The following reference contains a list of global fields that have a well defined semantic meaning in Dynatrace and can be used across different monitoring types. The fields are organized in namespaces that are separated with dots.
Base fields
The top level fields contain generally relevant information for all events and data points.
Attribute
Type
Description
Examples
timestamp
timestamp
stable Display name: Timestamp The time (UNIX Epoch time in nanoseconds) when the event originated, typically when the source created it. If no original timestamp is available, it will be populated at ingest time and required for all events. In the case of a correlated event (for example, ITIL events), this time could be different from the event.start time, as this time represents the actual timestamp when the "update" for the event was created.
1649822520123123123
timeframe
record[]
stable Display name: Timeframe The timeframe represented by a timeseries record.
start_time
timestamp
stable Display name: Start time Start time of a data point. Value is a UNIX Epoch time in nanoseconds and less than or equal to the end_time.
1649822520123123123
end_time
timestamp
stable Display name: End time End time of a data point. Value is a UNIX Epoch time in nanoseconds and greater than or equal to the start_time.
1649822520123123165
duration
duration
stable Display name: Duration The difference between start_time and end_time in nanoseconds.
42
interval
string
stable Display name: Interval Denotes the timeframe of represented by individual timeseries measurements returned by a timeseries record.
1 min
Actor
The actor namespace describes the origin of a security detection—the entity or location from which a threat or suspicious activity originates.
Actor fields
Attribute
Type
Description
Examples
actor.geo.city.name
string
experimental Display name: Actor city name Name of the city from which the actor operates.
Rome
actor.geo.continent.name
string
experimental Display name: Actor continent name Name of the continent from which the actor operates.
North America
actor.geo.country.name
string
experimental Display name: Actor country name Name of the country from which the actor operates.
Canada
actor.ips
ipAddress[]
stable Display name: Actor IP addresses List of the client's IP addresses (IPv4 or IPv6) from which the actor operates.
[168.10.15.23, 2a01:468:1000:9::140]
actor.k8s.cluster.name
string
experimental Display name: Actor Kubernetes cluster name Name of the Kubernetes cluster from which the actor operates (for example, in case of a compromised or malicious pod/node).
cluster-1; rancher01
actor.k8s.cluster.uid
string
experimental Display name: Actor Kubernetes cluster UID UID of the Kubernetes cluster from which the actor operates (for example, in case of a compromised or malicious pod/node).
experimental Display name: Actor Kubernetes container name Name of the container within a Kubernetes pod from which the actor operates (for example, in case of a compromised or malicious pod).
nginx; envoy
actor.k8s.namespace.name
string
experimental Display name: Actor Kubernetes namespace name Name of the Kubernetes namespace from which the actor operates (for example, in case of a compromised or malicious pod).
default; kube-system
actor.k8s.namespace.uid
string
experimental Display name: Actor Kubernetes namespace UID UID of the Kubernetes namespace from which the actor operates (for example, in case of a compromised or malicious pod).
experimental Display name: Actor Kubernetes pod name Name of the Kubernetes pod from which the actor operates (for example, in case of a compromised or malicious pod).
experimental Display name: Actor Kubernetes pod UID UID of the Kubernetes pod from which the actor operates (for example, in case of a compromised or malicious pod).
resourceexperimental Display name: Adobe Experience Manager program Adobe Experience Manager (AEM) service. Contains the customer defined name of the AEM environment.
adobe.em.service
string
resourceexperimental Display name: Adobe Experience Manager service Adobe Experience Manager (AEM) service. Contains the program and environment IDs the customer is exposed to.
OneAgent might aggregate spans that have the same parent span into a single span. The aggregated span contains attributes to indicate the aggregation and to allow reconstructing details.
Aggregation fields
For aggregated spans the start_time holds the earliest start_time, end_time holds the latest end_time of all aggregated spans.
Attribute
Type
Description
Examples
aggregation.count
long
stable Display name: Aggregation count The number of spans aggregated into this span. Because this span represents multiple spans, the value is >1.
3
aggregation.duration_max
duration
stable Display name: Aggregation duration maximum The duration in nanoseconds for the longest aggregated span.
482
aggregation.duration_min
duration
stable Display name: Aggregation duration minimum The duration in nanoseconds for the shortest aggregated span.
42
aggregation.duration_samples
duration[]
stable Display name: Aggregation duration samples Array of reservoir sampled span durations of the aggregated spans. The duration samples can be used to estimate a more accurate duration distribution of aggregated spans rather than the average value.
[42, 482, 301]
aggregation.duration_sum
duration
stable Display name: Aggregation duration sum The duration sum in nanoseconds for all aggregated spans.
123
aggregation.exception_count
long
stable Display name: Aggregation exception count The number of aggregated spans that included an exception.
0; 6
aggregation.parallel_execution
boolean
stable Display name: Aggregation parallel execution true indicates that aggregated spans may have been executed in parallel. Therefore, start_time + duration_sum may exceed end_time.
Apache HTTP Server
Apache Tomcat fields
Attribute
Type
Description
Examples
apache.tomcat.base
string
resourceexperimental Display name: Apache Tomcat base directory The server's base directory. This is what usually is referred to as CATALINA_BASE.
/usr/share/tomcat6
apache.tomcat.home
string
resourceexperimental Display name: Apache Tomcat home directory The server's home directory. This is what usually is referred to as CATALINA_HOME.
/usr/share/tomcat6
Apache HTTP Server fields
Attribute
Type
Description
Examples
apache.httpd.config.path
string
resourceexperimental Display name: Apache HTTP server configuration path
apache.httpd.module.name
string
resourceexperimental Display name: Apache HTTP server module name The name of the Apache HTTP Server module that generated the log entry.
core; proxy
Apache Spark fields
Attribute
Type
Description
Examples
apache.spark.master.ip
string
resourceexperimental Display name: Apache Spark master IP
App
The app namespace contains information on the application sending the event.
App fields
Attribute
Type
Description
Examples
app.bundle
string
resourcestable Display name: App bundle The name of the bundle, for example, the bundle identifier on iOS or the applicationId on Android.
com.example.easytravel
app.id
string
resourcestable Display name: App ID An optional unique application identifier. Chosen by the customer
easytravel
app.short_version
string
resourcestable Display name: App version The application's publicly visible version number, as, for example, displayed in App Store or Google Play. Usually this is just the major and minor version with no patch number.
5.23
app.version
string
resourcestable Display name: App build version The application's internal build number, which can include information such as patch number and build number.
experimental Display name: Argo CD sync operation outcome Message associated with synchronization operation. 2
successfully synced (no more tasks); Operation terminated (retried 4 times)
argocd.sync.operation_state.phase
string
experimental Display name: Argo CD sync operation phase Status of the synchronization operation between source and target. 3
Running; Succeeded; Error; Failed
argocd.sync.status
string
experimental Display name: Argo CD sync status The sync status represents the current state of reconciliation. 4
SYNCED; OUT OF SYNC; UNKNOWN
1
The value is equal to the app.status.health.status value in Argo CD.
2
The value is equal to the app.status.operationState.message value in Argo CD.
3
The value is equal to the app.status.operationState.phase value in Argo CD.
4
The value is equal to the app.status.sync.status value in Argo CD.
Artifact
The artifact namespace contains information about software artifacts.
Artifact fields
Attribute
Type
Description
Examples
artifact.attestation.filename
string
experimental Display name: Artifact attestation filename The provenance filename of the built attestation. It directly relates to the artifact.filename.
carts-service-amd64-0.1.1.tar.gz.intoto.json1
artifact.attestation.hash
string
experimental Display name: Artifact attestation hash The full hash value of the built attestation.
experimental Display name: Artifact attestation ID The ID of the build software attestation.
1337
artifact.filename
string
experimental Display name: Artifact filename The filename of the software artifact, typically generated by the build process. This is similar to the artifact.id, but can contain the artifact.version and other data like file extension.
carts-service-amd64-0.1.1.tar.gz
artifact.hash
string
experimental Display name: Artifact hash The full hash value of the software artifact. This value is used to verify the integrity of the software artifact.
Authenticated via API access token or personal access token
Token
authentication.client.id and authentication.token MUST follow the Dynatrace token format definition.
Specifically, authentication.client.id MUST be prefixed with dt0s02.
Availability
Availability fields
Information about entity availability. Sample usage is reporting hosts and PGI-s availability by OS Agent.
Value of availability.state can be used for calculating aggregate availability (dividing count of "successful" requests by count of all requests).
With constant frequency of requests it can be treated as a time-base availability, showing percentage of time that the monitored entity was available.
Attribute
Type
Description
Examples
availability.state
string
stable Display name: Availability state State of entity (host or PGI) availability.
up
availability.state has the following list of well-known values. If one of them applies, then the respective value MUST be used, otherwise a custom value MAY be used.
Value
Description
Display name
available
[PGI] PGI is available and reported.
Available
no_data
[HOST] Host is working, agent active but no data are sent.
No data
no_data_agent_inactive
[HOST] Host is working, agent inactive (disabled manually in configuration). No data are sent.
No data agent inactive
reboot_graceful
[HOST] Host has started after graceful shutdown.
Reboot graceful
reboot_ungraceful
[HOST] Host has started after ungraceful shutdown.
Reboot ungraceful
shutdown_host
[HOST] Host has been shut down.
Shutdown host
unavailable
[PGI] PGI is unavailable and not reported.
Unavailable
unimportant
[PGI] PGI is available but not reported because it became unimportant.
Unimportant
unmonitored_agent_stopped
[HOST] Host is unmonitored because agent stopped.
Agent stopped
unmonitored_agent_uninstalled
[HOST] Host is unmonitored because agent has been uninstalled.
Agent uninstalled
unmonitored_agent_upgrade
[HOST] Host is unmonitored because agent is upgrading.
Agent upgrading
up
[HOST] Host is working, agent active and sending data.
Up
Amazon Web Services (AWS)
AWS resource fields
Fields that can come from applications running on AWS.
Attribute
Type
Description
Examples
aws.account.id
string
resourcestable Display name: AWS account ID The 12-digit number, such as 123456789012, that uniquely identifies an AWS account. Tags: permissionprimary-field
123456789012
aws.account.name
string
resourceexperimental Display name: AWS account name Name associated with the AWS account.
example.com
aws.alb.name
string
resourceexperimental Display name: AWS application load balancer name Application load balancer name that instance is behind.
my-alb
aws.arn
string
resourcestable Display name: AWS ARN Amazon Resource Name (ARN).
resourceexperimental Display name: AWS CloudFront response result type How the server classified the response just before returning the response to the viewer.
Hit; Miss; LimitExceeded
aws.cloudfront.result_type
string
resourceexperimental Display name: AWS CloudFront result type How the server classified the response after the last byte left the server.
Hit; Miss; LimitExceeded
aws.ecr.account.id
string
resourceexperimental Display name: AWS ECR account ID
resourceexperimental Display name: AWS Lambda execution environment The runtime identifier, prefixed by AWS_Lambda_. Lambda supports multiple languages through the use of runtimes. A runtime provides a language-specific environment that relays invocation events, context information, and responses between Lambda and the function.
AWS_Lambda_java8
aws.fle.fields_number
long
resourceexperimental Display name: AWS field-level encryption fields number The number of field-level encryption fields that the server encrypted and forwarded to the origin.
12; 27
aws.fle.status
string
resourceexperimental Display name: AWS field-level encryption status When field-level encryption is configured for a distribution, this field contains a code that indicates whether the request body was successfully processed.
FieldLengthLimitClientError
aws.lambda.function.name
string
resourceexperimental Display name: Lambda function name
aws.lambda.initialization_type
string
resourceexperimental Display name: AWS Lambda initialization type The AWS Lambda initialization type. Same string value as available in AWS_LAMBDA_INITIALIZATION_TYPE.
snap_start
aws.log_group
string
resourceexperimental Display name: Log group Amazon CloudWatch group of log streams that share the same retention, monitoring, and access control settings.
/aws/lambda/a-SomeFunction-1AWHD6W1QC5DH
aws.log_stream
string
resourceexperimental Display name: Log stream A sequence of log events that share the same source.
resourcestable Display name: AWS region A specific geographical AWS Cloud location. Tags: primary-field
us-east-1
aws.resource.id
string
resourcestable Display name: AWS resource ID Unique, immutable identifier assigned to the AWS cloud resource.
i-0922cda4579db3a45
aws.resource.name
string
resourcestable Display name: AWS resource name Name of the resource for named resources, value of the "Name" tag in AWS for non-named resources (if unavailable, same as aws.resource.id).
my-ec2-instance
aws.resource.type
string
resourceexperimental Display name: AWS resource type The name of a resource type in CloudFormation format.
resourceexperimental Display name: AWS service The service that identifies the AWS product.
s3
aws.tags.__tag_key__
string
resourceexperimental Display name: AWS tag Contains the value for the tag with the tag key named __tag_key__ defined in the tag enrichment configuration.
dt_owner_mail
aws.fle.status MUST be one of the following:
Value
Description
Display name
FieldLengthLimitClientError
A field that is configured to be encrypted exceeds the maximum length allowed.
Field Length Limit Error
FieldNumberLimitClientError
A request that the distribution is configured to encrypt contains more than the number of fields allowed.
Field Number Limit Error
ForwardedByContentType
The server forwarded the request to the origin without parsing or encryption because no content type was configured.
Forwarded By Content Type
ForwardedByQueryArgs
The server forwarded the request to the origin without parsing or encryption because the request contains a query argument that wasn't in the configuration for field-level encryption.
Forwarded By Query Args
ForwardedDueToNoProfile
The server forwarded the request to the origin without parsing or encryption because no profile was specified in the configuration for field-level encryption.
Forwarded No Profile
MalformedContentTypeClientError
The server rejected the request and returned an HTTP 400 status code to the viewer because the value of the Content-Type header was in an invalid format.
Malformed Content Type Error
MalformedInputClientError
The server rejected the request and returned an HTTP 400 status code to the viewer because the request body was in an invalid format.
Malformed Input Error
MalformedQueryArgsClientError
The server rejected the request and returned an HTTP 400 status code to the viewer because a query argument was empty or in an invalid format.
Malformed Query Args Error
Processed
The server successfully processed the request body, encrypted values in the specified fields, and forwarded the request to the origin.
FLE Processed
RejectedByContentType
The server rejected the request and returned an HTTP 400 status code to the viewer because no content type was specified in the configuration for field-level encryption.
Rejected By Content Type
RejectedByQueryArgs
The server rejected the request and returned an HTTP 400 status code to the viewer because no query argument was specified in the configuration for field-level encryption.
Rejected By Query Args
RequestLengthLimitClientError
The length of the request body exceeded the maximum length allowed when field-level encryption is configured.
Request Length Limit Error
ServerError
The origin server returned an error.
Server Error
aws.lambda.initialization_type has the following list of well-known values. If one of them applies, then the respective value MUST be used, otherwise a custom value MAY be used.
Value
Description
Display name
on-demand
On demand
On Demand
provisioned-concurrency
Provisioned concurrency
Provisioned Concurrency
snap-start
SnapStart
Snap Start
AWS span fields
Attribute
Type
Description
Examples
aws.kinesis.arn
string
experimental Display name: AWS Kinesis ARN Amazon resource name (ARN) of a Kinesis stream or consumer.
experimental Display name: AWS Kinesis stream name Name of a Kinesis stream.
MyKinesisStream
aws.lambda.invoked_arn
string
experimental Display name: AWS Lambda invoked ARN The full invoked ARN as provided on the Context passed to the function (Lambda-Runtime-Invoked-Function-Arn response header from the request to /runtime/invocation/next).
experimental Display name: AWS request ID The AWS request ID (e.g., value of x-amzn-requestid, x-amzn-request-id, or x-amz-request-id HTTP header, awsRequestId field in AWS lambda context object).
0e7bc729-a468-57e8-8143-98f2eec5c925
aws.s3.bucket
string
experimental Display name: AWS S3 bucket Name of an S3 bucket.
experimental Display name: AWS S3 upload ID Upload ID identifying the multipart upload targeted by an operation (abort/complete/upload/…).
dfRtDYWFbkRONycy.Yxwh66Yjlx.cph0gtNBtJ
aws.xray.trace_id
string
experimental Display name: X-Ray trace ID Contains the AWS X-Ray trace id (e.g., value of the x-amzn-trace-id HTTP header, _X_AMZN_TRACE_ID environment variable on AWS lambda)
experimental (NLB) The application protocol negotiated with the backend target via the ALPN extension. A mismatch between this and aws.elb.alpn.frontend_protocol indicates a protocol negotiation asymmetry between the client and backend.
h2; http/1.1; http/1.0
aws.elb.alpn.client_preference
string[]
experimental (NLB) The full list of application protocols advertised by the client in the ALPN extension of the TLS ClientHello message, URL-encoded and truncated at 256 bytes. Not present if no ALPN policy is configured or if the extension is absent.
['h2', 'http/1.1']; ['h2']
aws.elb.alpn.frontend_protocol
string
experimental (NLB) The application protocol negotiated with the client via the ALPN extension. Not present if no ALPN policy is configured, if no matching protocol is found, or if the client did not send a valid protocol list.
h2; http/1.1; http/1.0
aws.elb.chosen_cert_arn
string
experimental (ALB, NLB) The ARN of the certificate presented to the client. For ALB, set to "session-reused" if the TLS session was resumed. Not present if the listener is not HTTPS or TLS, or if no valid TLS ClientHello was received (NLB).
experimental (ALB) A unique opaque identifier for the client-to-load-balancer connection. All requests routed through the same keep-alive connection share this identifier, enabling correlation of access log entries with connection logs events such as TLS errors or connection resets.
Root=1-67891233-abcdef012345678912345678
aws.elb.connection_time
long (Millisecond)
experimental (NLB) The total time elapsed (in milliseconds) for the connection to complete, measured from when the load balancer received the TCP SYN to when the connection is closed. Includes the TLS handshake duration (aws.elb.tls_handshake_time). Note: in milliseconds, unlike ALB and Classic LB processing times, which are in seconds.
150; 1200; 45
aws.elb.connection_type
string
experimental (ALB) The type of request or connection. Encodes both the application protocol and transport variant (for example, wss is WebSocket over TLS).
https; h2; wss; grpcs; ws; http
aws.elb.destination.ip
ipAddress
experimental (NLB) The IP address of the NLB listener endpoint that received the connection. If the client connects using a VPC Endpoint service, the destination is the VPC endpoint. This is not the backend target IP address.
10.0.1.100; 10.0.2.50
aws.elb.destination.port
long
experimental (NLB) The port of the NLB listener endpoint that received the connection. Complements aws.elb.destination.ip.
443; 8443
aws.elb.desync_mitigation_classification
string
experimental (ALB) The classification of the request based on HTTP desync mitigation, per RFC 7230 compliance. Present only for requests that do not fully comply with RFC 7230.
Acceptable; Ambiguous; Severe
aws.elb.desync_mitigation_classification_reason
string
experimental (ALB) The reason code describing why the request was classified for HTTP desync mitigation. Complements aws.elb.desync_mitigation_classification. Present only when the request does not comply with RFC 7230.
AmbiguousUri; BadHeader; MultipleContentLength
aws.elb.error_reason
string
experimental (ALB) The error reason code when a request fails. Set when an error occurs during the authenticate or Lambda target processing action, or when a request is not routable. Present only for failed requests.
experimental (NLB) The integer value of the TLS alert received from the client, as defined in RFC 5246 (for example, 40 = handshake_failure, 42 = bad_certificate). Present only if a TLS alert was received from the client during the connection.
40; 42; 46
aws.elb.listener.id
string
experimental (NLB) The resource ID of the load balancer listener that processed the connection. Identifies which listener on the NLB handled the connection, useful for multi-listener NLBs routing different ports or protocols.
1234567890abcdef; ead889d3c69590bd
aws.elb.redirect_url
string
experimental (ALB) The URL of the redirect target set in the Location response header when the ALB performed a redirect action. Present only when a redirect action was executed.
https://example.com/new-path
aws.elb.request.processing_time
double (Second)
experimental (ALB, Classic LB) The total time elapsed (in seconds, with millisecond precision) from when the load balancer received the request from the client until it dispatched the request to a target. Set to -1 if the load balancer could not dispatch the request (for example, if the target closed the connection before the idle timeout expired, or if the client sent a malformed request).
0.0; 0.001; -1.0
aws.elb.request.transform_status
string
experimental (ALB) The status of the URL rewrite or host-header transform action configured for the listener rule. Present only when a transform action was applied.
experimental (ALB) The value of the Host header after a host-header rewrite transform was applied by the ALB listener rule. Present only when a host-header rewrite transform changed the value of the Host header.
new-host.example.com
aws.elb.request.transformed_uri
string
experimental (ALB) The request URI after a URL rewrite transform was applied by the ALB listener rule. Present only when a URL rewrite transform changed the URI.
/new/path?param=value
aws.elb.response.processing_time
double (Second)
experimental (ALB, Classic LB) The total time elapsed (in seconds, with millisecond precision) from when the load balancer received the response header from the target until it started sending the response to the client. Includes both the queuing time at the load balancer and the connection acquisition time from the load balancer to the client. Set to -1 if the target did not respond before the idle timeout expired.
0.0; 0.002; -1.0
aws.elb.rule_priority
long
experimental (ALB) The priority of the listener rule that processed the request. A value of 0 indicates that the default action was taken. A value of -1 indicates that a rules evaluation error occurred.
1; 100; 50000; 0; -1
aws.elb.target.processing_time
double (Second)
experimental (ALB, Classic LB) The total time elapsed (in seconds, with millisecond precision) from when the load balancer sent the request to a target until the target started sending response headers. Set to -1 if the target did not respond before the idle timeout expired or if the connection was closed before a response was received.
0.001; 0.042; -1.0
aws.elb.target.status_code
long
experimental (ALB, Classic LB) The HTTP status code of the response received from the backend target. Distinct from http.response.status_code, which is the load balancer's own response code returned to the client. Not present if no connection was established to the target or the target did not send an HTTP response.
200; 302; 500; 503
aws.elb.target_group_arn
string
experimental (ALB) The Amazon Resource Name (ARN) of the target group that received the request. Identifies which backend pool the listener rule selected.
experimental (ALB) A space-delimited list of IP address and port combinations for the targets that processed the request. Currently contains one item matching the target selected from the target group. Present only when a request was dispatched to a target. Not present if target is a Lambda function or the request is blocked by AWS WAF.
['10.0.1.42:8080']
aws.elb.target_status_code_list
long[]
experimental (ALB) A space-delimited list of HTTP status codes returned by the targets. Currently contains one item matching aws.elb.target.status_code. Present only when a target responded.
[200]; [503]
aws.elb.tls_handshake_time
long (Millisecond)
experimental (NLB) The total time elapsed (in milliseconds) for the TLS handshake to complete after the TCP connection was established, including client-side delays. Included in aws.elb.connection_time. Not present if there is no TLS handshake or if the TLS handshake fails.
12; 45; 120
aws.elb.tls_key_exchange
string
experimental (NLB) The key exchange algorithm and, if applicable, the elliptic curve or group used during the TLS or PQ-TLS handshake. Not present if TLS negotiation did not complete. Useful for tracking post-quantum TLS (PQ-TLS) algorithm adoption.
ECDHE-RSA; X25519MLKEM768; RSA
aws.route53.edge_location_id
string
experimental Display name: Route 53 edge location ID The Route 53 edge location that responded to the query. Each edge location is identified by a three-letter code and an arbitrary number.
FRA54-SN1; DFW3
aws.route53.hostedzone_id
string
experimental Display name: Route 53 hosted zone ID The ID of the hosted zone that is associated with all the DNS queries in this log.
Z1234567890ABCDEFGHIJ
aws.route53.resolver_ip_address
string
experimental Display name: Route 53 resolver IP address The IP address of the DNS resolver that submitted the request to Route 53.
192.168.1.1; 2001:db8::1234
dns.question.name
string
experimental Display name: DNS question name The domain or subdomain that was specified in the request.
example.com; support.dynatrace.com/
dns.question.type
string
experimental Display name: DNS question type Either the DNS record type that was specified in the request, or ANY.
A; AAAA; CNAME; TXT; ANY
dns.response_code
string
experimental Display name: DNS response code The DNS response code that Route 53 returned in response to the DNS query.
NOERROR; NXDOMAIN
aws.elb.alpn.backend_protocol has the following list of well-known values. If one of them applies, then the respective value MUST be used, otherwise a custom value MAY be used.
Value
Description
h2
HTTP/2 over TLS.
http/1.0
HTTP/1.0.
http/1.1
HTTP/1.1.
aws.elb.alpn.frontend_protocol has the following list of well-known values. If one of them applies, then the respective value MUST be used, otherwise a custom value MAY be used.
Value
Description
h2
HTTP/2 over TLS.
http/1.0
HTTP/1.0.
http/1.1
HTTP/1.1.
aws.elb.connection_type has the following list of well-known values. If one of them applies, then the respective value MUST be used, otherwise a custom value MAY be used.
Value
Description
grpcs
TLS-encrypted gRPC connection.
h2
TLS-encrypted HTTP/2 connection.
http
Unencrypted HTTP/1.x connection.
https
TLS-encrypted HTTP/1.x connection.
ws
Unencrypted WebSocket connection.
wss
TLS-encrypted WebSocket connection.
aws.elb.desync_mitigation_classification MUST be one of the following:
Value
Description
Acceptable
Request is RFC 7230-compliant.
Ambiguous
Request is RFC 7230 non-compliant but poses low risk.
Severe
Request poses a high risk of HTTP desync.
aws.elb.error_reason has the following list of well-known values. If one of them applies, then the respective value MUST be used, otherwise a custom value MAY be used.
Value
Description
AWSALBTGCookieInvalid
ALB target-group stickiness cookie is invalid.
AuthInvalidCookie
Authentication cookie is invalid.
JWTHeaderNotPresent
JWT header required for authentication is missing.
LambdaInvalidResponse
Lambda target returned an invalid response.
Microsoft Azure
Azure resource fields
Fields that can come from applications running on Azure.
Attribute
Type
Description
Examples
azure.availability_zones
string[]
resourceexperimental Display name: Azure availability zones Availability zones of Azure cloud resource.
['1']
azure.class_name
string
resourceexperimental Display name: Azure function class name The fully qualified name of the class executing an Azure function.
Host.Functions
azure.container_app.dnssuffix
string
resourceexperimental Display name: Azure container app DNS suffix The DNS suffix for the Container Apps environment.
resourcestable Display name: Azure location A specific geographical location of Azure cloud resource. Tags: primary-field
westeurope
azure.management_group
string
resourceexperimental Display name: Azure management group A group of Azure subscriptions used for governance use cases.
Tenant Root Group; My Custom Group
azure.resource.group
string
resourcestable Display name: Azure resource group A resource group is a container that holds related resources for an Azure solution. Tags: permissionprimary-field
demo-backend-rg
azure.resource.id
string
resourceexperimental Display name: Azure resource ID A unique, immutable identifier assigned to each Azure cloud resource.
resourceexperimental Display name: Azure resource name User-provided name of the Azure cloud resource.
demo-aks
azure.resource.type
string
resourceexperimental Display name: Azure resource type The name of a resource type in the format: {resource-provider}/{resource-type}.
Microsoft.ContainerService/managedClusters
azure.service_bus_namespace.name
string
resourceexperimental Display name: Azure Service Bus namespace Azure Service Bus name.
my-service-bus
azure.site_name
string
resourceexperimental Display name: Azure site name Globally unique deployment information about an Azure function.
dt-function-scripted
azure.sql_elastic_pool.name
string
resourceexperimental Display name: Azure SQL elastic pool name Azure SQL Server Elastic Pool name.
contoso-elastic-pool
azure.sql_server.name
string
resourceexperimental Display name: Azure SQL server name Azure SQL Server name.
contoso-sql-server
azure.subscription
string
resourcestable Display name: Azure subscription An Azure subscription is a logical container used to provision resources in Azure. Tags: permissionprimary-field
27e9b03f-04d2-2b69-b327-32f433f7ed21
azure.tags.__tag_key__
string
resourceexperimental Display name: Azure tag Contains the value for the tag with the tag key named __tag_key__ defined in the tag enrichment configuration.
dt_owner_mail
azure.tenant.id
string
resourceexperimental Display name: Azure tenant ID Unique, immutable identifier assigned to the Azure tenant.
37c4add3-612a-483d-8b24-cccbb35d3306
azure.tenant.name
string
resourceexperimental Display name: Azure tenant name Name assigned to the Azure tenant.
experimental Value of the HTTP header x-ms-client-request-id, an optional client-generated ID for troubleshooting.
3adf2f8e-01f8-4b5f-8b8f-6b0e2df1f2a1
azure.invocation_id
string
experimental A unique identifier for the invocation of an Azure Function.
d41e0952-3822-4871-9cfb-7187cf812fe2
azure.operation.name
string
experimental Name of the Azure service operation being executed.
upload_blob; ContainerProxy.create_item
azure.service.name
string
experimental Name of the Azure service being accessed.
storage_blob; cosmos_db
azure.service.request.id
string
experimental Value of the HTTP header x-ms-request-id, uniquely identifies the request that was made.
8b4e3d9e-1001-00e1-4f0a-e4a742000000
azure.storage.account.name
string
experimental Name of the Azure Storage account.
mystorageaccount
azure.storage.blob.block_id
string
experimental Base64-encoded block ID identifying the block targeted by an operation on a block blob, specified in a request when staging a block and available when listing committed and uncommitted blocks.
YmxvY2stMQ==
azure.storage.blob.container.name
string
experimental Name of the Blob Storage container.
mycontainer
azure.storage.blob.copy_id
string
experimental ID identifying a blob copy operation, returned in the x-ms-copy-id response header when a copy is initiated and specified in a request when aborting a copy.
ca17abbc-4e00-4a1e-b0f2-9f5db5c8a1d2
azure.storage.blob.name
string
experimental Name of the blob.
folder/myblob.txt
azure.storage.blob.source.container.name
string
experimental Name of the container containing the blob to copy.
mysourcecontainer
azure.storage.blob.source.name
string
experimental Name of the blob to copy.
folder/mysourceblob.txt
azure.storage.blob.source.version_id
string
experimental Version ID of the source blob to copy.
2020-06-12T11:50:44.2323212Z
azure.storage.blob.version_id
string
experimental Version ID for the specific version of the blob (value of the x-ms-version-id header).
2020-06-12T11:50:44.2323212Z
azure.storage.container.name
string
experimental Name of the Azure Storage container.
mycontainer
Azure log fields
Attribute
Type
Description
Examples
azure.resource.log.category
string
experimental The name of the Azure Monitor resource log category.
cloud-controller-manager; kube-audit-admin
azure.resource.log.operation.name
string
experimental The name of the Azure ARM operation name.
LoadBalancerHealthEvent
Bizflow
Bizflow fields
Attribute
Type
Description
Examples
bizflow.id
string
experimental Display name: Business flow ID Internal ID from the business flow configured in the Business Flow app.
bizflow.priority
string
experimental Display name: Business flow priority The priority of a business process.
critical; high; medium; low
bizflow.url
string
experimental Display name: Business flow URL URL to explore the business flow in the Business Flow app from a result in a DQL query against Smartscape nodes.
BOSH
BOSH fields
Fields that are integral to applications managed by BOSH.
Attribute
Type
Description
Examples
bosh.availability_zone
string
resourceexperimental Display name: BOSH availability zone A specific geographical BOSH location.
us-east-1a
bosh.deployment.id
string
resourcestable Display name: BOSH deployment ID BOSH depoloyment ID, retrievied from /var/vcap on monitored host.
cf-c32ffe771e4ad26b9711
bosh.instance.name
string
resourcestable Display name: BOSH instance name BOSH instance name, retrievied from /var/vcap on monitored host.
diego_database
bosh.instance_id
string
resourceexperimental Display name: BOSH instance ID A unique identifier assigned to each deployed instance.
af318409-9e9d-4a18-aca4-0fb52bbdc526
bosh.name
string
resourceexperimental Display name: BOSH name A unique identifier to a deployment or instance.
isolated_diego_cell_devima
bosh.stemcell.version
string
resourcestable Display name: BOSH stemcell version Version of BOSH stemcell, retrievied from /var/vcap on monitored host.
621.448
Browser
The browser namespace contains information on the browser running an application.
Browser fields
Attribute
Type
Description
Examples
browser.frame.instance_id
uid
stable Display name: Browser frame instance ID A unique ID generated by RUM JavaScript to identify the browser frame. The browser.frame.instance_id is an 8-byte ID and hex-encoded if shown as a string.
f76281848bd8288c
browser.frame.parent_instance_id
uid
stable Display name: Browser parent frame instance ID A unique ID generated by RUM JavaScript to identify the browser's next-higher frame (if that frame exists and is reachable). The browser.frame.parent_instance_id is an 8-byte ID and hex-encoded if shown as a string.
f76281848bd8288c
browser.tab.instance_id
uid
stable Display name: Browser tab instance ID A unique ID generated by RUM JavaScript to identify the browser tab. The browser.tab.instance_id is an 8-byte ID and hex-encoded if shown as a string.
f76281848bd8288c
browser.window.device_pixel_ratio
double
stable Display name: Browser window device pixel ratio The ratio of the resolution in physical pixels to the resolution in CSS pixels for the current display device.
1.0
browser.window.height
long
stable Display name: Browser window height The browser window's inner height, in pixels.
384
browser.window.width
long
stable Display name: Browser window width The browser window's inner width, in pixels.
2048
Browser resource fields
Attribute
Type
Description
Examples
browser.is_webdriver
boolean
resourceexperimental Display name: Browser controlled by WebDriver If set to true, WebDriver controls the browser according to the navigator.webdriver property.
true
browser.name
string
resourcestable Display name: Browser name The browser name.
Chrome
browser.type
string
resourcestable Display name: Browser type The browser type.
desktop; mobile; tablet; robot; other
browser.user_agent
string
resourcestable Display name: User agent The full user agent string as provided by the browser in the HTTP User-Agent request header.
resourcestable Display name: Browser version The browser version.
Version 142.0.7444.176
Captured attribute
Span scoped attributes (e.g. method parameters, return values, class names, …) captured by the OneAgent based on a request attribute rule.
The actual name of the attribute is the prefix "captured_attribute" plus the "request attribute name" defined in the request attributes configuration.
In contrast to request attributes, captured attributes contain the raw values reported by the OneAgent at the location (i.e. on the active span) where they appeared.
No aggregation (first/last value, distinct values, ...), type conversion or normalization is performed on them.
They are the basis for request attributes.
Captured attribute fields
Attribute
Type
Description
Examples
captured_attribute.__attribute_name__
array
stable Display name: Captured attribute Contains the span scoped raw values that were captured under the name __attribute_name__ defined by the request attribute configuration. The values are mapped as an array according to the type of the captured attributes, so either boolean, double, long, or string. If the captured attributes have mixed types (e.g. long and string, or double and long, etc.), all attributes are converted to string and stored as string array.
experimental Display name: Upstream pipeline ID The identifier of the upstream CI/CD pipeline. If a pipeline run was triggered by another pipeline, this attribute is used to reference the triggering pipeline.
12345
cicd.upstream_pipeline.run.id
string
experimental Display name: Upstream pipeline run ID The identifier of the upstream CI/CD pipeline run. If a pipeline run was triggered by another pipeline, this attribute is used to reference the triggering pipeline run.
1337
cicd.deployment.status has the following list of well-known values. If one of them applies, then the respective value MUST be used, otherwise a custom value MAY be used.
Value
Description
Display name
failed
The deployment failed.
Failed
succeeded
The deployment succeeded.
Succeeded
cicd.pipeline.run.outcome has the following list of well-known values. If one of them applies, then the respective value MUST be used, otherwise a custom value MAY be used.
Value
Description
Display name
canceled
The pipeline run was canceled and did not complete.
Canceled
error
The pipeline run failed with an error.
Error
failure
The pipeline run failed.
Failure
skipped
The pipeline did not run, but was skipped.
Skipped
success
The pipeline run completed successfully.
Success
timed_out
The pipeline run timed out, and therefore did not complete.
Timed Out
warning
The pipeline run completed with at least one warning.
Warning
Client
The client namespace contains information on the initiator of a network connection.
When observered from the server side, and when communicating through an intermediary,
client.ip and client.port typically represent the client information behind any intermediaries (such as proxies) if it's available.
Client fields
Attribute
Type
Description
Examples
client.address
string
experimental Display name: Client address Client address - domain name if available without reverse DNS lookup; otherwise, IP address or Unix domain socket name.
client.example.com; 10.1.2.80; [local]
client.app.name
string
experimental Display name: Client app name The name of the client application used to perform the request.
MS Outlook
client.ip
ipAddress
experimental Display name: Client IP address The IP address of the client that makes the request. This can be IPv4 or IPv6. Tags: sensitive-spanssensitive-user-events
194.232.104.141; 2a01:468:1000:9::140
client.ip.is_public
boolean
experimental Display name: Client IP is public Indicates whether IP is a public IP.
true
client.isp
string
experimental Display name: Client ISP name The name of the Internet Service Provider (ISP) associated with the client's IP address.
Internet Service Provider Name
client.port
long
stable Display name: Client port Client port number.
65123; 80
Cloud
Fields related to cloud deployments that can be used across different providers.
Cloud fields
Fields related to cloud deployments that can be used across different providers.
Attribute
Type
Description
Examples
cloud.account.id
string
resourcedeprecated Display name: Cloud account ID Deprecated in favor of cloud specific fields, such as aws.account.id, azure.subscription, gcp.project.id, etc.
111111111111; opentelemetry
cloud.availability_zone
string
resourcedeprecated Display name: Cloud availability zone Deprecated in favor of cloud specific fields, such as aws.availability_zone, azure.availability_zones, gcp.zone, etc.
us-east-1a
cloud.platform
string
resourcedeprecated Display name: Cloud platform Deprecated, no replacement available. 1
alibaba_cloud_ecs
cloud.provider
string
resourcestable Display name: Cloud provider Name of the cloud provider.
alibaba_cloud
cloud.region
string
resourcedeprecated Display name: Cloud region Deprecated in favor of cloud specific fields, such as aws.region, azure.location, gcp.region, etc.
us-east-1
cloud.resource_id
string
resourcedeprecated Display name: Cloud resource ID Deprecated in favor of cloud specific fields, such as aws.arn, azure.resource.id, gcp.resource.name, etc.
The prefix of the service matches the one specified in cloud.provider.
cloud.platform MUST be one of the following:
Value
Description
Display name
alibaba_cloud_ecs
Alibaba Cloud Elastic Compute Service
Alibaba Cloud ECS
alibaba_cloud_fc
Alibaba Cloud Function Compute
Alibaba Cloud FC
alibaba_cloud_openshift
Red Hat OpenShift on Alibaba Cloud
Alibaba Cloud OpenShift
aws_app_runner
AWS App Runner
AWS App Runner
aws_ec2
AWS Elastic Compute Cloud
AWS EC2
aws_ecs
AWS Elastic Container Service
AWS ECS
aws_eks
AWS Elastic Kubernetes Service
AWS EKS
aws_elastic_beanstalk
AWS Elastic Beanstalk
AWS Elastic Beanstalk
aws_lambda
AWS Lambda
AWS Lambda
aws_openshift
Red Hat OpenShift on AWS (ROSA)
AWS OpenShift
azure_aks
Azure Kubernetes Service
Azure AKS
azure_app_service
Azure App Service
Azure App Service
azure_container_instances
Azure Container Instances
Azure Container Instances
azure_functions
Azure Functions
Azure Functions
azure_openshift
Azure Red Hat OpenShift
Azure OpenShift
azure_vm
Azure Virtual Machines
Azure VMs
gcp_app_engine
Google Cloud App Engine (GAE)
GCP App Engine
gcp_cloud_functions
Google Cloud Functions (GCF)
GCP Cloud Functions
gcp_cloud_run
Google Cloud Run
GCP Cloud Run
gcp_compute_engine
Google Cloud Compute Engine (GCE)
GCP Compute Engine
gcp_kubernetes_engine
Google Cloud Kubernetes Engine (GKE)
GCP GKE
gcp_openshift
Red Hat OpenShift on Google Cloud
GCP OpenShift
ibm_cloud_openshift
Red Hat OpenShift on IBM Cloud
IBM Cloud OpenShift
tencent_cloud_cvm
Tencent Cloud Cloud Virtual Machine (CVM)
Tencent Cloud CVM
tencent_cloud_eks
Tencent Cloud Elastic Kubernetes Service (EKS)
Tencent Cloud EKS
tencent_cloud_scf
Tencent Cloud Serverless Cloud Function (SCF)
Tencent Cloud SCF
cloud.provider has the following list of well-known values. If one of them applies, then the respective value MUST be used, otherwise a custom value MAY be used.
Value
Description
Display name
alibaba_cloud
Alibaba Cloud
Alibaba Cloud
aws
Amazon Web Services
AWS
azure
Microsoft Azure
Azure
gcp
Google Cloud Platform
GCP
heroku
Heroku Platform as a Service
Heroku
ibm_cloud
IBM Cloud
IBM Cloud
tencent_cloud
Tencent Cloud
Tencent Cloud
Cloud target span fields
The cloud.target group provides information on the entity targeted by outgoing requests.
Attribute
Type
Description
Examples
cloud.target.account.id
string
experimental Display name: Target cloud account ID The cloud account ID used to access a cloud resource.
111111111111; 984398786124
cloud.target.provider
string
experimental Display name: Target cloud provider Name of the cloud provider.
alibaba_cloud
cloud.target.region
string
experimental Display name: Target cloud region Identifier of the cloud vendor's data center geographic region.
us-east-1
cloud.target.resource_id
string
experimental Display name: Target cloud resource ID Cloud provider-specific native identifier of the accessed cloud resource (for example, an ARN on AWS, a fully qualified resource ID on Azure, or a complete resource name on GCP). If the value is not directly extractable for instrumentation, it can be constructed from its components.
cloud.target.provider has the following list of well-known values. If one of them applies, then the respective value MUST be used, otherwise a custom value MAY be used.
Value
Description
Display name
alibaba_cloud
Alibaba Cloud
Alibaba Cloud
aws
Amazon Web Services
AWS
azure
Microsoft Azure
Azure
gcp
Google Cloud Platform
GCP
heroku
Heroku Platform as a Service
Heroku
ibm_cloud
IBM Cloud
IBM Cloud
tencent_cloud
Tencent Cloud
Tencent Cloud
Cloud origin span fields
The cloud.origin group provides information on the entity from which incoming requests originate.
Attribute
Type
Description
Examples
cloud.origin.account.id
string
experimental Display name: Origin cloud account ID The cloud account ID used to access a cloud resource.
111111111111; 984398786124
cloud.origin.provider
string
experimental Display name: Origin cloud provider Name of the cloud provider.
alibaba_cloud
cloud.origin.region
string
experimental Display name: Origin cloud region Identifier of the cloud vendor's data center geographic region.
us-east-1
cloud.origin.resource_id
string
experimental Display name: Origin cloud resource ID Cloud provider-specific native identifier of the accessed cloud resource (for example, an ARN on AWS, a fully qualified resource ID on Azure, or a complete resource name on GCP). If the value is not directly extractable for instrumentation, it can be constructed from its components.
cloud.origin.provider has the following list of well-known values. If one of them applies, then the respective value MUST be used, otherwise a custom value MAY be used.
Value
Description
Display name
alibaba_cloud
Alibaba Cloud
Alibaba Cloud
aws
Amazon Web Services
AWS
azure
Microsoft Azure
Azure
gcp
Google Cloud Platform
GCP
heroku
Heroku Platform as a Service
Heroku
ibm_cloud
IBM Cloud
IBM Cloud
tencent_cloud
Tencent Cloud
Tencent Cloud
CloudEvents
CloudEvents fields
Fields for CloudEvents, a specification for describing event data in a common way.
Attribute
Type
Description
Examples
cloudevents.event_id
string
experimental Identifies the event. Producers MUST ensure that source+id is unique for each distinct event.
b25e0099-1dbb-4344-99ae-4cf2f62d86c0
cloudevents.event_source
string
experimental Identifies the context in which an event happened.
resourceexperimental Display name: Cloud Foundry application ID
cloudfoundry.application.name
string
resourceexperimental Display name: Cloud Foundry application name
cloudfoundry.instance.index
string
resourceexperimental Display name: Cloud Foundry instance index
cloudfoundry.space.id
string
resourceexperimental Display name: Cloud Foundry space ID
cloudfoundry.space.name
string
resourceexperimental Display name: Cloud Foundry space name
Code
Code fields
Attribute
Type
Description
Examples
code.call_stack
string
experimental Display name: Call stack The call stack of the code.function. The call stack starts with the code.function, and the stack frames are separated by a line feed.
experimental Display name: Code function The method or function name, or equivalent (usually the rightmost part of the code unit's name). Represents the name of the function that is represented by this span.
serveRequest
code.invoked.filepath
string
experimental Display name: Invoked file path Like code.filepath, only it represents the file path of the function that was active when a span has been started. Typically, it is the function that has been instrumented. It should only be set if it differs from code.filepath.
experimental Display name: Invoked function Like code.function, only it represents the function that was active when a span has been started. Typically, it's the function that has been instrumented. The spans duration does not reflect the duration of this function execution. It should only be set if it differs from code.function.
invoke
code.invoked.namespace
string
experimental Display name: Invoked namespace Like code.namespace, only it represents the namespace of the function that was active when a span has been started. Typically, it's the function that has been instrumented. It should only be set if it differs from code.namespace.
com.sun.xml.ws.server.InvokerTube$2
code.line.number
long
experimental Display name: Line number The line number within the source code file.
1337
code.namespace
string
experimental Display name: Code namespace The namespace within which code.function is defined. Usually, the qualified class or module name, such that code.namespace + some separator + code.function forms a unique identifier for the code unit.
resourceexperimental Display name: ColdFusion service name
Compilation timings
Compilation timings fields
For some technologies compilation of code might be a significant contributor to request execution time. Compilation timings provide insight into this, where available.
Attribute
Type
Description
Examples
compilation_timings.compilation_count
long
experimental Display name: Compilation count The number of compilations contributing to compilation_timings.duration_sum.
7
compilation_timings.duration_sum
duration
experimental Display name: Compilation duration sum The total duration in nanoseconds spent compiling.
6723
compilation_timings.top_compilations
record
experimental Display name: Top compilations The top N compilations contributing to compilation_timings.duration_sum, represented as map from compilation unit name to duration in nanoseconds spent.
resourceexperimental Display name: Container ID Container ID. Usually a UUID, as for example used to identify Docker containers. The UUID might be abbreviated.
a3bf90e006b2
container.image.digest
string
resourceexperimental Display name: Container image digest Immutable SHA-256 hash of an image that uniquely identifies the exact image content in a registry.
resourceexperimental Display name: Container image ID Immutable SHA-256 hash of an image's configuration object (the image's config JSON) that uniquely identifies that exact image in the container runtime.
resourceexperimental Display name: Container image name Name of the image the container was built on.
gcr.io/opentelemetry/operator
container.image.version
string
resourceexperimental Display name: Container image version Version of the image the container was created from.
0.1
container.name
string
resourceexperimental Display name: Container name Container name used by container runtime.
opentelemetry-autoconf
container.runtime.name
string
resourceexperimental Runtime used to run the container.
boshbpm
container.runtime.name has the following list of well-known values. If one of them applies, then the respective value MUST be used, otherwise a custom value MAY be used.
Value
Description
Display name
boshbpm
BOSH Process Manager container runtime, used in Cloud Foundry.
BOSH Process Manager
containerd
containerd container runtime.
containerd
cri-o
CRI-O container runtime.
CRI-O
docker
Docker container runtime.
Docker
garden
Garden container runtime, used in Cloud Foundry.
Garden
podman
Podman container runtime.
Podman
unknown
Container runtime could not be determined.
Unknown
winc
Windows container runtime, used in Cloud Foundry for Windows containers.
winc
Container image
The container_image namespace identifies the container image affected by or associated with a security finding.
Container image fields
Fields identifying the container image affected by or associated with a security finding.
Attribute
Type
Description
Examples
container_image.digest
string
resourceexperimental Display name: Container image digest Container image digest uniquely and immutably identifying the vulnerable container image.
resourceexperimental Display name: Container image registry Container image registry from which the container image originates.
1294385647.eu-central-1
container_image.repository
string
resourceexperimental Display name: Container image repository Container image repository from which the container image originates.
unguard-frontend
container_image.tags
array
resourceexperimental Display name: Container image tags List of tags of the container image.
[1.0.0]; [1.0.0, 1.0.0-nightly, latest]
CICS Transaction Gateway (CTG)
CTG (shorthand for "CICS Transaction Gateway") is a connector for enterprise modernization of CICS assets. It empowers various application
platforms, such as Java servlets, to incorporate CICS programs.
CICS (shorthand for "Customer Information Control System") is a middleware
to support rapid, high-volume online transaction processing on IBM mainframe systems on z/OS. CTG features a client and a server, which
communicate via so-called GatewayRequests.
CTG fields
Attribute
Type
Description
Examples
ctg.request.call_type
long
experimental Display name: CTG request call type Integer representing the call type of the CTG GatewayRequest. The set of possible values varies per request type. 1
2
ctg.request.commarea_length
long
experimental Display name: CTG request commarea length Length of the COMMAREA. Only set when the request type is ECI.
0
ctg.request.extend_mode
long
experimental Display name: CTG request extend mode Integer representing the extended mode of the CTG GatewayRequest. Only set when the request type is ECI. 2
11
ctg.request.flow_type
long
experimental Display name: CTG request flow type Integer representing the flow type of the CTG GatewayRequest. 3
5
ctg.request.gateway_url
string
experimental Display name: CTG request gateway URL URL of the gateway. Only set on client-side spans.
tcp://1.2.3.4:5678/
ctg.request.object_name
string
experimental Display name: CTG request object name Name of the request object. Only set when the request type is ADMIN.
ctg.request.server_id
string
experimental Display name: CTG request server ID ID of the server. Not set for all request types.
IPICTEST
ctg.request.term_id
string
experimental Display name: CTG request terminal ID Name of the terminal resource. Only set when the request type is EPI.
CN02
ctg.request.type
string
experimental Display name: CTG request type Type of the CTG GatewayRequest.
BASE
ctg.response.code
long
experimental Display name: CTG response code CTG response code. The set of possible values varies per request type. 4
experimental Display name: Custom service method The service method of a custom service. This field only exists if a custom service was created via Dynatrace OneAgent SDK.
startTask; run; authenticate
custom_service.name
string
experimental Display name: Custom service name The name of a custom service. This field only exists if a custom service was created via Dynatrace OneAgent SDK.
MyCustomService; AuthenticationComponent
Database
Database fields
Attribute
Type
Description
Examples
db.affected_item_count
long
experimental Display name: Affected item count The number of items (rows, documents,…) affected.
32
db.collection.name
string
stable Display name: Collection name The name of a collection (table, container) within the database.
customers; public.users
db.connection_string
string
experimental Display name: Db connection string The connection string for a database connection. Tags: sensitive-spans
experimental Display name: Dynamodb table names The list of tables the request targets.
['Cats', 'Dogs']
db.namespace
string
stable Display name: Database The name of the database, fully qualified within the server address and port.
customers; test.users
db.operation.name
string
stable Display name: Db operation name The name of the operation or command executed, for example the MongoDB command name, SQL keyword, Redis command name,… 1
experimental Display name: Query parameters The query parameters used in db.query.text represented as a key and value map. For database systems without named keys, the map key is the string representation of the index starting with 0. Several database requests may get aggregated into a single span. Each entry in the array holds the bind parameters for one database request. Tags: sensitive-spans
stable Display name: Query The database query being executed. 2
SELECT * FROM wuser_table; SET mykey "WuValue"
db.result.duration_max
duration
experimental Display name: Db duration max The maximum duration in nanoseconds used for fetching the result.
345
db.result.duration_min
duration
experimental Display name: Db duration min The minimum duration in nanoseconds used for fetching the result.
123
db.result.duration_sum
duration
experimental Display name: Db duration sum The total duration in nanoseconds used for fetching the result.
234
db.result.exception_count
long
experimental Display name: Db exception count The number of exceptions encountered while fetching the result.
2
db.result.execution_count
long
experimental Display name: Db execution count The number of operations executed on the result (for example, fetches from SQL result set, MongoDB cursor operations).
12
db.result.fetch_size
long
experimental Display name: Db fetch size The number of items requested in fetching query results.
12
db.result.roundtrip_count
long
experimental Display name: Db roundtrip count The number of round-trips triggered by fetching the result.
2
db.system
string
experimental Display name: Database system An identifier for the database management system (DBMS) product being used. See below for a list of well-known identifiers.
mongodb; mysql
1
Depending on the data provided on ingest, this attribute may be derived by e.g., parsing db.query.text. Parsing might fail, or the result might be inaccurate.
2
The value may be sanitized to exclude sensitive information.
db.system has the following list of well-known values. If one of them applies, then the respective value MUST be used, otherwise a custom value MAY be used.
Value
Description
Display name
adabas
Adabas (Adaptable Database System)
Adabas
amazon-documentdb
Amazon DocumentDB
DocumentDB
aurora-mysql
Amazon Aurora MySQL
Aurora MySQL
aurora-postgresql
Amazon Aurora PostgreSQL
Aurora PostgreSQL
cache
InterSystems Caché
InterSystems Caché
cassandra
Apache Cassandra
Cassandra
clickhouse
ClickHouse
ClickHouse
cloudscape
Cloudscape
Cloudscape
cockroachdb
CockroachDB
CockroachDB
coldfusion
ColdFusion IMQ
ColdFusion IMQ
cosmosdb
Microsoft Azure Cosmos DB
Cosmos DB
couchbase
Couchbase
Couchbase
couchdb
CouchDB
CouchDB
databricks
Databricks Data Platform
Databricks Data Platform
db2
IBM Db2
IBM Db2
derby
Apache Derby
Derby
dl/i
IBM DL/I
IBM DL/I
dynamodb
Amazon DynamoDB
DynamoDB
edb
EnterpriseDB
EnterpriseDB
elasticsearch
Elasticsearch
Elasticsearch
filemaker
FileMaker
FileMaker
firebird
Firebird
Firebird
firstsql
FirstSQL
FirstSQL
geode
Apache Geode
Geode
h2
H2
H2
hanadb
SAP HANA
SAP HANA
hbase
Apache HBase
HBase
hive
Apache Hive
Hive
hsqldb
HyperSQL DataBase
HSQLDB
informix
Informix
Informix
ingres
Ingres
Ingres
instantdb
InstantDB
InstantDB
interbase
InterBase
InterBase
keyspaces-cassandra
Amazon Keyspaces for Apache Cassandra
Keyspaces
mariadb
MariaDB
MariaDB
maxdb
SAP MaxDB
SAP MaxDB
memcached
Memcached
Memcached
mongodb
MongoDB
MongoDB
mssql
Microsoft SQL Server
SQL Server
mssqlcompact
Microsoft SQL Server Compact
SQL Server Compact
mysql
MySQL
MySQL
neo4j
Neo4j
Neo4j
neptune
Amazon Neptune
Neptune
netezza
Netezza
Netezza
opensearch
OpenSearch
OpenSearch
oracle
Oracle Database
Oracle
other_sql
Some other SQL database. Fallback only. See notes.
Other SQL
pervasive
Pervasive PSQL
Pervasive PSQL
phoenix
Apache Phoenix
Apache Phoenix
pointbase
PointBase
PointBase
postgresql
PostgreSQL
PostgreSQL
progress
Progress Database
Progress
redis
Redis
Redis
redshift
Amazon Redshift
Redshift
snowflake
Snowflake Data Platform
Snowflake Data Platform
spanner
Cloud Spanner
Cloud Spanner
sqlite
SQLite
SQLite
sybase
Sybase
Sybase
teradata
Teradata
Teradata
valkey
Valkey
Valkey
vertica
Vertica
Vertica
Deployment
Deployment fields
Attribute
Type
Description
Examples
deployment.release_build_version
string
resourceexperimental Display name: Build version The build version of the deployed product.
2021-03-24
deployment.release_product
string
resourceexperimental Display name: Release product The name of the deployed product.
WoGo Main
deployment.release_stage
string
resourceexperimental Display name: Stage The stage the product is deployed to.
production
deployment.release_version
string
resourceexperimental Display name: Version The version of the deployed product.
0.4.1
Device
The device namespace contains information on the device running an application. This should only be used for end-user devices or devices outside of a private infrastructure. In line with the naming conventions and guidelines, we are in this case adhering to the emerging Open Telemetry convention around this, with some additions.
Device fields
Attribute
Type
Description
Examples
device.battery.level
long
stable Display name: Device battery level The device's battery level in the range 0% (discharged) to 100% (fully charged).
100
device.orientation
string
experimental Display name: Device orientation The device orientation.
landscape
device.orientation MUST be one of the following:
Value
Description
Display name
landscape
The device was in landscape mode.
Landscape
portrait
The device was in portrait mode.
Portrait
Device resource fields
Attribute
Type
Description
Examples
device.is_rooted
boolean
resourcestable Display name: Device is rooted If set to true, the device is rooted or jailbroken.
false
device.manufacturer
string
resourcestable Display name: Device manufacturer The device manufacturer.
Apple
device.model.identifier
string
resourcestable Display name: Device model identifier The device model identifier.
iPhone 17 Max Pro
device.screen.height
long
resourcestable Display name: Device screen height The device's screen height in its natural orientation.
1152
device.screen.width
long
resourcestable Display name: Device screen width The device's screen width in its natural orientation.
2048
Disk
Disk fields
Fields describing a disk.
Attribute
Type
Description
Examples
disk.all_mountpoints
string[]
resourceexperimental Display name: Disk all mountpoints List of all mountpoints
['/mnt/storage', '/home', '/var/log']
disk.device_name
string
resourceexperimental Display name: Disk device name Disk device name (Linux, AIX)
sda
disk.mountpoint
string
resourceexperimental Display name: Disk primary mountpoint Primary mountpoint
/mnt/storage
disk.name
string
resourceexperimental The name of the Smartscape disk.
C:; /dev/sda1; xvda
disk.remote_disk_id
long
resourcestable Display name: Remote disk ID Unique identifier of remote disk
0; 16864135562327138441; 18446744073709551615
DL/I database attachment
DL/I database attachment fields
Attribute
Type
Description
Examples
db.dli.pcb
string
experimental Display name: DL/I pcb name The name of the program communication block associated with this DL/I method.
3; MYPCBNAM
db.dli.pcb_type
string
experimental Display name: DL/I pcb type The PCB type.
DC; DL/I; F/P
db.dli.processing_options
string
experimental Display name: DL/I processing options The PCB processing options.
GR
db.dli.segment_level
string
experimental Display name: DL/I segment level The hierarchical level of the segment that was matched or returned.
3; 24
db.dli.segment_name
string
experimental Display name: DL/I segment name The name of the last segment that was matched or returned.
PARTROOT
db.dli.status_code
string
experimental Display name: DL/I status code The DL/I status code.
QC
db.dli.terminal_name
string
experimental Display name: DL/I terminal name The DL/I database or logical terminal name associated with this DL/I method.
HWSAM5ZD; 10505
db.dli.pcb_type MUST be one of the following:
Value
Description
Display name
DC
Data communications.
Data communications
DL/I
DL/I db.
DL/I
F/P
Fast Path.
Fast Path
Dotnet
Dotnet fields
Attribute
Type
Description
Examples
dotnet.dll.file
string
resourceexperimental Display name: .NET dll file Filename of main dotnet assembly.
dotnet.dll.path
string
resourceexperimental Display name: .NET dll path Filepath of main dotnet assembly.
Dynatrace ActiveGate
Metadata with ActiveGate related information.
Dynatrace ActiveGate fields
Attribute
Type
Description
Examples
dt.active_gate.group.name
string
resourceexperimental Display name: ActiveGate group name The name of a group that the ActiveGate instance belongs to.
GdanskLab
dt.active_gate.id
string
resourceexperimental Display name: ActiveGate ID Hexadecimal identifier of the ActiveGate prefixed with 0x
0xef3d21c3
dt.active_gate.module_name
string
resourceexperimental Display name: ActiveGate module name The name of ActiveGate module
autoupdate
dt.active_gate.name
string
resourceexperimental Display name: ActiveGate name Human-readable name of the ActiveGate instance. 1
activegate-0; my-activegate-host.example.com
dt.active_gate.working_mode
string
resourceexperimental Display name: ActiveGate working mode Working mode of the ActiveGate
cluster
1
In a Kubernetes deployment, this is the pod name (see k8s.pod.name). In other deployments, this is the hostname (see host.name).
dt.active_gate.working_mode MUST be one of the following:
Value
Description
Display name
cluster
Cluster ActiveGate
Cluster
embedded
Embedded ActiveGate
Embedded
environment
Environment ActiveGate
Environment
multitenant
Multitenant ActiveGate
Multitenant
Dynatrace ActiveGate API connector fields
Attribute
Type
Description
Examples
dt.active_gate.api_connector.config_id
string
resourceexperimental Display name: ActiveGate API connector config ID Config long id of the endpoint configuration as a string.
123; 9276
dt.active_gate.api_connector.pipeline_identifier
string
resourceexperimental Display name: ActiveGate API connector pipeline identifier String identifier of an api connector pipeline
Kubernetes/Topology
dt.active_gate.api_connector.pipeline_status
string
resourceexperimental Display name: ActiveGate API connector pipeline status Status of an api connector pipeline run
failed
dt.active_gate.api_connector.technology_id
string
resourceexperimental Display name: ActiveGate API connector technology ID String identifier of an api connector technology
dt.active_gate.api_connector.pipeline_status MUST be one of the following:
Value
Description
Display name
failed
Pipeline execution failed
Failure
skipped
Pipeline execution skipped
Skipped
succeeded
Pipeline execution succeeded
Success
Dynatrace OneAgent metadata
Dynatrace OneAgent metadata fields
Metadata of the OneAgent module that reported a signal. These attributes are what one would also see in OneAgent Health.
Attribute
Type
Description
Examples
dt.agent.allocation_sampling.enabled
boolean
resourceexperimental Display name: OneAgent allocation sampling enabled Indicates whether allocation sampling profiling is enabled on this OneAgent.
false
dt.agent.cpu_sampling.enabled
boolean
resourceexperimental Display name: OneAgent CPU sampling enabled Indicates whether CPU sampling profiling is enabled on this OneAgent.
false
dt.agent.installer_version
string
resourceexperimental Display name: OneAgent installer version OneAgent installer version.
1.333.0.20260126-132010
dt.agent.live_debugger.enabled
boolean
resourceexperimental Display name: OneAgent live debugger enabled Indicates whether live debugging is enabled on this OneAgent.
false
dt.agent.module.deployment.__key__
string
resourceexperimental Display name: OneAgent module deployment property Deployment properties of the OneAgent module. __key__ is populated with the deployment property name, for example, dt.agent.module.deployment.orchestration_tech.
resourceexperimental Display name: OneAgent fips deployment mode True if FIPS deployment mode is enabled for the OneAgent module.
false
dt.agent.module.deployment.standalone
boolean
resourceexperimental Display name: OneAgent standalone deployment mode Indicates whether the OneAgent module is running in standalone deployment mode, without a full-stack OS-layer OneAgent present on the underlying host. When true, the OneAgent module is operating independently of a host-level OneAgent.
false
dt.agent.module.first_seen
timestamp
resourceexperimental Display name: OneAgent module first seen Timestamp when the OneAgent module first made contact and was registered.
1771494246779; 1771844752
dt.agent.module.health
string
resourceexperimental Display name: OneAgent module health Health status of the OneAgent module.
CRITICAL
dt.agent.module.id
uid
resourcestable Display name: OneAgent module ID OneAgent module ID.
031f613871fab0b4; fc3cd1bb276f0bed
dt.agent.module.injection_mode
string
resourceexperimental Display name: OneAgent module injection mode Injection Mode of the OneAgent module.
INJECTION_MODE_AUTO_INJECTED
dt.agent.module.issues
record[]
resourceexperimental Display name: OneAgent module issues List of issue objects detected for the OneAgent module. Each object contains the issue and severity level (CRITICAL, WARNING, or INFO).
resourcestable Display name: OneAgent parent module ID OneAgent parent module ID, in case this is a so-called sub-agent.
ea89eef5db8b85a9
dt.agent.module.startup_timestamp
timestamp
resourceexperimental Display name: OneAgent module startup timestamp Timestamp when the OneAgent module was started up. Note that this is not necessarily the same as dt.agent.module.first_seen (for example, if the agent is unable to register for some time).
1771494246779; 1771844752
dt.agent.module.type
string
resourcestable Display name: OneAgent module type OneAgent module type.
apache
dt.agent.module.version
string
resourcestable Display name: OneAgent module version OneAgent full module version.
1.269.17.20221117-132428
dt.agent.module.version_short
string
resourceexperimental Display name: OneAgent module short version OneAgent short module version, to be expected only on record types where dt.agent.module.version's cardinality would be a problem.
1.269
dt.agent.monitoring_mode
string
resourceexperimental Display name: OneAgent monitoring mode Monitoring Mode in which the OneAgent module operates.
DISCOVERY
dt.agent.module.health MUST be one of the following:
Value
Description
Display name
CRITICAL
The OneAgent module has critical issues that need immediate attention to ensure proper functionality.
Critical
HEALTHY
The OneAgent module is functioning properly without any detected issues.
Healthy
INFO
The OneAgent module has informational messages that may require attention.
Info
WARNING
The OneAgent module has warnings that indicate potential issues that should be investigated.
Warning
dt.agent.module.injection_mode MUST be one of the following:
Value
Description
Display name
INJECTION_MODE_AUTO_INJECTED
The OneAgent module was automatically injected into the application/process.
Auto
INJECTION_MODE_MANUALLY_INJECTED
The OneAgent module was manually injected or installed, requiring explicit user configuration or deployment.
Manual
INJECTION_MODE_UNKNOWN
The injection mode is not known or not determined yet. This is the default/fallback value.
Unknown
dt.agent.module.type has the following list of well-known values. If one of them applies, then the respective value MUST be used, otherwise a custom value MAY be used.
Value
Description
Display name
apache
apache
Apache
dotnet
dotnet
.NET
dumpproc
dumpproc
Dump Process
extensions
extensions
Extensions
go
go
Go
iis
iis
IIS
java
java
Java
log_analytics
log_analytics
Log Analytics
net
net
.NET Framework
nettracer
nettracer
Network Tracer
nginx
nginx
NGINX
nodejs
nodejs
Node.js
opentracingnative
opentracingnative
OpenTracing Native
os
os
OS
php
php
PHP
plugin
plugin
Plugin
process
process
Process
python
python
Python
remote_plugin
remote_plugin
Remote Plugin
ruby
ruby
Ruby
sdk
sdk
SDK
support
support
Support
updater
updater
Updater
varnish
varnish
Varnish
wsmb
wsmb
WSMB
z
z_
z/OS
dt.agent.monitoring_mode MUST be one of the following:
Value
Description
Display name
DISCOVERY
Discovery monitoring mode provides basic metrics enabling you to discover your hosts and processes and learn the potential to extend your monitoring.
Discovery
FULL_STACK
Full stack monitoring mode includes application performance, user experience data, code-level visbility and PurePath insights, as well as everything that is included in Infrastructure monitoring mode.
Full Stack
INFRASTRUCTURE
Infrastructure monitoring mode includes topology discovery, detailed health and performance monitoring of your host, and enables Network monitoring, Log monitoring and Extensions.
Infrastructure
Dynatrace AutomationEngine
Fields defined in this namespace are used by Dynatrace to describe various aspects of events emitted by the AutomationEngine.
Dynatrace AutomationEngine fields
Attribute
Type
Description
Examples
dt.automation_engine.action.app
string
experimental Display name: Action app The app ID of the app containing the executed action.
dynatrace.automations
dt.automation_engine.action.function
string
experimental Display name: Action function name Name of the function implementing the action.
task_1
dt.automation_engine.action_execution.id
string
experimental Display name: Action execution ID The unique identifier of a action execution as UUID.
23e7b55a-884f-4497-8ad6-8d49d52b4348
dt.automation_engine.action_execution.loop.index
long
experimental Display name: Action execution loop index Loop index of the action execution.
dt.automation_engine.action_execution.retry.count
long
experimental Display name: Action execution retry count Retry count of the action execution.
dt.automation_engine.is_draft
boolean
experimental Display name: Workflow is draft Indicates whether the triggered workflow execution is based on a workflow draft.
true; false
dt.automation_engine.is_task_test
boolean
experimental Display name: Is task test Indicates that the task execution or action execution belongs to a task test run of a single target task, rather than a regular workflow execution.
true; false
dt.automation_engine.root_workflow.id
string
experimental Display name: Root workflow ID The unique identifier of the root workflow.
e6388e3a-9db2-4226-9327-2ba86eaf12f7
dt.automation_engine.root_workflow_execution.id
string
experimental Display name: Root workflow execution ID The unique identifier of the execution of the root workflow.
a641fb59-4627-44cd-abaf-b68d86455a5b
dt.automation_engine.state
string
experimental Display name: Execution state The state of an execution. Values depend on type of execution (workflow-, task-, or action execution).
IDLE; RUNNING; WAITING; SUCCESS; ERROR; CANCELLED
dt.automation_engine.state.is_final
boolean
experimental Display name: Execution state is final Indicates if dt.automation_engine.state is a final and immutable state or if further processing will happen.
true; false
dt.automation_engine.state_info
string
experimental Display name: Execution state info Additional info about current state of execution. Typically holds error details.
ERROR
dt.automation_engine.task.name
string
experimental Display name: Task name The identifier of a task within a workflow.
task_1
dt.automation_engine.task_execution.id
string
experimental Display name: Task execution ID The unique identifier of a task execution as UUID.
6580d4af-6b1f-4e54-92fa-f47e94507acd
dt.automation_engine.test_task_execution.actor
string
experimental Display name: Task test actor The unique identifier of the actor the task test ran as.
experimental Display name: Workflow last execution state flip Indicates if the workflow execution state has changed since the last execution, ignoring draft executions. Always false for draft executions.
true; false
dt.automation_engine.workflow.title
string
experimental Display name: Workflow title The title of the workflow.
My Workflow
dt.automation_engine.workflow.type
string
experimental Display name: Workflow type Workflow type, either SIMPLE or STANDARD, where SIMPLE comes with restrictions.
SIMPLE; STANDARD
dt.automation_engine.workflow_execution.actor
string
experimental Display name: Workflow actor The unique identifier of the actor as defined in the workflow.
e622afae-ccc7-4fb5-acc5-13b32e827bbe
dt.automation_engine.workflow_execution.id
string
experimental Display name: Workflow execution ID The unique identifier of a workflow execution as UUID.
experimental Display name: Trigger event ID Unique identifier string (event.id) of the event that triggered the workflow execution. Only set for event-triggered executions.
experimental Display name: Trigger workflow execution ID The unique identifier of the workflow that triggered the workflow execution.
737a248b-d1cb-49a4-bf08-7d4c37dbfb1e
Dynatrace Bindplane
Fields defined in this namespace describe the Bindplane organizational context (configuration, fleet, and project) of the collector that produced a record.
Dynatrace Bindplane fields
Attribute
Type
Description
Examples
dt.bindplane.configuration
string
resourceexperimental Display name: Bindplane configuration Name of the Bindplane configuration applied to the collector that produced the record.
prod-logs; k8s-metrics
dt.bindplane.fleet
string
resourceexperimental Display name: Bindplane fleet Name of the Bindplane fleet the collector belongs to.
edge-collectors; gateway-eu
dt.bindplane.project
string
resourceexperimental Display name: Bindplane project Name of the Bindplane project that the collector is managed under.
platform; observability-team
Dynatrace data acquisition
Attributes defined in this namespace are used by Dynatrace to describe different aspects of the ingested data.
Dynatrace data acquisition fields
Attribute
Type
Description
Examples
dt.da.aws.data_firehose.arn
string
experimental Display name: Amazon Data Firehose ARN ARN of AWS Data Firehose signal is originating from.
experimental Display name: Data acquisition source Dynatrace source of signal ingestion
aws-log-ingest
dt.da.source has the following list of well-known values. If one of them applies, then the respective value MUST be used, otherwise a custom value MAY be used.
Value
Description
Display name
aws-log-ingest
aws-log-ingest
AWS Log Ingest
aws-metric-poller
aws-metric-poller
AWS Metric Poller
aws-metrics-ingest
aws-metrics-ingest
AWS Metrics Ingest
Davis metadata
Some attributes are used in the context of the Davis engine.
Davis metadata fields
These fields can be set by Davis routines.
Attribute
Type
Description
Examples
dt.davis.anomaly_detection.alert
long
stable Display name: Davis anomaly detection alert Boolean time series of 0 and 1 showing whether a single timespan was alerted due to continuous violations.
dt.davis.anomaly_detection.anomaly
long
stable Display name: Davis anomaly detection anomaly Boolean timeseries of 0 and 1 showing whether a single timespan is outside the normal value range and therefore considered as abnormal.
dt.davis.anomaly_detection.lower
long
stable Display name: Davis anomaly detection lower limit The lower value range limit where any value below this point is considered abnormal.
dt.davis.anomaly_detection.upper
long
stable Display name: Davis anomaly detection upper limit The upper value range limit where any value above this point is considered abnormal.
dt.davis.forecast.lower
long
stable Display name: Davis forecast lower bound The lower bound of the prediction interval of a given metric forecast.
dt.davis.forecast.point
long
stable Display name: Davis forecast point value The point value of a metric forecast.
dt.davis.forecast.upper
long
stable Display name: Davis forecast upper bound The upper bound of the prediction interval of a given metric forecast.
Dynatrace endpoint detection
Dynatrace endpoint detection fields
Fields that can be expected on a Dynatrace span where endpoint detection was applied.
Attribute
Type
Description
Examples
dt.endpoint_detection.rule_id
uid
experimental Display name: Endpoint detection rule ID The ID of the endpoint detection rule that was applied to that span.
4d76194c11a9426197a9062548f9e66e
Dynatrace enrichment
The dt.enrichment namespace contains fields related to Dynatrace apps and app functions that are used for security intelligence enrichment execution.
Dynatrace Entity ID
The Dynatrace OneAgent associates monitoring data with a so called Monitored Entity ID (ME ID). On OneAgent monitored environments,
whenever ME IDs are accessible within the monitored system they should be used to enrich monitoring data to facilitate correlations with
data primarily addressed through ME IDs coming from other channels.
The structure for keys that signify entity IDs is dt.entity.{type of entity}.
The value associated with such a key must be valid Dynatrace entity identifier
(see Monitored entities API).
To allow linking Entity IDs across various different monitoring artifacts (logs, metrics, etc.), all string representations of Entity IDs are required to follow a canonical form, which for all current entities is defined as PREFIX-0123456789ABCDEF.
Consumers should treat the token as an opaque value and must not infer any semantics on the ID itself.
Producers need to match the Entity ID that is being returned by Dynatrace Entity API verbatim.
Producers of string representation must treat the string as if it was parsed case-sensitively, even though some parts of the product may be more lenient.
The structure of the entity ID is currently as follows: <ID-NAMESPACE>-<16-digit-hex-string>. The <ID-NAMESPACE> is type specific but cannot be used to determine the actual entity type reliably, especially in cases of CUSTOM_DEVICE. The <16-digit-hex-string> needs to be zero-padded (prefix) to a length of 16 digits and must use upper case letters A-F.
Current entity IDs in cannonical form can be represented structurally with the following regular expression: [A-Z][A-Z_]*-[0-9A-F]{16}.
Additional characters or changes in the format may happen in the future but will not invalidate existing IDs or ID generation rules.
When adding a name to an entity ID via the Grail function entityName, by default, the name of the respective entity will be represented as dt.entity.{type of entity}.name. Similarly, further entity attributes can be added via the Grail function entityAttr, resulting in additional field(s) following the naming convention dt.entity.{type of entity}.{name of attribute}.
Fields enriched with signal data containing entity IDs that refer to classic entities are deprecated and will be removed in the future; use Smartscape IDs instead.
Dynatrace Entity ID fields
Attribute
Type
Description
Examples
dt.entity.application
string
resourcedeprecatedThis field is deprecated and will be removed in the future. Use dt.smartscape.frontend instead. Display name: Application The ME ID of a web application. Tags: entity-id
APPLICATION-DC92E74A7A844E6E
dt.entity.aws_availability_zone
string
resourcedeprecatedThis field is deprecated and will be removed in the future. Use dt.smartscape.aws_availability_zone instead. Display name: AWS availability zone An entity ID of an entity of type AWS_AVAILABILITY_ZONE Tags: entity-id
AWS_AVAILABILITY_ZONE-6000A4E2BD2AB971
dt.entity.azure_region
string
resourcedeprecatedThis field is deprecated and will be removed in the future. Use dt.smartscape.microsoft_resources_locations instead. Display name: Azure region An entity ID of an entity of type AZURE_REGION Tags: entity-id
AZURE_REGION-0DD5C79E4034F0AA
dt.entity.azure_vm
string
resourcedeprecatedThis field is deprecated and will be removed in the future. Use dt.smartscape.microsoft_compute_virtualmachines instead. Display name: Azure vm An entity ID of an entity of type AZURE_VM Tags: entity-id
AZURE_VM-326478B733D6CFB0
dt.entity.cloud_application
string
resourcedeprecatedThis field is deprecated and will be removed in the future. Use dt.smartscape.k8s_deployment instead. Display name: Cloud application An entity ID of an entity of type CLOUD_APPLICATION. Tags: entity-id
CLOUD_APPLICATION-3AB5BBF3E09A7942
dt.entity.cloud_application_instance
string
resourcedeprecatedThis field is deprecated and will be removed in the future. Use dt.smartscape.k8s_pod instead. Display name: Cloud application instance An entity ID of an entity of type CLOUD_APPLICATION_INSTANCE. Tags: entity-id
CLOUD_APPLICATION_INSTANCE-E0D8F94D9065F24F
dt.entity.cloud_application_namespace
string
resourcedeprecatedThis field is deprecated and will be removed in the future. Use dt.smartscape.k8s_namespace instead. Display name: Cloud application namespace An entity ID of an entity of type CLOUD_APPLICATION_NAMESPACE. A CLOUD_APPLICATION_NAMESPACE is a Kubernetes namespace. Tags: entity-id
CLOUD_APPLICATION_NAMESPACE-C61324AA70F57BCB
dt.entity.container_group
string
resourcedeprecatedThis field is deprecated and will be removed in the future. Note that there is no replacement for container groups in Smartscape. Display name: Container group An entity ID of an entity of type CONTAINER_GROUP. Tags: entity-id
CONTAINER_GROUP-7C2B1C24FFB288CB
dt.entity.container_group_instance
string
resourcedeprecatedThis field is deprecated and will be removed in the future. Use dt.smartscape.container instead. Display name: Container group instance An entity ID of an entity of type CONTAINER_GROUP_INSTANCE. Tags: entity-id
CONTAINER_GROUP_INSTANCE-F4A1347110826781
dt.entity.custom_application
string
resourcedeprecatedThis field is deprecated and will be removed in the future. Use dt.smartscape.frontend instead. Display name: Custom application The ME ID of a custom application. Tags: entity-id
CUSTOM_APPLICATION-343A92501A51F286
dt.entity.custom_device
string
resourcedeprecatedThis field is deprecated and will be removed in the future. Use dt.smartscape.custom_<type> or dt.smartscape.ext_<type> instead. Note that <type> represents the type of the custom device. Display name: Custom device An entity ID of an entity of type CUSTOM_DEVICE. Tags: entity-id
CUSTOM_DEVICE-E0D8F94D9065F24F
dt.entity.device_application
string
resourcedeprecatedThis field is deprecated and will be removed in the future. Use dt.smartscape.frontend instead. Display name: Device application The ME ID of a device application.
DEVICE_APPLICATION-EA8A8751A60D5BCE8
dt.entity.disk
string
resourcedeprecatedThis field is deprecated and will be removed in the future. Use dt.smartscape.disk instead. Display name: Disk An entity ID of an entity of type DISK Tags: entity-id
DISK-5472CBC1ED0981D6
dt.entity.ec2_instance
string
resourcedeprecatedThis field is deprecated and will be removed in the future. Use dt.smartscape.aws_ec2_instance instead. Display name: EC2 instance An entity ID of an entity of type EC2_INSTANCE Tags: entity-id
EC2_INSTANCE-0004DD30F142D18C
dt.entity.external_synthetic_test
string
resourcedeprecatedThis field is deprecated and will be removed in the future. Display name: External synthetic test An entity ID of an entity of type EXTERNAL_SYNTHETIC_TEST. Tags: entity-id
EXTERNAL_SYNTHETIC_TEST-A140F3B85BCCBD1A
dt.entity.external_synthetic_test_step
string
resourcedeprecatedThis field is deprecated and will be removed in the future. Display name: External synthetic test step An entity ID of an entity of type EXTERNAL_SYNTHETIC_TEST_STEP. Tags: entity-id
EXTERNAL_SYNTHETIC_TEST_STEP-A140F3B85BCCBD1A
dt.entity.gcp_zone
string
resourcedeprecatedThis field is deprecated and will be removed in the future. Use dt.smartscape.gcp_zone instead. Display name: GCP zone An entity ID of an entity of type GCP_ZONE Tags: entity-id
GCP_ZONE-3699CB75E19C8505
dt.entity.host
string
resourcedeprecatedThis field is deprecated and will be removed in the future. Use dt.smartscape.host instead. Display name: Host An entity ID of an entity of type HOST. Tags: entity-id
HOST-E0D8F94D9065F24F
dt.entity.host_group
string
resourcedeprecatedThis field is deprecated and will be removed in the future. Use dt.host_group.id instead. Note that dt.host_group.id represents the host group name, not the entity ID, as there is no entity of type HOST_GROUP in Smartscape. Display name: Host group An entity ID of an entity of type HOST_GROUP. Tags: entity-id
HOST_GROUP-E7FBBCF7B1467174
dt.entity.http_check
string
resourcedeprecatedThis field is deprecated and will be removed in the future. Use dt.smartscape.http_monitor instead. Display name: HTTP check An entity ID of an entity of type HTTP_CHECK. Tags: entity-id
HTTP_CHECK-A140F3B85BCCBD1A
dt.entity.http_check_step
string
resourcedeprecatedThis field is deprecated and will be removed in the future. Use dt.smartscape.http_monitor_step instead. Display name: HTTP check step An entity ID of an entity of type HTTP_CHECK_STEP. Tags: entity-id
HTTP_CHECK_STEP-A140F3B85BCCBD1A
dt.entity.kubernetes_cluster
string
resourcedeprecatedThis field is deprecated and will be removed in the future. Use dt.smartscape.k8s_cluster instead. Display name: Kubernetes cluster An entity ID of an entity of type KUBERNETES_CLUSTER. Tags: entity-id
KUBERNETES_CLUSTER-E0D8F94D9065F24F
dt.entity.kubernetes_node
string
resourcedeprecatedThis field is deprecated and will be removed in the future. Use dt.smartscape.k8s_node instead. Display name: Kubernetes node An entity ID of an entity of type KUBERNETES_NODE. Tags: entity-id
KUBERNETES_NODE-874C66B68CE15070
dt.entity.kubernetes_service
string
resourcedeprecatedThis field is deprecated and will be removed in the future. Use dt.smartscape.k8s_service instead. Display name: Kubernetes service An entity ID of an entity of type KUBERNETES_SERVICE. Tags: entity-id
KUBERNETES_SERVICE-FE6E75BB9DF02347
dt.entity.mobile_application
string
resourcedeprecatedThis field is deprecated and will be removed in the future. Use dt.smartscape.frontend instead. Display name: Mobile application The ME ID of a mobile application. Tags: entity-id
MOBILE_APPLICATION-E8A8751A60D5BCE8
dt.entity.multiprotocol_monitor
string
resourcedeprecatedThis field is deprecated and will be removed in the future. Use dt.smartscape.network_availability_monitor instead. Display name: Multiprotocol monitor An entity ID of an entity of type MULTIPROTOCOL_MONITOR. Tags: entity-id
MULTIPROTOCOL_MONITOR-A140F3B85BCCBD1A
dt.entity.network_interface
string
resourcedeprecatedThis field is deprecated and will be removed in the future. Use dt.smartscape.network_interface instead. Display name: Network interface An entity ID of an entity of type NETWORK_INTERFACE Tags: entity-id
NETWORK_INTERFACE-FC7B4A5937FC125C
dt.entity.process_group
string
resourcedeprecatedThis field is deprecated and will be removed in the future. Use dt.process_group.id or dt.process_group.detected_name instead. Note that there is no entity type PROCESS_GROUP in Smartscape, so dt.process_group.id exists only for compatibility. Preferably use dt.process_group.detected_name to identify process groups. Display name: Process group An entity ID of an entity of type PROCESS_GROUP. Tags: entity-id
PROCESS_GROUP-E0D8F94D9065F24F
dt.entity.process_group_instance
string
resourcedeprecatedThis field is deprecated and will be removed in the future. Use dt.smartscape.process instead. Display name: Process group instance An entity ID of an entity of type PROCESS_GROUP_INSTANCE. Tags: entity-id
PROCESS_GROUP_INSTANCE-E0D8F94D9065F24F
dt.entity.service
string
resourcedeprecatedThis field is deprecated and will be removed in the future. Use dt.smartscape.service instead. Display name: Service An entity ID of an entity of type SERVICE. Tags: entity-id
SERVICE-57EC3CFC1FE72449
dt.entity.service_method
string
resourcedeprecatedThis field is deprecated and will be removed in the future. Note that there is no replacement for service methods in Smartscape. Display name: Service method An entity ID of an entity of type SERVICE_METHOD. Tags: entity-id
SERVICE_METHOD-659B35CA9AAC96C1
dt.entity.service_method_group
string
resourcedeprecatedThis field is deprecated and will be removed in the future. Note that there is no replacement for service method groups in Smartscape. Display name: Service method group An entity ID of an entity of type SERVICE_METHOD_GROUP. Tags: entity-id
SERVICE_METHOD_GROUP-02000E1DB1CDAF9F
dt.entity.software_component
string
resourcedeprecatedThis field is deprecated and will be removed in the future. Display name: Software component An entity ID of an entity of type SOFTWARE_COMPONENT. Tags: entity-id
SOFTWARE_COMPONENT-4700CB75E19C8506
dt.entity.synthetic_location
string
resourcedeprecatedThis field is deprecated and will be removed in the future. Use dt.smartscape.synthetic_location instead. Display name: Synthetic location An entity ID of an entity of type SYNTHETIC_LOCATION. Tags: entity-id
SYNTHETIC_LOCATION-D140F3B85BCCBD1A
dt.entity.synthetic_test
string
resourcedeprecatedThis field is deprecated and will be removed in the future. Use dt.smartscape.browser_monitor instead. Display name: Synthetic test An entity ID of an entity of type SYNTHETIC_TEST. Tags: entity-id
SYNTHETIC_TEST-A140F3B85BCCBD1A
dt.entity.synthetic_test_step
string
resourcedeprecatedThis field is deprecated and will be removed in the future. Use dt.smartscape.browser_monitor_step instead. Display name: Synthetic test step An entity ID of an entity of type SYNTHETIC_TEST_STEP. Tags: entity-id
SYNTHETIC_TEST_STEP-A140F3B85BCCBD1A
Dynatrace Extensions
Dynatrace Extensions fields
Additional extension information sent via self-monitoring.
Attribute
Type
Description
Examples
dt.extension.config.id
string
resourceexperimental Display name: Extension configuration ID Extension's monitoring configuration identifier.
resourceexperimental Display name: Extension endpoint hints Hints to provide for the cluster in order to find proper endpoint in task registry.
['nat-test.lab.dynatrace.org', '1521', 'orc']
dt.extension.executor.pod.uid
string
resourceexperimental Display name: Extension executor pod UID Extension executor pod UID. 2
12345678-1234-1234-1234-123456789abc
dt.extension.name
string
resourceexperimental Display name: Extension name Name of the extension.
com.snmptrap.generic
dt.extension.python_version
string
resourceexperimental Display name: Extension Python version Version of the Python runtime version used by extension.
3.14
dt.extension.status
string
resourceexperimental Display name: Extension status The status of the component reporting a self-monitoring event.
AUTHENTICATION_ERROR
dt.extension.version
string
resourceexperimental Display name: Extension version Version of the extension.
0.0.1
1
This attribute is only set when the extension is running in a Kubernetes environment.
2
This attribute is only set when the extension is running in a Kubernetes environment.
dt.extension.status has the following list of well-known values. If one of them applies, then the respective value MUST be used, otherwise a custom value MAY be used.
Value
Description
Display name
AUTHENTICATION_ERROR
Unable to connect to EEC
Authentication Error
DEVICE_CONNECTION_ERROR
Failed to establish connection with the device
Device Connection Error
EEC_CONNECTION_ERROR
Unable to connect to EEC
EEC Connection Error
GENERIC_ERROR
Generic status used to communicate job failed
Generic Error
INVALID_ARGS_ERROR
Invalid arguments
Invalid Arguments
INVALID_CONFIG_ERROR
Config provided by EEC is invalid
Invalid Config
OK
Extension works fine
OK
UNKNOWN_ERROR
Uninitialized/unknown error
Unknown Error
Dynatrace ingest
Attributes defined in this namespace are used by Dynatrace to describe different aspects of the ingested data.
Dynatrace ingest fields
Attribute
Type
Description
Examples
dt.ingest.debug_messages
string[]
experimental Display name: Ingest debug messages An array of strings that represent debug messages that provide a detailed debugging information. That could include even variable parts, like which attribute was modified, or which processing rules were applied.
['MyATTribute mapped to myAttribute']
dt.ingest.format
string
experimental Display name: Ingest format The format of the data ingested in Dynatrace via the various ingest channels. E.g., Generic log ingest, OTLP logs ingest
dtapi/json; otlp/protobuf
dt.ingest.origin
string
experimental Display name: Ingest origin Origin of the data ingested in Dynatrace.
splunk; cribl
dt.ingest.size
long
stable Display name: Ingest size The size of the ingested data point in bytes.
2005
dt.ingest.warnings
string[]
experimental Display name: Ingest warnings An array of strings representing markers of unexpected situations that might affect the correctness or completeness of incoming data points. It might be, for instance, limits applied or a processing rule failing. It should not be a detailed log of what happened, just the high-level class of the issue that occurred.
['attr_count_trimmed', 'content_trimmed']
dt.ingest.format MUST be one of the following:
Value
Description
Display name
dtapi/json
JSON data ingested via the Dynatrace APIs or via EEC (Extension Execution Controller)
DT API JSON
dtapi/plaintext
(deprecated: use "plaintext") Plain text data ingested via the Dynatrace API
DT API Plaintext
journald
Journald data ingested via OneAgent
Journald
otlp/json
OpenTelemetry Protocol (OTLP) JSON data ingested via the Dynatrace APIs
OTLP JSON
otlp/protobuf
OpenTelemetry Protocol (OTLP) Protobuf data ingested via the Dynatrace APIs or via EEC (Extension Execution Controller)
OTLP Protobuf
plaintext
Plain text data ingested via the Dynatrace APIs, EEC (Extension Execution Controller) or OneAgent
Plaintext
syslog
Syslog data ingested via OneAgent or via EEC (Extension Execution Controller)
Syslog
unknown
The data format was not recognized (only for metrics dimension)
Unknown
windowseventlog
Windows event log data ingested via OneAgent
Windows Event Log
dt.ingest.warnings MUST contain only values from the following list:
Value
Description
content_trimmed
The content was trimmed, right after receiving it by Cluster/ActiveGate, because it exceeded the event content max byte size limit.
content_trimmed_pipe
The content was trimmed in post-processing (after applying processing rules) because it exceeded the event content max byte size limit
attr_count_trimmed
The number of attributes was trimmed, right after receiving it by Cluster/ActiveGate, because it exceeded the max number of attributes limit.
attr_count_trimmed_pipe
The number of attributes was trimmed in post-processing (after applying processing rules) because it exceeded the max number of attributes limit.
attr_key_case_mismatch
The attribute key is detected that matches the custom attribute key or the semantic attribute key, but there is the attribute key case mismatch.
attr_key_trimmed
The attribute key was trimmed, right after receiving it by Cluster/ActiveGate, because it exceeded the max key length limit.
attr_val_count_trimmed
At least one multi-value attribute had values number trimmed, right after receiving it by Cluster/ActiveGate, because it exceeded the max number of attributes limit.
attr_val_count_trimmed_pipe
After applying processing rules, at least one multi-value attribute had its values number trimmed (after using processing rules) because it exceeded the maximum number of attributes limit.
attr_val_size_trimmed
At least one attribute had its value size trimmed, right after receiving it by Cluster/ActiveGate, because it exceeded the max value size in bytes limit.
attr_val_size_trimmed_pipe
At least one attribute had its value size trimmed (after applying processing rules) because it exceeded the max value size in bytes limit.
timestamp_corrected
Timestamp was too far in the future and was corrected to current time.
common_attr_corrected
STATUS, LOG_LEVEL or EVENT_TYPE attribute was corrected.
processing_batch_timeout
Batch timeout occurred during processing pipeline.
processing_transformer_timeout
Execution timeout in one of processing transformers occurred during processing pipeline.
processing_transformer_error
Execution error in one of processing transformers occurred during processing pipeline.
processing_transformer_throttled
Execution throttled in one of processing transformers during processing pipeline.
processing_output_record_conversion_error
Output conversion error occurred for some record during processing pipeline.
processing_prepare_input_error
Prepare input error occurred in one of enabled processing pipeline rules.
Dynatrace
Dynatrace resource fields
Attribute
Type
Description
Examples
dt.cost.costcenter
string
resourcestable Display name: Cost center Can be used to assign usage to a Cost Center.
Team A
dt.cost.product
string
resourcestable Display name: Cost product Can be used to assign usage to a Product or Application ID.
Product A
dt.host_group.id
string
resourcestable Display name: Host group ID See Organize your environment using host groups. Note that host groups are identified by their name, not by the entity ID of the host group entity. For details on the entity ID, see dt.entity.host_group. Tags: permissionprimary-field
myHostGroup
dt.metrics.source
string
resourceexperimental Display name: Metrics source The source from which metrics are ingested. 1
telegraf; com.dynatrace.extension.sql-oracle
dt.network_zone.id
string
resourceexperimental Display name: Network zone ID The ID of the network zone. See Dynatrace Documentation
vpc-123
dt.openpipeline.forwarding.config_id
string
resourceexperimental Display name: OpenPipeline forwarding config ID ID of the forwarding configuration in OpenPipeline.
resourceexperimental Display name: Process group detection declarative ID
dt.pg_detection.environment.id
string
resourceexperimental Display name: Process group detection environment ID DT_ENVIRONMENT_ID environment variable
dt.pg_detection.node.id
string
resourceexperimental Display name: Process group detection node ID DT_NODE_ID environment variable; also see Process group detection
dt.process_group.detected_name
string
resourcestable Display name: Process group name The name of the process group as it was detect by the agent.
Apache Web Server httpd; Redis unguard-redis-* redis; Linux System
dt.process_group.id
string
resourcestable Display name: Process group ID The identifier shared by all entities belonging to a given process group.
PROCESS_GROUP-1234
dt.security_context
string
resourcestable Display name: DT security context The security context is used in access permissions to limit the visibility. Learn more about the Dynatrace permission model Tags: permission
dt.smartscape_source.id
smartscapeId
resourcestable Display name: Smartscape source ID The ID of the entity considered the source of the signal. The string represents an entity ID of an entity that is stored in the Smartscape storage. 2 Tags: smartscape-id
resourcedeprecatedThis field is deprecated and will be removed in the future. Use dt.smartscape_source.id instead. Display name: Source entity The ID of the entity considered the source of the signal. The string represents an entity ID of an entity that is stored in the classic entity storage. 3 Tags: entity-id
resourcedeprecatedThis field is deprecated and will be removed in the future. Use dt.smartscape_source.type instead. Display name: Source entity type The entity type of the entity whose identifier is held in dt.source_entity. The value must be a valid entity type and consistent with dt.source_entity. Note, however, that the type identifiers are expected to be lowercased in alignment with suffixes of dt.entity.* keys.
This is the framework used for capturing, processing and forwarding metrics, not the emitting monitored entity. Exemplary custom value: name of an extension sending metrics.
2
The value of this field will be based on the value of one of the dt.smartscape.<type> fields. That means that the dt.smartscape_source.id and dt.smartscape.<type> fields will both be set to the same ID.
3
The value of this field will be based on the value of one of the dt.entity.<type> fields. This means that the dt.source_entity and dt.entity.<type> fields will both be set to the same ID.
dt.metrics.source has the following list of well-known values. If one of them applies, then the respective value MUST be used, otherwise a custom value MAY be used.
Value
Description
Display name
dynatrace_codemodule
dynatrace_codemodule
Dynatrace Code Module
dynatrace_ingest
dynatrace_ingest
Dynatrace Ingest
dynatrace_osagent
OsAgent
Dynatrace OS Agent
micrometer
Micrometer
Micrometer
oneagent_metric_api
OneAgentMetricAPI
OneAgent Metric API
opentelemetry
OpenTelemetry
OpenTelemetry
statsd
StatsD
StatsD
telegraf
Telegraf
Telegraf
Dynatrace fields
Attribute
Type
Description
Examples
dt.container.uid
long
experimental A stable identifier for a container that survives container restarts and crash loops. A new ID is only assigned when the underlying scheduling unit is replaced—such as when a Kubernetes Pod is recreated (for example, after a pod eviction or an image change). Used in Container Application Monitoring to count distinct billable units.
5765169529530274912
dt.has_container_application_monitoring
boolean
experimental Display name: Dynatrace has container application monitoring Indicates that the underlying container of the data point should be considered in Container Application Monitoring license. Set to true for the opt-in of Container Application Monitoring. Setting to false is not supported by the backend and has no effect.
experimental Display name: Dynatrace query A query in the DQL format, see Dynatrace Query Langauge.
timeseries avg(dt.host.cpu.idle); fetch logs
dt.raw_data
string
experimental Display name: Dynatrace raw data The complete content of the record as it was originally accepted by Dynatrace, stored as a string in JSON format. This field captures the unaltered data for reference, debugging, or auditing purposes
{"content": "example record content"}
Dynatrace OpenPipeline
Fields defined in this namespace are used by Dynatrace to describe various aspects of the data ingested through OpenPipeline, providing detailed insights into the ingestion process.
Dynatrace OpenPipeline fields
Attribute
Type
Description
Examples
dt.openpipeline.pipelines
string[]
resourceexperimental Display name: OpenPipeline pipelines Collects the identifiers of all pipelines through which a record has passed during the ingestion process in OpenPipeline, providing a complete trace of its journey.
resourceexperimental Display name: OpenPipeline ingest source Identifies the source (such as API endpoints or OneAgent) used for ingesting the record into OpenPipeline.
/platform/ingest/v1/events; oneagent
dt.openpipeline.source_type
string
resourceexperimental Display name: OpenPipeline source type Identifies the source type used to ingest data in Dynatrace, for example, from OTLP and OneAgent.
otlp; oneagent
dt.openpipeline.source_type MUST be one of the following:
Value
Description
Display name
api
Logs ingested via one of the ActiveGate APIs
API
aws_firehose
Logs ingested via Amazon Data Firehose
AWS Firehose
extension
Logs ingested via the EEC running on host
Extension
oneagent
Logs ingested via OneAgent
OneAgent
otlp
Logs ingested via the OpenTelemetry Protocol (OTLP)
OTLP
unknown
The source type was not recognized (only for metrics dimension)
Unknown
Dynatrace OS service
Dynatrace OS service fields
Attribute
Type
Description
Examples
dt.osservice.alerting
boolean
deprecatedAvailable only for 2nd gen clusters. Replaced with os_service.alerting. Boolean attribute deciding whether the service status triggers alerts or not.
dt.osservice.status
string
deprecatedAvailable only for 2nd gen clusters. Replaced with os_service.status. Current running state.
activating
dt.osservice.status MUST be one of the following:
Value
Description
Display name
activating
Service is activating.
Activating
active
Service is active.
Active
continue_pending
Service continues pending.
Continue Pending
deactivating
Service is deactivating.
Deactivating
failed
Service failed to start.
Failed
inactive
Service is inactive.
Inactive
pause_pending
Service paused pending.
Pause Pending
paused
Service is currently paused.
Paused
reloading
Service is reloading.
Reloading
running
Service is currently running.
Running
start_pending
Service started pending.
Start Pending
stop_pending
Service stopped pending.
Stop Pending
stopped
Service is currently stopped.
Stopped
Dynatrace OS service resource fields
Attribute
Type
Description
Examples
dt.osservice.display_name
string
resourcedeprecatedAvailable only for 2nd gen clusters. Replaced with os_service.display_name. On Linux based systems this value ought to be the same as in the name attribute. On Windows it will be a prettier version of the name attribute.
My OS Service
dt.osservice.manufacturer
string
resourcedeprecatedAvailable only for 2nd gen clusters. Replaced with os_service.manufacturer. Manufacturer of the service. On Linux based systems, the value will always be -, meaning empty.
-; SSH Corp.
dt.osservice.name
string
resourcedeprecatedAvailable only for 2nd gen clusters. Replaced with os_service.name. Unique OS service name.
myosservice
dt.osservice.path
string
resourcedeprecatedAvailable only for 2nd gen clusters. Replaced with os_service.path. The full path to the process executable. On Linux based systems, this can be set to the target of proc/[pid]/exe. On Windows, it can be set to the result of GetProcessImageFileNameW.
/usr/bin/cmd/otelcol
dt.osservice.startup_type
string
resourcedeprecatedAvailable only for 2nd gen clusters. Replaced with os_service.startup_type. Current startup type.
auto
dt.osservice.startup_type MUST be one of the following:
Value
Description
Display name
auto
Windows specific. Automatic: The service starts at system logon.
Auto
auto_delay
Windows specific. Automatic (Delayed Start): The service starts a short while after the system has finished starting up.
Auto Delay
auto_delay_trigger
Windows specific. Automatic (Delayed Start, Trigger Start)
Auto Delay Trigger
auto_trigger
Windows specific. Automatic (Trigger Start): This service will start automatically at boot.
Auto Trigger
disabled
Linux specific. Service is configured to not start when the system boots, but can be started manually, or as a dependency of another service.
Disabled
enabled
Linux specific. Service is marked for starting up on boot.
Enabled
enabled-runtime
Linux specific. Service is marked for starting up on boot.
Enabled Runtime
indirect
Linux specific. Service is not enabled directly but can be activated via dependencies or aliases.
linked
Linux specific. Service unit file is symlinked into systemd from an external location persistently.
linked-runtime
Linux specific. Service unit file is temporarily symlinked into systemd for the current runtime only.
manual
Windows specific. Manual: The service starts only when explicitly summoned.
Manual
manual_trigger
Windows specific. Manual (Trigger Start): This service will not start automatically at boot.
Manual Trigger
static
Linux specific. Service is not enabled and can only start when pulled in by dependencies or started manually.
Static
Dynatrace RUM
The dt.rum namespace contains Dynatrace RUM specific fields.
Dynatrace RUM fields
Attribute
Type
Description
Examples
dt.rum.application.entity
string
experimental Display name: Frontend application An entity ID of an entity of type APPLICATION or MOBILE_APPLICATION. Tags: entity-id
stable Display name: Frontend application ID The Dynatrace RUM application ID. For mobile applications, a UUID is used. For web applications, an 8-byte HEX string is used.
experimental Display name: Browser session ID A browser session identifier set and read by Dynatrace RUM. Used to correlate RUM Classic user actions with PurePaths during ingest.
4D3133F359A76AB05AAF39691696858A
dt.rum.is_linking_candidate
boolean
experimental Display name: Is linking candidate If set to 'true', it indicates that Dynatrace RUM captured a user event that can be linked to this trace.
true
dt.rum.session.id
string
stable Display name: User session ID A unique identifier for a user session. Use this field to join user events with user sessions in DQL queries.
deprecatedReplaced with frontend.link. Display name: RUM link A RUM link provides backend to frontend linking information from traces to Dynatrace RUM. Unlike span links which reference other spans, the RUM link connects a span to a user event and/or user session.
Dynatrace RUM resource fields
Attribute
Type
Description
Examples
dt.rum.agent.type
string
resourceexperimental Display name: RUM agent type The Dynatrace RUM agent type.
android
dt.rum.agent.version
string
resourceexperimental Display name: RUM agent version The version of the Dynatrace RUM agent. It is provided in the format major.minor.patch.build. The build number is optional.
8.263.1; 9.293.2.1; 1.313.0.20250402-172634
dt.rum.event.source.type
string
resourceexperimental Display name: RUM event source type The Dynatrace RUM source technology that produced this event. Only used by cross-platform implementations, otherwise the field is omitted.
flutter
dt.rum.instance.id
string
resourcestable Display name: RUM instance ID A persistent pseudonymous identifier representing the same device (browser user agent or mobile app installation) across multiple user sessions. Used to analyze returning users and long-term journeys. Formerly known as "Visitor ID" or "internal user ID." For information on the real user identity, see user.identifier.
resourcestable Display name: RUM schema version The Dynatrace RUM enrichment version.
0.1
dt.rum.user_type
string
resourceexperimental Display name: User type The RUM user type.
real_user
dt.rum.agent.type MUST be one of the following:
Value
Description
Display name
android
OneAgent for Android
Android
ios
OneAgent for iOS
iOS
javascript
RUM JavaScript
JavaScript
dt.rum.event.source.type MUST be one of the following:
Value
Description
Display name
flutter
Flutter
Flutter
react_native
React Native auto-instrumentation
React Native
dt.rum.user_type MUST be one of the following:
Value
Description
Display name
real_user
The user event was produced by a real user.
Real User
robot
The user event was produced by a bot user.
Robot
synthetic
The user event was produced by a synthetic test.
Synthetic
Invalid fields
The dt.rum.invalid namespace is used for fields that are removed because of user event ingest validation.
For example, if the calculated web_vitals.largest_contentful_paint value would be less than 0, the value is copied over to dt.rum.invalid.web_vitals.largest_contentful_paint and web_vitals.largest_contentful_paint is removed.
Dynatrace service
Dynatrace service fields
Attribute
Type
Description
Examples
dt.service.name
string
resourcestable Display name: Service name The Dynatrace service name derived from service detection rules. It is equal to the Smartscape service node name.
OrderProcessingService; payment-api
dt.service.sdv1_type
string
resourcestable Display name: SDv1 service type The SDv1 service type. This field is available only if dt.service_detection.version is 1.
dt.service.sdv1_type MUST be one of the following:
Value
Description
BACKGROUND_ACTIVITY
Background activity (process) service
CICS_INTERACTION_SERVICE
IBM CICS interaction service
CICS_SERVICE
IBM CICS service
CUSTOM_APPLICATION
Custom application service
CUSTOM_SERVICE
Custom (method-based) service
DATABASE_SERVICE
Database service
ENTERPRISE_SERVICE_BUS_SERVICE
Enterprise service bus (ESB) service
IMS_INTERACTION_SERVICE
IBM IMS interaction service
IMS_SERVICE
IBM IMS service
MESSAGING_SERVICE
Messaging service
MOBILE_SERVICE
Mobile service
QUEUE_LISTENER_SERVICE
Queue listener service
RMI_SERVICE
Java RMI service
RPC_SERVICE
Remote procedure call service
SAAS_VENDOR
SaaS vendor service
SPAN
Span-based service
UNKNOWN
Unknown service type
WEBSITE
Website
WEB_REQUEST_SERVICE
Web request service
WEB_SERVICE
Web service endpoint
ZOS_CONNECT
z/OS Connect service
Dynatrace service detection
Dynatrace service detection fields
Attribute
Type
Description
Examples
dt.service_detection.version
long
resourcestable Display name: Service detection version The version of the service detection mechanism used to identify the service. Either 1 for Service Detection Version 1 (SDv1) or 2 for Service Detection Version 2 (SDv2).
1; 2
Dynatrace settings
Fields for referencing Settings 2.0 objects, schemas and scopes.
Considerations on which fields to use
Although the dt.settings.object_id is enough to identify a specific settings value within a dynatrace environment, adding explicit information about the schema, scope and/or scope type can be useful nonetheless. If your use-case will only ever involve a single schema, scope type and/or scope, documenting this is good enough - if multiple schemas, scope types and/or scopes can be involved, filling the corresponding fields is strongly recommended.
dt.settings.references can be used if multiple settings objects need to be referenced. In that case, each entry in the array can hold a reference to a single settings object.
Dynatrace settings fields
The top level fields contain generally relevant information for all monitoring data.
Attribute
Type
Description
Examples
dt.settings.object_id
string
experimental Display name: Settings object ID The object ID of a settings value. This corresponds to the 'objectId' field/parameter in the Settings API.
experimental Display name: Settings object summary The human-readable summary or name of a single value of a multi-value settings schema. This corresponds to the 'summary' field in the Settings API.
Journey Service all errors; Really, this can be anything; My alerting rule
dt.settings.references
record[]
experimental Display name: Settings references A collection of references to settings objects. Each entry in the array holds a reference to a single settings object.
experimental Display name: Settings relationship The type of relationship to the referenced settings object. You can use arbitrary values (in snake_case) here that describe the relationship for your use-case.
matched_rule; triggered_alert
dt.settings.schema_id
string
experimental Display name: Settings schema ID The schema ID of a settings schema, as used in the Settings APIs.
experimental Display name: Settings schema version The version of the schema referenced by dt.settings.schema_id, as declared by the schema itself. Typically a semantic version number.
1.0.0; 1.2.3
dt.settings.scope_id
string
experimental Display name: Settings scope ID The ID of the scope that a settings object is persisted on. This corresponds to the 'scope' field/parameter in the Settings API.
environment; HOST-EFAB6D2FE7274823
dt.settings.scope_name
string
experimental Display name: Settings scope name The human-readable name of the scope that a settings object is persisted on.
deb-10-k3s-oi-01.lab.dynatrace.org
dt.settings.scope_type
string
experimental Display name: Settings scope type The type of the scope that a settings object is persisted on.
environment; host_group; host
Smartscape ID
This namespace contains all field names that contain entitiy IDs that are stored in Smartscape on Grail. To ensure we can distinguish between classic entity IDs and Smartscape IDs, we use the dt.smartscape.* namespace to enrich entity IDs in signal data.
Smartscape ID resource fields
Attribute
Type
Description
Examples
dt.smartscape.__type__
smartscapeId
resourcestable Display name: Smartscape ID A Smartscape ID that can be used to query entities from the Smartscape storage. __type__ is a placeholder for any Smartscape type. Tags: smartscape-id
K8S_CLUSTER-E0D8F94D9065F24F
dt.smartscape.activegate
smartscapeId
resourceexperimental Display name: ActiveGate ID Smartscape ID referencing an ActiveGate installation entity. Tags: smartscape-id
ACTIVEGATE-0000000003B41C6E
dt.smartscape.aws_account
smartscapeId
resourcestable Display name: AWS account ID Smartscape ID referencing an AWS account entity. Tags: smartscape-id
AWS_ACCOUNT-5566FFEE77889900
dt.smartscape.aws_availability_zone
smartscapeId
resourcestable Display name: AWS availability zone ID Smartscape ID referencing an AWS Availability Zone. Tags: smartscape-id
AWS_AVAILABILITY_ZONE-6677001122334455
dt.smartscape.aws_ec2_eip
smartscapeId
resourcestable Display name: AWS elastic IP ID Smartscape ID referencing an AWS Elastic IP. Tags: smartscape-id
AWS_EC2_EIP-7788112233445566
dt.smartscape.aws_ec2_instance
smartscapeId
resourcestable Display name: AWS EC2 instance ID Smartscape ID referencing an AWS EC2 instance. Tags: smartscape-id
AWS_EC2_INSTANCE-8899223344556677
dt.smartscape.aws_ec2_networkinterface
smartscapeId
resourcestable Display name: AWS EC2 network interface ID Smartscape ID referencing an EC2 network interface. Tags: smartscape-id
AWS_EC2_NETWORKINTERFACE-99AA334455667788
dt.smartscape.aws_ec2_securitygroup
smartscapeId
resourcestable Display name: AWS EC2 security group ID Smartscape ID referencing an EC2 Security Group. Tags: smartscape-id
AWS_EC2_SECURITYGROUP-AABB334455667788
dt.smartscape.aws_lambda_alias
smartscapeId
resourcestable Display name: AWS Lambda alias ID Smartscape ID referencing an AWS Lambda alias. Tags: smartscape-id
AWS_LAMBDA_ALIAS-BBCC334455667799
dt.smartscape.aws_lambda_function
smartscapeId
resourcestable Display name: AWS Lambda function ID Smartscape ID referencing an AWS Lambda function. Tags: smartscape-id
AWS_LAMBDA_FUNCTION-DDEEFF2233445566
dt.smartscape.aws_rds_dbcluster
smartscapeId
resourcestable Display name: AWS RDS database cluster ID Smartscape ID referencing an AWS RDS DB cluster. Tags: smartscape-id
AWS_RDS_DB_CLUSTER-EEFF334455667788
dt.smartscape.aws_rds_dbclustersnapshot
smartscapeId
resourcestable Display name: AWS RDS database cluster snapshot ID Smartscape ID referencing an RDS DB cluster snapshot. Tags: smartscape-id
AWS_RDS_DB_CLUSTER_SNAPSHOT-FF00112233445566
dt.smartscape.aws_rds_dbinstance
smartscapeId
resourcestable Display name: AWS RDS database instance ID Smartscape ID referencing an RDS DB instance. Tags: smartscape-id
AWS_RDS_DB_INSTANCE-0011FF2233445566
dt.smartscape.aws_rds_dbsnapshot
smartscapeId
resourcestable Display name: AWS RDS database snapshot ID Smartscape ID referencing an RDS DB snapshot. Tags: smartscape-id
AWS_RDS_DB_SNAPSHOT-2233FF4455667788
dt.smartscape.aws_rds_dbsubnetgroup
smartscapeId
resourcestable Display name: AWS RDS database subnet group ID Smartscape ID referencing an RDS subnet group. Tags: smartscape-id
AWS_RDS_DB_SUBNET_GROUP-3344FF5566778899
dt.smartscape.aws_region
smartscapeId
resourcestable Display name: AWS region ID Smartscape ID referencing an AWS region entity. Tags: smartscape-id
resourcestable Display name: Business flow ID Smartscape ID referencing a Business Analytics / BizFlow entity. Tags: smartscape-id
BIZFLOW-AABBCCDDEEFF0011
dt.smartscape.browser_monitor
smartscapeId
resourcestable Display name: Browser monitor ID Smartscape ID referencing a browser monitor entity. Tags: smartscape-id
BROWSER_MONITOR-A140F3B85BCCBD1A
dt.smartscape.browser_monitor_step
smartscapeId
resourcestable Display name: Browser monitor step ID Smartscape ID referencing a browser monitor step entity. Tags: smartscape-id
BROWSER_MONITOR_STEP-A140F3B85BCCBD1A
dt.smartscape.container
smartscapeId
resourcestable Display name: Container ID Smartscape ID referencing a container entity. Tags: smartscape-id
CONTAINER-0F1E2D3C4B5A6978
dt.smartscape.disk
smartscapeId
resourcestable Display name: Disk ID Smartscape ID referencing a disk entity. Tags: smartscape-id
DISK-5472CBC1ED0981D6
dt.smartscape.frontend
smartscapeId
resourcestable Display name: Frontend ID The frontend Smartscape ID. Tags: smartscape-id
FRONTEND-E0D8F94D9065F24F
dt.smartscape.gcp_zone
smartscapeId
resourcestable Display name: GCP zone ID Smartscape ID referencing a GCP zone entity. Tags: smartscape-id
GCP_ZONE-3699CB75E19C8505
dt.smartscape.host
smartscapeId
resourcestable Display name: Host ID Smartscape ID referencing a host entity. Tags: smartscape-id
HOST-A1B2C3D4E5F67890
dt.smartscape.http_monitor
smartscapeId
resourcestable Display name: HTTP monitor ID Smartscape ID referencing an HTTP monitor entity. Tags: smartscape-id
HTTP_MONITOR-A140F3B85BCCBD1A
dt.smartscape.http_monitor_step
smartscapeId
resourcestable Display name: HTTP monitor step ID Smartscape ID referencing an HTTP monitor step entity. Tags: smartscape-id
HTTP_MONITOR_STEP-A140F3B85BCCBD1A
dt.smartscape.k8s_cluster
smartscapeId
resourcestable Display name: Kubernetes cluster ID A Smartscape ID that can be used to query Kubernetes cluster entities from the Smartscape storage. Tags: smartscape-id
K8S_CLUSTER-0123456789ABCDEF
dt.smartscape.k8s_configmap
smartscapeId
resourcestable Display name: Kubernetes configmap ID Smartscape ID referencing a Kubernetes ConfigMap. Tags: smartscape-id
K8S_CONFIGMAP-AABBCCDDEEFF0011
dt.smartscape.k8s_cronjob
smartscapeId
resourcestable Display name: Kubernetes cronjob ID Smartscape ID referencing a Kubernetes CronJob. Tags: smartscape-id
K8S_CRONJOB-2233445566778899
dt.smartscape.k8s_customresourcedefinition
smartscapeId
resourcestable Display name: Kubernetes customresourcedefinition ID Smartscape ID referencing a Kubernetes CustomResourceDefinition. Tags: smartscape-id
K8S_CUSTOMRESOURCEDEF-33445566778899AA
dt.smartscape.k8s_daemonset
smartscapeId
resourcestable Display name: Kubernetes daemonset ID Smartscape ID referencing a Kubernetes DaemonSet. Tags: smartscape-id
K8S_DAEMONSET-BBCCDDEEFF001122
dt.smartscape.k8s_deployment
smartscapeId
resourcestable Display name: Kubernetes deployment ID Smartscape ID referencing a Kubernetes deployment. Tags: smartscape-id
K8S_DEPLOYMENT-445566778899AABB
dt.smartscape.k8s_deploymentconfig
smartscapeId
resourcestable Display name: Kubernetes deploymentconfig ID Smartscape ID referencing an OpenShift DeploymentConfig. Tags: smartscape-id
K8S_DEPLOYMENTCONFIG-5566778899AABBCC
dt.smartscape.k8s_dynakube
smartscapeId
resourcestable Display name: Kubernetes dynakube ID Smartscape ID referencing a Dynatrace DynaKube Kubernetes resource. Tags: smartscape-id
K8S_DYNAKUBE-66778899AABBCCDD
dt.smartscape.k8s_edgeconnect
smartscapeId
resourcestable Display name: Kubernetes edgeconnect ID Smartscape ID referencing an EdgeConnect Kubernetes resource. Tags: smartscape-id
K8S_EDGECONNECT-778899AABBCCDDEE
dt.smartscape.k8s_horizontalpodautoscaler
smartscapeId
resourcestable Smartscape ID referencing a Kubernetes HorizontalPodAutoscaler. Tags: smartscape-id
K8S_HORIZONTALPODAUTOSCALER-91C6CADBB052EB09
dt.smartscape.k8s_ingress
smartscapeId
resourcestable Display name: Kubernetes ingress ID Smartscape ID referencing a Kubernetes ingress resource. Tags: smartscape-id
K8S_INGRESS-8899AABBCCDDEEFF
dt.smartscape.k8s_job
smartscapeId
resourcestable Display name: Kubernetes job ID Smartscape ID referencing a Kubernetes job. Tags: smartscape-id
K8S_JOB-99AABBCCDDEEFF00
dt.smartscape.k8s_namespace
smartscapeId
resourcestable Display name: Kubernetes namespace ID Smartscape ID referencing a Kubernetes namespace. Tags: smartscape-id
K8S_NAMESPACE-AABBCCDDEEFF0011
dt.smartscape.k8s_networkpolicy
smartscapeId
resourcestable Display name: Kubernetes networkpolicy ID Smartscape ID referencing a Kubernetes NetworkPolicy. Tags: smartscape-id
K8S_NETWORKPOLICY-BBCCDDEEFF112233
dt.smartscape.k8s_node
smartscapeId
resourcestable Display name: Kubernetes node ID Smartscape ID referencing a Kubernetes node. Tags: smartscape-id
K8S_NODE-CCDDEEFF11223344
dt.smartscape.k8s_persistentvolume
smartscapeId
resourcestable Display name: Kubernetes persistentvolume ID Smartscape ID referencing a Kubernetes PersistentVolume. Tags: smartscape-id
K8S_PERSISTENTVOLUME-DDEEFF1122334455
dt.smartscape.k8s_persistentvolumeclaim
smartscapeId
resourcestable Display name: Kubernetes persistentvolumeclaim ID Smartscape ID referencing a PersistentVolumeClaim. Tags: smartscape-id
K8S_PERSISTENTVOLUMECLAIM-EEFF112233445566
dt.smartscape.k8s_pod
smartscapeId
resourcestable Display name: Kubernetes pod ID Smartscape ID referencing a Kubernetes pod. Tags: smartscape-id
K8S_POD-FF11223344556677
dt.smartscape.k8s_replicaset
smartscapeId
resourcestable Display name: Kubernetes replicaset ID Smartscape ID referencing a Kubernetes ReplicaSet. Tags: smartscape-id
K8S_REPLICASET-0011AABBCCDD2233
dt.smartscape.k8s_replicationcontroller
smartscapeId
resourcestable Display name: Kubernetes replicationcontroller ID Smartscape ID referencing a Kubernetes ReplicationController. Tags: smartscape-id
K8S_REPLICATIONCONTROLLER-1122BBCCDDEEFF33
dt.smartscape.k8s_secret
smartscapeId
resourcestable Display name: Kubernetes secret ID Smartscape ID referencing a Kubernetes secret. Tags: smartscape-id
K8S_SECRET-2233CCDDEEFF4455
dt.smartscape.k8s_service
smartscapeId
resourcestable Display name: Kubernetes service ID Smartscape ID referencing a Kubernetes service. Tags: smartscape-id
K8S_SERVICE-3344DDEEFF556677
dt.smartscape.k8s_statefulset
smartscapeId
resourcestable Display name: Kubernetes statefulset ID Smartscape ID referencing a Kubernetes StatefulSet. Tags: smartscape-id
K8S_STATEFULSET-4455EEFF66778899
dt.smartscape.microsoft_compute_virtualmachines
smartscapeId
resourcestable Display name: Azure virtual machine ID Smartscape ID referencing an Azure Virtual Machine resource. Tags: smartscape-id
resourcestable Display name: Azure availability zone ID Smartscape ID referencing an Azure Availability Zone. Tags: smartscape-id
AZURE_AVAILABILITY_ZONE-5566AA77889900BB
dt.smartscape.microsoft_resources_subscriptions
smartscapeId
resourcestable Display name: Azure subscription ID Smartscape ID referencing an Azure subscription. Tags: smartscape-id
AZURE_SUBSCRIPTION-99AABB00CCDDEEFF
dt.smartscape.network_availability_monitor
smartscapeId
resourceexperimental The Smartscape ID of a Synthetic network availability monitor entity. Tags: smartscape-id
NETWORK_AVAILABILITY_MONITOR-0123456789ABCDEF
dt.smartscape.network_interface
smartscapeId
resourcestable Display name: Network interface ID Smartscape ID referencing a network interface entity. Tags: smartscape-id
NETWORK_INTERFACE-FC7B4A5937FC125C
dt.smartscape.oneagent
smartscapeId
resourcestable Display name: OneAgent ID Smartscape ID referencing a OneAgent installation entity. Tags: smartscape-id
ONEAGENT-1234567890ABCDEF
dt.smartscape.process
smartscapeId
resourcestable Display name: Process ID Smartscape ID referencing a process entity. Tags: smartscape-id
PROCESS-1234567890ABCDEF
dt.smartscape.service
smartscapeId
resourcestable Display name: Service ID Smartscape ID referencing a service entity. Tags: smartscape-id
SERVICE-0011223344556677
dt.smartscape.synthetic_engine
smartscapeId
resourceexperimental Display name: Synthetic engine ID Smartscape ID referencing a Synthetic Engine entity. Tags: smartscape-id
SYNTHETIC_ENGINE-A5DC8F6B0E3417C2
dt.smartscape.synthetic_location
smartscapeId
resourcestable Display name: Synthetic location ID Smartscape ID referencing a Synthetic Location entity. Tags: smartscape-id
SYNTHETIC_LOCATION-D140F3B85BCCBD1A
Dynatrace Synthetic
The dt.synthetic namespace contains Dynatrace synthetic specific fields.
Dynatrace Synthetic fields
Attribute
Type
Description
Examples
dt.synthetic.excluded_from_step
boolean
experimental Display name: Synthetic excluded from step Information whether the event is not included in step/monitor level aggregation (in metrics and counters).
The dt.synthetic_engine namespace contains Dynatrace synthetic engine specific fields.
Dynatrace Synthetic engine fields
Attribute
Type
Description
Examples
dt.synthetic_engine.processing.end_timestamp
timestamp
experimental Display name: Synthetic engine processing end timestamp The end timestamp of the step/monitor execution as reported by executor.
1629891693487
dt.synthetic_engine.processing.start_timestamp
timestamp
experimental Display name: Synthetic engine processing start timestamp The start timestamp of the step/monitor execution as reported by executor.
1529891693487
Dynatrace system
The namespace dt.system is reserved for Grail. These fields cannot be ingested but instead will be set by Grail directly. Every record that is fetched from Grail provides these fields, but by default they are hidden. You can display them by using the fieldsAdd command.
Example query:
// display the bucket for each log record
fetch logs
| fieldsAdd dt.system.bucket
Dynatrace system fields
Attribute
Type
Description
Examples
dt.system.bucket
string
stable Display name: System bucket The Grail bucket that the record is stored in.
default_logs; default_spans; default_bizevents
dt.system.environment
string
stable Display name: System environment The Dynatrace environment that the record belongs to.
wkf10640
dt.system.monitoring_source
string
stable Display name: System monitoring source Identifies the license under which the source is running.
fullstack_host; infrastructure
dt.system.sampling_ratio
long
stable Display name: System sampling ratio The selected sampling ratio.
1
dt.system.segment_id
string
stable Display name: System segment ID The segment that the record belongs to.
5d97c09e-7337-443e-bab5-2f0474804687
dt.system.storage_interval
string
stable Display name: System storage interval Identifies the timeframe represented by individual data structures stored under a metric key.
1 min
dt.system.table
string
stable Display name: System table The table that the record belongs to.
logs; bizevents
dt.system.monitoring_source MUST be one of the following:
Value
Description
Display name
container_application_monitoring
The source is running under the Container Application Monitoring license.
Container App Monitoring
discovery
The source is running under the discovery license.
Discovery
fullstack_container
The source is running under the full-stack container license.
Full-Stack Container
fullstack_host
The source is running under the full-stack host license.
Full-Stack Host
infrastructure
The source is running under the infrastructure license.
Infrastructure
mainframe
The source is running under the mainframe license.
Mainframe
dt.system.storage_interval MUST be one of the following:
Value
Description
Display name
1 min
The timeframe represented by individual measurements of a metrics record in storage.
One Minute
Dynatrace tracing
Fields defined in this namespace are used by Dynatrace to describe different aspects of the context propagation between spans.
Dynatrace tracing fields
Attribute
Type
Description
Examples
dt.tracing.custom_link.id
uid
experimental Display name: Custom link ID The custom link ID to identify spans calling each other. The ID is derived from the custom link bytes.
736bd2684696c4a8
dt.tracing.custom_link.original_bytes
binary
experimental Display name: Custom link original bytes The original binary data of the custom link.
experimental Display name: Custom link type The type of the custom link defines if a mapping of the dt.tracing.custom_link.original_bytes to the dt.tracing.custom_link.transformed_bytes was applied.
generic
dt.tracing.foreign_link.bytes
binary
experimental Display name: Foreign link bytes An incoming foreign link (cross-environment or cross-product).
experimental Display name: Link direction The direction of the span link to define the correct order between spans.
outgoing
dt.tracing.link.id
uid
deprecatedRemoved without replacement. Display name: Link ID Unique identifier for a Dynatrace link.
dt.tracing.link.is_sync
boolean
experimental Display name: Link is synchronous true indicates that the caller waits on the response. Only available on span links with dt.tracing.link.direction set to outgoing.
dt.tracing.response.headers
record
experimental Display name: Response headers A collection of key-value pairs containing received response headers related to tracing from an outgoing call. There may be multiple values for each header. Used for cross-environment linking.
dt.tracing.custom_link.type MUST be one of the following:
Value
Description
Display name
generic
The dt.tracing.custom_link.original_bytes have no special meaning.
Generic
ibm_mq
The dt.tracing.custom_link.original_bytes are an IBM MQ custom link.
IBM MQ
ibm_mq_ignore_qname
The dt.tracing.custom_link.original_bytes are an IBM MQ custom link, but the qname part should be ignored in mapping.
IBM MQ Ignore Queue Name
dt.tracing.link.direction MUST be one of the following:
Value
Description
Display name
incoming
Indicates that the link represents an incoming call (the child in a parent-child relationship).
Incoming
outgoing
Indicates that the link represents an outgoing call (the parent in a parent-child relationship).
Outgoing
Elasticsearch
Elasticsearch fields
Attribute
Type
Description
Examples
elasticsearch.cluster.name
string
resourceexperimental Display name: Elasticsearch cluster name
elasticsearch.node.name
string
resourceexperimental Display name: Elasticsearch node name
Endpoint
Endpoint span fields
Endpoints define the public interface of services.
Attribute
Type
Description
Examples
endpoint.name
string
stable Display name: Endpoint name The endpoint name is derived from endpoint detection rules and uniquely identifies one endpoint of a particular service. Endpoint names are usually technology-specific and should be defined by attributes with low cardinality, like http.route or rpc.method. Endpoints are exclusively detected on request root spans.
GET /; PUT /users/:userID?; GET /productpage; Reviews.GetReviews
The error namespace contains general information on errors.
Error fields
Attribute
Type
Description
Examples
error.code
long
experimental Display name: Error code The code of the error. Set for iOS (NSError and Swift Error) and custom errors for C-based languages.
-1; 3072
error.count
long
experimental Display name: Error count The total number of errors that are observed.
1
error.csp_violation_count
long
experimental Display name: Error CSP violation count The number of CSP rule violations.
1
error.dropped_exception_count
long
experimental Display name: Error dropped exception count The number of exceptions that are observed, but which are not captured due to error capture limits.
1
error.exception_count
long
experimental Display name: Error exception count The total number of exceptions that are observed, including exceptions that are not captured.
1
error.has_crash
boolean
experimental If set to true, a crash occurred during the lifetime of this event.
true
error.has_custom_name
boolean
experimental Display name: Custom error name set If set to true, the error.name was reported via the Dynatrace API.
true
error.http_4xx_count
long
experimental Display name: Error HTTP 4xx count The number of HTTP request errors with an http.response.status_code of 400-499.
1
error.http_5xx_count
long
experimental Display name: Error HTTP 5xx count The number of HTTP request errors with an http.response.status_code of 500-599.
1
error.http_other_count
long
experimental Display name: Error HTTP other count The number of HTTP request errors with an http.response.status_code of 0-99 or 600+ (undefined errors).
1
error.id
uid
experimental Display name: Error ID A unique identifier for error grouping. The error.id is a 16-byte ID and hex-encoded if shown as a string.
357bf70f3c617cb34584b31bd4616af8
error.is_fatal
boolean
experimental Display name: Error is fatal If set to true, the error resulted in a fatal exit (for example, an unhandled exception).
true
error.name
string
experimental Display name: Error name A human-readable version of error.id. Dynatrace can mask this field. To learn more, go to masking personal data in URIs.
500: foo.bar/path/file; path/file:1:5
error.reason
string
experimental Display name: Error reason The error reason. RUM JavaScript reports a pre-defined set of values. OneAgent for iOS reports nserror.domain.
no_network
error.request_other_count
long
experimental Display name: Error request other count The number of errors not related to HTTP status codes—for example, timeout or connectivity errors (Android) or other failed-request errors such as WebSocket failures (iOS).
1
error.source
string
experimental Display name: Error source The error source.
fetch; console
error.type
string
experimental Display name: Error type The main error type. This information is determined by Dynatrace RUM error grouping.
request
error.reason has the following list of well-known values. If one of them applies, then the respective value MUST be used, otherwise a custom value MAY be used.
Value
Description
Display name
abort
The request was aborted by the user.
Abort
csp
The request failed due to a Content Security Policy (CSP) violation.
CSP
no_network
The request failed because of no connectivity.
No network
timeout
The request timed out.
Timeout
error.source has the following list of well-known values. If one of them applies, then the respective value MUST be used, otherwise a custom value MAY be used.
Value
Description
Display name
console
console
Console
cordova_http
cordova_http
document_request
document_request
Document request
exception
exception
Exception
fetch
fetch
Fetch
promise_rejection
promise_rejection
Promise rejection
xhr
xhr
XHR
error.type MUST be one of the following:
Value
Description
Display name
anr
Application Not Responding (ANR)
Application not responding
crash
Crash
Crash
csp
Content Security Policy (CSP) violation
CSP
exception
Exception
Exception
reported
Custom reported error
Reported
request
Failed request
Request
ESB
ESB fields
Attribute
Type
Description
Examples
esb.application.name
string
resourceexperimental Display name: ESB application name The name of the application that holds the workflows of the business logic.
myBusinessApp; YourServiceApp; any_work
esb.library.name
string
resourceexperimental Display name: ESB library name The name of the library that hosts commonly used workflows to be reused in applications.
myWebServicesLib; YourMessagingLibrary; any_tools
esb.vendor
string
resourceexperimental Display name: ESB vendor The name of the vendor of the ESB technology of the current workflow.
ibm; tibco
esb.workflow.name
string
resourceexperimental Display name: ESB workflow name The name of the workflow (the message flow for the IBM ESB).
myMessageFlow; YourBusinessWorkflow; any_flow
Event
The event namespace contains common identification, categorization and context on events in Dynatrace.
Event fields
Attribute
Type
Description
Examples
event.category
string
stable Display name: Event category Standard categorization based on the significance of an event (similar to the severity level in the previous Dynatrace).
Availability
event.description
string
stable Display name: Event description Human-readable description of an event.
The current response time (11 s) exceeds the auto-detected baseline (767 ms) by 1,336 %
event.end
string
stable Display name: Event end The event end timestamp in UTC (given in Grail preferred Linux timestamp nano precision format).
16481073970000
event.group_label
string
experimental Display name: Event group label Group label of an event.
Availability
event.id
string
stable Display name: Event ID Unique identifier string of an event; is stable across multiple refreshes and updates.
5547782627070661074_1647601320000
event.kind
string
stable Display name: Event kind Gives high-level information about what kind of information the event contains without being specific about the contents of the event. It helps to determine the record type of a raw event. Tags: permission
stable Display name: Event outcome Denotes whether the event represents a success or a failure from the perspective of the entity that produced the event (for example an HTTP response code).
200; success; failure
event.parent_id
string
experimental Display name: Parent event ID Unique identifier string of a parent event to link parent and child events.
5547782627070661074_1647601319999
event.provider
string
stable Display name: Event provider Source of the event, for example, the name of the component or system that generated the event. Tags: permission
stable Display name: Event reason Describes why a certain event.outcome was set. Typically, this is some form of error description in the case of a failure.
user is missing permission "logs.read"
event.severity
long
experimental Display name: Event severity Incident severity on a scale of 1 to 5 (1 = most severe, 5 = least severe), aligned with ITIL severity levels.
1; 2; 3; 4; 5
event.start
string
stable Display name: Event start The event start timestamp in UTC (given in Grail preferred Linux timestamp nano precision format).
16481073970000
event.status
string
stable Display name: Event status Status of an event as being either Active or Closed.
Active
event.status_transition
string
experimental Display name: Status transition An enum that shows the transition of the above event state.
Recovered
event.type
string
stable Display name: Event type The unique type identifier of a given event. Tags: permission
ESXI_HOST_MEMORY_SATURATION; PROCESS_RESTART; CPU_SATURATION; MEMORY_SATURATION; Automation Workflow; AppEngine Functions - Small
event.version
string
stable Display name: Event version Describes the version of the event.
1.0.0
Values
Values are either in title-case or screaming snake case.
event.category SHOULD be one of the following:
Value
Description
Availability
availability
Error
error
Slowdown
slowdown
Resource contention
resource_contention
Warning
warning
Info
info
Vulnerability management
vulnerability_management
event.status SHOULD be one of the following:
Value
Description
Active
active
Closed
closed
event.status_transition SHOULD be one of the following:
Value
Description
Created
created
Updated
updated
Refreshed
refreshed
Resolved
resolved
Recovered
recovered
Closed
closed
Timed out
timed out
Reopened
reopened
Exception
Exception fields
Attribute
Type
Description
Examples
exception.caused_by_id
uid
stable Display name: Exception caused by ID The exception.id of the exception the current exception was caused by.
exception.column_number
long
stable Display name: Exception column number The column number where the exception happened.
12304
exception.escaped
boolean
stable Display name: Exception escaped true indicates that the exception was recorded at a point where it is known that the exception escaped the scope of the span.
exception.file.domain
string
stable Display name: Exception file domain The URI domain component. This is extracted from exception.file.full.
www.foo.bar
exception.file.full
string
stable Display name: Exception file The full file location when the exception happened. This is either an absolute URL or a filename.
https://www.foo.bar/path/main.js; main.js
exception.file.path
string
stable Display name: Exception file path The URI path component. This is extracted from exception.file.full.
/path/main.js
exception.id
uid
stable Display name: Exception ID The identifier of an exception. It should be unique within a list of exceptions of a span. The identifier is used to reference the exception.
exception.is_caused_by_root
boolean
stable Display name: Exception is caused by root Is set to true if the exception is the first exception caused by the chain.
exception.line_number
long
stable Display name: Exception line number The line number where the exception happened.
1401
exception.message
string
stable Display name: Exception message A message that describes the exception.
Division by zero
exception.stack_trace
string
stable Display name: Exception stack trace The stack trace of the exception. The format depends on the technology and source. While OneAgent formats stack traces to unify them across technologies, stack traces from an OpenTelemetry source are in the format they were sent to Dynatrace.
stable Display name: Exception type The type of the exception, for example, its fully-qualified class name.
java.net.ConnectException; OSError
Function as a Service (FaaS)
Fields that can be expected from serverless functions or Function as a Service (FaaS) on various cloud platforms.
FaaS resource fields
Attribute
Type
Description
Examples
faas.instance
string
resourceexperimental The execution environment ID as a string that will be potentially reused for other invocations to the same function/function version.
resourceexperimental Display name: FaaS version The immutable version of the function being executed. 2
14; 254
1
This is the name of the function as configured/deployed on the FaaS platform and is usually different from the name of the callback
function (which may be stored in the code.namespace/code.function span attributes).
2
Value of the field depends on a cloud provider. This field is not set for Azure.
FaaS fields
Attribute
Type
Description
Examples
faas.coldstart
boolean
experimental Display name: FaaS cold start A boolean that is true if the serverless function is executed for the first time (aka cold-start).
faas.document.collection
string
experimental Display name: FaaS document collection The table/collection name on which the operation faas.document.operation was executed. 1
my-coll-name
faas.document.count
long
experimental The number of documents affected by the operation that triggered the function invocation. 2
1; 37
faas.document.name
string
experimental Display name: FaaS document name The identifier for the specific item that changed after executing the operation above. 3
my-file.jpg; 63eeb6e7d418cd98afb1c1d7
faas.document.namespace
string
experimental The namespace of the collection/document (for example, database name,…) within which the operation was performed. 4
my-database; products
faas.document.operation
string
experimental Display name: FaaS document operation Relevant only for "datasource" trigger. The operation type which triggered the function invocation.
delete
faas.document.time
string
experimental Display name: FaaS document time The UTC ISO-8601 timestamp of the operation above. 5
2020-03-08T00:30:12.456Z
faas.event.__key__
string
stable Display name: FaaS event attribute FaaS event attribute, the __key__ attribute in a FaaS event represents the precise attribute name as received in the event. For example, it might be "faas.event.StackId" for the "StackId" attribute in an AWS CloudFormation event or "faas.event.IdentityPoolId" for the "IdentityPoolId" attribute in an AWS Cognito event. The value of this attribute is identical to the value received in the event.
experimental Display name: FaaS event name The API action that triggered the FaaS event. 6
ObjectCreated:Put (aws:s3); INSERT (aws:dynamodb)
faas.event_source
string
experimental Display name: FaaS event source The cloud service that originated the event.
aws:cloudwatch; aws:cloudformation
faas.invocation_id
string
experimental The invocation ID of the current function invocation
d759b86b-acab-498e-9220-08ba69bffbdb
faas.invoked_name
string
experimental Display name: FaaS invoked name The name of the invoked function.
my-function
faas.invoked_provider
string
experimental Display name: FaaS invoked provider The cloud provider of the invoked function. Will be equal to the invoked function's cloud.provider resource attribute.
alibaba_cloud
faas.invoked_region
string
experimental Display name: FaaS invoked region The cloud region of the invoked function. 7
eu-central-1
faas.timer.cron
string
experimental The schedule expression that configures the timer trigger for the function invocation (for faas.trigger=timer).
0 */5 * * * *
faas.timer.time
timestamp
experimental Display name: FaaS timer time The timestamp when the timer expired and triggered the function execution (for faas.trigger=timer).
1649822520123123123
faas.trigger
string
experimental Display name: FaaS trigger Type of the trigger which caused this function invocation.
datasource
1
Relevant only for faas.trigger=datasource trigger
2
Relevant only for faas.trigger=datasource trigger.
3
Relevant only for faas.trigger=datasource trigger
4
Relevant only for faas.trigger=datasource trigger.
5
Relevant only for faas.trigger=datasource trigger
6
The value of this attribute is specific to the service that generated the event.
7
Will be equal to the invoked function's cloud.region resource attribute.
faas.document.operation has the following list of well-known values. If one of them applies, then the respective value MUST be used, otherwise a custom value MAY be used.
Value
Description
Display name
delete
delete
Delete
edit
edit
Edit
insert
insert
Insert
faas.invoked_provider has the following list of well-known values. If one of them applies, then the respective value MUST be used, otherwise a custom value MAY be used.
Value
Description
Display name
alibaba_cloud
Alibaba Cloud
Alibaba Cloud
aws
Amazon Web Services
AWS
azure
Microsoft Azure
Azure
gcp
Google Cloud Platform
GCP
tencent_cloud
Tencent Cloud
Tencent Cloud
faas.trigger has the following list of well-known values. If one of them applies, then the respective value MUST be used, otherwise a custom value MAY be used.
Value
Description
Display name
datasource
A response to some data source operation such as a database or filesystem read/write.
Datasource
http
To provide an answer to an inbound HTTP request
HTTP
other
If none of the others apply
Other
pubsub
A function is set to be executed when messages are sent to a messaging system.
Pub/Sub
timer
A function is scheduled to be executed regularly.
Timer
Failure detection
Failure detection fields
Fields that can be expected for a failure detection on a Dynatrace span. For more details and how failure detection is embedded in a span, see Dynatrace Span model.
Attribute
Type
Description
Examples
dt.failure_detection.general_parameters_id
uid
experimental Display name: Failure detection general parameters ID The id of the failure detection general parameters (failure detection v1) that were applied to that span (uid128).
4d76194c11a9426197a9062548f9e66f
dt.failure_detection.global_parameters_id
uid
experimental Display name: Failure detection global parameters ID The id of the global failure detection parameters (failure detection v1) that were applied to that span (uid128). This is always used in conjunction with the dt.failure_detection.global_rule_id.
4d76194c11a9426197a9062548f9e66c
dt.failure_detection.global_rule_id
uid
experimental Display name: Failure detection global rule ID The id of the global failure detection rule (failure detection v1) that was applied to that span (uid128). This is always used in conjunction with the dt.failure_detection.global_parameters_id.
4d76194c11a9426197a9062548f9e66b
dt.failure_detection.http_parameters_id
uid
experimental Display name: Failure detection HTTP parameters ID The id of the failure detection HTTP parameters (failure detection v1) that were applied to that span (uid128).
4d76194c11a9426197a9062548f9e66a
dt.failure_detection.results
record[]
experimental Display name: Failure detection results A collection of individual failure detection reasons and verdicts for each applied matching rule. If no entries exist, no rules matched, and the attribute does not exist.
dt.failure_detection.ruleset_id
uid
experimental Display name: Failure detection ruleset ID The id of the failure detection rule set (failure detection v2) that was applied to that span (uid128).
4d76194c11a9426197a9062548f9e66e
dt.failure_detection.verdict
string
experimental Display name: Failure detection verdict The final failure detection verdict based on the results in dt.failure_detection.results.
failure
dt.failure_detection.verdict MUST be one of the following:
Value
Description
Display name
failure
There is at least one result with verdict failure and no result with verdict success.
Failure
success
There is at least one result with verdict success or no result at all.
Success
Feature flag
Feature flag evaluation event fields
Attribute
Type
Description
Examples
feature_flag.context.id
string
experimental Display name: Feature flag context ID The unique identifier for the flag evaluation context. For example, the targeting key.
5157782b-2203-4c80-a857-dbbd5e7761db
feature_flag.key
string
experimental Display name: Feature flag key The unique identifier of the feature flag.
logo-color
feature_flag.provider.name
string
experimental Display name: Feature flag provider name The name of the service provider that performs the flag evaluation.
Flag Manager
feature_flag.result.reason
string
experimental Display name: Feature flag result reason The reason code, which shows how a feature flag value was determined.
static; targeting_match; error; default
feature_flag.result.variant
string
experimental Display name: Feature flag result variant A semantic identifier for an evaluated flag value. 1
red; true; on
feature_flag.set.id
string
experimental Display name: Feature flag set ID The identifier of the flag set to that the feature flag belongs.
proj-1; ab98sgs; service1/dev
feature_flag.version
string
experimental Display name: Feature flag version The version of the ruleset used during the evaluation. This can be any stable value that uniquely identifies the ruleset.
1; 01ABCDEF
1
A semantic identifier, commonly referred to as a variant, provides a means
for referring to a value without including the value itself. This can
provide additional context for understanding the meaning behind a value.
For example, the variant red maybe be used for the value #c05543.
feature_flag.result.reason MUST be one of the following:
Value
Description
Display name
cached
The resolved value was retrieved from cache.
Cached
default
The resolved value fell back to a pre-configured value (no dynamic evaluation occurred or dynamic evaluation yielded no result).
Default
disabled
The resolved value was the result of the flag being disabled in the management system.
Disabled
error
The resolved value was the result of an error.
Error
split
The resolved value was the result of pseudorandom assignment.
Split
stale
The resolved value is non-authoritative or possibly out of date.
Stale
static
The resolved value is static (no dynamic evaluation).
Static
targeting_match
The resolved value was the result of a dynamic evaluation, such as a rule or specific user-targeting.
Targeting Match
unknown
The reason for the resolved value could not be determined.
Unknown
Frontend
Frontend fields
Attribute
Type
Description
Examples
frontend.link
record
experimental Display name: Frontend link A frontend-backend tracing link that connects a span to a frontend user event and/or user session. Unlike span links, which reference other spans, this links tracing data to frontend monitoring (such as RUM or Synthetic).
frontend.name
string
stable Display name: Frontend name The frontend name determined at ingest. Tags: permission
resourceexperimental Display name: GCP App Engine service
gcp.cloud_run.service
string
resourceexperimental Display name: GCP Cloud Run service
gcp.instance.id
string
resourceexperimental Display name: GCP instance ID The unique, numeric identifier of the Google Cloud resource instance (e.g., GCE VM or Cloud SQL), which remains immutable throughout the resource's lifecycle.
6639848141313102286
gcp.instance.name
string
resourcedeprecated Display name: GCP instance name The name to display for the instance in the Cloud Console.
single-vm-test
gcp.labels.__label__
string
resourceexperimental Display name: GCP label Contains the value for the user labels with the label key named __label__ defined in the label enrichment configuration.
dt_owner_mail
gcp.location
string
resourcestable Display name: GCP location Region or zone where GCP resource instance is running.
europe-west3-c
gcp.organization.id
string
resourceexperimental Display name: GCP organization ID Unique, immutable identifier assigned to an organization resource.
123456789012
gcp.organization.name
string
resourceexperimental Display name: GCP organization name Name assigned to the GCP organization.
dynatrace.com
gcp.project.id
string
resourcestable Display name: GCP project ID Identifier of the GCP project associated with this resource. Tags: permissionprimary-field
dynatrace-gcp-extension
gcp.region
string
resourcestable Display name: GCP region A region is a specific geographical location where you can host your resources. Tags: primary-field
europe-west3
gcp.resource.name
string
resourcestable Display name: GCP resource name The globally unique resource name in Google Cloud Platform convention.
experimental Display name: Guardrail output contextual Contextual check types that triggered the guardrail on the response, along with the score achieved by each triggered grounding check.
experimental Display name: Guardrail output sensitive patterns Name of the patterns for sensitive information in response that triggered the Guardrail.
experimental Display name: Guardrail output PIIs Personal Identifiable Information categories in response that triggered the Guardrail.
['ADDRESS', 'LICENSE_PLATE', 'DRIVER_ID']
gen_ai.guardrail.output.topic.names
string[]
experimental Display name: Guardrail output topics Topics in response that triggered the Guardrail.
['investment_advice', 'legal_advice', 'politics']
gen_ai.guardrail.output.words.lists
string[]
experimental Display name: Guardrail output words lists Word lists that triggered the guardrail for response.
['custom-word-list']
gen_ai.guardrail.output.words.matches
string[]
experimental Display name: Guardrail output words matches Words in response that triggered the Guardrail.
[]
gen_ai.guardrail.version
string
experimental Display name: Guardrail version Version of the guardrail that has been activated.
DRAFT; 5; 12345678
gen_ai.input.messages
record[]
experimental Display name: Input messages List of all user prompts passed to the LLM. This includes "tool" prompts and may include "system" prompts if the instrumented library includes them in the message list.
{'role': 'user', 'content': [{'text': 'What is the capital of France?'}]}
gen_ai.messages.dropped.input
long
experimental Display name: Dropped input messages Number of input messages dropped due to capture limits.
1; 5
gen_ai.messages.dropped.output
long
experimental Display name: Dropped output messages Number of output messages dropped due to capture limits.
1; 5
gen_ai.messages.dropped.system
long
experimental Display name: Dropped system messages Number of system messages dropped due to capture limits.
1; 5
gen_ai.operation.kind
string
experimental Display name: Operation kind AI framework operation being performed.
workflow; task; agent; agent; tool; retrieval
gen_ai.operation.name
string
experimental Display name: Operation name Name of operation being performed.
chat; generate_content; text_completion
gen_ai.output.messages
record[]
experimental Display name: Output messages List of all LLM responses.
{'role': 'assistant', 'content': [{'text': 'The capital of France is Paris.'}]}
gen_ai.prompt_caching
string
experimental Display name: Prompt caching Indicates how prompt cache has been used when handling the request.
read; write
gen_ai.provider.name
string
experimental Display name: Provider name Name of GenAI product being used.
aws_bedrock; openai
gen_ai.request.encoding_formats
string[]
experimental Display name: Request encoding formats The encoding formats requested in an embeddings operation, if specified.
['base64']; ['float', 'binary']
gen_ai.request.frequency_penalty
double
experimental Display name: Request frequency penalty Frequency penalty setting for GenAI request.
0.4
gen_ai.request.max_tokens
long
experimental Display name: Request max tokens Maximum number of tokens that the model can generate for a request.
50
gen_ai.request.model
string
experimental Display name: Request model Model chosen to handle the request.
experimental Display name: Response system fingerprint Identifier of system used to generate LLM response.
fp_03e44fcc34
gen_ai.system_instructions
record[]
experimental Display name: System instructions List of all system prompts passed to the LLM, which are not part of input messages list.
{'type': 'text', 'content': 'You are a helpful assistant.'}
gen_ai.usage.input_tokens
long
experimental Display name: Input tokens Number of tokens sent to the model in the request.
42
gen_ai.usage.output_tokens
long
experimental Display name: Output tokens Number of tokens generated by the model while handling the request.
42
gen_ai.usage.prompt_caching.read_tokens
long
experimental Display name: Prompt caching read tokens Number of tokens that has been read from cache.
42
gen_ai.usage.prompt_caching.write_tokens
long
experimental Display name: Prompt caching write tokens Number of tokens used to generate cache checkpoint.
42
gen_ai.operation.kind has the following list of well-known values. If one of them applies, then the respective value MUST be used, otherwise a custom value MAY be used.
Value
Description
Display name
agent
Operation invoking an autonomous component that can make decisions or perform actions.
Agent
retrieval
Operation collecting documents for a RAG pipeline.
Retrieval
task
A specific operation or step within a workflow.
Task
tool
Operation invoking a utility or function used within the application.
Tool call
workflow
A high-level process or chain of operations.
Workflow
gen_ai.operation.name has the following list of well-known values. If one of them applies, then the respective value MUST be used, otherwise a custom value MAY be used.
Value
Description
Display name
chat
Operation of engaging in a conversational exchange with LLM.
Chat
embeddings
Operation of creating embeddings from user input.
Embeddings
text_completion
Operation of completing text based on user input by LLM.
Text Completion
gen_ai.prompt_caching has the following list of well-known values. If one of them applies, then the respective value MUST be used, otherwise a custom value MAY be used.
Value
Description
Display name
read
Cache hit. Reading from cache.
Read
write
Cache miss. Creating cache checkpoint.
Write
gen_ai.provider.name has the following list of well-known values. If one of them applies, then the respective value MUST be used, otherwise a custom value MAY be used.
Value
Description
Display name
aws_bedrock
Amazon Bedrock
Amazon Bedrock
openai
OpenAI
OpenAI
Geolocation
The geo namespace contains geo location information. This section only holds all currently agreed upon fields in the Dynatrace Semantic Dictionary. Aligned closely to the ECS, with some adaptions around field groupings
Geolocation fields
Attribute
Type
Description
Examples
geo.city.name
string
resourcestable Display name: City English name of the city.
Montreal
geo.continent.code
string
resourcestable Two-letter code representing the name of the continent.
NA
geo.continent.name
string
resourcestable Display name: Continent English name of the continent.
North America
geo.country.iso_code
string
resourcestable Display name: Country ISO code The two-letter country code. The format complies with ISO 3166-1 alpha-2.
CA; GB
geo.country.name
string
resourcestable Display name: Country English name of the country.
Canada
geo.location.accuracy_radius
long
resourcestable The accuracy radius in kilometers.
20
geo.location.latitude
double
resourcestable Display name: Latitude The approximate latitude. The format complies with WGS 84. Tags: sensitive-user-events
45.505918
geo.location.longitude
double
resourcestable Display name: Longitude The approximate longitude. The format complies with WGS 84. Tags: sensitive-user-events
-73.61483
geo.region.iso_code
string
resourcestable ISO 3166-2 region code. In case a country has multiple subdivision categories, the field contains the subdivision category preferred by Dynatrace.
CA-QC; GB-CAM
geo.region.name
string
resourcestable Display name: Region English name of the region.
Quebec
GlassFish
GlassFish fields
Attribute
Type
Description
Examples
glassfish.domain.name
string
resourceexperimental Display name: Glassfish domain name The name of the domain this instance belongs to.
glassfish.instance.name
string
resourceexperimental Display name: Glassfish instance name The instance's name.
Go
Go fields
Attribute
Type
Description
Examples
go.linkage
string
resourceexperimental Display name: Go linkage
Host
Host naming
Dynatrace aims to use the best fitting name for the field host.name. See below, how Dynatrace determines the host name in an ordered by precedence fashion:
1. Customized host name
Dynatrace supports customizing the host.name property. A custom set host name takes precedence over the auto detection mechanisms described further down.
Place a configuration file containing the desired name in a specific directory as described in this Documentation
Alternatively, the oneagentctl tool can be used to set a custom host name. See Documentation for details.
2. Kubernetes node name
If no customized name is set locally, the OneAgent attempts to determine if we're deployed by Dynatrace Operator in Kubernetes or OpenShift and sets host.name to the name of the Node.
3. Cloud vendor metadata
If the Kubernetes isn't present, the OneAgent attempts to determine the host.name value by accessing cloud metadata where applicable.
AWS EC2:
If access to EC2 tags was granted (see AWS Documentation) and a tag with a key name (case insensitive) is found, the tag's value is used as the host.name.
The result of the system call to the standard C library's gethostname() if it can be interpreted as a fully qualified domain name (FQDN) and doesn't contain "localhost".
Otherwise, a system call to getaddrinfo() for port 80 is issued, again sanity checking whether the returned name is an FQDN and doesn't contain "localhost".
If a correct hostname still hasn't been identified, but the system call to gethostname() was successful, and the returned string is not empty and doesn't contain "localhost", then it's used.
Defaults to the string EmptyHostName if neither property can be resolved.
4b. Windows
On Windows, the system call GetComputerNameExA is used to determine a host's name. In particular, the resulting name is composed of <hostname>.<domainname> with the following details
hostname = ComputerNameDnsHostname retrieved by GetComputerNameEx
domainname = ComputerNameDnsDomain retrieved by GetComputerNameEx
The result of the system call GetComputerNameExA is used when it can be interpreted as a fully qualified domain name (FQDN).
Otherwise, the result of the system call GetComputerNameExA is used when it's not empty.
Defaults to the string EmptyHostName if neither property can be resolved.
Host fields
Attribute
Type
Description
Examples
host.fqdn
string[]
resourceexperimental Display name: Host FQDN A list of FQDNs of this host.
resourceexperimental Indicates whether the host has public traffic detected via eBPF Discovery. 1
true
host.ip
ipAddress[]
resourceexperimental Display name: Host IP A list of IP adresses (IPv4 or IPv6) of this host.
[194.232.104.141, 2a01:468:1000:9::140]
host.logical.cpus
long
resourceexperimental Display name: Logical cpus Logical CPUs on the monitored host. Applies to AIX LPARs.
8
host.mac
array
resourceexperimental Display name: Host MAC address A list of MAC adresses associated with this host.
4C:03:4F:5B:E8:89; 00:15:5D:2F:1C:2A
host.name
string
resourceexperimental Display name: Host name The host name as determined on the data source (for instance, OneAgent, extensions or OpenTelemetry). Important: This is not the name of the host entity, which can be modified based on naming rules. Tags: permission
ip-10-178-54-32.ec2.internal
host.physical.memory
long
resourceexperimental Display name: Physical memory Physical memory of the monitored host, expressed in bytes. The value might be different than the total available memory, if features such as Active Memory Expansion are used.
8141684736
host.simultaneous.multithreading
long
resourceexperimental Display name: Simultaneous multithreading Number of threads for AIX Simultaneous Multithreading feature.
4
host.type
string
resourceexperimental Display name: Host type Virtual Machine type, such as SKU on Azure
Standard_D2s_v3; m5.large; n1-standard-4
host.virtual.cpus
long
resourceexperimental Display name: Virtual cpus Number of virtual CPUs for AIX LPAR.
2
1
This field is supported only on Linux hosts with eBPF Discovery enabled and OneAgent installed in Full-stack or Infrastructure mode.
HTTP
HTTP span fields
Attribute
Type
Description
Examples
http.request.body.size
long
stable Display name: Request body size The size of the request payload body in bytes. This is the number of bytes transferred excluding headers and is often, but not always, present as the Content-Length header. For requests using transport encoding, this should be the compressed size.
3495
http.request.header.__key__
string
stable Display name: HTTP request header HTTP request headers, __key__ being the lowercase HTTP header name, for example, "http.request.header.accept-encoding". The value is a string. If multiple headers have the same name or multiple header values, the values will be comma-separated into a single string. Tags: sensitive-spans
stable Display name: HTTP request parameter HTTP request parameters, __key__ for example, "http.request.parameter.username". The value is a string. If there are multiple parameters with the same name or multiple parameter values, the values will be a single, comma-separated string.
admin; premium
http.request.size
long
experimental Display name: Request size The total size of the request in bytes. This value should be the total number of bytes sent over the wire, including the request line (HTTP/1.1), framing (HTTP/2 and HTTP/3), headers, and request body if any.
114; 702
http.response.body.size
long
stable Display name: Response body size The size of the response payload body in bytes. This is the number of bytes transferred excluding headers and is often, but not always, present as the Content-Length header. For requests using transport encoding, this should be the compressed size.
3495
http.response.header.__key__
string
stable Display name: HTTP response header HTTP response headers, __key__ being the lowercase HTTP header name, for example, "http.response.header.content-type". The value is a string. If multiple headers have the same name or multiple header values, the values will be comma-separated into a single string.
909; text/html; charset=utf-8; abc, def
http.response.range_end_value
long
experimental Display name: Response range end When the response contains the HTTP Content-Range header, this field contains the range end value.
499; 1999
http.response.range_start_value
long
experimental Display name: Response range start When the response contains the HTTP Content-Range header, this field contains the range start value.
experimental Display name: Response size The total size of the response in bytes. This value should be the total number of bytes sent over the wire, including the status line (HTTP/1.1), framing (HTTP/2 and HTTP/3), headers, and response body and trailers if any.
experimental Display name: Time to first byte Time between the browser requesting a page and when it receives the first byte of information from the server.
0.022; 0.071
http.route
string
stable Display name: HTTP route The matched route (path template in the format used by the respective server framework).
/users/:userID?; Home/Index/{id?}
HTTP resource fields
Attribute
Type
Description
Examples
http.server_name
string
resourceexperimental Display name: HTTP server name The server name as configured by the webserver if available. If no such name exists, this is the local hostname and bound port. In Kubernetes, the base pod name is used.
MyServer; localhost:8000
Hybris
Hybris fields
Attribute
Type
Description
Examples
hybris.bin.dir
string
resourceexperimental Display name: Hybris bin directory
resourceexperimental Display name: Hybris data directory
/opt/hybris-60/hybris/data
IBM
IBM fields
Attribute
Type
Description
Examples
ibm.ace.integration_node.name
string
resourceexperimental Display name: IBM App Connect Enterprise integration node name The name of the integration node (broker) that manages one or more integration servers.
resourceexperimental Display name: IBM App Connect Enterprise integration server name The name of the broker-managed or standalone integration server (formerly known as execution group or dataflow engine).
resourceexperimental Display name: IBM CICS application-owning region
ibm.cics.program
string
resourceexperimental Display name: IBM CICS program The name of the CICS program.
EDUCHAN
ibm.cics.region
string
resourceexperimental Display name: IBM CICS region
ibm.cics.tor
string
resourceexperimental Display name: IBM CICS terminal-owning region
ibm.ctg.name
string
resourceexperimental Display name: IBM CICS Transaction Gateway
ibm.ims.connect
string
resourceexperimental Display name: IBM IMS Connect
ibm.ims.control
string
resourceexperimental Display name: IBM IMS control
ibm.ims.mpr
string
resourceexperimental Display name: IBM IMS message processing region
ibm.ims.soap_gw.name
string
resourceexperimental Display name: IBM IMS SOAP gateway
IIS
IIS fields
Attribute
Type
Description
Examples
iis.app_pool.name
string
resourceexperimental Display name: IIS application pool name
iis.role.name
string
resourceexperimental Display name: IIS role name
Java
Java fields
Attribute
Type
Description
Examples
java.jar.file
string
resourceexperimental Display name: Java jar file
java.jar.path
string
resourceexperimental Display name: Java jar path
java.main.class
string
resourceexperimental Display name: Java main class
java.main.module
string
resourceexperimental Display name: Java main module
JBoss
JBoss fields
Attribute
Type
Description
Examples
jboss.home
string
resourceexperimental Display name: JBoss home directory The instance's home directory.
jboss.mode
string
resourceexperimental Display name: JBoss operating mode The instance's operating mode.
org.jboss.as.standalone; org.jboss.as.server
jboss.server.name
string
resourceexperimental Display name: JBoss server name The instance's server name.
JDBC
JDBC fields
Attribute
Type
Description
Examples
jdbc.connection.pool.name
string
stable Display name: JDBC connection pool name The name of the JDBC connection pool.
jdbc/db2
Journald
Journald fields
Attribute
Type
Description
Examples
journald.unit
string
experimental Display name: Journald unit A unit is a systemd object that performs or controls a particular task or action; concerns unix-based systems
cron.service; oneagent.service; kubepods.slice
Kubernetes
Kubernetes fields
Attribute
Type
Description
Examples
k8s.cluster.name
string
resourcestable Display name: Kubernetes cluster name The user-defined name of the cluster in Dynatrace. Doesn't need to be unique or immutable. Tags: permissionprimary-field
unguard-dev; acme-prod10
k8s.cluster.uid
string
resourcestable Display name: Kubernetes cluster UID A pseudo-ID for the cluster, by default set to the UID of the kube-system namespace.
1c7a24c7-ff51-46e0-bcc9-c52637ceec57
k8s.configmap.name
string
resourceexperimental Display name: Kubernetes ConfigMap name Name of the ConfigMap.
my-configmap
k8s.container.name
string
resourcestable Display name: Kubernetes container name The name of the container from the pod specification; must be unique within a pod. Container runtime usually uses different globally unique name (container.name).
redis
k8s.container.type
string
resourceexperimental Display name: Kubernetes container type The type of the Kubernetes container.
app; init; sidecar; ephemeral
k8s.cronjob.name
string
resourceexperimental Display name: Kubernetes CronJob name Name of the CronJob.
my-cronjob
k8s.customresourcedefinition.name
string
resourceexperimental Display name: Kubernetes CustomResourceDefinition name Name of the CustomResourceDefinition.
dynakubes.dynatrace.com
k8s.daemonset.name
string
resourceexperimental Display name: Kubernetes DaemonSet name Name of the DaemonSet.
my-daemonset
k8s.deployment.name
string
resourceexperimental Display name: Kubernetes Deployment name Name of the Deployment.
my-deployment
k8s.deploymentconfig.name
string
resourceexperimental Display name: Kubernetes DeploymentConfig name Name of the DeploymentConfig.
my-deploymentconfig
k8s.dynakube.name
string
resourceexperimental Display name: Kubernetes DynaKube name Name of the DynaKube.
my-dynakube
k8s.edgeconnect.name
string
resourceexperimental Display name: Kubernetes EdgeConnect name Name of the EdgeConnect.
my-edgeconnect
k8s.horizontalpodautoscaler.name
string
resourceexperimental Display name: Kubernetes HorizontalPodAutoscaler name Name of the HorizontalPodAutoscaler.
my-horizontalpodautoscaler
k8s.ingress.name
string
resourceexperimental Display name: Kubernetes Ingress name Name of the Ingress.
my-ingress
k8s.job.name
string
resourceexperimental Display name: Kubernetes Job name Name of the Job.
my-job
k8s.namespace.name
string
resourcestable Display name: Kubernetes namespace name The name of the namespace that the pod is running in. Tags: permissionprimary-field
default; kube-system
k8s.namespace.uid
string
resourceexperimental Display name: Kubernetes namespace UID The UID of the namespace.
bfb1ba44-3bcb-467d-a2dc-188fd74d1db5
k8s.networkpolicy.name
string
resourceexperimental Display name: Kubernetes NetworkPolicy name Name of the NetworkPolicy.
my-networkpolicy
k8s.node.name
string
resourcestable Display name: Kubernetes node name Name of the node.
cluster-pool-1-c3c7423d-azth
k8s.persistentvolume.name
string
resourceexperimental Display name: Kubernetes PersistentVolume name Name of the PersistentVolume.
my-persistentvolume
k8s.persistentvolumeclaim.name
string
resourceexperimental Display name: Kubernetes PersistentVolumeClaim name Name of the PersistentVolumeClaim.
my-persistentvolumeclaim
k8s.pod.deletion_timestamp
timestamp
resourceexperimental The RFC 3339 date and time at which the Pod will be deleted.
2026-04-01T10:15:30Z
k8s.pod.name
string
resourcestable Display name: Kubernetes pod name The name of the pod.
checkoutservice-7895755b94-mzs5m
k8s.pod.phase
string
resourceexperimental The pod phase is a simple status showing where a Pod is in its lifecycle.
Failed; Pending; Running; Succeeded; Unknown
k8s.pod.uid
string
resourcestable Display name: Kubernetes pod UID The UID of the pod.
275ecb36-5aa8-4c2a-9c47-d8bb681b9aff
k8s.replicaset.name
string
resourceexperimental Display name: Kubernetes ReplicaSet name Name of the ReplicaSet.
my-replicaset
k8s.replicationcontroller.name
string
resourceexperimental Display name: Kubernetes ReplicationController name Name of the ReplicationController.
my-replicationcontroller
k8s.secret.name
string
resourceexperimental Display name: Kubernetes Secret name Name of the Secret.
my-secret
k8s.service.name
string
resourcestable Display name: Kubernetes service name The name of the Kubernetes service.
my-service
k8s.statefulset.name
string
resourceexperimental Display name: Kubernetes StatefulSet name Name of the StatefulSet.
my-statefulset
k8s.workload.kind
string
resourcestable Display name: Kubernetes workload kind The type of the workload. The value is the Kubernetes object kind of the workload in lowercase.
resourcestable Display name: Kubernetes workload name The name of the workload.
checkoutservice
k8s.workload.uid
string
resourceexperimental Display name: Kubernetes workload UID The UID of the workload.
786a41e4-e673-44bb-bb30-18888f797a2b
k8s.pod.phase MUST be one of the following:
Value
Description
Failed
At least one container terminated with an error (non-zero exit code).
Pending
Pod is created but not yet running.
Running
Pod is scheduled on a node and at least one container is running.
Succeeded
All containers finished successfully (exit code 0) and won’t restart.
Unknown
Pod state cannot be determined (usually communication issue with node).
Kubernetes custom labels and annotations fields
Attribute
Type
Description
Examples
k8s.namespace.annotation.__attribute_name__
string
resourceexperimental Display name: Kubernetes namespace annotation Kubernetes namespace annotation that should be enriched on ingest signals and service metrics. The attribute_name is a placeholder that can freely be chosen.
k8s.namespace.annotation.team=a_team
k8s.namespace.label.__attribute_name__
string
resourceexperimental Display name: Kubernetes namespace label Kubernetes namespace label that should be enriched on ingest signals and service metrics. The attribute_name is a placeholder that can freely be chosen.
k8s.namespace.label.env=dev
k8s.pod.annotation.__attribute_name__
string
resourceexperimental Display name: Kubernetes pod annotation Kubernetes pod annotation that should be enriched on ingest signals and service metrics. The attribute_name is a placeholder that can freely be chosen.
k8s.pod.annotation.team=a_team
k8s.pod.label.__attribute_name__
string
resourceexperimental Display name: Kubernetes pod label Kubernetes pod label that should be enriched on ingest signals and service metrics. The attribute_name is a placeholder that can freely be chosen.
k8s.pod.label.env=dev
k8s.workload.annotation.__attribute_name__
string
resourceexperimental Display name: Kubernetes workload annotation Kubernetes workload annotation that should be enriched on ingest signals and service metrics. The attribute_name is a placeholder that can freely be chosen.
k8s.workload.annotation.team=a_team
k8s.workload.label.__attribute_name__
string
resourceexperimental Display name: Kubernetes workload label Kubernetes workload label that should be enriched on ingest signals and service metrics. The attribute_name is a placeholder that can freely be chosen.
k8s.workload.label.env=dev
Apache Kafka
Apache Kafka fields
Attribute
Type
Description
Examples
messaging.kafka.broker_id
string
experimental Display name: Kafka broker ID The ID of the Kafka broker.
0; 1; 2
messaging.kafka.component
string
experimental Display name: Kafka component The component of the Kafka Connect worker.
GroupCoordinator 1
messaging.kafka.connect.connector_name
string
experimental Display name: Kafka Connect connector name The name of the Kafka Connect connector.
my-s3-connector; jdbc-source-connector
messaging.kafka.connect.task_id
string
experimental Display name: Kafka Connect task ID The ID of the Kafka Connect task.
0; 1; 2
messaging.kafka.connect.worker_id
string
experimental Display name: Kafka Connect worker ID The ID of the Kafka Connect worker.
10.0.0.1:8083; worker-1
Log events
Fields relevant for log events
Log event fields
Attribute
Type
Description
Examples
log.file.name
string
experimental Display name: Log file name The basename of the file.
messages; agent.log
log.file.path
string
experimental Display name: Log file path The full path to the file.
/var/log/messages; /var/log/dynatrace/agent.log
log.iostream
string
stable Display name: Log I/O stream The I/O stream to which the log was emitted.
stdout; stderr
log.logger
string
experimental Display name: Logger name The name of the logger inside an application. This name is usually the name of the class that initialized the logger, but it can be a custom name.
main.logger; kafka.server.KafkaServer
log.raw_level
string
experimental Display name: Raw log level The original severity level of the log entry as recorded by the source, before standardization into the log.level format. 1
silly; verbose
log.record.uid
string
experimental Unique identifier of the log record. Records sharing the same uid are considered duplicates and may be safely deduplicated. Two distinct log records MUST have different uid values. When logs are ingested from an external tool, this attribute will hold the original vendor log ID.
c42dbd31-17b5-4270-b1a7-824a52e0d0e9
log.source
string
stable Display name: Log source Human-readable attribute that identifies a log stream. 2 Tags: permission
/var/log/messages; Windows Event Log; Docker Container Output; stdout
log.source.binary_files_state
string
experimental Display name: Log source binary files state Proportion of monitored files in this log source that were detected as binary and skipped: None means no binary files, Partial means some, Fully means all. 3
None; Partial; Fully
log.source.file_status
string
experimental Display name: Log source file status The field represents the current monitoring state of a log source.
OK; NOT_EXIST; BINARY
log.source.ingest_status
string
experimental Display name: Log source ingest status The field represents the log content ingestion status.
Ingested; Not ingested; Partially ingested
log.source.origin
string
stable Display name: Log source origin The log source origin indicates where the log derives from.
CUSTOM; IIS_LOG_DETECTOR
loglevel
string
stable Display name: Log level The log event severity level.
ERROR; INFO; TRACE
1
The log.raw_level can vary in type depending on the log entry. It may be represented as a string in some cases or as an integer (for example, 30, 40, 50) in others.
2
Can contain, for example, a file path, standard output, or an URI etc., depending on the log stream type. The value should be stable for one logical source (for example, not affected by log file rotation digits).
3
Unlike log.source.file_status, which reflects the overall health status of the log source, this field aggregates binary detection across all individual files monitored by the source.
log.iostream MUST be one of the following:
Value
Description
Display name
stderr
std_err
Standard Error
stdout
std_out
Standard Out
log.source.binary_files_state MUST be one of the following:
Value
Description
Display name
Fully
All monitored files in this log source are binary and were skipped.
Fully
None
No binary files were detected among the monitored files, or binary acceptance is enabled for this source.
No binary files
Partial
Some but not all monitored files are binary and were skipped.
Partial
log.source.origin MUST be one of the following:
Value
Description
Display name
CONTAINER_LOG_DETECTOR
Container log detector.
Container Log Detector
CUSTOM_LOG
Custom log source configuration.
Custom Log
EVENT_CHANNEL_DETECTOR
Event Log channel detector.
Event Log Channel Detector
IIS_LOG_DETECTOR
IIS log detector.
IIS Log Detector
JOURNALD_LOG_DETECTOR
Journald log detector.
Journald Log Detector
OPEN_LOG_DETECTOR
Open log file detector.
Open Log Detector
SYSTEM_LOG_DETECTOR
System log detector.
System Log Detector
loglevel MUST be one of the following:
Value
Description
Display name
ALERT
alert
Alert
CRITICAL
critical
Critical
DEBUG
debug
Debug
EMERGENCY
emergency
Emergency
ERROR
error
Error
FATAL
fatal
Fatal
INFO
info
Info
NONE
none
No level
NOTICE
notice
Notice
SEVERE
severe
Severe
TRACE
trace
Trace
WARN
warn
Warn
Messaging
Messaging fields
Attribute
Type
Description
Examples
messaging.batch.failed_count
long
experimental Display name: Batch failed count The number of messages in the batch for which publishing failed.
1; 3; 15
messaging.batch.failure_codes
string[]
experimental Display name: Batch failure codes The vendor-provided error codes explaining why an operation on the message broker failed. To limit attribute size, not all error codes might be included.
['MalformedDetail', 'InvalidArgument']
messaging.batch.message_count
long
stable Display name: Batch message count The number of messages sent, received, or processed in the scope of the batching operation.
1; 2; 3
messaging.client.id
string
stable Display name: Client ID A unique identifier for the client that consumes or produces a message.
aclient; myhost@68d46b89c9-c29qc
messaging.consumer.group.name
string
stable Display name: Consumer group name The name of the consumer group with which a consumer is associated.
my-group; indexer
messaging.destination.kind
string
deprecated Display name: Destination kind The kind of message destination
queue; topic
messaging.destination.manager_name
string
stable Display name: Destination Manager name The destination's manager name 1
MyBroker
messaging.destination.name
string
stable Display name: Destination name The message destination name 2
MyQueue; MyTopic
messaging.destination.partition.id
string
stable Display name: Destination partition ID String representation of the partition ID the message is sent to or received from.
1
messaging.destination.subscription.name
string
experimental The name of the subscription from which the message is received, applicable to topic-based messaging systems. 3
my-subscription; orders-subscription
messaging.destination.temporary
boolean
stable Display name: Temporary destination A boolean that is true if the message destination is temporary and might not exist anymore after messages are processed.
messaging.is_failed
boolean
deprecatedReplaced by transaction.is_failed in combination with transaction.is_message_processing. Display name: Is Failed Indicates that the messaging operation is considered failed according to the failure detection rules. Only present if the messaging.operation.type is process.
messaging.message.body.size
long
stable Display name: Message body size The (uncompressed) size of the message payload in bytes.
2738
messaging.message.conversation_id
string
stable Display name: Conversation ID The conversation ID identifying the conversation to which the message belongs, represented as a string. Sometimes called "Correlation ID".
MyConversationId
messaging.message.delivery_count
long
experimental Display name: Message delivery count The number of deliveries of the message.
1; 4
messaging.message.enqueued_time
timestamp
experimental Display name: Message enqueued time The timestamp when the message was enqueued in the destination.
1649822520123123123
messaging.message.header.__key__
record
stable Display name: Messaging message header The message headers, __key__ being the message header/attribute name, for example, "messaging.message.header.ExtendedPayloadSize". The data type of the value depends on the attribute.
1024, "my-eu-bucket-3", ["a", "b"]
messaging.message.id
string
stable Display name: Message ID A value used by the messaging system as an identifier for the message, represented as a string.
452a7c7c7c7048c2f887f61572b18fc2
messaging.operation.type
string
stable Display name: Messaging operation type A string identifying the kind of messaging operation.
peek
messaging.source.kind
string
deprecated Display name: Source kind The kind of message source
queue; topic
messaging.source.manager_name
string
deprecatedReplaced by messaging.destination.manager_name. Display name: Source Manager Name The source's manager name 4
MyBroker
messaging.source.name
string
deprecatedReplaced by messaging.destination.name. Display name: Source Name The message source name 5
MyQueue; MyTopic
messaging.source.temporary
boolean
deprecatedReplaced by messaging.destination.temporary. Display name: Temporary Source A boolean that is true if the message source is temporary and might not exist anymore after messages are processed.
messaging.system
string
stable Display name: Messaging system An identifier for the messaging system. See below for a list of well-known identifiers.
kafka; rabbitmq
1
Manager name uniquely identifies the broker.
2
Destination name uniquely identifies a specific queue, topic or other entity within the broker.
3
Subscription name identifies a specific subscription to a topic within the messaging system. Applicable to systems such as Azure Service Bus and Google Cloud Pub/Sub.
4
Manager name uniquely identifies the broker.
5
Source name uniquely identifies a specific queue, topic, or other entity within the broker.
messaging.destination.kind MUST be one of the following:
Value
Description
Display name
queue
A message sent to or received from a queue
Queue
topic
A message sent to or received from a topic
Topic
messaging.operation.type has the following list of well-known values. If one of them applies, then the respective value MUST be used, otherwise a custom value MAY be used.
Value
Description
Display name
peek
A message is received from a destination by a message consumer/server, but left there (span.kind is "consumer").
Peek
process
A message previously received from a destination is processed by a message consumer (span.kind is "consumer").
Process
publish
A message is sent to a destination by a message producer (span.kind is "producer").
Publish
receive
A message is received from a destination by a message consumer (span.kind is "consumer").
Receive
messaging.source.kind MUST be one of the following:
Value
Description
Display name
queue
A message received from a queue
Queue
topic
A message received from a topic
Topic
messaging.system has the following list of well-known values. If one of them applies, then the respective value MUST be used, otherwise a custom value MAY be used.
Value
Description
Display name
activemq
ActiveMQ
ActiveMQ
artemis
ActiveMQ Artemis
ActiveMQ Artemis
aws_eventbridge
Amazon EventBridge
AWS EventBridge
aws_sns
Amazon Simple Notification Service (SNS)
AWS SNS
aws_sqs
Amazon Simple Queue Service (SQS)
AWS SQS
azure_eventgrid
Azure Event Grid
Azure Event Grid
azure_eventhubs
Azure Event Hubs
Azure Event Hub
azure_iothub
Azure IoT Hub
Azure IoT Hub
azure_servicebus
Azure Service Bus
Azure Service Bus
gcp_pubsub
Google Cloud Pub/Sub
GCP Pub/Sub
hornetq
HornetQ
HornetQ
jms
Java Message Service
JMS
kafka
Apache Kafka
Kafka
mqseries
IBM MQ
IBM MQ
msmq
MSMQ
MSMQ
rabbitmq
RabbitMQ
RabbitMQ
rocketmq
Apache RocketMQ
RocketMQ
sag_webmethods_is
Software AG, webMethods Integration Server
webMethods IS
tibco_ems
Tibco EMS
TIBCO EMS
weblogic
Oracle WebLogic
WebLogic
websphere
IBM WebSphere Application Server
WebSphere
Akka messaging fields
Attribute
Type
Description
Examples
messaging.akka.actor.kind
string
experimental Display name: Akka actor kind Name of the top-level actor. See The Akka actor hierarchy
system; user
messaging.akka.actor.path
string
experimental Display name: Akka actor path Path to actor inside actor system.
experimental Display name: Kafka message key The key property of the message.
mykey
messaging.kafka.message.tombstone
boolean
experimental Display name: Kafka tombstone A boolean that is true if the message is a tombstone. 1
true
messaging.kafka.offset
long
experimental Display name: Kafka offset The offset of the message.
42
1
If the message is a tombstone, the value is true. When missing, the value is assumed to be false.
Metric
Metric fields
Attribute
Type
Description
Examples
metric.key
string
stable Display name: Metric key The identifier of a metric, grouping numeric measurements that share the same measurement semantics (i.e. were measured "the same way".) Tags: permission
dt.host.cpu.usage
metric.type
string
stable Display name: Metric type Identifies the type of metric and therefore the timeseries rollup functions it supports.
summary_stats
metric.type MUST be one of the following:
Value
Description
Display name
histogram
Identifies a metrics record supporting minimum, maximum, average, sum, count, and percentile timeseries rollup functions.
Histogram
summary_stats
Identifies a metrics record supporting minimum, maximum, average, sum, and count timeseries rollup functions.
Summary Stats
Module insights
Module insights fields
In webserver technologies a multitude of modules might be contributing to handling a single web request. Module insights provides timings for these, where available.
Attribute
Type
Description
Examples
module_insights.modules
record
experimental Display name: Module insights modules Modules executed as part of this web request, represented as map from module name to duration in nanoseconds spent.
These attributes may be used for any network related operation.
Attribute
Type
Description
Examples
network.carrier.name
string
experimental Display name: Carrier name The mobile carrier name.
Magenta; AT&T
network.connection.subtype
string
experimental Display name: Connection subtype Further details that specify network.connection.type, such as the cellular or WI-FI technology.
lte; 802.11x
network.connection.type
string
experimental Display name: Connection type The internet connection type.
cell; wifi
network.local.address
ipAddress
experimental Display name: Local address Local address of the network connection.
10.102.0.45
network.peer.ip
ipAddress
experimental Display name: Peer IP The immediate peer IP address of the network connection. This is the IP address of the other side of the socket connection.
140.78.100.116; 172.16.11.1; 2a01:468:1000:9::140
network.peer.port
long
experimental Display name: Peer port The immediate peer port number of the network connection. This is the port number of the other side of the socket connection.
experimental Display name: Network protocol number The IANA protocol number of the traffic. For more information, see Assigned Internet Protocol Numbers.
3; 10
network.protocol.version
string
experimental Display name: Network protocol version Version of the application layer protocol used.
1.1; 3.1.1
network.proxy_chain
record[]
experimental Display name: Proxy chain Information about proxies or load balancers between a client and a server, parsed out from Forwarded or X-Forwarded-For (XFF) HTTP headers. Each element in the list is a record with ip (type ipAddress) and port (type long) attributes that denote the intermediary. Port is optional; if it's not available, no port attribute is present in the record.
stable Display name: Network type OSI Network Layer or non-OSI equivalent.
ipv4; ipv6
network.connection.type has the following list of well-known values. If one of them applies, then the respective value MUST be used, otherwise a custom value MAY be used.
Value
Description
Display name
cell
cell
Cellular
unavailable
unavailable
Unavailable
unknown
unknown
Unknown
wifi
wifi
Wi-Fi
wired
wired
Wired
network.transport has the following list of well-known values. If one of them applies, then the respective value MUST be used, otherwise a custom value MAY be used.
Signals that there is only in-process communication not using a "real" network protocol in cases where network attributes would typically be expected. Usually, all other network attributes can be left out.
network.type has the following list of well-known values. If one of them applies, then the respective value MUST be used, otherwise a custom value MAY be used.
Value
Description
Display name
ipv4
IPv4
IPv4
ipv6
IPv6
IPv6
Network device
Network device fields
Fields that are used in extensions to describe network devices.
Attribute
Type
Description
Examples
device
string
resourcedeprecatedUsed in Extension Framework 2.0 Address (IP address with port) used by a monitored device to communicate with an extension.
10.102.0.45:161
device.address
ipAddress
resourcedeprecatedUsed in Extension Framework 2.0 IP address used by a monitored device to communicate with an extension.
10.102.0.45
device.name
string
resourcedeprecatedUsed in Extension Framework 2.0 Name of a device monitored by an extension.
AT1i-WLC-TestingLab.dynatrace.org
device.port
string
resourcedeprecatedUsed in Extension Framework 2.0 Port used by a monitored device to communicate with an extension.
161
Network flow
Network flow fields
Fields relevant for network flows.
Attribute
Type
Description
Examples
network_flow.bytes.rx
long
experimental Display name: Bytes received Number of bytes (octets) received during given interval, direction: to Process (PGI).
network_flow.bytes.tx
long
experimental Display name: Bytes transmitted Number of bytes (octets) transmitted during given interval, direction: from Process (PGI).
network_flow.destination.address
ipAddress
experimental Display name: Destination address Destination IP address. By convention, destination means TCP server (acceptor of the connection).
experimental Display name: Destination port Flow destination port. By convention, destination port means TCP server (acceptor of the connection).
22; 8080
network_flow.network.transport
string
experimental Display name: Network transport protocol Protocol
TCP; other; UDP
network_flow.network.type
string
experimental Display name: Network type IP protocol version.
IPV4
network_flow.packets.retransmitted.base.rx
long
experimental Display name: Packets retransmission base (rx) Number of packets received, used as the base for retransmission rate, direction: to Process (PGI).
network_flow.packets.retransmitted.base.tx
long
experimental Display name: Packets retransmission base (tx) Number of packets sent, used as the base for retransmission rate, direction: from Process (PGI).
network_flow.packets.retransmitted.rx
long
experimental Display name: Packets retransmitted (rx) Number of retransmitted packets during given interval, direction: to Process (PGI).
network_flow.packets.retransmitted.tx
long
experimental Display name: Packets retransmitted (tx) Number of retransmitted packets during given interval, direction: from Process (PGI).
network_flow.packets.rx
long
experimental Display name: Packets received Number of packets received during given interval, direction: to Process (PGI).
network_flow.packets.tx
long
experimental Display name: Packets transmitted Number of packets transmitted during given interval, direction: from Process (PGI).
network_flow.process_is_server
boolean
experimental Display name: Process is server Indicates whether the entity (Process) is acting as a server in the network flow.
true; false
network_flow.source.address
ipAddress
experimental Display name: Source address Source IP address. By convention, source means TCP client (initiator of the connection).
experimental Display name: TCP RTT Mean RTT value [ms].
network_flow.tcp.rtt.ack
duration
experimental Display name: TCP RTT ack Mean RTT ack value [ms].
network_flow.tcp.sessions.new
long
experimental Display name: New TCP sessions Number of new TCP sessions in the flow.
network_flow.tcp.sessions.reset
long
experimental Display name: Reset TCP sessions Number of reset (rejected) TCP sessions in the flow.
network_flow.tcp.sessions.timeout
long
experimental Display name: Timed out TCP sessions Number of timed out TCP sessions in flow.
network_flow.network.type has the following list of well-known values. If one of them applies, then the respective value MUST be used, otherwise a custom value MAY be used.
Value
Description
Display name
IPV4
ipv4
IPv4
IPV6
ipv6
IPv6
Network interface
Network interface fields
Attribute
Type
Description
Examples
network_interface.name
string
resourceexperimental The name of the Smartscape network interface.
eth0; ens192; Ethernet 1
Node.js
Node.js fields
Attribute
Type
Description
Examples
nodejs.app.base.dir
string
resourceexperimental Display name: Node.js application base directory
nodejs.app.name
string
resourceexperimental Display name: Node.js application name
nodejs.script.name
string
resourceexperimental Display name: Node.js script name
OpenSearch
OpenSearch fields
Attribute
Type
Description
Examples
opensearch.document_id
string
experimental Display name: OpenSearch document ID ID of the document stored in OpenSearch.
2kuZ25sBo9KPhzL41rsg
opensearch.id
string
experimental Display name: OpenSearch ID X-Opaque-Id http header if one was used.
152220
opensearch.index
string
experimental Display name: OpenSearch index The name of the OpenSearch index.
opensearch-index; index-2024.01.01
opensearch.node_id
string
experimental Display name: OpenSearch node ID The ID of the node.
experimental Display name: OpenSearch shard ID The ID of the OpenSearch shard.
VzblS9m1Q9CBaTHoEbKLnT
opensearch.stats
string
experimental Display name: OpenSearch stats Search group defined in the query.
autocomplete; dashboard_query
opensearch.took
string
experimental Display name: OpenSearch took Execution time of the request.
56ms
opensearch.took_millis
string
experimental Display name: OpenSearch took millis Execution time of the request.
56
opensearch.total_hits
string
experimental Display name: OpenSearch total hits Total number of hits returned by the search.
0 hits; 4 hits
opensearch.total_shards
string
experimental Display name: OpenSearch total shards Total number of shards.
1; 9
OpenStack
OpenStack fields
Fields that can come from applications running on OpenStack.
Attribute
Type
Description
Examples
openstack.availability_zone
string
resourceexperimental Display name: OpenStack availability zone A specific availability zone in the given OpenStack region.
us-east-1a
openstack.instance_uuid
string
resourceexperimental Display name: OpenStack instance UUID UUID of specific OpenStack instance.
6790cb48-f8e9-4773-bcea-001469de0599
Origin
Origin fields
The origin of a request associated with this event.
Attribute
Type
Description
Examples
origin.address
string
experimental Display name: Origin address Source IP address of the request associated with this event. Must be set if origin.type is 'REST', must not be set otherwise.
10.11.12.13
origin.session
string
experimental Display name: Origin session The ID of the browser session (if present) associated with the event.
node0hfznc
origin.type
string
experimental Display name: Origin type Origin type of the request associated with this event.
REST; LOCAL
origin.x_forwarded_for
string
experimental Display name: Origin x-forwarded-for The verbatim value of the X-Forwarded-For HTTP request header (if present) of the request associated with the event.
1.2.3.4
origin.type MUST be one of the following:
Value
Description
Display name
LOCAL
The event provider issued the request locally.
Local
RECOVERY
The event provider issued the request locally as part of disaster recovery.
Recovery
REST
The event provider received an external REST API call.
REST
OS
The os namespace contains information on the operating system running an application.
OS fields
Attribute
Type
Description
Examples
os.architecture
string
resourceexperimental Display name: OS architecture Architecture of the CPU, discovered from the operating system.
X86
os.name
string
resourcestable Display name: OS name The OS name in a short, human-readable format.
iOS
os.type
string
resourceexperimental Display name: OS type Type of discovered operating system.
LINUX; WINDOWS
os.version
string
resourcestable Display name: OS version The complete OS version, including patch, build, and other information.
15.3.1; Ubuntu 16.04.7 LTS (Xenial Xerus) (kernel 4.15.0-206-generic); Windows Server 2022 Datacenter 21H2 2009, ver. 10.0.20348
OS service
OS service fields
Attribute
Type
Description
Examples
os_service.alerting
boolean
experimental Display name: OS service alerting Boolean attribute deciding whether the service status triggers alerts or not.
os_service.status
string
experimental Display name: OS service status Current running state.
activating
os_service.status MUST be one of the following:
Value
Description
Display name
activating
Service is activating.
Activating
active
Service is active.
Active
continue_pending
Service continues pending.
Continue Pending
deactivating
Service is deactivating.
Deactivating
failed
Service failed to start.
Failed
inactive
Service is inactive.
Inactive
pause_pending
Service paused pending.
Pause Pending
paused
Service is currently paused.
Paused
reloading
Service is reloading.
Reloading
running
Service is currently running.
Running
start_pending
Service started pending.
Start Pending
stop_pending
Service stopped pending.
Stop Pending
stopped
Service is currently stopped.
Stopped
OS service resource fields
Attribute
Type
Description
Examples
os_service.display_name
string
resourceexperimental Human-readable name of the service. On Windows, this is the display name as reported by the Service Control Manager, which may differ from os_service.name (e.g., name: wuauserv, display_name: Windows Update). On Linux, this value is the same as os_service.name.
My OS Service
os_service.manufacturer
string
resourceexperimental Display name: OS service manufacturer Manufacturer of the service. On Linux based systems, the value will always be -, meaning empty.
-; SSH Corp.
os_service.name
string
resourceexperimental Display name: OS service name Unique OS service name. On Windows, this is the short programmatic key as reported by the Service Control Manager (e.g., wuauserv), which may differ from display name (e.g., Windows Update). On Linux, this is the systemd unit name (e.g., nginx.service).
myosservice
os_service.path
string
resourceexperimental Display name: OS service path The full path to the process executable. On Linux based systems, this can be set to the target of proc/[pid]/exe. On Windows, it can be set to the result of GetProcessImageFileNameW.
/usr/bin/cmd/otelcol
os_service.startup_type
string
resourceexperimental Display name: OS service startup type Current startup type.
auto
os_service.startup_type MUST be one of the following:
Value
Description
Display name
auto
Windows specific. Automatic: The service starts at system logon.
Auto
auto_delay
Windows specific. Automatic (Delayed Start): The service starts a short while after the system has finished starting up.
Auto Delay
auto_delay_trigger
Windows specific. Automatic (Delayed Start, Trigger Start)
Auto Delay Trigger
auto_trigger
Windows specific. Automatic (Trigger Start): This service will start automatically at boot.
Auto Trigger
disabled
Linux specific. Service is configured to not start when the system boots, but can be started manually, or as a dependency of another service.
Disabled
enabled
Linux specific. Service is marked for starting up on boot.
Enabled
enabled-runtime
Linux specific. Service is marked for starting up on boot.
Enabled Runtime
indirect
Linux specific. Service is not enabled directly but can be activated via dependencies or aliases.
linked
Linux specific. Service unit file is symlinked into systemd from an external location persistently.
linked-runtime
Linux specific. Service unit file is temporarily symlinked into systemd for the current runtime only.
manual
Windows specific. Manual: The service starts only when explicitly summoned.
Manual
manual_trigger
Windows specific. Manual (Trigger Start): This service will not start automatically at boot.
Manual Trigger
static
Linux specific. Service is not enabled and can only start when pulled in by dependencies or started manually.
Static
OpenTelemetry scope
OpenTelemetry scope fields
Attribute
Type
Description
Examples
otel.scope.name
string
stable Display name: OTel scope name The name of the instrumentation scope - (InstrumentationScope.Name in OTLP).
io.opentelemetry.contrib.mongodb
otel.scope.version
string
stable Display name: OTel scope version The version of the instrumentation scope - (InstrumentationScope.Version in OTLP).
experimental Display name: PostgreSQL session ID A unique ID to identify a PostgreSQL database session.
00112233-4455-6677-8899-aabbccddeeff
Primary Grail tags
Primary Grail tags fields
Primary Grail tags are a small set of important, customer-selected tags—such as Kubernetes labels, AWS/Azure tags, or key organizational attributes—that Dynatrace automatically attaches to all raw telemetry data at ingest, using the primary_tags.* prefix. This enrichment enables fast, consistent filtering, grouping, and permission management across all data, without complex joins or proprietary tagging rules. Primary Grail tags are centrally configured and ensure that cloud-native and business-relevant metadata is always available for queries, dashboards, and access control.
Attribute
Type
Description
Examples
primary_tags.__key__
string
resourceexperimental Display name: Primary tag Primary Grail tags are used to tag a resource in a meaningful way. __key__ is populated with the tag name, for example, primary_tags.ownership. In case of single-value tags, the value is a string. In case of multi-value tags, the value is an array of strings.
team-alpha; team-bravo
Process
Process fields
Attribute
Type
Description
Examples
process.bitness
string
resourceexperimental Display name: Process bitness The architecture of the monitored entity in terms of how many bits compose a basic value.
64
process.command
string
resourceexperimental Display name: Command The command used to launch the process (the command name). On Linux-based systems, can be set to the zeroth string in /proc/[pid]/cmdline. On Windows, can be set to the first parameter extracted from GetCommandLineW.
cmd/otelcol; python3; cmd.exe
process.command_args
string[]
resourceexperimental Display name: Command arguments All the command arguments (including the command/executable itself) as received by the process. On Linux-based systems, can be set according to the list of null-delimited strings extracted from /proc/[pid]/cmdline. For libc-based executables, this would be the full argv vector passed to main.
resourceexperimental Display name: Command line The full command used to launch the process as a single string representing the full command. On Windows, can be set to the result of GetCommandLineW. Do not set this if you have to assemble it just for monitoring; use process.command_args instead.
resourceexperimental Display name: Is containerized True if given process is running inside container.
process.end
timestamp
resourceexperimental Display name: Process end Timestamp of when the process terminated, in ISO 8601 format with millisecond precision and UTC timezone. Only populated in process termination events or in retrospective enrichment. On Windows, available via GetProcessTimes.
2025-01-15T10:35:22.417Z
process.executable.name
string
resourceexperimental Display name: Executable name The name of the process executable. On Linux based systems, can be set to the Name in proc/[pid]/status. On Windows, can be set to the base name of GetProcessImageFileNameW.
otelcol
process.executable.path
string
resourceexperimental Display name: Executable path The full path to the process executable. On Linux-based systems, can be set to the target of proc/[pid]/exe. On Windows, can be set to the result of GetProcessImageFileNameW.
/usr/bin/cmd/otelcol
process.has_public_traffic
boolean
resourceexperimental Indicates whether the process has public traffic detected via eBPF Discovery. 1
true
process.listen_ports
array
resourceexperimental Display name: Listen ports An array of open listen ports.
50000; 50001; 50002; 50003
process.metadata
record
resourceexperimental Display name: Process metadata It contains a diagnostic collection of input parameters that were used or could have been used in assigning processes to the process entity.
NODE_JS_APP_BASE_DIRECTORY:C:/home/site/wwwroot
process.metadata.id_keys
array
resourceexperimental Display name: Process metadata ID keys Keys of non-ignored input parameters used to calculate the process entity ID.
resourceexperimental The name of the Smartscape process.
java; nginx; python3
process.parent.command_args
string[]
resourceexperimental Display name: Parent command arguments All the command arguments (including the command/executable itself) as received by the parent process.
resourceexperimental Display name: Parent command line The full command line used to launch the parent process.
/usr/bin/bash -l; C:\Windows\explorer.exe
process.parent.end
timestamp
resourceexperimental Display name: Parent process end Timestamp of when the parent process terminated, in ISO 8601 format. May be empty if the parent process is still running.
2025-01-15T12:00:00.000Z
process.parent.executable.name
string
resourceexperimental Display name: Parent executable name The name of the parent process executable.
bash; explorer.exe
process.parent.executable.path
string
resourceexperimental Display name: Parent executable path Full filesystem path to the parent process executable, including the filename.
/usr/bin/bash; C:\Windows\explorer.exe
process.parent.pid
long
resourceexperimental Display name: Parent pid Operating system process identifier of the parent process. Subject to the same PID reuse caveat as process.pid.
1; 5678
process.parent.start
timestamp
resourceexperimental Display name: Parent process start Timestamp of when the parent process was started, in ISO 8601 format.
2025-01-15T08:00:00.000Z
process.parent.unique_id
string
resourceexperimental Display name: Parent unique ID Globally unique identifier for the parent process instance. Same generation mechanism and uniqueness guarantees as process.unique_id.
c3d2e1f0-9a8b-7c6d-5e4f-3a2b1c0d9e8f
process.parent.user.id
string
resourceexperimental Display name: Parent user ID The user ID under which the parent process was executing.
0; S-1-5-18
process.parent.working_directory
string
resourceexperimental Display name: Parent working directory The working directory of the parent process at its creation time.
/root; C:\Windows\System32
process.pid
long
resourceexperimental Display name: Process ID Process Identifier (PID) as observed by the monitored process.
1234
process.start
timestamp
resourceexperimental Display name: Process start Timestamp of when the process was started, in ISO 8601 format with millisecond precision and UTC timezone. On Linux, derivable from /proc/[pid]/stat start time combined with system boot time. On Windows, available via GetProcessTimes.
2025-01-15T10:30:00.000Z
process.unique_id
string
resourceexperimental Display name: Unique process ID Globally unique identifier for this specific process instance. Unlike process.pid, this value is never reused and uniquely identifies the process across its entire lifetime. Generation mechanism is implementation-defined (for example, UUID, hash of pid+start_time+host_id, Sysmon ProcessGuid).
8a4f500d-1ca8-5d73-a7f3-1b2c4e5f6a7b
process.user.id
string
resourceexperimental Display name: User ID The user ID under which the process is executing. On Linux, this is the numeric UID (for example, from /proc/[pid]/status Uid field, real UID). On Windows, this is the SID of the process token owner. Stored as string to accommodate both numeric UIDs and Windows SID format.
resourceexperimental Display name: Working directory The working directory of the process at creation time. On Linux, corresponds to /proc/[pid]/cwd at process start. Captures the initial state (subsequent chdir() calls are not reflected.) Includes a trailing separator where the OS convention dictates one.
/home/user/project; C:\Users\admin\Documents
1
This field is supported only on Linux hosts with eBPF Discovery enabled and OneAgent installed on the host.
RabbitMQ
RabbitMQ fields
Attribute
Type
Description
Examples
rabbitmq.function.arity
long
experimental Display name: RabbitMQ function arity The number of arguments the rabbitmq.function.name takes.
2; 5
rabbitmq.function.name
string
experimental Display name: RabbitMQ function name The name of the RabbitMQ function within the rabbitmq.module.name that generated the log entry.
start_it; main
rabbitmq.module.name
string
experimental Display name: RabbitMQ module name The name of the RabbitMQ module that generated the log entry.
rabbit; my_module
rabbitmq.pid
string
experimental Display name: RabbitMQ process ID ID of the Erlang process.
0.58.0; 1.20.4
Redis
Redis fields
Attribute
Type
Description
Examples
redis.role
string
experimental Display name: Redis role The role of the Redis process (for example, 'M' for Master or 'X' for sentinel).
C
redis.role MUST be one of the following:
Value
Description
Display name
C
Child process for persistence (RDB/AOF).
Child
M
Master Redis process.
Master
R
Replica Redis process.
Replica
X
Sentinel monitoring process.
Sentinel
Request
Request fields
Attribute
Type
Description
Examples
request.is_failed
boolean
deprecatedReplaced by transaction.is_failed in combination with transaction.is_endpoint_request. Indicates that the request is considered failed according to the failure detection rules. Only present on the request root span.
request.is_root_span
boolean
deprecatedReplaced by transaction.is_root_span in combination with transaction.is_endpoint_request. Marks the root of a request. It's the first span and starts the request within a service.
Request attribute
Request attribute fields
Request scoped attributes (e.g. method parameters, return values, class names, …) captured by the OneAgent based on a request attribute definition.
The actual name of the attribute is the prefix "request_attribute" plus the "request attribute name" defined in the request attributes configuration.
Request attributes are built based on captured attributes and other attributes like HTTP header values or "normal" span attributes, on which the aggregations (first/last value, distinct values, ...), type conversion and normalizations defined in the request attribute configuration are performed.
They are evaluated for an entire request (possibly consisting of multiple spans) and are stored only on the request root node.
Attribute
Type
Description
Examples
request_attribute.__attribute_name__
array
stable Display name: Request attribute Contains the request scoped reconciled values of the attribute named __attribute_name__ defined by the request attribute configuration. The data type of the value depends on the request attribute definition. Tags: sensitive-spans
experimental Display name: RPC method The name of the (logical) method being called 1
exampleMethod
rpc.namespace
string
experimental Display name: RPC namespace The namespace of the method being called. In SOAP, it would be the XML namespace.
tempuri.org
rpc.service
string
experimental Display name: RPC service The full (logical) name of the service being called, including its package name, if applicable. 2
myservice.EchoService
rpc.system
string
experimental Display name: RPC system A string identifying the remoting system or framework. See below for a list of well-known identifiers.
apache_cxf; dotnet_wcf; grpc; jax_ws
1
This is the logical name of the method from the RPC interface perspective, which can be different from the name of any implementing method/function. The code.function attribute may be used to store the latter (e.g., method executing the call on the server side, RPC client stub method on the client side).
2
This is the logical name of the service from the RPC interface perspective, which can be different from the name of any implementing class. The code.namespace attribute may be used to store the latter (despite the attribute name, it may include a class name, e.g., class with method executing actually executing the call on the server side, RPC client stub class on the client side).
rpc.system has the following list of well-known values. If one of them applies, then the respective value MUST be used, otherwise a custom value MAY be used.
Value
Description
Display name
apache_axis
Apache Axis
Apache Axis
apache_cxf
Apache CXF
Apache CXF
apache_wink
Apache Wink
Apache Wink
aws_api
AWS API
AWS API
azure_api
Azure API
Azure API
dotnet_remoting
.NET Remoting
.NET Remoting
dotnet_wcf
.NET WCF
.NET WCF
grpc
gRPC
gRPC
java_rmi
Java RMI
Java RMI
jax_ws
JAX-WS
JAX-WS
jboss
JBoss
JBoss
jersey
Jersey
Jersey
openedge
Progress OpenEdge
OpenEdge
resteasy
JBoss RESTEasy
RESTEasy
restlet
Restlet
Restlet
spring_ws
Spring Web Services
Spring Web Services
tibco_ws
Tibco Web Services
Tibco Web Services
weblogic_ws
WebLogic Web Services
WebLogic Web Services
webmethods
Webmethods
Webmethods
gRPC fields
Attribute
Type
Description
Examples
rpc.grpc.status_code
long
experimental Display name: GRPC status code The numeric status code of the gRPC request.
Server
Server fields
The server namespace contains information on the server side of a network connection.
Attribute
Type
Description
Examples
server.address
string
stable Display name: Server address Logical server hostname, matches server FQDN if available, and IP or socket address if FQDN is not known.
example.com
server.port
long
stable Display name: Server port Logical server port number.
65123; 80
server.resolved_ips
ipAddress[]
stable Display name: Server resolved ips A list of IP addresses that are the result of DNS resolution of server.address.
[194.232.104.141, 2a01:468:1000:9::140]
Service
Service fields
Attribute
Type
Description
Examples
service.name
string
resourcestable Display name: OTel service name The logical name of the service.
shoppingcart
service.namespace
string
resourceexperimental A string value helping to distinguish a group of services, for example the team, system, or application the service belongs to. Scopes service.name so that two services can share a name only if they are in different namespaces. For example, a Shop namespace and a Checkout namespace could each have their own frontend service without collision. Services with no namespace must have globally unique names or be split by other attributes such as k8s.cluster.uid and k8s.namespace.name.
resourcestable An IP address that is enabled for SNMP queries on the device.
10.0.0.1
snmp.sys_object_id
string
resourcestable Display name: SNMP system object ID OID 1.3.6.1.2.1.1.2 (SNMPv2-MIB::sysObjectId): The vendor's authoritative identification of the network management subsystem contained in the entity.
1.3.6.1.4.1.25461.2.3.38; 1.3.6.1.4.1.9.1.1046
trap_oid
string
resourcedeprecatedUsed in Extension Framework 2.0 Display name: SNMP trap OID The trap OID of a given event.
SNMPv2-MIB::coldStart
version
string
resourcedeprecatedUsed in Extension Framework 2.0 Display name: SNMP version The SNMP version.
SNMPv3
Software component
The software_component namespace describes an open-source library or dependency identified in a security finding.
Software component fields
Fields for identifying and versioning a software component within a security finding.
Attribute
Type
Description
Examples
software_component.ecosystem
string
experimental Display name: Software component ecosystem Software ecosystem to which the software component belongs.
npm; maven
software_component.purl
string
experimental Display name: Software component purl Location of the package providing unique identification.
pkg:maven/org.apache.logging.log4j/log4j-core
software_component.supplier.name
string
experimental Display name: Software component supplier name Supplier name of the software component.
FasterXML
software_component.type
string
experimental Display name: Software component type Type of the software component usually provided by the SBOM.
library
software_component.version
string
experimental Display name: Software component version Version of the software component.
3.16.2-5+deb9u3
Software AG
Software AG fields
Attribute
Type
Description
Examples
softwareag.install.root
string
resourceexperimental Display name: Software AG installation root
softwareag.product.prop.name
string
resourceexperimental Display name: Software AG product property name
Span
Span fields
Attribute
Type
Description
Examples
span.alternate_parent_id
uid
experimental Display name: Alternate parent span ID The alternative span.id of this span's parent span. If a trace is monitored by more tracing systems (for example, OneAgent and OpenTelemetry), there might be two parent spans. If the two parent spans differ, span.parent_id holds the ID of the parent span originating from same tenant of the span while span.alternate_parent_id holds the other parent span ID. The span.alternate_parent_id is an 8-byte ID and hex-encoded if shown as a string.
f76281848bd8288c
span.events
record[]
stable Display name: Span events A collection of events. An event is an optional time-stamped annotation of the span and consists of a name and key-value pairs.
span.exit_by_exception_id
uid
stable Display name: Exit exception ID The exception.id of the exception the its span.events with the current span exited. The referenced exception has set the attribute exception.escaped to true.
span.id
uid
stable Display name: Span ID A unique identifier for a span within a trace. The span.id is an 8-byte ID and hex-encoded if shown as a string.
f76281848bd8288c
span.is_exit_by_exception
boolean
stable Display name: Is exit by exception Set to true if an exception exited the span. If set to false, the span has exception events, but none exited the span.
span.is_subroutine
boolean
experimental Display name: Is subroutine If set to true, it indicates that this span is a subroutine of its parent span. The spans represent functions running on the same thread on the same call stack.
span.kind
string
stable Display name: Span kind Distinguishes between spans generated in a particular context.
server
span.links
record[]
stable Display name: Span links A collection of links. A link is a reference from this span to a whole trace or a span in the same or different trace.
span.name
string
stable Display name: Span name The span name identifies the work represented by the span, for example, the route in an HTTP controller, an RPC method name, a function name, or the name of a subtask or stage within a larger computation.
prepareOrderItemsAndShippingQuoteFromCart; org.example.CheckoutService/PlaceOrder; orders process; GET /products/{product_id}; HTTP POST
span.parent_id
uid
stable Display name: Parent span ID The span.id of this span's parent span. The span.parent_id is an 8-byte ID and hex-encoded if shown as a string.
f76281848bd8288c
span.status_code
string
stable Display name: Span status Defines the status of a span, predominantly used to indicate a processing error. This field is absent if the reported span status is unset.
error
span.status_message
string
experimental Display name: Span status message An optional text that can provide a descriptive error message in case the span.status_code is error.
Connection closed before message completed; Error sending request for url
span.timing.cpu
duration
stable Display name: Span CPU time The overall CPU time spent executing the span, including the CPU times of child spans that are running on the same thread on the same call stack.
span.timing.cpu_self
duration
stable Display name: Span self CPU time The CPU time spent exclusively on executing this span, not including the CPU times of any children.
span.kind MUST be one of the following:
Value
Description
Display name
client
Indicates that the span describes a request to some remote service.
Client
consumer
Indicates that a span describes a child of an asynchronous producer request.
Consumer
internal
Default Value. Indicates that the span represents an internal operation.
Internal
link
Indicates that the span describes a Dynatrace link node.
Link
producer
Indicates that the span describes the initiator of an asynchronous request.
Producer
server
Indicates that the span covers server-side handling of a synchronous RPC or other remote request.
Server
span.status_code MUST be one of the following:
Value
Description
Display name
error
An error happened while processing the span.
Error
ok
The span was explicitly validated as having completed successfully, despite maybe even containing information about an error.
OK
GraphQL fields
Attribute
Type
Description
Examples
graphql.document
string
experimental The GraphQL document being executed. 1 Tags: sensitive-spans
query GetUser { user(id: "123") { name } }; mutation CreateOrder { createOrder(input: $input) { id } }
graphql.execution.error_count
long
experimental The number of errors returned by the GraphQL execution.
1; 3
graphql.execution.error_details
string[]
experimental Safe, low-cardinality details for errors returned by the GraphQL execution. 2
experimental The name of the GraphQL operation being executed. 3
GetUser; CreateOrder
graphql.operation.type
string
experimental The type of GraphQL operation being executed.
query; mutation
1
The document can contain inline argument values and other sensitive data. Backends should mask this field by default unless sensitive data access is explicitly granted.
2
Values describe the error type and optionally a sanitized error code. Raw GraphQL error messages must not be captured because they can contain sensitive data.
3
Anonymous GraphQL operations do not have an operation name.
graphql.operation.type MUST be one of the following:
Value
Description
mutation
A GraphQL mutation operation.
query
A GraphQL query operation.
subscription
A GraphQL subscription operation.
Span event
Span event fields
Attribute
Type
Description
Examples
span_event.name
string
stable Display name: Span event name Some span events have a defined semantics based on the name of the span event.
exception
span_event.name has the following list of well-known values. If one of them applies, then the respective value MUST be used, otherwise a custom value MAY be used.
Value
Description
Display name
bizevent
Indicates that the span event represents a business event
Business Event
exception
Indicates that the span event represents an exception
Exception
feature_flag
Indicates that the span event represents a feature flag
resourceexperimental Display name: Spring profile name The active profile (last value of spring.profiles.active)
spring.startup.class
string
resourceexperimental Display name: Spring startup class
Storage
Storage disk fields
Attribute
Type
Description
Examples
storage.disk.encrypted
boolean
resourcestable Display name: Storage disk encrypted Is encrypted disk.
storage.disk.fstype
string
resourcestable Display name: Storage disk filesystem type Type of file system on the disk.
ext4; btrfs
storage.disk.kname
string
resourcestable Display name: Storage disk kernel name Kernel name of the disk device. It's also the disk ID in relation to other devices.
sda
storage.disk.model
string
resourcestable Display name: Storage disk model Disk model.
baracuda
storage.disk.mountpoint
string
resourcestable Display name: Storage disk mountpoint Primary mount point.
/mnt/disk1
storage.disk.other-mountpoints
string[]
resourcestable Display name: Storage disk other mountpoints List of other mount points of the disk
['/home/user1/mydisk', '/opt/volume1']
storage.disk.path
string
resourcestable Display name: Storage disk path Path to the disk.
/dev/sda
storage.disk.read-only
boolean
resourcestable Display name: Storage disk read-only Is read-only disk.
storage.disk.removable
boolean
resourcestable Display name: Storage disk removable Is removable disk.
storage.disk.serial
string
resourcestable Display name: Storage disk serial number Disk serial number.
1234-56789
storage.disk.type
string
resourcestable Display name: Storage disk type Disk device type.
disk; hardware raid
storage.disk.vendor
string
resourcestable Display name: Storage disk vendor Vendor of the disk.
seagate
Storage partition fields
Attribute
Type
Description
Examples
storage.partition.encrypted
boolean
resourcestable Display name: Storage partition encrypted Is encrypted partition.
storage.partition.fstype
string
resourcestable Display name: Storage partition filesystem type Type of file system on the partition.
ext4; btrfs
storage.partition.kname
string
resourcestable Display name: Storage partition kernel name Kernel name of the partition device. It's also the partition ID in relation to other devices.
sda1
storage.partition.mountpoint
string
resourcestable Display name: Storage partition mountpoint Primary mount point.
/mnt/diskA
storage.partition.other-mountpoints
string[]
resourcestable Display name: Storage partition other mountpoints List of other mount points of the partition.
['/home/user1/mydiskA', '/opt/volumeA']
storage.partition.path
string
resourcestable Display name: Storage partition path Path to the partition.
/dev/sda1
storage.partition.read-only
boolean
resourcestable Display name: Storage partition read-only Is read-only partition.
storage.partition.removable
boolean
resourcestable Display name: Storage partition removable Is removable partition (true when disk is removable).
storage.partition.type
string
resourcestable Display name: Storage partition type Partition device type.
partition
Storage volume fields
Attribute
Type
Description
Examples
storage.volume.display-name
string
resourcestable Display name: Storage volume display name Name of the volume device.
vg0-lv1; vg1-lv2; my-volume
storage.volume.fstype
string
resourcestable Display name: Storage volume filesystem type Type of file system on the volume.
ext4; btrfs
storage.volume.kname
string
resourcestable Display name: Storage volume kernel name Kernel name of the volume device. It's also the volume ID in relation to other devices.
dm-1; dm-2; dm-5
storage.volume.mountpoint
string
resourcestable Display name: Storage volume mountpoint Primary mount point.
/mnt/diskA
storage.volume.other-mountpoints
string[]
resourcestable Display name: Storage volume other mountpoints List of other mount points of the software RAID.
['/home/user1/mydiskA', '/opt/volumeA']
storage.volume.path
string
resourcestable Display name: Storage volume path Path to the volume device.
/dev/mapper/vg0-lv1
storage.volume.read-only
boolean
resourcestable Display name: Storage volume read-only Is read-only volume.
storage.volume.removable
boolean
resourcestable Display name: Storage volume removable Is removable volume.
storage.volume.type
string
resourcestable Display name: Storage volume type Volume device type.
resourcestable Display name: Storage software raid filesystem type Type of file system on the software RAID,
ext4; btrfs
storage.software-raid.kname
string
resourcestable Display name: Storage software raid kernel name Kernel name of the software RAID device. It's also the software RAID ID in relation to other devices.
md0; md1; md3
storage.software-raid.mountpoint
string
resourcestable Display name: Storage software raid mountpoint Primary mount point.
/mnt/diskA
storage.software-raid.other-mountpoints
string[]
resourcestable Display name: Storage software raid other mountpoints List of other mount points of the software RAID.
['/home/user1/mydiskA', '/opt/volumeA']
storage.software-raid.parent
string
resourcestable Display name: Storage software raid parent ID of parent software RAID in which this software RAID is nested.
md0
storage.software-raid.path
string
resourcestable Display name: Storage software raid path Path to the software RAID device.
experimental Display name: Subtrace ID Present on every span of a subtrace. All spans within one subtrace share the same identifier. The ID is a hex-encoded numerical value and not globally unique, but guaranteed to be unique within one particular trace.
95efd70fcdb5b7b3; 96835e1d65490b48
subtrace.is_root_span
boolean
experimental Display name: Subtrace is root span Marks the root of a subtrace. This is typically the first span of a request within a service. Endpoints detection rules are evaluated on subtrace root spans.
Supportability
Supportability fields
Additional information about the attributes of a data point.
Attribute
Type
Description
Examples
supportability.alr_sampling_ratio
long
experimental Display name: ALR sampling ratio The denominator of the sampling ratio of the Dynatrace cluster, the attribute is only set if Adaptive Load Redution (ALR) is active on the Dynatrace cluster. A numerator is not specified, as it's always 1. If, for example, the Dynatrace cluster samples with a probability of 1/8 (12,5%), the value of supportability.alr_sampling_ratio would be 8 and the numerator is 1.
8
supportability.atm_sampling_ratio
long
experimental Display name: ATM sampling ratio The denominator of the sampling ratio of an Adaptive Traffic Management (ATM) aware sampler. The attribute is always present if an ATM-aware sampler is active (this applies, for example, to Dynatrace OneAgent). A numerator is not specified, as it is always 1. If, for example, Dynatrace OneAgent samples with a probability of 1/16 (6,25%), the value of supportability.atm_sampling_ratio would be 16 and the numerator is 1.
16
supportability.custom_service.rule_id
uid
experimental Display name: Custom service rule ID The ID of a custom service configuration rule. This field is only present if a custom service was configured as an automatic instrumentation rule in Dynatrace.
4d76194c11a9426197a9062548f9e66e
supportability.dropped_attributes_count
long
experimental Display name: Dropped attributes count The number of attributes that were discarded on the source. Attributes can be discarded because their keys are too long or because there are too many attributes.
1
supportability.dropped_events_count
long
experimental Display name: Dropped events count The number of span events that were discarded on the source.
1
supportability.dropped_http_request_headers_count
long
experimental Display name: Dropped HTTP request headers count Number of http.request.header.__key__ that were discarded.
experimental Display name: Dropped HTTP request parameters count Number of http.request.parameter.__key__ that were discarded.
1
supportability.dropped_links_count
long
experimental Display name: Dropped links count The number of span links that were discarded on the source.
1
supportability.external.dt.entity.service
string
deprecated Display name: External service entity The ID of the external service detected from this client span. The span comes from the service identified by dt.entity.service. This attribute indicates the external service that has been derived from it, as the remote side is not fully monitored by Dynatrace. It's only available for Service Detection v1 (SDv1) detected services that have the isExternalService entity attribute set to true. Note that this refers to classic service entities only, not Smartscape services (which do not have external services), so the attribute is removed when all services are based exclusively on Smartscape.
SERVICE-0FA460E5CB2491A3
supportability.failure_detection.is_entry_point
boolean
experimental Indicates whether the server side node is the primary or secondary failure‑detection entry point. Not applied to client-side nodes. It's important to know which node is considered the "entry point" during, for example, "success forcing exceptions" and "exception on any node" functionality.
supportability.flaws
string[]
experimental Display name: Trace assembly flaws A string array of one or multiple error codes indicating issues in the assembly of a trace in Dynatrace. Typically, issues come from erroneous (3rd party) instrumentations (e.g. not sending a required field), data loss due to network connectivity (e.g. missing parent span) or conditions implied by the nature of the trace (e.g. trace exceeding the depth limit). The attribute is only present in case an assembly issue was detected (the list will not be empty). For more information and details about specific error codes, please reach out to Dynatrace support.
['C4', 'S3', 'A2']
supportability.is_http_route_derived
boolean
experimental Display name: Is HTTP route derived Indicates that http.route was derived from url.path by Dynatrace, rather than sent by instrumentation.
experimental Display name: Is non-key requests endpoint bucket Indicates that the span stems from a request that was not marked as a key request.
true
supportability.latency_before_openpipeline
duration
experimental Display name: Latency before OpenPipeline The difference between the Dynatrace cluster node time and the end_time before the span is forwarded to OpenPipeline. Only available on subtrace root spans sent from the OneAgent.
500000000000
supportability.non_persisted_attribute_keys
string[]
experimental Display name: Non-persisted attribute keys A string array of attribute keys that were not stored as they were not allow-listed or were removed during the pipeline steps.
['"my_span_attribute", "db.name"']
supportability.original_start_time
timestamp
experimental Display name: Original start time The original start time of the span. Only available if the value of the start_time attribute was truncated. Truncating the start time is technically required for long running spans that have a start time older than three days in the past.
1649822520123123123
supportability.serverid.addressee
long
experimental Display name: Addressee server ID The id of the Dynatrace cluster node this span was addressed to. This is only available if it differs from the value of supportability.serverid.processing.
5
supportability.serverid.processing
long
experimental Display name: Processing server ID The id of the Dynatrace cluster node that received and processed this span.
5
OT span rule configuration
Span sensor rules used during ingestion of OpenTelemetry/OpenTracing spans by instrumentation of the OpenTelemetry/OpenTracing Apis are applied at span start time.
Therefore these rules can only operate on span attributes given at span start time.
The value at span start time of attributes captured by this instrumentation is preserved to allow proper rule configuration.
Supportability span tensor fields
Attribute
Type
Description
Examples
supportability.span_start.__key__
record
experimental Display name: Span start attribute Span attributes set at span start time in case it changed later. The value at span start is relevant for span rule evaluation done by OpenTelemetry/OpenTracing instrumentation. __key__ is a placeholder for the actual attribute name. The data type of the value depends on the attribute.
5, "initial", ["a", "b"]
supportability.span_start.attribute_names
array
experimental Display name: Span start attribute names List of attribute names set at span start invocation time.
supportability.span_start.span.name
string
experimental Display name: Span start span name The span name at span start time in case it changed later. The value at span start is relevant for span rule evaluation done by OpenTelemetry/OpenTracing instrumentation.
GET
Telemetry
Telemetry fields
The telemetry.sdk.* fields are used to describe the telemetry SDK in OpenTelemetry or ODIN ingest. It can be considered the closest equivalent of ODIN/OTel data to dt.agent.module.*.
The telemetry.exporter.* fields are used to define the exporter that exports telemetry data and is expected to be different for each exporter in case when multiple exporters co-exist.
Attribute
Type
Description
Examples
telemetry.exporter.name
string
resourceexperimental Display name: Telemetry exporter name The exporter name.
odin
telemetry.exporter.package_version
string
resourceexperimental Display name: Telemetry exporter package version The version as exposed to the package manager (for example, npm).
1.285.1
telemetry.exporter.version
string
resourceexperimental Display name: Telemetry exporter version The full agent/exporter version.
1.285.1.20240101-256988
telemetry.sdk.language
string
resourcestable Display name: Telemetry SDK language The programming language/tech of the telemetry SDK.
nodejs; python; java
telemetry.sdk.name
string
resourcestable Display name: Telemetry SDK name The name of the telemetry SDK.
odin; opentelemetry
telemetry.sdk.version
string
resourcestable Display name: Telemetry SDK version The version string of the telemetry SDK.
1.20.0
Thread
Thread fields
Attribute
Type
Description
Examples
thread.id
long
stable Display name: Thread ID Current "managed" thread id (as opposed to OS thread id).
42
thread.name
string
stable Display name: Thread name Current thread name.
main
thread.pool.name
string
stable Display name: Thread pool name The name of the thread pool.
WorkerThreadPool
Threat
The threat.* namespace provides structured fields for threat intelligence
data. These are signal-level fields that annotate individual security events
alongside the finding.* fields.
Sub-namespaces:
threat.attack.*—MITRE ATT&CK classification (tactic, technique,
sub-technique). Scoped exclusively to the
MITRE ATT&CK framework. Future sibling
namespaces (threat.atlas.*, threat.kill_chain.*) will cover other
classification frameworks.
threat.report.*—Identity and metadata for threat intelligence reports
ingested from external platforms (AlienVault OTX, CrowdStrike Falcon
Intelligence, STIX feeds, etc.).
threat.actor.*—Threat actor attribution information.
threat.target.*—Targeted geographies and industry verticals.
threat.malware.*—Malware families associated with the reported activity.
threat.observables.*—Typed arrays of security observables (indicators
of compromise) extracted from a threat report: IP addresses, domains, URLs,
file hashes, email addresses, and CVEs.
Concept: Threat intelligence report
A threat intelligence report is a curated, structured publication produced by
an analyst or a threat intelligence platform (TIP). It groups related threat
intelligence objects—indicators of compromise, malware descriptions, actor
attribution, TTPs, and vulnerabilities—under a single editorial context, with a
title, publisher, and timestamps.
This is not:
A PDF document or narrative report
A file submission ("reporting a suspicious file")—that is a file observable
or a malware-analysis record
The result of a query or detection—those are findings or alerts
Concrete examples of a threat intelligence report in this sense:
The threat.report.* fields capture the report's identity and provenance
(who published it, when, what it covers). The threat.observables.* fields
capture the indicators extracted from the report. Together they let consumers
correlate updates to the same report, filter by publisher, and link back to the
source for full context.
Structured MITRE ATT&CK classification fields for security detection events. These fields carry the tactic, technique, and sub-technique identifiers that describe adversary behavior observed in a detection event, classified according to the MITRE ATT&CK framework. All fields are signal-level: they annotate individual detection events. The threat.attack.* namespace is scoped to MITRE ATT&CK. Other threat classification frameworks use sibling namespaces, for example, threat.atlas., threat.kill_chain.). Field names use plural form (.ids, .names) consistent with the SD array naming convention. Name fields are optional companions to their .ids counterparts: when populated, names[i] must be the human-readable label for ids[i] (positional correspondence). Omit name fields entirely when the producing source does not provide names; don't populate names without the corresponding IDs.
Attribute
Type
Description
Examples
threat.attack.subtechnique.ids
string[]
experimental MITRE ATT&CK sub-technique identifiers for this detection, in T{parent}.{sub} dotted format. Independent of threat.attack.technique.ids—no positional alignment is assumed or required. The parent technique is encoded in the sub-technique ID itself, for example, T1059.003 belongs to technique T1059). Omit when no sub-technique information is available; don't use empty string placeholders. Sub-technique names are derivable from IDs via the ATT&CK knowledge base. DQL filter example: array.contains(threat.attack.subtechnique.ids, "T1059.003")
['T1059.003']; ['T1059.003', 'T1078.002']
threat.attack.subtechnique.names
string[]
experimental Human-readable names of the MITRE ATT&CK sub-techniques for this detection. Optional companion to threat.attack.subtechnique.ids. When populated, elements must correspond positionally to threat.attack.subtechnique.ids: names[i] is the display name for ids[i]. No specific ordering of the array is required. Omit when the producing source does not provide sub-technique names; don't use placeholder values. Names can be derived from IDs using the ATT&CK knowledge base.
experimental MITRE ATT&CK tactic identifiers for this detection, in TA-prefixed format. A detection may map to zero or more tactics. Omit or set to an empty array when tactic information is unavailable from the producing source. Tactic names can be derived from IDs using the ATT&CK knowledge base. DQL filter example: array.contains(threat.attack.tactic.ids, "TA0002")
['TA0002']; ['TA0002', 'TA0004']
threat.attack.tactic.names
string[]
experimental Human-readable names of the MITRE ATT&CK tactics for this detection. Optional companion to threat.attack.tactic.ids. When populated, elements must correspond positionally to threat.attack.tactic.ids: names[i] is the display name for ids[i]. No specific ordering of the array is required. Omit when the producing source does not provide tactic names; don't use placeholder values. Names can be derived from IDs using the ATT&CK knowledge base.
experimental MITRE ATT&CK technique identifiers for this detection, in T-prefixed format. A detection may map to zero or more techniques. The primary pivot field for ATT&CK heat maps and technique coverage dashboards. Technique names can be derived from IDs using the ATT&CK knowledge base. DQL filter example: array.contains(threat.attack.technique.ids, "T1059")
['T1059']; ['T1059', 'T1078']
threat.attack.technique.names
string[]
experimental Human-readable names of the MITRE ATT&CK techniques for this detection. Optional companion to threat.attack.technique.ids. When populated, elements must correspond positionally to threat.attack.technique.ids: names[i] is the display name for ids[i]. No specific ordering of the array is required. Omit when the producing source does not provide technique names; don't use placeholder values. Names can be derived from IDs using the ATT&CK knowledge base.
['Command and Scripting Interpreter']; ['Command and Scripting Interpreter', 'Valid Accounts']
threat.attack.version
string
experimental Version of the MITRE ATT&CK framework used to classify this detection. Useful for audit and reproducibility, since tactic and technique IDs can be added or renumbered across major ATT&CK versions. Some producers don't embed the framework version in their event payloads; omit when version provenance can't be reliably determined. Use bare version numbers without a "v" prefix.
14.1; 15.1; 16.0
Threat intelligence report fields
Identity and metadata fields for threat intelligence reports ingested from external platforms (for example, AlienVault OTX, CrowdStrike Falcon Intelligence, STIX feeds). These fields describe the report itself—who published it, when, and what topic it covers. They complement the threat.attack.* fields, which describe the MITRE ATT&CK classification of the adversary behavior covered in the report.
Attribute
Type
Description
Examples
threat.report.author
string
experimental Name of the author or team that published the report. Omit when not provided by the source platform.
AlienVault; CrowdStrike Intelligence Team; FireEye, Inc.
threat.report.description
string
experimental Summary or abstract of the threat intelligence report. Producers should truncate to 2 KB to stay within Grail field size limits; full content belongs in a linked document referenced via threat.report.references.urls.
Threat actors have compromised several @antv-scoped packages on npm...
threat.report.id
string
experimental Vendor-assigned unique identifier for this threat intelligence report. Stable across report updates; use to correlate modified versions of the same report. Format varies by provider (for example, opaque ID string, base64, STIX report– UUID).
experimental Human-readable title of the threat intelligence report as provided by the source platform. May be a vendor reference code (for example, "CSA-260614") or a descriptive title.
Active Supply Chain Attack Compromises Packages on npm; CSA-260614
threat.report.references.urls
string[]
experimental External URLs referenced by or linking to the full report. May include the report's own URL on the source platform, blog posts, advisories, or research papers that underpin the report.
experimental Free-form classification tags assigned to the report by the source platform. Useful for filtering and grouping reports by topic. Omit when not provided by the source platform.
Fields describing the threat actor (adversary group or individual) attributed to the activity covered in the threat intelligence report. Attribution is often uncertain; populate only when the source platform explicitly attributes the activity.
Attribute
Type
Description
Examples
threat.actor.names
string[]
experimental Names of the threat actors attributed to the activity described in this report. Each entry may represent either a distinct co-attributed actor (e.g. two groups acting together) or an alternative name (alias) used for the same actor across different vendors or intelligence sources. Use the names as provided by the source platform. Omit when attribution is not provided or is explicitly uncertain.
Fields describing the geographies and industry verticals targeted by the adversary activity covered in the threat intelligence report. Populated from structured targeting metadata provided by the source platform.
Attribute
Type
Description
Examples
threat.target.countries.iso_codes
string[]
experimental ISO 3166-1 alpha-2 codes of the countries targeted by the adversary activity. Uses the same two-letter country code representation as geo.country.iso_code, the platform-wide standard for country geography, so threat targeting can be correlated with geo-enriched data and rendered on maps without name normalization. Complements threat.target.countries.names (full English country names); the two arrays are independent and need not align positionally—either may be populated without the other. Omit when targeting information is not available.
['US']; ['DE', 'JP']; ['US', 'GB']
threat.target.countries.names
string[]
experimental Names of the countries targeted by the adversary activity. Use the full English country name as provided by the source platform. Omit when targeting information is not available. It is recommended to normalize country values to ISO 3166 standard names; non-standard values may not be processed correctly by consumers of this field.
['United States of America']; ['Germany', 'Japan']; ['United States of America', 'United Kingdom of Great Britain and Northern Ireland']
threat.target.industries
string[]
experimental Names of the industry verticals targeted by the adversary activity. Use the sector name as provided by the source platform. Omit when targeting information is not available.
Fields identifying the malware families associated with the adversary activity described in the threat intelligence report. Populated from structured malware metadata provided by the source platform.
Attribute
Type
Description
Examples
threat.malware.families
string[]
experimental Names of the malware families observed or attributed in this report. Use the canonical family name as provided by the source platform. Omit when no malware family information is available.
Typed arrays of security observables (indicators of compromise) extracted from threat intelligence reports. Each field holds all values of a single observable type, deduplicated before ingestion. Field names follow STIX 2.0 Cyber Observable (SCO) type naming (for example, domain-name -> domains, ipv4-addr/ipv6-addr -> ips).
Attribute
Type
Description
Examples
threat.observables.cves
string[]
experimental CVE identifiers for vulnerabilities exploited or referenced in this report. Must use the canonical CVE-YYYY-NNNNN format. Deduplicate before ingestion.
experimental Domain names observed as indicators of compromise. Includes fully-qualified domain names (FQDNs) and bare domain names. Deduplicate before ingestion.
experimental Email addresses observed as indicators of compromise (for example, attacker C2 contact addresses or phishing sender addresses). Deduplicate before ingestion.
['c2@evil.com']
threat.observables.hashes.md5
string[]
experimental MD5 file hashes observed as indicators of compromise. Values must be lowercase hexadecimal strings. Deduplicate before ingestion.
experimental IPv4 and IPv6 addresses observed as indicators of compromise in this report. Include both IPv4 dotted-decimal and IPv6 colon-hex representations as provided by the source. Deduplicate before ingestion.
experimental Full URLs observed as indicators of compromise. Includes scheme, host, port, and path as provided by the source platform. Deduplicate before ingestion.
resourceexperimental Display name: TIBCO BusinessWorks CE application name
tibco.businessworks_ce.version
string
resourceexperimental Display name: TIBCO BusinessWorks CE version
Time correction
The time_correction namespace contains information on time corrections applied to the timestamps of an event, for example, start_time, timestamp or event.end.
Time corrections may be necessary if events are reported with timestamps that are completely off compared to cluster time. For example, Dynatrace RUM reported data can be off depending on client time.
Time correction fields
Attribute
Type
Description
Examples
time_correction.is_applied
boolean
experimental Display name: Time correction is applied If set to true, time correction has been applied to the event's timestamps.
false
time_correction.offset
long
experimental Display name: Time correction offset The offset (in nanoseconds) that is applied to all timestamp fields. The value may be negative.
127927969312
Timeframe
Timeframe fields
Attribute
Type
Description
Examples
end
timestamp
stable Display name: Timeframe end The end of the timeframe, exclusive.
12/13/2023, 12:57 PM
start
timestamp
stable Display name: Timeframe start The start of the timeframe, inclusive.
12/13/2023, 10:57 AM
TLS
TLS fields
Attribute
Type
Description
Examples
tls.cipher
string
experimental Display name: TLS cipher String indicating the cipher used during the current connection.
experimental The hostname sent by the client in the TLS Server Name Indication (SNI) extension of the ClientHello message. Represents the server the client intends to connect to at the TLS layer. In most cases, matches server.address (the HTTP Host header); when they differ, it may indicate H2 connection coalescing, certificate misconfiguration, or clients bypassing SNI-based routing rules.
api.example.com; www.example.com
tls.protocol.name
string
experimental Display name: TLS protocol name Normalized lowercase protocol name parsed from the original string of the negotiated SSL/TLS protocol version.
ssl; tls
tls.protocol.version
string
experimental Display name: TLS protocol version The numeric part of the version parsed from the original string of the negotiated SSL/TLS protocol version.
1.2; 3
Trace
Trace fields
Attribute
Type
Description
Examples
trace.alternate_id
uid
experimental Display name: Alternate trace ID The preserved trace ID when OneAgent and other tracing systems monitor the same process and the trace ID from the other tracing system was replaced by the OneAgent trace ID. The trace.alternate_id is a 16-byte ID and hex-encoded if shown as a string.
357bf70f3c617cb34584b31bd4616af8
trace.capture.reasons
string[]
experimental Display name: Capture reasons Explains why this trace was captured, multiple reasons can apply simultaneously. Note: The sampling approach ('atm' or 'fixed') is always placed at the first position in the array. These two values are mutually exclusive, though 'fixed' may appear with other capture triggers. Values: 'atm' (Dynatrace's intelligent sampling automatically adjusted trace capture based on traffic volume and system load), 'fixed' (trace captured due to configured percentage rules - either global settings or specific endpoint rules), 'custom' (trace captured because of custom correlation headers propagated between services or systems), 'mainframe' (trace originated from or includes IBM mainframe/z/OS components), 'serverless' (trace captured from serverless functions like AWS Lambda, Azure Functions, or similar platforms), 'rum' (trace initiated by user interactions in web browsers or mobile apps monitored by Dynatrace RUM agents).
stable Display name: Trace ID A unique identifier for a trace. The trace.id is a 16-byte ID and hex-encoded if shown as a string.
357bf70f3c617cb34584b31bd4616af8
trace.is_sampled
boolean
experimental Display name: Is sampled Flag indicating whether the trace was recorded. If set to true, the trace is recorded. If set to false, the trace is ignored.
true; false
trace.state
string
experimental Display name: Trace state The trace state in the w3c-trace-context format.
experimental Display name: URL port The URI port component.
443; 80
url.provider
string
experimental Display name: URL provider The provider type for the host name of url.full. This information is determined by Dynatrace RUM resource detection.
third_party
url.query
string
stable Display name: URL query The URI query component. Tags: sensitive-spans
q=OpenTelemetry
url.scheme
string
stable Display name: URL scheme The URI scheme component identifying the used protocol.
https; ftp; telnet
url.truncated_path
string
experimental Display name: Truncated URL path Truncated URI path component for endpoint detection of certain technologies that do not provide a http.route. The truncation logic depends on the technology and is a best effort to provide a stable value. Example Adobe Experience Manager (AEM): First two parts of url.path. Truncated value of /content/wknd/us/en/ is /content/wknd.
/docs
url.provider MUST be one of the following:
Value
Description
Display name
cdn
CDN (content delivery network).
CDN
first_party
First-party provider.
First Party
third_party
Third-party provider.
Third Party
User
User fields
Representation of a physical or logical user.
Attribute
Type
Description
Examples
user.email
string
stable Display name: User email Email of the user.
user@mail.com
user.id
string
stable Display name: User ID Unique UUID of a human user. If the system itself has to be represented, the constant 'system' is used.
35ba9499-f87c-4047-962c-14dc32e255e5; system
user.name
string
experimental Display name: User name Full name of the user. If the system itself has to be represented, the constant 'System' is used.
Wolfgang Amadeus Mozart; System
user.organization
string
experimental Display name: User organization Organization the user belongs to.
DYNATRACE; CUSTOMER; PARTNER
user.organization MUST be one of the following:
Value
Description
Display name
CUSTOMER
Customer organization
Customer
DYNATRACE
Dynatrace organization
Dynatrace
PARTNER
Dynatrace partner organization
Partner
user.organization MUST be one of the following:
Value
Description
DYNATRACE
Dynatrace organization
CUSTOMER
Customer organization
PARTNER
Dynatrace partner organization
User agent
User agent fields
Fields describing the HTTP User-Agent string. Applicable to any technology that processes HTTP requests (load balancers, CDNs, WAFs, web servers, API gateways).
Attribute
Type
Description
Examples
user_agent.original
string
stable The raw, unparsed User-Agent string as received in the HTTP User-Agent request header. Not scoped to browser clients—applicable to any HTTP client including browsers, SDKs, CLIs, bots, and services.
The vcs namespace contains information about Version Control Systems.
VCS fields
Attribute
Type
Description
Examples
vcs.change.id
string
experimental Display name: Change request ID The identifier of the change, for example, pull request ID or merge request ID. It is typically unique per repository and generated by the version control system itself.
1234
vcs.change.state
string
experimental Display name: Change request state The state of the change, for example, the state of a pull request or merge request.
wip; open; reopened; closed; merged
vcs.change.title
string
experimental Display name: Change request title The human-readable title of the change, for example, pull request title or merge request title.
CA-1234: Fix some stuff; [chore] update dependency
vcs.change.url.full
string
experimental Display name: Change request full URL The full URL to the change, for example, the full URL to the pull request or merge request.
experimental Display name: Line change type The type of line change being measured on a branch or change.
added; removed
vcs.ref.base.name
string
experimental Display name: Base reference name The name of the reference in the repository. This can be a branch name or a tag name. 1
my-branch-name
vcs.ref.base.revision
string
experimental Display name: Base reference revision The revision in the repository. For Git this is a synonym for a commit hash, whereas in SVN it is a revision number. 2
experimental Display name: Base reference type The reference type in the repository. 3
branch; tag
vcs.ref.head.name
string
experimental Display name: Head reference name The name of the reference in the repository. This can be a branch name or a tag name. 4
my-branch-name
vcs.ref.head.revision
string
experimental Display name: Head reference revision The revision in the repository. For Git, this is a synonym for a commit hash, whereas in SVN, it is a revision number. 5
experimental Display name: Head reference type The reference type in the repository. 6
branch; tag
vcs.ref.type
string
experimental Display name: Reference type The reference type in the repository.
branch; tag
vcs.repository.name
string
experimental Display name: Repository name The human-readable name of the repository. It should not include any additional identifiers like GitLab group or GitHub organization. 7
dynatrace-configuration-as-code
vcs.repository.url.full
string
experimental Display name: Repository full URL The repository's full URL. 8
experimental Display name: Revision delta direction The type of revision comparison.
ahead; behind
1
The base name refers to the starting point of a change. For example, if a feature branch was created from main,
main is the base reference of type branch.
2
The base revision refers to the starting revision of a change. For example, if a branch was created from a certain
commit, this commit is the base revision.
3
The base type refers to the reference type of the starting point of a change. For example,
if a feature branch was created from the main branch, branch is the base reference's type.
4
The head name refers to the current reference's name. For example,
if main is currently checked out, the head name is main.
5
The head revision refers to the currently referenced revision.
6
The head type refers to the currently referenced type in the repository. For example,
if the main branch is currently checked out, the head reference is of type branch.
7
Be aware that the repository name might clash with forked repositories.
8
For Git VCS, this should not include the .git URL suffix.
vcs.change.state has the following list of well-known values. If one of them applies, then the respective value MUST be used, otherwise a custom value MAY be used.
Value
Description
Display name
closed
The change was closed without being merged into the target code base.
Closed
merged
The change has successfully been merged into the target code base.
Merged
open
The change is open and ready for review or currently under review. It has not been merged yet, and changes are still possible.
Open
reopened
The change was re-opened after being closed and is ready for review again.
Reopened
wip
The change is still a work in progress and not yet ready for review.
Work In Progress
vcs.line_change.type has the following list of well-known values. If one of them applies, then the respective value MUST be used, otherwise a custom value MAY be used.
Value
Description
Display name
added
How many lines were added.
Added
removed
How many lines were removed.
Removed
vcs.ref.base.type has the following list of well-known values. If one of them applies, then the respective value MUST be used, otherwise a custom value MAY be used.
Value
Description
Display name
branch
The base reference type is a branch.
Branch
tag
The base reference type is a tag.
Tag
vcs.ref.head.type has the following list of well-known values. If one of them applies, then the respective value MUST be used, otherwise a custom value MAY be used.
Value
Description
Display name
branch
The head reference type is a branch.
Branch
tag
The head reference type is a tag.
Tag
vcs.ref.type has the following list of well-known values. If one of them applies, then the respective value MUST be used, otherwise a custom value MAY be used.
Value
Description
Display name
branch
The reference type is a branch.
Branch
tag
The reference type is a tag.
Tag
vcs.revision_delta.direction has the following list of well-known values. If one of them applies, then the respective value MUST be used, otherwise a custom value MAY be used.
Value
Description
Display name
ahead
How many revisions the change is ahead of the target ref.
Ahead
behind
How many revisions the change is behind of the target ref.
Behind
VMware
VMware fields
Fields that can come from applications running on VMware.
Attribute
Type
Description
Examples
vmware.datacenter.name
string
resourceexperimental Display name: VMware datacenter name The name of the data center in which the hypervisor is running.
srvwasapp1Cell01
vmware.disk.name
string
resourceexperimental Display name: VMware disk name ESXi host disk.
srvwasapp1Cell01
vmware.hypervisor.name
string
resourceexperimental Display name: VMware hypervisor name ESXi host.
my-hypervisor.lab.dynatrace.org
vmware.nic.name
string
resourceexperimental Display name: VMware nic name ESXi host network interface.
vmnic0; vmnic1; vmnic2
vmware.vcenter.name
string
resourceexperimental Display name: VMware vcenter name Name of the VMware vCenter server managing the multi-hypervisor environment.
my-vcenter.lab.dynatrace.org
vmware.vm.name
string
resourceexperimental Display name: VMware vm name The name of the virtual machine.
easytravel-demo
Vulnerability
Vulnerability fields
Attribute
Type
Description
Examples
vulnerability.code_location.name
string
stable Display name: Vulnerability code location name Name of the code location where the code-level vulnerability was detected.
stable Display name: Vulnerability parent vulnerable function status Usage status of vulnerable functions causing the vulnerability. Status is IN_USE when there's at least one vulnerable function in use by an application.
IN_USE; NOT_AVAILABLE; NOT_IN_USE
vulnerability.parent.first_seen
string
stable Display name: Vulnerability parent first seen Timestamp of when the vulnerability was first detected.
2023-03-22T13:19:36.945Z
vulnerability.parent.mute.change_date
timestamp
stable Display name: Vulnerability parent mute change date Timestamp of the last mute or unmute action of the vulnerability.
2023-03-22T13:19:36.945Z
vulnerability.parent.mute.reason
string
stable Display name: Vulnerability parent mute reason Reason for muting or unmuting the vulnerability.
FALSE_POSITIVE; IGNORE; AFFECTED; CONFIGURATION_NOT_AFFECTED; OTHER
vulnerability.parent.mute.status
string
stable Display name: Vulnerability parent mute status Vulnerability's mute status.
MUTED; NOT_MUTED
vulnerability.parent.mute.user
string
stable Display name: Vulnerability parent mute user User who last changed the vulnerability's mute status.
user@example.com
vulnerability.parent.resolution.change_date
string
stable Display name: Vulnerability parent resolution change date Timestamp of the vulnerability's last resolution status change.
2023-03-22T13:19:37.466Z
vulnerability.parent.resolution.status
string
stable Display name: Vulnerability parent resolution status Current status of the vulnerability.
OPEN; RESOLVED
vulnerability.parent.risk.level
string
stable Display name: Vulnerability parent risk level Vulnerability's risk score level defined by the provider. For Dynatrace, the Davis Security Score level.
LOW; MEDIUM; HIGH; CRITICAL; NONE
vulnerability.parent.risk.score
double
stable Display name: Vulnerability parent risk score Vulnerability's risk score defined by the provider. For Dynatrace, Davis Security Score.
8.1
vulnerability.previous.cvss.base_score
double
stable Display name: Vulnerability previous CVSS base score Vulnerability's previous CVSS base score (in case the CVSS base score has changed).
stable Display name: Vulnerability previous data assets status Vulnerability's previous reachability of related data assets by affected entities (in case the reachability has changed).
stable Display name: Vulnerability previous exploit status Vulnerability's previous public exploit status (in case the public exploit status has changed).
stable Display name: Vulnerability previous exposure status Vulnerability's previous internet exposure status (in case the internet exposure status has changed).
stable Display name: Vulnerability previous Davis security level Vulnerability's previous risk level (in case the risk level has changed).
LOW; MEDIUM; HIGH; CRITICAL; NONE
vulnerability.previous.davis_assessment.score
double
stable Display name: Vulnerability previous Davis security score Vulnerability's previous Davis Security Score (in case Davis Security Score has changed).
stable Display name: Vulnerability previous vulnerable function status Vulnerability's previous vulnerable function status (in case the vulnerable function status has changed).
IN_USE; NOT_AVAILABLE; NOT_IN_USE
vulnerability.previous.external_id
string
experimental Display name: Vulnerability previous external ID Vulnerability’s unique identifier from the previous external provider.
SNYK-JAVA-ORGAPACHEHTTPCOMPONENTS-30646
vulnerability.previous.mute.change_date
string
stable Display name: Vulnerability previous mute change date Timestamp of the vulnerability's previous mute status (in case the mute status has changed).
2023-03-22T13:19:36.945Z
vulnerability.previous.mute.comment
string
experimental Display name: Vulnerability previous mute comment Comment of the vulnerability's previous mute status.
Muted because it's a false positive.
vulnerability.previous.mute.reason
string
stable Display name: Vulnerability previous mute reason Reason for last muting or unmuting the vulnerability (in case the reason for muting or unmuting the vulnerability has changed).
Muted: False positive
vulnerability.previous.mute.status
string
stable Display name: Vulnerability previous mute status Vulnerability's previous mute status (in case the mute status has changed).
MUTED; NOT_MUTED
vulnerability.previous.mute.user
string
stable Display name: Vulnerability previous mute user User who last changed the vulnerability's mute status (in case the mute status was last changed by a different user).
user@example.com
vulnerability.previous.resolution.status
string
stable Display name: Vulnerability previous resolution status Vulnerability's previous resolution status (in case the resolution status has changed).
OPEN; RESOLVED
vulnerability.previous.risk.level
string
stable Display name: Vulnerability previous risk level Vulnerability's previous risk score level (in case the risk score level has changed).
LOW; MEDIUM; HIGH; CRITICAL
vulnerability.previous.risk.score
double
stable Display name: Vulnerability previous risk score Vulnerability's previous risk score (in case the risk score has changed).
8.1
vulnerability.references.cve
string[]
stable Display name: Vulnerability CVE references List of the vulnerability's CVE IDs.
['CVE-2021-41079']
vulnerability.references.cwe
string[]
stable Display name: Vulnerability CWE references List of the vulnerability's CWE IDs.
['CWE-20']
vulnerability.references.owasp
string[]
stable Display name: Vulnerability OWASP references List of vulnerability's OWASP IDs.
['2021:A3']
vulnerability.remediation.description
string
experimental Display name: Vulnerability remediation description Description of the vulnerability's remediation advice.
Upgrade component to version 1.2.3 or higher
vulnerability.remediation.status
string
experimental Display name: Vulnerability remediation status Indicates whether a fix for the vulnerability is available.
AVAILABLE; NOT_AVAILABLE
vulnerability.resolution.change_date
timestamp
stable Display name: Vulnerability resolution change date Timestamp of the vulnerability's last resolution status change.
2023-03-22T13:19:37.466Z
vulnerability.resolution.status
string
stable Display name: Vulnerability resolution status Vulnerability's resolution status.
OPEN; RESOLVED
vulnerability.risk.level
string
stable Display name: Vulnerability risk level Vulnerability's risk score level defined by the provider. For Dynatrace, the Davis Security Score level.
LOW; MEDIUM; HIGH; CRITICAL; NONE
vulnerability.risk.scale
string
stable Display name: Vulnerability risk scale Scale by which the vulnerability's risk score and risk score level defined by the provider are measured.
Davis Security Score
vulnerability.risk.score
double
stable Display name: Vulnerability risk score Vulnerability's risk score defined by the provider. For Dynatrace, Davis Security Score.
8.1
vulnerability.stack
string
experimental Display name: Vulnerability stack Level of the vulnerable component in the technological stack.
stable Display name: Vulnerability technology Technology of the vulnerable component.
JAVA; DOTNET; GO; PHP; NODE_JS
vulnerability.title
string
stable Display name: Vulnerability title Title of the vulnerability.
Improper Input Validation
vulnerability.type
string
stable Display name: Vulnerability type Classification of the vulnerability based on commonly accepted enums, such as CWE.
Improper Input Validation
vulnerability.url
string
stable Display name: Vulnerability URL Dynatrace URL to the details page of the vulnerability. |
https://example.com
vulnerability.davis_assessment.assessment_mode has the following list of well-known values. If one of them applies, then the respective value MUST be used, otherwise a custom value MAY be used.
Value
Description
Display name
FULL
full
Full
NOT_AVAILABLE
not_available
Not Available
REDUCED
reduced
Reduced
vulnerability.davis_assessment.data_assets_status has the following list of well-known values. If one of them applies, then the respective value MUST be used, otherwise a custom value MAY be used.
Value
Description
Display name
NOT_AVAILABLE
not_available
Not Available
NOT_DETECTED
not_detected
Not Detected
REACHABLE
reachable
Reachable
vulnerability.davis_assessment.exploit_status has the following list of well-known values. If one of them applies, then the respective value MUST be used, otherwise a custom value MAY be used.
Value
Description
Display name
AVAILABLE
available
Available
NOT_AVAILABLE
not_available
Not Available
vulnerability.davis_assessment.exposure_status has the following list of well-known values. If one of them applies, then the respective value MUST be used, otherwise a custom value MAY be used.
Value
Description
Display name
ADJACENT_NETWORK
adjacent_network
Adjacent Network
NOT_AVAILABLE
not_available
Not Available
NOT_DETECTED
not_detected
Not Detected
PUBLIC_NETWORK
public_network
Public Network
vulnerability.davis_assessment.level has the following list of well-known values. If one of them applies, then the respective value MUST be used, otherwise a custom value MAY be used.
Value
Description
Display name
CRITICAL
critical
Critical
HIGH
high
High
LOW
low
Low
MEDIUM
medium
Medium
NONE
none
No risk
vulnerability.davis_assessment.vulnerable_function_status has the following list of well-known values. If one of them applies, then the respective value MUST be used, otherwise a custom value MAY be used.
Value
Description
Display name
IN_USE
in_use
In Use
NOT_AVAILABLE
not_available
Not Available
NOT_IN_USE
not_in_use
Not In Use
vulnerability.mute.reason has the following list of well-known values. If one of them applies, then the respective value MUST be used, otherwise a custom value MAY be used.
Value
Description
Display name
AFFECTED
affected
Affected
CONFIGURATION_NOT_AFFECTED
configuration_not_affected
Configuration Not Affected
FALSE_POSITIVE
false_positive
False Positive
IGNORE
ignore
Ignore
OTHER
other
Other
vulnerability.mute.status has the following list of well-known values. If one of them applies, then the respective value MUST be used, otherwise a custom value MAY be used.
Value
Description
Display name
MUTED
muted
Muted
NOT_MUTED
not_muted
Not Muted
vulnerability.parent.davis_assessment.assessment_mode has the following list of well-known values. If one of them applies, then the respective value MUST be used, otherwise a custom value MAY be used.
Value
Description
Display name
FULL
full
Full
NOT_AVAILABLE
not_available
Not Available
REDUCED
reduced
Reduced
vulnerability.parent.davis_assessment.data_assets_status has the following list of well-known values. If one of them applies, then the respective value MUST be used, otherwise a custom value MAY be used.
Value
Description
Display name
NOT_AVAILABLE
not_available
Not Available
NOT_DETECTED
not_detected
Not Detected
REACHABLE
reachable
Reachable
vulnerability.parent.davis_assessment.exposure_status has the following list of well-known values. If one of them applies, then the respective value MUST be used, otherwise a custom value MAY be used.
Value
Description
Display name
ADJACENT_NETWORK
adjacent_network
Adjacent Network
NOT_AVAILABLE
not_available
Not Available
NOT_DETECTED
not_detected
Not Detected
PUBLIC_NETWORK
public_network
Public Network
vulnerability.parent.davis_assessment.level has the following list of well-known values. If one of them applies, then the respective value MUST be used, otherwise a custom value MAY be used.
Value
Description
Display name
CRITICAL
critical
Critical
HIGH
high
High
LOW
low
Low
MEDIUM
medium
Medium
NONE
none
No risk
vulnerability.parent.davis_assessment.vulnerable_function_status has the following list of well-known values. If one of them applies, then the respective value MUST be used, otherwise a custom value MAY be used.
Value
Description
Display name
IN_USE
in_use
In Use
NOT_AVAILABLE
not_available
Not Available
NOT_IN_USE
not_in_use
Not In Use
vulnerability.parent.mute.reason has the following list of well-known values. If one of them applies, then the respective value MUST be used, otherwise a custom value MAY be used.
Value
Description
Display name
AFFECTED
affected
Affected
CONFIGURATION_NOT_AFFECTED
configuration_not_affected
Configuration Not Affected
FALSE_POSITIVE
false_positive
False Positive
IGNORE
ignore
Ignore
OTHER
other
Other
vulnerability.parent.mute.status has the following list of well-known values. If one of them applies, then the respective value MUST be used, otherwise a custom value MAY be used.
Value
Description
Display name
MUTED
muted
Muted
NOT_MUTED
not_muted
Not Muted
vulnerability.parent.resolution.status has the following list of well-known values. If one of them applies, then the respective value MUST be used, otherwise a custom value MAY be used.
Value
Description
Display name
OPEN
open
Open
RESOLVED
resolved
Resolved
vulnerability.parent.risk.level has the following list of well-known values. If one of them applies, then the respective value MUST be used, otherwise a custom value MAY be used.
Value
Description
Display name
CRITICAL
critical
Critical
HIGH
high
High
LOW
low
Low
MEDIUM
medium
Medium
NONE
none
No risk
vulnerability.previous.davis_assessment.data_assets_status has the following list of well-known values. If one of them applies, then the respective value MUST be used, otherwise a custom value MAY be used.
Value
Description
Display name
NOT_AVAILABLE
not_available
Not Available
NOT_DETECTED
not_detected
Not Detected
REACHABLE
reachable
Reachable
vulnerability.previous.davis_assessment.exploit_status has the following list of well-known values. If one of them applies, then the respective value MUST be used, otherwise a custom value MAY be used.
Value
Description
Display name
AVAILABLE
available
Available
NOT_AVAILABLE
not_available
Not Available
vulnerability.previous.davis_assessment.exposure_status has the following list of well-known values. If one of them applies, then the respective value MUST be used, otherwise a custom value MAY be used.
Value
Description
Display name
ADJACENT_NETWORK
adjacent_network
Adjacent Network
NOT_AVAILABLE
not_available
Not Available
NOT_DETECTED
not_detected
Not Detected
PUBLIC_NETWORK
public_network
Public Network
vulnerability.previous.davis_assessment.level has the following list of well-known values. If one of them applies, then the respective value MUST be used, otherwise a custom value MAY be used.
Value
Description
Display name
CRITICAL
critical
Critical
HIGH
high
High
LOW
low
Low
MEDIUM
medium
Medium
NONE
none
No risk
vulnerability.previous.davis_assessment.vulnerable_function_status has the following list of well-known values. If one of them applies, then the respective value MUST be used, otherwise a custom value MAY be used.
Value
Description
Display name
IN_USE
in_use
In Use
NOT_AVAILABLE
not_available
Not Available
NOT_IN_USE
not_in_use
Not In Use
vulnerability.previous.mute.status has the following list of well-known values. If one of them applies, then the respective value MUST be used, otherwise a custom value MAY be used.
Value
Description
Display name
MUTED
muted
Muted
NOT_MUTED
not_muted
Not Muted
vulnerability.previous.resolution.status has the following list of well-known values. If one of them applies, then the respective value MUST be used, otherwise a custom value MAY be used.
Value
Description
Display name
OPEN
open
Open
RESOLVED
resolved
Resolved
vulnerability.previous.risk.level has the following list of well-known values. If one of them applies, then the respective value MUST be used, otherwise a custom value MAY be used.
Value
Description
Display name
CRITICAL
critical
Critical
HIGH
high
High
LOW
low
Low
MEDIUM
medium
Medium
NONE
none
No risk
vulnerability.resolution.status has the following list of well-known values. If one of them applies, then the respective value MUST be used, otherwise a custom value MAY be used.
Value
Description
Display name
OPEN
open
Open
RESOLVED
resolved
Resolved
vulnerability.risk.level has the following list of well-known values. If one of them applies, then the respective value MUST be used, otherwise a custom value MAY be used.
Value
Description
Display name
CRITICAL
critical
Critical
HIGH
high
High
LOW
low
Low
MEDIUM
medium
Medium
NONE
none
No risk
vulnerability.stack has the following list of well-known values. If one of them applies, then the respective value MUST be used, otherwise a custom value MAY be used.
Value
Description
Display name
CODE
code
Code
CODE_LIBRARY
code_library
Code Library
CONTAINER_ORCHESTRATION
container_orchestration
Container Orchestration
SOFTWARE
software
Software
vulnerability.technology has the following list of well-known values. If one of them applies, then the respective value MUST be used, otherwise a custom value MAY be used.
Value
Description
Display name
DOTNET
dotnet
.NET
GO
go
Go
JAVA
java
Java
NODE_JS
node_js
Node.js
PHP
php
PHP
WebLogic
WebLogic fields
Attribute
Type
Description
Examples
weblogic.cluster.name
string
resourceexperimental Display name: WebLogic cluster name The name of the cluster this instance belongs to.
OrderManagement2
weblogic.domain.name
string
resourceexperimental Display name: WebLogic domain name The name of the domain this instance belongs to.
CustomerManagementFulfillmentSvc
weblogic.home
string
resourceexperimental Display name: WebLogic home directory The instance's home directory.
resourceexperimental Display name: WebLogic server name The instance's server name.
OrderManagement2Srv1
Websocket
The WebSocket namespace contains information on WebSocket attributes for user events. When this namespace is used, the request fields (URL and network namespace) must also be used, and url.full and network.protocol.name must be set.
WebSocket fields
Attribute
Type
Description
Examples
websocket.connection.status_code
long
experimental Display name: Websocket connection status code The WebSocket connection status code.
1001
WebSphere
WebSphere fields
Attribute
Type
Description
Examples
websphere.cell.name
string
resourceexperimental Display name: WebSphere cell name The name of the cell this instance belongs to.
srvwasapp1Cell01
websphere.cluster.name
string
resourceexperimental Display name: WebSphere cluster name The name of the cluster this instance belongs to.
CluApp1
websphere.node.name
string
resourceexperimental Display name: WebSphere node name Name of the node to which this instance belongs.
nodeSrvApp2
websphere.server.name
string
resourceexperimental Display name: WebSphere server name The instance's server name.
SrvApp2
WebSphere Liberty
WebSphere Liberty fields
Attribute
Type
Description
Examples
websphere_liberty.server.name
string
resourceexperimental Display name: WebSphere liberty server name The instance's server name.
defaultServer
Windows Event Log (Winlog)
Winlog fields
Attribute
Type
Description
Examples
winlog.eventid
long
experimental Display name: Event Log Event ID Event ID is a unique identifier assigned to each event logged by the system. Each event ID corresponds to a specific type of event, such as an error, warning, or informational message. (4624 -> successful logon, 1000 -> application error)
4624; 1000
winlog.keywords
string
experimental Display name: Event Log Keywords Keywords are used to categorize and group events. This categorization allows to quickly identify and focus on specific types of events that are relevant to your troubleshooting or monitoring needs.
Classic; Started
winlog.level
string
experimental Display name: Event Log Level Level of an event indicates its severity or importance
Critical; Error; Warrning
winlog.opcode
string
experimental Display name: Event Log Opcode Opcode is a value that identifies a specific activity or a point within an activity that the application was performing when it raised the event. This helps in understanding the context of the event more precisely.
Info; Download
winlog.provider
string
experimental Display name: Event Log Provider Provider is a component or service that generates events. Providers are responsible for writing specific types of events to the event logs, such as application errors, security events, or system warnings.
Avecto Service; Security-SPP
winlog.task
long
experimental Display name: Event Log Task Task refers to the specific operation or activity that an event is associated with. Each event is categorized under a task, which helps in identifying what the system or application was doing when the event was logged. This can be particularly useful for troubleshooting and understanding the context of the event. (5 -> HTTP Configuration Property Trace Task, 12804 -> Other Object Access Events)
5; 12804
winlog.username
string
experimental Display name: Event Log Username Username refers to the account name associated with specific events, such as logon or logoff activities. This is particularly useful for tracking user activity and identifying who was logged into the system at a given time.
SYSTEM; N/A
z/OS
z/OS fields
Attribute
Type
Description
Examples
cics.transaction.system_id
string
resourceexperimental Display name: CICS transaction system ID The system ID of the CICS region that this transaction executed on.
C259; CICS
zos.address_space_id
long
resourceexperimental Display name: z/OS address space ID The address space identifier (ASID) of the z/OS address space.
1; 296
zos.cpu_model_number
string
resourceexperimental Display name: z/OS CPU model number The model number of the CPU assigned to this LPAR.
8562; 3931
zos.cpu_serial_number
string
resourceexperimental Display name: z/OS CPU serial number The serial number of the CPU assigned to this LPAR.
054BB88562; 15D77D2084
zos.job_id
string
resourceexperimental Display name: z/OS job ID The job ID of the z/OS address space.
JOB12345
zos.job_name
string
resourceexperimental Display name: z/OS job name The jobname of the z/OS address space.
CICSAOR0; CTGATM00; IMSCR15
zos.job_step_id
string
resourceexperimental Display name: z/OS job step ID The step ID within the job within the z/OS address space.
00000001; 00000002
zos.lpar_name
string
resourceexperimental Display name: z/OS lpar name The name of the LPAR that the z/OS address space executes within.
S0W1; ABCD
zos.sys_id
string
resourceexperimental Display name: z/OS system ID The system ID of the CICS/IMS address space.
C259; CICS; IMSF
zos.system_name
string
resourceexperimental Display name: Z/os system name The name of the z/OS system instance.
S0W1; ABCD
zos.total_general_purpose_processors
long
resourceexperimental Display name: z/OS total general purpose processors The number of general purpose processors (GCPs) assigned for this LPAR.
1; 190
zos.total_physical_memory
long
resourceexperimental Display name: z/OS total physical memory The total amount of memory, in terabytes, assigned for this LPAR.
1; 16
zos.total_ziip_processors
long
resourceexperimental Display name: z/OS total ziip processors The number of zIIPs assigned for this LPAR.
0; 8
zos.transaction.job_name
string
resourceexperimental Display name: z/OS transaction job name The jobname of the z/OS address space that the transaction executed in.
CICSAOR0; CTGATM00; IMSCR15
zos.transaction.lpar_name
string
resourceexperimental Display name: z/OS transaction lpar name The name of the LPAR that the transaction executed on.
S0W1; ABCD
zos.virtualization
string
resourceexperimental Display name: z/OS virtualization Type of virtualization on the mainframe.
LPAR
z/OS transaction fields
Attribute
Type
Description
Examples
zos.transaction.call_type
string
experimental Display name: Transaction call type The type of transaction call that was invoked.
CTG
zos.transaction.id
string
experimental Display name: Transaction ID The ID of this transaction.
CEMT; DTAX; IVTNO
zos.transaction.program_type
string
experimental Display name: Transaction program type The type of transaction that was executed.
DLI_DB; DLI_DC; MQ; DB2
zos.transaction.call_type MUST be one of the following:
Value
Description
Display name
CTG
A CTG request triggered this transaction.
CTG
DPL
A CICS DPL request triggered this transaction.
DPL
HTTP
An HTTP or HTTPS request triggered this transaction.
HTTP
IMS_CONNECT
An IMS Connect request triggered this transaction.
IMS Connect
IMS_CONNECT_API
An IMS Connect API request triggered this transaction.
IMS Connect API
IMS_TRANS_EXEC
The application program being scheduled and running to handle this transaction.
IMS transaction execute
ITRA
An IMS TM Resource Adapter request triggered this transaction.
ITRA
MQ
An MQ operation triggered this transaction.
MQ
MSC
An IMS MSC request triggered this transaction.
MSC
PGM_SWITCH
An IMS Program Switch request triggered this transaction.
Program switch
SDK
An SDK call triggered this transaction.
SDK
SHARED_QUEUE
An IMS Shared Queue request triggered this transaction.
Shared queue
SOAP
A SOAP request triggered this transaction.
SOAP
START
An EXEC CICS START triggered this transaction.
START
TTX
A green screen terminal transaction code triggered this transaction.
TTX
TX
A CICS or IMS transaction code triggered this transaction.
TX
ZOS_CONNECT
A z/OS Connect request triggered this transaction.
z/OS Connect
zos.transaction.program_type MUST be one of the following:
Value
Description
Display name
DB2
The transaction performs DB2 database actions.
DB2
DLI_DB
The transaction performs DLI database actions.
DLI database
DLI_DC
The transaction performs DLI data communications actions.
DLI data communications
MQ
The transaction performs MQ Queue actions.
MQ
CICS transaction fields
Attribute
Type
Description
Examples
cics.transaction.class_name
string
experimental Display name: CICS class name The name of the transaction class of this transaction.
null; DFHTCL00
cics.transaction.client.ip
ipAddress
experimental Display name: CICS client IP IP address of the client (IPv4 or IPv6) that made the request that triggered the transaction.
194.232.104.141; 2a01:468:1000:9::140
cics.transaction.client.port
long
experimental Display name: CICS client port Port number of the client that made the request that triggered the transaction.
65123; 80
cics.transaction.path.name
string
experimental Display name: CICS path name The path name, only applicable for web requests.
/dtrouter
cics.transaction.task_id
long
experimental Display name: CICS task ID The CICS task ID of this transaction.
1234
cics.transaction.transaction_group_id
string
experimental Display name: CICS transaction group ID The transaction group ID assigned at transaction attach time.
experimental Display name: CICS unit of work ID The unit of work ID for this transaction, which is normally represented as a hex value.
15977055984148641282; 15977055491352760323
cics.transaction.user_id
string
experimental Display name: CICS user ID The user ID of the user who triggered this transaction.
USER1; anon
cics.transaction.wlm.reporting_service_class_name
string
experimental Display name: CICS WLM reporting service class name The name of the z/OS Workload Manager (WLM) reporting service class of this transaction.
null; BAT_ATM; RC_CICS
cics.transaction.wlm.service_class_name
string
experimental Display name: CICS WLM service class name The name of the z/OS Workload Manager (WLM) service class of this transaction.
null; SYSSTC; VEL15I5
CICS file fields
Attribute
Type
Description
Examples
cics.file.defining_region_name
string
experimental Display name: CICS file defining region name The system ID of the CICS region that is defined on the request.
C259; CICS
cics.file.is_local
boolean
experimental Display name: CICS file is local A boolean that is true if the file is defined within the CICS region that it executed in.
true
cics.file_name
string
experimental Display name: CICS file name The logical name of the file, as defined in CEDA.
EXMPCAT; CICSFILE
IMS transaction fields
Attribute
Type
Description
Examples
ims.message.transaction.message.segment_count
long
experimental Display name: IMS message segment count The number of segments in the message.
1; 5
ims.message.transaction.message.size
long
experimental Display name: IMS message size The size of the message.
10; 421
ims.message.transaction.terminal_name
string
experimental Display name: IMS terminal name The terminal name that this IMS transaction executed on.
HWSAM5ZD; 10505
ims.message.transaction.unit_of_work_id
long
experimental Display name: IMS message unit of work ID The unit of work ID for this transaction, which is normally represented as a hex value.
experimental Display name: IMS Connect transaction client IP IP address of the client (IPv4 or IPv6) that made the request that triggered the transaction.
194.232.104.141; 2a01:468:1000:9::140
ims.connect.transaction.server.port
long
experimental Display name: IMS Connect transaction server port Port number on the IMS Connect server that received the request for this transaction
65123; 80
ims.connect.transaction.user_id
string
experimental Display name: IMS Connect user ID The user ID of the user who triggered this transaction.
experimental Display name: IMS tm resource adapter semantic detection version The detection version for this transaction.
1
ims.tm.resource.adapter.transaction.client.ip
ipAddress
experimental Display name: IMS tm resource adapter transaction client IP IP address of the client (IPv4 or IPv6) that made the request that triggered the transaction.
194.232.104.141; 2a01:468:1000:9::140
ims.tm.resource.adapter.transaction.client.port
long
experimental Display name: IMS tm resource adapter transaction client port Port number of the client that made the request that triggered the transaction.
65123; 80
ims.tm.resource.adapter.transaction.commit_mode
long
experimental Display name: IMS tm resource adapter transaction commit mode The commit mode of the transaction.
experimental Display name: IMS tm resource adapter transaction interaction verb The interaction verb that triggered the transaction.
0
ims.tm.resource.adapter.transaction.lpar_name
string
experimental Display name: IMS tm resource adapter transaction lpar name The name of the LPAR that the transaction executed on.
S0W1; ABCD
ims.tm.resource.adapter.transaction.sync_level
long
experimental Display name: IMS tm resource adapter transaction sync level Indicates the synchronization level of the transaction. This only applies when the interaction verb is set to "SYNC_SEND_RECEIVE", "SYNC_SEND", or "SYNC_RECEIVE_CALLOUT". This attribute applies to both conversational and non-conversational applications. It is used in conjuction with the ims.transaction.request.transaction.commit_mode attribute.
0
ims.tm.resource.adapter.transaction.commit_mode MUST be one of the following:
Value
Description
Display name
0
The commit happens before sending the response.
Commit then send
1
The commit is deferred until the response has been sent and acknowledged.
Send then commit
ims.tm.resource.adapter.transaction.interaction_verb MUST be one of the following:
Value
Description
Display name
0
SYNC_SEND
SYNC_SEND
1
SYNC_SEND_RECEIVE
SYNC_SEND_RECEIVE
3
SYNC_END_CONVERSATION
SYNC_END_CONVERSATION
4
SYNC_RECEIVE_ASYNCOUTPUT
SYNC_RECEIVE_ASYNCOUTPUT
5
SYNC_RECEIVE_ASYNCOUTPUT_SINGLE_NOWAIT
SYNC_RECEIVE_ASYNCOUTPUT_SINGLE_NOWAIT
6
SYNC_RECEIVE_ASYNCOUTPUT_SINGLE_WAIT
SYNC_RECEIVE_ASYNCOUTPUT_SINGLE_WAIT
7
SYNC_RECEIVE_CALLOUT
SYNC_RECEIVE_CALLOUT
ims.tm.resource.adapter.transaction.sync_level MUST be one of the following:
Value
Description
Display name
0
There will be no synchronization.
No synchronization
1
Synchronization will be confirmed.
Confirm
z/OS Connect
z/OS Connect fields
Attribute
Type
Description
Examples
zosconnect.api.description
string
experimental Display name: API description The z/OS Connect API description.
The API for the CICS catalog manager sample application.
zosconnect.api.name
string
experimental Display name: API name The z/OS Connect API name.
catalog
zosconnect.api.version
string
experimental Display name: API version The z/OS Connect API version.
1.0.0
zosconnect.request.body.size
long
experimental Display name: Request body size The size of the request payload in bytes.
234
zosconnect.request.id
long
experimental Display name: Request ID The z/OS Connect request ID.
2215
zosconnect.request.type
string
experimental Display name: Request type The type of the REST request. 1
ADMIN
zosconnect.response.body.size
long
experimental Display name: Response body size The size of the response payload in bytes.
125
zosconnect.service.description
string
experimental Display name: Service description The z/OS Connect service description.
EDUCHAN service using the CICS Service Provider
zosconnect.service.name
string
experimental Display name: Service name The z/OS Connect service name.
placeOrder
zosconnect.service.provider.name
string
experimental Display name: Service provider name The service provider name.
CICS-1.0
zosconnect.service.version
string
experimental Display name: Service version The z/OS Connect service version.
2.0
zosconnect.sor.identifier
string
experimental Display name: System of record identifier The system of record identifier. The format differs depending on the SOR type. 2
localhost:8080
zosconnect.sor.reference
string
experimental Display name: System of record reference The system of record reference.
cicsConn
zosconnect.sor.resource
string
experimental Display name: System of record resource Identifier for the resource invoked on the system of record. The format differs depending on the SOR type. 3
01,DFH0XCMN
zosconnect.sor.type
string
experimental Display name: System of record type The system of record type.