Smartscape - Core entities

Latest Dynatrace
Reference

Contains entity definitions for core infrastructure entities stored in Smartscape on Grail, including hosts, processes, services, containers, disks, frontends, network interfaces, and OS services.

Query

Get all HOST, PROCESS, SERVICE and CONTAINER entities.

smartscapeNodes {HOST, PROCESS, SERVICE, CONTAINER}

Application Observability service

Smartscape node name: dt.service.name

Smartscape node type: SERVICE

An Application Observability (AppObs) service entity detected by service detection.

Service entities represent the horizontal topology of your environment based on distributed tracing data, providing detailed insights into caller-callee relationships.

Unlike other Smartscape entities, service entities do not contain primary Grail fields due to the flexibility of service detection rules. Use the following service timeseries instead to query this data (refer to the query examples below).

dt.service.request.count
dt.service.messaging.receive.count
dt.service.messaging.process.count
dt.service.faas_invoke.count

Query

Find all service entities.

smartscapeNodes SERVICE

Count all service relationships, grouped by relationship type.

smartscapeEdges "*"
| filter source_type == "SERVICE"
| fields type, source_id, source_type, target_id, target_type, dt.system.edge_kind
| summarize count(), by:{type}

Count runs_on relationships from services, grouped by target entity type.

smartscapeEdges runs_on
| filter source_type == "SERVICE"
| summarize count(), by:{target_type}

Count belongs_to relationships from services, grouped by target entity type.

smartscapeEdges belongs_to
| filter source_type == "SERVICE"
| summarize count(), by:{target_type}

Traverse all service-to-service call relationships of a service.

smartscapeNodes SERVICE
| filter id == toSmartscapeId("SERVICE-0123456789ABCDEF")
| traverse {"calls"}, {"SERVICE"}, direction:"forward"

Query the average response time for all downstream services called by a specific service (identified by its ID).

timeseries avg(dt.service.request.response_time), filter:dt.smartscape.service in [
  smartscapeEdges "calls"
  | filter source_type == "SERVICE"
  | filter source_id == toSmartscapeId("SERVICE-0123456789ABCDEF")
  | fields target_id
], by:{dt.smartscape.service}

Query the 95th percentile response time for all downstream services called by a specific service (identified by its name).

timeseries responseTime_p95_timeseries = percentile(dt.service.request.response_time, 95), filter:dt.smartscape.service in [
  smartscapeNodes "SERVICE"
  | filter name == "checkout-service"
  | traverse {"calls"}, {"SERVICE"}, direction:"forward"
  | fields id
], by:{dt.smartscape.service}, nonempty: true
| fieldsAdd metricName = "Response time p95"

Get service entities with primary fields

timeseries avg(dt.service.request.count), by:{dt.smartscape.service, dt.service.name, aws.account.id,aws.region,azure.location,azure.resource.group,azure.subscription,dt.host_group.id,gcp.project.id,gcp.region,k8s.cluster.name,k8s.namespace.name}
| fields id = dt.smartscape.service, name = dt.service.name, aws.account.id,aws.region,azure.location,azure.resource.group,azure.subscription,dt.host_group.id,gcp.project.id,gcp.region,k8s.cluster.name,k8s.namespace.name

Base entity fields

The following base fields are used for all entities.

Attribute	Type	Description	Examples
`id`	smartscapeId	stableDisplay name: `ID`A Smartscape ID consists of two components: an UPPER_CASE entity type and a random 16-character hexadecimal unique identifier, separated by a dash. Use Smartscape conversion functions when working with strings that represent Smartscape IDs.	`<type>-017198AD253CBD63`
`id_classic`	string	deprecatedDisplay name: `Classic ID`The entity ID that was used in the classic entity store. This ID is present in old monitoring data. Not all entities have this ID, and it is not generated for new entities. Use the `id` field instead, which is the Smartscape ID.	`<type>-017198AD253CBD63`
`name`	string	stableDisplay name: `Name`The entity name.	`localhost`; `easyTravel`; `product-catalog`
`type`	string	stableDisplay name: `Type`The entity type. UPPER_SNAKE_CASE string that represents the type of the entity.	`TYPE_A`
`tags`	record	stableDisplay name: `Tags`A consolidated record that aggregates all tag values originating from different contexts. Each nested field within tags represents a specific key (for example, `release` or `name`). The value of each nested field is the tag value from one or multiple contexts. Tags for specific context can be queried via `tags:context` field. Note that rule-based tags do not exist in the new model.	`tags[tag_key-1] = [context_A_tag_val-1, context_B_tag_val-1]`; `tags[tag_key-2] = context_C_tag_val-1`; `tags:context_A[tag_key-1] = context_A_tag_val-1`
`lifetime`	timeframe	stableDisplay name: `Lifetime`The lifetime of the entity. This is a record with two nested fields: `start` and `end`, which represent the time when the entity was first and last observed, respectively. Each time an entity is updated, the end time is updated to the current time.	`{ start: 2022-07-06T13:36:00.808Z, end: 2024-04-11T06:56:01.204Z }`
`references`	record	stableDisplay name: `References`Provides access to static edges pointing to other entities. In this record each nested field represents a relationship type and target type, and the value is an array of target smartscape IDs. This field is hidden by default but can be added using the fieldsAdd command.	`{ references[runs_on.host] : [HOST-C251A1173C2B4B39,HOST-0E9038C7C4409D69], references[runs_on.container] : [CONTAINER-68A08967EF4F675B] }`
`dt.security_context`	string[]	resource stableDisplay name: `DT security context`The security contexts associated with the entity. For Smartscape entities, this field is always an array.Tags: `permission`	`[]`

Service fields

Fields specific to services.

Attribute	Type	Description	Examples
`dt.service_detection.version`	long	resource stableDisplay name: `Service detection version`The version of the service detection mechanism used to identify the service. Either `1` for Service Detection Version 1 (SDv1) or `2` for Service Detection Version 2 (SDv2).	`1`; `2`
`dt.service.sdv1_type`	string	resource stableDisplay name: `SDv1 service type`The SDv1 service type. This field is available only if `dt.service_detection.version` is `1`.	`BACKGROUND_ACTIVITY`; `CUSTOM_SERVICE`; `RMI_SERVICE`; `RPC_SERVICE`; `SPAN`; `WEB_REQUEST_SERVICE`; `WEB_SERVICE`

dt.service.sdv1_type MUST be one of the following:

Value	Description
`BACKGROUND_ACTIVITY`	Background activity (process) service
`CICS_INTERACTION_SERVICE`	IBM CICS interaction service
`CICS_SERVICE`	IBM CICS service
`CUSTOM_APPLICATION`	Custom application service
`CUSTOM_SERVICE`	Custom (method-based) service
`DATABASE_SERVICE`	Database service
`ENTERPRISE_SERVICE_BUS_SERVICE`	Enterprise service bus (ESB) service
`IMS_INTERACTION_SERVICE`	IBM IMS interaction service
`IMS_SERVICE`	IBM IMS service
`MESSAGING_SERVICE`	Messaging service
`MOBILE_SERVICE`	Mobile service
`QUEUE_LISTENER_SERVICE`	Queue listener service
`RMI_SERVICE`	Java RMI service
`RPC_SERVICE`	Remote procedure call service
`SAAS_VENDOR`	SaaS vendor service
`SPAN`	Span-based service
`UNKNOWN`	Unknown service type
`WEBSITE`	Website
`WEB_REQUEST_SERVICE`	Web request service
`WEB_SERVICE`	Web service endpoint
`ZOS_CONNECT`	z/OS Connect service

Application Observability service relationships

Type	Target type	Kind	Description
`calls`	`SERVICE`	dynamic	stableDefines a "horizontal" relationship between two entities that "call" each other. The "calls" relation does not imply a parent/child or other strong structural relation but rather a dynamic communication association. Examples: Typical examples include services calling other services, but also services calling databases, queue brokers, or other infrastructure entities.
`calls`	`DB_INSTANCE_MSSQL`	dynamic	stableDefines a "horizontal" relationship between two entities that "call" each other. The "calls" relation does not imply a parent/child or other strong structural relation but rather a dynamic communication association. Examples: Typical examples include services calling other services, but also services calling databases, queue brokers, or other infrastructure entities.
`calls`	`DB_INSTANCE_ORACLE`	dynamic	stableDefines a "horizontal" relationship between two entities that "call" each other. The "calls" relation does not imply a parent/child or other strong structural relation but rather a dynamic communication association. Examples: Typical examples include services calling other services, but also services calling databases, queue brokers, or other infrastructure entities.
`calls`	`DB_INSTANCE_MYSQL`	dynamic	stableDefines a "horizontal" relationship between two entities that "call" each other. The "calls" relation does not imply a parent/child or other strong structural relation but rather a dynamic communication association. Examples: Typical examples include services calling other services, but also services calling databases, queue brokers, or other infrastructure entities.
`calls`	`DB_INSTANCE_POSTGRES`	dynamic	stableDefines a "horizontal" relationship between two entities that "call" each other. The "calls" relation does not imply a parent/child or other strong structural relation but rather a dynamic communication association. Examples: Typical examples include services calling other services, but also services calling databases, queue brokers, or other infrastructure entities.
`calls`	`DB_INSTANCE_MARIADB`	dynamic	stableDefines a "horizontal" relationship between two entities that "call" each other. The "calls" relation does not imply a parent/child or other strong structural relation but rather a dynamic communication association. Examples: Typical examples include services calling other services, but also services calling databases, queue brokers, or other infrastructure entities.
`calls`	`DB_INSTANCE_HANA`	dynamic	stableDefines a "horizontal" relationship between two entities that "call" each other. The "calls" relation does not imply a parent/child or other strong structural relation but rather a dynamic communication association. Examples: Typical examples include services calling other services, but also services calling databases, queue brokers, or other infrastructure entities.
`calls`	`DB_INSTANCE_DB2`	dynamic	stableDefines a "horizontal" relationship between two entities that "call" each other. The "calls" relation does not imply a parent/child or other strong structural relation but rather a dynamic communication association. Examples: Typical examples include services calling other services, but also services calling databases, queue brokers, or other infrastructure entities.
`calls`	`DB_DATABASE_MSSQL`	dynamic	stableDefines a "horizontal" relationship between two entities that "call" each other. The "calls" relation does not imply a parent/child or other strong structural relation but rather a dynamic communication association. Examples: Typical examples include services calling other services, but also services calling databases, queue brokers, or other infrastructure entities.
`calls`	`DB_DATABASE_ORACLE`	dynamic	stableDefines a "horizontal" relationship between two entities that "call" each other. The "calls" relation does not imply a parent/child or other strong structural relation but rather a dynamic communication association. Examples: Typical examples include services calling other services, but also services calling databases, queue brokers, or other infrastructure entities.
`calls`	`DB_DATABASE_MYSQL`	dynamic	stableDefines a "horizontal" relationship between two entities that "call" each other. The "calls" relation does not imply a parent/child or other strong structural relation but rather a dynamic communication association. Examples: Typical examples include services calling other services, but also services calling databases, queue brokers, or other infrastructure entities.
`calls`	`DB_DATABASE_POSTGRES`	dynamic	stableDefines a "horizontal" relationship between two entities that "call" each other. The "calls" relation does not imply a parent/child or other strong structural relation but rather a dynamic communication association. Examples: Typical examples include services calling other services, but also services calling databases, queue brokers, or other infrastructure entities.
`calls`	`DB_DATABASE_MARIADB`	dynamic	stableDefines a "horizontal" relationship between two entities that "call" each other. The "calls" relation does not imply a parent/child or other strong structural relation but rather a dynamic communication association. Examples: Typical examples include services calling other services, but also services calling databases, queue brokers, or other infrastructure entities.
`calls`	`DB_DATABASE_HANA`	dynamic	stableDefines a "horizontal" relationship between two entities that "call" each other. The "calls" relation does not imply a parent/child or other strong structural relation but rather a dynamic communication association. Examples: Typical examples include services calling other services, but also services calling databases, queue brokers, or other infrastructure entities.
`calls`	`DB_DATABASE_MEMBER_DB2`	dynamic	stableDefines a "horizontal" relationship between two entities that "call" each other. The "calls" relation does not imply a parent/child or other strong structural relation but rather a dynamic communication association. Examples: Typical examples include services calling other services, but also services calling databases, queue brokers, or other infrastructure entities.
`runs_on`	`PROCESS`	dynamic	stableDefines a "vertical" relation of an entity running on some other entity. It does not imply any composition or aggregation but only a looser association between the entities. One entity can run on multiple other entities. Examples: Service running on a POD, a CONTAINER or a HOST.
`runs_on`	`HOST`	dynamic	stableDefines a "vertical" relation of an entity running on some other entity. It does not imply any composition or aggregation but only a looser association between the entities. One entity can run on multiple other entities. Examples: Service running on a POD, a CONTAINER or a HOST.
`runs_on`	`CONTAINER`	dynamic	stableDefines a "vertical" relation of an entity running on some other entity. It does not imply any composition or aggregation but only a looser association between the entities. One entity can run on multiple other entities. Examples: Service running on a POD, a CONTAINER or a HOST.
`runs_on`	`K8S_POD`	dynamic	stableDefines a "vertical" relation of an entity running on some other entity. It does not imply any composition or aggregation but only a looser association between the entities. One entity can run on multiple other entities. Examples: Service running on a POD, a CONTAINER or a HOST.
`belongs_to`	`K8S_CLUSTER`	dynamic	stableThis is similar to an aggregation in UML. It is a many-to-many relationship without existential properties (the destination is not composed of the sources).
`belongs_to`	`K8S_DAEMONSET`	dynamic	stableThis is similar to an aggregation in UML. It is a many-to-many relationship without existential properties (the destination is not composed of the sources).
`belongs_to`	`K8S_DEPLOYMENT`	dynamic	stableThis is similar to an aggregation in UML. It is a many-to-many relationship without existential properties (the destination is not composed of the sources).
`belongs_to`	`K8S_JOB`	dynamic	stableThis is similar to an aggregation in UML. It is a many-to-many relationship without existential properties (the destination is not composed of the sources).
`belongs_to`	`K8S_NAMESPACE`	dynamic	stableThis is similar to an aggregation in UML. It is a many-to-many relationship without existential properties (the destination is not composed of the sources).
`belongs_to`	`K8S_STATEFULSET`	dynamic	stableThis is similar to an aggregation in UML. It is a many-to-many relationship without existential properties (the destination is not composed of the sources).
`belongs_to`	`K8S_CRONJOB`	static	stableThis is similar to an aggregation in UML. It is a many-to-many relationship without existential properties (the destination is not composed of the sources).

Container

Smartscape node name: container.name

Smartscape node type: CONTAINER

A container entity. Provides the core container fields plus potentially additional platform specific fields.

Query

Load all container entities from Smartscape and get their names.

smartscapeNodes CONTAINER
| fields name

Get all hosts that run containers in the "travel-advisor-demo" namespace.

smartscapeNodes CONTAINER
| filter k8s.namespace.name == "travel-advisor-demo"
| traverse runs_on, HOST

Get all containers with their IDs, names, namespace names, and Kubernetes labels.

smartscapeNodes CONTAINER
| fields id, name, k8s.namespace.name, k8s_labels = getNodeField(references[belongs_to.k8s_namespace][0], "tags:k8s.labels")

Base entity fields

The following base fields are used for all entities.

Attribute	Type	Description	Examples
`id`	smartscapeId	stableDisplay name: `ID`A Smartscape ID consists of two components: an UPPER_CASE entity type and a random 16-character hexadecimal unique identifier, separated by a dash. Use Smartscape conversion functions when working with strings that represent Smartscape IDs.	`<type>-017198AD253CBD63`
`id_classic`	string	deprecatedDisplay name: `Classic ID`The entity ID that was used in the classic entity store. This ID is present in old monitoring data. Not all entities have this ID, and it is not generated for new entities. Use the `id` field instead, which is the Smartscape ID.	`<type>-017198AD253CBD63`
`name`	string	stableDisplay name: `Name`The entity name.	`localhost`; `easyTravel`; `product-catalog`
`type`	string	stableDisplay name: `Type`The entity type. UPPER_SNAKE_CASE string that represents the type of the entity.	`TYPE_A`
`tags`	record	stableDisplay name: `Tags`A consolidated record that aggregates all tag values originating from different contexts. Each nested field within tags represents a specific key (for example, `release` or `name`). The value of each nested field is the tag value from one or multiple contexts. Tags for specific context can be queried via `tags:context` field. Note that rule-based tags do not exist in the new model.	`tags[tag_key-1] = [context_A_tag_val-1, context_B_tag_val-1]`; `tags[tag_key-2] = context_C_tag_val-1`; `tags:context_A[tag_key-1] = context_A_tag_val-1`
`lifetime`	timeframe	stableDisplay name: `Lifetime`The lifetime of the entity. This is a record with two nested fields: `start` and `end`, which represent the time when the entity was first and last observed, respectively. Each time an entity is updated, the end time is updated to the current time.	`{ start: 2022-07-06T13:36:00.808Z, end: 2024-04-11T06:56:01.204Z }`
`references`	record	stableDisplay name: `References`Provides access to static edges pointing to other entities. In this record each nested field represents a relationship type and target type, and the value is an array of target smartscape IDs. This field is hidden by default but can be added using the fieldsAdd command.	`{ references[runs_on.host] : [HOST-C251A1173C2B4B39,HOST-0E9038C7C4409D69], references[runs_on.container] : [CONTAINER-68A08967EF4F675B] }`
`dt.security_context`	string[]	resource stableDisplay name: `DT security context`The security contexts associated with the entity. For Smartscape entities, this field is always an array.Tags: `permission`	`[]`

Container fields

Attribute	Type	Description	Examples
`container.image.name`	string	resource experimentalDisplay name: `Container image name`Name of the image the container was built on.	`gcr.io/opentelemetry/operator`
`container.image.version`	string	resource experimentalDisplay name: `Container image version`	`0.1`
`container.image.digest`	string	resource experimentalDisplay name: `Container image digest`Immutable SHA‑256 hash of an image that uniquely identifies the exact image content in a registry.	`sha256:aa1ed41571fa937da61b5bcd7cf842981c7f026b516c18655bc2f3a9362b1fa5`
`container.id`	string	resource experimentalDisplay name: `Container ID`Container ID. Usually a UUID, as for example used to identify Docker containers. The UUID might be abbreviated.	`a3bf90e006b2`

Container fields

Attribute	Type	Description	Examples
`k8s.cluster.name`	string	resource stableDisplay name: `Kubernetes cluster name`The user-defined name of the cluster in Dynatrace. Doesn't need to be unique or immutable.Tags: `permission` `primary-field`	`unguard-dev`; `acme-prod10`
`k8s.cluster.uid`	string	resource stableDisplay name: `Kubernetes cluster UID`A pseudo-ID for the cluster, by default set to the UID of the kube-system namespace.	`1c7a24c7-ff51-46e0-bcc9-c52637ceec57`
`k8s.namespace.name`	string	resource stableDisplay name: `Kubernetes namespace name`The name of the namespace that the pod is running in.Tags: `permission` `primary-field`	`default`; `kube-system`
`k8s.workload.name`	string	resource stableDisplay name: `Kubernetes workload name`The name of the workload. ¹	`checkoutservice`
`k8s.workload.kind`	string	resource stableDisplay name: `Kubernetes workload kind`The type of the workload. The value is the Kubernetes object kind of the workload in lowercase. ²	`deployment`; `statefulset`; `cronjob`; `job`; `daemonset`; `replicaset`
`k8s.node.name`	string	resource stableDisplay name: `Kubernetes node name`Name of the node.	`cluster-pool-1-c3c7423d-azth`
`k8s.pod.name`	string	resource stableDisplay name: `Kubernetes pod name`The name of the pod.	`checkoutservice-7895755b94-mzs5m`
`k8s.pod.uid`	string	resource stableDisplay name: `Kubernetes pod UID`The UID of the pod.	`275ecb36-5aa8-4c2a-9c47-d8bb681b9aff`
`k8s.container.name`	string	resource stableDisplay name: `Kubernetes container name`The name of the container from the pod specification; must be unique within a pod. Container runtime usually uses different globally unique name (`container.name`).	`redis`
`k8s.container.type`	string	resource experimentalDisplay name: `Kubernetes container type`The type of the Kubernetes container.	`app`; `init`; `sidecar`; `ephemeral`

Optional, as field isn't created by OneAgent only monitoring.

Container relationships

Type	Target type	Kind	Description
`belongs_to`	`K8S_CLUSTER`	static	stableThis is similar to an aggregation in UML. It is a many-to-many relationship without existential properties (the destination is not composed of the sources).
`belongs_to`	`K8S_NAMESPACE`	static	stableThis is similar to an aggregation in UML. It is a many-to-many relationship without existential properties (the destination is not composed of the sources).
`is_part_of`	`K8S_CRONJOB`	static	stableDefines if the instance is part of a cluster, similar to a composition in UML. The source (child) cannot exist without the destination (parent).
`is_part_of`	`K8S_DAEMONSET`	static	stableDefines if the instance is part of a cluster, similar to a composition in UML. The source (child) cannot exist without the destination (parent).
`is_part_of`	`K8S_DEPLOYMENT`	static	stableDefines if the instance is part of a cluster, similar to a composition in UML. The source (child) cannot exist without the destination (parent).
`is_part_of`	`K8S_JOB`	static	stableDefines if the instance is part of a cluster, similar to a composition in UML. The source (child) cannot exist without the destination (parent).
`is_part_of`	`K8S_POD`	static	stableDefines if the instance is part of a cluster, similar to a composition in UML. The source (child) cannot exist without the destination (parent).
`is_part_of`	`K8S_REPLICASET`	static	stableDefines if the instance is part of a cluster, similar to a composition in UML. The source (child) cannot exist without the destination (parent).
`is_part_of`	`K8S_STATEFULSET`	static	stableDefines if the instance is part of a cluster, similar to a composition in UML. The source (child) cannot exist without the destination (parent).
`runs_on`	`HOST`	static	stableDefines a "vertical" relation of an entity running on some other entity. It does not imply any composition or aggregation but only a looser association between the entities. One entity can run on multiple other entities. Examples: Service running on a POD, a CONTAINER or a HOST.
`runs_on`	`K8S_NODE`	static	stableDefines a "vertical" relation of an entity running on some other entity. It does not imply any composition or aggregation but only a looser association between the entities. One entity can run on multiple other entities. Examples: Service running on a POD, a CONTAINER or a HOST.

DA monitoring configuration

Smartscape node name: name

Smartscape node type: DA_MONITORING_CONFIGURATION

A DA monitoring configuration entity that defines which projects are monitored and observed.

Query

Fetch all DA Monitoring Configuration entities.

smartscapeNodes DA_MONITORING_CONFIGURATION

Base entity fields

The following base fields are used for all entities.

Attribute	Type	Description	Examples
`id`	smartscapeId	stableDisplay name: `ID`A Smartscape ID consists of two components: an UPPER_CASE entity type and a random 16-character hexadecimal unique identifier, separated by a dash. Use Smartscape conversion functions when working with strings that represent Smartscape IDs.	`<type>-017198AD253CBD63`
`id_classic`	string	deprecatedDisplay name: `Classic ID`The entity ID that was used in the classic entity store. This ID is present in old monitoring data. Not all entities have this ID, and it is not generated for new entities. Use the `id` field instead, which is the Smartscape ID.	`<type>-017198AD253CBD63`
`name`	string	stableDisplay name: `Name`The entity name.	`localhost`; `easyTravel`; `product-catalog`
`type`	string	stableDisplay name: `Type`The entity type. UPPER_SNAKE_CASE string that represents the type of the entity.	`TYPE_A`
`tags`	record	stableDisplay name: `Tags`A consolidated record that aggregates all tag values originating from different contexts. Each nested field within tags represents a specific key (for example, `release` or `name`). The value of each nested field is the tag value from one or multiple contexts. Tags for specific context can be queried via `tags:context` field. Note that rule-based tags do not exist in the new model.	`tags[tag_key-1] = [context_A_tag_val-1, context_B_tag_val-1]`; `tags[tag_key-2] = context_C_tag_val-1`; `tags:context_A[tag_key-1] = context_A_tag_val-1`
`lifetime`	timeframe	stableDisplay name: `Lifetime`The lifetime of the entity. This is a record with two nested fields: `start` and `end`, which represent the time when the entity was first and last observed, respectively. Each time an entity is updated, the end time is updated to the current time.	`{ start: 2022-07-06T13:36:00.808Z, end: 2024-04-11T06:56:01.204Z }`
`references`	record	stableDisplay name: `References`Provides access to static edges pointing to other entities. In this record each nested field represents a relationship type and target type, and the value is an array of target smartscape IDs. This field is hidden by default but can be added using the fieldsAdd command.	`{ references[runs_on.host] : [HOST-C251A1173C2B4B39,HOST-0E9038C7C4409D69], references[runs_on.container] : [CONTAINER-68A08967EF4F675B] }`
`dt.security_context`	string[]	resource stableDisplay name: `DT security context`The security contexts associated with the entity. For Smartscape entities, this field is always an array.Tags: `permission`	`[]`

Monitoring configuration relationships

Type	Target type	Kind	Description
`sees`	`GCP_PROJECT`	static	experimentalDefines a visibility relationship where the source configuration has discovered the destination entity but does not actively monitor it. Used alongside `monitors` to distinguish projects that are visible to a DA monitoring configuration from those that are actively monitored. Enables the UI to show which configuration sees or monitors a given project and to detect overlaps across configurations. Applies to static edges only; dynamic edges are out of scope. Examples: A DA monitoring configuration sees project.
`monitors`	`GCP_PROJECT`	static	experimentalDefines monitoring relationship, where the source monitors the destination. Examples: A synthetic monitor monitors a frontend. A synthetic monitor or OneAgent monitors a host.

Digital Experience Frontend

Smartscape node name: frontend.name

Smartscape node type: FRONTEND

Representation of a Digital Experience Monitoring (DEM) frontend entity.

Query

Load all FRONTEND entities.

smartscapeNodes FRONTEND

Base entity fields

The following base fields are used for all entities.

Attribute	Type	Description	Examples
`id`	smartscapeId	stableDisplay name: `ID`A Smartscape ID consists of two components: an UPPER_CASE entity type and a random 16-character hexadecimal unique identifier, separated by a dash. Use Smartscape conversion functions when working with strings that represent Smartscape IDs.	`<type>-017198AD253CBD63`
`id_classic`	string	deprecatedDisplay name: `Classic ID`The entity ID that was used in the classic entity store. This ID is present in old monitoring data. Not all entities have this ID, and it is not generated for new entities. Use the `id` field instead, which is the Smartscape ID.	`<type>-017198AD253CBD63`
`name`	string	stableDisplay name: `Name`The entity name.	`localhost`; `easyTravel`; `product-catalog`
`type`	string	stableDisplay name: `Type`The entity type. UPPER_SNAKE_CASE string that represents the type of the entity.	`TYPE_A`
`tags`	record	stableDisplay name: `Tags`A consolidated record that aggregates all tag values originating from different contexts. Each nested field within tags represents a specific key (for example, `release` or `name`). The value of each nested field is the tag value from one or multiple contexts. Tags for specific context can be queried via `tags:context` field. Note that rule-based tags do not exist in the new model.	`tags[tag_key-1] = [context_A_tag_val-1, context_B_tag_val-1]`; `tags[tag_key-2] = context_C_tag_val-1`; `tags:context_A[tag_key-1] = context_A_tag_val-1`
`lifetime`	timeframe	stableDisplay name: `Lifetime`The lifetime of the entity. This is a record with two nested fields: `start` and `end`, which represent the time when the entity was first and last observed, respectively. Each time an entity is updated, the end time is updated to the current time.	`{ start: 2022-07-06T13:36:00.808Z, end: 2024-04-11T06:56:01.204Z }`
`references`	record	stableDisplay name: `References`Provides access to static edges pointing to other entities. In this record each nested field represents a relationship type and target type, and the value is an array of target smartscape IDs. This field is hidden by default but can be added using the fieldsAdd command.	`{ references[runs_on.host] : [HOST-C251A1173C2B4B39,HOST-0E9038C7C4409D69], references[runs_on.container] : [CONTAINER-68A08967EF4F675B] }`
`dt.security_context`	string[]	resource stableDisplay name: `DT security context`The security contexts associated with the entity. For Smartscape entities, this field is always an array.Tags: `permission`	`[]`

Digital Experience Frontend fields

Attribute	Type	Description	Examples
`frontend.name`	string	stableDisplay name: `Frontend name`The frontend name determined at ingest.Tags: `permission`	`my_frontend`

Digital Experience Frontend relationships

Type	Target type	Kind	Description
`calls`	`SERVICE`	static	stableDefines a "horizontal" relationship between two entities that "call" each other. The "calls" relation does not imply a parent/child or other strong structural relation but rather a dynamic communication association. Examples: Typical examples include services calling other services, but also services calling databases, queue brokers, or other infrastructure entities.

Disk

Smartscape node name: disk.name

Smartscape node type: DISK

A disk entity. Represents a storage disk attached to a host.

Query

Load all disks and the names of their parent hosts, and get the tags assigned to the host groups of their parent hosts

smartscapeNodes DISK
| fields id, name, host_name = host.name , host_group_tags = getNodeField(references[belongs_to.host][0], "tags")

Get all disks attached to the sap-hana-db host

smartscapeNodes HOST
| filter name == "sap-hana-db"
| traverse belongs_to, DISK, direction:backward

Base entity fields

The following base fields are used for all entities.

Attribute	Type	Description	Examples
`id`	smartscapeId	stableDisplay name: `ID`A Smartscape ID consists of two components: an UPPER_CASE entity type and a random 16-character hexadecimal unique identifier, separated by a dash. Use Smartscape conversion functions when working with strings that represent Smartscape IDs.	`<type>-017198AD253CBD63`
`id_classic`	string	deprecatedDisplay name: `Classic ID`The entity ID that was used in the classic entity store. This ID is present in old monitoring data. Not all entities have this ID, and it is not generated for new entities. Use the `id` field instead, which is the Smartscape ID.	`<type>-017198AD253CBD63`
`name`	string	stableDisplay name: `Name`The entity name.	`localhost`; `easyTravel`; `product-catalog`
`type`	string	stableDisplay name: `Type`The entity type. UPPER_SNAKE_CASE string that represents the type of the entity.	`TYPE_A`
`tags`	record	stableDisplay name: `Tags`A consolidated record that aggregates all tag values originating from different contexts. Each nested field within tags represents a specific key (for example, `release` or `name`). The value of each nested field is the tag value from one or multiple contexts. Tags for specific context can be queried via `tags:context` field. Note that rule-based tags do not exist in the new model.	`tags[tag_key-1] = [context_A_tag_val-1, context_B_tag_val-1]`; `tags[tag_key-2] = context_C_tag_val-1`; `tags:context_A[tag_key-1] = context_A_tag_val-1`
`lifetime`	timeframe	stableDisplay name: `Lifetime`The lifetime of the entity. This is a record with two nested fields: `start` and `end`, which represent the time when the entity was first and last observed, respectively. Each time an entity is updated, the end time is updated to the current time.	`{ start: 2022-07-06T13:36:00.808Z, end: 2024-04-11T06:56:01.204Z }`
`references`	record	stableDisplay name: `References`Provides access to static edges pointing to other entities. In this record each nested field represents a relationship type and target type, and the value is an array of target smartscape IDs. This field is hidden by default but can be added using the fieldsAdd command.	`{ references[runs_on.host] : [HOST-C251A1173C2B4B39,HOST-0E9038C7C4409D69], references[runs_on.container] : [CONTAINER-68A08967EF4F675B] }`
`dt.security_context`	string[]	resource stableDisplay name: `DT security context`The security contexts associated with the entity. For Smartscape entities, this field is always an array.Tags: `permission`	`[]`

Disk fields

Attribute	Type	Description	Examples
`disk.remote_disk_id`	long	resource stableDisplay name: `Remote disk ID`Unique identifier of remote disk	`0`; `16864135562327138441`; `18446744073709551615`

Disk relationships

Type	Target type	Kind	Description
`belongs_to`	`HOST`	static	stableThis is similar to an aggregation in UML. It is a many-to-many relationship without existential properties (the destination is not composed of the sources).

Host

Smartscape node name: host.name

Smartscape node type: HOST

A host entity representing either a virtual or physical machine, providing an OS-level view of the infrastructure. When OneAgent is running in application-only mode within a container, it can't provide a full OS-level view for the host running the container, so no host entity is created.

The tags field may contain tags from the following sources:

tags:environment: Environment tags—see Define tags and metadata for hosts
tags:aws: AWS tags defined on the EC2 instance - requires access to tags in the instance metadata
tags:azure: Azure tags defined on the Azure VM
tags:gcp: GCP tags defined on the GCP Compute Engine instance

Query

Find all hosts that belong to the discovery-mode-demo host group.

smartscapeNodes HOST
| filter dt.host_group.id == "discovery-mode-demo"

Find all hosts that belong to the demoability team.

smartscapeNodes HOST
| filter tags[dt_owner_team] == "team-demoability"

Find all resources of hosts that belong to the discovery-mode-demo host group.

smartscapeNodes HOST
| filter dt.host_group.id == "discovery-mode-demo"
| traverse {belongs_to}, {DISK, NETWORK_INTERFACE}, direction:backward

Find all EC2 instances that run hosts with x86 architecture and get their host group IDs.

smartscapeNodes HOST
| filter host.additional_system_info[system.architecture] == "x86"
| traverse runs_on, AWS_EC2_INSTANCE, fieldsKeep:dt.host_group.id
| fields id, name, dt.host_group.id = dt.traverse.history[-1][dt.host_group.id]

Base entity fields

The following base fields are used for all entities.

Attribute	Type	Description	Examples
`id`	smartscapeId	stableDisplay name: `ID`A Smartscape ID consists of two components: an UPPER_CASE entity type and a random 16-character hexadecimal unique identifier, separated by a dash. Use Smartscape conversion functions when working with strings that represent Smartscape IDs.	`<type>-017198AD253CBD63`
`id_classic`	string	deprecatedDisplay name: `Classic ID`The entity ID that was used in the classic entity store. This ID is present in old monitoring data. Not all entities have this ID, and it is not generated for new entities. Use the `id` field instead, which is the Smartscape ID.	`<type>-017198AD253CBD63`
`name`	string	stableDisplay name: `Name`The entity name.	`localhost`; `easyTravel`; `product-catalog`
`type`	string	stableDisplay name: `Type`The entity type. UPPER_SNAKE_CASE string that represents the type of the entity.	`TYPE_A`
`tags`	record	stableDisplay name: `Tags`A consolidated record that aggregates all tag values originating from different contexts. Each nested field within tags represents a specific key (for example, `release` or `name`). The value of each nested field is the tag value from one or multiple contexts. Tags for specific context can be queried via `tags:context` field. Note that rule-based tags do not exist in the new model.	`tags[tag_key-1] = [context_A_tag_val-1, context_B_tag_val-1]`; `tags[tag_key-2] = context_C_tag_val-1`; `tags:context_A[tag_key-1] = context_A_tag_val-1`
`lifetime`	timeframe	stableDisplay name: `Lifetime`The lifetime of the entity. This is a record with two nested fields: `start` and `end`, which represent the time when the entity was first and last observed, respectively. Each time an entity is updated, the end time is updated to the current time.	`{ start: 2022-07-06T13:36:00.808Z, end: 2024-04-11T06:56:01.204Z }`
`references`	record	stableDisplay name: `References`Provides access to static edges pointing to other entities. In this record each nested field represents a relationship type and target type, and the value is an array of target smartscape IDs. This field is hidden by default but can be added using the fieldsAdd command.	`{ references[runs_on.host] : [HOST-C251A1173C2B4B39,HOST-0E9038C7C4409D69], references[runs_on.container] : [CONTAINER-68A08967EF4F675B] }`
`dt.security_context`	string[]	resource stableDisplay name: `DT security context`The security contexts associated with the entity. For Smartscape entities, this field is always an array.Tags: `permission`	`[]`

Compute fields

Fields that are provided for compute units, both virtual machines and physical hosts.

Attribute	Type	Description	Examples
`cores`	string	stableDisplay name: `Cores`Number of primary compute units available on the monitored host. On bare metal machines this means physical CPUs. In virtualized environments these are the cores exposed by the hypervisor (vCPUs). Use logical_cores for scheduler visible count.	`4`
`logical_cores`	string	stableNumber of logical execution contexts (logical cores) visible to the operating system scheduler on monitored host. This includes SMT / Hyper-Threading.	`4`
`memory`	string	stableDisplay name: `Memory`Total memory of monitored host, expressed in bytes.	`8141684736`
`private_dns_name`	string	stableDisplay name: `Private DNS name`Todo	`ip-10-0-0-1.eu-central-1.compute.internal`; `instance-xyz.europe-west3-a.c.project-xyz.internal`
`public_ip`	ipAddress[]	stableDisplay name: `Public IP`IP address that is publicaly accessible. This is usually an IP address assigned to a NAT gateway or a load balancer, rather than to the instance itself.	`['3.121.45.10']`
`host.type`	string	resource experimentalDisplay name: `Host type`Virtual Machine type, such as SKU on Azure	`Standard_D2s_v3`; `m5.large`; `n1-standard-4`

Host fields

Attribute	Type	Description	Examples
`host.additional_system_info`	record	stableAdditional system information. Some attributes here are only available on certain systems (e.g. system.lpar exists only on AIX). Several attributes are numbered. E.g. attributes starting with system.processor_. will have the underscore programatically replaced with an index like [12], starting from [0]. Note that in these examples, a '_' is replaced with '[x]', where x is a number starting from 0.
`host.software_technologies`	record[]	stableAn array of software technologies associated with a host entity. Contains individual records with the following fields: type, edition, version.	`[ {"type": "KUBERNETES", , "edition": "worker", "version": "1.33.7"}, {"type": "KUBERNETES", , "edition": "master", "version": "1.33.0"} ]`
`custom_metadata`	record	stableA collection of additional metadata information imported to Dynatrace.	`OperatorVersion:v0.9.0`; `cluster-name:ext-demo1`
`hypervisor.type`	string	resource experimentalDisplay name: `Hypervisor type`Virtualization hypervisor identified. For physical machines, this value is empty.	`KVM`; `VMWARE`
`mac`	string[]	experimentalA collection of MAC addresses that can be used to identify this entity.	`['4C:03:4F:5B:E8:89']`
`os.architecture`	string	resource experimentalDisplay name: `OS architecture`Architecture of the CPU, discovered from the operating system.	`X86`
`os.type`	string	resource experimentalDisplay name: `OS type`Type of discovered operating system.	`LINUX`; `WINDOWS`
`os.version`	string	resource stableDisplay name: `OS version`The complete OS version, including patch, build, and other information.	`15.3.1`; `Ubuntu 16.04.7 LTS (Xenial Xerus) (kernel 4.15.0-206-generic)`; `Windows Server 2022 Datacenter 21H2 2009, ver. 10.0.20348`
`host.physical.memory`	long	resource experimentalDisplay name: `Physical memory`Physical memory of the monitored host, expressed in bytes. The value might be different than the total available memory, if features such as Active Memory Expansion are used.	`8141684736`
`dt.host_group.id`	string	resource stableDisplay name: `Host group ID`See Organize your environment using host groups. Note that host groups are identified by their name, not by the entity ID of the host group entity. For details on the entity ID, see `dt.entity.host_group`.Tags: `permission` `primary-field`	`myHostGroup`
`ip`	ipAddress[]	experimentalA collection of IP addresses that may be used to identify this entity.	`['192.168.0.1', '10.10.10.10']`; `['10.10.10.10']`; `['2001:0000:130F:0000:0000:09C0:876A:130B']`
`host.has_public_traffic`	boolean	resource experimentalIndicates whether the host has public traffic detected via eBPF Discovery. ¹	`true`

This field is supported only on Linux hosts with eBPF Discovery enabled and OneAgent installed in Full-stack or Infrastructure mode.

Kubernetes resource fields

Attribute	Type	Description	Examples
`k8s.cluster.name`	string	resource stableDisplay name: `Kubernetes cluster name`The user-defined name of the cluster in Dynatrace. Doesn't need to be unique or immutable.Tags: `permission` `primary-field`	`unguard-dev`; `acme-prod10`
`k8s.cluster.uid`	string	resource stableDisplay name: `Kubernetes cluster UID`A pseudo-ID for the cluster, by default set to the UID of the kube-system namespace.	`1c7a24c7-ff51-46e0-bcc9-c52637ceec57`
`k8s.node.name`	string	resource stableDisplay name: `Kubernetes node name`Name of the node.	`cluster-pool-1-c3c7423d-azth`

AWS resource fields

Attribute	Type	Description	Examples
`aws.availability_zone`	string	resource stableDisplay name: `Availability zone`A specific availability zone or array of zones in given AWS region.	`us-east-1a`; `us-east-1b`
`aws.region`	string	resource stableDisplay name: `AWS region`A specific geographical AWS Cloud location.Tags: `primary-field`	`us-east-1`
`aws.resource.id`	string	resource stableDisplay name: `AWS resource ID`Unique, immutable identifier assigned to the AWS cloud resource.	`i-0922cda4579db3a45`
`aws.account.id`	string	resource stableDisplay name: `AWS account ID`The 12-digit number, such as 123456789012, that uniquely identifies an AWS account.Tags: `permission` `primary-field`	`123456789012`
`aws.arn`	string	resource stableDisplay name: `AWS ARN`Amazon Resource Name (ARN).	`arn:aws:lambda:us-east-1:478983378254:function:acceptanceWeatherBackend`

Azure resource fields

Attribute	Type	Description	Examples
`azure.resource.group`	string	resource stableDisplay name: `Azure resource group`A resource group is a container that holds related resources for an Azure solution.Tags: `permission` `primary-field`	`demo-backend-rg`
`azure.subscription`	string	resource stableDisplay name: `Azure subscription`An Azure subscription is a logical container used to provision resources in Azure.Tags: `permission` `primary-field`	`27e9b03f-04d2-2b69-b327-32f433f7ed21`
`azure.resource.id`	string	resource experimentalDisplay name: `Azure resource ID`A unique, immutable identifier assigned to each Azure cloud resource.	`/subscriptions/27e9b03f-04d2-2b69-b327-32f433f7ed21/resourceGroups/demo-backend-rg/providers/Microsoft.ContainerService/managedClusters/demo-aks`
`azure.location`	string	resource stableDisplay name: `Azure location`A specific geographical location of Azure cloud resource.Tags: `primary-field`	`westeurope`

GCP resource fields

Attribute	Type	Description	Examples
`gcp.project.id`	string	resource stableDisplay name: `GCP project ID`Identifier of the GCP project associated with this resource.Tags: `permission` `primary-field`	`dynatrace-gcp-extension`
`gcp.region`	string	resource stableDisplay name: `GCP region`A region is a specific geographical location where you can host your resources.Tags: `primary-field`	`europe-west3`
`gcp.resource.name`	string	resource stableDisplay name: `GCP resource name`The globally unique resource name in Google Cloud Platform convention.	`//cloudfunctions.googleapis.com/projects/gcp-example-project/locations/us-central1/functions/examplefunction`
`gcp.location`	string	resource stableDisplay name: `GCP location`Region or zone where GCP resource instance is running.	`europe-west3-c`
`gcp.resource.type`	string	resource stableDisplay name: `GCP resource type`The name of a monitored resource type available in Google Cloud Monitoring and Logging.	`cloudsql_database`

AIX fields

Attribute	Type	Description	Examples
`host.virtual.cpus`	long	resource experimentalDisplay name: `Virtual cpus`Number of virtual CPUs for AIX LPAR.	`2`
`host.logical.cpus`	long	resource experimentalDisplay name: `Logical cpus`Logical CPUs on the monitored host. Applies to AIX LPARs.	`8`
`host.simultaneous.multithreading`	long	resource experimentalDisplay name: `Simultaneous multithreading`Number of threads for AIX Simultaneous Multithreading feature.	`4`

z/OS fields

Attribute	Type	Description	Examples
`zos.lpar_name`	string	resource experimentalDisplay name: `z/OS lpar name`The name of the LPAR that the z/OS address space executes within.	`S0W1`; `ABCD`

BOSH fields

Attribute	Type	Description	Examples
`bosh.name`	string	resource experimentalDisplay name: `BOSH name`A unique identifier to a deployment or instance.	`isolated_diego_cell_devima`
`bosh.instance_id`	string	resource experimentalDisplay name: `BOSH instance ID`A unique identifier assigned to each deployed instance.	`af318409-9e9d-4a18-aca4-0fb52bbdc526`
`bosh.availability_zone`	string	resource experimentalDisplay name: `BOSH availability zone`A specific geographical BOSH location.	`us-east-1a`
`bosh.deployment.id`	string	resource stableDisplay name: `BOSH deployment ID`BOSH depoloyment ID, retrievied from /var/vcap on monitored host.	`cf-c32ffe771e4ad26b9711`
`bosh.instance.name`	string	resource stableDisplay name: `BOSH instance name`BOSH instance name, retrievied from /var/vcap on monitored host.	`diego_database`
`bosh.stemcell.version`	string	resource stableDisplay name: `BOSH stemcell version`Version of BOSH stemcell, retrievied from /var/vcap on monitored host.	`621.448`

Host relationships

Type	Target type	Kind	Description
`calls`	`HOST`	dynamic	stableDefines a "horizontal" relationship between two entities that "call" each other. The "calls" relation does not imply a parent/child or other strong structural relation but rather a dynamic communication association. Examples: Typical examples include services calling other services, but also services calling databases, queue brokers, or other infrastructure entities.

Network Interface

Smartscape node name: network_interface.name

Smartscape node type: NETWORK_INTERFACE

A network interface entity. Represents a network interface attached to a host.

Query

Load all network interfaces and the names of their parent hosts, and get the tags assigned to their parent hosts

smartscapeNodes NETWORK_INTERFACE
| fields id, name, host.name, host.tags = getNodeField(references[belongs_to.host][0], "tags")

Find the host to which the network interface with the specified MAC address is attached.

smartscapeNodes NETWORK_INTERFACE
| filter mac == "16:FF:F1:39:CE:99"
| traverse belongs_to, HOST

Base entity fields

The following base fields are used for all entities.

Attribute	Type	Description	Examples
`id`	smartscapeId	stableDisplay name: `ID`A Smartscape ID consists of two components: an UPPER_CASE entity type and a random 16-character hexadecimal unique identifier, separated by a dash. Use Smartscape conversion functions when working with strings that represent Smartscape IDs.	`<type>-017198AD253CBD63`
`id_classic`	string	deprecatedDisplay name: `Classic ID`The entity ID that was used in the classic entity store. This ID is present in old monitoring data. Not all entities have this ID, and it is not generated for new entities. Use the `id` field instead, which is the Smartscape ID.	`<type>-017198AD253CBD63`
`name`	string	stableDisplay name: `Name`The entity name.	`localhost`; `easyTravel`; `product-catalog`
`type`	string	stableDisplay name: `Type`The entity type. UPPER_SNAKE_CASE string that represents the type of the entity.	`TYPE_A`
`tags`	record	stableDisplay name: `Tags`A consolidated record that aggregates all tag values originating from different contexts. Each nested field within tags represents a specific key (for example, `release` or `name`). The value of each nested field is the tag value from one or multiple contexts. Tags for specific context can be queried via `tags:context` field. Note that rule-based tags do not exist in the new model.	`tags[tag_key-1] = [context_A_tag_val-1, context_B_tag_val-1]`; `tags[tag_key-2] = context_C_tag_val-1`; `tags:context_A[tag_key-1] = context_A_tag_val-1`
`lifetime`	timeframe	stableDisplay name: `Lifetime`The lifetime of the entity. This is a record with two nested fields: `start` and `end`, which represent the time when the entity was first and last observed, respectively. Each time an entity is updated, the end time is updated to the current time.	`{ start: 2022-07-06T13:36:00.808Z, end: 2024-04-11T06:56:01.204Z }`
`references`	record	stableDisplay name: `References`Provides access to static edges pointing to other entities. In this record each nested field represents a relationship type and target type, and the value is an array of target smartscape IDs. This field is hidden by default but can be added using the fieldsAdd command.	`{ references[runs_on.host] : [HOST-C251A1173C2B4B39,HOST-0E9038C7C4409D69], references[runs_on.container] : [CONTAINER-68A08967EF4F675B] }`
`dt.security_context`	string[]	resource stableDisplay name: `DT security context`The security contexts associated with the entity. For Smartscape entities, this field is always an array.Tags: `permission`	`[]`

Network Interface fields

Fields specific to network interfaces.

Attribute	Type	Description	Examples
`networkinterface.speed`	long	stableDisplay name: `Network interface speed`Speed of the network interface, expressed in bits per second.	`1000000000`; `10000000000`
`mac`	string[]	experimentalA collection of MAC addresses that can be used to identify this entity.	`['4C:03:4F:5B:E8:89']`
`ip`	ipAddress[]	experimentalA collection of IP addresses that may be used to identify this entity.	`['192.168.0.1', '10.10.10.10']`; `['10.10.10.10']`; `['2001:0000:130F:0000:0000:09C0:876A:130B']`

Network Interface relationships

Type	Target type	Kind	Description
`belongs_to`	`HOST`	static	stableThis is similar to an aggregation in UML. It is a many-to-many relationship without existential properties (the destination is not composed of the sources).

OS service

Smartscape node name: os_service.display_name

Smartscape node type: OS_SERVICE

Representation of an operating system service, which is a background process that performs specific functions and is typically managed by the operating system's service manager. OS services can include things like web servers, database servers, and other types of background processes that are essential for the functioning of an operating system and its applications.

Query

Get all OS services attached to the sap-hana-db host

smartscapeNodes HOST
| filter name == "sap-hana-db"
| traverse belongs_to, OS_SERVICE, direction:backward

Base entity fields

The following base fields are used for all entities.

Attribute	Type	Description	Examples
`id`	smartscapeId	stableDisplay name: `ID`A Smartscape ID consists of two components: an UPPER_CASE entity type and a random 16-character hexadecimal unique identifier, separated by a dash. Use Smartscape conversion functions when working with strings that represent Smartscape IDs.	`<type>-017198AD253CBD63`
`id_classic`	string	deprecatedDisplay name: `Classic ID`The entity ID that was used in the classic entity store. This ID is present in old monitoring data. Not all entities have this ID, and it is not generated for new entities. Use the `id` field instead, which is the Smartscape ID.	`<type>-017198AD253CBD63`
`name`	string	stableDisplay name: `Name`The entity name.	`localhost`; `easyTravel`; `product-catalog`
`type`	string	stableDisplay name: `Type`The entity type. UPPER_SNAKE_CASE string that represents the type of the entity.	`TYPE_A`
`tags`	record	stableDisplay name: `Tags`A consolidated record that aggregates all tag values originating from different contexts. Each nested field within tags represents a specific key (for example, `release` or `name`). The value of each nested field is the tag value from one or multiple contexts. Tags for specific context can be queried via `tags:context` field. Note that rule-based tags do not exist in the new model.	`tags[tag_key-1] = [context_A_tag_val-1, context_B_tag_val-1]`; `tags[tag_key-2] = context_C_tag_val-1`; `tags:context_A[tag_key-1] = context_A_tag_val-1`
`lifetime`	timeframe	stableDisplay name: `Lifetime`The lifetime of the entity. This is a record with two nested fields: `start` and `end`, which represent the time when the entity was first and last observed, respectively. Each time an entity is updated, the end time is updated to the current time.	`{ start: 2022-07-06T13:36:00.808Z, end: 2024-04-11T06:56:01.204Z }`
`references`	record	stableDisplay name: `References`Provides access to static edges pointing to other entities. In this record each nested field represents a relationship type and target type, and the value is an array of target smartscape IDs. This field is hidden by default but can be added using the fieldsAdd command.	`{ references[runs_on.host] : [HOST-C251A1173C2B4B39,HOST-0E9038C7C4409D69], references[runs_on.container] : [CONTAINER-68A08967EF4F675B] }`
`dt.security_context`	string[]	resource stableDisplay name: `DT security context`The security contexts associated with the entity. For Smartscape entities, this field is always an array.Tags: `permission`	`[]`

OS Service fields

Attribute	Type	Description	Examples
`os_service.name`	string	resource experimentalDisplay name: `OS service name`Unique OS service name. On Windows, this is the short programmatic key as reported by the Service Control Manager (e.g., `wuauserv`), which may differ from display name (e.g., `Windows Update`). On Linux, this is the systemd unit name (e.g., `nginx.service`).	`myosservice`
`os_service.path`	string	resource experimentalDisplay name: `OS service path`The full path to the process executable. On Linux based systems, this can be set to the target of `proc/[pid]/exe`. On Windows, it can be set to the result of `GetProcessImageFileNameW`.	`/usr/bin/cmd/otelcol`
`os_service.startup_type`	string	resource experimentalDisplay name: `OS service startup type`Current startup type.	`auto`
`os_service.status`	string	experimentalDisplay name: `OS service status`Current running state.	`activating`
`os_service.manufacturer`	string	resource experimentalDisplay name: `OS service manufacturer`Manufacturer of the service. On Linux based systems, the value will always be `-`, meaning empty.	`-`; `SSH Corp.`
`os_service.alerting`	boolean	experimentalDisplay name: `OS service alerting`Boolean attribute deciding whether the service status triggers alerts or not.

os_service.startup_type MUST be one of the following:

Value	Description	Display name
`auto`	Windows specific. Automatic: The service starts at system logon.	Auto
`auto_delay`	Windows specific. Automatic (Delayed Start): The service starts a short while after the system has finished starting up.	Auto Delay
`auto_delay_trigger`	Windows specific. Automatic (Delayed Start, Trigger Start)	Auto Delay Trigger
`auto_trigger`	Windows specific. Automatic (Trigger Start): This service will start automatically at boot.	Auto Trigger
`disabled`	Linux specific. Service is configured to not start when the system boots, but can be started manually, or as a dependency of another service.	Disabled
`enabled`	Linux specific. Service is marked for starting up on boot.	Enabled
`enabled-runtime`	Linux specific. Service is marked for starting up on boot.	Enabled Runtime
`indirect`	Linux specific. Service is not enabled directly but can be activated via dependencies or aliases.
`linked`	Linux specific. Service unit file is symlinked into systemd from an external location persistently.
`linked-runtime`	Linux specific. Service unit file is temporarily symlinked into systemd for the current runtime only.
`manual`	Windows specific. Manual: The service starts only when explicitly summoned.	Manual
`manual_trigger`	Windows specific. Manual (Trigger Start): This service will not start automatically at boot.	Manual Trigger
`static`	Linux specific. Service is not enabled and can only start when pulled in by dependencies or started manually.	Static

os_service.status MUST be one of the following:

Value	Description	Display name
`activating`	Service is activating.	Activating
`active`	Service is active.	Active
`continue_pending`	Service continues pending.	Continue Pending
`deactivating`	Service is deactivating.	Deactivating
`failed`	Service failed to start.	Failed
`inactive`	Service is inactive.	Inactive
`pause_pending`	Service paused pending.	Pause Pending
`paused`	Service is currently paused.	Paused
`reloading`	Service is reloading.	Reloading
`running`	Service is currently running.	Running
`start_pending`	Service started pending.	Start Pending
`stop_pending`	Service stopped pending.	Stop Pending
`stopped`	Service is currently stopped.	Stopped

OS service relationships

Type	Target type	Kind	Description
`runs_on`	`HOST`	static	stableDefines a "vertical" relation of an entity running on some other entity. It does not imply any composition or aggregation but only a looser association between the entities. One entity can run on multiple other entities. Examples: Service running on a POD, a CONTAINER or a HOST.
`runs_on`	`PROCESS`	static	stableDefines a "vertical" relation of an entity running on some other entity. It does not imply any composition or aggregation but only a looser association between the entities. One entity can run on multiple other entities. Examples: Service running on a POD, a CONTAINER or a HOST.

Process

Smartscape node name: process.name

Smartscape node type: PROCESS

The process entity aggregates similar processes executing on the same operating system (native or containerized), ensuring data continuity across process restarts and grouping workers performing similar roles. In Dynatrace Classic, this corresponds to the Process Group Instance (PGI).

The tags field may contain tags from the following sources:

tags:environment: Tags based on environment variables

Query

Find all NodeJS processes.

smartscapeNodes PROCESS
| fieldsAdd process.software_technologies = arrayConcat(process.software_technologies.os,process.software_technologies.webserver,process.software_technologies.nodejs)
| expand process.software_technologies
| filter process.software_technologies[type] == "NODE_JS"
| dedup id

Find all hosts that have processes listening on port 8080.

smartscapeNodes PROCESS
| filter in(port, 8080)
| traverse runs_on, HOST

Find all processes with command line arguments "java -jar app.jar".

smartscapeNodes PROCESS
| filter process.metadata[COMMAND_LINE_ARGS] == "java -jar app.jar"

Find all processes that call processes with executable name "java".

smartscapeNodes PROCESS
| filter process.metadata[EXE_NAME] == "java"
| traverse calls, PROCESS, direction:backward

Get a list of all software technologies detected on processes

smartscapeNodes PROCESS
| fieldsAdd process.software_technologies = arrayConcat(process.software_technologies.os,process.software_technologies.java,process.software_technologies.dotnet,process.software_technologies.webserver,process.software_technologies.wsb,process.software_technologies.php,process.software_technologies.nodejs,process.software_technologies.ruby,process.software_technologies.varnish,process.software_technologies.go,process.software_technologies.python)

Get the process type based on detected software technologies

smartscapeNodes PROCESS
| fieldsAdd process_type = coalesce(
  if (process.software_technologies.os ~ "REDIS", "REDIS"),
  if (process.software_technologies.os ~ "MONGODB", "MONGODB"),
  if (process.software_technologies.os ~ "MSSQL", "MSSQL"),
  if (process.software_technologies.os ~ "MYSQL", "MYSQL"),
  if (process.software_technologies.os ~ "SQLITE", "SQLITE"),
  if (process.software_technologies.os ~ "POSTGRES", "POSTGRES"),
  if (process.software_technologies.os ~ "ORACLE_DB", "ORACLE_DB"),
  if (process.software_technologies.os ~ "DB2", "DB2"),
  if (process.software_technologies.os ~ "TOMCAT", "TOMCAT"),
  if (process.software_technologies.os ~ "WEBLOGIC", "WEBLOGIC"),
  if (process.software_technologies.os ~ "WEBSPHERE", "WEBSPHERE"),
  if (process.software_technologies.os ~ "ACTIVEMQ_CLIENT", "ACTIVEMQ_CLIENT"),
  if (process.software_technologies.os ~ "JAVA", "JAVA"),
  if (process.software_technologies.os ~ "NGINX", "NGINX"),
  if (process.software_technologies.os ~ "APACHE_HTTPD", "APACHE_HTTPD"),
  if (process.software_technologies.os ~ "IIS_APP_POOL", "IIS_APP_POOL"),
  if (process.software_technologies.os ~ "IIS", "IIS"),
  if (process.software_technologies.os ~ "DOTNET", "DOTNET"),
  if (process.software_technologies.os ~ "NODE_JS", "NODE_JS"),
  if (process.software_technologies.os ~ "PHP", "PHP"),
  if (process.software_technologies.os ~ "PYTHON", "PYTHON"),
  if (process.software_technologies.os ~ "RUBY", "RUBY"),
  if (process.software_technologies.os ~ "GO", "GO"),
  if (process.software_technologies.os ~ "ERLANG", "ERLANG"),
  if (process.software_technologies.os ~ "IBM_CICS_REGION", "IBM_CICS_REGION"),
  if (process.software_technologies.os ~ "HAPROXY", "HAPROXY"),
  if (process.software_technologies.os ~ "ENVOY", "ENVOY"),
  if (process.software_technologies.os ~ "LINUX_SYSTEM", "LINUX_SYSTEM"),
  if (process.software_technologies.os ~ "WINDOWS_SYSTEM", "WINDOWS_SYSTEM"),
  if (isNotNull(process.software_technologies.os), process.software_technologies.os[0][type])
)

Base entity fields

The following base fields are used for all entities.

Attribute	Type	Description	Examples
`id`	smartscapeId	stableDisplay name: `ID`A Smartscape ID consists of two components: an UPPER_CASE entity type and a random 16-character hexadecimal unique identifier, separated by a dash. Use Smartscape conversion functions when working with strings that represent Smartscape IDs.	`<type>-017198AD253CBD63`
`id_classic`	string	deprecatedDisplay name: `Classic ID`The entity ID that was used in the classic entity store. This ID is present in old monitoring data. Not all entities have this ID, and it is not generated for new entities. Use the `id` field instead, which is the Smartscape ID.	`<type>-017198AD253CBD63`
`name`	string	stableDisplay name: `Name`The entity name.	`localhost`; `easyTravel`; `product-catalog`
`type`	string	stableDisplay name: `Type`The entity type. UPPER_SNAKE_CASE string that represents the type of the entity.	`TYPE_A`
`tags`	record	stableDisplay name: `Tags`A consolidated record that aggregates all tag values originating from different contexts. Each nested field within tags represents a specific key (for example, `release` or `name`). The value of each nested field is the tag value from one or multiple contexts. Tags for specific context can be queried via `tags:context` field. Note that rule-based tags do not exist in the new model.	`tags[tag_key-1] = [context_A_tag_val-1, context_B_tag_val-1]`; `tags[tag_key-2] = context_C_tag_val-1`; `tags:context_A[tag_key-1] = context_A_tag_val-1`
`lifetime`	timeframe	stableDisplay name: `Lifetime`The lifetime of the entity. This is a record with two nested fields: `start` and `end`, which represent the time when the entity was first and last observed, respectively. Each time an entity is updated, the end time is updated to the current time.	`{ start: 2022-07-06T13:36:00.808Z, end: 2024-04-11T06:56:01.204Z }`
`references`	record	stableDisplay name: `References`Provides access to static edges pointing to other entities. In this record each nested field represents a relationship type and target type, and the value is an array of target smartscape IDs. This field is hidden by default but can be added using the fieldsAdd command.	`{ references[runs_on.host] : [HOST-C251A1173C2B4B39,HOST-0E9038C7C4409D69], references[runs_on.container] : [CONTAINER-68A08967EF4F675B] }`
`dt.security_context`	string[]	resource stableDisplay name: `DT security context`The security contexts associated with the entity. For Smartscape entities, this field is always an array.Tags: `permission`	`[]`

Process group fields

Contains fields that share values for all entities belonging to a given process group.

Attribute	Type	Description	Examples
`dt.process_group.id`	string	resource stableDisplay name: `Process group ID`The identifier shared by all entities belonging to a given process group.	`PROCESS_GROUP-1234`
`dt.process_group.detected_name`	string	resource stableDisplay name: `Process group name`The name of the process group as it was detect by the agent.	`Apache Web Server httpd`; `Redis unguard-redis-* redis`; `Linux System`

Process fields

Fields specific to processes.

Attribute	Type	Description	Examples
`process.containerized`	boolean	resource experimentalDisplay name: `Is containerized`True if given process is running inside container.
`process.bitness`	string	resource experimentalDisplay name: `Process bitness`The architecture of the monitored entity in terms of how many bits compose a basic value.	`64`
`custom_metadata`	record	stableA collection of additional metadata information imported to Dynatrace.	`OperatorVersion:v0.9.0`; `cluster-name:ext-demo1`
`port`	long	experimentalA port property.	`42`
`process.metadata`	record	resource experimentalDisplay name: `Process metadata`It contains a diagnostic collection of input parameters that were used or could have been used in assigning processes to the process entity.	`NODE_JS_APP_BASE_DIRECTORY:C:/home/site/wwwroot`
`process.metadata.id_keys`	array	resource experimentalDisplay name: `Process metadata ID keys`Keys of non-ignored input parameters used to calculate the process entity ID.	`['NODE_JS_APP_BASE_DIRECTORY', 'EXE_NAME', 'PYTHON_SCRIPT_PATH']`
`process.software_technologies.os`	record[]	stableAn array of software technologies observed by the OneAgent OS module associated with a process entity. Contains individual records with the following fields: type, edition, version.	`[ {"type": "APACHE_CASSANDRA", "edition": "", "version": "4.1.10"}, {"type": "NODE_JS", "edition": "", "version": "20.19.5"} ]`
`process.software_technologies.java`	record[]	stableAn array of software technologies observed by the OneAgent Java module associated with a process entity. Contains individual records with the following fields: type, edition, version.	`[ {"type": "SPRING", "edition": "SPRING_BOOT", "version": "3.2.0"}, {"type": "JAVA", "edition": "OPEN_JDK", "version": "17.0.7"} ]`
`process.software_technologies.dotnet`	record[]	stableAn array of software technologies observed by the OneAgent .NET module associated with a process entity. Contains individual records with the following fields: type, edition, version.	`[ {"type": "DOTNET", "edition": "CORE", "version": "7.0.5"}, {"type": "ASP_NET", "edition": "CORE", "version": "7.0.5"} ]`
`process.software_technologies.webserver`	record[]	stableAn array of web server software technologies observed by the OneAgent web server modules associated with a process entity. Contains individual records with the following fields: type, edition, version.	`[ {"type": " APACHE_HTTPD", "edition": "", "version": "2.4.57"}, {"type": "NGINX", "edition": "", "version": "2.0.0"} ]`
`process.software_technologies.wsmb`	record[]	stableAn array of software technologies observed by the OneAgent WSMB module associated with a process entity. Contains individual records with the following fields: type, edition, version.	`[ {"type": "WORDPRESS", "edition": "", "version": "6.3.1"} ]`
`process.software_technologies.php`	record[]	stableAn array of software technologies observed by the OneAgent PHP module associated with a process entity. Contains individual records with the following fields: type, edition, version.	`[ {"type": "WORDPRESS", "edition": "", "version": "6.3.1"} ]`
`process.software_technologies.nodejs`	record[]	stableAn array of software technologies observed by the OneAgent Node.js module associated with a process entity. Contains individual records with the following fields: type, edition, version.	`[ {"type": "EXPRESS", "edition": "", "version": "4.18.2"}, {"type": "NODE_JS", "edition": "", "version": "20.19.5"} ]`
`process.software_technologies.ruby`	record[]	stableAn array of software technologies observed by the OneAgent Ruby module associated with a process entity. Contains individual records with the following fields: type, edition, version.	`[ {"type": "RAILS", "edition": "", "version": "7.0.4"}, {"type": "RUBY", "edition": "", "version": "3.2.2"} ]`
`process.software_technologies.varnish`	record[]	stableAn array of software technologies observed by the OneAgent Varnish module associated with a process entity. Contains individual records with the following fields: type, edition, version.	`[ {"type": "VARNISH_CACHE", "edition": "", "version": "7.0.0"} ]`
`process.software_technologies.go`	record[]	stableAn array of software technologies observed by the OneAgent Go module associated with a process entity. Contains individual records with the following fields: type, edition, version.	`[ {"type": "GO", "edition": "", "version": "1.23.5"} ]`
`process.software_technologies.python`	record[]	stableAn array of software technologies observed by the OneAgent Python module associated with a process entity. Contains individual records with the following fields: type, edition, version.	`[ {"type": "DJANGO", "edition": "", "version": "4.2.3"}, {"type": "PYTHON", "edition": "", "version": "3.12.6"} ]`
`process.has_public_traffic`	boolean	resource experimentalIndicates whether the process has public traffic detected via eBPF Discovery. ¹	`true`

This field is supported only on Linux hosts with eBPF Discovery enabled and OneAgent installed on the host.

Kubernetes fields

Attribute	Type	Description	Examples
`k8s.cluster.name`	string	resource stableDisplay name: `Kubernetes cluster name`The user-defined name of the cluster in Dynatrace. Doesn't need to be unique or immutable.Tags: `permission` `primary-field`	`unguard-dev`; `acme-prod10`

Process relationships

Type	Target type	Kind	Description
`calls`	`PROCESS`	dynamic	stableDefines a "horizontal" relationship between two entities that "call" each other. The "calls" relation does not imply a parent/child or other strong structural relation but rather a dynamic communication association. Examples: Typical examples include services calling other services, but also services calling databases, queue brokers, or other infrastructure entities.
`runs_on`	`CONTAINER`	static	stableDefines a "vertical" relation of an entity running on some other entity. It does not imply any composition or aggregation but only a looser association between the entities. One entity can run on multiple other entities. Examples: Service running on a POD, a CONTAINER or a HOST.
`runs_on`	`HOST`	static	stableDefines a "vertical" relation of an entity running on some other entity. It does not imply any composition or aggregation but only a looser association between the entities. One entity can run on multiple other entities. Examples: Service running on a POD, a CONTAINER or a HOST.