display name: `Target cloud provider` Name of the cloud provider.	`alibaba_cloud`
`cloud.target.region`	string	experimental Display name: `Target cloud region` Identifier of the cloud vendor's data center geographic region.	`us-east-1`
`cloud.target.resource_id`	string	experimental Display name: `Target cloud resource ID` Cloud provider-specific native identifier of the accessed cloud resource (for example, an ARN on AWS, a fully qualified resource ID on Azure, or a complete resource name on GCP). If the value is not directly extractable for instrumentation, it can be constructed from its components.	`arn:aws:lambda:REGION:ACCOUNT_ID:function:my-function`; `//run.googleapis.com/projects/PROJECT_ID/locations/LOCATION_ID/services/SERVICE_ID`; `/subscriptions/<SUBSCIPTION_GUID>/resourceGroups/<RG>/providers/Microsoft.Web/sites/<FUNCAPP>/functions/<FUNC>`

cloud.target.provider has the following list of well-known values. If one of them applies, then the respective value MUST be used, otherwise a custom value MAY be used.

Value	Description	Display name
`alibaba_cloud`	Alibaba Cloud	Alibaba Cloud
`aws`	Amazon Web Services	AWS
`azure`	Microsoft Azure	Azure
`gcp`	Google Cloud Platform	GCP
`heroku`	Heroku Platform as a Service	Heroku
`ibm_cloud`	IBM Cloud	IBM Cloud
`tencent_cloud`	Tencent Cloud	Tencent Cloud

Cloud origin span fields

The cloud.origin group provides information on the entity from which incoming requests originate.

Attribute	Type	Description	Examples
`cloud.origin.account.id`	string	experimental Display name: `Origin cloud account ID` The cloud account ID used to access a cloud resource.	`111111111111`; `984398786124`
`cloud.origin.provider`	string	experimental Display name: `Origin cloud provider` Name of the cloud provider.	`alibaba_cloud`
`cloud.origin.region`	string	experimental Display name: `Origin cloud region` Identifier of the cloud vendor's data center geographic region.	`us-east-1`
`cloud.origin.resource_id`	string	experimental Display name: `Origin cloud resource ID` Cloud provider-specific native identifier of the accessed cloud resource (for example, an ARN on AWS, a fully qualified resource ID on Azure, or a complete resource name on GCP). If the value is not directly extractable for instrumentation, it can be constructed from its components.	`arn:aws:lambda:REGION:ACCOUNT_ID:function:my-function`; `//run.googleapis.com/projects/PROJECT_ID/locations/LOCATION_ID/services/SERVICE_ID`; `/subscriptions/<SUBSCIPTION_GUID>/resourceGroups/<RG>/providers/Microsoft.Web/sites/<FUNCAPP>/functions/<FUNC>`

cloud.origin.provider has the following list of well-known values. If one of them applies, then the respective value MUST be used, otherwise a custom value MAY be used.

Value	Description	Display name
`alibaba_cloud`	Alibaba Cloud	Alibaba Cloud
`aws`	Amazon Web Services	AWS
`azure`	Microsoft Azure	Azure
`gcp`	Google Cloud Platform	GCP
`heroku`	Heroku Platform as a Service	Heroku
`ibm_cloud`	IBM Cloud	IBM Cloud
`tencent_cloud`	Tencent Cloud	Tencent Cloud

Cloud Foundry

Cloud Foundry fields

Attribute	Type	Description
`cloudfoundry.application.id`	string	resource experimental Display name: `Cloud Foundry application ID`
`cloudfoundry.application.name`	string	resource experimental Display name: `Cloud Foundry application name`
`cloudfoundry.instance.index`	string	resource experimental Display name: `Cloud Foundry instance index`
`cloudfoundry.space.id`	string	resource experimental Display name: `Cloud Foundry space ID`
`cloudfoundry.space.name`	string	resource experimental Display name: `Cloud Foundry space name`

Code

Code fields

Attribute	Type	Description	Examples
`code.call_stack`	string	experimental Display name: `Call stack` The call stack of the `code.function`. The call stack starts with the `code.function`, and the stack frames are separated by a line feed.	`com.example.SampleClass.doProcessing(SampleClass.java) com.example.SampleClass.doSomeWork(SampleClass.java) com.example.SampleClass.main(SampleClass.java)`
`code.filepath`	string	experimental Display name: `Code file path` The source code file name that identifies the code unit as uniquely as possible.	`/usr/local/MyApplication/content_root/app/index.php`
`code.function`	string	experimental Display name: `Code function` The method or function name, or equivalent (usually the rightmost part of the code unit's name). Represents the name of the function that is represented by this span.	`serveRequest`
`code.invoked.filepath`	string	experimental Display name: `Invoked file path` Like `code.filepath`, only it represents the file path of the function that was active when a span has been started. Typically, it is the function that has been instrumented. It should only be set if it differs from `code.filepath`.	`/usr/local/MyApplication/content_root/app/index.php`
`code.invoked.function`	string	experimental Display name: `Invoked function` Like `code.function`, only it represents the function that was active when a span has been started. Typically, it's the function that has been instrumented. The spans duration does not reflect the duration of this function execution. It should only be set if it differs from `code.function`.	`invoke`
`code.invoked.namespace`	string	experimental Display name: `Invoked namespace` Like `code.namespace`, only it represents the namespace of the function that was active when a span has been started. Typically, it's the function that has been instrumented. It should only be set if it differs from `code.namespace`.	`com.sun.xml.ws.server.InvokerTube$2`
`code.line.number`	long	experimental Display name: `Line number` The line number within the source code file.	`1337`
`code.namespace`	string	experimental Display name: `Code namespace` The namespace within which `code.function` is defined. Usually, the qualified class or module name, such that `code.namespace` + some separator + `code.function` forms a unique identifier for the code unit.	`com.example.MyHttpService`

ColdFusion

ColdFusion fields

Attribute	Type	Description	Examples
`coldfusion.jvm.config.file`	string	resource experimental Display name: `ColdFusion JVM configuration file`
`coldfusion.service.name`	string	resource experimental Display name: `ColdFusion service name`

Compilation timings

Compilation timings fields

For some technologies compilation of code might be a significant contributor to request execution time. Compilation timings provide insight into this, where available.

Attribute	Type	Description	Examples
`compilation_timings.compilation_count`	long	experimental Display name: `Compilation count` The number of compilations contributing to `compilation_timings.duration_sum`.	`7`
`compilation_timings.duration_sum`	duration	experimental Display name: `Compilation duration sum` The total duration in nanoseconds spent compiling.	`6723`
`compilation_timings.top_compilations`	record	experimental Display name: `Top compilations` The top N compilations contributing to `compilation_timings.duration_sum`, represented as map from compilation unit name to duration in nanoseconds spent.	`{'/home/user/test/php/build/tmp/php-htdocs/memcached/memcachedCli.php': 1952, '/home/user/test/php/build/tmp/php-htdocs/curl_cli_uri_filtering.php': 1306}`

Container

Container fields

Attribute	Type	Description	Examples
`container.id`	string	resource experimental Display name: `Container ID` Container ID. Usually a UUID, as for example used to identify Docker containers. The UUID might be abbreviated.	`a3bf90e006b2`
`container.image.digest`	string	resource experimental Display name: `Container image digest` Immutable SHA-256 hash of an image that uniquely identifies the exact image content in a registry.	`sha256:aa1ed41571fa937da61b5bcd7cf842981c7f026b516c18655bc2f3a9362b1fa5`
`container.image.id`	string	resource experimental Display name: `Container image ID` Immutable SHA-256 hash of an image's configuration object (the image's config JSON) that uniquely identifies that exact image in the container runtime.	`sha256:94a00394bc5a8ef503fb59db0a7d0ae9e1110866e8aee8ba40cd864cea69ea1a`
`container.image.name`	string	resource experimental Display name: `Container image name` Name of the image the container was built on.	`gcr.io/opentelemetry/operator`
`container.image.version`	string	resource experimental Display name: `Container image version` Version of the image the container was created from.	`0.1`
`container.name`	string	resource experimental Display name: `Container name` Container name used by container runtime.	`opentelemetry-autoconf`
`container.runtime.name`	string	resource experimental Runtime used to run the container.	`boshbpm`

container.runtime.name has the following list of well-known values. If one of them applies, then the respective value MUST be used, otherwise a custom value MAY be used.

Value	Description	Display name
`boshbpm`	BOSH Process Manager container runtime, used in Cloud Foundry.	BOSH Process Manager
`containerd`	containerd container runtime.	containerd
`cri-o`	CRI-O container runtime.	CRI-O
`docker`	Docker container runtime.	Docker
`garden`	Garden container runtime, used in Cloud Foundry.	Garden
`podman`	Podman container runtime.	Podman
`unknown`	Container runtime could not be determined.	Unknown
`winc`	Windows container runtime, used in Cloud Foundry for Windows containers.	winc

Container image

The container_image namespace identifies the container image affected by or associated with a security finding.

Container image fields

Fields identifying the container image affected by or associated with a security finding.

Attribute	Type	Description	Examples
`container_image.digest`	string	resource experimental Display name: `Container image digest` Container image digest uniquely and immutably identifying the vulnerable container image.	`sha256:054e1d39fb20a52f2c78caeb83574035462d3d2e627978d89a2834ce8cb69fe1`
`container_image.registry`	string	resource experimental Display name: `Container image registry` Container image registry from which the container image originates.	`1294385647.eu-central-1`
`container_image.repository`	string	resource experimental Display name: `Container image repository` Container image repository from which the container image originates.	`unguard-frontend`
`container_image.tags`	array	resource experimental Display name: `Container image tags` List of tags of the container image.	`[1.0.0]`; `[1.0.0, 1.0.0-nightly, latest]`

CICS Transaction Gateway (CTG)

CTG (shorthand for "CICS Transaction Gateway") is a connector for enterprise modernization of CICS assets. It empowers various application platforms, such as Java servlets, to incorporate CICS programs.

CICS (shorthand for "Customer Information Control System") is a middleware to support rapid, high-volume online transaction processing on IBM mainframe systems on z/OS. CTG features a client and a server, which communicate via so-called GatewayRequests.

CTG fields

Attribute	Type	Description	Examples
`ctg.request.call_type`	long	experimental Display name: `CTG request call type` Integer representing the call type of the CTG GatewayRequest. The set of possible values varies per request type. ¹	`2`
`ctg.request.commarea_length`	long	experimental Display name: `CTG request commarea length` Length of the COMMAREA. Only set when the request type is ECI.	`0`
`ctg.request.extend_mode`	long	experimental Display name: `CTG request extend mode` Integer representing the extended mode of the CTG GatewayRequest. Only set when the request type is ECI. ²	`11`
`ctg.request.flow_type`	long	experimental Display name: `CTG request flow type` Integer representing the flow type of the CTG GatewayRequest. ³	`5`
`ctg.request.gateway_url`	string	experimental Display name: `CTG request gateway URL` URL of the gateway. Only set on client-side spans.	`tcp://1.2.3.4:5678/`
`ctg.request.object_name`	string	experimental Display name: `CTG request object name` Name of the request object. Only set when the request type is ADMIN.
`ctg.request.server_id`	string	experimental Display name: `CTG request server ID` ID of the server. Not set for all request types.	`IPICTEST`
`ctg.request.term_id`	string	experimental Display name: `CTG request terminal ID` Name of the terminal resource. Only set when the request type is EPI.	`CN02`
`ctg.request.type`	string	experimental Display name: `CTG request type` Type of the CTG GatewayRequest.	`BASE`
`ctg.response.code`	long	experimental Display name: `CTG response code` CTG response code. The set of possible values varies per request type. ⁴	`-23`

https://www.ibm.com/docs/api/v1/content/SSZHFX_9.3.0/basejavadoc/constant-values.html

The values are defined in the IBM CTG API source code.

⁴

https://www.ibm.com/docs/api/v1/content/SSZHFX_9.3.0/basejavadoc/constant-values.html

ctg.request.type MUST be one of the following:

Value	Description	Display name
`ADMIN`	Admin request.	Admin
`AUTH`	Authentication request.	Authentication request
`BASE`	Base. A base GatewayRequest without a further subtype. ¹	Base
`ECI`	External Call Interface. Enables a client application to call a CICS program synchronously or asynchronously. ²	External Call Interface
`EPI`	External Presentation Interface. Enables a user application to install a virtual IBM 3270 terminal into a CICS server. ³	External Presentation Interface
`ESI`	External Security Interface. Enables user applications to perform security-related tasks. ⁴	External Security Interface
`XA`	CICS Request Exit. It can be used for request retry, dynamic server selection, and rejecting non-valid requests. ⁵	CICS Request Exit

https://www.ibm.com/docs/en/cics-tg-multi/10.1.0?topic=classes-gatewayrequest

https://www.ibm.com/docs/en/cics-tg-zos/9.1.0?topic=applications-external-call-interface-eci

https://www.ibm.com/docs/en/cics-tg-multi/10.1.0?topic=guide-external-presentation-interface-epi

⁴

https://www.ibm.com/docs/en/cics-tg-zos/9.3.0?topic=applications-external-security-interface-esi

⁵

https://www.ibm.com/docs/en/cics-tg-zos/9.3.0?topic=applications-creating-cics-request-exit

Custom services

Custom service fields

Attribute	Type	Description	Examples
`custom_service.method`	string	experimental Display name: `Custom service method` The service method of a custom service. This field only exists if a custom service was created via Dynatrace OneAgent SDK.	`startTask`; `run`; `authenticate`
`custom_service.name`	string	experimental Display name: `Custom service name` The name of a custom service. This field only exists if a custom service was created via Dynatrace OneAgent SDK.	`MyCustomService`; `AuthenticationComponent`

Database

Database fields

Attribute	Type	Description	Examples
`db.affected_item_count`	long	experimental Display name: `Affected item count` The number of items (rows, documents,…) affected.	`32`
`db.collection.name`	string	stable Display name: `Collection name` The name of a collection (table, container) within the database.	`customers`; `public.users`
`db.connection_string`	string	experimental Display name: `Db connection string` The connection string for a database connection. Tags: `sensitive-spans`	`jdbc:dynamodb:Access Key=XXX;Secret Key=XXX;Domain=amazonaws.com;Region`
`db.cosmosdb.request_charge`	double	experimental Display name: `Cosmosdb request charge` The cost of the request in Azure Cosmos DB request units (RU).	`4.95`; `2.0`
`db.dynamodb.table_names`	string[]	experimental Display name: `Dynamodb table names` The list of tables the request targets.	`['Cats', 'Dogs']`
`db.namespace`	string	stable Display name: `Database Name` The name of the database, fully qualified within the server address and port.	`customers`; `test.users`
`db.operation.name`	string	stable Display name: `Db operation name` The name of the operation or command executed, for example the MongoDB command name, SQL keyword, Redis command name,… ¹	`drop`; `findAndModify`; `SELECT`; `PREPARE`; `GetItem`; `set`; `LPUSH`; `mutateIn`; `ReadItems`
`db.query.parameters`	record[]	experimental Display name: `Query parameters` The query parameters used in db.query.text represented as a key and value map. For database systems without named keys, the map key is the string representation of the index starting with 0. Several database requests may get aggregated into a single span. Each entry in the array holds the bind parameters for one database request. Tags: `sensitive-spans`	`[{'name': 'paul', 'age': '23'}, {'name': 'mary', 'age': '32'}]`; `[{'0': 'paul', '1': '23'}, {'0': 'mary', '1': '32'}]`
`db.query.text`	string	stable Display name: `Query` The database query being executed. ²	`SELECT * FROM wuser_table`; `SET mykey "WuValue"`
`db.result.duration_max`	duration	experimental Display name: `Db duration max` The maximum duration in nanoseconds used for fetching the result.	`345`
`db.result.duration_min`	duration	experimental Display name: `Db duration min` The minimum duration in nanoseconds used for fetching the result.	`123`
`db.result.duration_sum`	duration	experimental Display name: `Db duration sum` The total duration in nanoseconds used for fetching the result.	`234`
`db.result.exception_count`	long	experimental Display name: `Db exception count` The number of exceptions encountered while fetching the result.	`2`
`db.result.execution_count`	long	experimental Display name: `Db execution count` The number of operations executed on the result (for example, fetches from SQL result set, MongoDB cursor operations).	`12`
`db.result.fetch_size`	long	experimental Display name: `Db fetch size` The number of items requested in fetching query results.	`12`
`db.result.roundtrip_count`	long	experimental Display name: `Db roundtrip count` The number of round-trips triggered by fetching the result.	`2`
`db.snowflake.connection`	string	experimental Display name: `Snowflake connection name` The name of the connection used by the client, or NULL if the client is not using a connection URL.	`connection_1`
`db.snowflake.dbs`	string[]	stable Display name: `Snowflake databases used in query` The databases involved in the query.	`['PROD_DB', 'TEST_DB']`
`db.snowflake.tables`	string[]	stable Display name: `Snowflake tables used in query` The tables involved in the query.	`['users', 'orders']`
`db.snowflake.views`	string[]	stable Display name: `Snowflake views used in query` The views involved in the query. ³	`['user_view']`
`db.system`	string	experimental Display name: `Database system` An identifier for the database management system (DBMS) product being used. See below for a list of well-known identifiers.	`mongodb`; `mysql`
`db.user`	string	experimental Display name: `Database user` The name of the user who executed the query.	`john_doe`

Depending on the data provided on ingest, this attribute may be derived by e.g., parsing db.query.text. Parsing might fail, or the result might be inaccurate.

The value may be sanitized to exclude sensitive information.

Fully proprietary; no OTel analog.

db.system has the following list of well-known values. If one of them applies, then the respective value MUST be used, otherwise a custom value MAY be used.

Value	Description	Display name
`adabas`	Adabas (Adaptable Database System)	Adabas
`amazon-documentdb`	Amazon DocumentDB	DocumentDB
`aurora-mysql`	Amazon Aurora MySQL	Aurora MySQL
`aurora-postgresql`	Amazon Aurora PostgreSQL	Aurora PostgreSQL
`cache`	InterSystems Caché	InterSystems Caché
`cassandra`	Apache Cassandra	Cassandra
`clickhouse`	ClickHouse	ClickHouse
`cloudscape`	Cloudscape	Cloudscape
`cockroachdb`	CockroachDB	CockroachDB
`coldfusion`	ColdFusion IMQ	ColdFusion IMQ
`cosmosdb`	Microsoft Azure Cosmos DB	Cosmos DB
`couchbase`	Couchbase	Couchbase
`couchdb`	CouchDB	CouchDB
`databricks`	Databricks Data Platform	Databricks Data Platform
`db2`	IBM Db2	IBM Db2
`derby`	Apache Derby	Derby
`dl/i`	IBM DL/I	IBM DL/I
`dynamodb`	Amazon DynamoDB	DynamoDB
`edb`	EnterpriseDB	EnterpriseDB
`elasticsearch`	Elasticsearch	Elasticsearch
`filemaker`	FileMaker	FileMaker
`firebird`	Firebird	Firebird
`firstsql`	FirstSQL	FirstSQL
`geode`	Apache Geode	Geode
`h2`	H2	H2
`hanadb`	SAP HANA	SAP HANA
`hbase`	Apache HBase	HBase
`hive`	Apache Hive	Hive
`hsqldb`	HyperSQL DataBase	HSQLDB
`informix`	Informix	Informix
`ingres`	Ingres	Ingres
`instantdb`	InstantDB	InstantDB
`interbase`	InterBase	InterBase
`keyspaces-cassandra`	Amazon Keyspaces for Apache Cassandra	Keyspaces
`mariadb`	MariaDB	MariaDB
`maxdb`	SAP MaxDB	SAP MaxDB
`memcached`	Memcached	Memcached
`mongodb`	MongoDB	MongoDB
`mssql`	Microsoft SQL Server	SQL Server
`mssqlcompact`	Microsoft SQL Server Compact	SQL Server Compact
`mysql`	MySQL	MySQL
`neo4j`	Neo4j	Neo4j
`neptune`	Amazon Neptune	Neptune
`netezza`	Netezza	Netezza
`opensearch`	OpenSearch	OpenSearch
`oracle`	Oracle Database	Oracle
`other_sql`	Some other SQL database. Fallback only. See notes.	Other SQL
`pervasive`	Pervasive PSQL	Pervasive PSQL
`phoenix`	Apache Phoenix	Apache Phoenix
`pointbase`	PointBase	PointBase
`postgresql`	PostgreSQL	PostgreSQL
`progress`	Progress Database	Progress
`redis`	Redis	Redis
`redshift`	Amazon Redshift	Redshift
`snowflake`	Snowflake Data Platform	Snowflake Data Platform
`spanner`	Cloud Spanner	Cloud Spanner
`sqlite`	SQLite	SQLite
`sybase`	Sybase	Sybase
`teradata`	Teradata	Teradata
`valkey`	Valkey	Valkey
`vertica`	Vertica	Vertica

Deployment

Deployment fields

Attribute	Type	Description	Examples
`deployment.release_build_version`	string	resource stable Display name: `Build version` The build version of the deployed product.	`2021-03-24`
`deployment.release_product`	string	resource stable Display name: `Release product` A logical group of interconnected microservices, APIs, and databases that work together to deliver a single business capability or product. It acts as an architectural boundary, mapping how individual technical pieces cooperate to provide a complete user-facing function. Software catalogs (like Backstage) use this concept to abstract away raw codebases and give teams high-level visibility into a product's entire ecosystem. Tags: `primary-field`	`astroshop`; `developer-self-service`; `mobile-banking-backend`; `product-search-discovery`
`deployment.release_stage`	string	resource stable Display name: `Stage` The deployment environment that the deployable unit producing this data is running in, for example, a stage of your delivery pipeline. Tags: `primary-field`	`production`
`deployment.release_version`	string	resource stable Display name: `Version` The version of the deployable unit—such as a service, application, or function—that produced this data. Tags: `primary-field`	`0.4.1`

Device

The device namespace contains information on the device running an application. This should only be used for end-user devices or devices outside of a private infrastructure. In line with the naming conventions and guidelines, we are in this case adhering to the emerging Open Telemetry convention around this, with some additions.

Device fields

Attribute	Type	Description	Examples
`device.battery.level`	long	stable Display name: `Device battery level` The device's battery level in the range 0% (discharged) to 100% (fully charged).	`100`
`device.orientation`	string	experimental Display name: `Device orientation` The device orientation.	`landscape`

device.orientation MUST be one of the following:

Value	Description	Display name
`landscape`	The device was in landscape mode.	Landscape
`portrait`	The device was in portrait mode.	Portrait

Device resource fields

Attribute	Type	Description	Examples
`device.is_rooted`	boolean	resource stable Display name: `Device is rooted` If set to `true`, the device is rooted or jailbroken.	`false`
`device.manufacturer`	string	resource stable Display name: `Device manufacturer` The device manufacturer.	`Apple`
`device.model.identifier`	string	resource stable Display name: `Device model identifier` The device model identifier.	`iPhone 17 Max Pro`
`device.screen.height`	long	resource stable Display name: `Device screen height` The device's screen height in its natural orientation.	`1152`
`device.screen.width`	long	resource stable Display name: `Device screen width` The device's screen width in its natural orientation.	`2048`

Disk

Disk fields

Fields describing a disk.

Attribute	Type	Description	Examples
`disk.all_mountpoints`	string[]	resource experimental Display name: `Disk all mountpoints` List of all mountpoints	`['/mnt/storage', '/home', '/var/log']`
`disk.device_name`	string	resource experimental Display name: `Disk device name` Disk device name (Linux, AIX)	`sda`
`disk.filesystem_type`	string	resource experimental Display name: `Filesystem type` Filesystem type as read from the operating system.	`ext4`; `ntfs`; `fat32`; `sfs`; `zfs`
`disk.mountpoint`	string	resource experimental Display name: `Disk primary mountpoint` Primary mountpoint	`/mnt/storage`
`disk.name`	string	resource experimental The name of the Smartscape disk.	`C:`; `/dev/sda1`; `xvda`
`disk.remote_disk_id`	long	resource stable Display name: `Remote disk ID` Unique identifier of a disk that is mounted from remote storage, derived from the remote path. It is therefore identical on every host that mounts the same share. Local disks report 0.	`0`; `16864135562327138441`; `18446744073709551615`

DL/I database attachment

DL/I database attachment fields

Attribute	Type	Description	Examples
`db.dli.pcb`	string	experimental Display name: `DL/I pcb name` The name of the program communication block associated with this DL/I method.	`3`; `MYPCBNAM`
`db.dli.pcb_type`	string	experimental Display name: `DL/I pcb type` The PCB type.	`DC`; `DL/I`; `F/P`
`db.dli.processing_options`	string	experimental Display name: `DL/I processing options` The PCB processing options.	`GR`
`db.dli.segment_level`	string	experimental Display name: `DL/I segment level` The hierarchical level of the segment that was matched or returned.	`3`; `24`
`db.dli.segment_name`	string	experimental Display name: `DL/I segment name` The name of the last segment that was matched or returned.	`PARTROOT`
`db.dli.status_code`	string	experimental Display name: `DL/I status code` The DL/I status code.	`QC`
`db.dli.terminal_name`	string	experimental Display name: `DL/I terminal name` The DL/I database or logical terminal name associated with this DL/I method.	`HWSAM5ZD`; `10505`

db.dli.pcb_type MUST be one of the following:

Value	Description	Display name
`DC`	Data communications.	Data communications
`DL/I`	DL/I db.	DL/I
`F/P`	Fast Path.	Fast Path

Dotnet

Dotnet fields

Attribute	Type	Description	Examples
`dotnet.dll.file`	string	resource experimental Display name: `.NET dll file` Filename of main dotnet assembly.
`dotnet.dll.path`	string	resource experimental Display name: `.NET dll path` Filepath of main dotnet assembly.

Dynatrace Snowflake Observability Agent (DSOA)

Dynatrace Snowflake Observability Agent resource fields

Resource-level Dynatrace Snowflake Observability Agent execution metadata and deployment context.

Attribute	Type	Description	Examples
`deployment.environment`	string	resource deprecatedUse deployment.environment.name instead. Display name: `Snowflake deployment environment` Deprecated alias for deployment.environment.name. The deployment environment, for example, production, staging, or development. Will be removed in release 1.3.0. ¹	`PROD`
`deployment.environment.name`	string	resource stable Display name: `Snowflake deployment environment name` The deployment environment name (OTel semconv canonical field), for example, production, staging, or development. Emitted alongside deployment.environment during the deprecation window. ²	`PROD`
`deployment.environment.tag`	string	resource stable Display name: `Deployment environment tag` Optional tag for the deployment environment in multitenancy mode	`SA080`
`dsoa.run.context`	string	resource stable Display name: `Dynatrace Snowflake Observability Agent execution context` The name of the Dynatrace Snowflake Observability Agent context (part of plugin) used to produce the telemetry (logs, traces, metrics, or events). In case of multiple contexts within the same plugin, this helps differentiate between them. If plugin delivers only one context, this field will have the same value as the plugin name.	`users_all_roles`
`dsoa.run.id`	string	resource stable Display name: `Dynatrace Snowflake Observability Agent execution unique identifier` Unique ID of each execution of the Dynatrace Snowflake Observability Agent plugin. It can be used to differentiate between telemetry produced between two executions, for example, to calculate the change in the system.	`4aa7c76c-e98c-4b8b-a5b3-a8a721bbde2d`
`dsoa.run.plugin`	string	resource stable Display name: `Dynatrace Snowflake Observability Agent execution plugin name` The name of the Dynatrace Snowflake Observability Agent plugin that produced this telemetry. Use to filter all telemetry from a specific plugin (for example, 'query_history', 'warehouse_usage'). Distinct from dsoa.run.context, which may represent a sub-context within a plugin.	`users`

OTel Semantic Conventions v1.26 renamed deployment.environment to deployment.environment.name (stable). Dynatrace Snowflake Observability Agent continues to emit deployment.environment for backward compatibility with existing Dynatrace configurations; migration to deployment.environment.name is deferred pending adoption analysis.

OTel Semantic Conventions stable canonical name (since v1.26). Dynatrace Snowflake Observability Agent co-emits this alongside the deprecated deployment.environment during the migration window. Operators should migrate DQL queries to filter by this key.

Dynatrace Snowflake Observability Agent debug signal fields

Signal-level fields for Dynatrace Snowflake Observability Agent debug telemetry.

Attribute	Type	Description	Examples
`dsoa.debug.span.events.added`	long	stable Display name: `Dynatrace Snowflake Observability Agent debug span events added` Internal debug field indicating the number of span events successfully added to the given span.	`5`
`dsoa.debug.span.events.failed`	long	stable Display name: `Dynatrace Snowflake Observability Agent debug span events failed` Internal debug field indicating the number of span events that failed to be added to the given span.	`1`

Dynatrace Snowflake Observability Agent plugins signal fields

Signal-level fields for Dynatrace Snowflake Observability Agent plugins telemetry.

Attribute	Type	Description	Examples
`dsoa.plugins.query_history.obfuscation_mode`	string	experimental Display name: `Dynatrace Snowflake Observability Agent query history obfuscation mode` Configuration key controlling query text obfuscation mode applied to `db.query.text` and `snowflake.error.message`. ¹	`none`
`dsoa.plugins.query_history.track_ddl_changes`	boolean	experimental Display name: `Dynatrace Snowflake Observability Agent query history DDL change tracking indicator` EXPERIMENTAL. When `true`, the plugin surfaces DDL change attribution attributes (`snowflake.object.type`, `.id`, `.name`, `snowflake.object.ddl.operation`, `snowflake.object.ddl.properties`) on `query_history` events whose `ACCESS_HISTORY` row carries an `OBJECT_MODIFIED_BY_DDL` payload. Covers database-object DDL only (tables, views, schemas, procedures). Warehouse and resource-monitor DDL does not populate `OBJECT_MODIFIED_BY_DDL` and is not affected by this setting — use `db.operation.name` for warehouse change detection. Default `false` preserves backward-compatible behavior. May be refactored into a dedicated plugin in a future release. ²	`false`

Note: this is the SD-catalog attribute name; the actual config path read at runtime is plugins.query_history.obfuscation_mode (no dsoa. prefix) — see 050_f_get_query_history.sql.

Note: this is the SD-catalog attribute name; the actual config path is plugins.query_history.track_ddl_changes (no dsoa. prefix). Not currently wired up to any reader in code — setting this has no runtime effect yet.

dsoa.plugins.query_history.obfuscation_mode MUST be one of the following:

Value	Description
`full`	Entire query text is replaced with `[OBFUSCATED]`.
`literals`	String and numeric literals are replaced with `?`.
`none`	No obfuscation applied.

Dynatrace ActiveGate

Metadata with ActiveGate related information.

Dynatrace ActiveGate fields

Attribute	Type	Description	Examples
`dt.active_gate.group.name`	string	resource experimental Display name: `ActiveGate group name` The name of a group that the ActiveGate instance belongs to.	`GdanskLab`
`dt.active_gate.id`	string	resource experimental Display name: `ActiveGate ID` Hexadecimal identifier of the ActiveGate prefixed with `0x`	`0xef3d21c3`
`dt.active_gate.module_name`	string	resource experimental Display name: `ActiveGate module name` The name of ActiveGate module	`autoupdate`
`dt.active_gate.name`	string	resource experimental Display name: `ActiveGate name` Human-readable name of the ActiveGate instance. ¹	`activegate-0`; `my-activegate-host.example.com`
`dt.active_gate.working_mode`	string	resource experimental Display name: `ActiveGate working mode` Working mode of the ActiveGate	`cluster`

In a Kubernetes deployment, this is the pod name (see k8s.pod.name). In other deployments, this is the hostname (see host.name).

dt.active_gate.working_mode MUST be one of the following:

Value	Description	Display name
`cluster`	Cluster ActiveGate	Cluster
`embedded`	Embedded ActiveGate	Embedded
`environment`	Environment ActiveGate	Environment
`multitenant`	Multitenant ActiveGate	Multitenant

Dynatrace ActiveGate API connector fields

Attribute	Type	Description	Examples
`dt.active_gate.api_connector.config_id`	string	resource experimental Display name: `ActiveGate API connector config ID` Config long id of the endpoint configuration as a string.	`123`; `9276`
`dt.active_gate.api_connector.pipeline_identifier`	string	resource experimental Display name: `ActiveGate API connector pipeline identifier` String identifier of an api connector pipeline	`Kubernetes/Topology`
`dt.active_gate.api_connector.pipeline_status`	string	resource experimental Display name: `ActiveGate API connector pipeline status` Status of an api connector pipeline run	`failed`
`dt.active_gate.api_connector.technology_id`	string	resource experimental Display name: `ActiveGate API connector technology ID` String identifier of an api connector technology	`Kubernetes`; `CloudFoundry`; `AWS`; `Dynatrace Extension`; `Azure`

dt.active_gate.api_connector.pipeline_status MUST be one of the following:

Value	Description	Display name
`failed`	Pipeline execution failed	Failure
`skipped`	Pipeline execution skipped	Skipped
`succeeded`	Pipeline execution succeeded	Success

Dynatrace OneAgent metadata

Dynatrace OneAgent metadata fields

Metadata of the OneAgent module that reported a signal. These attributes are what one would also see in OneAgent Health.

Attribute	Type	Description	Examples
`dt.agent.allocation_sampling.enabled`	boolean	resource experimental Display name: `OneAgent allocation sampling enabled` Indicates whether allocation sampling profiling is enabled on this OneAgent.	`false`
`dt.agent.cpu_sampling.enabled`	boolean	resource experimental Display name: `OneAgent CPU sampling enabled` Indicates whether CPU sampling profiling is enabled on this OneAgent.	`false`
`dt.agent.installer_version`	string	resource experimental Display name: `OneAgent installer version` OneAgent installer version.	`1.333.0.20260126-132010`
`dt.agent.live_debugger.enabled`	boolean	resource experimental Display name: `OneAgent live debugger enabled` Indicates whether live debugging is enabled on this OneAgent.	`false`
`dt.agent.module.deployment.__key__`	string	resource experimental Display name: `OneAgent module deployment property` Deployment properties of the OneAgent module. `__key__` is populated with the deployment property name, for example, `dt.agent.module.deployment.orchestration_tech`.	`Operator-activegate`; `Operator-classic_fullstack`; `Operator-cloud_native_fullstack`
`dt.agent.module.deployment.fips`	boolean	resource experimental Display name: `OneAgent fips deployment mode` True if FIPS deployment mode is enabled for the OneAgent module.	`false`
`dt.agent.module.deployment.standalone`	boolean	resource experimental Display name: `OneAgent standalone deployment mode` Indicates whether the OneAgent module is running in standalone deployment mode, without a full-stack OS-layer OneAgent present on the underlying host. When true, the OneAgent module is operating independently of a host-level OneAgent.	`false`
`dt.agent.module.first_seen`	timestamp	resource experimental Display name: `OneAgent module first seen` Timestamp when the OneAgent module first made contact and was registered.	`1771494246779`; `1771844752`
`dt.agent.module.health`	string	resource experimental Display name: `OneAgent module health` Health status of the OneAgent module.	`CRITICAL`
`dt.agent.module.id`	uid	resource stable Display name: `OneAgent module ID` OneAgent module ID.	`031f613871fab0b4`; `fc3cd1bb276f0bed`
`dt.agent.module.injection_mode`	string	resource experimental Display name: `OneAgent module injection mode` Injection Mode of the OneAgent module.	`INJECTION_MODE_AUTO_INJECTED`
`dt.agent.module.issues`	record[]	resource experimental Display name: `OneAgent module issues` List of issue objects detected for the OneAgent module. Each object contains the issue and severity level (CRITICAL, WARNING, or INFO).	`[{'issue': 'QUOTA_OS_EXCEEDED', 'severity': 'CRITICAL'}, {'issue': 'OSI_ID_CLASH', 'severity': 'CRITICAL'}]`; `[{'issue': 'VERSION_TOO_OLD', 'severity': 'WARNING'}, {'issue': 'INSTALLER_VERSION_BAD', 'severity': 'WARNING'}]`; `[{'issue': 'AGENT_OUTDATED', 'severity': 'INFO'}]`
`dt.agent.module.name`	string	resource experimental Display name: `OneAgent module name` Name of a specific OneAgent module.	`oneagentloganalytics`; `java-agent1-WebService-6-IG-48`
`dt.agent.module.parent_id`	uid	resource stable Display name: `OneAgent parent module ID` OneAgent parent module ID, in case this is a so-called sub-agent.	`ea89eef5db8b85a9`
`dt.agent.module.startup_timestamp`	timestamp	resource experimental Display name: `OneAgent module startup timestamp` Timestamp when the OneAgent module was started up. Note that this is not necessarily the same as `dt.agent.module.first_seen` (for example, if the agent is unable to register for some time).	`1771494246779`; `1771844752`
`dt.agent.module.type`	string	resource stable Display name: `OneAgent module type` OneAgent module type.	`apache`
`dt.agent.module.version`	string	resource stable Display name: `OneAgent module version` OneAgent full module version.	`1.269.17.20221117-132428`
`dt.agent.module.version_short`	string	resource experimental Display name: `OneAgent module short version` OneAgent short module version, to be expected only on record types where `dt.agent.module.version`'s cardinality would be a problem.	`1.269`
`dt.agent.monitoring.is_enabled`	boolean	resource experimental Display name: `OneAgent monitoring enabled` Indicates whether this OneAgent is actively monitoring.	`false`
`dt.agent.monitoring_mode`	string	resource experimental Display name: `OneAgent monitoring mode` Monitoring Mode in which the OneAgent module operates.	`DISCOVERY`

dt.agent.module.health MUST be one of the following:

Value	Description	Display name
`CRITICAL`	The OneAgent module has critical issues that need immediate attention to ensure proper functionality.	Critical
`HEALTHY`	The OneAgent module is functioning properly without any detected issues.	Healthy
`INFO`	The OneAgent module has informational messages that may require attention.	Info
`WARNING`	The OneAgent module has warnings that indicate potential issues that should be investigated.	Warning

dt.agent.module.injection_mode MUST be one of the following:

Value	Description	Display name
`INJECTION_MODE_AUTO_INJECTED`	The OneAgent module was automatically injected into the application/process.	Auto
`INJECTION_MODE_MANUALLY_INJECTED`	The OneAgent module was manually injected or installed, requiring explicit user configuration or deployment.	Manual
`INJECTION_MODE_UNKNOWN`	The injection mode is not known or not determined yet. This is the default/fallback value.	Unknown

dt.agent.module.type has the following list of well-known values. If one of them applies, then the respective value MUST be used, otherwise a custom value MAY be used.

Value	Description	Display name
`apache`	apache	Apache
`dotnet`	dotnet	.NET
`dumpproc`	dumpproc	Dump Process
`extensions`	extensions	Extensions
`go`	go	Go
`iis`	iis	IIS
`java`	java	Java
`log_analytics`	log_analytics	Log Analytics
`net`	net	.NET Framework
`nettracer`	nettracer	Network Tracer
`nginx`	nginx	NGINX
`nodejs`	nodejs	Node.js
`opentracingnative`	opentracingnative	OpenTracing Native
`os`	os	OS
`php`	php	PHP
`plugin`	plugin	Plugin
`process`	process	Process
`python`	python	Python
`remote_plugin`	remote_plugin	Remote Plugin
`ruby`	ruby	Ruby
`rust`	rust	Rust
`sdk`	sdk	SDK
`support`	support	Support
`updater`	updater	Updater
`varnish`	varnish	Varnish
`wsmb`	wsmb	WSMB
`z`	z_	z/OS

dt.agent.monitoring_mode MUST be one of the following:

Value	Description	Display name
`DISCOVERY`	Discovery monitoring mode provides basic metrics enabling you to discover your hosts and processes and learn the potential to extend your monitoring.	Discovery
`FULL_STACK`	Full stack monitoring mode includes application performance, user experience data, code-level visbility and PurePath insights, as well as everything that is included in Infrastructure monitoring mode.	Full Stack
`INFRASTRUCTURE`	Infrastructure monitoring mode includes topology discovery, detailed health and performance monitoring of your host, and enables Network monitoring, Log monitoring and Extensions.	Infrastructure

Dynatrace AutomationEngine

Fields defined in this namespace are used by Dynatrace to describe various aspects of events emitted by the AutomationEngine.

Dynatrace AutomationEngine fields

Attribute	Type	Description	Examples
`dt.automation_engine.action.app`	string	experimental Display name: `Action app` The app ID of the app containing the executed action.	`dynatrace.automations`
`dt.automation_engine.action.function`	string	experimental Display name: `Action function name` Name of the function implementing the action.	`task_1`
`dt.automation_engine.action_execution.id`	string	experimental Display name: `Action execution ID` The unique identifier of a action execution as UUID.	`23e7b55a-884f-4497-8ad6-8d49d52b4348`
`dt.automation_engine.action_execution.loop.index`	long	experimental Display name: `Action execution loop index` Loop index of the action execution.
`dt.automation_engine.action_execution.retry.count`	long	experimental Display name: `Action execution retry count` Retry count of the action execution.
`dt.automation_engine.is_draft`	boolean	experimental Display name: `Workflow is draft` Indicates whether the triggered workflow execution is based on a workflow draft.	`true`; `false`
`dt.automation_engine.is_task_test`	boolean	experimental Display name: `Is task test` Indicates that the task execution or action execution belongs to a task test run of a single target task, rather than a regular workflow execution.	`true`; `false`
`dt.automation_engine.root_workflow.id`	string	experimental Display name: `Root workflow ID` The unique identifier of the root workflow.	`e6388e3a-9db2-4226-9327-2ba86eaf12f7`
`dt.automation_engine.root_workflow_execution.id`	string	experimental Display name: `Root workflow execution ID` The unique identifier of the execution of the root workflow.	`a641fb59-4627-44cd-abaf-b68d86455a5b`
`dt.automation_engine.state`	string	experimental Display name: `Execution state` The state of an execution. Values depend on type of execution (workflow-, task-, or action execution).	`IDLE`; `RUNNING`; `WAITING`; `SUCCESS`; `ERROR`; `CANCELLED`
`dt.automation_engine.state.is_final`	boolean	experimental Display name: `Execution state is final` Indicates if `dt.automation_engine.state` is a final and immutable state or if further processing will happen.	`true`; `false`
`dt.automation_engine.state_info`	string	experimental Display name: `Execution state info` Additional info about current state of execution. Typically holds error details.	`ERROR`
`dt.automation_engine.task.name`	string	experimental Display name: `Task name` The identifier of a task within a workflow.	`task_1`
`dt.automation_engine.task_execution.id`	string	experimental Display name: `Task execution ID` The unique identifier of a task execution as UUID.	`6580d4af-6b1f-4e54-92fa-f47e94507acd`
`dt.automation_engine.test_task_execution.actor`	string	experimental Display name: `Task test actor` The unique identifier of the actor the task test ran as.	`e622afae-ccc7-4fb5-acc5-13b32e827bbe`
`dt.automation_engine.test_task_execution.trigger.user.id`	string	experimental Display name: `Task test trigger user ID` The unique identifier of the user who triggered the task test.	`dad18fa7-3c11-40a1-b760-1d8281bb5dcc`
`dt.automation_engine.throttle.limit`	long	experimental Display name: `Workflow execution throttle limit` The workflow execution per hour limit that has been reached.	`1000`
`dt.automation_engine.workflow.id`	string	experimental Display name: `Workflow ID` The unique identifier of a workflow as UUID.	`26c0334e-a3e1-4585-8cd8-2d72742fe141`
`dt.automation_engine.workflow.last_execution_state_flip`	boolean	experimental Display name: `Workflow last execution state flip` Indicates if the workflow execution state has changed since the last execution, ignoring draft executions. Always false for draft executions.	`true`; `false`
`dt.automation_engine.workflow.title`	string	experimental Display name: `Workflow title` The title of the workflow.	`My Workflow`
`dt.automation_engine.workflow.type`	string	experimental Display name: `Workflow type` Workflow type, either SIMPLE or STANDARD, where SIMPLE comes with restrictions.	`SIMPLE`; `STANDARD`
`dt.automation_engine.workflow.version`	long	experimental Display name: `Workflow version` The version of the workflow.	`1`; `42`
`dt.automation_engine.workflow_execution.actor`	string	experimental Display name: `Workflow actor` The unique identifier of the actor as defined in the workflow.	`e622afae-ccc7-4fb5-acc5-13b32e827bbe`
`dt.automation_engine.workflow_execution.id`	string	experimental Display name: `Workflow execution ID` The unique identifier of a workflow execution as UUID.	`737a248b-d1cb-49a4-bf08-7d4c37dbfb1e`
`dt.automation_engine.workflow_execution.trigger.event.id`	string	experimental Display name: `Trigger event ID` Unique identifier string (`event.id`) of the event that triggered the workflow execution. Only set for event-triggered executions.	`5547782627070661074_1647601320000`
`dt.automation_engine.workflow_execution.trigger.event.timestamp`	timestamp	experimental Display name: `Trigger event timestamp` The timestamp of the event that triggered the workflow execution.	`1.72852206e18`
`dt.automation_engine.workflow_execution.trigger.type`	string	experimental Display name: `Workflow trigger type` The identifier that describes the trigger of the workflow.	`Schedule`; `Event`; `Workflow`; `Manual`
`dt.automation_engine.workflow_execution.trigger.user.id`	string	experimental Display name: `Trigger user ID` The unique identifier of the user who triggered the workflow execution manually/via API.	`dad18fa7-3c11-40a1-b760-1d8281bb5dcc`
`dt.automation_engine.workflow_execution.trigger.workflow_execution.id`	string	experimental Display name: `Trigger workflow execution ID` The unique identifier of the workflow that triggered the workflow execution.	`737a248b-d1cb-49a4-bf08-7d4c37dbfb1e`

Dynatrace Bindplane

Fields defined in this namespace describe the Bindplane organizational context (configuration, fleet, and project) of the collector that produced a record.

Dynatrace Bindplane fields

Attribute	Type	Description	Examples
`dt.bindplane.configuration`	string	resource experimental Display name: `Bindplane configuration` Name of the Bindplane configuration applied to the collector that produced the record.	`prod-logs`; `k8s-metrics`
`dt.bindplane.fleet`	string	resource experimental Display name: `Bindplane fleet` Name of the Bindplane fleet the collector belongs to.	`edge-collectors`; `gateway-eu`
`dt.bindplane.project`	string	resource experimental Display name: `Bindplane project` Name of the Bindplane project that the collector is managed under.	`platform`; `observability-team`

Dynatrace data acquisition

Attributes defined in this namespace are used by Dynatrace to describe different aspects of the ingested data.

Dynatrace data acquisition fields

Attribute	Type	Description	Examples
`dt.da.aws.data_firehose.arn`	string	experimental Display name: `Amazon Data Firehose ARN` ARN of AWS Data Firehose signal is originating from.	`arn:aws:firehose:us-east-1:111110000111:deliverystream/tenantId-http-endpoint-direct-firehose-stream`
`dt.da.aws.forwarder.arn`	string	experimental Display name: `Dynatrace forwarder instance AWS ARN` The ARN of the Dynatrace forwarder that forwarded this signal	`arn:aws:lambda:us-east-1:111110000111:function:DT-S3-Logs-Forwarder-0bbdc8d0`
`dt.da.aws.log_group`	string	experimental Display name: `AWS CloudWatch log group` Name of the source Amazon CloudWatch Log group	`/aws/lambda/a-SomeFumction-1AWHD6W1QC5DH`
`dt.da.aws.log_stream`	string	experimental Display name: `AWS CloudWatch log stream` Name of the source Amazon CloudWatch Log stream	`2025/02/18/[$LATEST]12312312313123123123123123123123`
`dt.da.aws.s3.bucket.name`	string	experimental Display name: `AWS S3 bucket name` Name of S3 bucket name signal is originating from	`aws-cloudtrail-logs`
`dt.da.aws.s3.key.name`	string	experimental Display name: `AWS S3 key name` Name of S3 bucket name signal is originating from	`AWSLogs/111110000111/CloudTrail/us-east-1/2025/02/18/111110000111_CloudTrail_us-east-1_20250218T0000Z.json.gz`
`dt.da.azure.event_hub.location`	string	experimental Display name: `Azure Event Hub location` The location of the Event Hub that the signal is originating from	`polandcentral`
`dt.da.azure.event_hub_namespace.id`	string	experimental Display name: `Azure Event Hub namespace ID` The resource ID of the Event Hub that the signal is originating from	`/subscriptions/27e9b03f-04d2-2b69-b327-32f433f7ed21/resourceGroups/rg-dt-xyz1234a-eastus/providers/Microsoft.EventHub/namespaces/evhns-dt-xyz1234a-eastus`
`dt.da.source`	string	experimental Display name: `Data acquisition source` Dynatrace source of signal ingestion	`aws-log-ingest`

dt.da.source has the following list of well-known values. If one of them applies, then the respective value MUST be used, otherwise a custom value MAY be used.

Value	Description	Display name
`aws-log-ingest`	aws-log-ingest	AWS Log Ingest
`aws-metric-poller`	aws-metric-poller	AWS Metric Poller
`aws-metrics-ingest`	aws-metrics-ingest	AWS Metrics Ingest
`azure-smartscape-poller-full`	azure-smartscape-poller-full	Azure Smartscape Poller (full snapshot)
`azure-smartscape-poller-resource-changes`	azure-smartscape-poller-resource-changes	Azure Smartscape Poller (resource changes)
`generic-log-ingest/ands`	generic-log-ingest-ands	Azure Logs (ANDS integration)
`generic-log-ingest/pubsub`	generic-log-ingest-pubsub	GCP Logs (pub/sub integration)
`generic-log-ingest/s3`	generic-log-ingest-s3	AWS Logs (S3 integration)

Davis metadata

Some attributes are used in the context of the Davis engine.

Davis metadata fields

These fields can be set by Davis routines.

Attribute	Type	Description
`dt.davis.anomaly_detection.alert`	long	stable Display name: `Davis anomaly detection alert` Boolean time series of 0 and 1 showing whether a single timespan was alerted due to continuous violations.
`dt.davis.anomaly_detection.anomaly`	long	stable Display name: `Davis anomaly detection anomaly` Boolean timeseries of 0 and 1 showing whether a single timespan is outside the normal value range and therefore considered as abnormal.
`dt.davis.anomaly_detection.lower`	long	stable Display name: `Davis anomaly detection lower limit` The lower value range limit where any value below this point is considered abnormal.
`dt.davis.anomaly_detection.upper`	long	stable Display name: `Davis anomaly detection upper limit` The upper value range limit where any value above this point is considered abnormal.
`dt.davis.forecast.lower`	long	stable Display name: `Davis forecast lower bound` The lower bound of the prediction interval of a given metric forecast.
`dt.davis.forecast.point`	long	stable Display name: `Davis forecast point value` The point value of a metric forecast.
`dt.davis.forecast.upper`	long	stable Display name: `Davis forecast upper bound` The upper bound of the prediction interval of a given metric forecast.

Dynatrace endpoint detection

Dynatrace endpoint detection fields

Fields that can be expected on a Dynatrace span where endpoint detection was applied.

Attribute	Type	Description	Examples
`dt.endpoint_detection.rule_id`	uid	experimental Display name: `Endpoint detection rule ID` The ID of the endpoint detection rule that was applied to that span.	`4d76194c11a9426197a9062548f9e66e`

Dynatrace Entity ID

The Dynatrace OneAgent associates monitoring data with a so called Monitored Entity ID (ME ID). On OneAgent monitored environments, whenever ME IDs are accessible within the monitored system they should be used to enrich monitoring data to facilitate correlations with data primarily addressed through ME IDs coming from other channels.

The structure for keys that signify entity IDs is dt.entity.{type of entity}. The value associated with such a key must be valid Dynatrace entity identifier (see Monitored entities API).

To allow linking Entity IDs across various different monitoring artifacts (logs, metrics, etc.), all string representations of Entity IDs are required to follow a canonical form, which for all current entities is defined as PREFIX-0123456789ABCDEF.

Consumers should treat the token as an opaque value and must not infer any semantics on the ID itself. Producers need to match the Entity ID that is being returned by Dynatrace Entity API verbatim.

Producers of string representation must treat the string as if it was parsed case-sensitively, even though some parts of the product may be more lenient. The structure of the entity ID is currently as follows: <ID-NAMESPACE>-<16-digit-hex-string>. The <ID-NAMESPACE> is type specific but cannot be used to determine the actual entity type reliably, especially in cases of CUSTOM_DEVICE. The <16-digit-hex-string> needs to be zero-padded (prefix) to a length of 16 digits and must use upper case letters A-F.

Current entity IDs in cannonical form can be represented structurally with the following regular expression: [A-Z][A-Z_]*-[0-9A-F]{16}.

Additional characters or changes in the format may happen in the future but will not invalidate existing IDs or ID generation rules.

When adding a name to an entity ID via the Grail function entityName, by default, the name of the respective entity will be represented as dt.entity.{type of entity}.name. Similarly, further entity attributes can be added via the Grail function entityAttr, resulting in additional field(s) following the naming convention dt.entity.{type of entity}.{name of attribute}.

Fields enriched with signal data containing entity IDs that refer to classic entities are deprecated and will be removed in the future; use Smartscape IDs instead.

Dynatrace Entity ID fields

Attribute	Type	Description	Examples
`dt.entity.application`	string	resource deprecatedThis field is deprecated and will be removed in the future. Use `dt.smartscape.frontend` instead. Display name: `Application` The ME ID of a web application. Tags: `entity-id`	`APPLICATION-DC92E74A7A844E6E`
`dt.entity.aws_availability_zone`	string	resource deprecatedThis field is deprecated and will be removed in the future. Use `dt.smartscape.aws_availability_zone` instead. Display name: `AWS availability zone` An entity ID of an entity of type AWS_AVAILABILITY_ZONE Tags: `entity-id`	`AWS_AVAILABILITY_ZONE-6000A4E2BD2AB971`
`dt.entity.azure_region`	string	resource deprecatedThis field is deprecated and will be removed in the future. Use `dt.smartscape.microsoft_resources_locations` instead. Display name: `Azure region` An entity ID of an entity of type AZURE_REGION Tags: `entity-id`	`AZURE_REGION-0DD5C79E4034F0AA`
`dt.entity.azure_vm`	string	resource deprecatedThis field is deprecated and will be removed in the future. Use `dt.smartscape.microsoft_compute_virtualmachines` instead. Display name: `Azure vm` An entity ID of an entity of type AZURE_VM Tags: `entity-id`	`AZURE_VM-326478B733D6CFB0`
`dt.entity.cloud_application`	string	resource deprecatedThis field is deprecated and will be removed in the future. Use `dt.smartscape.k8s_deployment` instead. Display name: `Cloud application` An entity ID of an entity of type CLOUD_APPLICATION. Tags: `entity-id`	`CLOUD_APPLICATION-3AB5BBF3E09A7942`
`dt.entity.cloud_application_instance`	string	resource deprecatedThis field is deprecated and will be removed in the future. Use `dt.smartscape.k8s_pod` instead. Display name: `Cloud application instance` An entity ID of an entity of type CLOUD_APPLICATION_INSTANCE. Tags: `entity-id`	`CLOUD_APPLICATION_INSTANCE-E0D8F94D9065F24F`
`dt.entity.cloud_application_namespace`	string	resource deprecatedThis field is deprecated and will be removed in the future. Use `dt.smartscape.k8s_namespace` instead. Display name: `Cloud application namespace` An entity ID of an entity of type CLOUD_APPLICATION_NAMESPACE. A CLOUD_APPLICATION_NAMESPACE is a Kubernetes namespace. Tags: `entity-id`	`CLOUD_APPLICATION_NAMESPACE-C61324AA70F57BCB`
`dt.entity.container_group`	string	resource deprecatedThis field is deprecated and will be removed in the future. Note that there is no replacement for container groups in Smartscape. Display name: `Container group` An entity ID of an entity of type CONTAINER_GROUP. Tags: `entity-id`	`CONTAINER_GROUP-7C2B1C24FFB288CB`
`dt.entity.container_group_instance`	string	resource deprecatedThis field is deprecated and will be removed in the future. Use `dt.smartscape.container` instead. Display name: `Container group instance` An entity ID of an entity of type CONTAINER_GROUP_INSTANCE. Tags: `entity-id`	`CONTAINER_GROUP_INSTANCE-F4A1347110826781`
`dt.entity.custom_application`	string	resource deprecatedThis field is deprecated and will be removed in the future. Use `dt.smartscape.frontend` instead. Display name: `Custom application` The ME ID of a custom application. Tags: `entity-id`	`CUSTOM_APPLICATION-343A92501A51F286`
`dt.entity.custom_device`	string	resource deprecatedThis field is deprecated and will be removed in the future. Use `dt.smartscape.custom_<type>` or `dt.smartscape.ext_<type>` instead. Note that `<type>` represents the type of the custom device. Display name: `Custom device` An entity ID of an entity of type CUSTOM_DEVICE. Tags: `entity-id`	`CUSTOM_DEVICE-E0D8F94D9065F24F`
`dt.entity.device_application`	string	resource deprecatedThis field is deprecated and will be removed in the future. Use `dt.smartscape.frontend` instead. Display name: `Device application` The ME ID of a device application.	`DEVICE_APPLICATION-EA8A8751A60D5BCE8`
`dt.entity.disk`	string	resource deprecatedThis field is deprecated and will be removed in the future. Use `dt.smartscape.disk` instead. Display name: `Disk` An entity ID of an entity of type DISK Tags: `entity-id`	`DISK-5472CBC1ED0981D6`
`dt.entity.ec2_instance`	string	resource deprecatedThis field is deprecated and will be removed in the future. Use `dt.smartscape.aws_ec2_instance` instead. Display name: `EC2 instance` An entity ID of an entity of type EC2_INSTANCE Tags: `entity-id`	`EC2_INSTANCE-0004DD30F142D18C`
`dt.entity.external_synthetic_test`	string	resource deprecatedThis field is deprecated and will be removed in the future. Display name: `External synthetic test` An entity ID of an entity of type EXTERNAL_SYNTHETIC_TEST. Tags: `entity-id`	`EXTERNAL_SYNTHETIC_TEST-A140F3B85BCCBD1A`
`dt.entity.external_synthetic_test_step`	string	resource deprecatedThis field is deprecated and will be removed in the future. Display name: `External synthetic test step` An entity ID of an entity of type EXTERNAL_SYNTHETIC_TEST_STEP. Tags: `entity-id`	`EXTERNAL_SYNTHETIC_TEST_STEP-A140F3B85BCCBD1A`
`dt.entity.gcp_zone`	string	resource deprecatedThis field is deprecated and will be removed in the future. Use `dt.smartscape.gcp_zone` instead. Display name: `GCP zone` An entity ID of an entity of type GCP_ZONE Tags: `entity-id`	`GCP_ZONE-3699CB75E19C8505`
`dt.entity.host`	string	resource deprecatedThis field is deprecated and will be removed in the future. Use `dt.smartscape.host` instead. Display name: `Host` An entity ID of an entity of type HOST. Tags: `entity-id`	`HOST-E0D8F94D9065F24F`
`dt.entity.host_group`	string	resource deprecatedThis field is deprecated and will be removed in the future. Use `dt.host_group.id` instead. Note that `dt.host_group.id` represents the host group name, not the entity ID, as there is no entity of type HOST_GROUP in Smartscape. Display name: `Host group` An entity ID of an entity of type HOST_GROUP. Tags: `entity-id`	`HOST_GROUP-E7FBBCF7B1467174`
`dt.entity.http_check`	string	resource deprecatedThis field is deprecated and will be removed in the future. Use `dt.smartscape.http_monitor` instead. Display name: `HTTP check` An entity ID of an entity of type HTTP_CHECK. Tags: `entity-id`	`HTTP_CHECK-A140F3B85BCCBD1A`
`dt.entity.http_check_step`	string	resource deprecatedThis field is deprecated and will be removed in the future. Use `dt.smartscape.http_monitor_step` instead. Display name: `HTTP check step` An entity ID of an entity of type HTTP_CHECK_STEP. Tags: `entity-id`	`HTTP_CHECK_STEP-A140F3B85BCCBD1A`
`dt.entity.kubernetes_cluster`	string	resource deprecatedThis field is deprecated and will be removed in the future. Use `dt.smartscape.k8s_cluster` instead. Display name: `Kubernetes cluster` An entity ID of an entity of type KUBERNETES_CLUSTER. Tags: `entity-id`	`KUBERNETES_CLUSTER-E0D8F94D9065F24F`
`dt.entity.kubernetes_node`	string	resource deprecatedThis field is deprecated and will be removed in the future. Use `dt.smartscape.k8s_node` instead. Display name: `Kubernetes node` An entity ID of an entity of type KUBERNETES_NODE. Tags: `entity-id`	`KUBERNETES_NODE-874C66B68CE15070`
`dt.entity.kubernetes_service`	string	resource deprecatedThis field is deprecated and will be removed in the future. Use `dt.smartscape.k8s_service` instead. Display name: `Kubernetes service` An entity ID of an entity of type KUBERNETES_SERVICE. Tags: `entity-id`	`KUBERNETES_SERVICE-FE6E75BB9DF02347`
`dt.entity.mobile_application`	string	resource deprecatedThis field is deprecated and will be removed in the future. Use `dt.smartscape.frontend` instead. Display name: `Mobile application` The ME ID of a mobile application. Tags: `entity-id`	`MOBILE_APPLICATION-E8A8751A60D5BCE8`
`dt.entity.multiprotocol_monitor`	string	resource deprecatedThis field is deprecated and will be removed in the future. Use `dt.smartscape.network_availability_monitor` instead. Display name: `Multiprotocol monitor` An entity ID of an entity of type MULTIPROTOCOL_MONITOR. Tags: `entity-id`	`MULTIPROTOCOL_MONITOR-A140F3B85BCCBD1A`
`dt.entity.network_interface`	string	resource deprecatedThis field is deprecated and will be removed in the future. Use `dt.smartscape.network_interface` instead. Display name: `Network interface` An entity ID of an entity of type NETWORK_INTERFACE Tags: `entity-id`	`NETWORK_INTERFACE-FC7B4A5937FC125C`
`dt.entity.process_group`	string	resource deprecatedThis field is deprecated and will be removed in the future. Use `dt.process_group.id` or `dt.process_group.detected_name` instead. Note that there is no entity type PROCESS_GROUP in Smartscape, so `dt.process_group.id` exists only for compatibility. Preferably use `dt.process_group.detected_name` to identify process groups. Display name: `Process group` An entity ID of an entity of type PROCESS_GROUP. Tags: `entity-id`	`PROCESS_GROUP-E0D8F94D9065F24F`
`dt.entity.process_group_instance`	string	resource deprecatedThis field is deprecated and will be removed in the future. Use `dt.smartscape.process` instead. Display name: `Process group instance` An entity ID of an entity of type PROCESS_GROUP_INSTANCE. Tags: `entity-id`	`PROCESS_GROUP_INSTANCE-E0D8F94D9065F24F`
`dt.entity.service`	string	resource deprecatedThis field is deprecated and will be removed in the future. Use `dt.smartscape.service` instead. Display name: `Service` An entity ID of an entity of type SERVICE. Tags: `entity-id`	`SERVICE-57EC3CFC1FE72449`
`dt.entity.service_method`	string	resource deprecatedThis field is deprecated and will be removed in the future. Note that there is no replacement for service methods in Smartscape. Display name: `Service method` An entity ID of an entity of type SERVICE_METHOD. Tags: `entity-id`	`SERVICE_METHOD-659B35CA9AAC96C1`
`dt.entity.service_method_group`	string	resource deprecatedThis field is deprecated and will be removed in the future. Note that there is no replacement for service method groups in Smartscape. Display name: `Service method group` An entity ID of an entity of type SERVICE_METHOD_GROUP. Tags: `entity-id`	`SERVICE_METHOD_GROUP-02000E1DB1CDAF9F`
`dt.entity.software_component`	string	resource deprecatedThis field is deprecated and will be removed in the future. Display name: `Software component` An entity ID of an entity of type SOFTWARE_COMPONENT. Tags: `entity-id`	`SOFTWARE_COMPONENT-4700CB75E19C8506`
`dt.entity.synthetic_location`	string	resource deprecatedThis field is deprecated and will be removed in the future. Use `dt.smartscape.synthetic_location` instead. Display name: `Synthetic location` An entity ID of an entity of type SYNTHETIC_LOCATION. Tags: `entity-id`	`SYNTHETIC_LOCATION-D140F3B85BCCBD1A`
`dt.entity.synthetic_test`	string	resource deprecatedThis field is deprecated and will be removed in the future. Use `dt.smartscape.browser_monitor` instead. Display name: `Synthetic test` An entity ID of an entity of type SYNTHETIC_TEST. Tags: `entity-id`	`SYNTHETIC_TEST-A140F3B85BCCBD1A`
`dt.entity.synthetic_test_step`	string	resource deprecatedThis field is deprecated and will be removed in the future. Use `dt.smartscape.browser_monitor_step` instead. Display name: `Synthetic test step` An entity ID of an entity of type SYNTHETIC_TEST_STEP. Tags: `entity-id`	`SYNTHETIC_TEST_STEP-A140F3B85BCCBD1A`

Dynatrace Extensions

Dynatrace Extensions fields

Additional extension information sent via self-monitoring.

Attribute	Type	Description	Examples
`dt.extension.config.id`	string	resource experimental Display name: `Extension configuration ID` Extension's monitoring configuration identifier.	`vu9U3hXa3q0AAAABAAtleHQ6ZXh0LTA0MAAIYWdfZ3JvdXAAA0FHMQAkMjY2YTIyM2YtZDgxYi0zNTNjLThlYzctYzk2YzliZjg4OGQ3vu9U3hXa3q0`
`dt.extension.controller.pod.uid`	string	resource experimental Display name: `Extension controller pod UID` Extension controller pod UID. ¹	`87654321-4321-4321-4321-cba987654321`
`dt.extension.ds`	string	resource experimental Display name: `Extension data source` Name of the data source.	`SNMPTrap`
`dt.extension.endpoint`	string	resource experimental Display name: `Extensions framework endpoint` Extensions framework endpoint (normalized route).	`/mint`; `/logs`; `/otlp/metrics`
`dt.extension.endpoint.hints`	string[]	resource experimental Display name: `Extension endpoint hints` Hints to provide for the cluster in order to find proper endpoint in task registry.	`['nat-test.lab.dynatrace.org', '1521', 'orc']`
`dt.extension.executor.pod.uid`	string	resource experimental Display name: `Extension executor pod UID` Extension executor pod UID. ²	`12345678-1234-1234-1234-123456789abc`
`dt.extension.name`	string	resource experimental Display name: `Extension name` Name of the extension.	`com.snmptrap.generic`
`dt.extension.python_version`	string	resource experimental Display name: `Extension Python version` Version of the Python runtime version used by extension.	`3.14`
`dt.extension.status`	string	resource experimental Display name: `Extension status` The status of the component reporting a self-monitoring event.	`AUTHENTICATION_ERROR`
`dt.extension.version`	string	resource experimental Display name: `Extension version` Version of the extension.	`0.0.1`

This attribute is only set when the extension is running in a Kubernetes environment.

dt.extension.status has the following list of well-known values. If one of them applies, then the respective value MUST be used, otherwise a custom value MAY be used.

Value	Description	Display name
`AUTHENTICATION_ERROR`	Unable to connect to EEC	Authentication Error
`DEVICE_CONNECTION_ERROR`	Failed to establish connection with the device	Device Connection Error
`EEC_CONNECTION_ERROR`	Unable to connect to EEC	EEC Connection Error
`GENERIC_ERROR`	Generic status used to communicate job failed	Generic Error
`INVALID_ARGS_ERROR`	Invalid arguments	Invalid Arguments
`INVALID_CONFIG_ERROR`	Config provided by EEC is invalid	Invalid Config
`OK`	Extension works fine	OK
`UNKNOWN_ERROR`	Uninitialized/unknown error	Unknown Error

Dynatrace ingest

Attributes defined in this namespace are used by Dynatrace to describe different aspects of the ingested data.

Dynatrace ingest fields

Attribute	Type	Description	Examples
`dt.ingest.debug_messages`	string[]	experimental Display name: `Ingest debug messages` An array of strings that represent debug messages that provide a detailed debugging information. That could include even variable parts, like which attribute was modified, or which processing rules were applied.	`['MyATTribute mapped to myAttribute']`
`dt.ingest.format`	string	experimental Display name: `Ingest format` The format of the data ingested in Dynatrace via the various ingest channels. E.g., Generic log ingest, OTLP logs ingest	`dtapi/json`; `otlp/protobuf`
`dt.ingest.origin`	string	experimental Display name: `Ingest origin` Origin of the data ingested in Dynatrace.	`splunk`; `cribl`
`dt.ingest.size`	long	stable Display name: `Ingest size` The size of the ingested data point in bytes.	`2005`
`dt.ingest.warnings`	string[]	experimental Display name: `Ingest warnings` An array of strings representing markers of unexpected situations that might affect the correctness or completeness of incoming data points. It might be, for instance, limits applied or a processing rule failing. It should not be a detailed log of what happened, just the high-level class of the issue that occurred.	`['attr_count_trimmed', 'content_trimmed']`

dt.ingest.format MUST be one of the following:

Value	Description	Display name
`dtapi/json`	JSON data ingested via the Dynatrace APIs or via EEC (Extension Execution Controller)	DT API JSON
`dtapi/plaintext`	(deprecated: use "plaintext") Plain text data ingested via the Dynatrace API	DT API Plaintext
`journald`	Journald data ingested via OneAgent	Journald
`otlp/json`	OpenTelemetry Protocol (OTLP) JSON data ingested via the Dynatrace APIs	OTLP JSON
`otlp/protobuf`	OpenTelemetry Protocol (OTLP) Protobuf data ingested via the Dynatrace APIs or via EEC (Extension Execution Controller)	OTLP Protobuf
`plaintext`	Plain text data ingested via the Dynatrace APIs, EEC (Extension Execution Controller) or OneAgent	Plaintext
`syslog`	Syslog data ingested via OneAgent or via EEC (Extension Execution Controller)	Syslog
`unknown`	The data format was not recognized (only for metrics dimension)	Unknown
`windowseventlog`	Windows event log data ingested via OneAgent	Windows Event Log

dt.ingest.warnings MUST contain only values from the following list:

Value	Description
`content_trimmed`	The content was trimmed, right after receiving it by Cluster/ActiveGate, because it exceeded the event content max byte size limit.
`content_trimmed_pipe`	The content was trimmed in post-processing (after applying processing rules) because it exceeded the event content max byte size limit
`attr_count_trimmed`	The number of attributes was trimmed, right after receiving it by Cluster/ActiveGate, because it exceeded the max number of attributes limit.
`attr_count_trimmed_pipe`	The number of attributes was trimmed in post-processing (after applying processing rules) because it exceeded the max number of attributes limit.
`attr_key_case_mismatch`	The attribute key is detected that matches the custom attribute key or the semantic attribute key, but there is the attribute key case mismatch.
`attr_key_trimmed`	The attribute key was trimmed, right after receiving it by Cluster/ActiveGate, because it exceeded the max key length limit.
`attr_val_count_trimmed`	At least one multi-value attribute had values number trimmed, right after receiving it by Cluster/ActiveGate, because it exceeded the max number of attributes limit.
`attr_val_count_trimmed_pipe`	After applying processing rules, at least one multi-value attribute had its values number trimmed (after using processing rules) because it exceeded the maximum number of attributes limit.
`attr_val_size_trimmed`	At least one attribute had its value size trimmed, right after receiving it by Cluster/ActiveGate, because it exceeded the max value size in bytes limit.
`attr_val_size_trimmed_pipe`	At least one attribute had its value size trimmed (after applying processing rules) because it exceeded the max value size in bytes limit.
`timestamp_corrected`	Timestamp was too far in the future and was corrected to current time.
`common_attr_corrected`	STATUS, LOG_LEVEL or EVENT_TYPE attribute was corrected.
`processing_batch_timeout`	Batch timeout occurred during processing pipeline.
`processing_transformer_timeout`	Execution timeout in one of processing transformers occurred during processing pipeline.
`processing_transformer_error`	Execution error in one of processing transformers occurred during processing pipeline.
`processing_transformer_throttled`	Execution throttled in one of processing transformers during processing pipeline.
`processing_output_record_conversion_error`	Output conversion error occurred for some record during processing pipeline.
`processing_prepare_input_error`	Prepare input error occurred in one of enabled processing pipeline rules.

Dynatrace

Dynatrace resource fields

Attribute	Type	Description	Examples
`dt.cost.costcenter`	string	resource stable Display name: `Cost center` Can be used to assign usage to a Cost Center.	`Team A`
`dt.cost.product`	string	resource stable Display name: `Cost product` Can be used to assign usage to a Product or Application ID.	`Product A`
`dt.host_group.id`	string	resource stable Display name: `Host group ID` See Organize your environment using host groups. Note that host groups are identified by their name, not by the entity ID of the host group entity. For details on the entity ID, see `dt.entity.host_group`. Tags: `permission` `primary-field`	`myHostGroup`
`dt.metrics.source`	string	resource experimental Display name: `Metrics source` The source from which metrics are ingested. ¹	`telegraf`; `com.dynatrace.extension.sql-oracle`
`dt.network_zone.id`	string	resource experimental Display name: `Network zone ID` The ID of the network zone. See Dynatrace Documentation	`vpc-123`
`dt.openpipeline.forwarding.config_id`	string	resource experimental Display name: `OpenPipeline forwarding config ID` ID of the forwarding configuration in OpenPipeline.	`v00zu89AAABADJidWlsdGluOmh5cGVyc2NhbGVyLWF1dGhlbnRpY2F0aW9uLmNvpb25zLmF3cwAGdGVuYW50AGZ7ZW5hbnQAJDNlOTM1YmE3LTkzODUtMzczZS1hMWJiLW9uioQwNDFmNzIyMb7vVN4V2t6t`
`dt.openpipeline.forwarding.datatype`	string	resource experimental Display name: `OpenPipeline forwarding datatype` Forwarded datatype	`Logs`
`dt.pg_detection.cluster.id`	string	resource experimental Display name: `Process group detection cluster ID` `DT_CLUSTER_ID` environment variable; also see Process group detection
`dt.pg_detection.custom_entry`	string	resource experimental Display name: `Process group detection custom entry` also see Define metadata via environment variables
`dt.pg_detection.declarative.id`	string	resource experimental Display name: `Process group detection declarative ID`
`dt.pg_detection.environment.id`	string	resource experimental Display name: `Process group detection environment ID` `DT_ENVIRONMENT_ID` environment variable
`dt.pg_detection.node.id`	string	resource experimental Display name: `Process group detection node ID` `DT_NODE_ID` environment variable; also see Process group detection
`dt.process_group.detected_name`	string	resource stable Display name: `Process group name` The name of the process group as it was detect by the agent.	`Apache Web Server httpd`; `Redis unguard-redis-* redis`; `Linux System`
`dt.process_group.id`	string	resource stable Display name: `Process group ID` The identifier shared by all entities belonging to a given process group.	`PROCESS_GROUP-1234`
`dt.security_context`	string	resource stable Display name: `DT security context` The security context is used in access permissions to limit the visibility. Learn more about the Dynatrace permission model Tags: `permission`
`dt.smartscape_source.id`	smartscapeId	resource stable Display name: `Smartscape source ID` The ID of the entity considered the source of the signal. The string represents an entity ID of an entity that is stored in the Smartscape storage. ² Tags: `smartscape-id`	`K8S_CLUSTER-E0D8F94D9065F24F`; `AWS_LAMBDA_FUNCTION-E0D8F94D9065F24F`
`dt.smartscape_source.type`	string	resource stable The entity type of the entity whose identifier is held in dt.smartscape_source.id. Automatically set to match the type of the entity referenced in dt.smartscape_source.id.	`K8S_CLUSTER`; `AWS_LAMBDA_FUNCTION`
`dt.source_entity`	string	resource deprecatedThis field is deprecated and will be removed in the future. Use `dt.smartscape_source.id` instead. Display name: `Source entity` The ID of the entity considered the source of the signal. The string represents an entity ID of an entity that is stored in the classic entity storage. ³ Tags: `entity-id`	`HOST-E0D8F94D9065F24F`; `PROCESS_GROUP_INSTANCE-E0D8F94D9065F24F`
`dt.source_entity.type`	string	resource deprecatedThis field is deprecated and will be removed in the future. Use `dt.smartscape_source.type` instead. Display name: `Source entity type` The entity type of the entity whose identifier is held in dt.source_entity. The value must be a valid entity type and consistent with `dt.source_entity`. Note, however, that the type identifiers are expected to be lowercased in alignment with suffixes of dt.entity.* keys.	`host`; `process_group_instance`; `cloud:azure:resource_group`
`dt.space`	string	resource experimental Display name: `Space` The space associated with the record. Spaces enable granular scoping and delegation of monitoring responsibilities. Tags: `permission` `primary-field`

This is the framework used for capturing, processing and forwarding metrics, not the emitting monitored entity. Exemplary custom value: name of an extension sending metrics.

The value of this field will be based on the value of one of the dt.smartscape.<type> fields. That means that the dt.smartscape_source.id and dt.smartscape.<type> fields will both be set to the same ID.

The value of this field will be based on the value of one of the dt.entity.<type> fields. This means that the dt.source_entity and dt.entity.<type> fields will both be set to the same ID.

dt.metrics.source has the following list of well-known values. If one of them applies, then the respective value MUST be used, otherwise a custom value MAY be used.

Value	Description	Display name
`dynatrace_codemodule`	dynatrace_codemodule	Dynatrace Code Module
`dynatrace_ingest`	dynatrace_ingest	Dynatrace Ingest
`dynatrace_osagent`	OsAgent	Dynatrace OS Agent
`k8s_monitoring`	k8s_monitoring	Kubernetes Platform Monitoring
`k8s_prometheus`	k8s_prometheus	Kubernetes Prometheus
`micrometer`	Micrometer	Micrometer
`oneagent_metric_api`	OneAgentMetricAPI	OneAgent Metric API
`opentelemetry`	OpenTelemetry	OpenTelemetry
`statsd`	StatsD	StatsD
`telegraf`	Telegraf	Telegraf

Dynatrace fields

Attribute	Type	Description	Examples
`dt.container.uid`	long	experimental A stable identifier for a container that survives container restarts and crash loops. A new ID is only assigned when the underlying scheduling unit is replaced—such as when a Kubernetes Pod is recreated (for example, after a pod eviction or an image change). Used in Container Application Monitoring to count distinct billable units.	`5765169529530274912`
`dt.has_container_application_monitoring`	boolean	experimental Display name: `Dynatrace has container application monitoring` Indicates that the underlying container of the data point should be considered in Container Application Monitoring license. Set to `true` for the opt-in of Container Application Monitoring. Setting to `false` is not supported by the backend and has no effect.	`true`; `false`
`dt.maintenance_window_ids`	array	experimental Display name: `Dynatrace maintenance window ids` UUIDs of maintenance windows.	`c715d677-eb1b-3e1b-8dbc-db06cad5b8eb`
`dt.query`	string	experimental Display name: `Dynatrace query` A query in the DQL format, see Dynatrace Query Langauge.	`timeseries avg(dt.host.cpu.idle)`; `fetch logs`
`dt.raw_data`	string	experimental Display name: `Dynatrace raw data` The complete content of the record as it was originally accepted by Dynatrace, stored as a string in JSON format. This field captures the unaltered data for reference, debugging, or auditing purposes	`{"content": "example record content"}`

Dynatrace OpenPipeline

Fields defined in this namespace are used by Dynatrace to describe various aspects of the data ingested through OpenPipeline, providing detailed insights into the ingestion process.

Dynatrace OpenPipeline fields

Attribute	Type	Description	Examples
`dt.openpipeline.pipelines`	string[]	resource experimental Display name: `OpenPipeline pipelines` Collects the identifiers of all pipelines through which a record has passed during the ingestion process in OpenPipeline, providing a complete trace of its journey.	`['logs:default']`; `['logs:pipeline_haproxy_2656', 'bizevents:default']`
`dt.openpipeline.source`	string	resource experimental Display name: `OpenPipeline ingest source` Identifies the source (such as API endpoints or OneAgent) used for ingesting the record into OpenPipeline.	`/platform/ingest/v1/events`; `oneagent`
`dt.openpipeline.source_type`	string	resource experimental Display name: `OpenPipeline source type` Identifies the source type used to ingest data in Dynatrace, for example, from OTLP and OneAgent.	`otlp`; `oneagent`

dt.openpipeline.source_type MUST be one of the following:

Value	Description	Display name
`api`	Logs ingested via one of the ActiveGate APIs	API
`aws_firehose`	Logs ingested via Amazon Data Firehose	AWS Firehose
`extension`	Logs ingested via the EEC running on host	Extension
`oneagent`	Logs ingested via OneAgent	OneAgent
`otlp`	Logs ingested via the OpenTelemetry Protocol (OTLP)	OTLP
`unknown`	The source type was not recognized (only for metrics dimension)	Unknown

Dynatrace OS service

Dynatrace OS service fields

Attribute	Type	Description	Examples
`dt.osservice.alerting`	boolean	deprecatedAvailable only for 2nd gen clusters. Replaced with `os_service.alerting`. Boolean attribute deciding whether the service status triggers alerts or not.
`dt.osservice.status`	string	deprecatedAvailable only for 2nd gen clusters. Replaced with `os_service.status`. Current running state.	`activating`

dt.osservice.status MUST be one of the following:

Value	Description	Display name
`activating`	Service is activating.	Activating
`active`	Service is active.	Active
`continue_pending`	Service continues pending.	Continue Pending
`deactivating`	Service is deactivating.	Deactivating
`failed`	Service failed to start.	Failed
`inactive`	Service is inactive.	Inactive
`pause_pending`	Service paused pending.	Pause Pending
`paused`	Service is currently paused.	Paused
`reloading`	Service is reloading.	Reloading
`running`	Service is currently running.	Running
`start_pending`	Service started pending.	Start Pending
`stop_pending`	Service stopped pending.	Stop Pending
`stopped`	Service is currently stopped.	Stopped

Dynatrace OS service resource fields

Attribute	Type	Description	Examples
`dt.osservice.display_name`	string	resource deprecatedAvailable only for 2nd gen clusters. Replaced with `os_service.display_name`. On Linux based systems this value ought to be the same as in the name attribute. On Windows it will be a prettier version of the name attribute.	`My OS Service`
`dt.osservice.manufacturer`	string	resource deprecatedAvailable only for 2nd gen clusters. Replaced with `os_service.manufacturer`. Manufacturer of the service. On Linux based systems, the value will always be `-`, meaning empty.	`-`; `SSH Corp.`
`dt.osservice.name`	string	resource deprecatedAvailable only for 2nd gen clusters. Replaced with `os_service.name`. Unique OS service name.	`myosservice`
`dt.osservice.path`	string	resource deprecatedAvailable only for 2nd gen clusters. Replaced with `os_service.path`. The full path to the process executable. On Linux based systems, this can be set to the target of `proc/[pid]/exe`. On Windows, it can be set to the result of `GetProcessImageFileNameW`.	`/usr/bin/cmd/otelcol`
`dt.osservice.startup_type`	string	resource deprecatedAvailable only for 2nd gen clusters. Replaced with `os_service.startup_type`. Current startup type.	`auto`

dt.osservice.startup_type MUST be one of the following:

Value	Description	Display name
`auto`	Windows specific. Automatic: The service starts at system logon.	Auto
`auto_delay`	Windows specific. Automatic (Delayed Start): The service starts a short while after the system has finished starting up.	Auto Delay
`auto_delay_trigger`	Windows specific. Automatic (Delayed Start, Trigger Start)	Auto Delay Trigger
`auto_trigger`	Windows specific. Automatic (Trigger Start): This service will start automatically at boot.	Auto Trigger
`disabled`	Linux specific. Service is configured to not start when the system boots, but can be started manually, or as a dependency of another service.	Disabled
`enabled`	Linux specific. Service is marked for starting up on boot.	Enabled
`enabled-runtime`	Linux specific. Service is marked for starting up on boot.	Enabled Runtime
`indirect`	Linux specific. Service is not enabled directly but can be activated via dependencies or aliases.
`linked`	Linux specific. Service unit file is symlinked into systemd from an external location persistently.
`linked-runtime`	Linux specific. Service unit file is temporarily symlinked into systemd for the current runtime only.
`manual`	Windows specific. Manual: The service starts only when explicitly summoned.	Manual
`manual_trigger`	Windows specific. Manual (Trigger Start): This service will not start automatically at boot.	Manual Trigger
`static`	Linux specific. Service is not enabled and can only start when pulled in by dependencies or started manually.	Static

Dynatrace RUM

The dt.rum namespace contains Dynatrace RUM specific fields.

Dynatrace RUM fields

Attribute	Type	Description	Examples
`dt.rum.application.entity`	string	experimental Display name: `Frontend application` An entity ID of an entity of type APPLICATION or MOBILE_APPLICATION. Tags: `entity-id`	`APPLICATION-DC92E74A7A844E6E`; `MOBILE_APPLICATION-E8A8751A60D5BCE8`
`dt.rum.application.id`	string	deprecatedReplaced with `dt.rum.instrumentation.id`. Display name: `Frontend application ID` The RUM Classic application ID. For mobile applications, a UUID is used. For web applications, an 8-byte HEX string is used.	`ea7c4b59f27d43eb`; `89b1a1e7-fe89-4151-81e9-410fa0235f0d`
`dt.rum.browser.session_id`	string	experimental Display name: `Browser session ID` A browser session identifier set and read by Dynatrace RUM. Used to correlate RUM Classic user actions with PurePaths during ingest.	`4D3133F359A76AB05AAF39691696858A`
`dt.rum.instrumentation.id`	string	experimental The Dynatrace RUM frontend instrumentation ID. For mobile applications, a UUID is used. For web applications, an 8-byte HEX string is used.	`ea7c4b59f27d43eb`; `89b1a1e7-fe89-4151-81e9-410fa0235f0d`
`dt.rum.instrumentation.rum.enabled`	boolean	experimental Indicates whether Dynatrace RUM instrumentation is enabled for the frontend on Grail.	`true`; `false`
`dt.rum.is_linking_candidate`	boolean	experimental Display name: `Is linking candidate` If set to 'true', it indicates that Dynatrace RUM captured a user event that can be linked to this trace.	`true`
`dt.rum.session.id`	string	stable Display name: `User session ID` A unique identifier for a user session. Use this field to join user events with user sessions in DQL queries.	`HOPCPWKILUKHFHWRRQGBHHPAFLUJUOSH-0`; `23626166142035610_1-0`
`rum_link`	record	deprecatedReplaced with `frontend.link`. Display name: `RUM link` A RUM link provides backend to frontend linking information from traces to Dynatrace RUM. Unlike span links which reference other spans, the RUM link connects a span to a user event and/or user session.

Dynatrace RUM resource fields

Attribute	Type	Description	Examples
`dt.rum.agent.type`	string	resource experimental Display name: `RUM agent type` The Dynatrace RUM agent type.	`android`
`dt.rum.agent.version`	string	resource experimental Display name: `RUM agent version` The version of the Dynatrace RUM agent. It is provided in the format major.minor.patch.build. The build number is optional.	`8.263.1`; `9.293.2.1`; `1.313.0.20250402-172634`
`dt.rum.event.source.type`	string	resource experimental Display name: `RUM event source type` The Dynatrace RUM source technology that produced this event. Only used by cross-platform implementations, otherwise the field is omitted.	`flutter`
`dt.rum.instance.id`	string	resource stable Display name: `RUM instance ID` A persistent pseudonymous identifier representing the same device (browser user agent or mobile app installation) across multiple user sessions. Used to analyze returning users and long-term journeys. Formerly known as "Visitor ID" or "internal user ID." For information on the real user identity, see `user.identifier`.	`3735928559`; `1742973444821E7E6Q3E3SG28ATQPAGTT6T8HU92VFRFQ`
`dt.rum.schema_version`	string	resource stable Display name: `RUM schema version` The Dynatrace RUM enrichment version.	`0.1`
`dt.rum.user_type`	string	resource experimental Display name: `User type` The RUM user type.	`real_user`

dt.rum.agent.type MUST be one of the following:

Value	Description	Display name
`android`	OneAgent for Android	Android
`ios`	OneAgent for iOS	iOS
`javascript`	RUM JavaScript	JavaScript

dt.rum.event.source.type MUST be one of the following:

Value	Description	Display name
`flutter`	Flutter	Flutter
`react_native`	React Native auto-instrumentation	React Native

dt.rum.user_type MUST be one of the following:

Value	Description	Display name
`real_user`	The user event was produced by a real user.	Real User
`robot`	The user event was produced by a bot user.	Robot
`synthetic`	The user event was produced by a synthetic test.	Synthetic

Invalid fields

The dt.rum.invalid namespace is used for fields that are removed because of user event ingest validation. For example, if the calculated web_vitals.largest_contentful_paint value would be less than 0, the value is copied over to dt.rum.invalid.web_vitals.largest_contentful_paint and web_vitals.largest_contentful_paint is removed.

Dynatrace service

Dynatrace service fields

Attribute	Type	Description	Examples
`dt.service.name`	string	resource stable Display name: `Service name` The Dynatrace service name derived from service detection rules. It is equal to the Smartscape service node name.	`OrderProcessingService`; `payment-api`
`dt.service.sdv1_type`	string	resource stable Display name: `SDv1 service type` The SDv1 service type. This field is available only if `dt.service_detection.version` is `1`.	`BACKGROUND_ACTIVITY`; `CUSTOM_SERVICE`; `RMI_SERVICE`; `RPC_SERVICE`; `SPAN`; `WEB_REQUEST_SERVICE`; `WEB_SERVICE`

dt.service.sdv1_type MUST be one of the following:

Value	Description
`BACKGROUND_ACTIVITY`	Background activity (process) service
`CICS_INTERACTION_SERVICE`	IBM CICS interaction service
`CICS_SERVICE`	IBM CICS service
`CUSTOM_APPLICATION`	Custom application service
`CUSTOM_SERVICE`	Custom (method-based) service
`DATABASE_SERVICE`	Database service
`ENTERPRISE_SERVICE_BUS_SERVICE`	Enterprise service bus (ESB) service
`IMS_INTERACTION_SERVICE`	IBM IMS interaction service
`IMS_SERVICE`	IBM IMS service
`MESSAGING_SERVICE`	Messaging service
`MOBILE_SERVICE`	Mobile service
`QUEUE_LISTENER_SERVICE`	Queue listener service
`RMI_SERVICE`	Java RMI service
`RPC_SERVICE`	Remote procedure call service
`SAAS_VENDOR`	SaaS vendor service
`SPAN`	Span-based service
`UNKNOWN`	Unknown service type
`WEBSITE`	Website
`WEB_REQUEST_SERVICE`	Web request service
`WEB_SERVICE`	Web service endpoint
`ZOS_CONNECT`	z/OS Connect service

Dynatrace service detection

Dynatrace service detection fields

Attribute	Type	Description	Examples
`dt.service_detection.version`	long	resource stable Display name: `Service detection version` The version of the service detection mechanism used to identify the service. Either `1` for Service Detection Version 1 (SDv1) or `2` for Service Detection Version 2 (SDv2).	`1`; `2`

Dynatrace settings

Fields for referencing Settings 2.0 objects, schemas and scopes.

Considerations on which fields to use

Although the dt.settings.object_id is enough to identify a specific settings value within a dynatrace environment, adding explicit information about the schema, scope and/or scope type can be useful nonetheless. If your use-case will only ever involve a single schema, scope type and/or scope, documenting this is good enough - if multiple schemas, scope types and/or scopes can be involved, filling the corresponding fields is strongly recommended.

dt.settings.references can be used if multiple settings objects need to be referenced. In that case, each entry in the array can hold a reference to a single settings object.

Dynatrace settings fields

The top level fields contain generally relevant information for all monitoring data.

Attribute	Type	Description	Examples
`dt.settings.object_id`	string	experimental Display name: `Settings object ID` The object ID of a settings value. This corresponds to the 'objectId' field/parameter in the Settings API.	`vu9U3hXa3q0AAAABACFidWlsdGluOnJ1bS51c2VyLWV4cGVyaWVuY2Utc2NvcmUABnRlbmFudAAGdGVuYW50ACRhMzZmYmYwMy00NDY1LTNlNTYtOTZiOS1kOWMzOGQ3MzU1NmO-71TeFdrerQ`
`dt.settings.object_summary`	string	experimental Display name: `Settings object summary` The human-readable summary or name of a single value of a multi-value settings schema. This corresponds to the 'summary' field in the Settings API.	`Journey Service all errors`; `Really, this can be anything`; `My alerting rule`
`dt.settings.references`	record[]	experimental Display name: `Settings references` A collection of references to settings objects. Each entry in the array holds a reference to a single settings object.	`[{'dt.settings.object_id': 'vu9U3hXa3q0AAAABACFidWlsdGluOnJ1bS51c2VyLWV4cGVyaWVuY2Utc2NvcmUABnRlbmFudAAGdGVuYW50ACRhMzZmYmYwMy00NDY1LTNlNTYtOTZiOS1kOWMzOGQ3MzU1NmO-71TeFdrerQ', 'dt.settings.relationship': 'matched_rule'}, {'dt.settings.object_id': 'vu9U3hXa3q0AAAABAB9idWlsdGluOmRhdmlzLmFub21hbHktZGV0ZWN0b3JzAAZ0ZW5hbnQABnRlbmFudAAkMzM2NTc3MTgtYWNjYi0zOGY1LTlmOGUtMTg5NTBiYmNjNmRhvu9U3hXa3q0', 'dt.settings.relationship': 'triggered_alert'}]`
`dt.settings.relationship`	string	experimental Display name: `Settings relationship` The type of relationship to the referenced settings object. You can use arbitrary values (in `snake_case`) here that describe the relationship for your use-case.	`matched_rule`; `triggered_alert`
`dt.settings.schema_id`	string	experimental Display name: `Settings schema ID` The schema ID of a settings schema, as used in the Settings APIs.	`builtin:problem.notifications`; `app:dynatrace.jenkins:connection`
`dt.settings.schema_version`	string	experimental Display name: `Settings schema version` The version of the schema referenced by dt.settings.schema_id, as declared by the schema itself. Typically a semantic version number.	`1.0.0`; `1.2.3`
`dt.settings.scope_id`	string	experimental Display name: `Settings scope ID` The ID of the scope that a settings object is persisted on. This corresponds to the 'scope' field/parameter in the Settings API.	`environment`; `HOST-EFAB6D2FE7274823`
`dt.settings.scope_name`	string	experimental Display name: `Settings scope name` The human-readable name of the scope that a settings object is persisted on.	`deb-10-k3s-oi-01.lab.dynatrace.org`
`dt.settings.scope_type`	string	experimental Display name: `Settings scope type` The type of the scope that a settings object is persisted on.	`environment`; `host_group`; `host`

Smartscape ID

This namespace contains all field names that contain entitiy IDs that are stored in Smartscape on Grail. To ensure we can distinguish between classic entity IDs and Smartscape IDs, we use the dt.smartscape.* namespace to enrich entity IDs in signal data.

Smartscape ID resource fields

Attribute	Type	Description	Examples
`dt.smartscape.__type__`	smartscapeId	resource stable Display name: `Smartscape ID` A Smartscape ID that can be used to query entities from the Smartscape storage. `__type__` is a placeholder for any Smartscape type. Tags: `smartscape-id`	`K8S_CLUSTER-E0D8F94D9065F24F`
`dt.smartscape.activegate`	smartscapeId	resource experimental Display name: `ActiveGate ID` Smartscape ID referencing an ActiveGate installation entity. Tags: `smartscape-id`	`ACTIVEGATE-0000000003B41C6E`
`dt.smartscape.aws_account`	smartscapeId	resource stable Display name: `AWS account ID` Smartscape ID referencing an AWS account entity. Tags: `smartscape-id`	`AWS_ACCOUNT-5566FFEE77889900`
`dt.smartscape.aws_availability_zone`	smartscapeId	resource stable Display name: `AWS availability zone ID` Smartscape ID referencing an AWS Availability Zone. Tags: `smartscape-id`	`AWS_AVAILABILITY_ZONE-6677001122334455`
`dt.smartscape.aws_ec2_eip`	smartscapeId	resource stable Display name: `AWS elastic IP ID` Smartscape ID referencing an AWS Elastic IP. Tags: `smartscape-id`	`AWS_EC2_EIP-7788112233445566`
`dt.smartscape.aws_ec2_instance`	smartscapeId	resource stable Display name: `AWS EC2 instance ID` Smartscape ID referencing an AWS EC2 instance. Tags: `smartscape-id`	`AWS_EC2_INSTANCE-8899223344556677`
`dt.smartscape.aws_ec2_networkinterface`	smartscapeId	resource stable Display name: `AWS EC2 network interface ID` Smartscape ID referencing an EC2 network interface. Tags: `smartscape-id`	`AWS_EC2_NETWORKINTERFACE-99AA334455667788`
`dt.smartscape.aws_ec2_securitygroup`	smartscapeId	resource stable Display name: `AWS EC2 security group ID` Smartscape ID referencing an EC2 Security Group. Tags: `smartscape-id`	`AWS_EC2_SECURITYGROUP-AABB334455667788`
`dt.smartscape.aws_lambda_alias`	smartscapeId	resource stable Display name: `AWS Lambda alias ID` Smartscape ID referencing an AWS Lambda alias. Tags: `smartscape-id`	`AWS_LAMBDA_ALIAS-BBCC334455667799`
`dt.smartscape.aws_lambda_function`	smartscapeId	resource stable Display name: `AWS Lambda function ID` Smartscape ID referencing an AWS Lambda function. Tags: `smartscape-id`	`AWS_LAMBDA_FUNCTION-DDEEFF2233445566`
`dt.smartscape.aws_rds_dbcluster`	smartscapeId	resource stable Display name: `AWS RDS database cluster ID` Smartscape ID referencing an AWS RDS DB cluster. Tags: `smartscape-id`	`AWS_RDS_DB_CLUSTER-EEFF334455667788`
`dt.smartscape.aws_rds_dbclustersnapshot`	smartscapeId	resource stable Display name: `AWS RDS database cluster snapshot ID` Smartscape ID referencing an RDS DB cluster snapshot. Tags: `smartscape-id`	`AWS_RDS_DB_CLUSTER_SNAPSHOT-FF00112233445566`
`dt.smartscape.aws_rds_dbinstance`	smartscapeId	resource stable Display name: `AWS RDS database instance ID` Smartscape ID referencing an RDS DB instance. Tags: `smartscape-id`	`AWS_RDS_DB_INSTANCE-0011FF2233445566`
`dt.smartscape.aws_rds_dbsnapshot`	smartscapeId	resource stable Display name: `AWS RDS database snapshot ID` Smartscape ID referencing an RDS DB snapshot. Tags: `smartscape-id`	`AWS_RDS_DB_SNAPSHOT-2233FF4455667788`
`dt.smartscape.aws_rds_dbsubnetgroup`	smartscapeId	resource stable Display name: `AWS RDS database subnet group ID` Smartscape ID referencing an RDS subnet group. Tags: `smartscape-id`	`AWS_RDS_DB_SUBNET_GROUP-3344FF5566778899`
`dt.smartscape.aws_region`	smartscapeId	resource stable Display name: `AWS region ID` Smartscape ID referencing an AWS region entity. Tags: `smartscape-id`	`AWS_REGION-4455FF66778899AA`
`dt.smartscape.azure_microsoft_web_sites_functionapp`	smartscapeId	resource stable Display name: `Azure function app ID` Smartscape ID referencing an Azure Function App. Tags: `smartscape-id`	`AZURE_MICROSOFT_WEB_SITES_FUNCTIONAPP-8899DD00BBCCDDEE`
`dt.smartscape.biz_flow`	smartscapeId	resource stable Display name: `Business flow ID` Smartscape ID referencing a Business Analytics / BizFlow entity. Tags: `smartscape-id`	`BIZFLOW-AABBCCDDEEFF0011`
`dt.smartscape.browser_monitor`	smartscapeId	resource stable Display name: `Browser monitor ID` Smartscape ID referencing a browser monitor entity. Tags: `smartscape-id`	`BROWSER_MONITOR-A140F3B85BCCBD1A`
`dt.smartscape.browser_monitor_step`	smartscapeId	resource stable Display name: `Browser monitor step ID` Smartscape ID referencing a browser monitor step entity. Tags: `smartscape-id`	`BROWSER_MONITOR_STEP-A140F3B85BCCBD1A`
`dt.smartscape.container`	smartscapeId	resource stable Display name: `Container ID` Smartscape ID referencing a container entity. Tags: `smartscape-id`	`CONTAINER-0F1E2D3C4B5A6978`
`dt.smartscape.disk`	smartscapeId	resource stable Display name: `Disk ID` Smartscape ID referencing a disk entity. Tags: `smartscape-id`	`DISK-5472CBC1ED0981D6`
`dt.smartscape.frontend`	smartscapeId	resource stable Display name: `Frontend ID` The frontend Smartscape ID. Tags: `smartscape-id`	`FRONTEND-E0D8F94D9065F24F`
`dt.smartscape.gcp_zone`	smartscapeId	resource stable Display name: `GCP zone ID` Smartscape ID referencing a GCP zone entity. Tags: `smartscape-id`	`GCP_ZONE-3699CB75E19C8505`
`dt.smartscape.host`	smartscapeId	resource stable Display name: `Host ID` Smartscape ID referencing a host entity. Tags: `smartscape-id`	`HOST-A1B2C3D4E5F67890`
`dt.smartscape.http_monitor`	smartscapeId	resource stable Display name: `HTTP monitor ID` Smartscape ID referencing an HTTP monitor entity. Tags: `smartscape-id`	`HTTP_MONITOR-A140F3B85BCCBD1A`
`dt.smartscape.http_monitor_step`	smartscapeId	resource stable Display name: `HTTP monitor step ID` Smartscape ID referencing an HTTP monitor step entity. Tags: `smartscape-id`	`HTTP_MONITOR_STEP-A140F3B85BCCBD1A`
`dt.smartscape.k8s_cluster`	smartscapeId	resource stable Display name: `Kubernetes cluster ID` A Smartscape ID that can be used to query Kubernetes cluster entities from the Smartscape storage. Tags: `smartscape-id`	`K8S_CLUSTER-0123456789ABCDEF`
`dt.smartscape.k8s_configmap`	smartscapeId	resource stable Display name: `Kubernetes configmap ID` Smartscape ID referencing a Kubernetes ConfigMap. Tags: `smartscape-id`	`K8S_CONFIGMAP-AABBCCDDEEFF0011`
`dt.smartscape.k8s_cronjob`	smartscapeId	resource stable Display name: `Kubernetes cronjob ID` Smartscape ID referencing a Kubernetes CronJob. Tags: `smartscape-id`	`K8S_CRONJOB-2233445566778899`
`dt.smartscape.k8s_customresourcedefinition`	smartscapeId	resource stable Display name: `Kubernetes customresourcedefinition ID` Smartscape ID referencing a Kubernetes CustomResourceDefinition. Tags: `smartscape-id`	`K8S_CUSTOMRESOURCEDEF-33445566778899AA`
`dt.smartscape.k8s_daemonset`	smartscapeId	resource stable Display name: `Kubernetes daemonset ID` Smartscape ID referencing a Kubernetes DaemonSet. Tags: `smartscape-id`	`K8S_DAEMONSET-BBCCDDEEFF001122`
`dt.smartscape.k8s_deployment`	smartscapeId	resource stable Display name: `Kubernetes deployment ID` Smartscape ID referencing a Kubernetes deployment. Tags: `smartscape-id`	`K8S_DEPLOYMENT-445566778899AABB`
`dt.smartscape.k8s_deploymentconfig`	smartscapeId	resource stable Display name: `Kubernetes deploymentconfig ID` Smartscape ID referencing an OpenShift DeploymentConfig. Tags: `smartscape-id`	`K8S_DEPLOYMENTCONFIG-5566778899AABBCC`
`dt.smartscape.k8s_dynakube`	smartscapeId	resource stable Display name: `Kubernetes dynakube ID` Smartscape ID referencing a Dynatrace DynaKube Kubernetes resource. Tags: `smartscape-id`	`K8S_DYNAKUBE-66778899AABBCCDD`
`dt.smartscape.k8s_edgeconnect`	smartscapeId	resource stable Display name: `Kubernetes edgeconnect ID` Smartscape ID referencing an EdgeConnect Kubernetes resource. Tags: `smartscape-id`	`K8S_EDGECONNECT-778899AABBCCDDEE`
`dt.smartscape.k8s_horizontalpodautoscaler`	smartscapeId	resource stable Smartscape ID referencing a Kubernetes HorizontalPodAutoscaler. Tags: `smartscape-id`	`K8S_HORIZONTALPODAUTOSCALER-91C6CADBB052EB09`
`dt.smartscape.k8s_ingress`	smartscapeId	resource stable Display name: `Kubernetes ingress ID` Smartscape ID referencing a Kubernetes ingress resource. Tags: `smartscape-id`	`K8S_INGRESS-8899AABBCCDDEEFF`
`dt.smartscape.k8s_job`	smartscapeId	resource stable Display name: `Kubernetes job ID` Smartscape ID referencing a Kubernetes job. Tags: `smartscape-id`	`K8S_JOB-99AABBCCDDEEFF00`
`dt.smartscape.k8s_namespace`	smartscapeId	resource stable Display name: `Kubernetes namespace ID` Smartscape ID referencing a Kubernetes namespace. Tags: `smartscape-id`	`K8S_NAMESPACE-AABBCCDDEEFF0011`
`dt.smartscape.k8s_networkpolicy`	smartscapeId	resource stable Display name: `Kubernetes networkpolicy ID` Smartscape ID referencing a Kubernetes NetworkPolicy. Tags: `smartscape-id`	`K8S_NETWORKPOLICY-BBCCDDEEFF112233`
`dt.smartscape.k8s_node`	smartscapeId	resource stable Display name: `Kubernetes node ID` Smartscape ID referencing a Kubernetes node. Tags: `smartscape-id`	`K8S_NODE-CCDDEEFF11223344`
`dt.smartscape.k8s_persistentvolume`	smartscapeId	resource stable Display name: `Kubernetes persistentvolume ID` Smartscape ID referencing a Kubernetes PersistentVolume. Tags: `smartscape-id`	`K8S_PERSISTENTVOLUME-DDEEFF1122334455`
`dt.smartscape.k8s_persistentvolumeclaim`	smartscapeId	resource stable Display name: `Kubernetes persistentvolumeclaim ID` Smartscape ID referencing a PersistentVolumeClaim. Tags: `smartscape-id`	`K8S_PERSISTENTVOLUMECLAIM-EEFF112233445566`
`dt.smartscape.k8s_pod`	smartscapeId	resource stable Display name: `Kubernetes pod ID` Smartscape ID referencing a Kubernetes pod. Tags: `smartscape-id`	`K8S_POD-FF11223344556677`
`dt.smartscape.k8s_replicaset`	smartscapeId	resource stable Display name: `Kubernetes replicaset ID` Smartscape ID referencing a Kubernetes ReplicaSet. Tags: `smartscape-id`	`K8S_REPLICASET-0011AABBCCDD2233`
`dt.smartscape.k8s_replicationcontroller`	smartscapeId	resource stable Display name: `Kubernetes replicationcontroller ID` Smartscape ID referencing a Kubernetes ReplicationController. Tags: `smartscape-id`	`K8S_REPLICATIONCONTROLLER-1122BBCCDDEEFF33`
`dt.smartscape.k8s_secret`	smartscapeId	resource stable Display name: `Kubernetes secret ID` Smartscape ID referencing a Kubernetes secret. Tags: `smartscape-id`	`K8S_SECRET-2233CCDDEEFF4455`
`dt.smartscape.k8s_service`	smartscapeId	resource stable Display name: `Kubernetes service ID` Smartscape ID referencing a Kubernetes service. Tags: `smartscape-id`	`K8S_SERVICE-3344DDEEFF556677`
`dt.smartscape.k8s_statefulset`	smartscapeId	resource stable Display name: `Kubernetes statefulset ID` Smartscape ID referencing a Kubernetes StatefulSet. Tags: `smartscape-id`	`K8S_STATEFULSET-4455EEFF66778899`
`dt.smartscape.microsoft_compute_virtualmachines`	smartscapeId	resource stable Display name: `Azure virtual machine ID` Smartscape ID referencing an Azure Virtual Machine resource. Tags: `smartscape-id`	`AZURE_MICROSOFT_COMPUTE_VIRTUALMACHINES-7788CC9900AABBCC`
`dt.smartscape.microsoft_resources_locations`	smartscapeId	resource stable Display name: `Azure Microsoft.Resources locations ID` Smartscape ID referencing an Azure Microsoft.Resources locations entity. Tags: `smartscape-id`	`AZURE_MICROSOFT_RESOURCES_LOCATIONS-0DD5C79E4034F0AA`
`dt.smartscape.microsoft_resources_locations_availabilityzones`	smartscapeId	resource stable Display name: `Azure availability zone ID` Smartscape ID referencing an Azure Availability Zone. Tags: `smartscape-id`	`AZURE_AVAILABILITY_ZONE-5566AA77889900BB`
`dt.smartscape.microsoft_resources_subscriptions`	smartscapeId	resource stable Display name: `Azure subscription ID` Smartscape ID referencing an Azure subscription. Tags: `smartscape-id`	`AZURE_SUBSCRIPTION-99AABB00CCDDEEFF`
`dt.smartscape.network_availability_monitor`	smartscapeId	resource experimental The Smartscape ID of a Synthetic network availability monitor entity. Tags: `smartscape-id`	`NETWORK_AVAILABILITY_MONITOR-0123456789ABCDEF`
`dt.smartscape.network_interface`	smartscapeId	resource stable Display name: `Network interface ID` Smartscape ID referencing a network interface entity. Tags: `smartscape-id`	`NETWORK_INTERFACE-FC7B4A5937FC125C`
`dt.smartscape.oneagent`	smartscapeId	resource stable Display name: `OneAgent ID` Smartscape ID referencing a OneAgent installation entity. Tags: `smartscape-id`	`ONEAGENT-1234567890ABCDEF`
`dt.smartscape.otel_host`	smartscapeId	resource stable Smartscape ID referencing an OpenTelemetry host entity. Tags: `smartscape-id`	`OTEL_HOST-A1B2C3D4E5F67890`
`dt.smartscape.otel_process`	smartscapeId	resource stable Smartscape ID referencing an OpenTelemetry process entity. Tags: `smartscape-id`	`OTEL_PROCESS-1234567890ABCDEF`
`dt.smartscape.process`	smartscapeId	resource stable Display name: `Process ID` Smartscape ID referencing a process entity. Tags: `smartscape-id`	`PROCESS-1234567890ABCDEF`
`dt.smartscape.service`	smartscapeId	resource stable Display name: `Service ID` Smartscape ID referencing a service entity. Tags: `smartscape-id`	`SERVICE-0011223344556677`
`dt.smartscape.synthetic_engine`	smartscapeId	resource experimental Display name: `Synthetic engine ID` Smartscape ID referencing a Synthetic Engine entity. Tags: `smartscape-id`	`SYNTHETIC_ENGINE-A5DC8F6B0E3417C2`
`dt.smartscape.synthetic_location`	smartscapeId	resource stable Display name: `Synthetic location ID` Smartscape ID referencing a Synthetic Location entity. Tags: `smartscape-id`	`SYNTHETIC_LOCATION-D140F3B85BCCBD1A`

Dynatrace Synthetic

The dt.synthetic namespace contains Dynatrace synthetic specific fields.

Dynatrace Synthetic fields

Attribute	Type	Description	Examples
`dt.synthetic.excluded_from_step`	boolean	experimental Display name: `Synthetic excluded from step` Information whether the event is not included in step/monitor level aggregation (in metrics and counters).
`dt.synthetic.location.missing_capabilities`	array	experimental Display name: `Synthetic location missing capabilities` Names of missing Synthetic location capabilities.	`BROWSER`; `ICMP`
`dt.synthetic.monitor.name`	string	experimental The name of the monitor.	`Monitor name`
`dt.synthetic.request.targets`	array	experimental Display name: `Synthetic request targets` Request target addresses with DNS record type or TCP port number.	`127.0.0.1:22`
`dt.synthetic.step.name`	string	experimental The name of the step.	`Step name`
`dt.synthetic.step.sequence_number`	long	experimental The sequence number of the step within the synthetic browser monitor, indicating the order of execution of the steps.	`42`; `5`; `1`
`dt.synthetic.step.type`	string	experimental Display name: `Synthetic step type` Type of browser monitor step.	`navigate`; `click`; `javascript`
`dt.synthetic.step.url`	string	experimental Display name: `Step URL` The URL of the step.	`https://dynatrace.com`

dt.synthetic.step.type MUST be one of the following:

Value	Description
`click`	Click
`cookie`	Cookie
`javascript`	JavaScript
`keystrokes`	Keystrokes
`navigate`	Navigate
`select_option`	Select option
`tap`	Tap

Dynatrace Synthetic ID resource fields

Attribute	Type	Description	Examples
`dt.synthetic.batch.id`	long	resource experimental Display name: `Synthetic batch ID` The identifier of the batch (defined for on-demand executions only).	`123456789`
`dt.synthetic.monitor.id`	string	resource experimental Display name: `Synthetic monitor ID` The identifier of the monitor.	`HTTP_CHECK-6349B98E1CD87352`
`dt.synthetic.monitor.smartscape.id`	smartscapeId	resource experimental The Smartscape ID of the monitor.	`HTTP_MONITOR-017198AD253CBD63`
`dt.synthetic.monitored_entity_ids`	string[]	resource experimental Display name: `Synthetic monitored entity ids` IDs of monitored entities.	`['APPLICATION-EA7C4B59F27D43EB']`
`dt.synthetic.monitored_smartscape_ids`	smartscapeId[]	resource experimental Display name: `Synthetic monitored entity Smartscape ids` The Smartscape IDs of monitored entities.	`[['FRONTEND-E0D8F94D9065F24F']]`
`dt.synthetic.step.id`	string	resource experimental Display name: `Synthetic step ID` The identifier of the monitor step.	`HTTP_CHECK_STEP-5349B98E1CD87352`
`dt.synthetic.step.smartscape.id`	smartscapeId	resource experimental The Smartscape ID of the monitor step.	`HTTP_MONITOR_STEP-6349B98E1CD87352`
`dt.synthetic.violated_entity_ids`	string[]	resource experimental Display name: `Synthetic violated entity ids` IDs of synthetic monitor or steps.	`['HTTP_CHECK-9349B98E1CD87352', 'HTTP_CHECK_STEP-6349B98E1CD87352']`

Dynatrace Synthetic

The dt.synthetic_engine namespace contains Dynatrace synthetic engine specific fields.

Dynatrace Synthetic engine fields

Attribute	Type	Description	Examples
`dt.synthetic_engine.processing.end_timestamp`	timestamp	experimental Display name: `Synthetic engine processing end timestamp` The end timestamp of the step/monitor execution as reported by executor.	`1629891693487`
`dt.synthetic_engine.processing.start_timestamp`	timestamp	experimental Display name: `Synthetic engine processing start timestamp` The start timestamp of the step/monitor execution as reported by executor.	`1529891693487`

Dynatrace system

The namespace dt.system is reserved for Grail. These fields cannot be ingested but instead will be set by Grail directly. Every record that is fetched from Grail provides these fields, but by default they are hidden. You can display them by using the fieldsAdd command.

Example query:

// display the bucket for each log record
fetch logs
| fieldsAdd dt.system.bucket

Dynatrace system fields

Attribute	Type	Description	Examples
`dt.system.bucket`	string	stable Display name: `System bucket` The Grail bucket that the record is stored in.	`default_logs`; `default_spans`; `default_bizevents`
`dt.system.environment`	string	stable Display name: `System environment` The Dynatrace environment that the record belongs to.	`wkf10640`
`dt.system.monitoring_source`	string	stable Display name: `System monitoring source` Identifies the license under which the source is running.	`fullstack_host`; `infrastructure`
`dt.system.sampling_ratio`	long	stable Display name: `System sampling ratio` The selected sampling ratio.	`1`
`dt.system.segment_id`	string	stable Display name: `System segment ID` The segment that the record belongs to.	`5d97c09e-7337-443e-bab5-2f0474804687`
`dt.system.storage_interval`	string	stable Display name: `System storage interval` Identifies the timeframe represented by individual data structures stored under a metric key.	`1 min`
`dt.system.table`	string	stable Display name: `System table` The table that the record belongs to.	`logs`; `bizevents`

dt.system.monitoring_source MUST be one of the following:

Value	Description	Display name
`container_application_monitoring`	The source is running under the Container Application Monitoring license.	Container App Monitoring
`discovery`	The source is running under the discovery license.	Discovery
`fullstack_container`	The source is running under the full-stack container license.	Full-Stack Container
`fullstack_host`	The source is running under the full-stack host license.	Full-Stack Host
`infrastructure`	The source is running under the infrastructure license.	Infrastructure
`mainframe`	The source is running under the mainframe license.	Mainframe

dt.system.storage_interval MUST be one of the following:

Value	Description	Display name
`1 min`	The timeframe represented by individual measurements of a metrics record in storage.	One Minute

Dynatrace tracing

Fields defined in this namespace are used by Dynatrace to describe different aspects of the context propagation between spans.

Dynatrace tracing fields

Attribute	Type	Description	Examples
`dt.tracing.custom_link.id`	uid	experimental Display name: `Custom link ID` The custom link ID to identify spans calling each other. The ID is derived from the custom link bytes.	`736bd2684696c4a8`
`dt.tracing.custom_link.original_bytes`	binary	experimental Display name: `Custom link original bytes` The original binary data of the custom link.	`ycXlxUBAQEDee9lm8pBcA8nF5cVAQEBA3nvZZvKQXAPee9lm8s4SAQ==`
`dt.tracing.custom_link.transformed_bytes`	binary	experimental Display name: `Custom link transformed bytes` The transformed binary data of the custom link. Only available if a mapping was applied.	`ycXlxUBAQEDee9lm8pBcA8nF5cVAQEBA3nvZZvKQXAPee9lm8s4SAQ==`
`dt.tracing.custom_link.type`	string	experimental Display name: `Custom link type` The type of the custom link defines if a mapping of the `dt.tracing.custom_link.original_bytes` to the `dt.tracing.custom_link.transformed_bytes` was applied.	`generic`
`dt.tracing.foreign_link.bytes`	binary	experimental Display name: `Foreign link bytes` An incoming foreign link (cross-environment or cross-product).	`00000004000000010000000200000003000000040000002300000001`
`dt.tracing.foreign_link.text`	string	experimental Display name: `Foreign link text` An incoming foreign link (cross-environment or cross-product).	`FW4;129;12;-2023406815;4539717;0;17;66;c511;2h02;3h12345678;4h676767`; `FW1;129;4711;59959450;-1859959450;3;17;0`
`dt.tracing.link.direction`	string	experimental Display name: `Link direction` The direction of the span link to define the correct order between spans.	`outgoing`
`dt.tracing.link.id`	uid	deprecatedRemoved without replacement. Display name: `Link ID` Unique identifier for a Dynatrace link.
`dt.tracing.link.is_sync`	boolean	experimental Display name: `Link is synchronous` `true` indicates that the caller waits on the response. Only available on span links with `dt.tracing.link.direction` set to `outgoing`.
`dt.tracing.response.headers`	record	experimental Display name: `Response headers` A collection of key-value pairs containing received response headers related to tracing from an outgoing call. There may be multiple values for each header. Used for cross-environment linking.	`{'traceresponse': ['00-7b9e3e4068167838398f50017bfad358-d4ffc7e33530967a-01'], 'x-dt-tracestate': ['9651e1a8-19506b7c@dt']}`

dt.tracing.custom_link.type MUST be one of the following:

Value	Description	Display name
`generic`	The `dt.tracing.custom_link.original_bytes` have no special meaning.	Generic
`ibm_mq`	The `dt.tracing.custom_link.original_bytes` are an IBM MQ custom link.	IBM MQ
`ibm_mq_ignore_qname`	The `dt.tracing.custom_link.original_bytes` are an IBM MQ custom link, but the qname part should be ignored in mapping.	IBM MQ Ignore Queue Name

dt.tracing.link.direction MUST be one of the following:

Value	Description	Display name
`incoming`	Indicates that the link represents an incoming call (the child in a parent-child relationship).	Incoming
`outgoing`	Indicates that the link represents an outgoing call (the parent in a parent-child relationship).	Outgoing

Elasticsearch

Elasticsearch fields

Attribute	Type	Description	Examples
`elasticsearch.cluster.name`	string	resource experimental Display name: `Elasticsearch cluster name`
`elasticsearch.node.name`	string	resource experimental Display name: `Elasticsearch node name`

Endpoint

Endpoint span fields

Endpoints define the public interface of services.

Attribute	Type	Description	Examples
`endpoint.name`	string	stable Display name: `Endpoint name` The endpoint name is derived from endpoint detection rules and uniquely identifies one endpoint of a particular service. Endpoint names are usually technology-specific and should be defined by attributes with low cardinality, like `http.route` or `rpc.method`. Endpoints are exclusively detected on request root spans.	`GET /`; `PUT /users/:userID?`; `GET /productpage`; `Reviews.GetReviews`

Equinox

Equinox fields

Attribute	Type	Description	Examples
`equinox.config.path`	string	resource experimental Display name: `Equinox configuration path`

ESB

ESB fields

Attribute	Type	Description	Examples
`esb.application.name`	string	resource experimental Display name: `ESB application name` The name of the application that holds the workflows of the business logic.	`myBusinessApp`; `YourServiceApp`; `any_work`
`esb.library.name`	string	resource experimental Display name: `ESB library name` The name of the library that hosts commonly used workflows to be reused in applications.	`myWebServicesLib`; `YourMessagingLibrary`; `any_tools`
`esb.vendor`	string	resource experimental Display name: `ESB vendor` The name of the vendor of the ESB technology of the current workflow.	`ibm`; `tibco`
`esb.workflow.name`	string	resource experimental Display name: `ESB workflow name` The name of the workflow (the message flow for the IBM ESB).	`myMessageFlow`; `YourBusinessWorkflow`; `any_flow`

Event

The event namespace contains common identification, categorization and context on events in Dynatrace.

Event fields

Attribute	Type	Description	Examples
`event.category`	string	stable Display name: `Event category` Standard categorization based on the significance of an event (similar to the severity level in the previous Dynatrace).	`Availability`
`event.description`	string	stable Display name: `Event description` Human-readable description of an event.	`The current response time (11 s) exceeds the auto-detected baseline (767 ms) by 1,336 %`
`event.end`	string	stable Display name: `Event end` The event end timestamp in UTC (given in Grail preferred Linux timestamp nano precision format).	`16481073970000`
`event.group_label`	string	experimental Display name: `Event group label` Group label of an event.	`Availability`
`event.id`	string	stable Display name: `Event ID` Unique identifier string of an event; is stable across multiple refreshes and updates.	`5547782627070661074_1647601320000`
`event.kind`	string	stable Display name: `Event kind` Gives high-level information about what kind of information the event contains without being specific about the contents of the event. It helps to determine the record type of a raw event. Tags: `permission`	`INFRASTRUCTURE_EVENT`; `DAVIS_EVENT`; `BIZ_EVENT`; `RUM_EVENT`; `AUDIT_EVENT`; `BILLING_USAGE_EVENT`
`event.name`	string	stable Display name: `Event name` The human readable display name of an event type.	`Process crashed`; `CPU Saturation`
`event.original_content`	string	experimental Display name: `Original content` The original raw data of the event as received from the source.	`{"severity_id": 3,"state_id": 1,"time": "2024-06-26T07:15:06.139000Z","state": "New","type_uid": 200101}`
`event.outcome`	string	stable Display name: `Event outcome` Denotes whether the event represents a success or a failure from the perspective of the entity that produced the event (for example an HTTP response code).	`200`; `success`; `failure`
`event.parent_id`	string	experimental Display name: `Parent event ID` Unique identifier string of a parent event to link parent and child events.	`5547782627070661074_1647601319999`
`event.provider`	string	stable Display name: `Event provider` Source of the event, for example, the name of the component or system that generated the event. Tags: `permission`	`OneAgent`; `K8S`; `Davis`; `VMWare`; `GCP`; `AWS`; `LIMA_USAGE_STREAM`
`event.reason`	string	stable Display name: `Event reason` Describes why a certain event.outcome was set. Typically, this is some form of error description in the case of a failure.	`user is missing permission "logs.read"`
`event.related_id`	long	experimental Display name: `Related event ID` An identifier for a related event, if applicable.	`987654321`
`event.severity`	long	stable Display name: `Event severity` Incident severity on a scale of 1 to 5 (1 = most severe, 5 = least severe), aligned with ITIL severity levels.	`1`; `2`; `3`; `4`; `5`
`event.start`	string	stable Display name: `Event start` The event start timestamp in UTC (given in Grail preferred Linux timestamp nano precision format).	`16481073970000`
`event.status`	string	stable Display name: `Event status` Status of an event as being either Active or Closed.	`Active`
`event.status_transition`	string	experimental Display name: `Status transition` An enum that shows the transition of the above event state.	`Recovered`
`event.type`	string	stable Display name: `Event type` The unique type identifier of a given event. Tags: `permission`	`ESXI_HOST_MEMORY_SATURATION`; `PROCESS_RESTART`; `CPU_SATURATION`; `MEMORY_SATURATION`; `Automation Workflow`; `AppEngine Functions - Small`
`event.version`	string	stable Display name: `Event version` Describes the version of the event.	`1.0.0`

Values

Values are either in title-case or screaming snake case.

event.category SHOULD be one of the following:

Value	Description
`Availability`	availability
`Error`	error
`Slowdown`	slowdown
`Resource contention`	resource_contention
`Warning`	warning
`Info`	info
`Vulnerability management`	vulnerability_management

event.status SHOULD be one of the following:

Value	Description
`Active`	active
`Closed`	closed

event.status_transition SHOULD be one of the following:

Value	Description
`Created`	created
`Updated`	updated
`Refreshed`	refreshed
`Resolved`	resolved
`Recovered`	recovered
`Closed`	closed
`Timed out`	timed out
`Reopened`	reopened

Exception

Exception fields

Attribute	Type	Description	Examples
`exception.caused_by_id`	uid	stable Display name: `Exception caused by ID` The `exception.id` of the exception the current exception was caused by.
`exception.column_number`	long	stable Display name: `Exception column number` The column number where the exception happened.	`12304`
`exception.escaped`	boolean	stable Display name: `Exception escaped` `true` indicates that the exception was recorded at a point where it is known that the exception escaped the scope of the span.
`exception.file.domain`	string	stable Display name: `Exception file domain` The URI domain component. This is extracted from `exception.file.full`.	`www.foo.bar`
`exception.file.full`	string	stable Display name: `Exception file` The full file location when the exception happened. This is either an absolute URL or a filename.	`https://www.foo.bar/path/main.js`; `main.js`
`exception.file.path`	string	stable Display name: `Exception file path` The URI path component. This is extracted from `exception.file.full`.	`/path/main.js`
`exception.id`	uid	stable Display name: `Exception ID` The identifier of an exception. It should be unique within a list of exceptions of a span. The identifier is used to reference the exception.
`exception.is_caused_by_root`	boolean	stable Display name: `Exception is caused by root` Is set to `true` if the exception is the first exception caused by the chain.
`exception.line_number`	long	stable Display name: `Exception line number` The line number where the exception happened.	`1401`
`exception.message`	string	stable Display name: `Exception message` A message that describes the exception.	`Division by zero`
`exception.stack_trace`	string	stable Display name: `Exception stack trace` The stack trace of the exception. The format depends on the technology and source. While OneAgent formats stack traces to unify them across technologies, stack traces from an OpenTelemetry source are in the format they were sent to Dynatrace.	`@https://www.foo.bar/path/main.js:59:26 e@https://www.foo.bar/path/lib/1.1/lib.js:2:30315`
`exception.type`	string	stable Display name: `Exception type` The type of the exception, for example, its fully-qualified class name.	`java.net.ConnectException`; `OSError`

External provider

External provider fields

The external_provider group contains information about the external (first-party, third-party, or CDN) provider that a monitored service made an outbound call to.

Attribute	Type	Description	Examples
`external_provider.name`	string	experimental The name of the external provider whose configured pattern matched the outbound call.	`api.example.com`
`external_provider.type`	string	experimental The type of the external provider whose configured pattern matched the outbound call.	`third_party`

external_provider.type MUST be one of the following:

Value	Description
`cdn`	CDN (content delivery network).
`first_party`	First-party provider.
`third_party`	Third-party provider.

Function as a Service (FaaS)

Fields that can be expected from serverless functions or Function as a Service (FaaS) on various cloud platforms.

FaaS resource fields

Attribute	Type	Description	Examples
`faas.instance`	string	resource experimental The execution environment ID as a string that will be potentially reused for other invocations to the same function/function version.	`2021/06/28/[$LATEST]2f399eb14537447da05ab2a2e39309de`; `e558d244-3fe7-4890-90ac-e0a1e6735373`
`faas.max_memory`	long	resource experimental Display name: `FaaS maximum memory` The amount of memory available to the serverless function in Bytes.
`faas.name`	string	resource experimental Display name: `FaaS name` The name of the single function that this runtime instance executes. ¹	`my-function`; `myazurefunctionapp/some-function-name`; `test_function`
`faas.version`	string	resource experimental Display name: `FaaS version` The immutable version of the function being executed. ²	`14`; `254`

This is the name of the function as configured/deployed on the FaaS platform and is usually different from the name of the callback function (which may be stored in the code.namespace/code.function span attributes).

Value of the field depends on a cloud provider. This field is not set for Azure.

FaaS fields

Attribute	Type	Description	Examples
`faas.auth.is_authorized`	boolean	experimental Display name: `FaaS authorizer decision` The allow or deny decision made by the authorizer (for `faas.trigger=auth`). `true` if the request was authorized, `false` if it was denied.	`true`; `false`
`faas.coldstart`	boolean	experimental Display name: `FaaS cold start` A boolean that is true if the serverless function is executed for the first time (aka cold-start).
`faas.document.collection`	string	experimental Display name: `FaaS document collection` The table/collection name on which the operation `faas.document.operation` was executed. ¹	`my-coll-name`
`faas.document.count`	long	experimental The number of documents affected by the operation that triggered the function invocation. ²	`1`; `37`
`faas.document.name`	string	experimental Display name: `FaaS document name` The identifier for the specific item that changed after executing the operation above. ³	`my-file.jpg`; `63eeb6e7d418cd98afb1c1d7`
`faas.document.namespace`	string	experimental The namespace of the collection/document (for example, database name,…) within which the operation was performed. ⁴	`my-database`; `products`
`faas.document.operation`	string	experimental Display name: `FaaS document operation` Relevant only for "datasource" trigger. The operation type which triggered the function invocation.	`delete`
`faas.document.time`	string	experimental Display name: `FaaS document time` The UTC ISO-8601 timestamp of the operation above. ⁵	`2020-03-08T00:30:12.456Z`
`faas.event.__key__`	string	stable Display name: `FaaS event attribute` FaaS event attribute, the `__key__` attribute in a FaaS event represents the precise attribute name as received in the event. For example, it might be "faas.event.StackId" for the "StackId" attribute in an AWS CloudFormation event or "faas.event.IdentityPoolId" for the "IdentityPoolId" attribute in an AWS Cognito event. The value of this attribute is identical to the value received in the event.	`arn:aws:cloudformation:us-west-2:123456789012:stack/MyStack/1a2b3c4d-5678-90ab-cdef-EXAMPLE11111`; `eu-west-1:12345678-1234-1234-1234-123456789012`
`faas.event_name`	string	experimental Display name: `FaaS event name` The API action that triggered the FaaS event. ⁶	`ObjectCreated:Put (aws:s3)`; `INSERT (aws:dynamodb)`
`faas.event_source`	string	experimental Display name: `FaaS event source` The cloud service that originated the event.	`aws:cloudwatch`; `aws:cloudformation`
`faas.invocation_id`	string	experimental The invocation ID of the current function invocation	`d759b86b-acab-498e-9220-08ba69bffbdb`
`faas.invoked_name`	string	experimental Display name: `FaaS invoked name` The name of the invoked function.	`my-function`
`faas.invoked_provider`	string	experimental Display name: `FaaS invoked provider` The cloud provider of the invoked function. Will be equal to the invoked function's `cloud.provider` resource attribute.	`alibaba_cloud`
`faas.invoked_region`	string	experimental Display name: `FaaS invoked region` The cloud region of the invoked function. ⁷	`eu-central-1`
`faas.timer.cron`	string	experimental The schedule expression that configures the timer trigger for the function invocation (for `faas.trigger=timer`).	`0 /5 * * *`
`faas.timer.time`	timestamp	experimental Display name: `FaaS timer time` The timestamp when the timer expired and triggered the function execution (for `faas.trigger=timer`).	`1649822520123123123`
`faas.trigger`	string	experimental Display name: `FaaS trigger` Type of the trigger which caused this function invocation.	`auth`

Relevant only for faas.trigger=datasource trigger

Relevant only for faas.trigger=datasource trigger.

Relevant only for faas.trigger=datasource trigger

⁴

Relevant only for faas.trigger=datasource trigger.

⁵

Relevant only for faas.trigger=datasource trigger

⁶

The value of this attribute is specific to the service that generated the event.

⁷

Will be equal to the invoked function's cloud.region resource attribute.

faas.document.operation has the following list of well-known values. If one of them applies, then the respective value MUST be used, otherwise a custom value MAY be used.

Value	Description	Display name
`delete`	delete	Delete
`edit`	edit	Edit
`insert`	insert	Insert

faas.invoked_provider has the following list of well-known values. If one of them applies, then the respective value MUST be used, otherwise a custom value MAY be used.

Value	Description	Display name
`alibaba_cloud`	Alibaba Cloud	Alibaba Cloud
`aws`	Amazon Web Services	AWS
`azure`	Microsoft Azure	Azure
`gcp`	Google Cloud Platform	GCP
`tencent_cloud`	Tencent Cloud	Tencent Cloud

faas.trigger has the following list of well-known values. If one of them applies, then the respective value MUST be used, otherwise a custom value MAY be used.

Value	Description	Display name
`auth`	A function invoked to authorize an incoming request (for example, an API gateway authorizer).	Auth
`datasource`	A response to some data source operation such as a database or filesystem read/write.	Datasource
`http`	To provide an answer to an inbound HTTP request	HTTP
`other`	If none of the others apply	Other
`pubsub`	A function is set to be executed when messages are sent to a messaging system.	Pub/Sub
`timer`	A function is scheduled to be executed regularly.	Timer

Failure detection

Failure detection fields

Fields that can be expected for a failure detection on a Dynatrace span. For more details and how failure detection is embedded in a span, see Dynatrace Span model.

Attribute	Type	Description	Examples
`dt.failure_detection.general_parameters_id`	uid	experimental Display name: `Failure detection general parameters ID` The `id` of the failure detection general parameters (failure detection v1) that were applied to that span (uid128).	`4d76194c11a9426197a9062548f9e66f`
`dt.failure_detection.global_parameters_id`	uid	experimental Display name: `Failure detection global parameters ID` The `id` of the global failure detection parameters (failure detection v1) that were applied to that span (uid128). This is always used in conjunction with the `dt.failure_detection.global_rule_id`.	`4d76194c11a9426197a9062548f9e66c`
`dt.failure_detection.global_rule_id`	uid	experimental Display name: `Failure detection global rule ID` The `id` of the global failure detection rule (failure detection v1) that was applied to that span (uid128). This is always used in conjunction with the `dt.failure_detection.global_parameters_id`.	`4d76194c11a9426197a9062548f9e66b`
`dt.failure_detection.http_parameters_id`	uid	experimental Display name: `Failure detection HTTP parameters ID` The `id` of the failure detection HTTP parameters (failure detection v1) that were applied to that span (uid128).	`4d76194c11a9426197a9062548f9e66a`
`dt.failure_detection.results`	record[]	experimental Display name: `Failure detection results` A collection of individual failure detection reasons and verdicts for each applied matching rule. If no entries exist, no rules matched, and the attribute does not exist.
`dt.failure_detection.ruleset_id`	uid	experimental Display name: `Failure detection ruleset ID` The `id` of the failure detection rule set (failure detection v2) that was applied to that span (uid128).	`4d76194c11a9426197a9062548f9e66e`
`dt.failure_detection.verdict`	string	experimental Display name: `Failure detection verdict` The final failure detection verdict based on the results in `dt.failure_detection.results`.	`failure`

dt.failure_detection.verdict MUST be one of the following:

Value	Description	Display name
`failure`	There is at least one result with verdict `failure` and no result with verdict `success`.	Failure
`success`	There is at least one result with verdict `success` or no result at all.	Success

Feature flag

Feature flag evaluation event fields

Attribute	Type	Description	Examples
`feature_flag.context.id`	string	experimental Display name: `Feature flag context ID` The unique identifier for the flag evaluation context. For example, the targeting key.	`5157782b-2203-4c80-a857-dbbd5e7761db`
`feature_flag.key`	string	experimental Display name: `Feature flag key` The unique identifier of the feature flag.	`logo-color`
`feature_flag.provider.name`	string	experimental Display name: `Feature flag provider name` The name of the service provider that performs the flag evaluation.	`Flag Manager`
`feature_flag.result.reason`	string	experimental Display name: `Feature flag result reason` The reason code, which shows how a feature flag value was determined.	`static`; `targeting_match`; `error`; `default`
`feature_flag.result.variant`	string	experimental Display name: `Feature flag result variant` A semantic identifier for an evaluated flag value. ¹	`red`; `true`; `on`
`feature_flag.set.id`	string	experimental Display name: `Feature flag set ID` The identifier of the flag set to that the feature flag belongs.	`proj-1`; `ab98sgs`; `service1/dev`
`feature_flag.version`	string	experimental Display name: `Feature flag version` The version of the ruleset used during the evaluation. This can be any stable value that uniquely identifies the ruleset.	`1`; `01ABCDEF`

A semantic identifier, commonly referred to as a variant, provides a means for referring to a value without including the value itself. This can provide additional context for understanding the meaning behind a value. For example, the variant red maybe be used for the value #c05543.

feature_flag.result.reason MUST be one of the following:

Value	Description	Display name
`cached`	The resolved value was retrieved from cache.	Cached
`default`	The resolved value fell back to a pre-configured value (no dynamic evaluation occurred or dynamic evaluation yielded no result).	Default
`disabled`	The resolved value was the result of the flag being disabled in the management system.	Disabled
`error`	The resolved value was the result of an error.	Error
`split`	The resolved value was the result of pseudorandom assignment.	Split
`stale`	The resolved value is non-authoritative or possibly out of date.	Stale
`static`	The resolved value is static (no dynamic evaluation).	Static
`targeting_match`	The resolved value was the result of a dynamic evaluation, such as a rule or specific user-targeting.	Targeting Match
`unknown`	The reason for the resolved value could not be determined.	Unknown

Frontend

Frontend fields

Attribute	Type	Description	Examples
`frontend.deletion_time`	timestamp	experimental The time at which the frontend was marked as deleted. Only present when the frontend has been deleted.	`2024-04-11T06:56:01.204Z`
`frontend.link`	record	experimental Display name: `Frontend link` A frontend-backend tracing link that connects a span to a frontend user event and/or user session. Unlike span links, which reference other spans, this links tracing data to frontend monitoring (such as RUM or Synthetic).
`frontend.name`	string	stable Display name: `Frontend name` The frontend name determined at ingest. Tags: `permission`	`my_frontend`
`frontend.type`	string	experimental The type of the RUM-instrumented frontend. Enriched server-side based on the frontend configuration.	`web`; `mobile`

frontend.type MUST be one of the following:

Value	Description
`mobile`	A mobile frontend.
`web`	A web (browser-based) frontend.

Google Cloud Platform

Google Cloud Platform fields

Attribute	Type	Description	Examples
`gcp.app_engine.instance`	string	resource experimental Display name: `GCP App Engine instance`
`gcp.app_engine.service`	string	resource experimental Display name: `GCP App Engine service`
`gcp.cloud_run.service`	string	resource experimental Display name: `GCP Cloud Run service`
`gcp.instance.id`	string	resource experimental Display name: `GCP instance ID` The unique, numeric identifier of the Google Cloud resource instance (e.g., GCE VM or Cloud SQL), which remains immutable throughout the resource's lifecycle.	`6639848141313102286`
`gcp.instance.name`	string	resource deprecated Display name: `GCP instance name` The name to display for the instance in the Cloud Console.	`single-vm-test`
`gcp.labels.__label__`	string	resource experimental Display name: `GCP label` Contains the value for the user labels with the label key named `__label__` defined in the label enrichment configuration.	`dt_owner_mail`
`gcp.location`	string	resource stable Display name: `GCP location` Region or zone where GCP resource instance is running.	`europe-west3-c`
`gcp.organization.id`	string	resource experimental Display name: `GCP organization ID` Unique, immutable identifier assigned to an organization resource.	`123456789012`
`gcp.organization.name`	string	resource experimental Display name: `GCP organization name` Name assigned to the GCP organization.	`dynatrace.com`
`gcp.project.id`	string	resource stable Display name: `GCP project ID` Identifier of the GCP project associated with this resource. Tags: `permission` `primary-field`	`dynatrace-gcp-extension`
`gcp.region`	string	resource stable Display name: `GCP region` A region is a specific geographical location where you can host your resources. Tags: `primary-field`	`europe-west3`
`gcp.resource.name`	string	resource stable Display name: `GCP resource name` The globally unique resource name in Google Cloud Platform convention.	`//cloudfunctions.googleapis.com/projects/gcp-example-project/locations/us-central1/functions/examplefunction`
`gcp.resource.type`	string	resource stable Display name: `GCP resource type` The name of a monitored resource type available in Google Cloud Monitoring and Logging.	`cloudsql_database`
`gcp.tags.__tag__`	string	resource experimental Contains the value for the tags with the tag key named `__tag__` defined in the tag enrichment configuration.	`payroll_app`
`gcp.zone`	string	resource stable Display name: `GCP zone` A zone is a subset of a region. Each region has three or more zones.	`europe-west3-c`

Generative AI

Generative AI fields

Attribute	Type	Description	Examples
`gen_ai.agent.name`	string	experimental Display name: `Agent name` Human-readable name of the GenAI agent provided by the application.	`Math Tutor`; `Fiction Writer`
`gen_ai.embeddings.dimension.count`	long	experimental Display name: `Embeddings dimension count` The number of dimensions the resulting output embeddings should have.	`512`; `1024`
`gen_ai.guardrail.id`	string	experimental Display name: `Guardrail ID` Identifier of the guardrail that has been activated for the request.	`sensitive_data_guardrail`
`gen_ai.guardrail.input.content`	record[]	experimental Display name: `Guardrail input content` Content categories that triggered the guardrails on prompts.	`{'type': 'HATE', 'confidence': 'MEDIUM'}`; `{'type': 'SEXUAL', 'confidence': 'HIGH'}`
`gen_ai.guardrail.input.latency`	long	experimental Display name: `Guardrail input latency` Processing time of prompt by guardrail in ms.	`123`
`gen_ai.guardrail.input.sensitive_information.patterns`	string[]	experimental Display name: `Guardrail input sensitive patterns` Name of the patterns for sensitive information in prompt that triggered the Guardrail.	`['customer_identifier']`
`gen_ai.guardrail.input.sensitive_information.piis`	string[]	experimental Display name: `Guardrail input PIIs` Personal Identifiable Information categories in prompt that triggered the Guardrail.	`['ADDRESS', 'LICENSE_PLATE', 'DRIVER_ID']`
`gen_ai.guardrail.input.topic.names`	string[]	experimental Display name: `Guardrail input topics` Topics in prompt that triggered the Guardrail.	`['investment_advice', 'legal_advice', 'politics']`
`gen_ai.guardrail.input.words.lists`	string[]	experimental Display name: `Guardrail input words lists` Word lists that triggered the guardrail for prompt.	`['custom-word-list']`
`gen_ai.guardrail.input.words.matches`	string[]	experimental Display name: `Guardrail input words matches` Words in prompt that triggered the Guardrail.	`[]`
`gen_ai.guardrail.output.content`	record[]	experimental Display name: `Guardrail output content` Content categories that triggered the guardrails on response.	`{'type': 'HATE', 'confidence': 'MEDIUM'}`; `{'type': 'SEXUAL', 'confidence': 'HIGH'}`
`gen_ai.guardrail.output.contextual`	record[]	experimental Display name: `Guardrail output contextual` Contextual check types that triggered the guardrail on the response, along with the score achieved by each triggered grounding check.	`{'type': 'GROUNDING', 'score': 0.7}`; `{'type': 'RELEVANCE', 'score': 0.5}`
`gen_ai.guardrail.output.latency`	long	experimental Display name: `Guardrail output latency` Processing time of response by guardrail in ms.	`123`
`gen_ai.guardrail.output.sensitive_information.patterns`	string[]	experimental Display name: `Guardrail output sensitive patterns` Name of the patterns for sensitive information in response that triggered the Guardrail.	`['customer_identifier']`
`gen_ai.guardrail.output.sensitive_information.piis`	string[]	experimental Display name: `Guardrail output PIIs` Personal Identifiable Information categories in response that triggered the Guardrail.	`['ADDRESS', 'LICENSE_PLATE', 'DRIVER_ID']`
`gen_ai.guardrail.output.topic.names`	string[]	experimental Display name: `Guardrail output topics` Topics in response that triggered the Guardrail.	`['investment_advice', 'legal_advice', 'politics']`
`gen_ai.guardrail.output.words.lists`	string[]	experimental Display name: `Guardrail output words lists` Word lists that triggered the guardrail for response.	`['custom-word-list']`
`gen_ai.guardrail.output.words.matches`	string[]	experimental Display name: `Guardrail output words matches` Words in response that triggered the Guardrail.	`[]`
`gen_ai.guardrail.version`	string	experimental Display name: `Guardrail version` Version of the guardrail that has been activated.	`DRAFT`; `5`; `12345678`
`gen_ai.input.messages`	record[]	experimental Display name: `Input messages` List of all user prompts passed to the LLM. This includes "tool" prompts and may include "system" prompts if the instrumented library includes them in the message list.	`{'role': 'user', 'content': [{'text': 'What is the capital of France?'}]}`
`gen_ai.messages.dropped.input`	long	experimental Display name: `Dropped input messages` Number of input messages dropped due to capture limits.	`1`; `5`
`gen_ai.messages.dropped.output`	long	experimental Display name: `Dropped output messages` Number of output messages dropped due to capture limits.	`1`; `5`
`gen_ai.messages.dropped.system`	long	experimental Display name: `Dropped system messages` Number of system messages dropped due to capture limits.	`1`; `5`
`gen_ai.operation.kind`	string	experimental Display name: `Operation kind` AI framework operation being performed.	`workflow`; `task`; `agent`; `agent`; `tool`; `retrieval`
`gen_ai.operation.name`	string	experimental Display name: `Operation name` Name of operation being performed.	`chat`; `generate_content`; `text_completion`
`gen_ai.output.messages`	record[]	experimental Display name: `Output messages` List of all LLM responses.	`{'role': 'assistant', 'content': [{'text': 'The capital of France is Paris.'}]}`
`gen_ai.prompt_caching`	string	experimental Display name: `Prompt caching` Indicates how prompt cache has been used when handling the request.	`read`; `write`
`gen_ai.provider.name`	string	experimental Display name: `Provider name` Name of GenAI product being used.	`aws_bedrock`; `openai`
`gen_ai.request.encoding_formats`	string[]	experimental Display name: `Request encoding formats` The encoding formats requested in an embeddings operation, if specified.	`['base64']`; `['float', 'binary']`
`gen_ai.request.frequency_penalty`	double	experimental Display name: `Request frequency penalty` Frequency penalty setting for GenAI request.	`0.4`
`gen_ai.request.max_tokens`	long	experimental Display name: `Request max tokens` Maximum number of tokens that the model can generate for a request.	`50`
`gen_ai.request.model`	string	experimental Display name: `Request model` Model chosen to handle the request.	`amazon.nova-micro-v1:0`; `anthropic.claude-3-7-sonnet-20250219-v1:0`
`gen_ai.request.presence_penalty`	double	experimental Display name: `Request presence penalty` Presence penalty setting for GenAI request.	`0.4`
`gen_ai.request.service_tier`	string	experimental Display name: `Request service tier` Service tier requested.	`auto`; `priority`; `flex`
`gen_ai.request.stop_sequences`	string[]	experimental Display name: `Request stop sequences` List of sequences that will stop the model from generating further tokens.	`['forest', 'lived']`
`gen_ai.request.temperature`	double	experimental Display name: `Request temperature` Temperature setting for GenAI request.	`0.8`
`gen_ai.request.top_k`	long	experimental Display name: `Request top k` Temperature setting for GenAI request.	`300`
`gen_ai.request.top_p`	double	experimental Display name: `Request top p` Temperature setting for GenAI request.	`0.6`
`gen_ai.response.finish_reasons`	string[]	experimental Display name: `Response finish reasons` List of reasons why the model stopped generating tokens, corresponding to each generation received.	`['stop_sequence']`; `['stop_sequence', 'max_tokens']`
`gen_ai.response.id`	string	experimental Display name: `Response ID` Unique identifier of an LLM response.	`resp_0e7d0475962f0d2800691dd8cbf8108190b45198f77fa12d6e`
`gen_ai.response.model`	string	experimental Display name: `Response model` Model that handled the request.	`amazon.nova-micro-v1:0`; `anthropic.claude-3-7-sonnet-20250219-v1:0`
`gen_ai.response.service_tier`	string	experimental Display name: `Response service tier` The service tier used for the response.	`default`; `priority`; `flex`
`gen_ai.response.system_fingerprint`	string	experimental Display name: `Response system fingerprint` Identifier of system used to generate LLM response.	`fp_03e44fcc34`
`gen_ai.system_instructions`	record[]	experimental Display name: `System instructions` List of all system prompts passed to the LLM, which are not part of input messages list.	`{'type': 'text', 'content': 'You are a helpful assistant.'}`
`gen_ai.usage.input_tokens`	long	experimental Display name: `Input tokens` Number of tokens sent to the model in the request.	`42`
`gen_ai.usage.output_tokens`	long	experimental Display name: `Output tokens` Number of tokens generated by the model while handling the request.	`42`
`gen_ai.usage.prompt_caching.read_tokens`	long	experimental Display name: `Prompt caching read tokens` Number of tokens that has been read from cache.	`42`
`gen_ai.usage.prompt_caching.write_tokens`	long	experimental Display name: `Prompt caching write tokens` Number of tokens used to generate cache checkpoint.	`42`

gen_ai.operation.kind has the following list of well-known values. If one of them applies, then the respective value MUST be used, otherwise a custom value MAY be used.

Value	Description	Display name
`agent`	Operation invoking an autonomous component that can make decisions or perform actions.	Agent
`retrieval`	Operation collecting documents for a RAG pipeline.	Retrieval
`task`	A specific operation or step within a workflow.	Task
`tool`	Operation invoking a utility or function used within the application.	Tool call
`workflow`	A high-level process or chain of operations.	Workflow

gen_ai.operation.name has the following list of well-known values. If one of them applies, then the respective value MUST be used, otherwise a custom value MAY be used.

Value	Description	Display name
`chat`	Operation of engaging in a conversational exchange with LLM.	Chat
`embeddings`	Operation of creating embeddings from user input.	Embeddings
`text_completion`	Operation of completing text based on user input by LLM.	Text Completion

gen_ai.prompt_caching has the following list of well-known values. If one of them applies, then the respective value MUST be used, otherwise a custom value MAY be used.

Value	Description	Display name
`read`	Cache hit. Reading from cache.	Read
`write`	Cache miss. Creating cache checkpoint.	Write

gen_ai.provider.name has the following list of well-known values. If one of them applies, then the respective value MUST be used, otherwise a custom value MAY be used.

Value	Description	Display name
`aws_bedrock`	Amazon Bedrock	Amazon Bedrock
`openai`	OpenAI	OpenAI

Geolocation

The geo namespace contains geo location information. This section only holds all currently agreed upon fields in the Dynatrace Semantic Dictionary. Aligned closely to the ECS, with some adaptions around field groupings

Geolocation fields

Attribute	Type	Description	Examples
`geo.city.name`	string	resource stable Display name: `City` English name of the city.	`Montreal`
`geo.continent.code`	string	resource stable Two-letter code representing the name of the continent.	`NA`
`geo.continent.name`	string	resource stable Display name: `Continent` English name of the continent.	`North America`
`geo.country.iso_code`	string	resource stable Display name: `Country ISO code` The two-letter country code. The format complies with ISO 3166-1 alpha-2.	`CA`; `GB`
`geo.country.name`	string	resource stable Display name: `Country` English name of the country.	`Canada`
`geo.location.accuracy_radius`	long	resource stable The accuracy radius in kilometers.	`20`
`geo.location.latitude`	double	resource stable Display name: `Latitude` The approximate latitude. The format complies with WGS 84. Tags: `sensitive-user-events`	`45.505918`
`geo.location.longitude`	double	resource stable Display name: `Longitude` The approximate longitude. The format complies with WGS 84. Tags: `sensitive-user-events`	`-73.61483`
`geo.region.iso_code`	string	resource stable ISO 3166-2 region code. In case a country has multiple subdivision categories, the field contains the subdivision category preferred by Dynatrace.	`CA-QC`; `GB-CAM`
`geo.region.name`	string	resource stable Display name: `Region` English name of the region.	`Quebec`

GlassFish

GlassFish fields

Attribute	Type	Description	Examples
`glassfish.domain.name`	string	resource experimental Display name: `Glassfish domain name` The name of the domain this instance belongs to.
`glassfish.instance.name`	string	resource experimental Display name: `Glassfish instance name` The instance's name.

Go

Go fields

Attribute	Type	Description	Examples
`go.linkage`	string	resource experimental Display name: `Go linkage`

Host

Host naming

Dynatrace aims to use the best fitting name for the field host.name. See below, how Dynatrace determines the host name in an ordered by precedence fashion:

1. Customized host name

Dynatrace supports customizing the host.name property. A custom set host name takes precedence over the auto detection mechanisms described further down.

Place a configuration file containing the desired name in a specific directory as described in this Documentation
Alternatively, the oneagentctl tool can be used to set a custom host name. See Documentation for details.

2. Kubernetes node name

If no customized name is set locally, the OneAgent attempts to determine if we're deployed by Dynatrace Operator in Kubernetes or OpenShift and sets host.name to the name of the Node.

3. Cloud vendor metadata

If the Kubernetes isn't present, the OneAgent attempts to determine the host.name value by accessing cloud metadata where applicable.

AWS EC2:
- If access to EC2 tags was granted (see AWS Documentation) and a tag with a key name (case insensitive) is found, the tag's value is used as the host.name.
Azure VM:
- The VM's name (case insensitive) instance metadata property is used. See Microsoft Azure documentation
Google Compute Engine:
- The VM's hostname instance metadata property is used. See Google Cloud documentation.

4a. Linux & AIX

The result of the system call to the standard C library's gethostname() if it can be interpreted as a fully qualified domain name (FQDN) and doesn't contain "localhost".
Otherwise, a system call to getaddrinfo() for port 80 is issued, again sanity checking whether the returned name is an FQDN and doesn't contain "localhost".
If a correct hostname still hasn't been identified, but the system call to gethostname() was successful, and the returned string is not empty and doesn't contain "localhost", then it's used.
Defaults to the string EmptyHostName if neither property can be resolved.

4b. Windows

On Windows, the system call GetComputerNameExA is used to determine a host's name. In particular, the resulting name is composed of <hostname>.<domainname> with the following details
- hostname = ComputerNameDnsHostname retrieved by GetComputerNameEx
- domainname = ComputerNameDnsDomain retrieved by GetComputerNameEx
The result of the system call GetComputerNameExA is used when it can be interpreted as a fully qualified domain name (FQDN).
Otherwise, the result of the system call GetComputerNameExA is used when it's not empty.
Defaults to the string EmptyHostName if neither property can be resolved.

Host fields

Attribute	Type	Description	Examples
`host.arch`	string	resource experimental The architecture of the host system.	`amd64`; `arm64`
`host.cpu.model.name`	string	resource experimental The model name of the host CPU.	`11th Gen Intel(R) Core(TM) i7-1185G7 @ 3.00GHz`
`host.fqdn`	string[]	resource experimental Display name: `Host FQDN` A list of FQDNs of this host.	`['ec2-43-213-176-3.compute-1.amazonaws.com', 'localhost.example.com']`
`host.has_public_traffic`	boolean	resource experimental Indicates whether the host has public traffic detected via eBPF Discovery. ¹	`true`
`host.id`	string	resource experimental The unique host identifier reported by the monitored system.	`fdbf79e8af94cb7f9e8df36789187052`
`host.ip`	ipAddress[]	resource experimental Display name: `Host IP` A list of IP adresses (IPv4 or IPv6) of this host.	`[194.232.104.141, 2a01:468:1000:9::140]`
`host.logical.cpus`	long	resource experimental Display name: `Logical cpus` Logical CPUs on the monitored host. Applies to AIX LPARs.	`8`
`host.mac`	array	resource experimental Display name: `Host MAC address` A list of MAC adresses associated with this host.	`4C:03:4F:5B:E8:89`; `00:15:5D:2F:1C:2A`
`host.name`	string	resource experimental Display name: `Host name` The host name as determined on the data source (for instance, OneAgent, extensions or OpenTelemetry). Important: This is not the name of the host entity, which can be modified based on naming rules. Tags: `permission`	`ip-10-178-54-32.ec2.internal`
`host.physical.memory`	long	resource experimental Display name: `Physical memory` Physical memory of the monitored host, expressed in bytes. The value might be different than the total available memory, if features such as Active Memory Expansion are used.	`8141684736`
`host.simultaneous.multithreading`	long	resource experimental Display name: `Simultaneous multithreading` Number of threads for AIX Simultaneous Multithreading feature.	`4`
`host.type`	string	resource experimental Display name: `Host type` Virtual Machine type, such as SKU on Azure	`Standard_D2s_v3`; `m5.large`; `n1-standard-4`
`host.virtual.cpus`	long	resource experimental Display name: `Virtual cpus` Number of virtual CPUs for AIX LPAR.	`2`

This field is supported only on Linux hosts with eBPF Discovery enabled and OneAgent installed in Full-stack or Infrastructure mode.

HTTP

HTTP span fields

Attribute	Type	Description	Examples
`http.request.body.size`	long	stable Display name: `Request body size` The size of the request payload body in bytes. This is the number of bytes transferred excluding headers and is often, but not always, present as the Content-Length header. For requests using transport encoding, this should be the compressed size.	`3495`
`http.request.header.__key__`	string	stable Display name: `HTTP request header` HTTP request headers, `__key__` being the lowercase HTTP header name, for example, "http.request.header.accept-encoding". The value is a string. If multiple headers have the same name or multiple header values, the values will be comma-separated into a single string. Tags: `sensitive-spans`	`https://www.foo.bar/`; `gzip, deflate, br`; `1.2.3.4, 1.2.3.5`
`http.request.id`	string	experimental Display name: `Request ID` String that uniquely identifies a request.	`SOX4xwn4XV6Q4rgb7XiVGOHms_BGlTAC4KyHmureZmBNrjGdRLiNIQ==`; `k6WGMNkEzR5BEM_SaF47gjtX9zBDO2m349OY2an0QPEaUum1ZOLrow==`
`http.request.method`	string	stable Display name: `HTTP method` HTTP request method.	`GET`; `POST`; `HEAD`
`http.request.parameter.__key__`	string	stable Display name: `HTTP request parameter` HTTP request parameters, `__key__` for example, "http.request.parameter.username". The value is a string. If there are multiple parameters with the same name or multiple parameter values, the values will be a single, comma-separated string.	`admin`; `premium`
`http.request.size`	long	experimental Display name: `Request size` The total size of the request in bytes. This value should be the total number of bytes sent over the wire, including the request line (HTTP/1.1), framing (HTTP/2 and HTTP/3), headers, and request body if any.	`114`; `702`
`http.response.body.size`	long	stable Display name: `Response body size` The size of the response payload body in bytes. This is the number of bytes transferred excluding headers and is often, but not always, present as the Content-Length header. For requests using transport encoding, this should be the compressed size.	`3495`
`http.response.header.__key__`	string	stable Display name: `HTTP response header` HTTP response headers, `__key__` being the lowercase HTTP header name, for example, "http.response.header.content-type". The value is a string. If multiple headers have the same name or multiple header values, the values will be comma-separated into a single string.	`909`; `text/html; charset=utf-8`; `abc, def`
`http.response.range_end_value`	long	experimental Display name: `Response range end` When the response contains the HTTP Content-Range header, this field contains the range end value.	`499`; `1999`
`http.response.range_start_value`	long	experimental Display name: `Response range start` When the response contains the HTTP Content-Range header, this field contains the range start value.	`0`; `1000`
`http.response.reason_phrase`	string	experimental Display name: `Response reason phrase` The HTTP reason phrase (HTTP1 only).	`Not found`
`http.response.size`	long	experimental Display name: `Response size` The total size of the response in bytes. This value should be the total number of bytes sent over the wire, including the status line (HTTP/1.1), framing (HTTP/2 and HTTP/3), headers, and response body and trailers if any.	`251`; `608`
`http.response.status_code`	long	stable Display name: `HTTP status code` HTTP response status code.	`200`
`http.response.time_to_first_byte`	double	experimental Display name: `Time to first byte` Time between the browser requesting a page and when it receives the first byte of information from the server.	`0.022`; `0.071`
`http.route`	string	stable Display name: `HTTP route` The matched route (path template in the format used by the respective server framework).	`/users/:userID?`; `Home/Index/{id?}`

HTTP resource fields

Attribute	Type	Description	Examples
`http.server_name`	string	resource experimental Display name: `HTTP server name` The server name as configured by the webserver if available. If no such name exists, this is the local hostname and bound port. In Kubernetes, the base pod name is used.	`MyServer`; `localhost:8000`

Hybris

Hybris fields

Attribute	Type	Description	Examples
`hybris.bin.dir`	string	resource experimental Display name: `Hybris bin directory`	`/opt/hybris-60/hybris/bin`
`hybris.config.dir`	string	resource experimental Display name: `Hybris config directory`	`/opt/hybris-60/hybris/config`
`hybris.data.dir`	string	resource experimental Display name: `Hybris data directory`	`/opt/hybris-60/hybris/data`

IBM

IBM fields

Attribute	Type	Description	Examples
`ibm.ace.integration_node.name`	string	resource experimental Display name: `IBM App Connect Enterprise integration node name` The name of the integration node (broker) that manages one or more integration servers.	`myIntegrationNode`; `YourBroker`; `the_management_instance`
`ibm.ace.integration_server.name`	string	resource experimental Display name: `IBM App Connect Enterprise integration server name` The name of the broker-managed or standalone integration server (formerly known as execution group or dataflow engine).	`myIntegrationServer`; `YourExecutionGroup`; `dataflow_engine`
`ibm.cics.aor`	string	resource experimental Display name: `IBM CICS application-owning region`
`ibm.cics.program`	string	resource experimental Display name: `IBM CICS program` The name of the CICS program.	`EDUCHAN`
`ibm.cics.region`	string	resource experimental Display name: `IBM CICS region`
`ibm.cics.tor`	string	resource experimental Display name: `IBM CICS terminal-owning region`
`ibm.ctg.name`	string	resource experimental Display name: `IBM CICS Transaction Gateway`
`ibm.ims.connect`	string	resource experimental Display name: `IBM IMS Connect`
`ibm.ims.control`	string	resource experimental Display name: `IBM IMS control`
`ibm.ims.mpr`	string	resource experimental Display name: `IBM IMS message processing region`
`ibm.ims.soap_gw.name`	string	resource experimental Display name: `IBM IMS SOAP gateway`

IIS

IIS fields

Attribute	Type	Description	Examples
`iis.app_pool.name`	string	resource experimental Display name: `IIS application pool name`
`iis.role.name`	string	resource experimental Display name: `IIS role name`

Java

Java fields

Attribute	Type	Description
`java.jar.file`	string	resource experimental Display name: `Java jar file`
`java.jar.path`	string	resource experimental Display name: `Java jar path`
`java.main.class`	string	resource experimental Display name: `Java main class`
`java.main.module`	string	resource experimental Display name: `Java main module`

JBoss

JBoss fields

Attribute	Type	Description	Examples
`jboss.home`	string	resource experimental Display name: `JBoss home directory` The instance's home directory.
`jboss.mode`	string	resource experimental Display name: `JBoss operating mode` The instance's operating mode.	`org.jboss.as.standalone`; `org.jboss.as.server`
`jboss.server.name`	string	resource experimental Display name: `JBoss server name` The instance's server name.

JDBC

JDBC fields

Attribute	Type	Description	Examples
`jdbc.connection.pool.name`	string	stable Display name: `JDBC connection pool name` The name of the JDBC connection pool.	`jdbc/db2`

Journald

Journald fields

Attribute	Type	Description	Examples
`journald.unit`	string	experimental Display name: `Journald unit` A unit is a systemd object that performs or controls a particular task or action; concerns unix-based systems	`cron.service`; `oneagent.service`; `kubepods.slice`

Kubernetes

Kubernetes fields

Attribute	Type	Description	Examples
`k8s.cluster.name`	string	resource stable Display name: `Kubernetes cluster name` The user-defined name of the cluster in Dynatrace. Doesn't need to be unique or immutable. Tags: `permission` `primary-field`	`unguard-dev`; `acme-prod10`
`k8s.cluster.uid`	string	resource stable Display name: `Kubernetes cluster UID` A pseudo-ID for the cluster, by default set to the UID of the kube-system namespace.	`1c7a24c7-ff51-46e0-bcc9-c52637ceec57`
`k8s.configmap.name`	string	resource experimental Display name: `Kubernetes ConfigMap name` Name of the ConfigMap.	`my-configmap`
`k8s.container.name`	string	resource stable Display name: `Kubernetes container name` The name of the container from the pod specification; must be unique within a pod. Container runtime usually uses different globally unique name (`container.name`).	`redis`
`k8s.container.type`	string	resource experimental Display name: `Kubernetes container type` The type of the Kubernetes container.	`app`; `init`; `sidecar`; `ephemeral`
`k8s.cronjob.name`	string	resource experimental Display name: `Kubernetes CronJob name` Name of the CronJob.	`my-cronjob`
`k8s.customresourcedefinition.name`	string	resource experimental Display name: `Kubernetes CustomResourceDefinition name` Name of the CustomResourceDefinition.	`dynakubes.dynatrace.com`
`k8s.daemonset.name`	string	resource experimental Display name: `Kubernetes DaemonSet name` Name of the DaemonSet.	`my-daemonset`
`k8s.deployment.name`	string	resource experimental Display name: `Kubernetes Deployment name` Name of the Deployment.	`my-deployment`
`k8s.deploymentconfig.name`	string	resource experimental Display name: `Kubernetes DeploymentConfig name` Name of the DeploymentConfig.	`my-deploymentconfig`
`k8s.dynakube.name`	string	resource experimental Display name: `Kubernetes DynaKube name` Name of the DynaKube.	`my-dynakube`
`k8s.edgeconnect.name`	string	resource experimental Display name: `Kubernetes EdgeConnect name` Name of the EdgeConnect.	`my-edgeconnect`
`k8s.event.involved_object.kind`	string	resource experimental The kind of the Kubernetes object that triggered the event.	`Pod`; `Node`; `Deployment`; `ReplicaSet`
`k8s.event.reason`	string	resource experimental The reason the Kubernetes event was generated.	`Created`; `OOMKilling`; `BackOff`; `FailedScheduling`
`k8s.event.type`	string	resource experimental The type of the Kubernetes event.	`Normal`; `Warning`
`k8s.horizontalpodautoscaler.name`	string	resource experimental Display name: `Kubernetes HorizontalPodAutoscaler name` Name of the HorizontalPodAutoscaler.	`my-horizontalpodautoscaler`
`k8s.ingress.name`	string	resource experimental Display name: `Kubernetes Ingress name` Name of the Ingress.	`my-ingress`
`k8s.job.name`	string	resource experimental Display name: `Kubernetes Job name` Name of the Job.	`my-job`
`k8s.namespace.name`	string	resource stable Display name: `Kubernetes namespace name` The name of the namespace that the pod is running in. Tags: `permission` `primary-field`	`default`; `kube-system`
`k8s.namespace.uid`	string	resource experimental Display name: `Kubernetes namespace UID` The UID of the namespace.	`bfb1ba44-3bcb-467d-a2dc-188fd74d1db5`
`k8s.network_interface.name`	string	resource experimental The name of the network interface on the pod.	`eth0`; `lo`
`k8s.networkpolicy.name`	string	resource experimental Display name: `Kubernetes NetworkPolicy name` Name of the NetworkPolicy.	`my-networkpolicy`
`k8s.node.name`	string	resource stable Display name: `Kubernetes node name` Name of the node.	`cluster-pool-1-c3c7423d-azth`
`k8s.persistentvolume.name`	string	resource experimental Display name: `Kubernetes PersistentVolume name` Name of the PersistentVolume.	`my-persistentvolume`
`k8s.persistentvolumeclaim.name`	string	resource experimental Display name: `Kubernetes PersistentVolumeClaim name` Name of the PersistentVolumeClaim.	`my-persistentvolumeclaim`
`k8s.pod.deletion_timestamp`	timestamp	resource experimental The RFC 3339 date and time at which the Pod will be deleted.	`2026-04-01T10:15:30Z`
`k8s.pod.name`	string	resource stable Display name: `Kubernetes pod name` The name of the pod.	`checkoutservice-7895755b94-mzs5m`
`k8s.pod.phase`	string	resource experimental The pod phase is a simple status showing where a Pod is in its lifecycle.	`Failed`; `Pending`; `Running`; `Succeeded`; `Unknown`
`k8s.pod.uid`	string	resource stable Display name: `Kubernetes pod UID` The UID of the pod.	`275ecb36-5aa8-4c2a-9c47-d8bb681b9aff`
`k8s.replicaset.name`	string	resource experimental Display name: `Kubernetes ReplicaSet name` Name of the ReplicaSet.	`my-replicaset`
`k8s.replicationcontroller.name`	string	resource experimental Display name: `Kubernetes ReplicationController name` Name of the ReplicationController.	`my-replicationcontroller`
`k8s.resourcequota.name`	string	resource experimental Name of the ResourceQuota.	`my-resourcequota`
`k8s.secret.name`	string	resource experimental Display name: `Kubernetes Secret name` Name of the Secret.	`my-secret`
`k8s.service.name`	string	resource stable Display name: `Kubernetes service name` The name of the Kubernetes service.	`my-service`
`k8s.statefulset.name`	string	resource experimental Display name: `Kubernetes StatefulSet name` Name of the StatefulSet.	`my-statefulset`
`k8s.workload.kind`	string	resource stable Display name: `Kubernetes workload kind` The type of the workload. The value is the Kubernetes object kind of the workload in lowercase.	`deployment`; `statefulset`; `cronjob`; `job`; `daemonset`; `replicaset`
`k8s.workload.name`	string	resource stable Display name: `Kubernetes workload name` The name of the workload.	`checkoutservice`
`k8s.workload.uid`	string	resource experimental Display name: `Kubernetes workload UID` The UID of the workload.	`786a41e4-e673-44bb-bb30-18888f797a2b`

k8s.event.type MUST be one of the following:

Value	Description
`Normal`	Informational event indicating normal operation.
`Warning`	Event indicating something went wrong or may go wrong.

k8s.pod.phase MUST be one of the following:

Value	Description
`Failed`	At least one container terminated with an error (non-zero exit code).
`Pending`	Pod is created but not yet running.
`Running`	Pod is scheduled on a node and at least one container is running.
`Succeeded`	All containers finished successfully (exit code 0) and won’t restart.
`Unknown`	Pod state cannot be determined (usually communication issue with node).

Kubernetes custom labels and annotations fields

Attribute	Type	Description	Examples
`k8s.namespace.annotation.__attribute_name__`	string	resource experimental Display name: `Kubernetes namespace annotation` Kubernetes namespace annotation that should be enriched on ingest signals and service metrics. The __attribute_name__ is a placeholder that can freely be chosen.	`k8s.namespace.annotation.team=a_team`
`k8s.namespace.label.__attribute_name__`	string	resource experimental Display name: `Kubernetes namespace label` Kubernetes namespace label that should be enriched on ingest signals and service metrics. The __attribute_name__ is a placeholder that can freely be chosen.	`k8s.namespace.label.env=dev`
`k8s.pod.annotation.__attribute_name__`	string	resource experimental Display name: `Kubernetes pod annotation` Kubernetes pod annotation that should be enriched on ingest signals and service metrics. The __attribute_name__ is a placeholder that can freely be chosen.	`k8s.pod.annotation.team=a_team`
`k8s.pod.label.__attribute_name__`	string	resource experimental Display name: `Kubernetes pod label` Kubernetes pod label that should be enriched on ingest signals and service metrics. The __attribute_name__ is a placeholder that can freely be chosen.	`k8s.pod.label.env=dev`
`k8s.workload.annotation.__attribute_name__`	string	resource experimental Display name: `Kubernetes workload annotation` Kubernetes workload annotation that should be enriched on ingest signals and service metrics. The __attribute_name__ is a placeholder that can freely be chosen.	`k8s.workload.annotation.team=a_team`
`k8s.workload.label.__attribute_name__`	string	resource experimental Display name: `Kubernetes workload label` Kubernetes workload label that should be enriched on ingest signals and service metrics. The __attribute_name__ is a placeholder that can freely be chosen.	`k8s.workload.label.env=dev`

Kubernetes status and condition dimension fields

Attribute	Type	Description	Examples
`condition_reason`	string	resource experimental The reason string for the current condition status.	`KubeletReady`; `NodeStatusUnknown`; `MinimumReplicasAvailable`
`condition_status`	string	resource experimental The status of the condition (True, False, or Unknown).	`true`; `false`; `Unknown`
`container_state`	string	resource experimental The current state of the container.	`running`; `waiting`; `terminated`
`last_exit_code`	string	resource experimental The exit code of the last container termination.	`0`; `1`; `137`
`node_condition`	string	resource experimental The type of the Kubernetes node condition being reported.	`Ready`; `DiskPressure`; `MemoryPressure`; `PIDPressure`; `NetworkUnavailable`
`node_condition_disk_pressure`	string	resource experimental Status of the node DiskPressure condition (True, False, or Unknown).	`true`; `false`; `Unknown`
`node_condition_memory_pressure`	string	resource experimental Status of the node MemoryPressure condition (True, False, or Unknown).	`true`; `false`; `Unknown`
`node_condition_network_unavailable`	string	resource experimental Status of the node NetworkUnavailable condition (True, False, or Unknown).	`true`; `false`; `Unknown`
`node_condition_pid_pressure`	string	resource experimental Status of the node PIDPressure condition (True, False, or Unknown).	`true`; `false`; `Unknown`
`node_condition_ready`	string	resource experimental Status of the node Ready condition (True, False, or Unknown).	`true`; `false`; `Unknown`
`pod_condition`	string	resource experimental The type of the Kubernetes pod condition.	`Ready`; `ContainersReady`; `PodScheduled`; `Initialized`
`pod_phase`	string	resource experimental The current lifecycle phase of the pod as reported by the extension.	`Pending`; `Running`; `Succeeded`; `Failed`; `Unknown`
`pod_status`	string	resource experimental The human-readable status string of the pod.	`Running`; `CrashLoopBackOff`; `OOMKilled`; `Terminating`
`pod_status_reason`	string	resource experimental The reason for the current pod status.	`Evicted`; `OOMKilled`; `Error`
`workload_condition`	string	resource experimental The type of the Kubernetes workload condition being reported.	`Available`; `Progressing`; `ReplicaFailure`

Apache Kafka

Apache Kafka fields

Attribute	Type	Description	Examples
`messaging.kafka.broker_id`	string	experimental Display name: `Kafka broker ID` The ID of the Kafka broker.	`0`; `1`; `2`
`messaging.kafka.component`	string	experimental Display name: `Kafka component` The component of the Kafka Connect worker.	`GroupCoordinator 1`
`messaging.kafka.connect.connector_name`	string	experimental Display name: `Kafka Connect connector name` The name of the Kafka Connect connector.	`my-s3-connector`; `jdbc-source-connector`
`messaging.kafka.connect.task_id`	string	experimental Display name: `Kafka Connect task ID` The ID of the Kafka Connect task.	`0`; `1`; `2`
`messaging.kafka.connect.worker_id`	string	experimental Display name: `Kafka Connect worker ID` The ID of the Kafka Connect worker.	`10.0.0.1:8083`; `worker-1`

Log events

Fields relevant for log events

Log event fields

Attribute	Type	Description	Examples
`log.file.name`	string	experimental Display name: `Log file name` The basename of the file.	`messages`; `agent.log`
`log.file.path`	string	experimental Display name: `Log file path` The full path to the file.	`/var/log/messages`; `/var/log/dynatrace/agent.log`
`log.iostream`	string	stable Display name: `Log I/O stream` The I/O stream to which the log was emitted.	`stdout`; `stderr`
`log.logger`	string	experimental Display name: `Logger name` The name of the logger inside an application. This name is usually the name of the class that initialized the logger, but it can be a custom name.	`main.logger`; `kafka.server.KafkaServer`
`log.raw_level`	string	experimental Display name: `Raw log level` The original severity level of the log entry as recorded by the source, before standardization into the log.level format. ¹	`silly`; `verbose`
`log.record.uid`	string	experimental Unique identifier of the log record. Records sharing the same uid are considered duplicates and may be safely deduplicated. Two distinct log records MUST have different uid values. When logs are ingested from an external tool, this attribute will hold the original vendor log ID.	`c42dbd31-17b5-4270-b1a7-824a52e0d0e9`
`log.source`	string	stable Display name: `Log source` Human-readable attribute that identifies a log stream. ² Tags: `permission`	`/var/log/messages`; `Windows Event Log`; `Docker Container Output`; `stdout`
`log.source.binary_files_state`	string	experimental Display name: `Log source binary files state` Proportion of monitored files in this log source that were detected as binary and skipped: None means no binary files, Partial means some, Fully means all. ³	`None`; `Partial`; `Fully`
`log.source.file_status`	string	experimental Display name: `Log source file status` The field represents the current monitoring state of a log source.	`OK`; `NOT_EXIST`; `BINARY`
`log.source.ingest_status`	string	experimental Display name: `Log source ingest status` The field represents the log content ingestion status.	`Ingested`; `Not ingested`; `Partially ingested`
`log.source.origin`	string	stable Display name: `Log source origin` The log source origin indicates where the log derives from.	`CUSTOM`; `IIS_LOG_DETECTOR`
`loglevel`	string	stable Display name: `Log level` The log event severity level.	`ERROR`; `INFO`; `TRACE`

The log.raw_level can vary in type depending on the log entry. It may be represented as a string in some cases or as an integer (for example, 30, 40, 50) in others.

Can contain, for example, a file path, standard output, or an URI etc., depending on the log stream type. The value should be stable for one logical source (for example, not affected by log file rotation digits).

Unlike log.source.file_status, which reflects the overall health status of the log source, this field aggregates binary detection across all individual files monitored by the source.

log.iostream MUST be one of the following:

Value	Description	Display name
`stderr`	std_err	Standard Error
`stdout`	std_out	Standard Out

log.source.binary_files_state MUST be one of the following:

Value	Description	Display name
`Fully`	All monitored files in this log source are binary and were skipped.	Fully
`None`	No binary files were detected among the monitored files, or binary acceptance is enabled for this source.	No binary files
`Partial`	Some but not all monitored files are binary and were skipped.	Partial

log.source.origin MUST be one of the following:

Value	Description	Display name
`CONTAINER_LOG_DETECTOR`	Container log detector.	Container Log Detector
`CUSTOM_LOG`	Custom log source configuration.	Custom Log
`EVENT_CHANNEL_DETECTOR`	Event Log channel detector.	Event Log Channel Detector
`IIS_LOG_DETECTOR`	IIS log detector.	IIS Log Detector
`JOURNALD_LOG_DETECTOR`	Journald log detector.	Journald Log Detector
`OPEN_LOG_DETECTOR`	Open log file detector.	Open Log Detector
`SYSTEM_LOG_DETECTOR`	System log detector.	System Log Detector

loglevel MUST be one of the following:

Value	Description	Display name
`ALERT`	alert	Alert
`CRITICAL`	critical	Critical
`DEBUG`	debug	Debug
`EMERGENCY`	emergency	Emergency
`ERROR`	error	Error
`FATAL`	fatal	Fatal
`INFO`	info	Info
`NONE`	none	No level
`NOTICE`	notice	Notice
`SEVERE`	severe	Severe
`TRACE`	trace	Trace
`WARN`	warn	Warn

Messaging

Messaging fields

Attribute	Type	Description	Examples
`messaging.batch.failed_count`	long	experimental Display name: `Batch failed count` The number of messages in the batch for which publishing failed.	`1`; `3`; `15`
`messaging.batch.failure_codes`	string[]	experimental Display name: `Batch failure codes` The vendor-provided error codes explaining why an operation on the message broker failed. To limit attribute size, not all error codes might be included.	`['MalformedDetail', 'InvalidArgument']`
`messaging.batch.message_count`	long	stable Display name: `Batch message count` The number of messages sent, received, or processed in the scope of the batching operation.	`1`; `2`; `3`
`messaging.client.id`	string	stable Display name: `Client ID` A unique identifier for the client that consumes or produces a message.	`aclient`; `myhost@68d46b89c9-c29qc`
`messaging.consumer.group.name`	string	stable Display name: `Consumer group name` The name of the consumer group with which a consumer is associated.	`my-group`; `indexer`
`messaging.destination.kind`	string	deprecated Display name: `Destination kind` The kind of message destination	`queue`; `topic`
`messaging.destination.manager_name`	string	stable Display name: `Destination Manager name` The destination's manager name ¹	`MyBroker`
`messaging.destination.name`	string	stable Display name: `Destination name` The message destination name ²	`MyQueue`; `MyTopic`
`messaging.destination.partition.id`	string	stable Display name: `Destination partition ID` String representation of the partition ID the message is sent to or received from.	`1`
`messaging.destination.subscription.name`	string	experimental The name of the subscription from which the message is received, applicable to topic-based messaging systems. ³	`my-subscription`; `orders-subscription`
`messaging.destination.temporary`	boolean	stable Display name: `Temporary destination` A boolean that is true if the message destination is temporary and might not exist anymore after messages are processed.
`messaging.is_failed`	boolean	deprecatedReplaced by `transaction.is_failed` in combination with `transaction.is_message_processing`. Display name: `Is Failed` Indicates that the messaging operation is considered failed according to the failure detection rules. Only present if the `messaging.operation.type` is `process`.
`messaging.message.body.size`	long	stable Display name: `Message body size` The (uncompressed) size of the message payload in bytes.	`2738`
`messaging.message.conversation_id`	string	stable Display name: `Conversation ID` The conversation ID identifying the conversation to which the message belongs, represented as a string. Sometimes called "Correlation ID".	`MyConversationId`
`messaging.message.delivery_count`	long	experimental Display name: `Message delivery count` The number of deliveries of the message.	`1`; `4`
`messaging.message.enqueued_time`	timestamp	experimental Display name: `Message enqueued time` The timestamp when the message was enqueued in the destination.	`1649822520123123123`
`messaging.message.header.__key__`	record	stable Display name: `Messaging message header` The message headers, `__key__` being the message header/attribute name, for example, "messaging.message.header.ExtendedPayloadSize". The data type of the value depends on the attribute.	`1024, "my-eu-bucket-3", ["a", "b"]`
`messaging.message.id`	string	stable Display name: `Message ID` A value used by the messaging system as an identifier for the message, represented as a string.	`452a7c7c7c7048c2f887f61572b18fc2`
`messaging.operation.type`	string	stable Display name: `Messaging operation type` A string identifying the kind of messaging operation.	`peek`
`messaging.source.kind`	string	deprecated Display name: `Source kind` The kind of message source	`queue`; `topic`
`messaging.source.manager_name`	string	deprecatedReplaced by `messaging.destination.manager_name`. Display name: `Source Manager Name` The source's manager name ⁴	`MyBroker`
`messaging.source.name`	string	deprecatedReplaced by `messaging.destination.name`. Display name: `Source Name` The message source name ⁵	`MyQueue`; `MyTopic`
`messaging.source.temporary`	boolean	deprecatedReplaced by `messaging.destination.temporary`. Display name: `Temporary Source` A boolean that is true if the message source is temporary and might not exist anymore after messages are processed.
`messaging.system`	string	stable Display name: `Messaging system` An identifier for the messaging system. See below for a list of well-known identifiers.	`kafka`; `rabbitmq`

Manager name uniquely identifies the broker.

Destination name uniquely identifies a specific queue, topic or other entity within the broker.

Subscription name identifies a specific subscription to a topic within the messaging system. Applicable to systems such as Azure Service Bus and Google Cloud Pub/Sub.

⁴

Manager name uniquely identifies the broker.

⁵

Source name uniquely identifies a specific queue, topic, or other entity within the broker.

messaging.destination.kind MUST be one of the following:

Value	Description	Display name
`queue`	A message sent to or received from a queue	Queue
`topic`	A message sent to or received from a topic	Topic

messaging.operation.type has the following list of well-known values. If one of them applies, then the respective value MUST be used, otherwise a custom value MAY be used.

Value	Description	Display name
`peek`	A message is received from a destination by a message consumer/server, but left there (`span.kind` is "consumer").	Peek
`process`	A message previously received from a destination is processed by a message consumer (`span.kind` is "consumer").	Process
`publish`	A message is sent to a destination by a message producer (`span.kind` is "producer").	Publish
`receive`	A message is received from a destination by a message consumer (`span.kind` is "consumer").	Receive

messaging.source.kind MUST be one of the following:

Value	Description	Display name
`queue`	A message received from a queue	Queue
`topic`	A message received from a topic	Topic

messaging.system has the following list of well-known values. If one of them applies, then the respective value MUST be used, otherwise a custom value MAY be used.

Value	Description	Display name
`activemq`	ActiveMQ	ActiveMQ
`artemis`	ActiveMQ Artemis	ActiveMQ Artemis
`aws_eventbridge`	Amazon EventBridge	AWS EventBridge
`aws_sns`	Amazon Simple Notification Service (SNS)	AWS SNS
`aws_sqs`	Amazon Simple Queue Service (SQS)	AWS SQS
`azure_eventgrid`	Azure Event Grid	Azure Event Grid
`azure_eventhubs`	Azure Event Hubs	Azure Event Hub
`azure_iothub`	Azure IoT Hub	Azure IoT Hub
`azure_servicebus`	Azure Service Bus	Azure Service Bus
`gcp_pubsub`	Google Cloud Pub/Sub	GCP Pub/Sub
`hornetq`	HornetQ	HornetQ
`jms`	Java Message Service	JMS
`kafka`	Apache Kafka	Kafka
`mqseries`	IBM MQ	IBM MQ
`msmq`	MSMQ	MSMQ
`rabbitmq`	RabbitMQ	RabbitMQ
`rocketmq`	Apache RocketMQ	RocketMQ
`sag_webmethods_is`	Software AG, webMethods Integration Server	webMethods IS
`tibco_ems`	Tibco EMS	TIBCO EMS
`weblogic`	Oracle WebLogic	WebLogic
`websphere`	IBM WebSphere Application Server	WebSphere

Akka messaging fields

Attribute	Type	Description	Examples
`messaging.akka.actor.kind`	string	experimental Display name: `Akka actor kind` Name of the top-level actor. See The Akka actor hierarchy	`system`; `user`
`messaging.akka.actor.path`	string	experimental Display name: `Akka actor path` Path to actor inside actor system.	`/system/log1-Logging$DefaultLogger`; `/remote/akka.tcp/RequesterSystem@localhost:52133/user/requestActor/$a`
`messaging.akka.actor.system`	string	experimental Display name: `Akka actor system` Name of the actor system.	`RequesterSystem`; `ResponseSystem`
`messaging.akka.actor.type`	string	experimental Display name: `Akka actor type` Fully qualified type name of actor.	`com.acme.RespondingActor`
`messaging.akka.message.type`	string	experimental Display name: `Akka message type` Fully qualified type name of the message.	`java.lang.String`; `akka.event.Logging$Info2`; `com.acme.twosuds.ResponseActor$RequestMessage`

Kafka messaging fields

Attribute	Type	Description	Examples
`messaging.kafka.message.key`	string	experimental Display name: `Kafka message key` The `key` property of the message.	`mykey`
`messaging.kafka.message.tombstone`	boolean	experimental Display name: `Kafka tombstone` A boolean that is true if the message is a tombstone. ¹	`true`
`messaging.kafka.offset`	long	experimental Display name: `Kafka offset` The offset of the message.	`42`

If the message is a tombstone, the value is true. When missing, the value is assumed to be false.

Metric

Metric fields

Attribute	Type	Description	Examples
`metric.key`	string	stable Display name: `Metric key` The identifier of a metric, grouping numeric measurements that share the same measurement semantics (i.e. were measured "the same way".) Tags: `permission`	`dt.host.cpu.usage`
`metric.type`	string	stable Display name: `Metric type` Identifies the type of metric and therefore the timeseries rollup functions it supports.	`summary_stats`

metric.type MUST be one of the following:

Value	Description	Display name
`histogram`	Identifies a metrics record supporting minimum, maximum, average, sum, count, and percentile timeseries rollup functions.	Histogram
`summary_stats`	Identifies a metrics record supporting minimum, maximum, average, sum, and count timeseries rollup functions.	Summary Stats

Module insights

Module insights fields

In webserver technologies a multitude of modules might be contributing to handling a single web request. Module insights provides timings for these, where available.

Attribute	Type	Description	Examples
`module_insights.modules`	record	experimental Display name: `Module insights modules` Modules executed as part of this web request, represented as map from module name to duration in nanoseconds spent.	`{'HttpRedirectionModule': 10299, 'BasicAuthenticationModule': 4665}`

Network

Network fields

These attributes may be used for any network related operation.

Attribute	Type	Description	Examples
`network.carrier.name`	string	experimental Display name: `Carrier name` The mobile carrier name.	`Magenta`; `AT&T`
`network.connection.subtype`	string	experimental Display name: `Connection subtype` Further details that specify `network.connection.type`, such as the cellular or WI-FI technology.	`lte`; `802.11x`
`network.connection.type`	string	experimental Display name: `Connection type` The internet connection type.	`cell`; `wifi`
`network.local.address`	ipAddress	experimental Display name: `Local address` Local address of the network connection.	`10.102.0.45`
`network.peer.ip`	ipAddress	experimental Display name: `Peer IP` The immediate peer IP address of the network connection. This is the IP address of the other side of the socket connection.	`140.78.100.116`; `172.16.11.1`; `2a01:468:1000:9::140`
`network.peer.port`	long	experimental Display name: `Peer port` The immediate peer port number of the network connection. This is the port number of the other side of the socket connection.	`49158`; `65531`; `443`
`network.protocol.name`	string	stable Display name: `Network protocol` OSI Application Layer or non-OSI equivalent.	`amqp`; `http`; `mqtt`
`network.protocol.number`	long	experimental Display name: `Network protocol number` The IANA protocol number of the traffic. For more information, see Assigned Internet Protocol Numbers.	`3`; `10`
`network.protocol.version`	string	experimental Display name: `Network protocol version` Version of the application layer protocol used.	`1.1`; `3.1.1`
`network.proxy_chain`	record[]	experimental Display name: `Proxy chain` Information about proxies or load balancers between a client and a server, parsed out from `Forwarded` or `X-Forwarded-For (XFF)` HTTP headers. Each element in the list is a record with `ip` (type ipAddress) and `port` (type long) attributes that denote the intermediary. Port is optional; if it's not available, no `port` attribute is present in the record.	`[{'ip': '172.16.1.80', 'port': 3128}, {'ip': '18.66.233.23'}, {'ip': '2001:db8::aa:bb'}]`
`network.transport`	string	stable Display name: `Network transport` OSI Transport Layer or Inter-process Communication method	`tcp`; `udp`
`network.type`	string	stable Display name: `Network type` OSI Network Layer or non-OSI equivalent.	`ipv4`; `ipv6`

network.connection.type has the following list of well-known values. If one of them applies, then the respective value MUST be used, otherwise a custom value MAY be used.

Value	Description	Display name
`cell`	cell	Cellular
`unavailable`	unavailable	Unavailable
`unknown`	unknown	Unknown
`wifi`	wifi	Wi-Fi
`wired`	wired	Wired

network.transport has the following list of well-known values. If one of them applies, then the respective value MUST be used, otherwise a custom value MAY be used.

Value	Description	Display name
`inproc`	In-process communication. ¹	In-Process
`other`	Something else (non-IP-based).	Other
`pipe`	Named or anonymous pipe.	Pipe
`tcp`	TCP	TCP
`udp`	UDP	UDP
`unix`	Unix domain socket.	Unix Domain Socket

Signals that there is only in-process communication not using a "real" network protocol in cases where network attributes would typically be expected. Usually, all other network attributes can be left out.

network.type has the following list of well-known values. If one of them applies, then the respective value MUST be used, otherwise a custom value MAY be used.

Value	Description	Display name
`ipv4`	IPv4	IPv4
`ipv6`	IPv6	IPv6

Network device

Network device fields

Fields that are used in extensions to describe network devices.

Attribute	Type	Description	Examples
`device`	string	resource deprecatedUsed in Extension Framework 2.0 Address (IP address with port) used by a monitored device to communicate with an extension.	`10.102.0.45:161`
`device.address`	ipAddress	resource deprecatedUsed in Extension Framework 2.0 IP address used by a monitored device to communicate with an extension.	`10.102.0.45`
`device.name`	string	resource deprecatedUsed in Extension Framework 2.0 Name of a device monitored by an extension.	`AT1i-WLC-TestingLab.dynatrace.org`
`device.port`	string	resource deprecatedUsed in Extension Framework 2.0 Port used by a monitored device to communicate with an extension.	`161`

Network flow

Network flow fields

Fields relevant for network flows.

Attribute	Type	Description	Examples
`network_flow.bytes.rx`	long	experimental Display name: `Bytes received` Number of bytes (octets) received during given interval, direction: to Process (PGI).
`network_flow.bytes.tx`	long	experimental Display name: `Bytes transmitted` Number of bytes (octets) transmitted during given interval, direction: from Process (PGI).
`network_flow.destination.address`	ipAddress	experimental Display name: `Destination address` Destination IP address. By convention, destination means TCP server (acceptor of the connection).	`192.33.1.2`; `2001:0db8:85a3:0000:0000:8a2e:0370:7334`
`network_flow.destination.port`	long	experimental Display name: `Destination port` Flow destination port. By convention, destination port means TCP server (acceptor of the connection).	`22`; `8080`
`network_flow.network.transport`	string	experimental Display name: `Network transport protocol` Protocol	`TCP`; `other`; `UDP`
`network_flow.network.type`	string	experimental Display name: `Network type` IP protocol version.	`IPV4`
`network_flow.packets.retransmitted.base.rx`	long	experimental Display name: `Packets retransmission base (rx)` Number of packets received, used as the base for retransmission rate, direction: to Process (PGI).
`network_flow.packets.retransmitted.base.tx`	long	experimental Display name: `Packets retransmission base (tx)` Number of packets sent, used as the base for retransmission rate, direction: from Process (PGI).
`network_flow.packets.retransmitted.rx`	long	experimental Display name: `Packets retransmitted (rx)` Number of retransmitted packets during given interval, direction: to Process (PGI).
`network_flow.packets.retransmitted.tx`	long	experimental Display name: `Packets retransmitted (tx)` Number of retransmitted packets during given interval, direction: from Process (PGI).
`network_flow.packets.rx`	long	experimental Display name: `Packets received` Number of packets received during given interval, direction: to Process (PGI).
`network_flow.packets.tx`	long	experimental Display name: `Packets transmitted` Number of packets transmitted during given interval, direction: from Process (PGI).
`network_flow.process_is_server`	boolean	experimental Display name: `Process is server` Indicates whether the entity (Process) is acting as a server in the network flow.	`true`; `false`
`network_flow.source.address`	ipAddress	experimental Display name: `Source address` Source IP address. By convention, source means TCP client (initiator of the connection).	`192.33.1.2`; `2001:0db8:85a3:0000:0000:8a2e:0370:7334`
`network_flow.tcp.rtt`	duration	experimental Display name: `TCP RTT` Mean RTT value [ms].
`network_flow.tcp.rtt.ack`	duration	experimental Display name: `TCP RTT ack` Mean RTT ack value [ms].
`network_flow.tcp.sessions.new`	long	experimental Display name: `New TCP sessions` Number of new TCP sessions in the flow.
`network_flow.tcp.sessions.reset`	long	experimental Display name: `Reset TCP sessions` Number of reset (rejected) TCP sessions in the flow.
`network_flow.tcp.sessions.timeout`	long	experimental Display name: `Timed out TCP sessions` Number of timed out TCP sessions in flow.

network_flow.network.type has the following list of well-known values. If one of them applies, then the respective value MUST be used, otherwise a custom value MAY be used.

Value	Description	Display name
`IPV4`	ipv4	IPv4
`IPV6`	ipv6	IPv6

Network interface

Network interface fields

Attribute	Type	Description	Examples
`network_interface.name`	string	resource experimental The name of the Smartscape network interface.	`eth0`; `ens192`; `Ethernet 1`

Node.js

Node.js fields

Attribute	Type	Description
`nodejs.app.base.dir`	string	resource experimental Display name: `Node.js application base directory`
`nodejs.app.name`	string	resource experimental Display name: `Node.js application name`
`nodejs.script.name`	string	resource experimental Display name: `Node.js script name`

Observed timestamp

Observed timestamp signal fields

Signal-level fields for observed timestamp telemetry.

Attribute	Type	Description	Examples
`observed_timestamp`	long	stable Display name: `Observed event timestamp` The timestamp (in epoch nanoseconds) when the event was observed. ¹	`1741768500000000000`

In OTel Log Data Model, observed_timestamp is a structural field (not an attribute key). Dynatrace normalizes this into the attribute bag for query consistency.

OpenSearch

OpenSearch fields

Attribute	Type	Description	Examples
`opensearch.document_id`	string	experimental Display name: `OpenSearch document ID` ID of the document stored in OpenSearch.	`2kuZ25sBo9KPhzL41rsg`
`opensearch.id`	string	experimental Display name: `OpenSearch ID` X-Opaque-Id http header if one was used.	`152220`
`opensearch.index`	string	experimental Display name: `OpenSearch index` The name of the OpenSearch index.	`opensearch-index`; `index-2024.01.01`
`opensearch.node_id`	string	experimental Display name: `OpenSearch node ID` The ID of the node.	`80f333333b31623f94213a9a43cef6b1`
`opensearch.routing`	string	experimental Display name: `OpenSearch routing` Custom routing value.	`user42`
`opensearch.shard_id`	string	experimental Display name: `OpenSearch shard ID` The ID of the OpenSearch shard.	`VzblS9m1Q9CBaTHoEbKLnT`
`opensearch.stats`	string	experimental Display name: `OpenSearch stats` Search group defined in the query.	`autocomplete`; `dashboard_query`
`opensearch.took`	string	experimental Display name: `OpenSearch took` Execution time of the request.	`56ms`
`opensearch.took_millis`	string	experimental Display name: `OpenSearch took millis` Execution time of the request.	`56`
`opensearch.total_hits`	string	experimental Display name: `OpenSearch total hits` Total number of hits returned by the search.	`0 hits`; `4 hits`
`opensearch.total_shards`	string	experimental Display name: `OpenSearch total shards` Total number of shards.	`1`; `9`

OpenStack

OpenStack fields

Fields that can come from applications running on OpenStack.

Attribute	Type	Description	Examples
`openstack.availability_zone`	string	resource experimental Display name: `OpenStack availability zone` A specific availability zone in the given OpenStack region.	`us-east-1a`
`openstack.instance_uuid`	string	resource experimental Display name: `OpenStack instance UUID` UUID of specific OpenStack instance.	`6790cb48-f8e9-4773-bcea-001469de0599`

Origin

Origin fields

The origin of a request associated with this event.

Attribute	Type	Description	Examples
`origin.address`	string	experimental Display name: `Origin address` Source IP address of the request associated with this event. Must be set if origin.type is 'REST', must not be set otherwise.	`10.11.12.13`
`origin.session`	string	experimental Display name: `Origin session` The ID of the browser session (if present) associated with the event.	`node0hfznc`
`origin.type`	string	experimental Display name: `Origin type` Origin type of the request associated with this event.	`REST`; `LOCAL`
`origin.x_forwarded_for`	string	experimental Display name: `Origin x-forwarded-for` The verbatim value of the X-Forwarded-For HTTP request header (if present) of the request associated with the event.	`1.2.3.4`

origin.type MUST be one of the following:

Value	Description	Display name
`LOCAL`	The event provider issued the request locally.	Local
`RECOVERY`	The event provider issued the request locally as part of disaster recovery.	Recovery
`REST`	The event provider received an external REST API call.	REST

OS

The os namespace contains information on the operating system running an application.

OS fields

Attribute	Type	Description	Examples
`os.architecture`	string	resource experimental Display name: `OS architecture` Architecture of the CPU, discovered from the operating system.	`X86`
`os.build_id`	string	resource experimental The operating system build identifier.	`6.8.0-124-generic`
`os.description`	string	resource experimental The human-readable description of the operating system.	`Ubuntu 22.04.5 LTS`
`os.name`	string	resource stable Display name: `OS name` The OS name in a short, human-readable format.	`iOS`
`os.type`	string	resource experimental Display name: `OS type` Type of discovered operating system.	`LINUX`; `WINDOWS`
`os.version`	string	resource stable Display name: `OS version` The complete OS version, including patch, build, and other information.	`15.3.1`; `Ubuntu 16.04.7 LTS (Xenial Xerus) (kernel 4.15.0-206-generic)`; `Windows Server 2022 Datacenter 21H2 2009, ver. 10.0.20348`

OS service

OS service fields

Attribute	Type	Description	Examples
`os_service.alerting`	boolean	experimental Display name: `OS service alerting` Boolean attribute deciding whether the service status triggers alerts or not.
`os_service.status`	string	experimental Display name: `OS service status` Current running state.	`activating`

os_service.status MUST be one of the following:

Value	Description	Display name
`activating`	Service is activating.	Activating
`active`	Service is active.	Active
`continue_pending`	Service continues pending.	Continue Pending
`deactivating`	Service is deactivating.	Deactivating
`failed`	Service failed to start.	Failed
`inactive`	Service is inactive.	Inactive
`pause_pending`	Service paused pending.	Pause Pending
`paused`	Service is currently paused.	Paused
`reloading`	Service is reloading.	Reloading
`running`	Service is currently running.	Running
`start_pending`	Service started pending.	Start Pending
`stop_pending`	Service stopped pending.	Stop Pending
`stopped`	Service is currently stopped.	Stopped

OS service resource fields

Attribute	Type	Description	Examples
`os_service.display_name`	string	resource experimental Human-readable name of the service. On Windows, this is the display name as reported by the Service Control Manager, which may differ from os_service.name (e.g., name: `wuauserv`, display_name: `Windows Update`). On Linux, this value is the same as os_service.name.	`My OS Service`
`os_service.manufacturer`	string	resource experimental Display name: `OS service manufacturer` Manufacturer of the service. On Linux based systems, the value will always be `-`, meaning empty.	`-`; `SSH Corp.`
`os_service.name`	string	resource experimental Display name: `OS service name` Unique OS service name. On Windows, this is the short programmatic key as reported by the Service Control Manager (e.g., `wuauserv`), which may differ from display name (e.g., `Windows Update`). On Linux, this is the systemd unit name (e.g., `nginx.service`).	`myosservice`
`os_service.path`	string	resource experimental Display name: `OS service path` The full path to the process executable. On Linux based systems, this can be set to the target of `proc/[pid]/exe`. On Windows, it can be set to the result of `GetProcessImageFileNameW`.	`/usr/bin/cmd/otelcol`
`os_service.startup_type`	string	resource experimental Display name: `OS service startup type` Current startup type.	`auto`

os_service.startup_type MUST be one of the following:

Value	Description	Display name
`auto`	Windows specific. Automatic: The service starts at system logon.	Auto
`auto_delay`	Windows specific. Automatic (Delayed Start): The service starts a short while after the system has finished starting up.	Auto Delay
`auto_delay_trigger`	Windows specific. Automatic (Delayed Start, Trigger Start)	Auto Delay Trigger
`auto_trigger`	Windows specific. Automatic (Trigger Start): This service will start automatically at boot.	Auto Trigger
`disabled`	Linux specific. Service is configured to not start when the system boots, but can be started manually, or as a dependency of another service.	Disabled
`enabled`	Linux specific. Service is marked for starting up on boot.	Enabled
`enabled-runtime`	Linux specific. Service is marked for starting up on boot.	Enabled Runtime
`indirect`	Linux specific. Service is not enabled directly but can be activated via dependencies or aliases.
`linked`	Linux specific. Service unit file is symlinked into systemd from an external location persistently.
`linked-runtime`	Linux specific. Service unit file is temporarily symlinked into systemd for the current runtime only.
`manual`	Windows specific. Manual: The service starts only when explicitly summoned.	Manual
`manual_trigger`	Windows specific. Manual (Trigger Start): This service will not start automatically at boot.	Manual Trigger
`static`	Linux specific. Service is not enabled and can only start when pulled in by dependencies or started manually.	Static

OpenTelemetry scope

OpenTelemetry scope fields

Attribute	Type	Description	Examples
`otel.scope.name`	string	stable Display name: `OTel scope name` The name of the instrumentation scope - (`InstrumentationScope.Name` in OTLP).	`io.opentelemetry.contrib.mongodb`
`otel.scope.version`	string	stable Display name: `OTel scope version` The version of the instrumentation scope - (`InstrumentationScope.Version` in OTLP).	`1.0.0`

PHP

PHP fields

Attribute	Type	Description
`php.cli.script.path`	string	resource experimental Display name: `Php cli script path`
`php.cli.working.dir`	string	resource experimental Display name: `Php cli working directory`
`php.drupal.application.name`	string	resource experimental Display name: `Php Drupal application name`
`php.fpm.pool.name`	string	resource experimental Display name: `Php fpm pool name`
`php.symfony.application.name`	string	resource experimental Display name: `Php Symfony application name`
`php.wordpress.blog.name`	string	resource experimental Display name: `Php Wordpress blog name` also see https://developer.wordpress.org/reference/functions/get\_bloginfo/

PostgreSQL

PostgreSQL fields

Attribute	Type	Description	Examples
`postgresql.session.id`	string	experimental Display name: `PostgreSQL session ID` A unique ID to identify a PostgreSQL database session.	`00112233-4455-6677-8899-aabbccddeeff`

Primary Grail tags

Primary Grail tags fields

Primary Grail tags are a small set of important, customer-selected tags—such as Kubernetes labels, AWS/Azure tags, or key organizational attributes—that Dynatrace automatically attaches to all raw telemetry data at ingest, using the primary_tags.* prefix. This enrichment enables fast, consistent filtering, grouping, and permission management across all data, without complex joins or proprietary tagging rules. Primary Grail tags are centrally configured and ensure that cloud-native and business-relevant metadata is always available for queries, dashboards, and access control.

Attribute	Type	Description	Examples
`primary_tags.__key__`	string	resource experimental Display name: `Primary tag` Primary Grail tags are used to tag a resource in a meaningful way. `__key__` is populated with the tag name, for example, `primary_tags.ownership`. In case of single-value tags, the value is a string. In case of multi-value tags, the value is an array of strings.	`team-alpha`; `team-bravo`

Process

Process fields

Attribute	Type	Description	Examples
`process.bitness`	string	resource experimental Display name: `Process bitness` The architecture of the monitored entity in terms of how many bits compose a basic value.	`64`
`process.command`	string	resource experimental Display name: `Command` The command used to launch the process (the command name). On Linux-based systems, can be set to the zeroth string in `/proc/[pid]/cmdline`. On Windows, can be set to the first parameter extracted from `GetCommandLineW`.	`cmd/otelcol`; `python3`; `cmd.exe`
`process.command_args`	string[]	resource experimental Display name: `Command arguments` All the command arguments (including the command/executable itself) as received by the process. On Linux-based systems, can be set according to the list of null-delimited strings extracted from `/proc/[pid]/cmdline`. For libc-based executables, this would be the full argv vector passed to main.	`['/usr/bin/python3', 'script.py', '--verbose', '--output', '/tmp/results.json']`; `['C:\\Windows\\System32\\cmd.exe', '/c', 'whoami']`
`process.command_line`	string	resource experimental Display name: `Command line` The full command used to launch the process as a single string representing the full command. On Windows, can be set to the result of `GetCommandLineW`. Do not set this if you have to assemble it just for monitoring; use `process.command_args` instead.	`/usr/bin/python3 script.py --verbose --output /tmp/results.json`; `C:\Windows\System32\cmd.exe /c whoami`
`process.containerized`	boolean	resource experimental Display name: `Is containerized` True if given process is running inside container.
`process.end`	timestamp	resource experimental Display name: `Process end` Timestamp of when the process terminated, in ISO 8601 format with millisecond precision and UTC timezone. Only populated in process termination events or in retrospective enrichment. On Windows, available via `GetProcessTimes`.	`2025-01-15T10:35:22.417Z`
`process.executable.name`	string	resource experimental Display name: `Executable name` The name of the process executable. On Linux based systems, can be set to the `Name` in `proc/[pid]/status`. On Windows, can be set to the base name of `GetProcessImageFileNameW`.	`otelcol`
`process.executable.path`	string	resource experimental Display name: `Executable path` The full path to the process executable. On Linux-based systems, can be set to the target of `proc/[pid]/exe`. On Windows, can be set to the result of `GetProcessImageFileNameW`.	`/usr/bin/cmd/otelcol`
`process.has_public_traffic`	boolean	resource experimental Indicates whether the process has public traffic detected via eBPF Discovery. ¹	`true`
`process.listen_ports`	array	resource experimental Display name: `Listen ports` An array of open listen ports.	`50000`; `50001`; `50002`; `50003`
`process.metadata`	record	resource experimental Display name: `Process metadata` It contains a diagnostic collection of input parameters that were used or could have been used in assigning processes to the process entity.	`NODE_JS_APP_BASE_DIRECTORY:C:/home/site/wwwroot`
`process.metadata.id_keys`	array	resource experimental Display name: `Process metadata ID keys` Keys of non-ignored input parameters used to calculate the process entity ID.	`['NODE_JS_APP_BASE_DIRECTORY', 'EXE_NAME', 'PYTHON_SCRIPT_PATH']`
`process.name`	string	resource experimental The name of the Smartscape process.	`java`; `nginx`; `python3`
`process.parent.command_args`	string[]	resource experimental Display name: `Parent command arguments` All the command arguments (including the command/executable itself) as received by the parent process.	`['/usr/bin/bash', '-l']`; `['C:\\Windows\\explorer.exe']`
`process.parent.command_line`	string	resource experimental Display name: `Parent command line` The full command line used to launch the parent process.	`/usr/bin/bash -l`; `C:\Windows\explorer.exe`
`process.parent.end`	timestamp	resource experimental Display name: `Parent process end` Timestamp of when the parent process terminated, in ISO 8601 format. May be empty if the parent process is still running.	`2025-01-15T12:00:00.000Z`
`process.parent.executable.name`	string	resource experimental Display name: `Parent executable name` The name of the parent process executable.	`bash`; `explorer.exe`
`process.parent.executable.path`	string	resource experimental Display name: `Parent executable path` Full filesystem path to the parent process executable, including the filename.	`/usr/bin/bash`; `C:\Windows\explorer.exe`
`process.parent.pid`	long	resource experimental Display name: `Parent pid` Operating system process identifier of the parent process. Subject to the same PID reuse caveat as `process.pid`.	`1`; `5678`
`process.parent.start`	timestamp	resource experimental Display name: `Parent process start` Timestamp of when the parent process was started, in ISO 8601 format.	`2025-01-15T08:00:00.000Z`
`process.parent.unique_id`	string	resource experimental Display name: `Parent unique ID` Globally unique identifier for the parent process instance. Same generation mechanism and uniqueness guarantees as `process.unique_id`.	`c3d2e1f0-9a8b-7c6d-5e4f-3a2b1c0d9e8f`
`process.parent.user.id`	string	resource experimental Display name: `Parent user ID` The user ID under which the parent process was executing.	`0`; `S-1-5-18`
`process.parent.working_directory`	string	resource experimental Display name: `Parent working directory` The working directory of the parent process at its creation time.	`/root`; `C:\Windows\System32`
`process.pid`	long	resource experimental Display name: `Process ID` Process Identifier (PID) as observed by the monitored process.	`1234`
`process.start`	timestamp	resource experimental Display name: `Process start` Timestamp of when the process was started, in ISO 8601 format with millisecond precision and UTC timezone. On Linux, derivable from `/proc/[pid]/stat` start time combined with system boot time. On Windows, available via `GetProcessTimes`.	`2025-01-15T10:30:00.000Z`
`process.unique_id`	string	resource experimental Display name: `Unique process ID` Globally unique identifier for this specific process instance. Unlike `process.pid`, this value is never reused and uniquely identifies the process across its entire lifetime. Generation mechanism is implementation-defined (for example, UUID, hash of pid+start_time+host_id, Sysmon ProcessGuid).	`8a4f500d-1ca8-5d73-a7f3-1b2c4e5f6a7b`
`process.user.id`	string	resource experimental Display name: `User ID` The user ID under which the process is executing. On Linux, this is the numeric UID (for example, from `/proc/[pid]/status` Uid field, real UID). On Windows, this is the SID of the process token owner. Stored as string to accommodate both numeric UIDs and Windows SID format.	`1000`; `0`; `S-1-5-21-1234567890-1234567890-1234567890-1001`
`process.working_directory`	string	resource experimental Display name: `Working directory` The working directory of the process at creation time. On Linux, corresponds to `/proc/[pid]/cwd` at process start. Captures the initial state (subsequent `chdir()` calls are not reflected.) Includes a trailing separator where the OS convention dictates one.	`/home/user/project`; `C:\Users\admin\Documents`

This field is supported only on Linux hosts with eBPF Discovery enabled and OneAgent installed on the host.

RabbitMQ

RabbitMQ fields

Attribute	Type	Description	Examples
`rabbitmq.function.arity`	long	experimental Display name: `RabbitMQ function arity` The number of arguments the `rabbitmq.function.name` takes.	`2`; `5`
`rabbitmq.function.name`	string	experimental Display name: `RabbitMQ function name` The name of the RabbitMQ function within the `rabbitmq.module.name` that generated the log entry.	`start_it`; `main`
`rabbitmq.module.name`	string	experimental Display name: `RabbitMQ module name` The name of the RabbitMQ module that generated the log entry.	`rabbit`; `my_module`
`rabbitmq.pid`	string	experimental Display name: `RabbitMQ process ID` ID of the Erlang process.	`0.58.0`; `1.20.4`

Redis

Redis fields

Attribute	Type	Description	Examples
`redis.role`	string	experimental Display name: `Redis role` The role of the Redis process (for example, 'M' for Master or 'X' for sentinel).	`C`

redis.role MUST be one of the following:

Value	Description	Display name
`C`	Child process for persistence (RDB/AOF).	Child
`M`	Master Redis process.	Master
`R`	Replica Redis process.	Replica
`X`	Sentinel monitoring process.	Sentinel

Request

Request fields

Attribute	Type	Description	Examples
`request.is_failed`	boolean	deprecatedReplaced by `transaction.is_failed` in combination with `transaction.is_endpoint_request`. Indicates that the request is considered failed according to the failure detection rules. Only present on the request root span.
`request.is_root_span`	boolean	deprecatedReplaced by `transaction.is_root_span` in combination with `transaction.is_endpoint_request`. Marks the root of a request. It's the first span and starts the request within a service.

Request attribute

Request attribute fields

Request scoped attributes (e.g. method parameters, return values, class names, …) captured by the OneAgent based on a request attribute definition. The actual name of the attribute is the prefix "request_attribute" plus the "request attribute name" defined in the request attributes configuration. Request attributes are built based on captured attributes and other attributes like HTTP header values or "normal" span attributes, on which the aggregations (first/last value, distinct values, ...), type conversion and normalizations defined in the request attribute configuration are performed. They are evaluated for an entire request (possibly consisting of multiple spans) and are stored only on the request root node.

Attribute	Type	Description	Examples
`request_attribute.__attribute_name__`	array	stable Display name: `Request attribute` Contains the request scoped reconciled values of the attribute named `__attribute_name__` defined by the request attribute configuration. The data type of the value depends on the request attribute definition. Tags: `sensitive-spans`	`42`; `Platinum`; `['Product A', 'Product B']`; `['Special Offer', '1702']`

Remote Procedure Calls (RPC)

RPC fields

Attribute	Type	Description	Examples
`rpc.method`	string	experimental Display name: `RPC method` The name of the (logical) method being called ¹	`exampleMethod`
`rpc.namespace`	string	experimental Display name: `RPC namespace` The namespace of the method being called. In SOAP, it would be the XML namespace.	`tempuri.org`
`rpc.service`	string	experimental Display name: `RPC service` The full (logical) name of the service being called, including its package name, if applicable. ²	`myservice.EchoService`
`rpc.system`	string	experimental Display name: `RPC system` A string identifying the remoting system or framework. See below for a list of well-known identifiers.	`apache_cxf`; `dotnet_wcf`; `grpc`; `jax_ws`

This is the logical name of the method from the RPC interface perspective, which can be different from the name of any implementing method/function. The code.function attribute may be used to store the latter (e.g., method executing the call on the server side, RPC client stub method on the client side).

This is the logical name of the service from the RPC interface perspective, which can be different from the name of any implementing class. The code.namespace attribute may be used to store the latter (despite the attribute name, it may include a class name, e.g., class with method executing actually executing the call on the server side, RPC client stub class on the client side).

rpc.system has the following list of well-known values. If one of them applies, then the respective value MUST be used, otherwise a custom value MAY be used.

Value	Description	Display name
`apache_axis`	Apache Axis	Apache Axis
`apache_cxf`	Apache CXF	Apache CXF
`apache_wink`	Apache Wink	Apache Wink
`aws_api`	AWS API	AWS API
`azure_api`	Azure API	Azure API
`dotnet_remoting`	.NET Remoting	.NET Remoting
`dotnet_wcf`	.NET WCF	.NET WCF
`grpc`	gRPC	gRPC
`java_rmi`	Java RMI	Java RMI
`jax_ws`	JAX-WS	JAX-WS
`jboss`	JBoss	JBoss
`jersey`	Jersey	Jersey
`openedge`	Progress OpenEdge	OpenEdge
`resteasy`	JBoss RESTEasy	RESTEasy
`restlet`	Restlet	Restlet
`spring_ws`	Spring Web Services	Spring Web Services
`tibco_ws`	Tibco Web Services	Tibco Web Services
`weblogic_ws`	WebLogic Web Services	WebLogic Web Services
`webmethods`	Webmethods	Webmethods

gRPC fields

Attribute	Type	Description	Examples
`rpc.grpc.status_code`	long	experimental Display name: `GRPC status code` The numeric status code of the gRPC request.

Server

Server fields

The server namespace contains information on the server side of a network connection.

Attribute	Type	Description	Examples
`server.address`	string	stable Display name: `Server address` Logical server hostname, matches server FQDN if available, and IP or socket address if FQDN is not known.	`example.com`
`server.port`	long	stable Display name: `Server port` Logical server port number.	`65123`; `80`
`server.resolved_ips`	ipAddress[]	stable Display name: `Server resolved ips` A list of IP addresses that are the result of DNS resolution of `server.address`.	`[194.232.104.141, 2a01:468:1000:9::140]`

Service

Service fields

Attribute	Type	Description	Examples
`service.name`	string	resource stable Display name: `OTel service name` The logical name of the service.	`shoppingcart`
`service.namespace`	string	resource experimental A string value helping to distinguish a group of services, for example the team, system, or application the service belongs to. Scopes `service.name` so that two services can share a name only if they are in different namespaces. For example, a `Shop` namespace and a `Checkout` namespace could each have their own `frontend` service without collision. Services with no namespace must have globally unique names or be split by other attributes such as `k8s.cluster.uid` and `k8s.namespace.name`.	`Shop`; `Checkout`

Servlet

Servlet fields

Attribute	Type	Description	Examples
`servlet.context.name`	string	resource experimental Display name: `Servlet context name` also see https://docs.oracle.com/javaee/6/api/javax/servlet/ServletContext.html#getServletContextName
`servlet.context.path`	string	resource experimental Display name: `Servlet context path` also see https://docs.oracle.com/javaee/6/api/javax/servlet/ServletContext.html#getContextPath

SNMP

SNMP fields

Fields that are used in SNMP extensions.

Attribute	Type	Description	Examples
`snmp.ip`	string	resource stable An IP address that is enabled for SNMP queries on the device.	`10.0.0.1`
`snmp.sys_object_id`	string	resource stable Display name: `SNMP system object ID` OID 1.3.6.1.2.1.1.2 (SNMPv2-MIB::sysObjectId): The vendor's authoritative identification of the network management subsystem contained in the entity.	`1.3.6.1.4.1.25461.2.3.38`; `1.3.6.1.4.1.9.1.1046`
`trap_oid`	string	resource deprecatedUsed in Extension Framework 2.0 Display name: `SNMP trap OID` The trap OID of a given event.	`SNMPv2-MIB::coldStart`
`version`	string	resource deprecatedUsed in Extension Framework 2.0 Display name: `SNMP version` The SNMP version.	`SNMPv3`

Snowflake

Snowflake account signal fields

Signal-level fields for Snowflake account telemetry.

Attribute	Type	Description	Examples
`snowflake.account.locator`	string	experimental Display name: `Snowflake account locator` The account locator identifier for the Snowflake account.	`ABC12345`
`snowflake.account.name`	string	stable Display name: `Snowflake account name` The name of the Snowflake account within the organization.	`MYORG-ACCOUNT1`
`snowflake.account.region`	string	stable Display name: `Snowflake account region` The cloud region of the Snowflake account performing the data transfer.	`US_EAST_1`

Snowflake budget signal fields

Signal-level fields for Snowflake budget telemetry.

Attribute	Type	Description	Examples
`snowflake.budget.created_on`	long	stable Display name: `Snowflake budget creation time` The timestamp when the budget was created.	`1732981199999000000`
`snowflake.budget.full_name`	string	experimental Display name: `Snowflake fully qualified budget name` Fully-qualified name of the budget (DATABASE.SCHEMA.NAME).	`ANALYTICS_DB.BUDGETS.MONTHLY_BUDGET`
`snowflake.budget.name`	string	stable Display name: `Snowflake budget name` Name of the budget.	`monthly_budget`
`snowflake.budget.owner.name`	string	stable Display name: `Snowflake budget owner name` The owner of the budget, typically the user or role responsible for managing the budget.	`budget_admin`
`snowflake.budget.owner.role_type`	string	experimental Display name: `Snowflake budget owner role type` The principal type of the budget owner: ROLE or APPLICATION.	`ROLE`
`snowflake.budget.resource`	string[]	stable Display name: `Snowflake budget resource` The resources linked to the budget, such as databases, warehouses, or other Snowflake objects that the budget monitors. ¹	`['DATABASE1', 'WAREHOUSE1']`

Array of resource names (databases, warehouses) in this budget group, stored as string[] in Grail.

Snowflake cluster signal fields

Signal-level fields for Snowflake cluster telemetry.

Attribute	Type	Description	Examples
`snowflake.cluster_number`	long	experimental Display name: `Snowflake warehouse cluster number` The warehouse cluster number associated with the query.	`1`

Snowflake copy signal fields

Signal-level fields for Snowflake copy telemetry.

Attribute	Type	Description	Examples
`snowflake.copy.errors.limit`	long	experimental Display name: `Snowflake copy error limit` Error limit for the COPY.	`1`
`snowflake.copy.file_name`	string	experimental Display name: `Snowflake copy source file name` Source file name.	`data/file_20250312.csv.gz`
`snowflake.copy.first_commit_time`	long	experimental Display name: `Snowflake copy first commit time` When the first chunk of the file was committed.	`1741772160000000000`
`snowflake.copy.first_error.character_position`	long	experimental Display name: `Snowflake copy first error character position` Character position of first error.	`128`
`snowflake.copy.first_error.column_name`	string	experimental Display name: `Snowflake copy first error column name` Column name causing the first error.	`AMOUNT`
`snowflake.copy.first_error.line_number`	long	experimental Display name: `Snowflake copy first error line number` Line number of first error.	`42`
`snowflake.copy.first_error.message`	string	experimental Display name: `Snowflake copy first error message` First error message for failed loads.	`Number of columns in file (3) does not match that of the corresponding table (4)`
`snowflake.copy.pipe.received_time`	long	experimental Display name: `Snowflake pipe file received time` When file was received by Snowpipe (view-only).	`1741772100000000000`
`snowflake.copy.stage_location`	string	experimental Display name: `Snowflake copy stage location` Stage location (ACCOUNT_USAGE view-only).	`s3://my-bucket/data/`
`snowflake.copy.status`	string	experimental Display name: `Snowflake copy status` Load status of the COPY INTO operation.	`LOADED`

snowflake.copy.status has the following list of well-known values. If one of them applies, then the respective value MUST be used, otherwise a custom value MAY be used.

Value	Description
`LOADED`	File loaded successfully.
`LOAD_FAILED`	File load failed with errors.
`PARTIALLY_LOADED`	File partially loaded; some rows failed.

Snowflake cost attribution signal fields

Signal-level fields for Snowflake cost attribution telemetry.

Attribute	Type	Description	Examples
`snowflake.cost_attribution.period_end`	long	experimental Display name: `Snowflake cost attribution period end` End of the cost attribution summary window.	`1730844667000000000`
`snowflake.cost_attribution.period_start`	long	experimental Display name: `Snowflake cost attribution period start` Start of the cost attribution summary window.	`1730841067000000000`

Snowflake database signal fields

Signal-level fields for Snowflake database telemetry.

Attribute	Type	Description	Examples
`snowflake.database.id`	long	stable Display name: `Snowflake database ID` The unique identifier of the database involved in the query. ¹	`123456`

ACCOUNT_USAGE.DATABASES supplies related fields (name, owner, owner_role_type, type, is_transient, lifecycle, retention_time, comment) but these should be populated by a future inventory plugin, not query_history (≈180-min latency + cost). In query_history, snowflake.database.id stays a foreign key only.

Snowflake entity signal fields

Signal-level fields for Snowflake entity telemetry.

Attribute	Type	Description	Examples
`snowflake.entity.details`	string	stable Display name: `Snowflake entity details` Additional details about the entity involved in the event.	`Contains user data`
`snowflake.entity.id`	string	experimental Display name: `Snowflake entity ID` The unique identifier for the entity involved in the event.	`entity123`
`snowflake.entity.name`	string	stable Display name: `Snowflake entity name` The name of the entity involved in the event.	`User Table`
`snowflake.entity.type`	string	experimental Display name: `Snowflake entity type` The type of entity involved in the event, such as a table, view, or user.	`table`

Snowflake error signal fields

Signal-level fields for Snowflake error telemetry.

Attribute	Type	Description	Examples
`snowflake.error.code`	string	stable Display name: `Snowflake error code` The error code returned by the operation, if any.	`1001`
`snowflake.error.message`	string	stable Display name: `Snowflake error message` The error message returned by the operation, if any.	`Syntax error in SQL statement`

Snowflake event signal fields

Signal-level fields for Snowflake event telemetry.

Attribute	Type	Description	Examples
`snowflake.event.type`	string	experimental Display name: `Snowflake event type` Type of (timestamp based) event	`snowflake.table.update`

Snowflake grant signal fields

Signal-level fields for Snowflake grant telemetry.

Attribute	Type	Description	Examples
`snowflake.grant.by`	string	stable Display name: `Snowflake account making the grant` Shows the name of the account which made the grant.	`ACCOUNTADMIN`
`snowflake.grant.created_on`	long	stable Display name: `Snowflake grant creation time` The timestamp when the grant was created. Epoch nanoseconds timestamp.	`1639051180946000000`
`snowflake.grant.grantee`	string	stable Display name: `Snowflake account receiving the grant` Shows the grantee account name.	`PARTNER_ACCOUNT`
`snowflake.grant.name`	string	stable Display name: `Snowflake share grant name` Name of the grant to a share.	`READ_ACCESS`
`snowflake.grant.on`	string	stable Display name: `Snowflake grant object type` Shows on what type of object the grant was made.	`DATABASE`
`snowflake.grant.option`	boolean	experimental Display name: `Snowflake grant option availability` Indicates if grant option is available.	`false`
`snowflake.grant.privilege`	string	stable Display name: `Snowflake privilege granted` Shows the type of privilege granted.	`USAGE`
`snowflake.grant.to`	string	experimental Display name: `Snowflake share grant recipient` Shows to what the grant was made.	`SHARE`

Snowflake object signal fields

Signal-level fields for Snowflake object telemetry.

Attribute	Type	Description	Examples
`snowflake.object.ddl.modified`	string	experimental Display name: `Snowflake DDL-modified object details` A JSON array that specifies the objects that were associated with a write operation in the query. ¹	`{ "DTAGENT_DB.APP.TMP_RECENT_QUERIES": { "objectColumns": "HISTOGRAM_METRICS, COUNTER_METRICS, START_TIME, STATUS_CODE, SESSION_ID, QUERY_ID, DIMENSIONS, END_TIME, NAME, ATTRIBUTES, PARENT_QUERY_ID", "objectDomain": "Table" } }`
`snowflake.object.ddl.operation`	string	stable Display name: `Snowflake DDL operation` The SQL keyword that specifies the operation on the table, view, or column.	`REPLACE`
`snowflake.object.ddl.properties`	string	stable Display name: `Snowflake DDL property changes` A JSON array that specifies the object or column properties when you create, modify, drop, or undrop the object or column. There are two types of properties: atomic and compound. ²	`{"creationMode": "CREATE", "columns": {"ADD": ["ATTRIBUTE","JOB_ID"]}}`
`snowflake.object.id`	long	stable Display name: `Snowflake object ID` An identifier for the object, which is unique within a given account and domain.	`747545`
`snowflake.object.name`	string	stable Display name: `Snowflake object name` The fully qualified name of the object defined or modified by the DDL operation.	`DTAGENT_DB.APP.TMP_RECENT_QUERIES`
`snowflake.object.type`	string	stable Display name: `Snowflake object type` The domain of the object defined or modified by the DDL operation.	`Table`

Serialized JSON object stored as string in Grail. Contains modified DDL object details. Parse with parseJson() in DQL.

Stored as a serialized JSON string, not plain text.

snowflake.object.ddl.operation has the following list of well-known values. If one of them applies, then the respective value MUST be used, otherwise a custom value MAY be used.

Value	Description
`ALTER`	Modifies the properties or definition of an existing database object without recreating it.
`CREATE`	Creates a new database object; when used as CREATE OR REPLACE, atomically drops and recreates.
`DROP`	Removes a database object; for tables, data enters Fail-safe and can be recovered via UNDROP within the retention period.
`REPLACE`	Equivalent to CREATE OR REPLACE; atomically drops and recreates the object, resetting its definition.
`UNDROP`	Restores a previously dropped table, schema, or database from Fail-safe within the Time Travel retention window.

snowflake.object.type has the following list of well-known values. If one of them applies, then the respective value MUST be used, otherwise a custom value MAY be used.

Value	Description
`Database`	The top-level namespace container in Snowflake; groups schemas and all their child objects.
`MASKING POLICY`	Column-level data masking policy that transforms sensitive column values at query time for unauthorized roles.
`Procedure`	A callable stored procedure object encapsulating SQL or Snowpark logic that can be invoked via CALL.
`ROW ACCESS POLICY`	Row-level security policy that filters rows returned by a query based on the querying role or user.
`Schema`	A namespace container within a database used to group tables, views, and other objects.
`TAG`	Schema-level metadata label that can be attached to Snowflake objects or columns for governance and classification.
`Table`	A base, temporary, or external table object that stores or references tabular data, as reported in ACCESS_HISTORY.OBJECT_MODIFIED_BY_DDL.
`View`	A standard or secure view object whose definition is stored as a query and evaluated at access time.

Snowflake organization signal fields

Signal-level fields for Snowflake organization telemetry.

Attribute	Type	Description	Examples
`snowflake.org.billing.contract_number`	string	experimental Display name: `Snowflake billing contract number` The contract number associated with the Snowflake billing balance.	`CONTRACT-001`
`snowflake.org.billing.currency`	string	experimental Display name: `Snowflake billing currency` The currency in which billing usage amounts are denominated.	`USD`
`snowflake.org.name`	string	stable Display name: `Snowflake organization name` The name of the Snowflake organization.	`MYORG`

Snowflake pipe signal fields

Signal-level fields for Snowflake pipe telemetry.

Attribute	Type	Description	Examples
`snowflake.pipe.catalog`	string	experimental Display name: `Snowflake pipe database` Database containing the pipe.	`MY_DB`
`snowflake.pipe.created_on`	long	stable Display name: `Snowflake pipe creation time` Pipe creation event.	`1736936200000000000`
`snowflake.pipe.definition`	string	experimental Display name: `Snowflake pipe COPY statement` The pipe's COPY statement.	`COPY INTO MY_DB.MY_SCHEMA.TARGET_TABLE FROM @MY_DB.MY_SCHEMA.MY_STAGE`
`snowflake.pipe.execution_state`	string	stable Display name: `Snowflake pipe execution state` Raw execution state from `SYSTEM$PIPE\_STATUS`.	`RUNNING`
`snowflake.pipe.full_name`	string	experimental Display name: `Snowflake fully qualified pipe name` Fully qualified pipe name (database.schema.pipe).	`MY_DB.MY_SCHEMA.MY_PIPE`
`snowflake.pipe.id`	string	experimental Display name: `Snowflake pipe ID` Unique pipe UUID (from PIPE_USAGE_HISTORY).	`a1b2c3d4-e5f6-7890-abcd-ef1234567890`
`snowflake.pipe.invalid_reason`	string	experimental Display name: `Snowflake pipe invalid state reason` Reason the pipe is in an invalid state.	`Pipe paused by user`
`snowflake.pipe.last_ingested_timestamp`	string	experimental Display name: `Snowflake pipe last ingested file timestamp` Most recent file ingestion timestamp.	`2025-03-12 08:58:41.695 Z`
`snowflake.pipe.last_received_message_timestamp`	string	experimental Display name: `Snowflake pipe last received notification timestamp` Most recent event notification timestamp.	`2025-03-12 08:57:30.000 Z`
`snowflake.pipe.name`	string	stable Display name: `Snowflake pipe name` Short pipe name.	`MY_PIPE`
`snowflake.pipe.notification_channel`	string	experimental Display name: `Snowflake pipe notification channel URL` Cloud notification channel URL.	`arn:aws:sqs:us-east-1:123456789012:sf-snowpipe-AIDAEXAMPLE-pipeId`
`snowflake.pipe.oldest_file_timestamp`	string	experimental Display name: `Snowflake pipe oldest pending file timestamp` Timestamp of oldest pending file.	`2025-03-12 08:50:00.000 Z`
`snowflake.pipe.owner`	string	experimental Display name: `Snowflake pipe owner role` Role owning the pipe.	`LOADER_ROLE`
`snowflake.pipe.schema`	string	experimental Display name: `Snowflake pipe schema` Schema containing the pipe.	`MY_SCHEMA`
`snowflake.pipe.status`	string	stable Display name: `Snowflake pipe status` Raw execution state from `SYSTEM$PIPE\_STATUS`; stable values include RUNNING and PAUSED, dynamic variants follow STOPPED_* and STALLED_* patterns.	`RUNNING`
`snowflake.pipe.usage.start_time`	string	experimental Display name: `Snowflake pipe usage window start time` Start of the usage aggregation window.	`2025-03-12 08:00:00.000 Z`

snowflake.pipe.status has the following list of well-known values. If one of them applies, then the respective value MUST be used, otherwise a custom value MAY be used.

Value	Description
`PAUSED`	Pipe has been administratively paused; no files are ingested until resumed.
`RUNNING`	Pipe is active and processing staged files for ingestion.

Snowflake query signal fields

Signal-level fields for Snowflake query telemetry.

Attribute	Type	Description	Examples
`snowflake.query.accel_est.estimated_query_times`	string	stable Display name: `Snowflake query acceleration estimated execution times` Object that contains the estimated query execution time in seconds for different query acceleration scale factors. If the status for the query is not eligible for query acceleration, this object is empty. ¹	`{ "scaleFactor1": 10, "scaleFactor2": 5 }`
`snowflake.query.accel_est.status`	string	stable Display name: `Snowflake query acceleration status` Indicates whether the query is eligible to benefit from the query acceleration service.	`eligible`
`snowflake.query.accel_est.upper_limit_scale_factor`	long	stable Display name: `Snowflake query acceleration upper limit scale factor` Number of the highest query acceleration scale factor in the estimatedQueryTimes object. If the status for the query is not eligible for query acceleration, this field is set to 0.	`2`
`snowflake.query.data_transfer.inbound.cloud`	string	stable Display name: `Snowflake inbound data transfer cloud` The cloud provider from which data was transferred inbound.	`AWS`
`snowflake.query.data_transfer.inbound.region`	string	stable Display name: `Snowflake inbound data transfer region` The region from which data was transferred inbound.	`us-west-2`
`snowflake.query.data_transfer.outbound.cloud`	string	stable Display name: `Snowflake outbound data transfer cloud` The cloud provider to which data was transferred outbound.	`AWS`
`snowflake.query.data_transfer.outbound.region`	string	stable Display name: `Snowflake outbound data transfer region` The region to which data was transferred outbound.	`us-west-2`
`snowflake.query.execution_status`	string	stable Display name: `Snowflake query execution status` The execution status of the query.	`FAILED_WITH_ERROR`
`snowflake.query.hash`	string	stable Display name: `Snowflake query text hash` The hash of the query text.	`hash_abcdef`
`snowflake.query.hash_version`	long	experimental Display name: `Snowflake query hash version` The version of the query hash logic.	`1`
`snowflake.query.id`	string	stable Display name: `Snowflake query ID` The unique identifier for the SQL query.	`b1bbaa7f-8144-4e50-947a-b7e9bf7d62d5`
`snowflake.query.is_client_generated`	boolean	stable Display name: `Snowflake client generated query indicator` Indicates if the statement was generated by the client.	`true`
`snowflake.query.parametrized_hash`	string	stable Display name: `Snowflake parameterized query text hash` The hash value of the parameterized query text.	`param_hash_abcdef`
`snowflake.query.parametrized_hash_version`	long	experimental Display name: `Snowflake parameterized query hash version` The version of the parameterized query hash logic.	`1`
`snowflake.query.parent_id`	string	stable Display name: `Snowflake parent query ID` The query ID of the parent job or NULL if the job does not have a parent.	`01b2fd01-0604-6864-0040-e003029abda2`
`snowflake.query.retry_cause`	string	stable Display name: `Snowflake query retry cause` The cause for retrying the query, if applicable.	`Network issue`
`snowflake.query.root_id`	string	experimental Display name: `Snowflake root query ID` The query ID of the top most job in the chain or NULL if the job does not have a parent.	`01b2fd00-0604-6864-0040-e003029abd82`
`snowflake.query.step.id`	long	experimental Display name: `Snowflake query execution step ID` Identifier of the step in the query execution plan. operator_id values are unique within a step, not across the full query.	`1`
`snowflake.query.step.operator.attributes`	string	experimental Display name: `Snowflake query execution operator attributes` Information about the operator, depending on the operator type. ²	`{ "equality_join_condition": "(T4.C = T1.C)", "join_type": "INNER" }`
`snowflake.query.step.operator.id`	long	experimental Display name: `Snowflake query execution operator ID` The operator's identifier, unique within a step. Values start at 0.	`0`
`snowflake.query.step.operator.parent_ids`	string[]	experimental Display name: `Snowflake query execution operator parent IDs` Identifiers of the parent operators for this operator, or NULL if this is the final operator in the query plan. ³	`['0', '1']`
`snowflake.query.step.operator.stats`	string	experimental Display name: `Snowflake query execution operator statistics` Statistics about the operator (for example, the number of output rows from the operator). ⁴	`{ "input_rows": 64, "output_rows": 64 }`
`snowflake.query.step.operator.time_breakdown`	string	experimental Display name: `Snowflake query execution operator time breakdown` The breakdown of the execution time of the operator: - overall_percentage: The percentage of the total query time spent by this operator, - initialization: Time spent setting up query processing, - processing: Time spent processing the data by the CPU, - synchronization: Time spent synchronizing activities between participating processes, - local_disk_io: Time during which processing was blocked while waiting for local disk access, - remote_disk_io: Time during which processing was blocked while waiting for remote disk access, - network_communication: Time during which processing was waiting for network data transfer. ⁵	`{ "overall_percentage": 50.0,"initialization": 0.5,"processing": 4.0,"synchronization": 0.5,"local_disk_io": 0.2,"remote_disk_io": 0.1,"network_communication": 0.2 }`
`snowflake.query.step.operator.type`	string	experimental Display name: `Snowflake query execution operator type` The type of query operator (for example, TableScan or Filter).	`TableScan`
`snowflake.query.tag`	string	stable Display name: `Snowflake query tag` The query tag associated with the operation, if any.	`daily_report`
`snowflake.query.transaction_id`	long	stable Display name: `Snowflake query transaction ID` The transaction ID associated with the query.	`7890123456`
`snowflake.query.with_operator_stats`	boolean	experimental Display name: `Snowflake query execution plan telemetry indicator` Indicates if the query was executed with operator-level statistics enabled.	`true`

Serialized JSON object stored as string in Grail. Contains estimated query execution times per scale factor. Parse with parseJson() in DQL.

Serialized JSON object stored as string in Grail. Contains query operator specific attributes (for example, join conditions). Parse with parseJson() in DQL.

Array of parent operator IDs stored as string[] in Grail. Values are numeric strings.

⁴

Serialized JSON object stored as string in Grail. Contains query operator execution statistics (for example, input_rows, output_rows). Parse with parseJson() in DQL.

⁵

Serialized JSON object stored as string in Grail. Contains query operator time breakdown (for example, overall_percentage). Parse with parseJson() in DQL.

snowflake.query.accel_est.status has the following list of well-known values. If one of them applies, then the respective value MUST be used, otherwise a custom value MAY be used.

Value	Description
`accelerated`	Query was accelerated by the service.
`eligible`	Query is eligible for query acceleration.
`ineligible`	Query is not eligible for query acceleration.
`invalid`	Query acceleration status could not be determined.

snowflake.query.execution_status has the following list of well-known values. If one of them applies, then the respective value MUST be used, otherwise a custom value MAY be used.

Value	Description
`FAIL`	Query failed due to a user-actionable error (for example, syntax error, insufficient privileges).
`FAILED_WITH_ERROR`	Query failed due to a user-actionable error (for example, syntax error, insufficient privileges). Only reported by the active_queries plugin.
`FAILED_WITH_INCIDENT`	Query was aborted or interrupted by a Snowflake platform incident; not caused by user error or warehouse load. Only reported by the active_queries plugin.
`INCIDENT`	Query was aborted or interrupted by a Snowflake platform incident; not caused by user error or warehouse load.
`QUEUED`	Query is waiting in the warehouse queue due to concurrency limits or cluster provisioning. Only reported by the active_queries plugin.
`RESUMING_WAREHOUSE`	Query is waiting for the warehouse to resume from a suspended state before execution can begin. Only reported by the active_queries plugin.
`RUNNING`	Query is actively executing on the warehouse compute resources. Only reported by the active_queries plugin.
`SUCCESS`	Query completed without errors; result is available in the result cache. Only reported by the query_history plugin.

Snowflake release signal fields

Signal-level fields for Snowflake release telemetry.

Attribute	Type	Description	Examples
`snowflake.release_version`	string	experimental Display name: `Snowflake release version` The release version of Snowflake at the time of query execution.	`5.0`

Snowflake Resource Monitor signal fields

Signal-level fields for Snowflake Resource Monitor telemetry.

Attribute	Type	Description	Examples
`snowflake.resource_monitor.created_on`	long	experimental Display name: `Snowflake resource monitor creation time` The timestamp when the resource monitor was created.	`1728991696789000000`
`snowflake.resource_monitor.end_time`	long	experimental Display name: `Snowflake resource monitor end time` The timestamp when the resource monitor ended.	`1732981199999000000`
`snowflake.resource_monitor.is_active`	boolean	stable Display name: `Snowflake resource monitor active indicator` Indicates if the resource monitor is active.	`true`
`snowflake.resource_monitor.name`	string	stable Display name: `Snowflake resource monitor name` The name of the resource monitor.	`RM_MONITOR`
`snowflake.resource_monitor.start_time`	long	experimental Display name: `Snowflake resource monitor start time` The timestamp when the resource monitor started.	`1730419200000000000`
`snowflake.resource_monitor.threshold.direction`	string	experimental Display name: `Snowflake resource monitor threshold crossing direction` Direction of the threshold crossing: `up` when quota is increasing into or remaining within a band; `down` when the consumption drops back below a previously active band.	`up`
`snowflake.resource_monitor.threshold.level`	string	experimental Display name: `Snowflake resource monitor threshold alert band` Alert band for the threshold event.	`warn`
`snowflake.resource_monitor.threshold.value`	double	experimental Display name: `Snowflake resource monitor threshold value` Alert band the resource monitor's credit usage fell into when the event was emitted: one of `info`, `warn`, `critical`, or `exhausted` (increasing severity). The percentage boundaries for each band are configurable via `plugins.resource\_monitors.credits\_quota\_thresholds` (default `[50, 80, 90, 100]`); the specific crossed percentage is reported in `snowflake.resource\_monitor.threshold.value`. The configured threshold percentage at which this crossing event was triggered (for example, 80 means the 80% threshold was crossed). Distinct from snowflake.credits.quota.used_pct, which captures live consumption at emit time.	`80.0`
`snowflake.resource_monitor.warehouses`	string[]	experimental Display name: `Snowflake resource monitor warehouses` The names of the warehouses monitored.	`['COMPUTE_WH']`

snowflake.resource_monitor.threshold.direction MUST be one of the following:

Value	Description
`down`	Consumption drops back below a previously active band.
`up`	Quota is increasing into or remaining within a band.

snowflake.resource_monitor.threshold.level MUST be one of the following:

Value	Description
`critical`	Quota consumption is in the 90% (inclusive) to 100% (exclusive) range.
`exhausted`	Quota consumption is at or above 100%.
`info`	Quota consumption is below 80%.
`warn`	Quota consumption is in the 80% (inclusive) to 90% (exclusive) range.

Snowflake Resource Monitor resource fields

Resource-level fields describing Snowflake Resource Monitor resource entities.

Attribute	Type	Description	Examples
`snowflake.resource_monitor.frequency`	string	resource stable Display name: `Snowflake resource monitor frequency` The frequency of the resource monitor.	`DAILY`
`snowflake.resource_monitor.level`	string	resource experimental Display name: `Snowflake resource monitor level` The level of the resource monitor.	`ACCOUNT`

snowflake.resource_monitor.frequency has the following list of well-known values. If one of them applies, then the respective value MUST be used, otherwise a custom value MAY be used.

Value	Description
`DAILY`	Credit usage counter resets to zero at 12:00 AM UTC each day from the configured start date.
`MONTHLY`	Credit usage counter resets to zero at 12:00 AM UTC on the same day of each month as the configured start date; default frequency.
`NEVER`	Resource monitor does not reset automatically.
`WEEKLY`	Credit usage counter resets to zero at 12:00 AM UTC each week on the same weekday as the configured start date.
`YEARLY`	Credit usage counter resets to zero once per year on the anniversary of the configured start date.

snowflake.resource_monitor.level MUST be one of the following:

Value	Description
`ACCOUNT`	Monitors aggregate credit consumption across all warehouses in the account; only one account-level monitor may exist per account.
`WAREHOUSE`	Resource monitor applies at the warehouse level.

Snowflake role signal fields

Signal-level fields for Snowflake role telemetry.

Attribute	Type	Description	Examples
`snowflake.role.name`	string	stable Display name: `Snowflake role name` The name of the Snowflake role associated with the operation.	`analyst_role`
`snowflake.role.type`	string	stable Display name: `Snowflake role type` The type of role used to execute the query.	`PRIMARY`

Snowflake schema signal fields

Signal-level fields for Snowflake schema telemetry.

Attribute	Type	Description	Examples
`snowflake.schema.id`	long	experimental Display name: `Snowflake schema ID` The unique identifier of the schema involved in the query.	`78901`
`snowflake.schema.name`	string	stable Display name: `Snowflake schema name` The name of the schema.	`public`

Snowflake secondary signal fields

Signal-level fields for Snowflake secondary telemetry.

Attribute	Type	Description	Examples
`snowflake.secondary_role_stats`	string	experimental Display name: `Snowflake secondary role statistics` Statistics related to secondary roles used during the query execution.	`role_stat1`

Snowflake service signal fields

Signal-level fields for Snowflake service telemetry.

Attribute	Type	Description	Examples
`snowflake.service.entity_id`	long	experimental Display name: `Snowflake service entity ID` Unique Snowflake identifier of the service entity.	`12345`
`snowflake.service.name`	string	stable Display name: `Snowflake service name` Name of the Snowflake service entity that consumed credits.	`MY_PIPE`
`snowflake.service.type`	string	stable Display name: `Snowflake service type` Type of Snowflake service consuming credits.	`WAREHOUSE_METERING`

snowflake.service.type has the following list of well-known values. If one of them applies, then the respective value MUST be used, otherwise a custom value MAY be used.

Value	Description
`AUTO_CLUSTERING`	Credits consumed by the background service that continuously re-clusters micro-partitions of tables with an active clustering key.
`CLOUD_SERVICES`	Cloud services layer credits for metadata operations, query parsing, and transaction management.
`HYBRID_TABLE_REQUESTS`	Credits consumed by Unistore hybrid-table (row-store + columnar) request processing.
`MATERIALIZED_VIEW`	Credits consumed by the background service that keeps materialized view results up to date as underlying table data changes.
`PIPE`	Credits consumed by Snowpipe for continuous micro-batch ingestion of staged files into Snowflake tables via serverless compute.
`QUERY_ACCELERATION`	Credits consumed when the Query Acceleration Service offloads eligible query portions to auto-provisioned serverless compute to reduce per-query latency.
`REPLICATION`	Credits consumed to replicate databases, schemas, or failover groups across regions or cloud providers for disaster recovery or data proximity.
`SEARCH_OPTIMIZATION`	Credits consumed to build and maintain the search access path that accelerates selective point-lookup and substring-search queries.
`SERVERLESS_ALERTS`	Credits consumed by Snowflake Alerts running on serverless compute to evaluate alert conditions and send notifications.
`SERVERLESS_TASK`	Credits consumed by tasks that run on Snowflake-managed serverless compute rather than a user-provisioned warehouse.
`SNOWPIPE_STREAMING`	Credits consumed by the Snowpipe Streaming SDK for low-latency row-level data ingestion without staging files.
`STORAGE`	Credits billed for bytes stored in Snowflake databases, internal stages, Time Travel history, and Fail-safe retention.
`TELEMETRY_DATA_INGEST`	Credits consumed for ingesting OpenTelemetry-compatible logs, traces, and metrics into a Snowflake event table.
`WAREHOUSE_METERING`	Virtual warehouse compute credits.
`WAREHOUSE_METERING_READER`	Virtual warehouse compute credits consumed by reader accounts accessing shared data.

Snowflake session signal fields

Signal-level fields for Snowflake session telemetry.

Attribute	Type	Description	Examples
`snowflake.session.closed_reason`	string	experimental Display name: `Snowflake session closed reason` The reason the session was closed.	`USER_LOGOUT`
`snowflake.session.id`	string	experimental Display name: `Snowflake session ID` The unique identifier for the session in which the query was executed. ¹	`123456789`
`snowflake.session.start`	long	experimental Display name: `Snowflake session start time` The start time of the session.	`1633046400000000000`

OTel semconv Development-tier attribute (session namespace). The semdict session.id is model-scoped/internal in code_monitoring only; no global ref available. Emitting as new id: pending global semdict registration.

Signal-level fields for Snowflake share telemetry.

Attribute	Type	Description	Examples
`snowflake.share.created_on`	long	stable Display name: `Snowflake share creation time` The timestamp when the share was created. Epoch nanoseconds timestamp.	`1639051180714000000`
`snowflake.share.has_details_reported`	boolean	experimental Display name: `Snowflake share details reported indicator` Indicates whether or not details on this share should be reported.	`false`
`snowflake.share.is_secure_objects_only`	boolean	stable Display name: `Snowflake share secure objects only indicator` Indicates if the share is only for secure objects.	`true`
`snowflake.share.kind`	string	stable Display name: `Snowflake share type` Indicates the type of share.	`OUTBOUND`
`snowflake.share.listing_global_name`	string	experimental Display name: `Snowflake share global name` Global name of the share listing.	`GLOBAL_SHARE_NAME`
`snowflake.share.name`	string	stable Display name: `Snowflake share name` Name of the share.	`SAMPLE_DATA`
`snowflake.share.owner`	string	stable Display name: `Snowflake share owner role` Shows the account owning the share.	`ACCOUNTADMIN`
`snowflake.share.shared_from`	string	experimental Display name: `Snowflake share owner account` Shows the owner account of the share.	`SNOWFLAKE`
`snowflake.share.shared_to`	string	experimental Display name: `Snowflake share recipient account` Shows the account the share was made to.	`PARTNER_ACCOUNT`
`snowflake.share.status`	string	stable Display name: `Snowflake share availability status` Indicates the availability status of the share. Set to UNAVAILABLE when the shared database is no longer accessible.	`UNAVAILABLE`

Snowflake status signal fields

Signal-level fields for Snowflake status telemetry.

Attribute	Type	Description	Examples
`snowflake.status.code`	string	experimental Display name: `Snowflake status code` The status of the login attempt, indicating success (OK) or failure (ERROR).	`OK`
`snowflake.status.message`	string	experimental Display name: `Snowflake status message` A human-readable message providing additional detail about the operation status.	`Login successful`

snowflake.status.code MUST be one of the following:

Value	Description
`ERROR`	The operation failed.
`OK`	The operation completed successfully.

Snowflake table signal fields

Signal-level fields for Snowflake table telemetry.

Attribute	Type	Description	Examples
`snowflake.table.clustering_key`	string	experimental Display name: `Snowflake table clustering key` Clustering key for the table.	`DATE`
`snowflake.table.cold_status`	string	stable Display name: `Snowflake table cold status indicator` Table temperature classification based on access recency.	`cold`
`snowflake.table.comment`	string	experimental Display name: `Snowflake table comment` Comment for this table.	`The tables defined in this database that are accessible to the current user's role.`
`snowflake.table.created_on`	long	experimental Display name: `Snowflake table creation time` The timestamp when the table was created. Epoch nanoseconds timestamp.	`1649940827875000000`
`snowflake.table.ddl`	long	experimental Display name: `Snowflake table last DDL time` The timestamp of the last DDL operation performed on the table or view, including CREATE, ALTER, DROP, or UNDROP.	`1730458800000000000`
`snowflake.table.dynamic.lag.target.type`	string	experimental Display name: `Snowflake dynamic table target lag type` The type of target lag.	`USER_DEFINED`
`snowflake.table.dynamic.latest.code`	string	experimental Display name: `Snowflake dynamic table refresh state code (latest)` Code representing the current state of the refresh. If the LAST_COMPLETED_REFRESH_STATE is FAILED, this column shows the error code associated with the failure.	`SUCCESS`
`snowflake.table.dynamic.latest.data_timestamp`	string	experimental Display name: `Snowflake dynamic table refresh timestamp (latest)` Data timestamp of the last successful refresh. ¹	`2024-11-22 12:55:29.695 Z`
`snowflake.table.dynamic.latest.dependency.data_timestamp`	string	experimental Display name: `Snowflake dynamic table dependency data timestamp (latest)` Data timestamp of the latest dependency to become available. ²	`2024-11-25 06:09:53.695 Z`
`snowflake.table.dynamic.latest.dependency.name`	string	experimental Display name: `Snowflake dynamic table dependency name (latest)` Qualified name of the latest dependency to become available.	`DYNAMIC_TABLE_DB.DYNAMIC_TABLE_SCH.EMPLOYEE`
`snowflake.table.dynamic.latest.message`	string	experimental Display name: `Snowflake dynamic table refresh message (latest)` Description of the current state of the refresh. If the LAST_COMPLETED_REFRESH_STATE is FAILED, this column shows the error message associated with the failure.	`Refresh completed successfully`
`snowflake.table.dynamic.latest.state`	string	experimental Display name: `Snowflake dynamic table refresh state (latest)` Status of the last terminated refresh for the dynamic table.	`SUCCEEDED`
`snowflake.table.dynamic.refresh.action`	string	stable Display name: `Snowflake dynamic table refresh action` Describes the type of refresh action performed.	`NO_DATA`
`snowflake.table.dynamic.refresh.code`	string	stable Display name: `Snowflake dynamic table refresh state code` Code representing the current state of the refresh.	`SUCCESS`
`snowflake.table.dynamic.refresh.completion_target`	long	experimental Display name: `Snowflake dynamic table refresh completion target time` Time by which this refresh should complete to keep lag under the TARGET_LAG parameter for the dynamic table.	`1732515005695000000`
`snowflake.table.dynamic.refresh.data_timestamp`	long	experimental Display name: `Snowflake dynamic table refresh data timestamp` Transactional timestamp when the refresh was evaluated.	`1732514993695000000`
`snowflake.table.dynamic.refresh.end`	long	experimental Display name: `Snowflake dynamic table refresh end time` Time when the refresh completed.	`1732514995308000000`
`snowflake.table.dynamic.refresh.message`	string	stable Display name: `Snowflake dynamic table refresh message` Description of the current state of the refresh.	`Refresh completed successfully`
`snowflake.table.dynamic.refresh.start`	long	experimental Display name: `Snowflake dynamic table refresh start time` Time when the refresh job started.	`1732514994978000000`
`snowflake.table.dynamic.refresh.state`	string	stable Display name: `Snowflake dynamic table refresh state` Status of the refresh for the dynamic table.	`SUCCEEDED`
`snowflake.table.dynamic.refresh.trigger`	string	stable Display name: `Snowflake dynamic table refresh trigger` Describes the trigger for the refresh.	`SCHEDULED`
`snowflake.table.dynamic.scheduling.reason.code`	string	experimental Display name: `Snowflake dynamic table scheduling reason code` Optional reason code if the state is not ACTIVE.	`MAINTENANCE`
`snowflake.table.dynamic.scheduling.reason.message`	string	experimental Display name: `Snowflake dynamic table scheduling reason message` Text description of the reason the dynamic table is not active. Only applies if the state is not active.	`Scheduled maintenance`
`snowflake.table.dynamic.scheduling.resumed_on`	string	stable Display name: `Snowflake dynamic table scheduling resume time` The timestamp when the dynamic table was last resumed, if ACTIVE. ³	`2024-11-25 08:09:53.695 Z`
`snowflake.table.dynamic.scheduling.state`	string	stable Display name: `Snowflake dynamic table scheduling state` Scheduling state of the dynamic table.	`ACTIVE`
`snowflake.table.dynamic.scheduling.suspended_on`	string	experimental Display name: `Snowflake dynamic table scheduling suspend time` The timestamp when the dynamic table was suspended. ⁴	`2024-11-25 06:09:53.695 Z`
`snowflake.table.full_name`	string	stable Display name: `Snowflake fully qualified table name` Fully qualified name of the Snowflake table (database.schema.table).	`ANALYTICS_DB.PUBLIC.ORDERS`
`snowflake.table.is_auto_clustering_on`	boolean	experimental Display name: `Snowflake automatic table clustering indicator` Indicates whether automatic clustering is enabled for the table.	`true`
`snowflake.table.is_dynamic`	boolean	experimental Display name: `Snowflake dynamic table indicator` Indicates whether the table is a dynamic table.	`false`
`snowflake.table.is_hybrid`	boolean	experimental Display name: `Snowflake hybrid table indicator` Indicates whether this is a hybrid table.	`false`
`snowflake.table.is_iceberg`	boolean	experimental Display name: `Snowflake Iceberg table indicator` Indicates whether the table is an Iceberg table.	`false`
`snowflake.table.is_temporary`	boolean	experimental Display name: `Snowflake temporary table indicator` Indicates whether this is a temporary table.	`false`
`snowflake.table.is_transient`	boolean	experimental Display name: `Snowflake transient table indicator` Indicates whether this is a transient table.	`false`
`snowflake.table.last_accessed_at`	string	experimental Display name: `Snowflake table last access time` ISO 8601 timestamp of the most recent query that accessed this table.	`2026-01-15T10:30:00Z`
`snowflake.table.last_ddl_by`	string	experimental Display name: `Snowflake table last DDL executor` The current username for the user who executed the last DDL operation.	`DBA_USER`
`snowflake.table.owner`	string	experimental Display name: `Snowflake table owner role` Name of the role that owns the table.	`ACCOUNTADMIN`
`snowflake.table.retention_time`	long	experimental Display name: `Snowflake table time travel retention days` Number of days that historical data is retained for Time Travel.	`5`
`snowflake.table.type`	string	stable Display name: `Snowflake table type` The type of the table.	`BASE TABLE`
`snowflake.table.update`	long	stable Display name: `Snowflake table last update time` The timestamp of the last time the object was altered by a DML, DDL, or background metadata operation.	`1731256700000000000`

ISO 8601 timestamp string stored as string in Grail.

⁴

ISO 8601 timestamp string stored as string in Grail.

snowflake.table.cold_status has the following list of well-known values. If one of them applies, then the respective value MUST be used, otherwise a custom value MAY be used.

Value	Description
`cold`	Table data has not been recently accessed (beyond the cold threshold).
`warm`	Table data has been recently accessed within the cold threshold period.

snowflake.table.dynamic.latest.state has the following list of well-known values. If one of them applies, then the respective value MUST be used, otherwise a custom value MAY be used.

Value	Description
`CANCELLED`	Refresh was canceled before execution.
`FAILED`	Refresh failed during execution.
`SUCCEEDED`	Refresh completed successfully.
`SUSPENDED`	Dynamic table scheduling is suspended.
`UPSTREAM_FAILED`	Refresh not performed due to an upstream failed refresh.

snowflake.table.dynamic.refresh.action has the following list of well-known values. If one of them applies, then the respective value MUST be used, otherwise a custom value MAY be used.

Value	Description
`FULL`	Full refresh performed.
`INCREMENTAL`	Normal incremental refresh.
`NO_DATA`	No new data in base tables.
`REINITIALIZE`	Base table changed or source table of cloned dynamic table was refreshed.

snowflake.table.dynamic.refresh.state has the following list of well-known values. If one of them applies, then the respective value MUST be used, otherwise a custom value MAY be used.

Value	Description
`CANCELLED`	Refresh was canceled before execution.
`EXECUTING`	Refresh in progress.
`FAILED`	Refresh failed during execution.
`SCHEDULED`	Refresh scheduled but not yet executed.
`SUCCEEDED`	Refresh completed successfully.
`UPSTREAM_FAILED`	Refresh not performed due to an upstream failed refresh.

snowflake.table.dynamic.refresh.trigger has the following list of well-known values. If one of them applies, then the respective value MUST be used, otherwise a custom value MAY be used.

Value	Description
`CREATION`	Refresh performed during creation DDL statement.
`MANUAL`	User or task triggered refresh via ALTER DYNAMIC TABLE REFRESH.
`SCHEDULED`	Normal background refresh to meet target lag or downstream target lag.

snowflake.table.type has the following list of well-known values. If one of them applies, then the respective value MUST be used, otherwise a custom value MAY be used.

Value	Description
`BASE TABLE`	Full permanent table stored in Snowflake micro-partitions; supports all DML, Time Travel, and Fail-safe.
`EXTERNAL TABLE`	Schema overlay over data files in an external cloud storage stage; data is never loaded into Snowflake and is read-only.
`MATERIALIZED VIEW`	Pre-computed query result stored as a physical table and transparently refreshed by Snowflake's background maintenance service; consumes MATERIALIZED_VIEW credits.
`TEMPORARY TABLE`	Temporary table (session-scoped).
`VIEW`	Non-materialized virtual table defined by a stored query; the underlying SQL is re-executed on every access with no physical storage.

Snowflake table dynamic graph signal fields

Signal-level fields for Snowflake table dynamic graph telemetry.

Attribute	Type	Description	Examples
`snowflake.table.dynamic.graph.alter_trigger`	string[]	experimental Display name: `Snowflake dynamic table graph alter trigger` Describes why a new entry is created in the DYNAMIC_TABLE_GRAPH_HISTORY function. ¹	`['NONE']`; `['CREATE_DYNAMIC_TABLE']`; `['ALTER_TARGET_LAG']`; `['SUSPEND']`; `['RESUME']`; `['REPLICATION_REFRESH']`; `['ALTER_WAREHOUSE']`
`snowflake.table.dynamic.graph.inputs`	string[]	experimental Display name: `Snowflake dynamic table graph inputs` Each OBJECT represents a table, view, or dynamic table that serves as the input to this dynamic table. ²	`['{"kind": "TABLE", "name": "DYNAMIC_TABLE_DB.DYNAMIC_TABLE_SCH.EMPLOYEE"}', '{"kind": "TABLE", "name": "DYNAMIC_TABLE_DB.DYNAMIC_TABLE_SCH.EMPLOYEE_SKILL"}']`
`snowflake.table.dynamic.graph.valid_from`	long	experimental Display name: `Snowflake dynamic table graph validity start time` The timestamp after which the description of the dynamic table is valid.	`1732135627448000000`
`snowflake.table.dynamic.graph.valid_to`	long	experimental Display name: `Snowflake dynamic table graph validity end time` If present, the description of the dynamic table is valid up to this time. If null, the description is still accurate.	`1733011200000000000`

Array of DDL operation names stored as string[] in Grail (for example, CREATE_DYNAMIC_TABLE).

Array of input table references stored as string[] in Grail. Each element is a JSON-serialized object with kind and name fields.

Snowflake task signal fields

Signal-level fields for Snowflake task telemetry.

Attribute	Type	Description	Examples
`snowflake.task.condition`	string	experimental Display name: `Snowflake task condition text` The condition text of the task.	`status = 'SUCCESS'`
`snowflake.task.config.allow_overlap`	boolean	experimental Display name: `Snowflake task overlapping execution indicator` Indicates if overlapping execution is allowed.	`true`
`snowflake.task.config.id`	string	experimental Display name: `Snowflake task configuration ID` The configuration of the task.	`config123`
`snowflake.task.end_time`	long	experimental Display name: `Snowflake task end time` The end time of the task.	`1633046700000000000`
`snowflake.task.error_integration`	string	experimental Display name: `Snowflake task error notification integration service` Name of the notification integration used to access Amazon Simple Notification Service (SNS), Google Pub/Sub, or Microsoft Azure Event Grid to relay error notifications for the task.	`error_integration123`
`snowflake.task.graph.root_id`	string	experimental Display name: `Snowflake task graph root ID` The root ID of the task graph.	`root123`
`snowflake.task.graph.version`	long	experimental Display name: `Snowflake task graph version` The version of the task graph.	`1`
`snowflake.task.graph.version.created_on`	long	stable Display name: `Snowflake task graph version creation time` The timestamp when the task graph version was created.	`1633046400000000000`
`snowflake.task.id`	long	experimental Display name: `Snowflake task ID` The unique identifier for the task.	`123456789`
`snowflake.task.instance_id`	long	stable Display name: `Snowflake internal instance ID` Internal/system-generated identifier for the instance which the object belongs to.	`987654321`
`snowflake.task.is_internal`	boolean	stable Display name: `Snowflake internal task indicator` Whether the task is an internal Dynatrace Snowflake Observability Agent scheduler task (measurement or finalizer).	`false`
`snowflake.task.last_committed_on`	long	experimental Display name: `Snowflake task last committed time` The last committed time of the task.	`1633046400000000000`
`snowflake.task.last_suspended_on`	long	experimental Display name: `Snowflake task last suspended time` The last suspended time of the task.	`1633046700000000000`
`snowflake.task.name`	string	stable Display name: `Snowflake task name` The name of the task.	`daily_backup_task`
`snowflake.task.owner`	string	experimental Display name: `Snowflake task owner` The owner of the task.	`admin`
`snowflake.task.predecessors`	string[]	experimental Display name: `Snowflake task predecessors` The predecessors of the task.	`['taskA', 'taskB']`
`snowflake.task.run.attempt`	long	stable Display name: `Snowflake task run attempt number` The attempt number of the task run.	`1`
`snowflake.task.run.completed_time`	long	stable Display name: `Snowflake task run completion time` The completed time of the task run.	`1742824007586000000`
`snowflake.task.run.group_id`	string	experimental Display name: `Snowflake task run group ID` The group ID of the task run.	`group123`
`snowflake.task.run.id`	long	experimental Display name: `Snowflake task run ID` The unique identifier for the task run.	`123456`
`snowflake.task.run.return_value`	string	experimental Display name: `Snowflake predecessor task return value` Value set for the predecessor task in a task graph. The return value is explicitly set by calling the SYSTEM$SET_RETURN_VALUE function by the predecessor task.	`0`
`snowflake.task.run.scheduled_from`	string	stable Display name: `Snowflake task run schedule source` The source from which the task was scheduled.	`CRON`
`snowflake.task.run.scheduled_time`	long	stable Display name: `Snowflake task run scheduled time` The scheduled time of the task run.	`1742821828016000000`
`snowflake.task.run.state`	string	stable Display name: `Snowflake task run state` The state of the task run.	`RUNNING`
`snowflake.task.schedule`	string	experimental Display name: `Snowflake task schedule` The schedule of the task.	`0 0 * * *`
`snowflake.task.start_time`	long	experimental Display name: `Snowflake task start time` The start time of the task.	`1633046400000000000`

Snowflake Trust Center signal fields

Signal-level fields for Snowflake Trust Center telemetry.

Attribute	Type	Description	Examples
`snowflake.trust_center.scanner.description`	string	experimental Display name: `Snowflake Trust Center scanner description` A short description of the scanner used in the Trust Center.	`Ensure monitoring and alerting exist for password sign-in without MFA`
`snowflake.trust_center.scanner.id`	string	stable Display name: `Snowflake Trust Center scanner ID` The unique identifier for the scanner used in the Trust Center.	`scanner123`
`snowflake.trust_center.scanner.name`	string	experimental Display name: `Snowflake Trust Center scanner name` The name of the scanner used in the Trust Center.	`2.4`
`snowflake.trust_center.scanner.package.id`	string	experimental Display name: `Snowflake Trust Center scanner package ID` The unique identifier for the scanner package used in the Trust Center.	`package123`
`snowflake.trust_center.scanner.package.name`	string	experimental Display name: `Snowflake Trust Center scanner package name` The name of the scanner package used in the Trust Center.	`CIS Package`
`snowflake.trust_center.scanner.type`	string	stable Display name: `Snowflake Trust Center scanner type` The type of scanner used in the Trust Center, such as 'CIS Benchmarks' or 'Threat Intelligence'.	`CIS Benchmarks`

Snowflake user signal fields

Signal-level fields for Snowflake user telemetry.

Attribute	Type	Description	Examples
`snowflake.user.bypass_mfa_until`	long	experimental Display name: `Snowflake user MFA bypass time` The time until which the user can bypass MFA. Epoch nanoseconds timestamp.	`1620213179885000000`
`snowflake.user.comment`	string	experimental Display name: `Snowflake user comment` Any comments associated with the user.	`New user account`
`snowflake.user.created_on`	long	experimental Display name: `Snowflake user account creation time` The timestamp of the user account creation.	`1651830381846000000`
`snowflake.user.default.namespace`	string	stable Display name: `Snowflake user default namespace` The default namespace for the user.	`PUBLIC`
`snowflake.user.default.role`	string	stable Display name: `Snowflake user default role` The default role for the user.	`SYSADMIN`
`snowflake.user.default.secondary_role`	string	stable Display name: `Snowflake user default secondary role` The default secondary role for the user.	`SECURITYADMIN`
`snowflake.user.default.warehouse`	string	stable Display name: `Snowflake user default warehouse` The default warehouse for the user.	`COMPUTE_WH`
`snowflake.user.deleted_on`	long	experimental Display name: `Snowflake user account deletion time` The timestamp of the user account deletion.	`1615219846384000000`
`snowflake.user.display_name`	string	experimental Display name: `Snowflake user display name` The display name of the user.	`John Doe`
`snowflake.user.email`	string	experimental Display name: `Snowflake user email address` The email address of the user.	`jdoe@example.com`
`snowflake.user.expires_at`	long	experimental Display name: `Snowflake user account expiration time` The expiration date of the user account.	`1620213179885000000`
`snowflake.user.ext_authn.duo`	boolean	stable Display name: `Snowflake user Duo authentication indicator` Indicates if Duo authentication is enabled for the user.	`true`
`snowflake.user.ext_authn.uid`	string	stable Display name: `Snowflake user ID in external authentication` The external authentication UID for the user.	`ext123`
`snowflake.user.has_mfa`	boolean	stable Display name: `Snowflake user MFA enrollment indicator` Indicates if the user is enrolled for multi-factor authentication.	`true`
`snowflake.user.has_password`	boolean	stable Display name: `Snowflake user password indicator` Indicates if the user has a password set.	`true`
`snowflake.user.has_pat`	boolean	stable Display name: `Snowflake user programmatic access token indicator` Indicates if a programmatic access token has been generated for the user.	`true`
`snowflake.user.has_rsa`	boolean	stable Display name: `Snowflake user RSA key authentication indicator` Indicates if RSA public key authentication is configured for the user.	`true`
`snowflake.user.has_workload_identity`	boolean	experimental Display name: `Snowflake user workload identity indicator` Indicates if workload identity federation is configured for the user.	`true`
`snowflake.user.id`	long	experimental Display name: `Snowflake user ID` The unique identifier for the user.	`12345`
`snowflake.user.is_disabled`	boolean	stable Display name: `Snowflake user disabled indicator` Indicates if the user account is disabled.	`false`
`snowflake.user.is_from_organization`	boolean	experimental Display name: `Snowflake user organization import indicator` Indicates if the user was imported from a global organization.	`true`
`snowflake.user.is_locked`	boolean	stable Display name: `Snowflake user locked indicator` Indicates if the user account is locked by Snowflake.	`false`
`snowflake.user.last_success_login`	long	stable Display name: `Snowflake user last successful login time` The timestamp of the last successful login by the user.	`1732181350954000000`
`snowflake.user.locked_until_time`	long	experimental Display name: `Snowflake user locked until time` The time until which the user account is locked.	`1615479617866000000`
`snowflake.user.must_change_password`	boolean	experimental Display name: `Snowflake user password change required indicator` Indicates if the user must change their password.	`true`
`snowflake.user.name.first`	string	stable Display name: `Snowflake user first name` The first name of the user.	`John`
`snowflake.user.name.last`	string	stable Display name: `Snowflake user last name` The last name of the user.	`Doe`
`snowflake.user.name.login`	string	experimental Display name: `Snowflake user login name` The login name of the user.	`jdoe`
`snowflake.user.owner`	string	stable Display name: `Snowflake user owner role` The role that owns the user account.	`ACCOUNTADMIN`
`snowflake.user.password_last_set_time`	long	experimental Display name: `Snowflake user password last set time` The timestamp of the last password change for the user.	`1615219848053000000`
`snowflake.user.privilege.granted_by`	string[]	experimental Display name: `Snowflake user privilege grantor roles` Array of all roles which granted grants to a user for a privilege. ¹	`['ACCOUNTADMIN']`
`snowflake.user.privilege.grants_on`	string[]	experimental Display name: `Snowflake user privilege grant targets` List of all objects of given type on which given privilege was given; both object type and privilege are reported as `snowflake.user.privilege.name` ²	`['TRUST_CENTER_ADMIN', 'COMPUTE_WH']`
`snowflake.user.privilege.last_altered`	long	experimental Display name: `Snowflake user privilege last altered time` The timestamp of the last alteration to the user's privileges.	`1732181350954000000`
`snowflake.user.privilege.name`	string	stable Display name: `Snowflake user privilege name` Name of the privilege and type of object this privilege granted on to the user or role. Composed as `privilege:granted_on_object`.	`CREATE SERVICE:SCHEMA`
`snowflake.user.roles.all`	string	experimental Display name: `Snowflake user roles` Comma separated list of all roles granted to a user.	`SNOWFLAKE_FINANCE,MONITORING`
`snowflake.user.roles.direct.list`	string[]	stable Display name: `Snowflake user direct roles` List of all direct roles granted to user. ³	`['DEVOPS_ROLE', 'SYSADMIN', 'ACCOUNTADMIN']`
`snowflake.user.roles.direct.removed`	string	stable Display name: `Snowflake user removed direct role` Name of the role that was revoked from user.	`ACCOUNTADMIN`
`snowflake.user.roles.direct.removed_on`	long	experimental Display name: `Snowflake user direct role removal time` The timestamp of the last removal of a direct role from the user.	`1718260900411000000`
`snowflake.user.roles.granted_by`	string[]	experimental Display name: `Snowflake user role grantor roles` Array of admin roles that were used to grant current list of user roles. ⁴	`['DEMIGOD', 'SECURITYADMIN', 'ACCOUNTADMIN']`
`snowflake.user.roles.last_altered`	long	experimental Display name: `Snowflake user roles last altered time` The timestamp of the last alteration to the roles granted to the user.	`1718260900411000000`
`snowflake.user.type`	string	stable Display name: `Snowflake user type` The type of user who executed the query. Useful for splitting workloads by human vs. automated traffic.	`PERSON`

Array of grantor role names stored as string[] in Grail.

Array of privilege grant target names stored as string[] in Grail.

Array of directly assigned role names stored as string[] in Grail.

⁴

Array of grantor names for role assignments stored as string[] in Grail.

snowflake.user.type has the following list of well-known values. If one of them applies, then the respective value MUST be used, otherwise a custom value MAY be used.

Value	Description
`LEGACY_SERVICE`	Non-interactive integration user that, unlike SERVICE, still permits password and SAML authentication. Deprecated — migrate to SERVICE type.
`PERSON`	Human interactive user.
`SERVICE`	Non-interactive integration user; cannot authenticate via password or SAML, cannot enroll in MFA. Recommended for all automated service accounts.
`SNOWFLAKE_SERVICE`	System-managed user automatically created for each Snowpark Container Services (SPCS) service; cannot be created or converted by administrators.

Snowflake warehouse signal fields

Signal-level fields for Snowflake warehouse telemetry.

Attribute	Type	Description	Examples
`snowflake.warehouse.cluster.number`	long	stable Display name: `Snowflake warehouse cluster number` The cluster number of the warehouse used.	`1`
`snowflake.warehouse.created_on`	string	experimental Display name: `Snowflake warehouse creation time` The timestamp when the warehouse was created. ¹	`2024-09-01 08:00:00.000`
`snowflake.warehouse.event.name`	string	stable Display name: `Snowflake warehouse event name` The name of the event.	`WAREHOUSE_START`
`snowflake.warehouse.event.reason`	string	experimental Display name: `Snowflake warehouse event reason` The reason for the event.	`USER_REQUEST`
`snowflake.warehouse.event.state`	string	stable Display name: `Snowflake warehouse event state` The state of the event, such as STARTED or COMPLETED.	`STARTED`
`snowflake.warehouse.event.trigger`	string	experimental Display name: `Snowflake warehouse event trigger` The event that triggered the "warehouse is not monitored" notification.	`snowflake.warehouse.created_on`
`snowflake.warehouse.id`	long	experimental Display name: `Snowflake warehouse ID` The unique identifier of the warehouse used.	`12345`
`snowflake.warehouse.is_current`	boolean	experimental Display name: `Snowflake warehouse current indicator` Indicates if the warehouse is the current warehouse.	`true`
`snowflake.warehouse.is_default`	boolean	experimental Display name: `Snowflake warehouse default indicator` Indicates if the warehouse is the default warehouse.	`true`
`snowflake.warehouse.is_unmonitored`	boolean	stable Display name: `Snowflake warehouse unmonitored indicator` Indicates if the warehouse is NOT monitored by a resource monitor.	`true`
`snowflake.warehouse.name`	string	stable Display name: `Snowflake warehouse name` The name of the Snowflake warehouse.	`compute_wh`
`snowflake.warehouse.owner.role_type`	string	experimental Display name: `Snowflake warehouse owner role type` The principal type of the warehouse owner: ROLE or APPLICATION.	`ROLE`
`snowflake.warehouse.resumed_on`	string	stable Display name: `Snowflake warehouse last resumed time` The timestamp when the warehouse was last resumed. ²	`2024-11-15 09:00:00.000`
`snowflake.warehouse.size`	string	stable Display name: `Snowflake warehouse size` The size of the warehouse used.	`X-SMALL`
`snowflake.warehouse.type`	string	stable Display name: `Snowflake warehouse type` The type of warehouse used.	`STANDARD`
`snowflake.warehouse.updated_on`	string	experimental Display name: `Snowflake warehouse last updated time` The timestamp when the warehouse was last updated. ³	`2024-11-10 14:30:00.000`

ISO 8601 timestamp string stored as string in Grail. Grail stores this as a plain string; use toTimestamp() in DQL for time-based operations.

ISO 8601 timestamp string stored as string in Grail.

snowflake.warehouse.event.name has the following list of well-known values. If one of them applies, then the respective value MUST be used, otherwise a custom value MAY be used.

Value	Description
`ALTER_WAREHOUSE`	A warehouse property was modified via ALTER WAREHOUSE (for example, size, auto-suspend timeout, comment).
`CREATE_WAREHOUSE`	A new virtual warehouse was created.
`DROP_WAREHOUSE`	A virtual warehouse was dropped and its compute resources released.
`RESUME_CLUSTER`	An individual cluster within a multi-cluster warehouse was resumed to meet increased demand.
`RESUME_WAREHOUSE`	The warehouse transitioned from SUSPENDED to STARTED, reprovisioning compute resources.
`SUSPEND_CLUSTER`	An individual cluster within a multi-cluster warehouse was suspended due to reduced demand.
`SUSPEND_WAREHOUSE`	The warehouse transitioned from STARTED to SUSPENDED, deallocating all compute resources.
`WAREHOUSE_CONSISTENT`	All pending state changes for the warehouse have settled; emitted as the final event in a multi-step operation sequence.

snowflake.warehouse.event.reason has the following list of well-known values. If one of them applies, then the respective value MUST be used, otherwise a custom value MAY be used.

Value	Description
`RESOURCE_MONITOR_SUSPEND`	Warehouse was suspended because a resource monitor reached its SUSPEND or SUSPEND_IMMEDIATE threshold.
`WAREHOUSE_AUTORESUME`	Warehouse resumed automatically because AUTO_RESUME is enabled and a SQL statement was submitted while suspended.
`WAREHOUSE_AUTOSUSPEND`	Warehouse suspended automatically after the configured AUTO_SUSPEND inactivity period elapsed.
`WAREHOUSE_RESUME`	Warehouse was resumed explicitly via ALTER WAREHOUSE RESUME or a user-initiated action.
`WAREHOUSE_SUSPEND`	Warehouse was suspended explicitly via ALTER WAREHOUSE SUSPEND or a user-initiated action.

snowflake.warehouse.event.state has the following list of well-known values. If one of them applies, then the respective value MUST be used, otherwise a custom value MAY be used.

Value	Description
`COMPLETED`	The warehouse operation completed atomically with no further pending state changes.
`STARTED`	The warehouse operation has been initiated and is in progress; a COMPLETED or further STARTED event will follow.

snowflake.warehouse.size has the following list of well-known values. If one of them applies, then the respective value MUST be used, otherwise a custom value MAY be used.

Value	Description
`2X-LARGE`	32 credits/hour; credit consumption doubles at each step from X-Large.
`3X-LARGE`	64 credits/hour.
`4X-LARGE`	128 credits/hour.
`5X-LARGE`	256 credits/hour; generally available on AWS and Azure.
`6X-LARGE`	512 credits/hour; largest available size, generally available on AWS and Azure.
`LARGE`	8 credits/hour; provides substantially more compute resources per cluster for complex queries.
`MEDIUM`	4 credits/hour; suited for moderate-complexity queries and concurrent workloads.
`SMALL`	2 credits/hour; double the compute resources of X-Small.
`X-LARGE`	16 credits/hour; suitable for large-scale ETL and analytics.
`X-SMALL`	Smallest warehouse size; 1 credit/hour. Default size when creating a warehouse via SQL or Snowsight.

snowflake.warehouse.type has the following list of well-known values. If one of them applies, then the respective value MUST be used, otherwise a custom value MAY be used.

Value	Description
`SNOWPARK_OPTIMIZED`	Single-node warehouse with configurable high-memory nodes (16x–64x vs standard) and CPU architecture options; recommended for ML training and memory-intensive UDFs and stored procedures.
`STANDARD`	Standard multi-cluster warehouse.

Snowflake warehouse resource fields

Resource-level fields describing Snowflake warehouse resource entities.

Attribute	Type	Description	Examples
`snowflake.warehouse.clusters.count`	long	resource stable Display name: `Snowflake warehouse cluster count` The number of clusters in the warehouse. ¹	`2`
`snowflake.warehouse.execution_state`	string	resource stable Display name: `Snowflake warehouse execution state` The execution state of the warehouse.	`RUNNING`
`snowflake.warehouse.has_query_acceleration_enabled`	boolean	resource experimental Display name: `Snowflake warehouse query acceleration indicator` Indicates if query acceleration is enabled for the warehouse.	`true`
`snowflake.warehouse.is_auto_resume`	boolean	resource stable Display name: `Snowflake warehouse auto-resume indicator` Indicates if the warehouse is set to auto-resume.	`true`
`snowflake.warehouse.owner.name`	string	resource experimental Display name: `Snowflake warehouse owner name` The owner of the warehouse.	`ADMIN`
`snowflake.warehouse.scaling_policy`	string	resource stable Display name: `Snowflake warehouse scaling policy` The scaling policy of the warehouse.	`STANDARD`

The .count suffix is deliberately preserved. Sibling metrics snowflake.warehouse.clusters.min, .max, and .started exist in the same namespace; using the bare plural snowflake.warehouse.clusters as a scalar would be ambiguous alongside them.

snowflake.warehouse.execution_state has the following list of well-known values. If one of them applies, then the respective value MUST be used, otherwise a custom value MAY be used.

Value	Description
`RESIZING`	Warehouse is scaling to a new per-cluster size; running queries continue on the current size until resizing completes.
`RESUMING`	Compute resources being provisioned; submitted queries are queued until provisioning completes.
`STARTED`	Compute resources provisioned and warehouse is initialising after a CREATE or RESUME operation.
`SUSPENDED`	All compute resources deallocated; no credits consumed. Auto-resumes on next query submission if AUTO_RESUME is enabled.
`SUSPENDING`	Completing in-flight queries before deallocating compute resources; credits continue to accrue until suspension is complete.

snowflake.warehouse.scaling_policy has the following list of well-known values. If one of them applies, then the respective value MUST be used, otherwise a custom value MAY be used.

Value	Description
`ECONOMY`	Economy scaling policy (slower to scale up, saves credits).
`STANDARD`	"Prioritises query throughput: adds a new cluster immediately when any query is queued, ensuring minimal queue time at the cost of higher credit consumption. Default policy."

Software component

The software_component namespace describes an open-source library or dependency identified in a security finding.

Software component fields

Fields for identifying and versioning a software component within a security finding.

Attribute	Type	Description	Examples
`software_component.ecosystem`	string	experimental Display name: `Software component ecosystem` Software ecosystem to which the software component belongs.	`npm`; `maven`
`software_component.path`	string	experimental File system path from which the software component was loaded (its load origin).	`/opt/tomcat/webapps/cart/WEB-INF/lib/log4j-core-2.14.1.jar`
`software_component.purl`	string	experimental Display name: `Software component purl` Location of the package providing unique identification.	`pkg:maven/org.apache.logging.log4j/log4j-core`
`software_component.supplier.name`	string	experimental Display name: `Software component supplier name` Supplier name of the software component.	`FasterXML`
`software_component.type`	string	experimental Display name: `Software component type` Type of the software component usually provided by the SBOM.	`library`
`software_component.version`	string	experimental Display name: `Software component version` Version of the software component.	`3.16.2-5+deb9u3`

Software AG

Software AG fields

Attribute	Type	Description	Examples
`softwareag.install.root`	string	resource experimental Display name: `Software AG installation root`
`softwareag.product.prop.name`	string	resource experimental Display name: `Software AG product property name`

Span

Span fields

Attribute	Type	Description	Examples
`span.alternate_parent_id`	uid	experimental Display name: `Alternate parent span ID` The alternative `span.id` of this span's parent span. If a trace is monitored by more tracing systems (for example, OneAgent and OpenTelemetry), there might be two parent spans. If the two parent spans differ, `span.parent_id` holds the ID of the parent span originating from same tenant of the span while `span.alternate_parent_id` holds the other parent span ID. The `span.alternate_parent_id` is an 8-byte ID and hex-encoded if shown as a string.	`f76281848bd8288c`
`span.events`	record[]	stable Display name: `Span events` A collection of events. An event is an optional time-stamped annotation of the span and consists of a name and key-value pairs.
`span.exit_by_exception_id`	uid	stable Display name: `Exit exception ID` The `exception.id` of the exception the its `span.events` with the current span exited. The referenced exception has set the attribute `exception.escaped` to true.
`span.id`	uid	stable Display name: `Span ID` A unique identifier for a span within a trace. The `span.id` is an 8-byte ID and hex-encoded if shown as a string.	`f76281848bd8288c`
`span.is_exit_by_exception`	boolean	stable Display name: `Is exit by exception` Set to `true` if an exception exited the span. If set to `false`, the span has exception events, but none exited the span.
`span.is_subroutine`	boolean	experimental Display name: `Is subroutine` If set to `true`, it indicates that this span is a subroutine of its parent span. The spans represent functions running on the same thread on the same call stack.
`span.kind`	string	stable Display name: `Span kind` Distinguishes between spans generated in a particular context.	`server`
`span.links`	record[]	stable Display name: `Span links` A collection of links. A link is a reference from this span to a whole trace or a span in the same or different trace.
`span.name`	string	stable Display name: `Span name` The span name identifies the work represented by the span, for example, the route in an HTTP controller, an RPC method name, a function name, or the name of a subtask or stage within a larger computation.	`prepareOrderItemsAndShippingQuoteFromCart`; `org.example.CheckoutService/PlaceOrder`; `orders process`; `GET /products/{product_id}`; `HTTP POST`
`span.parent_id`	uid	stable Display name: `Parent span ID` The `span.id` of this span's parent span. The `span.parent_id` is an 8-byte ID and hex-encoded if shown as a string.	`f76281848bd8288c`
`span.status_code`	string	stable Display name: `Span status` Defines the status of a span, predominantly used to indicate a processing error. This field is absent if the reported span status is `unset`.	`error`
`span.status_message`	string	experimental Display name: `Span status message` An optional text that can provide a descriptive error message in case the `span.status_code` is `error`.	`Connection closed before message completed`; `Error sending request for url`
`span.timing.cpu`	duration	stable Display name: `Span CPU time` The overall CPU time spent executing the span, including the CPU times of child spans that are running on the same thread on the same call stack.
`span.timing.cpu_self`	duration	stable Display name: `Span self CPU time` The CPU time spent exclusively on executing this span, not including the CPU times of any children.

span.kind MUST be one of the following:

Value	Description	Display name
`client`	Indicates that the span describes a request to some remote service.	Client
`consumer`	Indicates that a span describes a child of an asynchronous `producer` request.	Consumer
`internal`	Default Value. Indicates that the span represents an internal operation.	Internal
`link`	Indicates that the span describes a Dynatrace link node.	Link
`producer`	Indicates that the span describes the initiator of an asynchronous request.	Producer
`server`	Indicates that the span covers server-side handling of a synchronous RPC or other remote request.	Server

span.status_code MUST be one of the following:

Value	Description	Display name
`error`	An error happened while processing the span.	Error
`ok`	The span was explicitly validated as having completed successfully, despite maybe even containing information about an error.	OK

GraphQL fields

Attribute	Type	Description	Examples
`graphql.document`	string	experimental The GraphQL document being executed. ¹ Tags: `sensitive-spans`	`query GetUser { user(id: "123") { name } }`; `mutation CreateOrder { createOrder(input: $input) { id } }`
`graphql.execution.error_count`	long	experimental The number of errors returned by the GraphQL execution.	`1`; `3`
`graphql.execution.error_details`	string[]	experimental Safe, low-cardinality details for errors returned by the GraphQL execution. ²	`['ValidationError', 'DataFetchingException:NOT_FOUND', 'code:BAD_USER_INPUT']`
`graphql.operation.name`	string	experimental The name of the GraphQL operation being executed. ³	`GetUser`; `CreateOrder`
`graphql.operation.type`	string	experimental The type of GraphQL operation being executed.	`query`; `mutation`

The document can contain inline argument values and other sensitive data. Backends should mask this field by default unless sensitive data access is explicitly granted.

Values describe the error type and optionally a sanitized error code. Raw GraphQL error messages must not be captured because they can contain sensitive data.

Anonymous GraphQL operations do not have an operation name.

graphql.operation.type MUST be one of the following:

Value	Description
`mutation`	A GraphQL mutation operation.
`query`	A GraphQL query operation.
`subscription`	A GraphQL subscription operation.

Span event

Span event fields

Attribute	Type	Description	Examples
`span_event.name`	string	stable Display name: `Span event name` Some span events have a defined semantics based on the name of the span event.	`exception`

span_event.name has the following list of well-known values. If one of them applies, then the respective value MUST be used, otherwise a custom value MAY be used.

Value	Description	Display name
`bizevent`	Indicates that the span event represents a business event	Business Event
`exception`	Indicates that the span event represents an exception	Exception
`feature_flag`	Indicates that the span event represents a feature flag	Feature Flag

Reference

Language Independent Interface Types For OpenTelemetry

Spring

Spring fields

Attribute	Type	Description
`spring.application.group`	string	resource experimental Display name: `Spring application group` Also see Common Application Properties
`spring.application.name`	string	resource experimental Display name: `Spring application name` Also see Common Application Properties
`spring.profile.name`	string	resource experimental Display name: `Spring profile name` The active profile (last value of spring.profiles.active)
`spring.startup.class`	string	resource experimental Display name: `Spring startup class`

Storage

Storage disk fields

Attribute	Type	Description	Examples
`storage.disk.encrypted`	boolean	resource stable Display name: `Storage disk encrypted` Is encrypted disk.
`storage.disk.fstype`	string	resource stable Display name: `Storage disk filesystem type` Type of file system on the disk.	`ext4`; `btrfs`
`storage.disk.kname`	string	resource stable Display name: `Storage disk kernel name` Kernel name of the disk device. It's also the disk ID in relation to other devices.	`sda`
`storage.disk.model`	string	resource stable Display name: `Storage disk model` Disk model.	`baracuda`
`storage.disk.mountpoint`	string	resource stable Display name: `Storage disk mountpoint` Primary mount point.	`/mnt/disk1`
`storage.disk.other-mountpoints`	string[]	resource stable Display name: `Storage disk other mountpoints` List of other mount points of the disk	`['/home/user1/mydisk', '/opt/volume1']`
`storage.disk.path`	string	resource stable Display name: `Storage disk path` Path to the disk.	`/dev/sda`
`storage.disk.read-only`	boolean	resource stable Display name: `Storage disk read-only` Is read-only disk.
`storage.disk.removable`	boolean	resource stable Display name: `Storage disk removable` Is removable disk.
`storage.disk.serial`	string	resource stable Display name: `Storage disk serial number` Disk serial number.	`1234-56789`
`storage.disk.type`	string	resource stable Display name: `Storage disk type` Disk device type.	`disk`; `hardware raid`
`storage.disk.vendor`	string	resource stable Display name: `Storage disk vendor` Vendor of the disk.	`seagate`

Storage partition fields

Attribute	Type	Description	Examples
`storage.partition.encrypted`	boolean	resource stable Display name: `Storage partition encrypted` Is encrypted partition.
`storage.partition.fstype`	string	resource stable Display name: `Storage partition filesystem type` Type of file system on the partition.	`ext4`; `btrfs`
`storage.partition.kname`	string	resource stable Display name: `Storage partition kernel name` Kernel name of the partition device. It's also the partition ID in relation to other devices.	`sda1`
`storage.partition.mountpoint`	string	resource stable Display name: `Storage partition mountpoint` Primary mount point.	`/mnt/diskA`
`storage.partition.other-mountpoints`	string[]	resource stable Display name: `Storage partition other mountpoints` List of other mount points of the partition.	`['/home/user1/mydiskA', '/opt/volumeA']`
`storage.partition.path`	string	resource stable Display name: `Storage partition path` Path to the partition.	`/dev/sda1`
`storage.partition.read-only`	boolean	resource stable Display name: `Storage partition read-only` Is read-only partition.
`storage.partition.removable`	boolean	resource stable Display name: `Storage partition removable` Is removable partition (true when disk is removable).
`storage.partition.type`	string	resource stable Display name: `Storage partition type` Partition device type.	`partition`

Storage volume fields

Attribute	Type	Description	Examples
`storage.volume.display-name`	string	resource stable Display name: `Storage volume display name` Name of the volume device.	`vg0-lv1`; `vg1-lv2`; `my-volume`
`storage.volume.fstype`	string	resource stable Display name: `Storage volume filesystem type` Type of file system on the volume.	`ext4`; `btrfs`
`storage.volume.kname`	string	resource stable Display name: `Storage volume kernel name` Kernel name of the volume device. It's also the volume ID in relation to other devices.	`dm-1`; `dm-2`; `dm-5`
`storage.volume.mountpoint`	string	resource stable Display name: `Storage volume mountpoint` Primary mount point.	`/mnt/diskA`
`storage.volume.other-mountpoints`	string[]	resource stable Display name: `Storage volume other mountpoints` List of other mount points of the software RAID.	`['/home/user1/mydiskA', '/opt/volumeA']`
`storage.volume.path`	string	resource stable Display name: `Storage volume path` Path to the volume device.	`/dev/mapper/vg0-lv1`
`storage.volume.read-only`	boolean	resource stable Display name: `Storage volume read-only` Is read-only volume.
`storage.volume.removable`	boolean	resource stable Display name: `Storage volume removable` Is removable volume.
`storage.volume.type`	string	resource stable Display name: `Storage volume type` Volume device type.	`lvm`

Storage software RAID fields

Attribute	Type	Description	Examples
`storage.software-raid.encrypted`	boolean	resource stable Display name: `Storage software raid encrypted` Is encrypted software RAID.
`storage.software-raid.fstype`	string	resource stable Display name: `Storage software raid filesystem type` Type of file system on the software RAID,	`ext4`; `btrfs`
`storage.software-raid.kname`	string	resource stable Display name: `Storage software raid kernel name` Kernel name of the software RAID device. It's also the software RAID ID in relation to other devices.	`md0`; `md1`; `md3`
`storage.software-raid.mountpoint`	string	resource stable Display name: `Storage software raid mountpoint` Primary mount point.	`/mnt/diskA`
`storage.software-raid.other-mountpoints`	string[]	resource stable Display name: `Storage software raid other mountpoints` List of other mount points of the software RAID.	`['/home/user1/mydiskA', '/opt/volumeA']`
`storage.software-raid.parent`	string	resource stable Display name: `Storage software raid parent` ID of parent software RAID in which this software RAID is nested.	`md0`
`storage.software-raid.path`	string	resource stable Display name: `Storage software raid path` Path to the software RAID device.	`/dev/md0`
`storage.software-raid.read-only`	boolean	resource stable Display name: `Storage software raid read-only` Is read-only software RAID.
`storage.software-raid.removable`	boolean	resource stable Display name: `Storage software raid removable` Is removable software RAID.
`storage.software-raid.type`	string	resource stable Display name: `Storage software raid type` Software RAID device type.	`raid0, raid10`

Subtrace

Subtrace fields

Attribute	Type	Description	Examples
`subtrace.id`	uid	experimental Display name: `Subtrace ID` Present on every span of a subtrace. All spans within one subtrace share the same identifier. The ID is a hex-encoded numerical value and not globally unique, but guaranteed to be unique within one particular trace.	`95efd70fcdb5b7b3`; `96835e1d65490b48`
`subtrace.is_root_span`	boolean	experimental Display name: `Subtrace is root span` Marks the root of a subtrace. This is typically the first span of a request within a service. Endpoints detection rules are evaluated on subtrace root spans.

Supportability

Supportability fields

Additional information about the attributes of a data point.

Attribute	Type	Description	Examples
`supportability.alr_sampling_ratio`	long	experimental Display name: `ALR sampling ratio` The denominator of the sampling ratio of the Dynatrace cluster, the attribute is only set if Adaptive Load Redution (ALR) is active on the Dynatrace cluster. A numerator is not specified, as it's always 1. If, for example, the Dynatrace cluster samples with a probability of 1/8 (12,5%), the value of `supportability.alr_sampling_ratio` would be 8 and the numerator is 1.	`8`
`supportability.atm_sampling_ratio`	long	experimental Display name: `ATM sampling ratio` The denominator of the sampling ratio of an Adaptive Traffic Management (ATM) aware sampler. The attribute is always present if an ATM-aware sampler is active (this applies, for example, to Dynatrace OneAgent). A numerator is not specified, as it is always 1. If, for example, Dynatrace OneAgent samples with a probability of 1/16 (6,25%), the value of `supportability.atm_sampling_ratio` would be 16 and the numerator is 1.	`16`
`supportability.custom_service.rule_id`	uid	experimental Display name: `Custom service rule ID` The ID of a custom service configuration rule. This field is only present if a custom service was configured as an automatic instrumentation rule in Dynatrace.	`4d76194c11a9426197a9062548f9e66e`
`supportability.dropped_attributes_count`	long	experimental Display name: `Dropped attributes count` The number of attributes that were discarded on the source. Attributes can be discarded because their keys are too long or because there are too many attributes.	`1`
`supportability.dropped_events_count`	long	experimental Display name: `Dropped events count` The number of span events that were discarded on the source.	`1`
`supportability.dropped_http_request_headers_count`	long	experimental Display name: `Dropped HTTP request headers count` Number of `http.request.header.__key__` that were discarded.	`1`
`supportability.dropped_http_request_parameters_count`	long	experimental Display name: `Dropped HTTP request parameters count` Number of `http.request.parameter.__key__` that were discarded.	`1`
`supportability.dropped_links_count`	long	experimental Display name: `Dropped links count` The number of span links that were discarded on the source.	`1`
`supportability.external.dt.entity.service`	string	deprecated Display name: `External service entity` The ID of the external service detected from this client span. The span comes from the service identified by `dt.entity.service`. This attribute indicates the external service that has been derived from it, as the remote side is not fully monitored by Dynatrace. It's only available for Service Detection v1 (SDv1) detected services that have the `isExternalService` entity attribute set to `true`. Note that this refers to classic service entities only, not Smartscape services (which do not have external services), so the attribute is removed when all services are based exclusively on Smartscape.	`SERVICE-0FA460E5CB2491A3`
`supportability.failure_detection.is_entry_point`	boolean	experimental Indicates whether the server side node is the primary or secondary failure‑detection entry point. Not applied to client-side nodes. It's important to know which node is considered the "entry point" during, for example, "success forcing exceptions" and "exception on any node" functionality.
`supportability.flaws`	string[]	experimental Display name: `Trace assembly flaws` A string array of one or multiple error codes indicating issues in the assembly of a trace in Dynatrace. Typically, issues come from erroneous (3rd party) instrumentations (e.g. not sending a required field), data loss due to network connectivity (e.g. missing parent span) or conditions implied by the nature of the trace (e.g. trace exceeding the depth limit). The attribute is only present in case an assembly issue was detected (the list will not be empty). For more information and details about specific error codes, please reach out to Dynatrace support.	`['C4', 'S3', 'A2']`
`supportability.is_http_route_derived`	boolean	experimental Display name: `Is HTTP route derived` Indicates that `http.route` was derived from `url.path` by Dynatrace, rather than sent by instrumentation.	`true`
`supportability.is_non_key_requests_endpoint_bucket`	boolean	experimental Display name: `Is non-key requests endpoint bucket` Indicates that the span stems from a request that was not marked as a key request.	`true`
`supportability.latency_before_openpipeline`	duration	experimental Display name: `Latency before OpenPipeline` The difference between the Dynatrace cluster node time and the `end_time` before the span is forwarded to OpenPipeline. Only available on subtrace root spans sent from the OneAgent.	`500000000000`
`supportability.non_persisted_attribute_keys`	string[]	experimental Display name: `Non-persisted attribute keys` A string array of attribute keys that were not stored as they were not allow-listed or were removed during the pipeline steps.	`['"my_span_attribute", "db.name"']`
`supportability.original_start_time`	timestamp	experimental Display name: `Original start time` The original start time of the span. Only available if the value of the `start_time` attribute was truncated. Truncating the start time is technically required for long running spans that have a start time older than three days in the past.	`1649822520123123123`
`supportability.serverid.addressee`	long	experimental Display name: `Addressee server ID` The id of the Dynatrace cluster node this span was addressed to. This is only available if it differs from the value of `supportability.serverid.processing`.	`5`
`supportability.serverid.processing`	long	experimental Display name: `Processing server ID` The id of the Dynatrace cluster node that received and processed this span.	`5`

OT span rule configuration

Span sensor rules used during ingestion of OpenTelemetry/OpenTracing spans by instrumentation of the OpenTelemetry/OpenTracing Apis are applied at span start time. Therefore these rules can only operate on span attributes given at span start time.

The value at span start time of attributes captured by this instrumentation is preserved to allow proper rule configuration.

Supportability span tensor fields

Attribute	Type	Description	Examples
`supportability.span_start.__key__`	record	experimental Display name: `Span start attribute` Span attributes set at span start time in case it changed later. The value at span start is relevant for span rule evaluation done by OpenTelemetry/OpenTracing instrumentation. `__key__` is a placeholder for the actual attribute name. The data type of the value depends on the attribute.	`5, "initial", ["a", "b"]`
`supportability.span_start.attribute_names`	array	experimental Display name: `Span start attribute names` List of attribute names set at span start invocation time.
`supportability.span_start.span.name`	string	experimental Display name: `Span start span name` The span name at span start time in case it changed later. The value at span start is relevant for span rule evaluation done by OpenTelemetry/OpenTracing instrumentation.	`GET`

Telemetry

Telemetry fields

The telemetry.sdk.* fields are used to describe the telemetry SDK in OpenTelemetry or ODIN ingest. It can be considered the closest equivalent of ODIN/OTel data to dt.agent.module.*. The telemetry.exporter.* fields are used to define the exporter that exports telemetry data and is expected to be different for each exporter in case when multiple exporters co-exist.

Attribute	Type	Description	Examples
`telemetry.exporter.name`	string	resource experimental Display name: `Telemetry exporter name` The exporter name.	`odin`
`telemetry.exporter.package_version`	string	resource experimental Display name: `Telemetry exporter package version` The version as exposed to the package manager (for example, npm).	`1.285.1`
`telemetry.exporter.version`	string	resource experimental Display name: `Telemetry exporter version` The full agent/exporter version.	`1.285.1.20240101-256988`
`telemetry.sdk.language`	string	resource stable Display name: `Telemetry SDK language` The programming language/tech of the telemetry SDK.	`nodejs`; `python`; `java`
`telemetry.sdk.name`	string	resource stable Display name: `Telemetry SDK name` The name of the telemetry SDK.	`odin`; `opentelemetry`
`telemetry.sdk.version`	string	resource stable Display name: `Telemetry SDK version` The version string of the telemetry SDK.	`1.20.0`

Thread

Thread fields

Attribute	Type	Description	Examples
`thread.id`	long	stable Display name: `Thread ID` Current "managed" thread id (as opposed to OS thread id).	`42`
`thread.name`	string	stable Display name: `Thread name` Current thread name.	`main`
`thread.pool.name`	string	stable Display name: `Thread pool name` The name of the thread pool.	`WorkerThreadPool`

Threat

The threat.* namespace provides structured fields for threat intelligence data. These are signal-level fields that annotate individual security events alongside the finding.* fields.

Sub-namespaces:

threat.attack.*—MITRE ATT&CK classification (tactic, technique, sub-technique). Scoped exclusively to the MITRE ATT&CK framework. Future sibling namespaces (threat.atlas.*, threat.kill_chain.*) will cover other classification frameworks.
threat.report.*—Identity and metadata for threat intelligence reports ingested from external platforms (AlienVault OTX, CrowdStrike Falcon Intelligence, STIX feeds, etc.).
threat.actor.*—Threat actor attribution information.
threat.target.*—Targeted geographies and industry verticals.
threat.malware.*—Malware families associated with the reported activity.
threat.observables.*—Typed arrays of security observables (indicators of compromise) extracted from a threat report: IP addresses, domains, URLs, file hashes, email addresses, and CVEs.

Concept: Threat intelligence report

A threat intelligence report is a curated, structured publication produced by an analyst or a threat intelligence platform (TIP). It groups related threat intelligence objects—indicators of compromise, malware descriptions, actor attribution, TTPs, and vulnerabilities—under a single editorial context, with a title, publisher, and timestamps.

This is not:

A PDF document or narrative report
A file submission ("reporting a suspicious file")—that is a file observable or a malware-analysis record
The result of a query or detection—those are findings or alerts

Concrete examples of a threat intelligence report in this sense:

An AlienVault OTX pulse
A CrowdStrike Falcon Intelligence malware analysis report
A STIX 2.1 report object delivered via a TAXII feed

The threat.report.* fields capture the report's identity and provenance (who published it, when, what it covers). The threat.observables.* fields capture the indicators extracted from the report. Together they let consumers correlate updates to the same report, filter by publisher, and link back to the source for full context.

Standard references:

MITRE ATT&CK fields

Structured MITRE ATT&CK classification fields for security detection events. These fields carry the tactic, technique, and sub-technique identifiers that describe adversary behavior observed in a detection event, classified according to the MITRE ATT&CK framework. All fields are signal-level: they annotate individual detection events. The threat.attack.* namespace is scoped to MITRE ATT&CK. Other threat classification frameworks use sibling namespaces, for example, threat.atlas., threat.kill_chain.). Field names use plural form (.ids, .names) consistent with the SD array naming convention. Name fields are optional companions to their .ids counterparts: when populated, names[i] must be the human-readable label for ids[i] (positional correspondence). Omit name fields entirely when the producing source does not provide names; don't populate names without the corresponding IDs.

Attribute	Type	Description	Examples
`threat.attack.subtechnique.ids`	string[]	experimental MITRE ATT&CK sub-technique identifiers for this detection, in T{parent}.{sub} dotted format. Independent of threat.attack.technique.ids—no positional alignment is assumed or required. The parent technique is encoded in the sub-technique ID itself, for example, T1059.003 belongs to technique T1059). Omit when no sub-technique information is available; don't use empty string placeholders. Sub-technique names are derivable from IDs via the ATT&CK knowledge base. DQL filter example: array.contains(threat.attack.subtechnique.ids, "T1059.003")	`['T1059.003']`; `['T1059.003', 'T1078.002']`
`threat.attack.subtechnique.names`	string[]	experimental Human-readable names of the MITRE ATT&CK sub-techniques for this detection. Optional companion to threat.attack.subtechnique.ids. When populated, elements must correspond positionally to threat.attack.subtechnique.ids: names[i] is the display name for ids[i]. No specific ordering of the array is required. Omit when the producing source does not provide sub-technique names; don't use placeholder values. Names can be derived from IDs using the ATT&CK knowledge base.	`['Windows Command Shell']`; `['Windows Command Shell', 'Domain Accounts']`
`threat.attack.tactic.ids`	string[]	experimental MITRE ATT&CK tactic identifiers for this detection, in TA-prefixed format. A detection may map to zero or more tactics. Omit or set to an empty array when tactic information is unavailable from the producing source. Tactic names can be derived from IDs using the ATT&CK knowledge base. DQL filter example: array.contains(threat.attack.tactic.ids, "TA0002")	`['TA0002']`; `['TA0002', 'TA0004']`
`threat.attack.tactic.names`	string[]	experimental Human-readable names of the MITRE ATT&CK tactics for this detection. Optional companion to threat.attack.tactic.ids. When populated, elements must correspond positionally to threat.attack.tactic.ids: names[i] is the display name for ids[i]. No specific ordering of the array is required. Omit when the producing source does not provide tactic names; don't use placeholder values. Names can be derived from IDs using the ATT&CK knowledge base.	`['Execution']`; `['Execution', 'Privilege Escalation']`
`threat.attack.technique.ids`	string[]	experimental MITRE ATT&CK technique identifiers for this detection, in T-prefixed format. A detection may map to zero or more techniques. The primary pivot field for ATT&CK heat maps and technique coverage dashboards. Technique names can be derived from IDs using the ATT&CK knowledge base. DQL filter example: array.contains(threat.attack.technique.ids, "T1059")	`['T1059']`; `['T1059', 'T1078']`
`threat.attack.technique.names`	string[]	experimental Human-readable names of the MITRE ATT&CK techniques for this detection. Optional companion to threat.attack.technique.ids. When populated, elements must correspond positionally to threat.attack.technique.ids: names[i] is the display name for ids[i]. No specific ordering of the array is required. Omit when the producing source does not provide technique names; don't use placeholder values. Names can be derived from IDs using the ATT&CK knowledge base.	`['Command and Scripting Interpreter']`; `['Command and Scripting Interpreter', 'Valid Accounts']`
`threat.attack.version`	string	experimental Version of the MITRE ATT&CK framework used to classify this detection. Useful for audit and reproducibility, since tactic and technique IDs can be added or renumbered across major ATT&CK versions. Some producers don't embed the framework version in their event payloads; omit when version provenance can't be reliably determined. Use bare version numbers without a "v" prefix.	`14.1`; `15.1`; `16.0`

Threat intelligence report fields

Identity and metadata fields for threat intelligence reports ingested from external platforms (for example, AlienVault OTX, CrowdStrike Falcon Intelligence, STIX feeds). These fields describe the report itself—who published it, when, and what topic it covers. They complement the threat.attack.* fields, which describe the MITRE ATT&CK classification of the adversary behavior covered in the report.

Attribute	Type	Description	Examples
`threat.report.author`	string	experimental Name of the author or team that published the report. Omit when not provided by the source platform.	`AlienVault`; `CrowdStrike Intelligence Team`; `FireEye, Inc.`
`threat.report.description`	string	experimental Summary or abstract of the threat intelligence report. Producers should truncate to 2 KB to stay within Grail field size limits; full content belongs in a linked document referenced via threat.report.references.urls.	`Threat actors have compromised several @antv-scoped packages on npm...`
`threat.report.id`	string	experimental Vendor-assigned unique identifier for this threat intelligence report. Stable across report updates; use to correlate modified versions of the same report. Format varies by provider (for example, opaque ID string, base64, STIX report– UUID).	`6a0c1b289f4fe8b7bdf00a84`; `YWdhdXNsMjYwNjE0`; `report--f2b63e80-b523-4747-a069-35c002c690db`
`threat.report.name`	string	experimental Human-readable title of the threat intelligence report as provided by the source platform. May be a vendor reference code (for example, "CSA-260614") or a descriptive title.	`Active Supply Chain Attack Compromises Packages on npm`; `CSA-260614`
`threat.report.references.urls`	string[]	experimental External URLs referenced by or linking to the full report. May include the report's own URL on the source platform, blog posts, advisories, or research papers that underpin the report.	`['https://socket.dev/blog/antv-packages-compromised']`; `['https://falcon.crowdstrike.com/intelligence/reports/CSA-260614']`
`threat.report.tags`	string[]	experimental Free-form classification tags assigned to the report by the source platform. Useful for filtering and grouping reports by topic. Omit when not provided by the source platform.	`['supply chain attack', 'npm', 'credential theft']`; `['ransomware', 'lockbit', 'rdp']`
`threat.report.time.created`	timestamp	experimental Timestamp when the report was first created by the source platform.	`2026-05-19T08:11:20.341Z`; `2026-04-12T06:45:00Z`; `1747642280341000000`
`threat.report.time.updated`	timestamp	experimental Timestamp of the most recent modification to the report. Useful for detecting updated intelligence on the same report ID.	`2026-05-19T17:46:10.861Z`; `2026-04-14T11:20:00Z`; `1747684370861000000`

Threat actor fields

Fields describing the threat actor (adversary group or individual) attributed to the activity covered in the threat intelligence report. Attribution is often uncertain; populate only when the source platform explicitly attributes the activity.

Attribute	Type	Description	Examples
`threat.actor.names`	string[]	experimental Names of the threat actors attributed to the activity described in this report. Each entry may represent either a distinct co-attributed actor (e.g. two groups acting together) or an alternative name (alias) used for the same actor across different vendors or intelligence sources. Use the names as provided by the source platform. Omit when attribution is not provided or is explicitly uncertain.	`['SCATTERED SPIDER']`; `['BITWISE SPIDER']`; `['Leek Likho']`; `['Cozy Bear', 'APT29', 'Midnight Blizzard']`

Threat targeting fields

Fields describing the geographies and industry verticals targeted by the adversary activity covered in the threat intelligence report. Populated from structured targeting metadata provided by the source platform.

Attribute	Type	Description	Examples
`threat.target.countries.iso_codes`	string[]	experimental ISO 3166-1 alpha-2 codes of the countries targeted by the adversary activity. Uses the same two-letter country code representation as geo.country.iso_code, the platform-wide standard for country geography, so threat targeting can be correlated with geo-enriched data and rendered on maps without name normalization. Complements threat.target.countries.names (full English country names); the two arrays are independent and need not align positionally—either may be populated without the other. Omit when targeting information is not available.	`['US']`; `['DE', 'JP']`; `['US', 'GB']`
`threat.target.countries.names`	string[]	experimental Names of the countries targeted by the adversary activity. Use the full English country name as provided by the source platform. Omit when targeting information is not available. It is recommended to normalize country values to ISO 3166 standard names; non-standard values may not be processed correctly by consumers of this field.	`['United States of America']`; `['Germany', 'Japan']`; `['United States of America', 'United Kingdom of Great Britain and Northern Ireland']`
`threat.target.industries`	string[]	experimental Names of the industry verticals targeted by the adversary activity. Use the sector name as provided by the source platform. Omit when targeting information is not available.	`['Technology']`; `['Manufacturing']`; `['Financial Services', 'Healthcare']`

Malware family fields

Fields identifying the malware families associated with the adversary activity described in the threat intelligence report. Populated from structured malware metadata provided by the source platform.

Attribute	Type	Description	Examples
`threat.malware.families`	string[]	experimental Names of the malware families observed or attributed in this report. Use the canonical family name as provided by the source platform. Omit when no malware family information is available.	`['LockBit 3.0']`; `['ALPHV', 'BlackCat']`; `['Poison Ivy', 'PIVY Variant']`

Threat observable fields

Typed arrays of security observables (indicators of compromise) extracted from threat intelligence reports. Each field holds all values of a single observable type, deduplicated before ingestion. Field names follow STIX 2.0 Cyber Observable (SCO) type naming (for example, domain-name -> domains, ipv4-addr/ipv6-addr -> ips).

Attribute	Type	Description	Examples
`threat.observables.cves`	string[]	experimental CVE identifiers for vulnerabilities exploited or referenced in this report. Must use the canonical CVE-YYYY-NNNNN format. Deduplicate before ingestion.	`['CVE-2024-1234']`; `['CVE-2012-0158', 'CVE-2013-0422', 'CVE-2013-1347']`
`threat.observables.domains`	string[]	experimental Domain names observed as indicators of compromise. Includes fully-qualified domain names (FQDNs) and bare domain names. Deduplicate before ingestion.	`['t.m-kosche.com']`; `['evil.example.com', 'rdp-relay.backup-vault.eu']`
`threat.observables.emails`	string[]	experimental Email addresses observed as indicators of compromise (for example, attacker C2 contact addresses or phishing sender addresses). Deduplicate before ingestion.	`['c2@evil.com']`
`threat.observables.hashes.md5`	string[]	experimental MD5 file hashes observed as indicators of compromise. Values must be lowercase hexadecimal strings. Deduplicate before ingestion.	`['d41d8cd98f00b204e9800998ecf8427e']`; `['1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d']`
`threat.observables.hashes.sha1`	string[]	experimental SHA-1 file hashes observed as indicators of compromise. Values must be lowercase hexadecimal strings. Deduplicate before ingestion.	`['1916faa365f2788b6e193514872d51a242876569']`; `['da39a3ee5e6b4b0d3255bfef95601890afd80709']`
`threat.observables.hashes.sha256`	string[]	experimental SHA-256 file hashes observed as indicators of compromise. Values must be lowercase hexadecimal strings. Deduplicate before ingestion.	`['e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855']`; `['c1d2e3f4a5b6c7d8e9f0a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2']`
`threat.observables.ips`	ipAddress[]	experimental IPv4 and IPv6 addresses observed as indicators of compromise in this report. Include both IPv4 dotted-decimal and IPv6 colon-hex representations as provided by the source. Deduplicate before ingestion.	`['1.2.3.4', '91.208.52.149']`; `['219.76.208.163', '113.10.246.30']`
`threat.observables.urls`	string[]	experimental Full URLs observed as indicators of compromise. Includes scheme, host, port, and path as provided by the source platform. Deduplicate before ingestion.	`['https://t.m-kosche.com:443/api/public/otel/v1/traces']`

TIBCO Business Works

TIBCO Business Works fields

Attribute	Type	Description
`tibco.businessworks.app.node.name`	string	resource experimental Display name: `TIBCO BusinessWorks application node name`
`tibco.businessworks.app.space.name`	string	resource experimental Display name: `TIBCO BusinessWorks application space name`
`tibco.businessworks.domain.name`	string	resource experimental Display name: `TIBCO BusinessWorks domain name`
`tibco.businessworks.home`	string	resource experimental Display name: `TIBCO BusinessWorks home directory`
`tibco.businessworks.property.file.name`	string	resource experimental Display name: `TIBCO BusinessWorks property file name`
`tibco.businessworks.property.file.path`	string	resource experimental Display name: `TIBCO BusinessWorks property file path`
`tibco.businessworks_ce.app.name`	string	resource experimental Display name: `TIBCO BusinessWorks CE application name`
`tibco.businessworks_ce.version`	string	resource experimental Display name: `TIBCO BusinessWorks CE version`

Timeframe

Timeframe fields

Attribute	Type	Description	Examples
`end`	timestamp	stable Display name: `Timeframe end` The end of the timeframe, exclusive.	`12/13/2023, 12:57 PM`
`start`	timestamp	stable Display name: `Timeframe start` The start of the timeframe, inclusive.	`12/13/2023, 10:57 AM`

TLS

TLS fields

Attribute	Type	Description	Examples
`tls.cipher`	string	experimental Display name: `TLS cipher` String indicating the cipher used during the current connection.	`TLS_RSA_WITH_3DES_EDE_CBC_SHA`; `TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256`
`tls.client.server_name`	string	experimental The hostname sent by the client in the TLS Server Name Indication (SNI) extension of the ClientHello message. Represents the server the client intends to connect to at the TLS layer. In most cases, matches server.address (the HTTP Host header); when they differ, it may indicate H2 connection coalescing, certificate misconfiguration, or clients bypassing SNI-based routing rules.	`api.example.com`; `www.example.com`
`tls.protocol.name`	string	experimental Display name: `TLS protocol name` Normalized lowercase protocol name parsed from the original string of the negotiated SSL/TLS protocol version.	`ssl`; `tls`
`tls.protocol.version`	string	experimental Display name: `TLS protocol version` The numeric part of the version parsed from the original string of the negotiated SSL/TLS protocol version.	`1.2`; `3`

Trace

Trace fields

Attribute	Type	Description	Examples
`trace.alternate_id`	uid	experimental Display name: `Alternate trace ID` The preserved trace ID when OneAgent and other tracing systems monitor the same process and the trace ID from the other tracing system was replaced by the OneAgent trace ID. The `trace.alternate_id` is a 16-byte ID and hex-encoded if shown as a string.	`357bf70f3c617cb34584b31bd4616af8`
`trace.capture.reasons`	string[]	experimental Display name: `Capture reasons` Explains why this trace was captured, multiple reasons can apply simultaneously. Note: The sampling approach ('atm' or 'fixed') is always placed at the first position in the array. These two values are mutually exclusive, though 'fixed' may appear with other capture triggers. Values: 'atm' (Dynatrace's intelligent sampling automatically adjusted trace capture based on traffic volume and system load), 'fixed' (trace captured due to configured percentage rules - either global settings or specific endpoint rules), 'custom' (trace captured because of custom correlation headers propagated between services or systems), 'mainframe' (trace originated from or includes IBM mainframe/z/OS components), 'serverless' (trace captured from serverless functions like AWS Lambda, Azure Functions, or similar platforms), 'rum' (trace initiated by user interactions in web browsers or mobile apps monitored by Dynatrace RUM agents).	`['atm']`; `['fixed']`; `['fixed', 'custom']`; `['fixed', 'rum']`
`trace.id`	uid	stable Display name: `Trace ID` A unique identifier for a trace. The `trace.id` is a 16-byte ID and hex-encoded if shown as a string.	`357bf70f3c617cb34584b31bd4616af8`
`trace.is_sampled`	boolean	experimental Display name: `Is sampled` Flag indicating whether the trace was recorded. If set to `true`, the trace is recorded. If set to `false`, the trace is ignored.	`true`; `false`
`trace.state`	string	experimental Display name: `Trace state` The trace state in the w3c-trace-context format.	`f4fe05b2-bd92206c@dt=fw4;3;abf102d9;c4592;0;0;0;2ee;5607;2h01;3habf102d9;4h0c4592;5h01;6h5f9a543f1184a52b1b744e383038911c;7h6564df6f55bd6eae,apmvendor=boo,foo=bar`

URL

The url namespace contains semantic conventions for URL and its components.

URL fields

Attribute	Type	Description	Examples
`url.domain`	string	experimental Display name: `URL domain` The URI domain component.	`www.foo.bar`; `google.com`; `wikipedia.org`
`url.fragment`	string	stable Display name: `URL fragment` The URI fragment component.	`SemConv`
`url.full`	string	stable Display name: `Full URL` Absolute URL describing a network resource according to RFC3986. Tags: `sensitive-spans`	`https://www.foo.bar/docs/search?q=OpenTelemetry#SemConv`
`url.path`	string	stable Display name: `URL path` The URI path component.	`/docs/search`
`url.path.pattern`	string	experimental Display name: `URL path pattern` The URL path pattern used to match a set of URLs with variable path segments.	`/docs/{id}`; `/users/{userId}/posts/{postId}`; `/api/v1/resources/*`
`url.port`	long	experimental Display name: `URL port` The URI port component.	`443`; `80`
`url.provider`	string	experimental Display name: `URL provider` The provider type for the host name of `url.full`. This information is determined by Dynatrace RUM resource detection.	`third_party`
`url.query`	string	stable Display name: `URL query` The URI query component. Tags: `sensitive-spans`	`q=OpenTelemetry`
`url.scheme`	string	stable Display name: `URL scheme` The URI scheme component identifying the used protocol.	`https`; `ftp`; `telnet`
`url.truncated_path`	string	experimental Display name: `Truncated URL path` Truncated URI path component for endpoint detection of certain technologies that do not provide a `http.route`. The truncation logic depends on the technology and is a best effort to provide a stable value. Example Adobe Experience Manager (AEM): First two parts of `url.path`. Truncated value of `/content/wknd/us/en/` is `/content/wknd`.	`/docs`

url.provider MUST be one of the following:

Value	Description	Display name
`cdn`	CDN (content delivery network).	CDN
`first_party`	First-party provider.	First Party
`third_party`	Third-party provider.	Third Party

User

User fields

Representation of a physical or logical user.

Attribute	Type	Description	Examples
`user.email`	string	stable Display name: `User email` Email of the user.	`user@mail.com`
`user.id`	string	stable Display name: `User ID` Unique UUID of a human user. If the system itself has to be represented, the constant 'system' is used.	`35ba9499-f87c-4047-962c-14dc32e255e5`; `system`
`user.name`	string	experimental Display name: `User name` Full name of the user. If the system itself has to be represented, the constant 'System' is used.	`Wolfgang Amadeus Mozart`; `System`
`user.organization`	string	experimental Display name: `User organization` Organization the user belongs to.	`DYNATRACE`; `CUSTOMER`; `PARTNER`
`user.type`	string	experimental Source system type label for the kind of identity the account represents	`User`; `ServicePrincipal`; `ManagedIdentity`; `ServiceAccount`; `system`

user.organization MUST be one of the following:

Value	Description	Display name
`CUSTOMER`	Customer organization	Customer
`DYNATRACE`	Dynatrace organization	Dynatrace
`PARTNER`	Dynatrace partner organization	Partner

user.organization MUST be one of the following:

Value	Description
`DYNATRACE`	Dynatrace organization
`CUSTOMER`	Customer organization
`PARTNER`	Dynatrace partner organization

User agent

User agent fields

Fields describing the HTTP User-Agent string. Applicable to any technology that processes HTTP requests (load balancers, CDNs, WAFs, web servers, API gateways).

Attribute	Type	Description	Examples
`user_agent.name`	string	experimental Parsed name of the user agent extracted from user_agent.original	`Chrome`; `Safari`; `aws-sdk-java`; `curl`; `python-requests`
`user_agent.original`	string	stable The raw, unparsed User-Agent string as received in the HTTP User-Agent request header. Not scoped to browser clients—applicable to any HTTP client including browsers, SDKs, CLIs, bots, and services.	`Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36`; `aws-sdk-java/2.20.0 Linux/5.15.0 OpenJDK_64-Bit_Server_VM/17.0.5`; `curl/7.88.1`; `python-requests/2.28.2`
`user_agent.version`	string	experimental Parsed version of the user agent extracted from user_agent.original	`120.0.6099.109`; `14.1.2`; `2.20.0`; `7.88.1`

VCS Repository

The vcs namespace contains information about Version Control Systems.

VCS fields

Attribute	Type	Description	Examples
`vcs.change.id`	string	experimental Display name: `Change request ID` The identifier of the change, for example, pull request ID or merge request ID. It is typically unique per repository and generated by the version control system itself.	`1234`
`vcs.change.state`	string	experimental Display name: `Change request state` The state of the change, for example, the state of a pull request or merge request.	`wip`; `open`; `reopened`; `closed`; `merged`
`vcs.change.title`	string	experimental Display name: `Change request title` The human-readable title of the change, for example, pull request title or merge request title.	`CA-1234: Fix some stuff`; `[chore] update dependency`
`vcs.change.url.full`	string	experimental Display name: `Change request full URL` The full URL to the change, for example, the full URL to the pull request or merge request.	`https://github.com/dynatrace-oss/terraform-provider-dynatrace/pull/20`
`vcs.line_change.type`	string	experimental Display name: `Line change type` The type of line change being measured on a branch or change.	`added`; `removed`
`vcs.ref.base.name`	string	experimental Display name: `Base reference name` The name of the reference in the repository. This can be a branch name or a tag name. ¹	`my-branch-name`
`vcs.ref.base.revision`	string	experimental Display name: `Base reference revision` The revision in the repository. For Git this is a synonym for a commit hash, whereas in SVN it is a revision number. ²	`d4322ab6cba38d21ad83c9de304a6a214ecf2cdc`; `main`; `1337`
`vcs.ref.base.type`	string	experimental Display name: `Base reference type` The reference type in the repository. ³	`branch`; `tag`
`vcs.ref.head.name`	string	experimental Display name: `Head reference name` The name of the reference in the repository. This can be a branch name or a tag name. ⁴	`my-branch-name`
`vcs.ref.head.revision`	string	experimental Display name: `Head reference revision` The revision in the repository. For Git, this is a synonym for a commit hash, whereas in SVN, it is a revision number. ⁵	`d4322ab6cba38d21ad83c9de304a6a214ecf2cdc`; `main`; `1337`
`vcs.ref.head.type`	string	experimental Display name: `Head reference type` The reference type in the repository. ⁶	`branch`; `tag`
`vcs.ref.type`	string	experimental Display name: `Reference type` The reference type in the repository.	`branch`; `tag`
`vcs.repository.name`	string	experimental Display name: `Repository name` The human-readable name of the repository. It should not include any additional identifiers like GitLab group or GitHub organization. ⁷	`dynatrace-configuration-as-code`
`vcs.repository.url.full`	string	experimental Display name: `Repository full URL` The repository's full URL. ⁸	`https://github.com/dynatrace-oss/terraform-provider-dynatrace`
`vcs.revision_delta.direction`	string	experimental Display name: `Revision delta direction` The type of revision comparison.	`ahead`; `behind`

The base name refers to the starting point of a change. For example, if a feature branch was created from main, main is the base reference of type branch.

The base revision refers to the starting revision of a change. For example, if a branch was created from a certain commit, this commit is the base revision.

The base type refers to the reference type of the starting point of a change. For example, if a feature branch was created from the main branch, branch is the base reference's type.

⁴

The head name refers to the current reference's name. For example, if main is currently checked out, the head name is main.

⁵

The head revision refers to the currently referenced revision.

⁶

The head type refers to the currently referenced type in the repository. For example, if the main branch is currently checked out, the head reference is of type branch.

⁷

Be aware that the repository name might clash with forked repositories.

⁸

For Git VCS, this should not include the .git URL suffix.

vcs.change.state has the following list of well-known values. If one of them applies, then the respective value MUST be used, otherwise a custom value MAY be used.

Value	Description	Display name
`closed`	The change was closed without being merged into the target code base.	Closed
`merged`	The change has successfully been merged into the target code base.	Merged
`open`	The change is open and ready for review or currently under review. It has not been merged yet, and changes are still possible.	Open
`reopened`	The change was re-opened after being `closed` and is ready for review again.	Reopened
`wip`	The change is still a work in progress and not yet ready for review.	Work In Progress

vcs.line_change.type has the following list of well-known values. If one of them applies, then the respective value MUST be used, otherwise a custom value MAY be used.

Value	Description	Display name
`added`	How many lines were added.	Added
`removed`	How many lines were removed.	Removed

vcs.ref.base.type has the following list of well-known values. If one of them applies, then the respective value MUST be used, otherwise a custom value MAY be used.

Value	Description	Display name
`branch`	The base reference type is a branch.	Branch
`tag`	The base reference type is a tag.	Tag

vcs.ref.head.type has the following list of well-known values. If one of them applies, then the respective value MUST be used, otherwise a custom value MAY be used.

Value	Description	Display name
`branch`	The head reference type is a branch.	Branch
`tag`	The head reference type is a tag.	Tag

vcs.ref.type has the following list of well-known values. If one of them applies, then the respective value MUST be used, otherwise a custom value MAY be used.

Value	Description	Display name
`branch`	The reference type is a branch.	Branch
`tag`	The reference type is a tag.	Tag

vcs.revision_delta.direction has the following list of well-known values. If one of them applies, then the respective value MUST be used, otherwise a custom value MAY be used.

Value	Description	Display name
`ahead`	How many revisions the change is ahead of the target ref.	Ahead
`behind`	How many revisions the change is behind of the target ref.	Behind

VMware

VMware fields

Fields that can come from applications running on VMware.

Attribute	Type	Description	Examples
`vmware.datacenter.name`	string	resource experimental Display name: `VMware datacenter name` The name of the data center in which the hypervisor is running.	`srvwasapp1Cell01`
`vmware.disk.name`	string	resource experimental Display name: `VMware disk name` ESXi host disk.	`srvwasapp1Cell01`
`vmware.hypervisor.name`	string	resource experimental Display name: `VMware hypervisor name` ESXi host.	`my-hypervisor.lab.dynatrace.org`
`vmware.nic.name`	string	resource experimental Display name: `VMware nic name` ESXi host network interface.	`vmnic0`; `vmnic1`; `vmnic2`
`vmware.vcenter.name`	string	resource experimental Display name: `VMware vcenter name` Name of the VMware vCenter server managing the multi-hypervisor environment.	`my-vcenter.lab.dynatrace.org`
`vmware.vm.name`	string	resource experimental Display name: `VMware vm name` The name of the virtual machine.	`easytravel-demo`

Vulnerability

Vulnerability fields

Attribute	Type	Description	Examples
`vulnerability.code_location.name`	string	stable Display name: `Vulnerability code location name` Name of the code location where the code-level vulnerability was detected.	`org.dynatrace.profileservice.BioController.markdownToHtml(String):80`
`vulnerability.cvss.base_score`	double	stable Display name: `Vulnerability CVSS base score` Vulnerability's CVSS base score provided by NVD.	`8.1`
`vulnerability.cvss.version`	string	stable Display name: `Vulnerability CVSS version` Vulnerability's CVSS score version.	`3.1`; `4.0`
`vulnerability.davis_assessment.assessment_mode`	string	stable Display name: `Vulnerability assessment mode` Availability of the information based on which the vulnerability assessment has been done.	`FULL`; `NOT_AVAILABLE`; `REDUCED`
`vulnerability.davis_assessment.assessment_mode_reasons`	string[]	experimental Display name: `Vulnerability Davis assessment mode reasons` Reasons for the assessment mode.	`['LIMITED_BY_CONFIGURATION', 'LIMITED_AGENT_SUPPORT']`
`vulnerability.davis_assessment.data_assets_status`	string	stable Display name: `Vulnerability data assets status` Vulnerability's reachability of related data assets by affected entities.	`NOT_AVAILABLE`; `NOT_DETECTED`; `REACHABLE`
`vulnerability.davis_assessment.exploit_status`	string	stable Display name: `Vulnerability exploit status` Vulnerability's public exploits status.	`AVAILABLE`; `NOT_AVAILABLE`
`vulnerability.davis_assessment.exposure_status`	string	stable Display name: `Vulnerability exposure status` Vulnerability's internet exposure status.	`NOT_AVAILABLE`; `NOT_DETECTED`; `PUBLIC_NETWORK`; `ADJACENT_NETWORK`
`vulnerability.davis_assessment.level`	string	stable Display name: `Vulnerability Davis security level` Vulnerability's risk level based on Davis Security Score.	`LOW`; `MEDIUM`; `HIGH`; `CRITICAL`; `NONE`
`vulnerability.davis_assessment.score`	double	stable Display name: `Vulnerability Davis security score` Vulnerability's Davis Security Score (1-10) calculated by Dynatrace.	`8.1`
`vulnerability.davis_assessment.vulnerable_function_status`	string	stable Display name: `Vulnerability vulnerable function status` Usage status of the vulnerable functions causing the vulnerability.	`IN_USE`; `NOT_AVAILABLE`; `NOT_IN_USE`
`vulnerability.description`	string	stable Display name: `Vulnerability description` Description of the vulnerability.	`More detailed description about improper input validation vulnerability.`
`vulnerability.display_id`	string	stable Display name: `Vulnerability display ID` Dynatrace user-readable identifier for the vulnerability.	`S-1234`
`vulnerability.exploit.status`	string	experimental Display name: `Vulnerability exploit status` Whether there is a known exploit for the vulnerability.	`AVAILABLE`; `NOT_AVAILABLE`
`vulnerability.external_id`	string	stable Display name: `Vulnerability external ID` External provider's unique identifier for the vulnerability.	`SNYK-JAVA-ORGAPACHEHTTPCOMPONENTS-30646`
`vulnerability.external_url`	string	stable Display name: `Vulnerability external URL` External provider's URL to the details page of the vulnerability.	`https://example.com`
`vulnerability.first_seen`	timestamp	stable Display name: `Vulnerability first seen` Timestamp of when the vulnerability was first detected.	`2023-03-22T13:19:36.945Z`
`vulnerability.id`	string	stable Display name: `Vulnerability ID` Dynatrace unique identifier for the vulnerability.	`2039861408676243188`
`vulnerability.is_fix_available`	boolean	experimental Display name: `Vulnerability is fix available` Indicates if a vulnerability fix is available.
`vulnerability.mute.change_date`	timestamp	stable Display name: `Vulnerability mute change date` Timestamp of the vulnerability's last muted or unmuted action.	`2023-03-22T13:19:36.945Z`
`vulnerability.mute.comment`	string	experimental Display name: `Vulnerability mute comment` Comment when muting or unmuting the vulnerability.	`Muted because it's a false positive.`
`vulnerability.mute.reason`	string	stable Display name: `Vulnerability mute reason` Reason for muting or unmuting the vulnerability.	`FALSE_POSITIVE`; `IGNORE`; `AFFECTED`; `CONFIGURATION_NOT_AFFECTED`; `OTHER`
`vulnerability.mute.status`	string	stable Display name: `Vulnerability mute status` Vulnerability's mute status.	`MUTED`; `NOT_MUTED`
`vulnerability.mute.user`	string	stable Display name: `Vulnerability mute user` User who last changed the vulnerability's mute status.	`user@example.com`
`vulnerability.parent.davis_assessment.assessment_mode`	string	stable Display name: `Vulnerability parent assessment mode` Availability of the information based on which the vulnerability assessment has been done.	`FULL`; `NOT_AVAILABLE`; `REDUCED`
`vulnerability.parent.davis_assessment.data_assets_status`	string	stable Display name: `Vulnerability parent data assets status` Vulnerability's reachability of related data assets by affected entities.	`NOT_AVAILABLE`; `NOT_DETECTED`; `REACHABLE`
`vulnerability.parent.davis_assessment.exposure_status`	string	stable Display name: `Vulnerability parent exposure status` Vulnerability's internet exposure status.	`NOT_AVAILABLE`; `NOT_DETECTED`; `PUBLIC_NETWORK`; `ADJACENT_NETWORK`
`vulnerability.parent.davis_assessment.level`	string	stable Display name: `Vulnerability parent Davis security level` Vulnerability's Davis Security Score level.	`LOW`; `MEDIUM`; `HIGH`; `CRITICAL`; `NONE`
`vulnerability.parent.davis_assessment.score`	double	stable Display name: `Vulnerability parent Davis security score` Vulnerability's Davis Security Score (1-10) calculated by Dynatrace.	`8.1`
`vulnerability.parent.davis_assessment.vulnerable_function_status`	string	stable Display name: `Vulnerability parent vulnerable function status` Usage status of vulnerable functions causing the vulnerability. Status is `IN_USE` when there's at least one vulnerable function in use by an application.	`IN_USE`; `NOT_AVAILABLE`; `NOT_IN_USE`
`vulnerability.parent.first_seen`	string	stable Display name: `Vulnerability parent first seen` Timestamp of when the vulnerability was first detected.	`2023-03-22T13:19:36.945Z`
`vulnerability.parent.mute.change_date`	timestamp	stable Display name: `Vulnerability parent mute change date` Timestamp of the last mute or unmute action of the vulnerability.	`2023-03-22T13:19:36.945Z`
`vulnerability.parent.mute.reason`	string	stable Display name: `Vulnerability parent mute reason` Reason for muting or unmuting the vulnerability.	`FALSE_POSITIVE`; `IGNORE`; `AFFECTED`; `CONFIGURATION_NOT_AFFECTED`; `OTHER`
`vulnerability.parent.mute.status`	string	stable Display name: `Vulnerability parent mute status` Vulnerability's mute status.	`MUTED`; `NOT_MUTED`
`vulnerability.parent.mute.user`	string	stable Display name: `Vulnerability parent mute user` User who last changed the vulnerability's mute status.	`user@example.com`
`vulnerability.parent.resolution.change_date`	string	stable Display name: `Vulnerability parent resolution change date` Timestamp of the vulnerability's last resolution status change.	`2023-03-22T13:19:37.466Z`
`vulnerability.parent.resolution.status`	string	stable Display name: `Vulnerability parent resolution status` Current status of the vulnerability.	`OPEN`; `RESOLVED`
`vulnerability.parent.risk.level`	string	stable Display name: `Vulnerability parent risk level` Vulnerability's risk score level defined by the provider. For Dynatrace, the Davis Security Score level.	`LOW`; `MEDIUM`; `HIGH`; `CRITICAL`; `NONE`
`vulnerability.parent.risk.score`	double	stable Display name: `Vulnerability parent risk score` Vulnerability's risk score defined by the provider. For Dynatrace, Davis Security Score.	`8.1`
`vulnerability.previous.cvss.base_score`	double	stable Display name: `Vulnerability previous CVSS base score` Vulnerability's previous CVSS base score (in case the CVSS base score has changed).	`8.1`
`vulnerability.previous.davis_assessment.data_assets_status`	string	stable Display name: `Vulnerability previous data assets status` Vulnerability's previous reachability of related data assets by affected entities (in case the reachability has changed).	`NOT_AVAILABLE`; `NOT_DETECTED`; `REACHABLE`
`vulnerability.previous.davis_assessment.exploit_status`	string	stable Display name: `Vulnerability previous exploit status` Vulnerability's previous public exploit status (in case the public exploit status has changed).	`AVAILABLE`; `NOT_AVAILABLE`
`vulnerability.previous.davis_assessment.exposure_status`	string	stable Display name: `Vulnerability previous exposure status` Vulnerability's previous internet exposure status (in case the internet exposure status has changed).	`NOT_AVAILABLE`; `NOT_DETECTED`; `PUBLIC_NETWORK`; `ADJACENT_NETWORK`
`vulnerability.previous.davis_assessment.level`	string	stable Display name: `Vulnerability previous Davis security level` Vulnerability's previous risk level (in case the risk level has changed).	`LOW`; `MEDIUM`; `HIGH`; `CRITICAL`; `NONE`
`vulnerability.previous.davis_assessment.score`	double	stable Display name: `Vulnerability previous Davis security score` Vulnerability's previous Davis Security Score (in case Davis Security Score has changed).	`8.1`
`vulnerability.previous.davis_assessment.vulnerable_function_status`	string	stable Display name: `Vulnerability previous vulnerable function status` Vulnerability's previous vulnerable function status (in case the vulnerable function status has changed).	`IN_USE`; `NOT_AVAILABLE`; `NOT_IN_USE`
`vulnerability.previous.external_id`	string	experimental Display name: `Vulnerability previous external ID` Vulnerability’s unique identifier from the previous external provider.	`SNYK-JAVA-ORGAPACHEHTTPCOMPONENTS-30646`
`vulnerability.previous.mute.change_date`	string	stable Display name: `Vulnerability previous mute change date` Timestamp of the vulnerability's previous mute status (in case the mute status has changed).	`2023-03-22T13:19:36.945Z`
`vulnerability.previous.mute.comment`	string	experimental Display name: `Vulnerability previous mute comment` Comment of the vulnerability's previous mute status.	`Muted because it's a false positive.`
`vulnerability.previous.mute.reason`	string	stable Display name: `Vulnerability previous mute reason` Reason for last muting or unmuting the vulnerability (in case the reason for muting or unmuting the vulnerability has changed).	`Muted: False positive`
`vulnerability.previous.mute.status`	string	stable Display name: `Vulnerability previous mute status` Vulnerability's previous mute status (in case the mute status has changed).	`MUTED`; `NOT_MUTED`
`vulnerability.previous.mute.user`	string	stable Display name: `Vulnerability previous mute user` User who last changed the vulnerability's mute status (in case the mute status was last changed by a different user).	`user@example.com`
`vulnerability.previous.resolution.status`	string	stable Display name: `Vulnerability previous resolution status` Vulnerability's previous resolution status (in case the resolution status has changed).	`OPEN`; `RESOLVED`
`vulnerability.previous.risk.level`	string	stable Display name: `Vulnerability previous risk level` Vulnerability's previous risk score level (in case the risk score level has changed).	`LOW`; `MEDIUM`; `HIGH`; `CRITICAL`
`vulnerability.previous.risk.score`	double	stable Display name: `Vulnerability previous risk score` Vulnerability's previous risk score (in case the risk score has changed).	`8.1`
`vulnerability.references.cve`	string[]	stable Display name: `Vulnerability CVE references` List of the vulnerability's CVE IDs.	`['CVE-2021-41079']`
`vulnerability.references.cwe`	string[]	stable Display name: `Vulnerability CWE references` List of the vulnerability's CWE IDs.	`['CWE-20']`
`vulnerability.references.owasp`	string[]	stable Display name: `Vulnerability OWASP references` List of vulnerability's OWASP IDs.	`['2021:A3']`
`vulnerability.remediation.description`	string	experimental Display name: `Vulnerability remediation description` Description of the vulnerability's remediation advice.	`Upgrade component to version 1.2.3 or higher`
`vulnerability.remediation.status`	string	experimental Display name: `Vulnerability remediation status` Indicates whether a fix for the vulnerability is available.	`AVAILABLE`; `NOT_AVAILABLE`
`vulnerability.resolution.change_date`	timestamp	stable Display name: `Vulnerability resolution change date` Timestamp of the vulnerability's last resolution status change.	`2023-03-22T13:19:37.466Z`
`vulnerability.resolution.status`	string	stable Display name: `Vulnerability resolution status` Vulnerability's resolution status.	`OPEN`; `RESOLVED`
`vulnerability.risk.level`	string	stable Display name: `Vulnerability risk level` Vulnerability's risk score level defined by the provider. For Dynatrace, the Davis Security Score level.	`LOW`; `MEDIUM`; `HIGH`; `CRITICAL`; `NONE`
`vulnerability.risk.scale`	string	stable Display name: `Vulnerability risk scale` Scale by which the vulnerability's risk score and risk score level defined by the provider are measured.	`Davis Security Score`
`vulnerability.risk.score`	double	stable Display name: `Vulnerability risk score` Vulnerability's risk score defined by the provider. For Dynatrace, Davis Security Score.	`8.1`
`vulnerability.stack`	string	experimental Display name: `Vulnerability stack` Level of the vulnerable component in the technological stack.	`CODE`; `CODE_LIBRARY`; `SOFTWARE`; `CONTAINER_ORCHESTRATION`
`vulnerability.technology`	string	stable Display name: `Vulnerability technology` Technology of the vulnerable component.	`JAVA`; `DOTNET`; `GO`; `PHP`; `NODE_JS`
`vulnerability.title`	string	stable Display name: `Vulnerability title` Title of the vulnerability.	`Improper Input Validation`
`vulnerability.type`	string	stable Display name: `Vulnerability type` Classification of the vulnerability based on commonly accepted enums, such as CWE.	`Improper Input Validation`
`vulnerability.url`	string	stable Display name: `Vulnerability URL` Dynatrace URL to the details page of the vulnerability. \|	`https://example.com`

vulnerability.davis_assessment.assessment_mode has the following list of well-known values. If one of them applies, then the respective value MUST be used, otherwise a custom value MAY be used.

Value	Description	Display name
`FULL`	full	Full
`NOT_AVAILABLE`	not_available	Not Available
`REDUCED`	reduced	Reduced

vulnerability.davis_assessment.data_assets_status has the following list of well-known values. If one of them applies, then the respective value MUST be used, otherwise a custom value MAY be used.

Value	Description	Display name
`NOT_AVAILABLE`	not_available	Not Available
`NOT_DETECTED`	not_detected	Not Detected
`REACHABLE`	reachable	Reachable

vulnerability.davis_assessment.exploit_status has the following list of well-known values. If one of them applies, then the respective value MUST be used, otherwise a custom value MAY be used.

Value	Description	Display name
`AVAILABLE`	available	Available
`NOT_AVAILABLE`	not_available	Not Available

vulnerability.davis_assessment.exposure_status has the following list of well-known values. If one of them applies, then the respective value MUST be used, otherwise a custom value MAY be used.

Value	Description	Display name
`ADJACENT_NETWORK`	adjacent_network	Adjacent Network
`NOT_AVAILABLE`	not_available	Not Available
`NOT_DETECTED`	not_detected	Not Detected
`PUBLIC_NETWORK`	public_network	Public Network

vulnerability.davis_assessment.level has the following list of well-known values. If one of them applies, then the respective value MUST be used, otherwise a custom value MAY be used.

Value	Description	Display name
`CRITICAL`	critical	Critical
`HIGH`	high	High
`LOW`	low	Low
`MEDIUM`	medium	Medium
`NONE`	none	No risk

vulnerability.davis_assessment.vulnerable_function_status has the following list of well-known values. If one of them applies, then the respective value MUST be used, otherwise a custom value MAY be used.

Value	Description	Display name
`IN_USE`	in_use	In Use
`NOT_AVAILABLE`	not_available	Not Available
`NOT_IN_USE`	not_in_use	Not In Use

vulnerability.mute.reason has the following list of well-known values. If one of them applies, then the respective value MUST be used, otherwise a custom value MAY be used.

Value	Description	Display name
`AFFECTED`	affected	Affected
`CONFIGURATION_NOT_AFFECTED`	configuration_not_affected	Configuration Not Affected
`FALSE_POSITIVE`	false_positive	False Positive
`IGNORE`	ignore	Ignore
`OTHER`	other	Other

vulnerability.mute.status has the following list of well-known values. If one of them applies, then the respective value MUST be used, otherwise a custom value MAY be used.

Value	Description	Display name
`MUTED`	muted	Muted
`NOT_MUTED`	not_muted	Not Muted

vulnerability.parent.davis_assessment.assessment_mode has the following list of well-known values. If one of them applies, then the respective value MUST be used, otherwise a custom value MAY be used.

Value	Description	Display name
`FULL`	full	Full
`NOT_AVAILABLE`	not_available	Not Available
`REDUCED`	reduced	Reduced

vulnerability.parent.davis_assessment.data_assets_status has the following list of well-known values. If one of them applies, then the respective value MUST be used, otherwise a custom value MAY be used.

Value	Description	Display name
`NOT_AVAILABLE`	not_available	Not Available
`NOT_DETECTED`	not_detected	Not Detected
`REACHABLE`	reachable	Reachable

vulnerability.parent.davis_assessment.exposure_status has the following list of well-known values. If one of them applies, then the respective value MUST be used, otherwise a custom value MAY be used.

Value	Description	Display name
`ADJACENT_NETWORK`	adjacent_network	Adjacent Network
`NOT_AVAILABLE`	not_available	Not Available
`NOT_DETECTED`	not_detected	Not Detected
`PUBLIC_NETWORK`	public_network	Public Network

vulnerability.parent.davis_assessment.level has the following list of well-known values. If one of them applies, then the respective value MUST be used, otherwise a custom value MAY be used.

Value	Description	Display name
`CRITICAL`	critical	Critical
`HIGH`	high	High
`LOW`	low	Low
`MEDIUM`	medium	Medium
`NONE`	none	No risk

vulnerability.parent.davis_assessment.vulnerable_function_status has the following list of well-known values. If one of them applies, then the respective value MUST be used, otherwise a custom value MAY be used.

Value	Description	Display name
`IN_USE`	in_use	In Use
`NOT_AVAILABLE`	not_available	Not Available
`NOT_IN_USE`	not_in_use	Not In Use

vulnerability.parent.mute.reason has the following list of well-known values. If one of them applies, then the respective value MUST be used, otherwise a custom value MAY be used.

Value	Description	Display name
`AFFECTED`	affected	Affected
`CONFIGURATION_NOT_AFFECTED`	configuration_not_affected	Configuration Not Affected
`FALSE_POSITIVE`	false_positive	False Positive
`IGNORE`	ignore	Ignore
`OTHER`	other	Other

vulnerability.parent.mute.status has the following list of well-known values. If one of them applies, then the respective value MUST be used, otherwise a custom value MAY be used.

Value	Description	Display name
`MUTED`	muted	Muted
`NOT_MUTED`	not_muted	Not Muted

vulnerability.parent.resolution.status has the following list of well-known values. If one of them applies, then the respective value MUST be used, otherwise a custom value MAY be used.

Value	Description	Display name
`OPEN`	open	Open
`RESOLVED`	resolved	Resolved

vulnerability.parent.risk.level has the following list of well-known values. If one of them applies, then the respective value MUST be used, otherwise a custom value MAY be used.

Value	Description	Display name
`CRITICAL`	critical	Critical
`HIGH`	high	High
`LOW`	low	Low
`MEDIUM`	medium	Medium
`NONE`	none	No risk

vulnerability.previous.davis_assessment.data_assets_status has the following list of well-known values. If one of them applies, then the respective value MUST be used, otherwise a custom value MAY be used.

Value	Description	Display name
`NOT_AVAILABLE`	not_available	Not Available
`NOT_DETECTED`	not_detected	Not Detected
`REACHABLE`	reachable	Reachable

vulnerability.previous.davis_assessment.exploit_status has the following list of well-known values. If one of them applies, then the respective value MUST be used, otherwise a custom value MAY be used.

Value	Description	Display name
`AVAILABLE`	available	Available
`NOT_AVAILABLE`	not_available	Not Available

vulnerability.previous.davis_assessment.exposure_status has the following list of well-known values. If one of them applies, then the respective value MUST be used, otherwise a custom value MAY be used.

Value	Description	Display name
`ADJACENT_NETWORK`	adjacent_network	Adjacent Network
`NOT_AVAILABLE`	not_available	Not Available
`NOT_DETECTED`	not_detected	Not Detected
`PUBLIC_NETWORK`	public_network	Public Network

vulnerability.previous.davis_assessment.level has the following list of well-known values. If one of them applies, then the respective value MUST be used, otherwise a custom value MAY be used.

Value	Description	Display name
`CRITICAL`	critical	Critical
`HIGH`	high	High
`LOW`	low	Low
`MEDIUM`	medium	Medium
`NONE`	none	No risk

vulnerability.previous.davis_assessment.vulnerable_function_status has the following list of well-known values. If one of them applies, then the respective value MUST be used, otherwise a custom value MAY be used.

Value	Description	Display name
`IN_USE`	in_use	In Use
`NOT_AVAILABLE`	not_available	Not Available
`NOT_IN_USE`	not_in_use	Not In Use

vulnerability.previous.mute.status has the following list of well-known values. If one of them applies, then the respective value MUST be used, otherwise a custom value MAY be used.

Value	Description	Display name
`MUTED`	muted	Muted
`NOT_MUTED`	not_muted	Not Muted

vulnerability.previous.resolution.status has the following list of well-known values. If one of them applies, then the respective value MUST be used, otherwise a custom value MAY be used.

Value	Description	Display name
`OPEN`	open	Open
`RESOLVED`	resolved	Resolved

vulnerability.previous.risk.level has the following list of well-known values. If one of them applies, then the respective value MUST be used, otherwise a custom value MAY be used.

Value	Description	Display name
`CRITICAL`	critical	Critical
`HIGH`	high	High
`LOW`	low	Low
`MEDIUM`	medium	Medium
`NONE`	none	No risk

vulnerability.resolution.status has the following list of well-known values. If one of them applies, then the respective value MUST be used, otherwise a custom value MAY be used.

Value	Description	Display name
`OPEN`	open	Open
`RESOLVED`	resolved	Resolved

vulnerability.risk.level has the following list of well-known values. If one of them applies, then the respective value MUST be used, otherwise a custom value MAY be used.

Value	Description	Display name
`CRITICAL`	critical	Critical
`HIGH`	high	High
`LOW`	low	Low
`MEDIUM`	medium	Medium
`NONE`	none	No risk

vulnerability.stack has the following list of well-known values. If one of them applies, then the respective value MUST be used, otherwise a custom value MAY be used.

Value	Description	Display name
`CODE`	code	Code
`CODE_LIBRARY`	code_library	Code Library
`CONTAINER_ORCHESTRATION`	container_orchestration	Container Orchestration
`SOFTWARE`	software	Software

vulnerability.technology has the following list of well-known values. If one of them applies, then the respective value MUST be used, otherwise a custom value MAY be used.

Value	Description	Display name
`DOTNET`	dotnet	.NET
`GO`	go	Go
`JAVA`	java	Java
`NODE_JS`	node_js	Node.js
`PHP`	php	PHP

WebLogic

WebLogic fields

Attribute	Type	Description	Examples
`weblogic.cluster.name`	string	resource experimental Display name: `WebLogic cluster name` The name of the cluster this instance belongs to.	`OrderManagement2`
`weblogic.domain.name`	string	resource experimental Display name: `WebLogic domain name` The name of the domain this instance belongs to.	`CustomerManagementFulfillmentSvc`
`weblogic.home`	string	resource experimental Display name: `WebLogic home directory` The instance's home directory.	`/apps/infra/wls/bin/10.3.6_64/wlserver_10.3/server`
`weblogic.server.name`	string	resource experimental Display name: `WebLogic server name` The instance's server name.	`OrderManagement2Srv1`

Websocket

The WebSocket namespace contains information on WebSocket attributes for user events. When this namespace is used, the request fields (URL and network namespace) must also be used, and url.full and network.protocol.name must be set.

WebSocket fields

Attribute	Type	Description	Examples
`websocket.connection.status_code`	long	experimental Display name: `Websocket connection status code` The WebSocket connection status code.	`1001`

WebSphere

WebSphere fields

Attribute	Type	Description	Examples
`websphere.cell.name`	string	resource experimental Display name: `WebSphere cell name` The name of the cell this instance belongs to.	`srvwasapp1Cell01`
`websphere.cluster.name`	string	resource experimental Display name: `WebSphere cluster name` The name of the cluster this instance belongs to.	`CluApp1`
`websphere.node.name`	string	resource experimental Display name: `WebSphere node name` Name of the node to which this instance belongs.	`nodeSrvApp2`
`websphere.server.name`	string	resource experimental Display name: `WebSphere server name` The instance's server name.	`SrvApp2`

WebSphere Liberty

WebSphere Liberty fields

Attribute	Type	Description	Examples
`websphere_liberty.server.name`	string	resource experimental Display name: `WebSphere liberty server name` The instance's server name.	`defaultServer`

Windows Event Log (Winlog)

Winlog fields

Attribute	Type	Description	Examples
`winlog.eventid`	long	experimental Display name: `Event Log Event ID` Event ID is a unique identifier assigned to each event logged by the system. Each event ID corresponds to a specific type of event, such as an error, warning, or informational message. (4624 -> successful logon, 1000 -> application error)	`4624`; `1000`
`winlog.keywords`	string	experimental Display name: `Event Log Keywords` Keywords are used to categorize and group events. This categorization allows to quickly identify and focus on specific types of events that are relevant to your troubleshooting or monitoring needs.	`Classic`; `Started`
`winlog.level`	string	experimental Display name: `Event Log Level` Level of an event indicates its severity or importance	`Critical`; `Error`; `Warrning`
`winlog.opcode`	string	experimental Display name: `Event Log Opcode` Opcode is a value that identifies a specific activity or a point within an activity that the application was performing when it raised the event. This helps in understanding the context of the event more precisely.	`Info`; `Download`
`winlog.provider`	string	experimental Display name: `Event Log Provider` Provider is a component or service that generates events. Providers are responsible for writing specific types of events to the event logs, such as application errors, security events, or system warnings.	`Avecto Service`; `Security-SPP`
`winlog.task`	long	experimental Display name: `Event Log Task` Task refers to the specific operation or activity that an event is associated with. Each event is categorized under a task, which helps in identifying what the system or application was doing when the event was logged. This can be particularly useful for troubleshooting and understanding the context of the event. (5 -> HTTP Configuration Property Trace Task, 12804 -> Other Object Access Events)	`5`; `12804`
`winlog.username`	string	experimental Display name: `Event Log Username` Username refers to the account name associated with specific events, such as logon or logoff activities. This is particularly useful for tracking user activity and identifying who was logged into the system at a given time.	`SYSTEM`; `N/A`

z/OS

z/OS fields

Attribute	Type	Description	Examples
`cics.transaction.system_id`	string	resource experimental Display name: `CICS transaction system ID` The system ID of the CICS region that this transaction executed on.	`C259`; `CICS`
`zos.address_space_id`	long	resource experimental Display name: `z/OS address space ID` The address space identifier (ASID) of the z/OS address space.	`1`; `296`
`zos.cpu_model_number`	string	resource experimental Display name: `z/OS CPU model number` The model number of the CPU assigned to this LPAR.	`8562`; `3931`
`zos.cpu_serial_number`	string	resource experimental Display name: `z/OS CPU serial number` The serial number of the CPU assigned to this LPAR.	`054BB88562`; `15D77D2084`
`zos.job_id`	string	resource experimental Display name: `z/OS job ID` The job ID of the z/OS address space.	`JOB12345`
`zos.job_name`	string	resource experimental Display name: `z/OS job name` The jobname of the z/OS address space.	`CICSAOR0`; `CTGATM00`; `IMSCR15`
`zos.job_step_id`	string	resource experimental Display name: `z/OS job step ID` The step ID within the job within the z/OS address space.	`00000001`; `00000002`
`zos.lpar_name`	string	resource experimental Display name: `z/OS lpar name` The name of the LPAR that the z/OS address space executes within.	`S0W1`; `ABCD`
`zos.sys_id`	string	resource experimental Display name: `z/OS system ID` The system ID of the CICS/IMS address space.	`C259`; `CICS`; `IMSF`
`zos.system_name`	string	resource experimental Display name: `Z/os system name` The name of the z/OS system instance.	`S0W1`; `ABCD`
`zos.total_general_purpose_processors`	long	resource experimental Display name: `z/OS total general purpose processors` The number of general purpose processors (GCPs) assigned for this LPAR.	`1`; `190`
`zos.total_physical_memory`	long	resource experimental Display name: `z/OS total physical memory` The total amount of memory, in terabytes, assigned for this LPAR.	`1`; `16`
`zos.total_ziip_processors`	long	resource experimental Display name: `z/OS total ziip processors` The number of zIIPs assigned for this LPAR.	`0`; `8`
`zos.transaction.job_name`	string	resource experimental Display name: `z/OS transaction job name` The jobname of the z/OS address space that the transaction executed in.	`CICSAOR0`; `CTGATM00`; `IMSCR15`
`zos.transaction.lpar_name`	string	resource experimental Display name: `z/OS transaction lpar name` The name of the LPAR that the transaction executed on.	`S0W1`; `ABCD`
`zos.virtualization`	string	resource experimental Display name: `z/OS virtualization` Type of virtualization on the mainframe.	`LPAR`

z/OS transaction fields

Attribute	Type	Description	Examples
`zos.transaction.call_type`	string	experimental Display name: `Transaction call type` The type of transaction call that was invoked.	`CTG`
`zos.transaction.id`	string	experimental Display name: `Transaction ID` The ID of this transaction.	`CEMT`; `DTAX`; `IVTNO`
`zos.transaction.program_type`	string	experimental Display name: `Transaction program type` The type of transaction that was executed.	`DLI_DB`; `DLI_DC`; `MQ`; `DB2`

zos.transaction.call_type MUST be one of the following:

Value	Description	Display name
`CTG`	A CTG request triggered this transaction.	CTG
`DPL`	A CICS DPL request triggered this transaction.	DPL
`HTTP`	An HTTP or HTTPS request triggered this transaction.	HTTP
`IMS_CONNECT`	An IMS Connect request triggered this transaction.	IMS Connect
`IMS_CONNECT_API`	An IMS Connect API request triggered this transaction.	IMS Connect API
`IMS_TRANS_EXEC`	The application program being scheduled and running to handle this transaction.	IMS transaction execute
`ITRA`	An IMS TM Resource Adapter request triggered this transaction.	ITRA
`MQ`	An MQ operation triggered this transaction.	MQ
`MSC`	An IMS MSC request triggered this transaction.	MSC
`PGM_SWITCH`	An IMS Program Switch request triggered this transaction.	Program switch
`SDK`	An SDK call triggered this transaction.	SDK
`SHARED_QUEUE`	An IMS Shared Queue request triggered this transaction.	Shared queue
`SOAP`	A SOAP request triggered this transaction.	SOAP
`START`	An EXEC CICS START triggered this transaction.	START
`TTX`	A green screen terminal transaction code triggered this transaction.	TTX
`TX`	A CICS or IMS transaction code triggered this transaction.	TX
`ZOS_CONNECT`	A z/OS Connect request triggered this transaction.	z/OS Connect

zos.transaction.program_type MUST be one of the following:

Value	Description	Display name
`DB2`	The transaction performs DB2 database actions.	DB2
`DLI_DB`	The transaction performs DLI database actions.	DLI database
`DLI_DC`	The transaction performs DLI data communications actions.	DLI data communications
`MQ`	The transaction performs MQ Queue actions.	MQ

CICS transaction fields

Attribute	Type	Description	Examples
`cics.transaction.class_name`	string	experimental Display name: `CICS class name` The name of the transaction class of this transaction.	`null`; `DFHTCL00`
`cics.transaction.client.ip`	ipAddress	experimental Display name: `CICS client IP` IP address of the client (IPv4 or IPv6) that made the request that triggered the transaction.	`194.232.104.141`; `2a01:468:1000:9::140`
`cics.transaction.client.port`	long	experimental Display name: `CICS client port` Port number of the client that made the request that triggered the transaction.	`65123`; `80`
`cics.transaction.path.name`	string	experimental Display name: `CICS path name` The path name, only applicable for web requests.	`/dtrouter`
`cics.transaction.task_id`	long	experimental Display name: `CICS task ID` The CICS task ID of this transaction.	`1234`
`cics.transaction.transaction_group_id`	string	experimental Display name: `CICS transaction group ID` The transaction group ID assigned at transaction attach time.	`160dd5c5e3c44bc8e5c5c1c3f4f4f9df9fa2d8b049cb800000000000`
`cics.transaction.unit_of_work_id`	long	experimental Display name: `CICS unit of work ID` The unit of work ID for this transaction, which is normally represented as a hex value.	`15977055984148641282`; `15977055491352760323`
`cics.transaction.user_id`	string	experimental Display name: `CICS user ID` The user ID of the user who triggered this transaction.	`USER1`; `anon`
`cics.transaction.wlm.reporting_service_class_name`	string	experimental Display name: `CICS WLM reporting service class name` The name of the z/OS Workload Manager (WLM) reporting service class of this transaction.	`null`; `BAT_ATM`; `RC_CICS`
`cics.transaction.wlm.service_class_name`	string	experimental Display name: `CICS WLM service class name` The name of the z/OS Workload Manager (WLM) service class of this transaction.	`null`; `SYSSTC`; `VEL15I5`

CICS file fields

Attribute	Type	Description	Examples
`cics.file.defining_region_name`	string	experimental Display name: `CICS file defining region name` The system ID of the CICS region that is defined on the request.	`C259`; `CICS`
`cics.file.is_local`	boolean	experimental Display name: `CICS file is local` A boolean that is true if the file is defined within the CICS region that it executed in.	`true`
`cics.file_name`	string	experimental Display name: `CICS file name` The logical name of the file, as defined in CEDA.	`EXMPCAT`; `CICSFILE`

IMS transaction fields

Attribute	Type	Description	Examples
`ims.message.transaction.message.segment_count`	long	experimental Display name: `IMS message segment count` The number of segments in the message.	`1`; `5`
`ims.message.transaction.message.size`	long	experimental Display name: `IMS message size` The size of the message.	`10`; `421`
`ims.message.transaction.terminal_name`	string	experimental Display name: `IMS terminal name` The terminal name that this IMS transaction executed on.	`HWSAM5ZD`; `10505`
`ims.message.transaction.unit_of_work_id`	long	experimental Display name: `IMS message unit of work ID` The unit of work ID for this transaction, which is normally represented as a hex value.	`5981228500318430862871015129591113287966852300630664295044916520394057871645605888`; `5981112713529734741010744557477214433959078921583025076794253743298954785382793216`
`ims.message.transaction.user_id`	string	experimental Display name: `IMS message user ID` The user ID of the user who triggered this transaction.	`USER1`; `anon`

IMS execution transaction fields

Attribute	Type	Description	Examples
`ims.execution.transaction.commit_count`	long	experimental Display name: `IMS commit count` The commit count for this transaction.	`4`; `5`
`ims.execution.transaction.current_priority`	long	experimental Display name: `IMS current priority` The current priority of this transaction.	`1`; `5`
`ims.execution.transaction.execution_class`	long	experimental Display name: `IMS execution class` The execution class of this transaction.	`45`; `66`
`ims.execution.transaction.psb_name`	string	experimental Display name: `IMS PSB name` The PSB name that this IMS transaction executed on.	`HWSAM5ZD`; `10505`
`ims.execution.transaction.schedule_count`	long	experimental Display name: `IMS schedule count` The schedule count for this transaction.	`346613`; `421`
`ims.execution.transaction.unit_of_work_id`	long	experimental Display name: `IMS execution unit of work ID` The unit of work ID for this transaction, which is normally represented as a hex value.	`5981228500318430862871015129591113287966852300630664295044916520394057871645605888`; `5981112713529734741010744557477214433959078921583025076794253743298954785382793216`

IMS Connect transaction span fields

Attribute	Type	Description	Examples
`ims.connect.transaction.client.ip`	ipAddress	experimental Display name: `IMS Connect transaction client IP` IP address of the client (IPv4 or IPv6) that made the request that triggered the transaction.	`194.232.104.141`; `2a01:468:1000:9::140`
`ims.connect.transaction.server.port`	long	experimental Display name: `IMS Connect transaction server port` Port number on the IMS Connect server that received the request for this transaction	`65123`; `80`
`ims.connect.transaction.user_id`	string	experimental Display name: `IMS Connect user ID` The user ID of the user who triggered this transaction.	`USER1`; `anon`

IMS TM Resource Adapter transaction fields

Attribute	Type	Description	Examples
`ims.tm.resource.adapter.semantic_detection_version`	string	experimental Display name: `IMS tm resource adapter semantic detection version` The detection version for this transaction.	`1`
`ims.tm.resource.adapter.transaction.client.ip`	ipAddress	experimental Display name: `IMS tm resource adapter transaction client IP` IP address of the client (IPv4 or IPv6) that made the request that triggered the transaction.	`194.232.104.141`; `2a01:468:1000:9::140`
`ims.tm.resource.adapter.transaction.client.port`	long	experimental Display name: `IMS tm resource adapter transaction client port` Port number of the client that made the request that triggered the transaction.	`65123`; `80`
`ims.tm.resource.adapter.transaction.commit_mode`	long	experimental Display name: `IMS tm resource adapter transaction commit mode` The commit mode of the transaction.	`0`
`ims.tm.resource.adapter.transaction.datastore_name`	string	experimental Display name: `IMS tm resource adapter transaction datastore name` The datastore name used by this transaction.	`IMS1500`
`ims.tm.resource.adapter.transaction.interaction_verb`	long	experimental Display name: `IMS tm resource adapter transaction interaction verb` The interaction verb that triggered the transaction.	`0`
`ims.tm.resource.adapter.transaction.lpar_name`	string	experimental Display name: `IMS tm resource adapter transaction lpar name` The name of the LPAR that the transaction executed on.	`S0W1`; `ABCD`
`ims.tm.resource.adapter.transaction.sync_level`	long	experimental Display name: `IMS tm resource adapter transaction sync level` Indicates the synchronization level of the transaction. This only applies when the interaction verb is set to "SYNC_SEND_RECEIVE", "SYNC_SEND", or "SYNC_RECEIVE_CALLOUT". This attribute applies to both conversational and non-conversational applications. It is used in conjuction with the ims.transaction.request.transaction.commit_mode attribute.	`0`

ims.tm.resource.adapter.transaction.commit_mode MUST be one of the following:

Value	Description	Display name
`0`	The commit happens before sending the response.	Commit then send
`1`	The commit is deferred until the response has been sent and acknowledged.	Send then commit

ims.tm.resource.adapter.transaction.interaction_verb MUST be one of the following:

Value	Description	Display name
`0`	SYNC_SEND	SYNC_SEND
`1`	SYNC_SEND_RECEIVE	SYNC_SEND_RECEIVE
`3`	SYNC_END_CONVERSATION	SYNC_END_CONVERSATION
`4`	SYNC_RECEIVE_ASYNCOUTPUT	SYNC_RECEIVE_ASYNCOUTPUT
`5`	SYNC_RECEIVE_ASYNCOUTPUT_SINGLE_NOWAIT	SYNC_RECEIVE_ASYNCOUTPUT_SINGLE_NOWAIT
`6`	SYNC_RECEIVE_ASYNCOUTPUT_SINGLE_WAIT	SYNC_RECEIVE_ASYNCOUTPUT_SINGLE_WAIT
`7`	SYNC_RECEIVE_CALLOUT	SYNC_RECEIVE_CALLOUT

ims.tm.resource.adapter.transaction.sync_level MUST be one of the following:

Value	Description	Display name
`0`	There will be no synchronization.	No synchronization
`1`	Synchronization will be confirmed.	Confirm

z/OS Connect

z/OS Connect fields

Attribute	Type	Description	Examples
`zosconnect.api.description`	string	experimental Display name: `API description` The z/OS Connect API description.	`The API for the CICS catalog manager sample application.`
`zosconnect.api.name`	string	experimental Display name: `API name` The z/OS Connect API name.	`catalog`
`zosconnect.api.version`	string	experimental Display name: `API version` The z/OS Connect API version.	`1.0.0`
`zosconnect.request.body.size`	long	experimental Display name: `Request body size` The size of the request payload in bytes.	`234`
`zosconnect.request.id`	long	experimental Display name: `Request ID` The z/OS Connect request ID.	`2215`
`zosconnect.request.type`	string	experimental Display name: `Request type` The type of the REST request. ¹	`ADMIN`
`zosconnect.response.body.size`	long	experimental Display name: `Response body size` The size of the response payload in bytes.	`125`
`zosconnect.service.description`	string	experimental Display name: `Service description` The z/OS Connect service description.	`EDUCHAN service using the CICS Service Provider`
`zosconnect.service.name`	string	experimental Display name: `Service name` The z/OS Connect service name.	`placeOrder`
`zosconnect.service.provider.name`	string	experimental Display name: `Service provider name` The service provider name.	`CICS-1.0`
`zosconnect.service.version`	string	experimental Display name: `Service version` The z/OS Connect service version.	`2.0`
`zosconnect.sor.identifier`	string	experimental Display name: `System of record identifier` The system of record identifier. The format differs depending on the SOR type. ²	`localhost:8080`
`zosconnect.sor.reference`	string	experimental Display name: `System of record reference` The system of record reference.	`cicsConn`
`zosconnect.sor.resource`	string	experimental Display name: `System of record resource` Identifier for the resource invoked on the system of record. The format differs depending on the SOR type. ³	`01,DFH0XCMN`
`zosconnect.sor.type`	string	experimental Display name: `System of record type` The system of record type.	`CICS`

See https://www.ibm.com/docs/en/zos-connect/zosconnect/3.0?topic=spi-datarequesttype

See https://www.ibm.com/docs/en/zos-connect/zosconnect/3.0?topic=spi-data#SOR_IDENTIFIER

See https://www.ibm.com/docs/en/zos-connect/zosconnect/3.0?topic=spi-data#SOR_RESOURCE

zosconnect.request.type MUST be one of the following:

Value	Description	Display name
`ADMIN`	admin	Admin
`API`	api	API
`SERVICE`	service	Service
`UNKNOWN`	unknown	Unknown

zosconnect.sor.type MUST be one of the following:

Value	Description	Display name
`CICS`	cics	CICS
`IMS`	ims	IMS
`MQ`	mq	MQ
`REST`	rest	REST
`WOLA`	wola	WOLA