Smartscape - Core entities

Latest Dynatrace
Reference
Published May 07, 2026

Contains entity definitions for core infrastructure entities stored in Smartscape on Grail, including hosts, processes, services, containers, disks, frontends, network interfaces, and OS services.

Query

Get all HOST, PROCESS, SERVICE and CONTAINER entities.

smartscapeNodes {HOST, PROCESS, SERVICE, CONTAINER}

Container

Smartscape node name: container.name

Smartscape node type: CONTAINER

A container entity. Provides the core container fields plus potentially additional platform specific fields.

Query

Load all container entities from Smartscape and get their names.

smartscapeNodes CONTAINER
| fields name

Get all hosts that run containers in the "travel-advisor-demo" namespace.

smartscapeNodes CONTAINER
| filter k8s.namespace.name == "travel-advisor-demo"
| traverse runs_on, HOST

Get all containers with their IDs, names, namespace names, and Kubernetes labels.

smartscapeNodes CONTAINER
| fields id, name, k8s.namespace.name, k8s_labels = getNodeField(references[belongs_to.k8s_namespace][0], "tags:k8s.labels")

Base entity fields

The following base fields are used for all entities.

Attribute	Type	Description	Examples
`id`	smartscapeId	stable Display name: `ID` A Smartscape ID consists of two components: an UPPER_CASE entity type and a random 16-character hexadecimal unique identifier, separated by a dash. Use Smartscape conversion functions when working with strings that represent Smartscape IDs.	`<type>-017198AD253CBD63`
`id_classic`	string	deprecated Display name: `Classic ID` The entity ID that was used in the classic entity store. This ID is present in old monitoring data. Not all entities have this ID, and it is not generated for new entities. Use the `id` field instead, which is the Smartscape ID.	`<type>-017198AD253CBD63`
`name`	string	stable Display name: `Name` The entity name.	`localhost`; `easyTravel`; `product-catalog`
`type`	string	stable Display name: `Type` The entity type. UPPER_SNAKE_CASE string that represents the type of the entity. Tags: `permission`	`TYPE_A`
`tags`	record	stable Display name: `Tags` A consolidated record that aggregates all tag values originating from different contexts. Each nested field within tags represents a specific key (for example, `release` or `name`). The value of each nested field is the tag value from one or multiple contexts. Tags for specific context can be queried via `tags:context` field. Note that rule-based tags do not exist in the new model.	`tags[tag_key-1] = [context_A_tag_val-1, context_B_tag_val-1]`; `tags[tag_key-2] = context_C_tag_val-1`; `tags:context_A[tag_key-1] = context_A_tag_val-1`
`lifetime`	timeframe	stable Display name: `Lifetime` The lifetime of the entity. This is a record with two nested fields: `start` and `end`, which represent the time when the entity was first and last observed, respectively. Each time an entity is updated, the end time is updated to the current time.	`{ start: 2022-07-06T13:36:00.808Z, end: 2024-04-11T06:56:01.204Z }`
`references`	record	stable Display name: `References` Provides access to static edges pointing to other entities. In this record each nested field represents a relationship type and target type, and the value is an array of target Smartscape IDs. This field is hidden by default but can be added using the fieldsAdd command.	`{ references[runs_on.host] : [HOST-C251A1173C2B4B39,HOST-0E9038C7C4409D69], references[runs_on.container] : [CONTAINER-68A08967EF4F675B] }`
`dt.security_context`	string[]	resource stable Display name: `DT security context` The security contexts associated with the entity. For Smartscape entities, this field is always an array. Tags: `permission`	`[]`

Container fields

Attribute	Type	Description	Examples
`container.image.name`	string	resource experimental Display name: `Container image name` Name of the image the container was built on.	`gcr.io/opentelemetry/operator`
`container.image.version`	string	resource experimental Display name: `Container image version` Version of the image the container was created from.	`0.1`
`container.image.digest`	string	resource experimental Display name: `Container image digest` Immutable SHA-256 hash of an image that uniquely identifies the exact image content in a registry.	`sha256:aa1ed41571fa937da61b5bcd7cf842981c7f026b516c18655bc2f3a9362b1fa5`
`container.id`	string	resource experimental Display name: `Container ID` Container ID. Usually a UUID, as for example used to identify Docker containers. The UUID might be abbreviated.	`a3bf90e006b2`
`container.runtime.name`	string	resource experimental Display name: `Container runtime name` Runtime used to run the container.	`boshbpm`

container.runtime.name has the following list of well-known values. If one of them applies, then the respective value MUST be used, otherwise a custom value MAY be used.

Value	Description	Display name
`boshbpm`	BOSH Process Manager container runtime, used in Cloud Foundry.	BOSH Process Manager
`containerd`	containerd container runtime.	containerd
`cri-o`	CRI-O container runtime.	CRI-O
`docker`	Docker container runtime.	Docker
`garden`	Garden container runtime, used in Cloud Foundry.	Garden
`podman`	Podman container runtime.	Podman
`unknown`	Container runtime could not be determined.	Unknown
`winc`	Windows container runtime, used in Cloud Foundry for Windows containers.	winc

Container fields

Attribute	Type	Description	Examples
`k8s.cluster.name`	string	resource stable Display name: `Kubernetes cluster name` The user-defined name of the cluster in Dynatrace. Doesn't need to be unique or immutable. Tags: `permission` `primary-field`	`unguard-dev`; `acme-prod10`
`k8s.cluster.uid`	string	resource stable Display name: `Kubernetes cluster UID` A pseudo-ID for the cluster, by default set to the UID of the kube-system namespace.	`1c7a24c7-ff51-46e0-bcc9-c52637ceec57`
`k8s.namespace.name`	string	resource stable Display name: `Kubernetes namespace name` The name of the namespace that the pod is running in. Tags: `permission` `primary-field`	`default`; `kube-system`
`k8s.workload.name`	string	resource stable Display name: `Kubernetes workload name` The name of the workload. ¹	`checkoutservice`
`k8s.workload.kind`	string	resource stable Display name: `Kubernetes workload kind` The type of the workload. The value is the Kubernetes object kind of the workload in lowercase. ¹	`deployment`; `statefulset`; `cronjob`; `job`; `daemonset`; `replicaset`
`k8s.node.name`	string	resource stable Display name: `Kubernetes node name` Name of the node.	`cluster-pool-1-c3c7423d-azth`
`k8s.pod.name`	string	resource stable Display name: `Kubernetes pod name` The name of the pod.	`checkoutservice-7895755b94-mzs5m`
`k8s.pod.uid`	string	resource stable Display name: `Kubernetes pod UID` The UID of the pod.	`275ecb36-5aa8-4c2a-9c47-d8bb681b9aff`
`k8s.container.name`	string	resource stable Display name: `Kubernetes container name` The name of the container from the pod specification; must be unique within a pod.	`redis`
`k8s.container.type`	string	resource experimental Display name: `Kubernetes container type` The type of the Kubernetes container.	`app`; `init`; `sidecar`; `ephemeral`

Optional, as field isn't created by OneAgent only monitoring.

Container relationships

Type	Target type	Kind	Description
`belongs_to`	`K8S_CLUSTER`	static	stable This is similar to an aggregation in UML. It is a many-to-many relationship without existential properties (the destination is not composed of the sources).
`belongs_to`	`K8S_NAMESPACE`	static	stable This is similar to an aggregation in UML. It is a many-to-many relationship without existential properties (the destination is not composed of the sources).
`is_part_of`	`K8S_CRONJOB`	static	stable Defines if the instance is part of a cluster, similar to a composition in UML. The source (child) cannot exist without the destination (parent).
`is_part_of`	`K8S_DAEMONSET`	static	stable Defines if the instance is part of a cluster, similar to a composition in UML. The source (child) cannot exist without the destination (parent).
`is_part_of`	`K8S_DEPLOYMENT`	static	stable Defines if the instance is part of a cluster, similar to a composition in UML. The source (child) cannot exist without the destination (parent).
`is_part_of`	`K8S_JOB`	static	stable Defines if the instance is part of a cluster, similar to a composition in UML. The source (child) cannot exist without the destination (parent).
`is_part_of`	`K8S_POD`	static	stable Defines if the instance is part of a cluster, similar to a composition in UML. The source (child) cannot exist without the destination (parent).
`is_part_of`	`K8S_REPLICASET`	static	stable Defines if the instance is part of a cluster, similar to a composition in UML. The source (child) cannot exist without the destination (parent).
`is_part_of`	`K8S_STATEFULSET`	static	stable Defines if the instance is part of a cluster, similar to a composition in UML. The source (child) cannot exist without the destination (parent).
`runs_on`	`HOST`	static	stable Defines a "vertical" relation of an entity running on some other entity. It does not imply any composition or aggregation but only a looser association between the entities. One entity can run on multiple other entities. Examples: Service running on a POD, a CONTAINER or a HOST.
`runs_on`	`K8S_NODE`	static	stable Defines a "vertical" relation of an entity running on some other entity. It does not imply any composition or aggregation but only a looser association between the entities. One entity can run on multiple other entities. Examples: Service running on a POD, a CONTAINER or a HOST.

DA monitoring configuration

Smartscape node name: name

Smartscape node type: DA_MONITORING_CONFIGURATION

A DA monitoring configuration entity that defines which projects are monitored and observed.

Query

Fetch all DA Monitoring Configuration entities.

smartscapeNodes DA_MONITORING_CONFIGURATION

Base entity fields

The following base fields are used for all entities.

Attribute	Type	Description	Examples
`id`	smartscapeId	stable Display name: `ID` A Smartscape ID consists of two components: an UPPER_CASE entity type and a random 16-character hexadecimal unique identifier, separated by a dash. Use Smartscape conversion functions when working with strings that represent Smartscape IDs.	`<type>-017198AD253CBD63`
`id_classic`	string	deprecated Display name: `Classic ID` The entity ID that was used in the classic entity store. This ID is present in old monitoring data. Not all entities have this ID, and it is not generated for new entities. Use the `id` field instead, which is the Smartscape ID.	`<type>-017198AD253CBD63`
`name`	string	stable Display name: `Name` The entity name.	`localhost`; `easyTravel`; `product-catalog`
`type`	string	stable Display name: `Type` The entity type. UPPER_SNAKE_CASE string that represents the type of the entity. Tags: `permission`	`TYPE_A`
`tags`	record	stable Display name: `Tags` A consolidated record that aggregates all tag values originating from different contexts. Each nested field within tags represents a specific key (for example, `release` or `name`). The value of each nested field is the tag value from one or multiple contexts. Tags for specific context can be queried via `tags:context` field. Note that rule-based tags do not exist in the new model.	`tags[tag_key-1] = [context_A_tag_val-1, context_B_tag_val-1]`; `tags[tag_key-2] = context_C_tag_val-1`; `tags:context_A[tag_key-1] = context_A_tag_val-1`
`lifetime`	timeframe	stable Display name: `Lifetime` The lifetime of the entity. This is a record with two nested fields: `start` and `end`, which represent the time when the entity was first and last observed, respectively. Each time an entity is updated, the end time is updated to the current time.	`{ start: 2022-07-06T13:36:00.808Z, end: 2024-04-11T06:56:01.204Z }`
`references`	record	stable Display name: `References` Provides access to static edges pointing to other entities. In this record each nested field represents a relationship type and target type, and the value is an array of target Smartscape IDs. This field is hidden by default but can be added using the fieldsAdd command.	`{ references[runs_on.host] : [HOST-C251A1173C2B4B39,HOST-0E9038C7C4409D69], references[runs_on.container] : [CONTAINER-68A08967EF4F675B] }`
`dt.security_context`	string[]	resource stable Display name: `DT security context` The security contexts associated with the entity. For Smartscape entities, this field is always an array. Tags: `permission`	`[]`

Monitoring configuration relationships

Type	Target type	Kind	Description
`sees`	`GCP_PROJECT`	static	experimental Defines a visibility relationship where the source configuration has discovered the destination entity but does not actively monitor it. Used alongside `monitors` to distinguish projects that are visible to a DA monitoring configuration from those that are actively monitored. Enables the UI to show which configuration sees or monitors a given project and to detect overlaps across configurations. Applies to static edges only; dynamic edges are out of scope. Examples: A DA monitoring configuration sees project.
`monitors`	`GCP_PROJECT`	static	experimental Defines monitoring relationship, where the source monitors the destination. Examples: A synthetic monitor monitors a frontend. A synthetic monitor or OneAgent monitors a host.

Disk

Smartscape node name: disk.name

Smartscape node type: DISK

A disk entity representing a logical storage device that OneAgent detects on a monitored host, together with the file systems mounted from it. A disk is a logical, not a physical, unit: one disk entity can be backed by several physical devices—for example, a software RAID array or a logical volume—and a single physical device can back several disk entities when it is split into several partitions or volumes.

What counts as one disk depends on the operating system of the host:

On Unix-like systems, including Linux and AIX, one entity is created per local device, no matter how many paths that device is mounted at. The entity is named after the device (for example, /dev/sda1 or xvda). The shortest path the device is mounted at is reported as its primary mount path (disk.mountpoint), and every path it is mounted at is reported as well (disk.all_mountpoints).
On Windows, one entity is created per fixed volume. The entity is named after the path the volume is mounted at, which is typically a drive letter (for example, C:).
Remote storage mounted on the host, such as a Network File System (NFS), Server Message Block (SMB/CIFS), or General Parallel File System (GPFS) share, is reported as a separate entity per mounted share. Only these entities have a non-zero disk.remote_disk_id, which is derived from the remote path and is therefore identical on every host that mounts the same share.

Pseudo file systems such as proc, sysfs, tmpfs, and cgroup are never reported, and additional disks can be excluded from monitoring—see Exclude disks and network traffic from host monitoring. A disk belongs to exactly one host and is only reported while OneAgent monitors that host.

Internal Model description: Reported by OneAgent host monitoring (the dt.host.disk.* metrics), not by the Disk Analytics extension—the extension publishes its own, more granular disk device, partition, volume, and software RAID data under the com.dynatrace.extension.disk-devices.* metrics (storage.disk.* fields) and does not create DISK entities. Detection is per local block device on Unix-like systems, including Linux and AIX (all mount points of one device are merged into a single entity, the shortest mount path being the primary one), and per fixed volume on Windows, where the volume is tracked by its volume GUID. Network mounts are handled separately and are keyed by the remote path, which is what makes disk.remote_disk_id host-agnostic.

Query

Load all disks and the names of their parent hosts, and get the tags assigned to the host groups of their parent hosts

smartscapeNodes DISK
| fields id, name, host_name = host.name , host_group_tags = getNodeField(references[belongs_to.host][0], "tags")

Get all disks attached to the sap-hana-db host

smartscapeNodes HOST
| filter name == "sap-hana-db"
| traverse belongs_to, DISK, direction:backward

Base entity fields

The following base fields are used for all entities.

Attribute	Type	Description	Examples
`id`	smartscapeId	stable Display name: `ID` A Smartscape ID consists of two components: an UPPER_CASE entity type and a random 16-character hexadecimal unique identifier, separated by a dash. Use Smartscape conversion functions when working with strings that represent Smartscape IDs.	`<type>-017198AD253CBD63`
`id_classic`	string	deprecated Display name: `Classic ID` The entity ID that was used in the classic entity store. This ID is present in old monitoring data. Not all entities have this ID, and it is not generated for new entities. Use the `id` field instead, which is the Smartscape ID.	`<type>-017198AD253CBD63`
`name`	string	stable Display name: `Name` The entity name.	`localhost`; `easyTravel`; `product-catalog`
`type`	string	stable Display name: `Type` The entity type. UPPER_SNAKE_CASE string that represents the type of the entity. Tags: `permission`	`TYPE_A`
`tags`	record	stable Display name: `Tags` A consolidated record that aggregates all tag values originating from different contexts. Each nested field within tags represents a specific key (for example, `release` or `name`). The value of each nested field is the tag value from one or multiple contexts. Tags for specific context can be queried via `tags:context` field. Note that rule-based tags do not exist in the new model.	`tags[tag_key-1] = [context_A_tag_val-1, context_B_tag_val-1]`; `tags[tag_key-2] = context_C_tag_val-1`; `tags:context_A[tag_key-1] = context_A_tag_val-1`
`lifetime`	timeframe	stable Display name: `Lifetime` The lifetime of the entity. This is a record with two nested fields: `start` and `end`, which represent the time when the entity was first and last observed, respectively. Each time an entity is updated, the end time is updated to the current time.	`{ start: 2022-07-06T13:36:00.808Z, end: 2024-04-11T06:56:01.204Z }`
`references`	record	stable Display name: `References` Provides access to static edges pointing to other entities. In this record each nested field represents a relationship type and target type, and the value is an array of target Smartscape IDs. This field is hidden by default but can be added using the fieldsAdd command.	`{ references[runs_on.host] : [HOST-C251A1173C2B4B39,HOST-0E9038C7C4409D69], references[runs_on.container] : [CONTAINER-68A08967EF4F675B] }`
`dt.security_context`	string[]	resource stable Display name: `DT security context` The security contexts associated with the entity. For Smartscape entities, this field is always an array. Tags: `permission`	`[]`

Disk fields

Fields specific to disks.

Attribute	Type	Description	Examples
`disk.remote_disk_id`	long	resource stable Display name: `Remote disk ID` Unique identifier of a disk that is mounted from remote storage, derived from the remote path. It is therefore identical on every host that mounts the same share. Local disks report 0.	`0`; `16864135562327138441`; `18446744073709551615`
`disk.all_mountpoints`	string[]	resource experimental Display name: `Disk all mountpoints` List of all mountpoints	`['/mnt/storage', '/home', '/var/log']`
`disk.filesystem_type`	string	resource experimental Display name: `Filesystem type` Filesystem type as read from the operating system.	`ext4`; `ntfs`; `fat32`; `sfs`; `zfs`

Disk relationships

Type	Target type	Kind	Description
`belongs_to`	`HOST`	static	stable This is similar to an aggregation in UML. It is a many-to-many relationship without existential properties (the destination is not composed of the sources).

Frontend

Smartscape node name: frontend.name

Smartscape node type: FRONTEND

Representation of a frontend entity.

Query

Load all FRONTEND entities.

smartscapeNodes FRONTEND

Base entity fields

The following base fields are used for all entities.

Attribute	Type	Description	Examples
`id`	smartscapeId	stable Display name: `ID` A Smartscape ID consists of two components: an UPPER_CASE entity type and a random 16-character hexadecimal unique identifier, separated by a dash. Use Smartscape conversion functions when working with strings that represent Smartscape IDs.	`<type>-017198AD253CBD63`
`id_classic`	string	deprecated Display name: `Classic ID` The entity ID that was used in the classic entity store. This ID is present in old monitoring data. Not all entities have this ID, and it is not generated for new entities. Use the `id` field instead, which is the Smartscape ID.	`<type>-017198AD253CBD63`
`name`	string	stable Display name: `Name` The entity name.	`localhost`; `easyTravel`; `product-catalog`
`type`	string	stable Display name: `Type` The entity type. UPPER_SNAKE_CASE string that represents the type of the entity. Tags: `permission`	`TYPE_A`
`tags`	record	stable Display name: `Tags` A consolidated record that aggregates all tag values originating from different contexts. Each nested field within tags represents a specific key (for example, `release` or `name`). The value of each nested field is the tag value from one or multiple contexts. Tags for specific context can be queried via `tags:context` field. Note that rule-based tags do not exist in the new model.	`tags[tag_key-1] = [context_A_tag_val-1, context_B_tag_val-1]`; `tags[tag_key-2] = context_C_tag_val-1`; `tags:context_A[tag_key-1] = context_A_tag_val-1`
`lifetime`	timeframe	stable Display name: `Lifetime` The lifetime of the entity. This is a record with two nested fields: `start` and `end`, which represent the time when the entity was first and last observed, respectively. Each time an entity is updated, the end time is updated to the current time.	`{ start: 2022-07-06T13:36:00.808Z, end: 2024-04-11T06:56:01.204Z }`
`references`	record	stable Display name: `References` Provides access to static edges pointing to other entities. In this record each nested field represents a relationship type and target type, and the value is an array of target Smartscape IDs. This field is hidden by default but can be added using the fieldsAdd command.	`{ references[runs_on.host] : [HOST-C251A1173C2B4B39,HOST-0E9038C7C4409D69], references[runs_on.container] : [CONTAINER-68A08967EF4F675B] }`
`dt.security_context`	string[]	resource stable Display name: `DT security context` The security contexts associated with the entity. For Smartscape entities, this field is always an array. Tags: `permission`	`[]`

Frontend fields

Attribute	Type	Description	Examples
`frontend.name`	string	stable Display name: `Frontend name` The frontend name determined at ingest. Tags: `permission`	`my_frontend`
`frontend.type`	string	experimental The type of the RUM-instrumented frontend. Enriched server-side based on the frontend configuration.	`web`; `mobile`
`frontend.deletion_time`	timestamp	experimental The time at which the frontend was marked as deleted. Only present when the frontend has been deleted.	`2024-04-11T06:56:01.204Z`
`dt.rum.instrumentation.rum.enabled`	boolean	experimental Indicates whether Dynatrace RUM instrumentation is enabled for the frontend on Grail.	`true`; `false`
`dt.rum.instrumentation.id`	string	experimental The Dynatrace RUM frontend instrumentation ID. For mobile applications, a UUID is used. For web applications, an 8-byte HEX string is used.	`ea7c4b59f27d43eb`; `89b1a1e7-fe89-4151-81e9-410fa0235f0d`

frontend.type MUST be one of the following:

Value	Description
`mobile`	A mobile frontend.
`web`	A web (browser-based) frontend.

Frontend relationships

Type	Target type	Kind	Description
`calls`	`SERVICE`	static	stable Defines a "horizontal" relationship between two entities that "call" each other. The "calls" relation does not imply a parent/child or other strong structural relation but rather a dynamic communication association. Examples: Typical examples include services calling other services, but also services calling databases, queue brokers, or other infrastructure entities.

Host

Smartscape node name: host.name

Smartscape node type: HOST

A host entity representing either a virtual or physical machine, providing an OS-level view of the infrastructure. When OneAgent is running in application-only mode within a container, it can't provide a full OS-level view for the host running the container, so no host entity is created.

The tags field may contain tags from the following sources:

tags:environment: Environment tags—see Define tags and metadata for hosts
tags:aws: AWS tags defined on the EC2 instance - requires access to tags in the instance metadata
tags:azure: Azure tags defined on the Azure VM
tags:gcp: GCP tags defined on the GCP Compute Engine instance

Query

Find all hosts that belong to the discovery-mode-demo host group.

smartscapeNodes HOST
| filter dt.host_group.id == "discovery-mode-demo"

Find all hosts that belong to the demoability team.

smartscapeNodes HOST
| filter tags[dt_owner_team] == "team-demoability"

Find all resources of hosts that belong to the discovery-mode-demo host group.

smartscapeNodes HOST
| filter dt.host_group.id == "discovery-mode-demo"
| traverse {belongs_to}, {DISK, NETWORK_INTERFACE}, direction:backward

Find all EC2 instances that run hosts with x86 architecture and get their host group IDs.

smartscapeNodes HOST
| filter host.additional_system_info[system.architecture] == "x86"
| traverse runs_on, AWS_EC2_INSTANCE, fieldsKeep:dt.host_group.id
| fields id, name, dt.host_group.id = dt.traverse.history[-1][dt.host_group.id]

Base entity fields

The following base fields are used for all entities.

Attribute	Type	Description	Examples
`id`	smartscapeId	stable Display name: `ID` A Smartscape ID consists of two components: an UPPER_CASE entity type and a random 16-character hexadecimal unique identifier, separated by a dash. Use Smartscape conversion functions when working with strings that represent Smartscape IDs.	`<type>-017198AD253CBD63`
`id_classic`	string	deprecated Display name: `Classic ID` The entity ID that was used in the classic entity store. This ID is present in old monitoring data. Not all entities have this ID, and it is not generated for new entities. Use the `id` field instead, which is the Smartscape ID.	`<type>-017198AD253CBD63`
`name`	string	stable Display name: `Name` The entity name.	`localhost`; `easyTravel`; `product-catalog`
`type`	string	stable Display name: `Type` The entity type. UPPER_SNAKE_CASE string that represents the type of the entity. Tags: `permission`	`TYPE_A`
`tags`	record	stable Display name: `Tags` A consolidated record that aggregates all tag values originating from different contexts. Each nested field within tags represents a specific key (for example, `release` or `name`). The value of each nested field is the tag value from one or multiple contexts. Tags for specific context can be queried via `tags:context` field. Note that rule-based tags do not exist in the new model.	`tags[tag_key-1] = [context_A_tag_val-1, context_B_tag_val-1]`; `tags[tag_key-2] = context_C_tag_val-1`; `tags:context_A[tag_key-1] = context_A_tag_val-1`
`lifetime`	timeframe	stable Display name: `Lifetime` The lifetime of the entity. This is a record with two nested fields: `start` and `end`, which represent the time when the entity was first and last observed, respectively. Each time an entity is updated, the end time is updated to the current time.	`{ start: 2022-07-06T13:36:00.808Z, end: 2024-04-11T06:56:01.204Z }`
`references`	record	stable Display name: `References` Provides access to static edges pointing to other entities. In this record each nested field represents a relationship type and target type, and the value is an array of target Smartscape IDs. This field is hidden by default but can be added using the fieldsAdd command.	`{ references[runs_on.host] : [HOST-C251A1173C2B4B39,HOST-0E9038C7C4409D69], references[runs_on.container] : [CONTAINER-68A08967EF4F675B] }`
`dt.security_context`	string[]	resource stable Display name: `DT security context` The security contexts associated with the entity. For Smartscape entities, this field is always an array. Tags: `permission`	`[]`

Compute fields

Fields that are provided for compute units, both virtual machines and physical hosts.

Attribute	Type	Description	Examples
`cores`	string	stable Display name: `Cores` Number of primary compute units available on the monitored host. On bare metal machines this means physical CPUs. In virtualized environments these are the cores exposed by the hypervisor (vCPUs). Use logical_cores for scheduler visible count.	`4`
`logical_cores`	string	stable Number of logical execution contexts (logical cores) visible to the operating system scheduler on monitored host. This includes SMT / Hyper-Threading.	`4`
`memory`	string	stable Display name: `Memory` Total memory of monitored host, expressed in bytes.	`8141684736`
`private_dns_name`	string	stable Display name: `Private DNS name` Todo	`ip-10-0-0-1.eu-central-1.compute.internal`; `instance-xyz.europe-west3-a.c.project-xyz.internal`
`public_ip`	ipAddress[]	stable Display name: `Public IP` IP address that is publicaly accessible. This is usually an IP address assigned to a NAT gateway or a load balancer, rather than to the instance itself.	`['3.121.45.10']`
`host.type`	string	resource experimental Display name: `Host type` Virtual Machine type, such as SKU on Azure	`Standard_D2s_v3`; `m5.large`; `n1-standard-4`

Host fields

Attribute	Type	Description	Examples
`host.additional_system_info`	record	stable Additional system information. Some attributes here are only available on certain systems (e.g. system.lpar exists only on AIX). Several attributes are numbered. E.g. attributes starting with system.processor_. will have the underscore programatically replaced with an index like [12], starting from [0]. Note that in these examples, a '_' is replaced with '[x]', where x is a number starting from 0.
`host.software_technologies`	record[]	stable An array of software technologies associated with a host entity. Contains individual records with the following fields: type, edition, version.	`[ {"type": "KUBERNETES", , "edition": "worker", "version": "1.33.7"}, {"type": "KUBERNETES", , "edition": "master", "version": "1.33.0"} ]`
`custom_metadata`	record	stable A collection of additional metadata information imported to Dynatrace.	`OperatorVersion:v0.9.0`; `cluster-name:ext-demo1`
`hypervisor.type`	string	resource experimental Display name: `Hypervisor type` Virtualization hypervisor identified. For physical machines, this value is empty.	`KVM`; `VMWARE`
`mac`	string[]	experimental A collection of MAC addresses that can be used to identify this entity.	`['4C:03:4F:5B:E8:89']`
`os.architecture`	string	resource experimental Display name: `OS architecture` Architecture of the CPU, discovered from the operating system.	`X86`
`os.type`	string	resource experimental Display name: `OS type` Type of discovered operating system.	`OS_TYPE_LINUX`; `OS_TYPE_WINDOWS`; `OS_TYPE_DARWIN`; `OS_TYPE_AIX`; `OS_TYPE_HPUX`; `OS_TYPE_SOLARIS`; `OS_TYPE_ZOS`
`os.version`	string	resource stable Display name: `OS version` The complete OS version, including patch, build, and other information.	`15.3.1`; `Ubuntu 16.04.7 LTS (Xenial Xerus) (kernel 4.15.0-206-generic)`; `Windows Server 2022 Datacenter 21H2 2009, ver. 10.0.20348`
`host.physical.memory`	long	resource experimental Display name: `Physical memory` Physical memory of the monitored host, expressed in bytes. The value might be different than the total available memory, if features such as Active Memory Expansion are used.	`8141684736`
`dt.host_group.id`	string	resource stable Display name: `Host group ID` See Organize your environment using host groups. Note that host groups are identified by their name, not by the entity ID of the host group entity. For details on the entity ID, see `dt.entity.host_group`. Tags: `permission` `primary-field`	`myHostGroup`
`ip`	ipAddress[]	experimental A collection of IP addresses that can be used to identify this entity.	`['192.168.0.1', '10.10.10.10']`; `['10.10.10.10']`; `['2001:0000:130F:0000:0000:09C0:876A:130B']`
`host.has_public_traffic`	boolean	resource experimental Indicates whether the host has public traffic detected via eBPF Discovery. ¹	`true`

This field is supported only on Linux hosts with eBPF Discovery enabled and OneAgent installed in Full-stack or Infrastructure mode.

Kubernetes resource fields

Attribute	Type	Description	Examples
`k8s.cluster.name`	string	resource stable Display name: `Kubernetes cluster name` The user-defined name of the cluster in Dynatrace. Doesn't need to be unique or immutable. Tags: `permission` `primary-field`	`unguard-dev`; `acme-prod10`
`k8s.cluster.uid`	string	resource stable Display name: `Kubernetes cluster UID` A pseudo-ID for the cluster, by default set to the UID of the kube-system namespace.	`1c7a24c7-ff51-46e0-bcc9-c52637ceec57`
`k8s.node.name`	string	resource stable Display name: `Kubernetes node name` Name of the node.	`cluster-pool-1-c3c7423d-azth`

AWS resource fields

Attribute	Type	Description	Examples
`aws.availability_zone`	string	resource stable Display name: `Availability zone` A specific availability zone or array of zones in given AWS region.	`us-east-1a`; `us-east-1b`
`aws.region`	string	resource stable Display name: `AWS region` A specific geographical AWS Cloud location. Tags: `primary-field`	`us-east-1`
`aws.resource.id`	string	resource stable Display name: `AWS resource ID` Unique, immutable identifier assigned to the AWS cloud resource.	`i-0922cda4579db3a45`
`aws.account.id`	string	resource stable Display name: `AWS account ID` The 12-digit number, such as 123456789012, that uniquely identifies an AWS account. Tags: `permission` `primary-field`	`123456789012`
`aws.arn`	string	resource stable Display name: `AWS ARN` Amazon Resource Name (ARN).	`arn:aws:lambda:us-east-1:478983378254:function:acceptanceWeatherBackend`

Azure resource fields

Attribute	Type	Description	Examples
`azure.resource.group`	string	resource stable Display name: `Azure resource group` A resource group is a container that holds related resources for an Azure solution. Tags: `permission` `primary-field`	`demo-backend-rg`
`azure.subscription`	string	resource stable Display name: `Azure subscription` An Azure subscription is a logical container used to provision resources in Azure. Tags: `permission` `primary-field`	`27e9b03f-04d2-2b69-b327-32f433f7ed21`
`azure.resource.id`	string	resource experimental Display name: `Azure resource ID` A unique, immutable identifier assigned to each Azure cloud resource.	`/subscriptions/27e9b03f-04d2-2b69-b327-32f433f7ed21/resourceGroups/demo-backend-rg/providers/Microsoft.ContainerService/managedClusters/demo-aks`
`azure.location`	string	resource stable Display name: `Azure location` A specific geographical location of Azure cloud resource. Tags: `primary-field`	`westeurope`

GCP resource fields

Attribute	Type	Description	Examples
`gcp.project.id`	string	resource stable Display name: `GCP project ID` Identifier of the GCP project associated with this resource. Tags: `permission` `primary-field`	`dynatrace-gcp-extension`
`gcp.region`	string	resource stable Display name: `GCP region` A region is a specific geographical location where you can host your resources. Tags: `primary-field`	`europe-west3`
`gcp.resource.name`	string	resource stable Display name: `GCP resource name` The globally unique resource name in Google Cloud Platform convention.	`//cloudfunctions.googleapis.com/projects/gcp-example-project/locations/us-central1/functions/examplefunction`
`gcp.location`	string	resource stable Display name: `GCP location` Region or zone where GCP resource instance is running.	`europe-west3-c`
`gcp.resource.type`	string	resource stable Display name: `GCP resource type` The name of a monitored resource type available in Google Cloud Monitoring and Logging.	`cloudsql_database`

AIX fields

Attribute	Type	Description	Examples
`host.virtual.cpus`	long	resource experimental Display name: `Virtual cpus` Number of virtual CPUs for AIX LPAR.	`2`
`host.logical.cpus`	long	resource experimental Display name: `Logical cpus` Logical CPUs on the monitored host. Applies to AIX LPARs.	`8`
`host.simultaneous.multithreading`	long	resource experimental Display name: `Simultaneous multithreading` Number of threads for AIX Simultaneous Multithreading feature.	`4`

z/OS fields

Attribute	Type	Description	Examples
`zos.lpar_name`	string	resource experimental Display name: `z/OS lpar name` The name of the LPAR that the z/OS address space executes within.	`S0W1`; `ABCD`

BOSH fields

Attribute	Type	Description	Examples
`bosh.name`	string	resource experimental Display name: `BOSH name` A unique identifier to a deployment or instance.	`isolated_diego_cell_devima`
`bosh.instance_id`	string	resource experimental Display name: `BOSH instance ID` A unique identifier assigned to each deployed instance.	`af318409-9e9d-4a18-aca4-0fb52bbdc526`
`bosh.availability_zone`	string	resource experimental Display name: `BOSH availability zone` A specific geographical BOSH location.	`us-east-1a`
`bosh.deployment.id`	string	resource stable Display name: `BOSH deployment ID` BOSH depoloyment ID, retrievied from /var/vcap on monitored host.	`cf-c32ffe771e4ad26b9711`
`bosh.instance.name`	string	resource stable Display name: `BOSH instance name` BOSH instance name, retrievied from /var/vcap on monitored host.	`diego_database`
`bosh.stemcell.version`	string	resource stable Display name: `BOSH stemcell version` Version of BOSH stemcell, retrievied from /var/vcap on monitored host.	`621.448`

Host relationships

Type	Target type	Kind	Description
`calls`	`HOST`	dynamic	stable Defines a "horizontal" relationship between two entities that "call" each other. The "calls" relation does not imply a parent/child or other strong structural relation but rather a dynamic communication association. Examples: Typical examples include services calling other services, but also services calling databases, queue brokers, or other infrastructure entities.

Network Interface

Smartscape node name: network_interface.name

Smartscape node type: NETWORK_INTERFACE

A network interface entity. Represents a network interface attached to a host.

Query

Load all network interfaces and the names of their parent hosts, and get the tags assigned to their parent hosts

smartscapeNodes NETWORK_INTERFACE
| fields id, name, host.name, host.tags = getNodeField(references[belongs_to.host][0], "tags")

Find the host to which the network interface with the specified MAC address is attached.

smartscapeNodes NETWORK_INTERFACE
| filter mac == "16:FF:F1:39:CE:99"
| traverse belongs_to, HOST

Base entity fields

The following base fields are used for all entities.

Attribute	Type	Description	Examples
`id`	smartscapeId	stable Display name: `ID` A Smartscape ID consists of two components: an UPPER_CASE entity type and a random 16-character hexadecimal unique identifier, separated by a dash. Use Smartscape conversion functions when working with strings that represent Smartscape IDs.	`<type>-017198AD253CBD63`
`id_classic`	string	deprecated Display name: `Classic ID` The entity ID that was used in the classic entity store. This ID is present in old monitoring data. Not all entities have this ID, and it is not generated for new entities. Use the `id` field instead, which is the Smartscape ID.	`<type>-017198AD253CBD63`
`name`	string	stable Display name: `Name` The entity name.	`localhost`; `easyTravel`; `product-catalog`
`type`	string	stable Display name: `Type` The entity type. UPPER_SNAKE_CASE string that represents the type of the entity. Tags: `permission`	`TYPE_A`
`tags`	record	stable Display name: `Tags` A consolidated record that aggregates all tag values originating from different contexts. Each nested field within tags represents a specific key (for example, `release` or `name`). The value of each nested field is the tag value from one or multiple contexts. Tags for specific context can be queried via `tags:context` field. Note that rule-based tags do not exist in the new model.	`tags[tag_key-1] = [context_A_tag_val-1, context_B_tag_val-1]`; `tags[tag_key-2] = context_C_tag_val-1`; `tags:context_A[tag_key-1] = context_A_tag_val-1`
`lifetime`	timeframe	stable Display name: `Lifetime` The lifetime of the entity. This is a record with two nested fields: `start` and `end`, which represent the time when the entity was first and last observed, respectively. Each time an entity is updated, the end time is updated to the current time.	`{ start: 2022-07-06T13:36:00.808Z, end: 2024-04-11T06:56:01.204Z }`
`references`	record	stable Display name: `References` Provides access to static edges pointing to other entities. In this record each nested field represents a relationship type and target type, and the value is an array of target Smartscape IDs. This field is hidden by default but can be added using the fieldsAdd command.	`{ references[runs_on.host] : [HOST-C251A1173C2B4B39,HOST-0E9038C7C4409D69], references[runs_on.container] : [CONTAINER-68A08967EF4F675B] }`
`dt.security_context`	string[]	resource stable Display name: `DT security context` The security contexts associated with the entity. For Smartscape entities, this field is always an array. Tags: `permission`	`[]`

Network Interface fields

Fields specific to network interfaces.

Attribute	Type	Description	Examples
`networkinterface.speed`	long	stable Display name: `Network interface speed` Speed of the network interface, expressed in bits per second.	`1000000000`; `10000000000`
`mac`	string[]	experimental A collection of MAC addresses that can be used to identify this entity.	`['4C:03:4F:5B:E8:89']`
`ip`	ipAddress[]	experimental A collection of IP addresses that can be used to identify this entity.	`['192.168.0.1', '10.10.10.10']`; `['10.10.10.10']`; `['2001:0000:130F:0000:0000:09C0:876A:130B']`

Network Interface relationships

Type	Target type	Kind	Description
`belongs_to`	`HOST`	static	stable This is similar to an aggregation in UML. It is a many-to-many relationship without existential properties (the destination is not composed of the sources).

OS service

Smartscape node name: os_service.display_name

Smartscape node type: OS_SERVICE

Representation of an operating system service, which is a background process that performs specific functions and is typically managed by the operating system's service manager. OS services can include things like web servers, database servers, and other types of background processes that are essential for the functioning of an operating system and its applications.

Query

Get all OS services attached to the sap-hana-db host

smartscapeNodes HOST
| filter name == "sap-hana-db"
| traverse belongs_to, OS_SERVICE, direction:backward

Base entity fields

The following base fields are used for all entities.

Attribute	Type	Description	Examples
`id`	smartscapeId	stable Display name: `ID` A Smartscape ID consists of two components: an UPPER_CASE entity type and a random 16-character hexadecimal unique identifier, separated by a dash. Use Smartscape conversion functions when working with strings that represent Smartscape IDs.	`<type>-017198AD253CBD63`
`id_classic`	string	deprecated Display name: `Classic ID` The entity ID that was used in the classic entity store. This ID is present in old monitoring data. Not all entities have this ID, and it is not generated for new entities. Use the `id` field instead, which is the Smartscape ID.	`<type>-017198AD253CBD63`
`name`	string	stable Display name: `Name` The entity name.	`localhost`; `easyTravel`; `product-catalog`
`type`	string	stable Display name: `Type` The entity type. UPPER_SNAKE_CASE string that represents the type of the entity. Tags: `permission`	`TYPE_A`
`tags`	record	stable Display name: `Tags` A consolidated record that aggregates all tag values originating from different contexts. Each nested field within tags represents a specific key (for example, `release` or `name`). The value of each nested field is the tag value from one or multiple contexts. Tags for specific context can be queried via `tags:context` field. Note that rule-based tags do not exist in the new model.	`tags[tag_key-1] = [context_A_tag_val-1, context_B_tag_val-1]`; `tags[tag_key-2] = context_C_tag_val-1`; `tags:context_A[tag_key-1] = context_A_tag_val-1`
`lifetime`	timeframe	stable Display name: `Lifetime` The lifetime of the entity. This is a record with two nested fields: `start` and `end`, which represent the time when the entity was first and last observed, respectively. Each time an entity is updated, the end time is updated to the current time.	`{ start: 2022-07-06T13:36:00.808Z, end: 2024-04-11T06:56:01.204Z }`
`references`	record	stable Display name: `References` Provides access to static edges pointing to other entities. In this record each nested field represents a relationship type and target type, and the value is an array of target Smartscape IDs. This field is hidden by default but can be added using the fieldsAdd command.	`{ references[runs_on.host] : [HOST-C251A1173C2B4B39,HOST-0E9038C7C4409D69], references[runs_on.container] : [CONTAINER-68A08967EF4F675B] }`
`dt.security_context`	string[]	resource stable Display name: `DT security context` The security contexts associated with the entity. For Smartscape entities, this field is always an array. Tags: `permission`	`[]`

OS Service fields

Attribute	Type	Description	Examples
`os_service.name`	string	resource experimental Display name: `OS service name` Unique OS service name. On Windows, this is the short programmatic key as reported by the Service Control Manager (e.g., `wuauserv`), which may differ from display name (e.g., `Windows Update`). On Linux, this is the systemd unit name (e.g., `nginx.service`).	`myosservice`
`os_service.path`	string	resource experimental Display name: `OS service path` The full path to the process executable. On Linux based systems, this can be set to the target of `proc/[pid]/exe`. On Windows, it can be set to the result of `GetProcessImageFileNameW`.	`/usr/bin/cmd/otelcol`
`os_service.startup_type`	string	resource experimental Display name: `OS service startup type` Current startup type.	`auto`
`os_service.status`	string	experimental Display name: `OS service status` Current running state.	`activating`
`os_service.manufacturer`	string	resource experimental Display name: `OS service manufacturer` Manufacturer of the service. On Linux based systems, the value will always be `-`, meaning empty.	`-`; `SSH Corp.`
`os_service.alerting`	boolean	experimental Display name: `OS service alerting` Boolean attribute deciding whether the service status triggers alerts or not.

os_service.startup_type MUST be one of the following:

Value	Description	Display name
`auto`	Windows specific. Automatic: The service starts at system logon.	Auto
`auto_delay`	Windows specific. Automatic (Delayed Start): The service starts a short while after the system has finished starting up.	Auto Delay
`auto_delay_trigger`	Windows specific. Automatic (Delayed Start, Trigger Start)	Auto Delay Trigger
`auto_trigger`	Windows specific. Automatic (Trigger Start): This service will start automatically at boot.	Auto Trigger
`disabled`	Linux specific. Service is configured to not start when the system boots, but can be started manually, or as a dependency of another service.	Disabled
`enabled`	Linux specific. Service is marked for starting up on boot.	Enabled
`enabled-runtime`	Linux specific. Service is marked for starting up on boot.	Enabled Runtime
`indirect`	Linux specific. Service is not enabled directly but can be activated via dependencies or aliases.
`linked`	Linux specific. Service unit file is symlinked into systemd from an external location persistently.
`linked-runtime`	Linux specific. Service unit file is temporarily symlinked into systemd for the current runtime only.
`manual`	Windows specific. Manual: The service starts only when explicitly summoned.	Manual
`manual_trigger`	Windows specific. Manual (Trigger Start): This service will not start automatically at boot.	Manual Trigger
`static`	Linux specific. Service is not enabled and can only start when pulled in by dependencies or started manually.	Static

os_service.status MUST be one of the following:

Value	Description	Display name
`activating`	Service is activating.	Activating
`active`	Service is active.	Active
`continue_pending`	Service continues pending.	Continue Pending
`deactivating`	Service is deactivating.	Deactivating
`failed`	Service failed to start.	Failed
`inactive`	Service is inactive.	Inactive
`pause_pending`	Service paused pending.	Pause Pending
`paused`	Service is currently paused.	Paused
`reloading`	Service is reloading.	Reloading
`running`	Service is currently running.	Running
`start_pending`	Service started pending.	Start Pending
`stop_pending`	Service stopped pending.	Stop Pending
`stopped`	Service is currently stopped.	Stopped

OS service relationships

Type	Target type	Kind	Description
`runs_on`	`HOST`	static	stable Defines a "vertical" relation of an entity running on some other entity. It does not imply any composition or aggregation but only a looser association between the entities. One entity can run on multiple other entities. Examples: Service running on a POD, a CONTAINER or a HOST.
`runs_on`	`PROCESS`	static	stable Defines a "vertical" relation of an entity running on some other entity. It does not imply any composition or aggregation but only a looser association between the entities. One entity can run on multiple other entities. Examples: Service running on a POD, a CONTAINER or a HOST.

OpenTelemetry host

Smartscape node name: host.name

Smartscape node type: OTEL_HOST

A host entity derived from OpenTelemetry resource attributes.

Query

Find all OpenTelemetry host entities.

smartscapeNodes OTEL_HOST

Find OpenTelemetry host entities by name.

smartscapeNodes OTEL_HOST
| filter name == "checkout-host"

Find OpenTelemetry processes running on OpenTelemetry hosts.

smartscapeNodes OTEL_HOST
| traverse runs_on, OTEL_PROCESS, direction:"backward"

ID input

The ID is calculated based on the following fields in the defined order: host.id

Base entity fields

The following base fields are used for all entities.

Attribute	Type	Description	Examples
`id`	smartscapeId	stable Display name: `ID` A Smartscape ID consists of two components: an UPPER_CASE entity type and a random 16-character hexadecimal unique identifier, separated by a dash. Use Smartscape conversion functions when working with strings that represent Smartscape IDs.	`<type>-017198AD253CBD63`
`id_classic`	string	deprecated Display name: `Classic ID` The entity ID that was used in the classic entity store. This ID is present in old monitoring data. Not all entities have this ID, and it is not generated for new entities. Use the `id` field instead, which is the Smartscape ID.	`<type>-017198AD253CBD63`
`name`	string	stable Display name: `Name` The entity name.	`localhost`; `easyTravel`; `product-catalog`
`type`	string	stable Display name: `Type` The entity type. UPPER_SNAKE_CASE string that represents the type of the entity. Tags: `permission`	`TYPE_A`
`tags`	record	stable Display name: `Tags` A consolidated record that aggregates all tag values originating from different contexts. Each nested field within tags represents a specific key (for example, `release` or `name`). The value of each nested field is the tag value from one or multiple contexts. Tags for specific context can be queried via `tags:context` field. Note that rule-based tags do not exist in the new model.	`tags[tag_key-1] = [context_A_tag_val-1, context_B_tag_val-1]`; `tags[tag_key-2] = context_C_tag_val-1`; `tags:context_A[tag_key-1] = context_A_tag_val-1`
`lifetime`	timeframe	stable Display name: `Lifetime` The lifetime of the entity. This is a record with two nested fields: `start` and `end`, which represent the time when the entity was first and last observed, respectively. Each time an entity is updated, the end time is updated to the current time.	`{ start: 2022-07-06T13:36:00.808Z, end: 2024-04-11T06:56:01.204Z }`
`references`	record	stable Display name: `References` Provides access to static edges pointing to other entities. In this record each nested field represents a relationship type and target type, and the value is an array of target Smartscape IDs. This field is hidden by default but can be added using the fieldsAdd command.	`{ references[runs_on.host] : [HOST-C251A1173C2B4B39,HOST-0E9038C7C4409D69], references[runs_on.container] : [CONTAINER-68A08967EF4F675B] }`
`dt.security_context`	string[]	resource stable Display name: `DT security context` The security contexts associated with the entity. For Smartscape entities, this field is always an array. Tags: `permission`	`[]`

OpenTelemetry host fields

Attribute	Type	Description	Examples
`aws.account.id`	string	resource stable Display name: `AWS account ID` The 12-digit number, such as 123456789012, that uniquely identifies an AWS account. Tags: `permission` `primary-field`	`123456789012`
`aws.region`	string	resource stable Display name: `AWS region` A specific geographical AWS Cloud location. Tags: `primary-field`	`us-east-1`
`azure.location`	string	resource stable Display name: `Azure location` A specific geographical location of Azure cloud resource. Tags: `primary-field`	`westeurope`
`azure.resource.group`	string	resource stable Display name: `Azure resource group` A resource group is a container that holds related resources for an Azure solution. Tags: `permission` `primary-field`	`demo-backend-rg`
`azure.subscription`	string	resource stable Display name: `Azure subscription` An Azure subscription is a logical container used to provision resources in Azure. Tags: `permission` `primary-field`	`27e9b03f-04d2-2b69-b327-32f433f7ed21`
`dt.host_group.id`	string	resource stable Display name: `Host group ID` See Organize your environment using host groups. Note that host groups are identified by their name, not by the entity ID of the host group entity. For details on the entity ID, see `dt.entity.host_group`. Tags: `permission` `primary-field`	`myHostGroup`
`gcp.project.id`	string	resource stable Display name: `GCP project ID` Identifier of the GCP project associated with this resource. Tags: `permission` `primary-field`	`dynatrace-gcp-extension`
`gcp.region`	string	resource stable Display name: `GCP region` A region is a specific geographical location where you can host your resources. Tags: `primary-field`	`europe-west3`
`k8s.cluster.name`	string	resource stable Display name: `Kubernetes cluster name` The user-defined name of the cluster in Dynatrace. Doesn't need to be unique or immutable. Tags: `permission` `primary-field`	`unguard-dev`; `acme-prod10`
`k8s.namespace.name`	string	resource stable Display name: `Kubernetes namespace name` The name of the namespace that the pod is running in. Tags: `permission` `primary-field`	`default`; `kube-system`
`os.type`	string	resource experimental Display name: `OS type` Type of discovered operating system.	`windows`; `linux`; `darwin`; `freebsd`; `netbsd`; `openbsd`; `dragonflybsd`; `hpux`; `aix`; `solaris`; `z_os`
`os.name`	string	resource stable Display name: `OS name` The OS name in a short, human-readable format.	`iOS`
`os.version`	string	resource stable Display name: `OS version` The complete OS version, including patch, build, and other information.	`15.3.1`; `Ubuntu 16.04.7 LTS (Xenial Xerus) (kernel 4.15.0-206-generic)`; `Windows Server 2022 Datacenter 21H2 2009, ver. 10.0.20348`
`os.description`	string	resource experimental The human-readable description of the operating system.	`Ubuntu 22.04.5 LTS`
`os.build_id`	string	resource experimental The operating system build identifier.	`6.8.0-124-generic`
`host.id`	string	resource experimental The unique host identifier reported by the monitored system.	`fdbf79e8af94cb7f9e8df36789187052`
`host.arch`	string	resource experimental The architecture of the host system.	`amd64`; `arm64`
`host.cpu.model.name`	string	resource experimental The model name of the host CPU.	`11th Gen Intel(R) Core(TM) i7-1185G7 @ 3.00GHz`
`host.ip`	ipAddress[]	resource experimental Display name: `Host IP` A list of IP adresses (IPv4 or IPv6) of this host.	`[194.232.104.141, 2a01:468:1000:9::140]`
`dt.cost.product`	string	resource stable Display name: `Cost product` Can be used to assign usage to a Product or Application ID.	`Product A`
`dt.cost.costcenter`	string	resource stable Display name: `Cost center` Can be used to assign usage to a Cost Center.	`Team A`
`primary_tags.__key__`	string	resource experimental Display name: `Primary tag` Primary Grail tags are used to tag a resource in a meaningful way. `__key__` is populated with the tag name, for example, `primary_tags.ownership`. In case of single-value tags, the value is a string. In case of multi-value tags, the value is an array of strings.	`team-alpha`; `team-bravo`

OpenTelemetry process

Smartscape node name: process.executable.name

Smartscape node type: OTEL_PROCESS

A process entity derived from OpenTelemetry resource attributes.

Query

Find all OpenTelemetry process entities.

smartscapeNodes OTEL_PROCESS

Find OpenTelemetry process entities by name.

smartscapeNodes OTEL_PROCESS
| filter name == "otelcol"

Find the OpenTelemetry hosts on which OpenTelemetry processes run.

smartscapeNodes OTEL_PROCESS
| traverse runs_on, OTEL_HOST

ID input

The ID is calculated based on the following fields in the defined order: host.id, process.executable.name

Base entity fields

The following base fields are used for all entities.

Attribute	Type	Description	Examples
`id`	smartscapeId	stable Display name: `ID` A Smartscape ID consists of two components: an UPPER_CASE entity type and a random 16-character hexadecimal unique identifier, separated by a dash. Use Smartscape conversion functions when working with strings that represent Smartscape IDs.	`<type>-017198AD253CBD63`
`id_classic`	string	deprecated Display name: `Classic ID` The entity ID that was used in the classic entity store. This ID is present in old monitoring data. Not all entities have this ID, and it is not generated for new entities. Use the `id` field instead, which is the Smartscape ID.	`<type>-017198AD253CBD63`
`name`	string	stable Display name: `Name` The entity name.	`localhost`; `easyTravel`; `product-catalog`
`type`	string	stable Display name: `Type` The entity type. UPPER_SNAKE_CASE string that represents the type of the entity. Tags: `permission`	`TYPE_A`
`tags`	record	stable Display name: `Tags` A consolidated record that aggregates all tag values originating from different contexts. Each nested field within tags represents a specific key (for example, `release` or `name`). The value of each nested field is the tag value from one or multiple contexts. Tags for specific context can be queried via `tags:context` field. Note that rule-based tags do not exist in the new model.	`tags[tag_key-1] = [context_A_tag_val-1, context_B_tag_val-1]`; `tags[tag_key-2] = context_C_tag_val-1`; `tags:context_A[tag_key-1] = context_A_tag_val-1`
`lifetime`	timeframe	stable Display name: `Lifetime` The lifetime of the entity. This is a record with two nested fields: `start` and `end`, which represent the time when the entity was first and last observed, respectively. Each time an entity is updated, the end time is updated to the current time.	`{ start: 2022-07-06T13:36:00.808Z, end: 2024-04-11T06:56:01.204Z }`
`references`	record	stable Display name: `References` Provides access to static edges pointing to other entities. In this record each nested field represents a relationship type and target type, and the value is an array of target Smartscape IDs. This field is hidden by default but can be added using the fieldsAdd command.	`{ references[runs_on.host] : [HOST-C251A1173C2B4B39,HOST-0E9038C7C4409D69], references[runs_on.container] : [CONTAINER-68A08967EF4F675B] }`
`dt.security_context`	string[]	resource stable Display name: `DT security context` The security contexts associated with the entity. For Smartscape entities, this field is always an array. Tags: `permission`	`[]`

OpenTelemetry process fields

Attribute	Type	Description	Examples
`aws.account.id`	string	resource stable Display name: `AWS account ID` The 12-digit number, such as 123456789012, that uniquely identifies an AWS account. Tags: `permission` `primary-field`	`123456789012`
`aws.region`	string	resource stable Display name: `AWS region` A specific geographical AWS Cloud location. Tags: `primary-field`	`us-east-1`
`azure.location`	string	resource stable Display name: `Azure location` A specific geographical location of Azure cloud resource. Tags: `primary-field`	`westeurope`
`azure.resource.group`	string	resource stable Display name: `Azure resource group` A resource group is a container that holds related resources for an Azure solution. Tags: `permission` `primary-field`	`demo-backend-rg`
`azure.subscription`	string	resource stable Display name: `Azure subscription` An Azure subscription is a logical container used to provision resources in Azure. Tags: `permission` `primary-field`	`27e9b03f-04d2-2b69-b327-32f433f7ed21`
`dt.host_group.id`	string	resource stable Display name: `Host group ID` See Organize your environment using host groups. Note that host groups are identified by their name, not by the entity ID of the host group entity. For details on the entity ID, see `dt.entity.host_group`. Tags: `permission` `primary-field`	`myHostGroup`
`gcp.project.id`	string	resource stable Display name: `GCP project ID` Identifier of the GCP project associated with this resource. Tags: `permission` `primary-field`	`dynatrace-gcp-extension`
`gcp.region`	string	resource stable Display name: `GCP region` A region is a specific geographical location where you can host your resources. Tags: `primary-field`	`europe-west3`
`k8s.cluster.name`	string	resource stable Display name: `Kubernetes cluster name` The user-defined name of the cluster in Dynatrace. Doesn't need to be unique or immutable. Tags: `permission` `primary-field`	`unguard-dev`; `acme-prod10`
`k8s.namespace.name`	string	resource stable Display name: `Kubernetes namespace name` The name of the namespace that the pod is running in. Tags: `permission` `primary-field`	`default`; `kube-system`
`process.command_line`	string	resource experimental Display name: `Command line` The full command used to launch the process as a single string representing the full command. On Windows, can be set to the result of `GetCommandLineW`. Do not set this if you have to assemble it just for monitoring; use `process.command_args` instead. ¹	`/usr/bin/python3 script.py --verbose --output /tmp/results.json`; `C:\Windows\System32\cmd.exe /c whoami`
`process.pid`	long	resource experimental Display name: `Process ID` Process Identifier (PID) as observed by the monitored process.	`1234`
`dt.cost.product`	string	resource stable Display name: `Cost product` Can be used to assign usage to a Product or Application ID.	`Product A`
`dt.cost.costcenter`	string	resource stable Display name: `Cost center` Can be used to assign usage to a Cost Center.	`Team A`
`primary_tags.__key__`	string	resource experimental Display name: `Primary tag` Primary Grail tags are used to tag a resource in a meaningful way. `__key__` is populated with the tag name, for example, `primary_tags.ownership`. In case of single-value tags, the value is a string. In case of multi-value tags, the value is an array of strings.	`team-alpha`; `team-bravo`

This field reflects the command line of the main process of the Process Group Instance, which may not be the only process in the group. When multiple OS processes are grouped into a single PGI (for example, java.exe and javaw.exe in a JVM workload), the command line reported here belongs to whichever process OneAgent designated as the main one, which may differ from the process surfaced by other discovery tools.

Data is gathered from /proc/<pid>/cmdline on Linux, getargs() API function on AIX and NtQueryInformationProcess on Windows.

For processes that are not deep-monitored, the command line reflects whatever is currently held in the process's own memory at the time osagent reads it, not necessarily the command line the process was originally started with — a process that rewrites its own argv at runtime (for example via setproctitle(), to display a custom process title in tools like ps) will be reported with that self-modified content instead.

No credential, secret, or other sensitive-value masking is ever applied here, so command lines that pass secrets as arguments (for example, --password=...) appear unmasked. One conditional content modification applies, and it is platform-specific: on Windows only, surrounding double-quote characters are always stripped from individual arguments. An escaped quote inside a token (\") survives though and appears as a literal ". At the same time, the command line is split into tokens, so a quoted argument (for example, "C:\Program Files\app.exe") appears here without its quotes. On Linux/AIX, arguments are never quote-wrapped by the OS in the first place, so no such stripping occurs or is needed there.

Process

Smartscape node name: process.name

Smartscape node type: PROCESS

The process entity aggregates similar processes executing on the same operating system (native or containerized), ensuring data continuity across process restarts and grouping workers performing similar roles. In Dynatrace Classic, this corresponds to the Process Group Instance (PGI).

The tags field may contain tags from the following sources:

tags:environment: Tags based on environment variables

Query

Find all NodeJS processes.

smartscapeNodes PROCESS
| fieldsAdd process.software_technologies = arrayConcat(process.software_technologies.os,process.software_technologies.webserver,process.software_technologies.nodejs)
| expand process.software_technologies
| filter process.software_technologies[type] == "NODE_JS"
| dedup id

Find all hosts that have processes listening on port 8080.

smartscapeNodes PROCESS
| filter in(port, 8080)
| traverse runs_on, HOST

Find all processes with command line arguments "java -jar app.jar".

smartscapeNodes PROCESS
| filter process.metadata[COMMAND_LINE_ARGS] == "java -jar app.jar"

Find all processes that call processes with executable name "java".

smartscapeNodes PROCESS
| filter process.metadata[EXE_NAME] == "java"
| traverse calls, PROCESS, direction:backward

Get a list of all software technologies detected on processes

smartscapeNodes PROCESS
| fieldsAdd process.software_technologies = arrayConcat(process.software_technologies.os,process.software_technologies.java,process.software_technologies.dotnet,process.software_technologies.webserver,process.software_technologies.wsb,process.software_technologies.php,process.software_technologies.nodejs,process.software_technologies.ruby,process.software_technologies.varnish,process.software_technologies.go,process.software_technologies.python)

Get the process type based on detected software technologies

smartscapeNodes PROCESS
| fieldsAdd process_type = coalesce(
  if (process.software_technologies.os ~ "REDIS", "REDIS"),
  if (process.software_technologies.os ~ "MONGODB", "MONGODB"),
  if (process.software_technologies.os ~ "MSSQL", "MSSQL"),
  if (process.software_technologies.os ~ "MYSQL", "MYSQL"),
  if (process.software_technologies.os ~ "SQLITE", "SQLITE"),
  if (process.software_technologies.os ~ "POSTGRES", "POSTGRES"),
  if (process.software_technologies.os ~ "ORACLE_DB", "ORACLE_DB"),
  if (process.software_technologies.os ~ "DB2", "DB2"),
  if (process.software_technologies.os ~ "TOMCAT", "TOMCAT"),
  if (process.software_technologies.os ~ "WEBLOGIC", "WEBLOGIC"),
  if (process.software_technologies.os ~ "WEBSPHERE", "WEBSPHERE"),
  if (process.software_technologies.os ~ "ACTIVEMQ_CLIENT", "ACTIVEMQ_CLIENT"),
  if (process.software_technologies.os ~ "JAVA", "JAVA"),
  if (process.software_technologies.os ~ "NGINX", "NGINX"),
  if (process.software_technologies.os ~ "APACHE_HTTPD", "APACHE_HTTPD"),
  if (process.software_technologies.os ~ "IIS_APP_POOL", "IIS_APP_POOL"),
  if (process.software_technologies.os ~ "IIS", "IIS"),
  if (process.software_technologies.os ~ "DOTNET", "DOTNET"),
  if (process.software_technologies.os ~ "NODE_JS", "NODE_JS"),
  if (process.software_technologies.os ~ "PHP", "PHP"),
  if (process.software_technologies.os ~ "PYTHON", "PYTHON"),
  if (process.software_technologies.os ~ "RUBY", "RUBY"),
  if (process.software_technologies.os ~ "GO", "GO"),
  if (process.software_technologies.os ~ "ERLANG", "ERLANG"),
  if (process.software_technologies.os ~ "IBM_CICS_REGION", "IBM_CICS_REGION"),
  if (process.software_technologies.os ~ "HAPROXY", "HAPROXY"),
  if (process.software_technologies.os ~ "ENVOY", "ENVOY"),
  if (process.software_technologies.os ~ "LINUX_SYSTEM", "LINUX_SYSTEM"),
  if (process.software_technologies.os ~ "WINDOWS_SYSTEM", "WINDOWS_SYSTEM"),
  if (isNotNull(process.software_technologies.os), process.software_technologies.os[0][type])
)

Base entity fields

The following base fields are used for all entities.

Attribute	Type	Description	Examples
`id`	smartscapeId	stable Display name: `ID` A Smartscape ID consists of two components: an UPPER_CASE entity type and a random 16-character hexadecimal unique identifier, separated by a dash. Use Smartscape conversion functions when working with strings that represent Smartscape IDs.	`<type>-017198AD253CBD63`
`id_classic`	string	deprecated Display name: `Classic ID` The entity ID that was used in the classic entity store. This ID is present in old monitoring data. Not all entities have this ID, and it is not generated for new entities. Use the `id` field instead, which is the Smartscape ID.	`<type>-017198AD253CBD63`
`name`	string	stable Display name: `Name` The entity name.	`localhost`; `easyTravel`; `product-catalog`
`type`	string	stable Display name: `Type` The entity type. UPPER_SNAKE_CASE string that represents the type of the entity. Tags: `permission`	`TYPE_A`
`tags`	record	stable Display name: `Tags` A consolidated record that aggregates all tag values originating from different contexts. Each nested field within tags represents a specific key (for example, `release` or `name`). The value of each nested field is the tag value from one or multiple contexts. Tags for specific context can be queried via `tags:context` field. Note that rule-based tags do not exist in the new model.	`tags[tag_key-1] = [context_A_tag_val-1, context_B_tag_val-1]`; `tags[tag_key-2] = context_C_tag_val-1`; `tags:context_A[tag_key-1] = context_A_tag_val-1`
`lifetime`	timeframe	stable Display name: `Lifetime` The lifetime of the entity. This is a record with two nested fields: `start` and `end`, which represent the time when the entity was first and last observed, respectively. Each time an entity is updated, the end time is updated to the current time.	`{ start: 2022-07-06T13:36:00.808Z, end: 2024-04-11T06:56:01.204Z }`
`references`	record	stable Display name: `References` Provides access to static edges pointing to other entities. In this record each nested field represents a relationship type and target type, and the value is an array of target Smartscape IDs. This field is hidden by default but can be added using the fieldsAdd command.	`{ references[runs_on.host] : [HOST-C251A1173C2B4B39,HOST-0E9038C7C4409D69], references[runs_on.container] : [CONTAINER-68A08967EF4F675B] }`
`dt.security_context`	string[]	resource stable Display name: `DT security context` The security contexts associated with the entity. For Smartscape entities, this field is always an array. Tags: `permission`	`[]`

Process group fields

Contains fields that share values for all entities belonging to a given process group.

Attribute	Type	Description	Examples
`dt.process_group.id`	string	resource stable Display name: `Process group ID` The identifier shared by all entities belonging to a given process group.	`PROCESS_GROUP-1234`
`dt.process_group.detected_name`	string	resource stable Display name: `Process group name` The name of the process group as it was detect by the agent.	`Apache Web Server httpd`; `Redis unguard-redis-* redis`; `Linux System`

Process fields

Fields specific to processes.

Attribute	Type	Description	Examples
`process.containerized`	boolean	resource experimental Display name: `Is containerized` True if given process is running inside container.
`process.bitness`	string	resource experimental Display name: `Process bitness` The architecture of the monitored entity in terms of how many bits compose a basic value.	`64`
`custom_metadata`	record	stable A collection of additional metadata information imported to Dynatrace.	`OperatorVersion:v0.9.0`; `cluster-name:ext-demo1`
`port`	long[]	experimental A collection of layer 4 ports used to identify this entity.	`[50000, 50001, 50002, 50003]`
`process.metadata`	record	resource experimental Display name: `Process metadata` It contains a diagnostic collection of input parameters that were used in assigning processes to the process entity; which of them were used to calculate the ID is listed in `process.metadata.id_keys`. ¹	`NODE_JS_APP_BASE_DIRECTORY:C:/home/site/wwwroot`
`process.metadata.id_keys`	array	resource experimental Display name: `Process metadata ID keys` Keys of non-ignored input parameters used to calculate the process entity ID.	`['NODE_JS_APP_BASE_DIRECTORY', 'EXE_NAME', 'PYTHON_SCRIPT_PATH']`
`process.software_technologies.os`	record[]	stable An array of software technologies observed by the OneAgent OS module associated with a process entity. Contains individual records with the following fields: type, edition, version.	`[ {"type": "APACHE_CASSANDRA", "edition": "", "version": "4.1.10"}, {"type": "NODE_JS", "edition": "", "version": "20.19.5"} ]`
`process.software_technologies.java`	record[]	stable An array of software technologies observed by the OneAgent Java module associated with a process entity. Contains individual records with the following fields: type, edition, version.	`[ {"type": "SPRING", "edition": "SPRING_BOOT", "version": "3.2.0"}, {"type": "JAVA", "edition": "OPEN_JDK", "version": "17.0.7"} ]`
`process.software_technologies.dotnet`	record[]	stable An array of software technologies observed by the OneAgent .NET module associated with a process entity. Contains individual records with the following fields: type, edition, version.	`[ {"type": "DOTNET", "edition": "CORE", "version": "7.0.5"}, {"type": "ASP_NET", "edition": "CORE", "version": "7.0.5"} ]`
`process.software_technologies.webserver`	record[]	stable An array of web server software technologies observed by the OneAgent web server modules associated with a process entity. Contains individual records with the following fields: type, edition, version.	`[ {"type": " APACHE_HTTPD", "edition": "", "version": "2.4.57"}, {"type": "NGINX", "edition": "", "version": "2.0.0"} ]`
`process.software_technologies.wsmb`	record[]	stable An array of software technologies observed by the OneAgent WSMB module associated with a process entity. Contains individual records with the following fields: type, edition, version.	`[ {"type": "WORDPRESS", "edition": "", "version": "6.3.1"} ]`
`process.software_technologies.php`	record[]	stable An array of software technologies observed by the OneAgent PHP module associated with a process entity. Contains individual records with the following fields: type, edition, version.	`[ {"type": "WORDPRESS", "edition": "", "version": "6.3.1"} ]`
`process.software_technologies.nodejs`	record[]	stable An array of software technologies observed by the OneAgent Node.js module associated with a process entity. Contains individual records with the following fields: type, edition, version.	`[ {"type": "EXPRESS", "edition": "", "version": "4.18.2"}, {"type": "NODE_JS", "edition": "", "version": "20.19.5"} ]`
`process.software_technologies.ruby`	record[]	stable An array of software technologies observed by the OneAgent Ruby module associated with a process entity. Contains individual records with the following fields: type, edition, version.	`[ {"type": "RAILS", "edition": "", "version": "7.0.4"}, {"type": "RUBY", "edition": "", "version": "3.2.2"} ]`
`process.software_technologies.varnish`	record[]	stable An array of software technologies observed by the OneAgent Varnish module associated with a process entity. Contains individual records with the following fields: type, edition, version.	`[ {"type": "VARNISH_CACHE", "edition": "", "version": "7.0.0"} ]`
`process.software_technologies.go`	record[]	stable An array of software technologies observed by the OneAgent Go module associated with a process entity. Contains individual records with the following fields: type, edition, version.	`[ {"type": "GO", "edition": "", "version": "1.23.5"} ]`
`process.software_technologies.python`	record[]	stable An array of software technologies observed by the OneAgent Python module associated with a process entity. Contains individual records with the following fields: type, edition, version.	`[ {"type": "DJANGO", "edition": "", "version": "4.2.3"}, {"type": "PYTHON", "edition": "", "version": "3.12.6"} ]`
`process.has_public_traffic`	boolean	resource experimental Indicates whether the process has public traffic detected via eBPF Discovery. ²	`true`

May include a COMMAND_LINE_ARGS entry holding the process's command line, joined into a single string in which each literal space in an argument may be preceded by a backslash. Which of the keys in this collection are used to calculate the entity ID is listed in process.metadata.id_keys.

This field reflects the command line of the main process when multiple OS processes are grouped into a single process entity (for example, java.exe and javaw.exe in a JVM workload) — the command line reported here belongs to whichever process OneAgent designated as the main one, which may differ from the process surfaced by other discovery tools.

Data is gathered from /proc/<pid>/cmdline on Linux, getargs() API function on AIX and NtQueryInformationProcess on Windows.

For processes that are not deep-monitored, this entry reflects whatever is currently held in the process's own memory at the time osagent reads it, not necessarily the command line the process was originally started with — a process that rewrites its own argv at runtime (for example via setproctitle(), to display a custom process title in tools like ps) will be reported with that self-modified content instead.

Unlike other path-like entries in this collection, it is never passed through digit/hex normalization, and no credential or secret masking is ever applied to it. One conditional content modification applies, and it is platform-specific: on Windows only, surrounding double-quote characters are always stripped from individual arguments while the command line is split into tokens, so a quoted argument (for example, "C:\Program Files\app.exe") appears here without its quotes. An escaped quote inside a token (\") survives though and appears as a literal ". On Linux/AIX, arguments are never quote-wrapped by the OS in the first place, so no such stripping occurs or is needed there.

This field is supported only on Linux hosts with eBPF Discovery enabled and OneAgent installed on the host.

Kubernetes fields

Attribute	Type	Description	Examples
`k8s.cluster.name`	string	resource stable Display name: `Kubernetes cluster name` The user-defined name of the cluster in Dynatrace. Doesn't need to be unique or immutable. Tags: `permission` `primary-field`	`unguard-dev`; `acme-prod10`

Process relationships

Type	Target type	Kind	Description
`calls`	`PROCESS`	dynamic	stable Defines a "horizontal" relationship between two entities that "call" each other. The "calls" relation does not imply a parent/child or other strong structural relation but rather a dynamic communication association. Examples: Typical examples include services calling other services, but also services calling databases, queue brokers, or other infrastructure entities.
`runs_on`	`CONTAINER`	static	stable Defines a "vertical" relation of an entity running on some other entity. It does not imply any composition or aggregation but only a looser association between the entities. One entity can run on multiple other entities. Examples: Service running on a POD, a CONTAINER or a HOST.
`runs_on`	`HOST`	static	stable Defines a "vertical" relation of an entity running on some other entity. It does not imply any composition or aggregation but only a looser association between the entities. One entity can run on multiple other entities. Examples: Service running on a POD, a CONTAINER or a HOST.

Service

Smartscape node name: dt.service.name

Smartscape node type: SERVICE

A service entity detected by service detection.

Service entities represent the horizontal topology of your environment based on distributed tracing data, providing detailed insights into caller-callee relationships.

Unlike other Smartscape entities, service entities do not contain primary Grail fields due to the flexibility of service detection rules. Use the following service timeseries instead to query this data (refer to the query examples below).

dt.service.request.count
dt.service.messaging.receive.count
dt.service.messaging.process.count
dt.service.faas_invoke.count

Query

Find all service entities.

smartscapeNodes SERVICE

Count all service relationships, grouped by relationship type.

smartscapeEdges "*"
| filter source_type == "SERVICE"
| fields type, source_id, source_type, target_id, target_type, dt.system.edge_kind
| summarize count(), by:{type}

Count runs_on relationships from services, grouped by target entity type.

smartscapeEdges runs_on
| filter source_type == "SERVICE"
| summarize count(), by:{target_type}

Count belongs_to relationships from services, grouped by target entity type.

smartscapeEdges belongs_to
| filter source_type == "SERVICE"
| summarize count(), by:{target_type}

Traverse all service-to-service call relationships of a service.

smartscapeNodes SERVICE
| filter id == toSmartscapeId("SERVICE-0123456789ABCDEF")
| traverse {"calls"}, {"SERVICE"}, direction:"forward"

Query the average response time for all downstream services called by a specific service (identified by its ID).

timeseries avg(dt.service.request.response_time), filter:dt.smartscape.service in [
  smartscapeEdges "calls"
  | filter source_type == "SERVICE"
  | filter source_id == toSmartscapeId("SERVICE-0123456789ABCDEF")
  | fields target_id
], by:{dt.smartscape.service}

Query the 95th percentile response time for all downstream services called by a specific service (identified by its name).

timeseries responseTime_p95_timeseries = percentile(dt.service.request.response_time, 95), filter:dt.smartscape.service in [
  smartscapeNodes "SERVICE"
  | filter name == "checkout-service"
  | traverse {"calls"}, {"SERVICE"}, direction:"forward"
  | fields id
], by:{dt.smartscape.service}, nonempty: true
| fieldsAdd metricName = "Response time p95"

Get service entities with primary fields

timeseries avg(dt.service.request.count), by:{dt.smartscape.service, dt.service.name, aws.account.id,aws.region,azure.location,azure.resource.group,azure.subscription,dt.host_group.id,gcp.project.id,gcp.region,k8s.cluster.name,k8s.namespace.name}
| fields id = dt.smartscape.service, name = dt.service.name, aws.account.id,aws.region,azure.location,azure.resource.group,azure.subscription,dt.host_group.id,gcp.project.id,gcp.region,k8s.cluster.name,k8s.namespace.name

Base entity fields

The following base fields are used for all entities.

Attribute	Type	Description	Examples
`id`	smartscapeId	stable Display name: `ID` A Smartscape ID consists of two components: an UPPER_CASE entity type and a random 16-character hexadecimal unique identifier, separated by a dash. Use Smartscape conversion functions when working with strings that represent Smartscape IDs.	`<type>-017198AD253CBD63`
`id_classic`	string	deprecated Display name: `Classic ID` The entity ID that was used in the classic entity store. This ID is present in old monitoring data. Not all entities have this ID, and it is not generated for new entities. Use the `id` field instead, which is the Smartscape ID.	`<type>-017198AD253CBD63`
`name`	string	stable Display name: `Name` The entity name.	`localhost`; `easyTravel`; `product-catalog`
`type`	string	stable Display name: `Type` The entity type. UPPER_SNAKE_CASE string that represents the type of the entity. Tags: `permission`	`TYPE_A`
`tags`	record	stable Display name: `Tags` A consolidated record that aggregates all tag values originating from different contexts. Each nested field within tags represents a specific key (for example, `release` or `name`). The value of each nested field is the tag value from one or multiple contexts. Tags for specific context can be queried via `tags:context` field. Note that rule-based tags do not exist in the new model.	`tags[tag_key-1] = [context_A_tag_val-1, context_B_tag_val-1]`; `tags[tag_key-2] = context_C_tag_val-1`; `tags:context_A[tag_key-1] = context_A_tag_val-1`
`lifetime`	timeframe	stable Display name: `Lifetime` The lifetime of the entity. This is a record with two nested fields: `start` and `end`, which represent the time when the entity was first and last observed, respectively. Each time an entity is updated, the end time is updated to the current time.	`{ start: 2022-07-06T13:36:00.808Z, end: 2024-04-11T06:56:01.204Z }`
`references`	record	stable Display name: `References` Provides access to static edges pointing to other entities. In this record each nested field represents a relationship type and target type, and the value is an array of target Smartscape IDs. This field is hidden by default but can be added using the fieldsAdd command.	`{ references[runs_on.host] : [HOST-C251A1173C2B4B39,HOST-0E9038C7C4409D69], references[runs_on.container] : [CONTAINER-68A08967EF4F675B] }`
`dt.security_context`	string[]	resource stable Display name: `DT security context` The security contexts associated with the entity. For Smartscape entities, this field is always an array. Tags: `permission`	`[]`

Service fields

Fields specific to services.

Attribute	Type	Description	Examples
`dt.service_detection.version`	long	resource stable Display name: `Service detection version` The version of the service detection mechanism used to identify the service. Either `1` for Service Detection Version 1 (SDv1) or `2` for Service Detection Version 2 (SDv2).	`1`; `2`
`dt.service.sdv1_type`	string	resource stable Display name: `SDv1 service type` The SDv1 service type. This field is available only if `dt.service_detection.version` is `1`.	`BACKGROUND_ACTIVITY`; `CUSTOM_SERVICE`; `RMI_SERVICE`; `RPC_SERVICE`; `SPAN`; `WEB_REQUEST_SERVICE`; `WEB_SERVICE`

dt.service.sdv1_type MUST be one of the following:

Value	Description
`BACKGROUND_ACTIVITY`	Background activity (process) service
`CICS_INTERACTION_SERVICE`	IBM CICS interaction service
`CICS_SERVICE`	IBM CICS service
`CUSTOM_APPLICATION`	Custom application service
`CUSTOM_SERVICE`	Custom (method-based) service
`DATABASE_SERVICE`	Database service
`ENTERPRISE_SERVICE_BUS_SERVICE`	Enterprise service bus (ESB) service
`IMS_INTERACTION_SERVICE`	IBM IMS interaction service
`IMS_SERVICE`	IBM IMS service
`MESSAGING_SERVICE`	Messaging service
`MOBILE_SERVICE`	Mobile service
`QUEUE_LISTENER_SERVICE`	Queue listener service
`RMI_SERVICE`	Java RMI service
`RPC_SERVICE`	Remote procedure call service
`SAAS_VENDOR`	SaaS vendor service
`SPAN`	Span-based service
`UNKNOWN`	Unknown service type
`WEBSITE`	Website
`WEB_REQUEST_SERVICE`	Web request service
`WEB_SERVICE`	Web service endpoint
`ZOS_CONNECT`	z/OS Connect service

Service relationships

Type	Target type	Kind	Description
`calls`	`SERVICE`	dynamic	stable Defines a "horizontal" relationship between two entities that "call" each other. The "calls" relation does not imply a parent/child or other strong structural relation but rather a dynamic communication association. Examples: Typical examples include services calling other services, but also services calling databases, queue brokers, or other infrastructure entities.
`calls`	`DB_INSTANCE_MSSQL`	dynamic	stable Defines a "horizontal" relationship between two entities that "call" each other. The "calls" relation does not imply a parent/child or other strong structural relation but rather a dynamic communication association. Examples: Typical examples include services calling other services, but also services calling databases, queue brokers, or other infrastructure entities.
`calls`	`DB_INSTANCE_ORACLE`	dynamic	stable Defines a "horizontal" relationship between two entities that "call" each other. The "calls" relation does not imply a parent/child or other strong structural relation but rather a dynamic communication association. Examples: Typical examples include services calling other services, but also services calling databases, queue brokers, or other infrastructure entities.
`calls`	`DB_INSTANCE_MYSQL`	dynamic	stable Defines a "horizontal" relationship between two entities that "call" each other. The "calls" relation does not imply a parent/child or other strong structural relation but rather a dynamic communication association. Examples: Typical examples include services calling other services, but also services calling databases, queue brokers, or other infrastructure entities.
`calls`	`DB_INSTANCE_POSTGRES`	dynamic	stable Defines a "horizontal" relationship between two entities that "call" each other. The "calls" relation does not imply a parent/child or other strong structural relation but rather a dynamic communication association. Examples: Typical examples include services calling other services, but also services calling databases, queue brokers, or other infrastructure entities.
`calls`	`DB_INSTANCE_MARIADB`	dynamic	stable Defines a "horizontal" relationship between two entities that "call" each other. The "calls" relation does not imply a parent/child or other strong structural relation but rather a dynamic communication association. Examples: Typical examples include services calling other services, but also services calling databases, queue brokers, or other infrastructure entities.
`calls`	`DB_INSTANCE_HANA`	dynamic	stable Defines a "horizontal" relationship between two entities that "call" each other. The "calls" relation does not imply a parent/child or other strong structural relation but rather a dynamic communication association. Examples: Typical examples include services calling other services, but also services calling databases, queue brokers, or other infrastructure entities.
`calls`	`DB_INSTANCE_DB2`	dynamic	stable Defines a "horizontal" relationship between two entities that "call" each other. The "calls" relation does not imply a parent/child or other strong structural relation but rather a dynamic communication association. Examples: Typical examples include services calling other services, but also services calling databases, queue brokers, or other infrastructure entities.
`calls`	`DB_DATABASE_MSSQL`	dynamic	stable Defines a "horizontal" relationship between two entities that "call" each other. The "calls" relation does not imply a parent/child or other strong structural relation but rather a dynamic communication association. Examples: Typical examples include services calling other services, but also services calling databases, queue brokers, or other infrastructure entities.
`calls`	`DB_DATABASE_ORACLE`	dynamic	stable Defines a "horizontal" relationship between two entities that "call" each other. The "calls" relation does not imply a parent/child or other strong structural relation but rather a dynamic communication association. Examples: Typical examples include services calling other services, but also services calling databases, queue brokers, or other infrastructure entities.
`calls`	`DB_DATABASE_MYSQL`	dynamic	stable Defines a "horizontal" relationship between two entities that "call" each other. The "calls" relation does not imply a parent/child or other strong structural relation but rather a dynamic communication association. Examples: Typical examples include services calling other services, but also services calling databases, queue brokers, or other infrastructure entities.
`calls`	`DB_DATABASE_POSTGRES`	dynamic	stable Defines a "horizontal" relationship between two entities that "call" each other. The "calls" relation does not imply a parent/child or other strong structural relation but rather a dynamic communication association. Examples: Typical examples include services calling other services, but also services calling databases, queue brokers, or other infrastructure entities.
`calls`	`DB_DATABASE_MARIADB`	dynamic	stable Defines a "horizontal" relationship between two entities that "call" each other. The "calls" relation does not imply a parent/child or other strong structural relation but rather a dynamic communication association. Examples: Typical examples include services calling other services, but also services calling databases, queue brokers, or other infrastructure entities.
`calls`	`DB_DATABASE_HANA`	dynamic	stable Defines a "horizontal" relationship between two entities that "call" each other. The "calls" relation does not imply a parent/child or other strong structural relation but rather a dynamic communication association. Examples: Typical examples include services calling other services, but also services calling databases, queue brokers, or other infrastructure entities.
`calls`	`DB_DATABASE_MEMBER_DB2`	dynamic	stable Defines a "horizontal" relationship between two entities that "call" each other. The "calls" relation does not imply a parent/child or other strong structural relation but rather a dynamic communication association. Examples: Typical examples include services calling other services, but also services calling databases, queue brokers, or other infrastructure entities.
`runs_on`	`PROCESS`	dynamic	stable Defines a "vertical" relation of an entity running on some other entity. It does not imply any composition or aggregation but only a looser association between the entities. One entity can run on multiple other entities. Examples: Service running on a POD, a CONTAINER or a HOST.
`runs_on`	`HOST`	dynamic	stable Defines a "vertical" relation of an entity running on some other entity. It does not imply any composition or aggregation but only a looser association between the entities. One entity can run on multiple other entities. Examples: Service running on a POD, a CONTAINER or a HOST.
`runs_on`	`CONTAINER`	dynamic	stable Defines a "vertical" relation of an entity running on some other entity. It does not imply any composition or aggregation but only a looser association between the entities. One entity can run on multiple other entities. Examples: Service running on a POD, a CONTAINER or a HOST.
`runs_on`	`K8S_POD`	dynamic	stable Defines a "vertical" relation of an entity running on some other entity. It does not imply any composition or aggregation but only a looser association between the entities. One entity can run on multiple other entities. Examples: Service running on a POD, a CONTAINER or a HOST.
`runs_on`	`OTEL_PROCESS`	dynamic	stable Defines a "vertical" relation of an entity running on some other entity. It does not imply any composition or aggregation but only a looser association between the entities. One entity can run on multiple other entities. Examples: Service running on a POD, a CONTAINER or a HOST.
`runs_on`	`OTEL_HOST`	dynamic	stable Defines a "vertical" relation of an entity running on some other entity. It does not imply any composition or aggregation but only a looser association between the entities. One entity can run on multiple other entities. Examples: Service running on a POD, a CONTAINER or a HOST.
`belongs_to`	`K8S_CLUSTER`	dynamic	stable This is similar to an aggregation in UML. It is a many-to-many relationship without existential properties (the destination is not composed of the sources).
`belongs_to`	`K8S_DAEMONSET`	dynamic	stable This is similar to an aggregation in UML. It is a many-to-many relationship without existential properties (the destination is not composed of the sources).
`belongs_to`	`K8S_DEPLOYMENT`	dynamic	stable This is similar to an aggregation in UML. It is a many-to-many relationship without existential properties (the destination is not composed of the sources).
`belongs_to`	`K8S_JOB`	dynamic	stable This is similar to an aggregation in UML. It is a many-to-many relationship without existential properties (the destination is not composed of the sources).
`belongs_to`	`K8S_NAMESPACE`	dynamic	stable This is similar to an aggregation in UML. It is a many-to-many relationship without existential properties (the destination is not composed of the sources).
`belongs_to`	`K8S_STATEFULSET`	dynamic	stable This is similar to an aggregation in UML. It is a many-to-many relationship without existential properties (the destination is not composed of the sources).
`belongs_to`	`K8S_CRONJOB`	static	stable This is similar to an aggregation in UML. It is a many-to-many relationship without existential properties (the destination is not composed of the sources).