System events are used to store details about executed queries, auditing events, billing events and more. In order to query system events, you need the storage:system:read permission.
Query
Query system events.
fetch dt.system.events
AI Function Standard Call billing usage
Model describing a billing usage event for AI Function Standard Calls. Billing usage events are stored in the dt.system.events table.
Query
Analyze billing usage events for AI Function Standard Calls.
fetch dt.system.events
|filter event.kind == "BILLING_USAGE_EVENT" and event.type == "AI Function Standard Call"
|dedup event.id
Analyze billing usage of AI Function Standard Calls by tool and caller type.
fetch dt.system.events
|filter event.kind == "BILLING_USAGE_EVENT" and event.type == "AI Function Standard Call"
stableNumber of billed invocations. Unit is 1/4 GiB * min
8
caller.app.id
string
stableThe entity/app invoking the function or not set when not invoked by an app.
dynatrace.hub
caller.service.id
string
stableThe service invoking the function or not set when not invoked by a service.
DI_ENGINE
caller.type
string
experimentalThe type of caller that invoked the GenAI skill.
API; MCP; INTERNAL
conversation_id
string
experimentalA UUID identifying a conversation across multiple messages.
55239b04-8f8d-4e26-88fa-f75357a626a2
dt.security_context
string
resourcestableDisplay name: DT security contextThe security context is used in access permissions to limit the visibility. Learn more about the Dynatrace permission modelTags: permission
BILLING_USAGE_EVENT
event.id
string
stableDisplay name: Event IDUnique identifier string of an event; is stable across multiple refreshes and updates.
5547782627070661074_1647601320000
event.kind
string
stableDisplay name: Event kindGives high-level information about what kind of information the event contains without being specific about the contents of the event. It helps to determine the record type of a raw event.Tags: permission
BILLING_USAGE_EVENT
event.provider
string
stableDisplay name: Event providerSource of the event, for example, the name of the component or system that generated the event.Tags: permission
LIMA_USAGE_STREAM
event.type
string
stableDisplay name: Event typeThe unique type identifier of a given event.Tags: permission
AI Function Standard Call
event.version
string
stableDisplay name: Event versionDescribes the version of the event.
1.0.0
session_id
string
experimentalUUID of the MCP protocol session; created at client connection and spans all messages exchanged during that connection.
cf45e99d-43c2-466f-a455-ab37cf942a54
timestamp
timestamp
stableDisplay name: TimestampThe time (UNIX Epoch time in nanoseconds) when the event originated, typically when the source created it. If no original timestamp is available, it will be populated at ingest time and required for all events. In the case of a correlated event (for example, ITIL events), this time could be different from the event.start time, as this time represents the actual timestamp when the "update" for the event was created.
1649822520123123123
tool
string
experimentalThe name of the MCP server tool or AI function tool that was invoked.
execute-dql
tool.category
string
experimentalThe category of the invoked tool.
standard
user.email
string
stableDisplay name: User emailEmail of the user.
user@mail.com
user.id
string
stableDisplay name: User IDUnique UUID of a human user. If the system itself has to be represented, the constant 'system' is used.
35ba9499-f87c-4047-962c-14dc32e255e5; system
workflow.execution.id
string
stableThe unique identifier of a workflow execution as UUID.
737a248b-d1cb-49a4-bf08-7d4c37dbfb1e
workflow.id
string
stableThe unique identifier of a workflow as UUID.
26c0334e-a3e1-4585-8cd8-2d72742fe141
AI Units billing usage
Model describing a billing usage event for AI Units. Billing usage events are stored in the dt.system.events table.
Unlike the AI Function Standard Call, this event tracks billable quantity instead of a flat invocation count.
Query
Analyze billing usage events for AI Units.
fetch dt.system.events
|filter event.kind == "BILLING_USAGE_EVENT" and event.type == "AI Units"
|dedup event.id
Analyze billable quantity of AI Units by tool and caller type.
fetch dt.system.events
|filter event.kind == "BILLING_USAGE_EVENT" and event.type == "AI Units"
stableThe entity/app invoking the function or not set when not invoked by an app.
dynatrace.hub
caller.service.id
string
stableThe service invoking the function or not set when not invoked by a service.
DI_ENGINE
caller.type
string
experimentalThe type of caller that invoked the GenAI skill.
API; MCP; INTERNAL
conversation_id
string
experimentalA UUID identifying a conversation across multiple messages.
55239b04-8f8d-4e26-88fa-f75357a626a2
dt.security_context
string
resourcestableDisplay name: DT security contextThe security context is used in access permissions to limit the visibility. Learn more about the Dynatrace permission modelTags: permission
BILLING_USAGE_EVENT
event.id
string
stableDisplay name: Event IDUnique identifier string of an event; is stable across multiple refreshes and updates.
5547782627070661074_1647601320000
event.kind
string
stableDisplay name: Event kindGives high-level information about what kind of information the event contains without being specific about the contents of the event. It helps to determine the record type of a raw event.Tags: permission
BILLING_USAGE_EVENT
event.provider
string
stableDisplay name: Event providerSource of the event, for example, the name of the component or system that generated the event.Tags: permission
LIMA_USAGE_STREAM
event.type
string
stableDisplay name: Event typeThe unique type identifier of a given event.Tags: permission
AI Units
event.version
string
stableDisplay name: Event versionDescribes the version of the event.
1.0.0
session_id
string
experimentalUUID of the MCP protocol session; created at client connection and spans all messages exchanged during that connection.
cf45e99d-43c2-466f-a455-ab37cf942a54
timestamp
timestamp
stableDisplay name: TimestampThe time (UNIX Epoch time in nanoseconds) when the event originated, typically when the source created it. If no original timestamp is available, it will be populated at ingest time and required for all events. In the case of a correlated event (for example, ITIL events), this time could be different from the event.start time, as this time represents the actual timestamp when the "update" for the event was created.
1649822520123123123
tool
string
experimentalThe name of the MCP server tool or AI function tool that was invoked.
create-dql
tool.category
string
experimentalThe category of the invoked tool.
ai
usage.quantity.billable
double
experimentalBillable quantity of AI units, adjusted by a variable weight factor. See pricing documentation for estimated weight values by use case.
3.0; 8.0; 30.0
usage.unit
string
experimentalBilling unit for an AI unit charge.
Units
user.email
string
stableDisplay name: User emailEmail of the user.
user@mail.com
user.id
string
stableDisplay name: User IDUnique UUID of a human user. If the system itself has to be represented, the constant 'system' is used.
35ba9499-f87c-4047-962c-14dc32e255e5; system
workflow.execution.id
string
stableThe unique identifier of a workflow execution as UUID.
737a248b-d1cb-49a4-bf08-7d4c37dbfb1e
workflow.id
string
stableThe unique identifier of a workflow as UUID.
26c0334e-a3e1-4585-8cd8-2d72742fe141
Analyzer execution event
Analyzer execution events track all executions of analyzers.
Query
List all analyzer executions.
fetch dt.system.events
|filter event.kind == "ANALYZER_EXECUTION_EVENT"
List all analyzer executions that failed.
fetch dt.system.events, from:now()-24h
|filter event.kind == "ANALYZER_EXECUTION_EVENT"
|filter dt.analyzer.result_status == "FAILED"
Chart the number of result records for each task and user.
experimentalIndicates whether the task was successfully executed. CANCELED indicates the task could not succeed within the given time budget.
SUCCESS; FAILED; CANCELED
dt.task.scheduling_expression
string
experimentalExpression that defines the concrete task schedule. The expression syntax depends on the selected dt.task.scheduling_type.
PT1M; PT10M
dt.task.scheduling_type
string
experimentalScheduling method used for the task.
FIXED_DELAY; FIXED_RATE
event.kind
string
stableDisplay name: Event kindGives high-level information about what kind of information the event contains without being specific about the contents of the event. It helps to determine the record type of a raw event.Tags: permission
ANALYZER_EXECUTION_EVENT
timestamp
timestamp
stableDisplay name: TimestampThe time (UNIX Epoch time in nanoseconds) when the event originated, typically when the source created it. If no original timestamp is available, it will be populated at ingest time and required for all events. In the case of a correlated event (for example, ITIL events), this time could be different from the event.start time, as this time represents the actual timestamp when the "update" for the event was created.
1649822520123123123
user.id
string
stableDisplay name: User IDUnique UUID of a human user. If the system itself has to be represented, the constant 'system' is used.
35ba9499-f87c-4047-962c-14dc32e255e5; system
Anomaly Detector status event
The Anomaly Detector status events are used for Davis anomaly detection.
They track errors and warnings during the execution of an anomaly detector. Examples:
Query runs into a timeout
Query fails as unauthorized
Query result is truncated as the scanned bytes limit was reached
stableDisplay name: Event kindGives high-level information about what kind of information the event contains without being specific about the contents of the event. It helps to determine the record type of a raw event.Tags: permission
ANOMALY_DETECTOR_STATUS_EVENT
timestamp
timestamp
stableDisplay name: TimestampThe time (UNIX Epoch time in nanoseconds) when the event originated, typically when the source created it. If no original timestamp is available, it will be populated at ingest time and required for all events. In the case of a correlated event (for example, ITIL events), this time could be different from the event.start time, as this time represents the actual timestamp when the "update" for the event was created.
1649822520123123123
AppEngine Functions - Small billing usage
Model describing a billing usage event of function invocations. Billing usage events are stored in the dt.system.events table.
stableNumber of billed invocations. Unit is 1/4 GiB * min
8
caller.app.id
string
stableThe entity/app invoking the function or not set when not invoked by an app.
dynatrace.hub
caller.service.id
string
stableThe service invoking the function or not set when not invoked by a service.
AUTOMATION_ENGINE
dt.app.id
string
resourcestableDisplay name: Dynatrace app IDThe unique application identifier. Dynatrace apps are prefixed with 'dynatrace.', custom apps are prefixed with 'my.'.
dynatrace.notebooks; my.awesome.app
dt.security_context
string
resourcestableDisplay name: DT security contextThe security context is used in access permissions to limit the visibility. Learn more about the Dynatrace permission modelTags: permission
BILLING_USAGE_EVENT
event.id
string
stableDisplay name: Event IDUnique identifier string of an event; is stable across multiple refreshes and updates.
5547782627070661074_1647601320000
event.kind
string
stableDisplay name: Event kindGives high-level information about what kind of information the event contains without being specific about the contents of the event. It helps to determine the record type of a raw event.Tags: permission
BILLING_USAGE_EVENT
event.provider
string
stableDisplay name: Event providerSource of the event, for example, the name of the component or system that generated the event.Tags: permission
LIMA_USAGE_STREAM
event.type
string
stableDisplay name: Event typeThe unique type identifier of a given event.Tags: permission
AppEngine Functions - Small
event.version
string
stableDisplay name: Event versionDescribes the version of the event.
1.0.0
function.duration_sec
long
stableDuration of the function call in seconds. Measures not the actual execution time but the duration in the function proxy including network roundtrip to the Runtime. If the duration is bigger than the maximum allowed duration (which may happen due to technical reasons) the reported value is set to the maximum allowed duration.
60
function.execution_id
string
stableIf the execution of a resumable function last for more than 2 minutes, there will be multiple BILLING_USAGE_EVENTs created for that execution, which will have the same value in this field. It can therefore be used to join BILLING_USAGE_EVENTs for long running function invocations.
1bfa32fa-679e-4ac9-b683-2d2cdd4b6314
function.id
string
stableThe unique identifier of a function containing the app id and function id in the form of {app.id}.{function.id}. Missing for adhoc executions.
myapp.test/path/myfunction
function.memory_mib
long
stableRuntime memory in MiB. Some of the memory is not available to the javascript code, because it is needed by the runtime itself.
128
function.type
string
stableThe identifier defining the function type.
STANDARD; ACTION; AD_HOC
timestamp
timestamp
stableDisplay name: TimestampThe time (UNIX Epoch time in nanoseconds) when the event originated, typically when the source created it. If no original timestamp is available, it will be populated at ingest time and required for all events. In the case of a correlated event (for example, ITIL events), this time could be different from the event.start time, as this time represents the actual timestamp when the "update" for the event was created.
1649822520123123123
user.email
string
stableDisplay name: User emailEmail of the user.
user@mail.com
user.id
string
stableDisplay name: User IDUnique UUID of a human user. If the system itself has to be represented, the constant 'system' is used.
35ba9499-f87c-4047-962c-14dc32e255e5; system
workflow.execution.id
string
stableThe unique identifier of a workflow execution as UUID.
737a248b-d1cb-49a4-bf08-7d4c37dbfb1e
workflow.id
string
stableThe unique identifier of a workflow as UUID.
26c0334e-a3e1-4585-8cd8-2d72742fe141
Values
event.kind MUST be one of the following:
Value
Description
BILLING_USAGE_EVENT
Billing usage event
event.provider MUST be one of the following:
Value
Description
LIMA_USAGE_STREAM
LIMA Usage Stream Service
event.type MUST be one of the following:
Value
Description
AppEngine Functions - Small
AppEngine Functions - Small
dt.security_context MUST be one of the following:
Value
Description
BILLING_USAGE_EVENT
Billing usage event
function.type MUST be one of the following:
Value
Description
AD_HOC
Adhoc function execution
STANDARD
App function execution
ACTION
App function execution, but function is defined as an Action in the app manifest
Audit event
For every API access, Dynatrace stores an audit event in the dt.system.events table.
Additionally, the Audit Event allows to attach an arbitrary key/value map with string keys and string values to the event. Keys are prefixed with "details." during serialization.
Query
Analyze audit events stored in the system event bucket.
fetch dt.system.events
|filter event.kind == "AUDIT_EVENT"
Audit event fields
Attribute
Type
Description
Examples
authentication.client.id
string
experimentalDisplay name: Authentication client IDThe OAuth2 client id if of type 'CLIENT_CREDENTIALS'.
experimentalDisplay name: Authentication grant typeThe grant type used during OAuth2 authentication.
AUTHORIZATION_CODE; CLIENT_CREDENTIALS
authentication.token
string
experimentalDisplay name: Authentication tokenThe public token identifier of authentication.type 'TOKEN'.
dt0c01.AM4SEYKIBROBEJ2N3HAXZ4IX
authentication.type
string
experimentalDisplay name: Authentication typeThe method of authentication.
OAUTH2
dt.app.function
string
resourceexperimentalThe unique ID of the Dynatrace application function associated with the audit event in case the audited action was performed by a Dynatrace application function.
api/slack-send-message; api/shell-indicator
dt.app.id
string
resourcestableDisplay name: Dynatrace app IDThe unique ID of the Dynatrace application associated with the audit event in case the audited action was performed by a Dynatrace application (either originating from the browser or a serverless function). Dynatrace applications are prefixed with 'dynatrace.' and custom apps are prefixed with 'my.'. If the ID is null, the audited action was not performed by a Dynatrace application, for example, a REST request coming from a customer script.
resourcestableDisplay name: DT security contextThe security context is used in access permissions to limit the visibility. Learn more about the Dynatrace permission modelTags: permission
event.id
string
stableDisplay name: Event IDUnique identifier string of an event; is stable across multiple refreshes and updates.
5547782627070661074_1647601320000
event.kind
string
stableDisplay name: Event kindGives high-level information about what kind of information the event contains without being specific about the contents of the event. It helps to determine the record type of a raw event.Tags: permission
AUDIT_EVENT
event.outcome
string
stableDisplay name: Event outcomeDenotes whether the event represents a success or a failure from the perspective of the entity that produced the event (for example an HTTP response code).
200; success; failure
event.provider
string
stableDisplay name: Event providerSource of the event, for example, the name of the component or system that generated the event.Tags: permission
API_GATEWAY
event.reason
string
stableDisplay name: Event reasonDescribes why a certain event.outcome was set. Typically, this is some form of error description in the case of a failure.
user is missing permission "logs.read"
event.type
string
stableDisplay name: Event typeThe unique type identifier of a given event.Tags: permission
POST; PUT; GET
event.version
string
stableDisplay name: Event versionDescribes the version of the event.
1.0.0
origin.address
string
experimentalDisplay name: Origin addressSource IP address of the request associated with this event. Must be set if origin.type is 'REST', must not be set otherwise.
10.11.12.13
origin.session
string
experimentalDisplay name: Origin sessionThe ID of the browser session (if present) associated with the event.
node0hfznc
origin.type
string
experimentalDisplay name: Origin typeOrigin type of the request associated with this event.
REST; LOCAL
origin.x_forwarded_for
string
experimentalDisplay name: Origin x-forwarded-forThe verbatim value of the X-Forwarded-For HTTP request header (if present) of the request associated with the event.
1.2.3.4
request.source
string
stableIn case of a REST call audit event, this field contains the request source.
BROWSER; DT_SERVERLESS; OTHER
resource
string
stableGeneric reference to a resource like a REST resource URL or a settings ID.
/service/resource; 1234567890
timestamp
timestamp
stableDisplay name: TimestampThe time (UNIX Epoch time in nanoseconds) when the event originated, typically when the source created it. If no original timestamp is available, it will be populated at ingest time and required for all events. In the case of a correlated event (for example, ITIL events), this time could be different from the event.start time, as this time represents the actual timestamp when the "update" for the event was created.
1649822520123123123
user.id
string
stableDisplay name: User IDUnique UUID of a human user. If the system itself has to be represented, the constant 'system' is used.
35ba9499-f87c-4047-962c-14dc32e255e5; system
user.name
string
experimentalDisplay name: User namein the context of audit events, the name of the user is always the email address of the user.
albert.einstein@patent.office
user.organization
string
experimentalDisplay name: User organizationOrganization the user belongs to.
DYNATRACE; CUSTOMER; PARTNER
Automation Workflow billing usage
Model describing a billing usage event of automation workflows. Billing usage events are stored in the dt.system.events table.
Query
Analyze billing usage events for AutomationEngine workflows.
fetch dt.system.events
|filter event.kind == "BILLING_USAGE_EVENT" and event.type == "Automation Workflow"
Automation Workflow billing usage fields
Attribute
Type
Description
Examples
dt.security_context
string
resourcestableDisplay name: DT security contextThe security context is used in access permissions to limit the visibility. Learn more about the Dynatrace permission modelTags: permission
BILLING_USAGE_EVENT
event.end
string
stableDisplay name: Event endThe event end timestamp in UTC (given in Grail preferred Linux timestamp nano precision format).
16481073970000
event.id
string
stableDisplay name: Event IDUnique identifier string of an event; is stable across multiple refreshes and updates.
5547782627070661074_1647601320000
event.kind
string
stableDisplay name: Event kindGives high-level information about what kind of information the event contains without being specific about the contents of the event. It helps to determine the record type of a raw event.Tags: permission
BILLING_USAGE_EVENT
event.provider
string
stableDisplay name: Event providerSource of the event, for example, the name of the component or system that generated the event.Tags: permission
LIMA_USAGE_STREAM
event.start
string
stableDisplay name: Event startThe event start timestamp in UTC (given in Grail preferred Linux timestamp nano precision format).
16481073970000
event.type
string
stableDisplay name: Event typeThe unique type identifier of a given event.Tags: permission
Automation Workflow
event.version
string
stableDisplay name: Event versionDescribes the version of the event.
1.0.0
timestamp
timestamp
stableDisplay name: TimestampThe time (UNIX Epoch time in nanoseconds) when the event originated, typically when the source created it. If no original timestamp is available, it will be populated at ingest time and required for all events. In the case of a correlated event (for example, ITIL events), this time could be different from the event.start time, as this time represents the actual timestamp when the "update" for the event was created.
1649822520123123123
workflow.actor
string
stableThe entity executing the workflow as UUID.
b22a50a0-2540-4f29-9452-bc330322fb1e
workflow.created_at
timestamp
stableThe time when the workflow was created.
1649822520123123123
workflow.description
string
stableThe description of the workflow.
This is a test workflow
workflow.id
string
stableThe unique identifier of a workflow as UUID.
26c0334e-a3e1-4585-8cd8-2d72742fe141
workflow.is_private
string
stableThe boolean identifier denoting the visibility of the workflow.
true; false
workflow.owner
string
stableThe entity owning the workflow as UUID.
f1358516-8136-4634-9012-d2e3dfee38dc
workflow.title
string
stableThe title of the workflow.
Test Workflow
workflow.trigger_type
string
stableThe identifier that describes the trigger of the workflow.
schedule; manual
workflow.updated_by
string
stableThe entity updating the workflow last.
f1358516-8136-4634-9012-d2e3dfee38dc
Values
event.kind MUST be one of the following:
Value
Description
BILLING_USAGE_EVENT
Billing usage event
event.provider MUST be one of the following:
Value
Description
LIMA_USAGE_STREAM
LIMA Usage Stream Service
event.type MUST be one of the following:
Value
Description
Automation Workflow
Automation Workflow
dt.security_context MUST be one of the following:
Value
Description
BILLING_USAGE_EVENT
Billing usage event
AutomationEngine action execution event
Model describing an AutomationEngine action execution event. Action execution events are stored in the dt.system.events table.
Query
AutomationEngine action execution state change.
fetch dt.system.events
|filter event.kind == "WORKFLOW_EVENT" and event.provider == "AUTOMATION_ENGINE" and event.type =="ACTION_EXECUTION"
AutomationEngine action execution event fields
Attribute
Type
Description
Examples
dt.automation_engine.action.app
string
experimentalDisplay name: Action appThe app ID of the app containing the executed action.
dynatrace.automations
dt.automation_engine.action.function
string
experimentalDisplay name: Action function nameName of the function implementing the action.
task_1
dt.automation_engine.action_execution.id
string
experimentalDisplay name: Action execution IDThe unique identifier of a action execution as UUID.
23e7b55a-884f-4497-8ad6-8d49d52b4348
dt.automation_engine.action_execution.loop.index
long
experimentalDisplay name: Action execution loop indexLoop index of the action execution.
dt.automation_engine.action_execution.retry.count
long
experimentalDisplay name: Action execution retry countRetry count of the action execution.
dt.automation_engine.is_draft
boolean
experimentalDisplay name: Workflow is draftIndicates whether the triggered workflow execution is based on a workflow draft.
true; false
dt.automation_engine.root_workflow.id
string
experimentalDisplay name: Root workflow IDThe unique identifier of the root workflow.
e6388e3a-9db2-4226-9327-2ba86eaf12f7
dt.automation_engine.root_workflow_execution.id
string
experimentalDisplay name: Root workflow execution IDThe unique identifier of the execution of the root workflow.
a641fb59-4627-44cd-abaf-b68d86455a5b
dt.automation_engine.state
string
experimentalDisplay name: Execution stateThe state of an execution. Values depend on type of execution (workflow-, task-, or action execution).
RUNNING; SUCCESS; ERROR
dt.automation_engine.state.is_final
boolean
experimentalDisplay name: Execution state is finalIndicates if dt.automation_engine.state is a final and immutable state or if further processing will happen.
true; false
dt.automation_engine.state_info
string
experimentalDisplay name: Execution state infoAdditional info about current state of execution. Typically holds error details.
ERROR
dt.automation_engine.task.name
string
experimentalDisplay name: Task nameThe identifier of a task within a workflow.
task_1
dt.automation_engine.workflow.id
string
experimentalDisplay name: Workflow IDThe unique identifier of a workflow as UUID.
26c0334e-a3e1-4585-8cd8-2d72742fe141
dt.automation_engine.workflow.title
string
experimentalDisplay name: Workflow titleThe title of the workflow.
My Workflow
dt.automation_engine.workflow_execution.id
string
experimentalDisplay name: Workflow execution IDThe unique identifier of a workflow execution as UUID.
737a248b-d1cb-49a4-bf08-7d4c37dbfb1e
dt.openpipeline.pipelines
string[]
resourceexperimentalDisplay name: OpenPipeline pipelinesCollects the identifiers of all pipelines through which a record has passed during the ingestion process in OpenPipeline, providing a complete trace of its journey.
resourceexperimentalDisplay name: OpenPipeline ingest sourceIdentifies the source (such as API endpoints or OneAgent) used for ingesting the record into OpenPipeline.
/platform/ingest/v1/events; oneagent
duration
duration
stableDisplay name: DurationThe difference between start_time and end_time in nanoseconds.
42
end_time
timestamp
stableDisplay name: End timeEnd time of a data point. Value is a UNIX Epoch time in nanoseconds and greater than or equal to the start_time.
1649822520123123165
event.id
string
stableDisplay name: Event IDUnique identifier string of an event; is stable across multiple refreshes and updates.
5547782627070661074_1647601320000
event.kind
string
stableDisplay name: Event kindGives high-level information about what kind of information the event contains without being specific about the contents of the event. It helps to determine the record type of a raw event.Tags: permission
WORKFLOW_EVENT
event.provider
string
stableDisplay name: Event providerSource of the event, for example, the name of the component or system that generated the event.Tags: permission
AUTOMATION_ENGINE
event.type
string
stableDisplay name: Event typeThe unique type identifier of a given event.Tags: permission
ACTION_EXECUTION
start_time
timestamp
stableDisplay name: Start timeStart time of a data point. Value is a UNIX Epoch time in nanoseconds and less than or equal to the end_time.
1649822520123123123
timestamp
timestamp
stableDisplay name: TimestampThe time (UNIX Epoch time in nanoseconds) when the event originated, typically when the source created it. If no original timestamp is available, it will be populated at ingest time and required for all events. In the case of a correlated event (for example, ITIL events), this time could be different from the event.start time, as this time represents the actual timestamp when the "update" for the event was created.
1649822520123123123
Values
event.kind MUST be one of the following:
Value
Description
WORKFLOW_EVENT
Event in context of a workflow
event.provider MUST be one of the following:
Value
Description
AUTOMATION_ENGINE
Event produced by AutomationEngine
event.type MUST be one of the following:
Value
Description
ACTION_EXECUTION
Task execution state change event
dt.automation_engine.state MUST be one of the following:
Value
Description
RUNNING
Action execution started.
SUCCESS
Action execution finished successfully.
ERROR
Action execution failed.
AutomationEngine task execution event
Model describing an AutomationEngine task execution event. Task execution events are stored in the dt.system.events table.
Query
AutomationEngine task execution state change.
fetch dt.system.events
|filter event.kind == "WORKFLOW_EVENT" and event.provider == "AUTOMATION_ENGINE" and event.type =="TASK_EXECUTION"
AutomationEngine task execution event fields
Attribute
Type
Description
Examples
dt.automation_engine.is_draft
boolean
experimentalDisplay name: Workflow is draftIndicates whether the triggered workflow execution is based on a workflow draft.
true; false
dt.automation_engine.root_workflow.id
string
experimentalDisplay name: Root workflow IDThe unique identifier of the root workflow.
e6388e3a-9db2-4226-9327-2ba86eaf12f7
dt.automation_engine.root_workflow_execution.id
string
experimentalDisplay name: Root workflow execution IDThe unique identifier of the execution of the root workflow.
a641fb59-4627-44cd-abaf-b68d86455a5b
dt.automation_engine.state
string
experimentalDisplay name: Execution stateThe state of an execution. Values depend on type of execution (workflow-, task-, or action execution).
RUNNING; SUCCESS; ERROR
dt.automation_engine.state.is_final
boolean
experimentalDisplay name: Execution state is finalIndicates if dt.automation_engine.state is a final and immutable state or if further processing will happen.
true; false
dt.automation_engine.state_info
string
experimentalDisplay name: Execution state infoAdditional info about current state of execution. Typically holds error details.
ERROR
dt.automation_engine.task.name
string
experimentalDisplay name: Task nameThe identifier of a task within a workflow.
task_1
dt.automation_engine.workflow.id
string
experimentalDisplay name: Workflow IDThe unique identifier of a workflow as UUID.
26c0334e-a3e1-4585-8cd8-2d72742fe141
dt.automation_engine.workflow.title
string
experimentalDisplay name: Workflow titleThe title of the workflow.
My Workflow
dt.automation_engine.workflow_execution.id
string
experimentalDisplay name: Workflow execution IDThe unique identifier of a workflow execution as UUID.
737a248b-d1cb-49a4-bf08-7d4c37dbfb1e
dt.openpipeline.pipelines
string[]
resourceexperimentalDisplay name: OpenPipeline pipelinesCollects the identifiers of all pipelines through which a record has passed during the ingestion process in OpenPipeline, providing a complete trace of its journey.
resourceexperimentalDisplay name: OpenPipeline ingest sourceIdentifies the source (such as API endpoints or OneAgent) used for ingesting the record into OpenPipeline.
/platform/ingest/v1/events; oneagent
duration
duration
stableDisplay name: DurationThe difference between start_time and end_time in nanoseconds.
42
end_time
timestamp
stableDisplay name: End timeEnd time of a data point. Value is a UNIX Epoch time in nanoseconds and greater than or equal to the start_time.
1649822520123123165
event.id
string
stableDisplay name: Event IDUnique identifier string of an event; is stable across multiple refreshes and updates.
5547782627070661074_1647601320000
event.kind
string
stableDisplay name: Event kindGives high-level information about what kind of information the event contains without being specific about the contents of the event. It helps to determine the record type of a raw event.Tags: permission
WORKFLOW_EVENT
event.provider
string
stableDisplay name: Event providerSource of the event, for example, the name of the component or system that generated the event.Tags: permission
AUTOMATION_ENGINE
event.type
string
stableDisplay name: Event typeThe unique type identifier of a given event.Tags: permission
TASK_EXECUTION
start_time
timestamp
stableDisplay name: Start timeStart time of a data point. Value is a UNIX Epoch time in nanoseconds and less than or equal to the end_time.
1649822520123123123
timestamp
timestamp
stableDisplay name: TimestampThe time (UNIX Epoch time in nanoseconds) when the event originated, typically when the source created it. If no original timestamp is available, it will be populated at ingest time and required for all events. In the case of a correlated event (for example, ITIL events), this time could be different from the event.start time, as this time represents the actual timestamp when the "update" for the event was created.
1649822520123123123
Values
event.kind MUST be one of the following:
Value
Description
WORKFLOW_EVENT
Event in context of a workflow
event.provider MUST be one of the following:
Value
Description
AUTOMATION_ENGINE
Event produced by AutomationEngine
event.type MUST be one of the following:
Value
Description
TASK_EXECUTION
Task execution state change event
dt.automation_engine.state MUST be one of the following:
Value
Description
SKIPPED
Task skipped due to task conditions evaluation or task is disabled.
DISCARDED
Task discarded due to predecessor task conditions evaluation.
WAITING
Task waiting due to e.g. task option configuration.
RUNNING
Task execution has running action execution.
SUCCESS
Task execution finished successfully.
CANCELLED
Task execution cancelled manually/by API request.
ERROR
Task execution finished due to at least one failed action execution and no retries configured/left to process.
AutomationEngine workflow execution event
Model describing an AutomationEngine workflow execution event. Workflow execution events are stored in the dt.system.events table.
Query
AutomationEngine workflow execution state change.
fetch dt.system.events
|filter event.kind == "WORKFLOW_EVENT" and event.provider == "AUTOMATION_ENGINE" and event.type =="WORKFLOW_EXECUTION"
AutomationEngine workflow execution event fields
Attribute
Type
Description
Examples
dt.automation_engine.is_draft
boolean
experimentalDisplay name: Workflow is draftIndicates whether the triggered workflow execution is based on a workflow draft.
true; false
dt.automation_engine.root_workflow.id
string
experimentalDisplay name: Root workflow IDThe unique identifier of the root workflow.
e6388e3a-9db2-4226-9327-2ba86eaf12f7
dt.automation_engine.root_workflow_execution.id
string
experimentalDisplay name: Root workflow execution IDThe unique identifier of the execution of the root workflow.
a641fb59-4627-44cd-abaf-b68d86455a5b
dt.automation_engine.state
string
experimentalDisplay name: Execution stateThe state of an execution. Values depend on type of execution (workflow-, task-, or action execution).
RUNNING; SUCCESS; ERROR
dt.automation_engine.state.is_final
boolean
experimentalDisplay name: Execution state is finalIndicates if dt.automation_engine.state is a final and immutable state or if further processing will happen.
true; false
dt.automation_engine.state_info
string
experimentalDisplay name: Execution state infoAdditional info about current state of execution. Typically holds error details.
ERROR
dt.automation_engine.workflow.id
string
experimentalDisplay name: Workflow IDThe unique identifier of a workflow as UUID.
experimentalDisplay name: Workflow last execution state flipIndicates if the workflow execution state has changed since the last execution, ignoring draft executions. Always false for draft executions.
true; false
dt.automation_engine.workflow.title
string
experimentalDisplay name: Workflow titleThe title of the workflow.
My Workflow
dt.automation_engine.workflow.type
string
experimentalDisplay name: Workflow typeWorkflow type, either SIMPLE or STANDARD, where SIMPLE comes with restrictions.
SIMPLE; STANDARD
dt.automation_engine.workflow_execution.actor
string
experimentalDisplay name: Workflow actorThe unique identifier of the actor as defined in the workflow.
e622afae-ccc7-4fb5-acc5-13b32e827bbe
dt.automation_engine.workflow_execution.id
string
experimentalDisplay name: Workflow execution IDThe unique identifier of a workflow execution as UUID.
experimentalDisplay name: Trigger event IDUnique identifier string (event.id) of the event that triggered the workflow execution. Only set for event-triggered executions.
experimentalDisplay name: Trigger workflow execution IDThe unique identifier of the workflow that triggered the workflow execution.
737a248b-d1cb-49a4-bf08-7d4c37dbfb1e
dt.openpipeline.pipelines
string[]
resourceexperimentalDisplay name: OpenPipeline pipelinesCollects the identifiers of all pipelines through which a record has passed during the ingestion process in OpenPipeline, providing a complete trace of its journey.
resourceexperimentalDisplay name: OpenPipeline ingest sourceIdentifies the source (such as API endpoints or OneAgent) used for ingesting the record into OpenPipeline.
/platform/ingest/v1/events; oneagent
duration
duration
stableDisplay name: DurationThe difference between start_time and end_time in nanoseconds.
42
end_time
timestamp
stableDisplay name: End timeEnd time of a data point. Value is a UNIX Epoch time in nanoseconds and greater than or equal to the start_time.
1649822520123123165
event.id
string
stableDisplay name: Event IDUnique identifier string of an event; is stable across multiple refreshes and updates.
5547782627070661074_1647601320000
event.kind
string
stableDisplay name: Event kindGives high-level information about what kind of information the event contains without being specific about the contents of the event. It helps to determine the record type of a raw event.Tags: permission
WORKFLOW_EVENT
event.provider
string
stableDisplay name: Event providerSource of the event, for example, the name of the component or system that generated the event.Tags: permission
AUTOMATION_ENGINE
event.type
string
stableDisplay name: Event typeThe unique type identifier of a given event.Tags: permission
WORKFLOW_EXECUTION
start_time
timestamp
stableDisplay name: Start timeStart time of a data point. Value is a UNIX Epoch time in nanoseconds and less than or equal to the end_time.
1649822520123123123
timestamp
timestamp
stableDisplay name: TimestampThe time (UNIX Epoch time in nanoseconds) when the event originated, typically when the source created it. If no original timestamp is available, it will be populated at ingest time and required for all events. In the case of a correlated event (for example, ITIL events), this time could be different from the event.start time, as this time represents the actual timestamp when the "update" for the event was created.
1649822520123123123
Values
event.kind MUST be one of the following:
Value
Description
WORKFLOW_EVENT
Event in context of a workflow
event.provider MUST be one of the following:
Value
Description
AUTOMATION_ENGINE
Event produced by AutomationEngine
event.type MUST be one of the following:
Value
Description
WORKFLOW_EXECUTION
Workflow execution state change event
dt.automation_engine.state MUST be one of the following:
Value
Description
RUNNING
Workflow execution started.
SUCCESS
Workflow execution finished successfully.
ERROR
Workflow execution failed due to at least one branch with a failed task without an on error successor.
CANCELLED
Workflow execution cancelled manually/by API request.
AutomationEngine workflow lifecycle event
Model describing an AutomationEngine workflow lifecycle event. Workflow lifecycle events are stored in the dt.system.events table.
Query
AutomationEngine workflow lifecycle events.
fetch dt.system.events
|filter event.kind == "WORKFLOW_EVENT" and event.provider == "AUTOMATION_ENGINE" and in(event.type, array("WORKFLOW_CREATED", "WORKFLOW_UPDATED", "WORKFLOW_DELETED"))
AutomationEngine workflow lifecycle event fields
Attribute
Type
Description
Examples
dt.automation_engine.workflow.id
string
experimentalDisplay name: Workflow IDThe unique identifier of a workflow as UUID.
26c0334e-a3e1-4585-8cd8-2d72742fe141
dt.automation_engine.workflow.title
string
experimentalDisplay name: Workflow titleThe title of the workflow.
My Workflow
event.id
string
stableDisplay name: Event IDUnique identifier string of an event; is stable across multiple refreshes and updates.
5547782627070661074_1647601320000
event.kind
string
stableDisplay name: Event kindGives high-level information about what kind of information the event contains without being specific about the contents of the event. It helps to determine the record type of a raw event.Tags: permission
WORKFLOW_EVENT
event.provider
string
stableDisplay name: Event providerSource of the event, for example, the name of the component or system that generated the event.Tags: permission
AUTOMATION_ENGINE
event.type
string
stableDisplay name: Event typeThe unique type identifier of a given event.Tags: permission
WORKFLOW_CREATED
timestamp
timestamp
stableDisplay name: TimestampThe time (UNIX Epoch time in nanoseconds) when the event originated, typically when the source created it. If no original timestamp is available, it will be populated at ingest time and required for all events. In the case of a correlated event (for example, ITIL events), this time could be different from the event.start time, as this time represents the actual timestamp when the "update" for the event was created.
1649822520123123123
user.id
string
stableDisplay name: User IDUnique UUID of a human user. If the system itself has to be represented, the constant 'system' is used.
35ba9499-f87c-4047-962c-14dc32e255e5; system
Values
event.kind MUST be one of the following:
Value
Description
WORKFLOW_EVENT
Event in context of a workflow
event.provider MUST be one of the following:
Value
Description
AUTOMATION_ENGINE
Event produced by AutomationEngine
event.type MUST be one of the following:
Value
Description
WORKFLOW_CREATED
Workflow created event
WORKFLOW_UPDATED
Workflow updated event
WORKFLOW_DELETED
Workflow deleted event
AutomationEngine workflow throttle event
Model describing an AutomationEngine workflow throttle event. Workflow throttle events are stored in the dt.system.events table.
Query
AutomationEngine workflow throttle events.
fetch dt.system.events
|filter event.kind == "WORKFLOW_EVENT" and event.provider == "AUTOMATION_ENGINE" and event.type =="WORKFLOW_THROTTLED"
AutomationEngine workflow throttle event fields
Attribute
Type
Description
Examples
dt.automation_engine.throttle.limit
long
experimentalDisplay name: Workflow execution throttle limitThe workflow execution per hour limit that has been reached.
1000
dt.automation_engine.workflow.id
string
experimentalDisplay name: Workflow IDThe unique identifier of a workflow as UUID.
26c0334e-a3e1-4585-8cd8-2d72742fe141
dt.automation_engine.workflow.title
string
experimentalDisplay name: Workflow titleThe title of the workflow.
My Workflow
end_time
timestamp
stableDisplay name: End timeEnd time of a data point. Value is a UNIX Epoch time in nanoseconds and greater than or equal to the start_time.
1649822520123123165
event.id
string
stableDisplay name: Event IDUnique identifier string of an event; is stable across multiple refreshes and updates.
5547782627070661074_1647601320000
event.kind
string
stableDisplay name: Event kindGives high-level information about what kind of information the event contains without being specific about the contents of the event. It helps to determine the record type of a raw event.Tags: permission
WORKFLOW_EVENT
event.provider
string
stableDisplay name: Event providerSource of the event, for example, the name of the component or system that generated the event.Tags: permission
AUTOMATION_ENGINE
event.type
string
stableDisplay name: Event typeThe unique type identifier of a given event.Tags: permission
WORKFLOW_THROTTLED
timestamp
timestamp
stableDisplay name: TimestampThe time (UNIX Epoch time in nanoseconds) when the event originated, typically when the source created it. If no original timestamp is available, it will be populated at ingest time and required for all events. In the case of a correlated event (for example, ITIL events), this time could be different from the event.start time, as this time represents the actual timestamp when the "update" for the event was created.
1649822520123123123
Values
event.kind MUST be one of the following:
Value
Description
WORKFLOW_EVENT
Event in context of a workflow
event.provider MUST be one of the following:
Value
Description
AUTOMATION_ENGINE
Event produced by AutomationEngine
event.type MUST be one of the following:
Value
Description
WORKFLOW_THROTTLED
Workflow throttled event
Browser Monitor or Clickpath billing usage
Model describing a billing usage event for "Browser Monitor or Clickpath". Billing usage events are stored in the dt.system.events table.
Query
Analyze billing usage events for the "Browser Monitor or Clickpath" capability.
fetch dt.system.events
|filter event.kind == "BILLING_USAGE_EVENT" and event.type == "Browser Monitor or Clickpath"
|dedup event.id
Browser Monitor or Clickpath billing usage fields
Attribute
Type
Description
Examples
billed_synthetic_action_count
long
experimentalThe number of synthetic actions which trigger a web request that includes a page load, navigation event, or action that triggers an XHR or Fetch request. Scroll downs, keystrokes, or clicks that don't trigger web requests aren't counted as such actions. This is the billable unit related to the rate card of this capability.
10
dt.entity.synthetic_test
string
resource **deprecatedThis field is deprecated and will be removed in the future. Use dt.smartscape.browser_monitor instead.**Display name: Synthetic testAn entity ID of an entity of type SYNTHETIC_TEST.Tags: entity-id
SYNTHETIC_TEST-A140F3B85BCCBD1A
dt.security_context
string
resourcestableDisplay name: DT security contextThe security context is used in access permissions to limit the visibility. Learn more about the Dynatrace permission modelTags: permission
BILLING_USAGE_EVENT
event.id
string
stableDisplay name: Event IDUnique identifier string of an event; is stable across multiple refreshes and updates.
5547782627070661074_1647601320000
event.kind
string
stableDisplay name: Event kindGives high-level information about what kind of information the event contains without being specific about the contents of the event. It helps to determine the record type of a raw event.Tags: permission
BILLING_USAGE_EVENT
event.provider
string
stableDisplay name: Event providerSource of the event, for example, the name of the component or system that generated the event.Tags: permission
LIMA_CLIENT
event.type
string
stableDisplay name: Event typeThe unique type identifier of a given event.Tags: permission
Browser Monitor or Clickpath
event.version
string
stableDisplay name: Event versionDescribes the version of the event.
1.0.0
timestamp
timestamp
stableDisplay name: TimestampStart time of the usage timeframe (inclusive).
2023-05-22T11:15:00.000000Z
usage.end
timestamp
stableEnd time of the usage timeframe (exclusive).
2023-05-22T11:30:00.000000Z
usage.start
timestamp
stableStart time of the usage timeframe (inclusive).
2023-05-22T11:15:00.000000Z
Values
event.kind MUST be one of the following:
Value
Description
BILLING_USAGE_EVENT
Billing usage event
event.provider MUST be one of the following:
Value
Description
LIMA_CLIENT
LIMA Client Service
event.type MUST be one of the following:
Value
Description
Browser Monitor or Clickpath
Browser Monitor or Clickpath
dt.security_context MUST be one of the following:
Value
Description
BILLING_USAGE_EVENT
Billing usage event
Classic Feature Tracking event
Classic Feature Tracking events capture usage and compatibility of Dynatrace Classic
features across your environment. They help administrators understand which classic features
are actively used and which items are compatible with Latest Dynatrace.
Two types of events are defined:
CLASSIC_USAGE—records an individual use of a classic feature, such as opening an app
or calling a classic API endpoint.
COMPATIBILITY—a pass/fail compatibility check for a specific item against
Latest Dynatrace requirements.
Events do not include personal data or detailed payload content. Only data necessary for
usage analysis or compatibility review is reported.
Query
Retrieve all Classic Feature Tracking events.
fetch dt.system.events
|filter event.kind == "CLASSIC_TRACKING_EVENT"
Count classic feature usage events per feature area.
stableDisplay name: Audit identityPresent for CLASSIC_USAGE events. The anonymized identifier of the user or API token that triggered the usage. Must not include personal data beyond a pseudonymous identifier.
experimentalPresent for CLASSIC_USAGE events. Optional additional detail such as a query string or user agent. Must not include personal data or sensitive payload content.
Mozilla/5.0 (compatible; DynatraceBot)
classic.feature
string
experimentalThe classic feature or capability that was used or configured. Identifies the product area, for example "Dashboards Classic", "Management Zone", "Extension v2", or "OneAgent".
experimentalPresent for COMPATIBILITY events. true if the item is compatible with Latest Dynatrace; false if action is required.
true; false
classic.object_id
string
experimentalFor CLASSIC_USAGE events: the specific object that was accessed, such as a dashboard ID or API endpoint path. For COMPATIBILITY events: the identifier of the item being assessed, such as an extension ID, host ID, or integration name.
experimentalPresent for COMPATIBILITY events. Optional human-readable name of the item identified by classic.object_id.
Frontend Team MZ; My Auto-tag Rule
classic.reason
string
experimentalPresent for COMPATIBILITY events when classic.is_ready is false. Explains why the item requires attention.
OneAgent version 1.325 below required 1.331; Extension major version too low; Unsupported configuration type
event.kind
string
stableDisplay name: Event kindGives high-level information about what kind of information the event contains without being specific about the contents of the event. It helps to determine the record type of a raw event.Tags: permission
CLASSIC_TRACKING_EVENT
event.type
string
stableDisplay name: Event typeThe unique type identifier of a given event.Tags: permission
CLASSIC_USAGE; COMPATIBILITY
timestamp
timestamp
stableDisplay name: TimestampThe time (UNIX Epoch time in nanoseconds) when the event originated, typically when the source created it. If no original timestamp is available, it will be populated at ingest time and required for all events. In the case of a correlated event (for example, ITIL events), this time could be different from the event.start time, as this time represents the actual timestamp when the "update" for the event was created.
1649822520123123123
Code Monitoring billing usage
Model describing a billing usage event of Code Monitoring. Billing usage events are stored in the dt.system.events table.
Query
Analyze billing usage events for the Code Monitoring capability.
fetch dt.system.events
|filter event.kind == "BILLING_USAGE_EVENT" and event.type == "Code Monitoring"
|dedup event.id
Code Monitoring billing usage fields
Attribute
Type
Description
Examples
application_only_type
string
experimentalIdentifier of the app-only containerization type.
resourcestableDisplay name: AWS account IDThe 12-digit number, such as 123456789012, that uniquely identifies an AWS account.Tags: permissionprimary-field
123456789012
azure.subscription
string
resourcestableDisplay name: Azure subscriptionAn Azure subscription is a logical container used to provision resources in Azure.Tags: permissionprimary-field
27e9b03f-04d2-2b69-b327-32f433f7ed21
billed_container_hours
long
experimentalThe number of code monitoring container hours consumed by the host.
800
cloudfoundry.application.id
string
resourceexperimentalDisplay name: Cloud Foundry application ID
dt.cost.costcenter
string
resourcestableDisplay name: Cost centerCan be used to assign usage to a Cost Center.
Team A
dt.cost.product
string
resourcestableDisplay name: Cost productCan be used to assign usage to a Product or Application ID.
Product A
dt.entity.host
string
resource **deprecatedThis field is deprecated and will be removed in the future. Use dt.smartscape.host instead.**Display name: HostAn entity ID of an entity of type HOST.Tags: entity-id
HOST-E0D8F94D9065F24F
dt.security_context
string
resourcestableDisplay name: DT security contextThe security context is used in access permissions to limit the visibility. Learn more about the Dynatrace permission modelTags: permission
BILLING_USAGE_EVENT
event.id
string
stableDisplay name: Event IDUnique identifier string of an event; is stable across multiple refreshes and updates.
5547782627070661074_1647601320000
event.kind
string
stableDisplay name: Event kindGives high-level information about what kind of information the event contains without being specific about the contents of the event. It helps to determine the record type of a raw event.Tags: permission
BILLING_USAGE_EVENT
event.provider
string
stableDisplay name: Event providerSource of the event, for example, the name of the component or system that generated the event.Tags: permission
LIMA_CLIENT
event.type
string
stableDisplay name: Event typeThe unique type identifier of a given event.Tags: permission
Code Monitoring
event.version
string
stableDisplay name: Event versionDescribes the version of the event.
1.0.0
gcp.project.id
string
resourcestableDisplay name: GCP project IDIdentifier of the GCP project associated with this resource.Tags: permissionprimary-field
dynatrace-gcp-extension
k8s.cluster.uid
string
resourcestableDisplay name: Kubernetes cluster UIDA pseudo-ID for the cluster, by default set to the UID of the kube-system namespace.
1c7a24c7-ff51-46e0-bcc9-c52637ceec57
k8s.namespace.name
string
resourcestableDisplay name: Kubernetes namespace nameThe name of the namespace that the pod is running in.Tags: permissionprimary-field
default; kube-system
timestamp
timestamp
stableDisplay name: TimestampThe time (UNIX Epoch time in nanoseconds) when the event originated, typically when the source created it. If no original timestamp is available, it will be populated at ingest time and required for all events. In the case of a correlated event (for example, ITIL events), this time could be different from the event.start time, as this time represents the actual timestamp when the "update" for the event was created.
1649822520123123123
usage.end
timestamp
stableEnd time of the usage timeframe (exclusive).
2023-05-22T11:30:00.000000Z
usage.start
timestamp
stableStart time of the usage timeframe (inclusive).
2023-05-22T11:15:00.000000Z
Values
event.kind MUST be one of the following:
Value
Description
BILLING_USAGE_EVENT
Billing usage event
event.provider MUST be one of the following:
Value
Description
LIMA_CLIENT
LIMA Client Service
event.type MUST be one of the following:
Value
Description
Code Monitoring
Code Monitoring
dt.security_context MUST be one of the following:
Value
Description
BILLING_USAGE_EVENT
Billing usage event
Data Egress billing usage
Model describing a billing usage event for data egress. Billing usage events are stored in the dt.system.events table.
Query
Retrieves billing usage events related to the "Data Egress" capability and returns only unique events by removing duplicates based on event.id.
fetch dt.system.events
|filter event.kind == "BILLING_USAGE_EVENT"
|filter event.type == "Data Egress"
|dedup event.id
Charts how Data Egress usage evolves by summing billed bytes and grouping the usage by forwarding data type.
resourcestableDisplay name: DT security contextThe security context is used in access permissions to limit the visibility. Learn more about the Dynatrace permission modelTags: permission
BILLING_USAGE_EVENT
event.id
string
stableDisplay name: Event IDUnique identifier string of an event; is stable across multiple refreshes and updates.
5547782627070661074_1647601320000
event.kind
string
stableDisplay name: Event kindGives high-level information about what kind of information the event contains without being specific about the contents of the event. It helps to determine the record type of a raw event.Tags: permission
BILLING_USAGE_EVENT
event.provider
string
stableDisplay name: Event providerSource of the event, for example, the name of the component or system that generated the event.Tags: permission
LIMA_USAGE_TRACKER
event.type
string
stableDisplay name: Event typeThe unique type identifier of a given event.Tags: permission
Data Egress
event.version
string
stableDisplay name: Event versionDescribes the version of the event.
1.0.0
timestamp
timestamp
stableDisplay name: TimestampStart time of the usage timeframe (inclusive).
2025-01-01T11:15:00.000000Z
usage.end
timestamp
stableEnd time of the usage timeframe (exclusive).
2023-05-22T11:30:00.000000Z
usage.start
timestamp
stableStart time of the usage timeframe (inclusive).
2023-05-22T11:15:00.000000Z
Values
event.kind MUST be one of the following:
Value
Description
BILLING_USAGE_EVENT
Billing usage event
event.provider MUST be one of the following:
Value
Description
LIMA_USAGE_TRACKER
LIMA Usage Tracker Service
event.type MUST be one of the following:
Value
Description
Data Egress
Data Egress
dt.security_context MUST be one of the following:
Value
Description
BILLING_USAGE_EVENT
Billing usage event
Data deletion events
Dynatrace stores a data deletion event for each segment that got rewritten in the dt.system.events table.
Query
Analyze data deletion events.
fetch dt.system.events
|filter event.kind == "DATA_DELETION_EVENT"
Data deletion event fields
Attribute
Type
Description
Examples
bucket
string
experimentalA Dynatrace Grail bucket name.
default_logs; default_events
client.api_version
string
stableThe REST API version used by the client to perform the request.
1
deletion_end
long
experimentalEnd of a particular deletion.
1649822520123123123
deletion_id
string
experimentalInternal deletion request UUID.
c454347c-0ba9-4bd3-870e-d06dc1657f71
deletion_start
long
experimentalStart of a particular deletion.
1649822520123123123
dt.security_context
string
resourcestableDisplay name: DT security contextThe security context is used in access permissions to limit the visibility. Learn more about the Dynatrace permission modelTags: permission
environment
string
experimentalA Dynatrace environment/tenant ID.
umsaywsjuo
event.kind
string
stableDisplay name: Event kindGives high-level information about what kind of information the event contains without being specific about the contents of the event. It helps to determine the record type of a raw event.Tags: permission
DATA_DELETION_EVENT
failure_reason
string
experimentalAdditional information if query execution has 'FAILED'.
QUEUE_TIMEOUT; THROTTLED
query_string
string
experimentalThe query string.
fetch bizevents, from:-30m | limit 1
rewritten_bytes
long
experimentalThe number of rewritten bytes in the context of record deletion.
1113359256
status
string
experimentalThe outcome of the query.
SUCCEEDED
task.id
string
experimentalDeletion task UUID returned by API.
b5998ff1-26fd-4aec-80c4-6c59633b5d66
timestamp
timestamp
stableDisplay name: TimestampThe time (UNIX Epoch time in nanoseconds) when the event originated, typically when the source created it. If no original timestamp is available, it will be populated at ingest time and required for all events. In the case of a correlated event (for example, ITIL events), this time could be different from the event.start time, as this time represents the actual timestamp when the "update" for the event was created.
1649822520123123123
user.email
string
stableDisplay name: User emailEmail of the user.
user@mail.com
user.id
string
stableDisplay name: User IDUnique UUID of a human user. If the system itself has to be represented, the constant 'system' is used.
35ba9499-f87c-4047-962c-14dc32e255e5; system
version
string
resourcedeprecatedUsed in Extension Framework 2.0Display name: SNMP versionThe SNMP version.
SNMPv3
Database Monitoring billing usage
Model describing a billing usage event for the Database Monitoring capability. Billing usage events are stored in the dt.system.events table.
Query
Analyze billing usage events for the Database Monitoring capability.
fetch dt.system.events
|filter event.kind == "BILLING_USAGE_EVENT" and event.type == "Database Monitoring"
|dedup event.id
Summarize total database instance hours per monitored database instance.
fetch dt.system.events
|filter event.kind == "BILLING_USAGE_EVENT" and event.type == "Database Monitoring"
experimentalDatabase instance hours consumed during the usage window. Each 1,000 unique queries count as 0.25 hours, with a minimum of 0.25 hours per window.
0.25; 0.5; 1.0
database_queries
long
experimentalCount of unique database queries executed during the 15-minute usage window.
500; 1001; 5000
dt.cost.costcenter
string
resourcestableDisplay name: Cost centerCan be used to assign usage to a Cost Center.
Team A
dt.cost.product
string
resourcestableDisplay name: Cost productCan be used to assign usage to a Product or Application ID.
Product A
dt.security_context
string
resourcestableDisplay name: DT security contextThe security context is used in access permissions to limit the visibility. Learn more about the Dynatrace permission modelTags: permission
BILLING_USAGE_EVENT
dt.smartscape_source.id
smartscapeId
resourcestableDisplay name: Smartscape source IDThe ID of the entity considered the source of the signal. The string represents an entity ID of an entity that is stored in the Smartscape storage. 1Tags: smartscape-id
DB_INSTANCE_POSTGRES-0000000000000001
dt.smartscape_source.type
string
stableDisplay name: Smartscape source typeThe entity type of the entity whose identifier is held in dt.smartscape_source.id.
DB_INSTANCE_POSTGRES
event.id
string
stableDisplay name: Event IDUnique identifier string of an event; is stable across multiple refreshes and updates.
5547782627070661074_1647601320000
event.kind
string
stableDisplay name: Event kindGives high-level information about what kind of information the event contains without being specific about the contents of the event. It helps to determine the record type of a raw event.Tags: permission
BILLING_USAGE_EVENT
event.provider
string
stableDisplay name: Event providerSource of the event, for example, the name of the component or system that generated the event.Tags: permission
LIMA_USAGE_TRACKER
event.type
string
stableDisplay name: Event typeThe unique type identifier of a given event.Tags: permission
Database Monitoring
event.version
string
stableDisplay name: Event versionDescribes the version of the event.
1.0.0
timestamp
timestamp
stableDisplay name: TimestampThe time (UNIX Epoch time in nanoseconds) when the event originated, typically when the source created it. If no original timestamp is available, it will be populated at ingest time and required for all events. In the case of a correlated event (for example, ITIL events), this time could be different from the event.start time, as this time represents the actual timestamp when the "update" for the event was created.
1649822520123123123
usage.end
timestamp
stableEnd time of the usage timeframe (exclusive).
2023-05-22T11:30:00.000000Z
usage.start
timestamp
stableStart time of the usage timeframe (inclusive).
2023-05-22T11:15:00.000000Z
1
The value of this field will be based on the value of one of the dt.smartscape.<type> fields. That means that the dt.smartscape_source.id and dt.smartscape.<type> fields will both be set to the same ID.
Values
event.kind MUST be one of the following:
Value
Description
BILLING_USAGE_EVENT
Billing usage event
event.provider MUST be one of the following:
Value
Description
LIMA_USAGE_TRACKER
Lima Usage Tracker
event.type MUST be one of the following:
Value
Description
Database Monitoring
Database Monitoring
dt.security_context MUST be one of the following:
Value
Description
BILLING_USAGE_EVENT
Billing usage event
Digital Experience Monitoring - Query billing usage
Model describing a billing usage event of a Digital Experience Monitoring query execution. Billing usage events are stored in the dt.system.events table.
Query
Retrieves billing usage events related to the Digital Experience Monitoring - Query capability and returns only unique events by removing duplicates based on event.id.
stableContains information about the invoked workflow. For example, the workflow.id.
8a9c9ceb-7eb3-4e88-8c4b-681f8d52eb32
dt.security_context
string
resourcestableDisplay name: DT security contextThe security context is used in access permissions to limit the visibility. Learn more about the Dynatrace permission modelTags: permission
BILLING_USAGE_EVENT
event.billing.category
string
stableDisplay name for usage details.
User events; User sessions; Synthetic events; Synthetic user events; Synthetic user sessions
event.id
string
stableDisplay name: Event IDUnique identifier string of an event; is stable across multiple refreshes and updates.
5547782627070661074_1647601320000
event.kind
string
stableDisplay name: Event kindGives high-level information about what kind of information the event contains without being specific about the contents of the event. It helps to determine the record type of a raw event.Tags: permission
BILLING_USAGE_EVENT
event.provider
string
stableDisplay name: Event providerSource of the event, for example, the name of the component or system that generated the event.Tags: permission
LIMA_USAGE_TRACKER
event.type
string
stableDisplay name: Event typeThe unique type identifier of a given event.Tags: permission
Digital Experience Monitoring - Query
event.version
string
stableDisplay name: Event versionDescribes the version of the event.
1.0
query_id
string
stableThe UUID identifying a particular query.
e68e5cc8-c31e-4e57-90d7-c6dde20b19d5
query_start
long
stableQuery start time.
1683012271413
timestamp
timestamp
stableDisplay name: TimestampThe time (UNIX Epoch time in nanoseconds) when the event originated, typically when the source created it. If no original timestamp is available, it will be populated at ingest time and required for all events. In the case of a correlated event (for example, ITIL events), this time could be different from the event.start time, as this time represents the actual timestamp when the "update" for the event was created.
stableDisplay name: User IDUnique UUID of a human user. If the system itself has to be represented, the constant 'system' is used.
35ba9499-f87c-4047-962c-14dc32e255e5; system
Values
event.kind MUST be one of the following:
Value
Description
BILLING_USAGE_EVENT
Billing usage event
event.provider MUST be one of the following:
Value
Description
LIMA_USAGE_TRACKER
LIMA Usage Tracker Service
event.type MUST be one of the following:
Value
Description
Digital Experience Monitoring - Query
Digital Experience Monitoring Query Execution
dt.security_context MUST be one of the following:
Value
Description
BILLING_USAGE_EVENT
Billing usage event
Digital Experience Monitoring - Retain billing usage
Model describing the billing usage event for retention of DEM events per Grail bucket. Billing usage events are stored in the dt.system.events table.
Query
Retrieves billing usage events related to the Digital Experience Monitoring - Retain capability and returns only unique events by removing duplicates based on event.id.
Digital Experience Monitoring - Retain billing usage fields
Attribute
Type
Description
Examples
billed_bytes
long
stableThe number of bytes that will be billed.
1113359256
dt.security_context
string
resourcestableDisplay name: DT security contextThe security context is used in access permissions to limit the visibility. Learn more about the Dynatrace permission modelTags: permission
BILLING_USAGE_EVENT
event.billing.category
string
stableDisplay name for usage details.
User events; User sessions; Synthetic events; Synthetic user events; Synthetic user sessions
event.id
string
stableDisplay name: Event IDUnique identifier string of an event; is stable across multiple refreshes and updates.
5547782627070661074_1647601320000
event.kind
string
stableDisplay name: Event kindGives high-level information about what kind of information the event contains without being specific about the contents of the event. It helps to determine the record type of a raw event.Tags: permission
BILLING_USAGE_EVENT
event.provider
string
stableDisplay name: Event providerSource of the event, for example, the name of the component or system that generated the event.Tags: permission
LIMA_USAGE_STREAM
event.type
string
stableDisplay name: Event typeThe unique type identifier of a given event.Tags: permission
Digital Experience Monitoring - Retain
event.version
string
stableDisplay name: Event versionDescribes the version of the event.
1.0.0
timestamp
timestamp
stableDisplay name: TimestampThe time (UNIX Epoch time in nanoseconds) when the event originated, typically when the source created it. If no original timestamp is available, it will be populated at ingest time and required for all events. In the case of a correlated event (for example, ITIL events), this time could be different from the event.start time, as this time represents the actual timestamp when the "update" for the event was created.
Events that are generated by Dynatrace components with self-monitoring information (health, status, unexpected situations)
Dynatrace self-monitoring event fields
Attribute
Type
Description
Examples
content
string
experimentalUnstructured content of the record. It should contain a human-readable message. Often it is the raw version of a record read from a source.
No keepalive from datasource statsd. Restarting
dt.active_gate.group.name
string
resourceexperimentalDisplay name: ActiveGate group nameThe name of a group that the ActiveGate instance belongs to.
GdanskLab
dt.entity.host
string
resource **deprecatedThis field is deprecated and will be removed in the future. Use dt.smartscape.host instead.**Display name: HostAn entity ID of an entity of type HOST.Tags: entity-id
HOST-E0D8F94D9065F24F
dt.event.key
string
experimentalPreregistered event key for self-monitoring events whitelisting.
resourceexperimentalDisplay name: Extension data sourceName of the data source.
SNMPTrap
dt.extension.name
string
resourceexperimentalDisplay name: Extension nameName of the extension.
com.snmptrap.generic
dt.extension.status
string
resourceexperimentalDisplay name: Extension statusThe status of the component reporting a self-monitoring event.
AUTHENTICATION_ERROR
dt.source_entity
string
resource **deprecatedThis field is deprecated and will be removed in the future. Use dt.smartscape_source.id instead.**Display name: Source entityThe ID of the entity considered the source of the signal. The string represents an entity ID of an entity that is stored in the classic entity storage. 1Tags: entity-id
stableDisplay name: Log sourceHuman-readable attribute that identifies a log stream. 2Tags: permission
dsfm; isfm
timestamp
timestamp
stableDisplay name: TimestampThe time (UNIX Epoch time in nanoseconds) when the event originated, typically when the source created it. If no original timestamp is available, it will be populated at ingest time and required for all events. In the case of a correlated event (for example, ITIL events), this time could be different from the event.start time, as this time represents the actual timestamp when the "update" for the event was created.
1649822520123123123
1
The value of this field will be based on the value of one of the dt.entity.<type> fields. This means that the dt.source_entity and dt.entity.<type> fields will both be set to the same ID.
2
Can contain, for example, a file path, standard output, or an URI etc., depending on the log stream type. The value should be stable for one logical source (for example, not affected by log file rotation digits).
Events - Ingest & Process billing usage
Model describing a billing usage event of ingest for events. Billing usage events are stored in the dt.system.events table.
Query
Analyze billing usage events for the "Events - Ingest & Process" capability.
resourcestableDisplay name: DT security contextThe security context is used in access permissions to limit the visibility. Learn more about the Dynatrace permission modelTags: permission
BILLING_USAGE_EVENT
event.billing.category
string
stableDisplay name for usage details.
Business events; Custom Davis & Kubernetes events; Kubernetes warning events; Davis AI problems; Security events
event.id
string
stableDisplay name: Event IDUnique identifier string of an event; is stable across multiple refreshes and updates.
5547782627070661074_1647601320000
event.kind
string
stableDisplay name: Event kindGives high-level information about what kind of information the event contains without being specific about the contents of the event. It helps to determine the record type of a raw event.Tags: permission
BILLING_USAGE_EVENT
event.provider
string
stableDisplay name: Event providerSource of the event, for example, the name of the component or system that generated the event.Tags: permission
LIMA_CLIENT
event.type
string
stableDisplay name: Event typeThe unique type identifier of a given event.Tags: permission
Events - Ingest & Process
event.version
string
stableDisplay name: Event versionDescribes the version of the event.
1.0.0
timestamp
timestamp
stableDisplay name: TimestampStart time of the usage timeframe (inclusive).
2023-05-22T11:15:00.000000Z
usage.bucket
string
stableA Dynatrace Grail usage event bucket name.
default_davis_custom_events
usage.end
timestamp
stableEnd time of the usage timeframe (exclusive).
2023-05-22T11:30:00.000000Z
usage.start
timestamp
stableStart time of the usage timeframe (inclusive).
2023-05-22T11:15:00.000000Z
Values
event.kind MUST be one of the following:
Value
Description
BILLING_USAGE_EVENT
Billing usage event
event.provider MUST be one of the following:
Value
Description
LIMA_CLIENT
LIMA Client Service
event.type MUST be one of the following:
Value
Description
Events - Ingest & Process
Events - Ingest & Process
dt.security_context MUST be one of the following:
Value
Description
BILLING_USAGE_EVENT
Billing usage event
Events - Query billing usage
Model describing a billing usage event of a events query execution. Billing usage events are stored in the dt.system.events table.
Query
Analyze billing usage events.
fetch dt.system.events
|filter event.kind == "BILLING_USAGE_EVENT" and event.type == "Events - Query"
Events - Query billing usage fields
Attribute
Type
Description
Examples
action_type
string
stableIndicates if the query was executed to fetch records or to delete them.
stableContains information about the invoked workflow. For example, the workflow.id.
8a9c9ceb-7eb3-4e88-8c4b-681f8d52eb32
dt.security_context
string
resourcestableDisplay name: DT security contextThe security context is used in access permissions to limit the visibility. Learn more about the Dynatrace permission modelTags: permission
BILLING_USAGE_EVENT
event.billing.category
string
stableDisplay name for usage details.
Business events; Custom Davis & Kubernetes events; Kubernetes warning events; Davis AI problems; Security events
event.id
string
stableDisplay name: Event IDUnique identifier string of an event; is stable across multiple refreshes and updates.
5547782627070661074_1647601320000
event.kind
string
stableDisplay name: Event kindGives high-level information about what kind of information the event contains without being specific about the contents of the event. It helps to determine the record type of a raw event.Tags: permission
BILLING_USAGE_EVENT
event.provider
string
stableDisplay name: Event providerSource of the event, for example, the name of the component or system that generated the event.Tags: permission
LIMA_USAGE_TRACKER
event.type
string
stableDisplay name: Event typeThe unique type identifier of a given event.Tags: permission
Events - Query
event.version
string
stableDisplay name: Event versionDescribes the version of the event.
1.0; 2.0
query_id
string
stableThe UUID identifying a particular query.
e68e5cc8-c31e-4e57-90d7-c6dde20b19d5
query_start
long
stableQuery start time.
1683012271413
timestamp
timestamp
stableDisplay name: TimestampThe time (UNIX Epoch time in nanoseconds) when the event originated, typically when the source created it. If no original timestamp is available, it will be populated at ingest time and required for all events. In the case of a correlated event (for example, ITIL events), this time could be different from the event.start time, as this time represents the actual timestamp when the "update" for the event was created.
1649822520123123123
usage.bucket
string
stableA Dynatrace Grail usage event bucket name.
default_bizevents; default_davis_custom_events
user.email
string
stableDisplay name: User emailEmail of the user.
user@mail.com
user.id
string
stableDisplay name: User IDUnique UUID of a human user. If the system itself has to be represented, the constant 'system' is used.
35ba9499-f87c-4047-962c-14dc32e255e5; system
Values
event.kind MUST be one of the following:
Value
Description
BILLING_USAGE_EVENT
Billing usage event
event.provider MUST be one of the following:
Value
Description
LIMA_USAGE_TRACKER
LIMA Usage Tracker Service
event.type MUST be one of the following:
Value
Description
Events - Query
Events Query Execution
dt.security_context MUST be one of the following:
Value
Description
BILLING_USAGE_EVENT
Billing usage event
Events - Retain billing usage
Model describing the billing usage event for retention of events per Grail bucket. Billing usage events are stored in the dt.system.events table.
Query
Analyze billing usage events.
fetch dt.system.events
|filter event.kind == "BILLING_USAGE_EVENT" and event.type == "Events - Retain"
Events - Retain billing usage fields
Attribute
Type
Description
Examples
billed_bytes
long
stableThe number of bytes that will be billed.
1113359256
dt.security_context
string
resourcestableDisplay name: DT security contextThe security context is used in access permissions to limit the visibility. Learn more about the Dynatrace permission modelTags: permission
BILLING_USAGE_EVENT
event.billing.category
string
stableDisplay name for usage details.
Business events; Custom Davis & Kubernetes events; Kubernetes warning events; Davis AI problems; Security events
event.id
string
stableDisplay name: Event IDUnique identifier string of an event; is stable across multiple refreshes and updates.
5547782627070661074_1647601320000
event.kind
string
stableDisplay name: Event kindGives high-level information about what kind of information the event contains without being specific about the contents of the event. It helps to determine the record type of a raw event.Tags: permission
BILLING_USAGE_EVENT
event.provider
string
stableDisplay name: Event providerSource of the event, for example, the name of the component or system that generated the event.Tags: permission
LIMA_USAGE_STREAM
event.type
string
stableDisplay name: Event typeThe unique type identifier of a given event.Tags: permission
Event - Retain
event.version
string
stableDisplay name: Event versionDescribes the version of the event.
1.0.0
timestamp
timestamp
stableDisplay name: TimestampThe time (UNIX Epoch time in nanoseconds) when the event originated, typically when the source created it. If no original timestamp is available, it will be populated at ingest time and required for all events. In the case of a correlated event (for example, ITIL events), this time could be different from the event.start time, as this time represents the actual timestamp when the "update" for the event was created.
1649822520123123123
usage.bucket
string
stableA Dynatrace Grail usage event bucket name.
default_bizevents; default_davis_custom_events
Values
event.kind MUST be one of the following:
Value
Description
BILLING_USAGE_EVENT
Billing usage event
event.provider MUST be one of the following:
Value
Description
LIMA_USAGE_STREAM
LIMA Usage Stream Service
event.type MUST be one of the following:
Value
Description
Events - Retain
Events Retain
dt.security_context MUST be one of the following:
Value
Description
BILLING_USAGE_EVENT
Billing usage event
Files - Ingest & Process billing usage
Model describing a billing usage event of ingest for files. Billing usage events are stored in the dt.system.events table.
Query
Analyze billing usage events for the "Files - Ingest & Process" capability.
resourcestableDisplay name: DT security contextThe security context is used in access permissions to limit the visibility. Learn more about the Dynatrace permission modelTags: permission
BILLING_USAGE_EVENT
event.id
string
stableDisplay name: Event IDUnique identifier string of an event; is stable across multiple refreshes and updates.
5547782627070661074_1647601320000
event.kind
string
stableDisplay name: Event kindGives high-level information about what kind of information the event contains without being specific about the contents of the event. It helps to determine the record type of a raw event.Tags: permission
BILLING_USAGE_EVENT
event.provider
string
stableDisplay name: Event providerSource of the event, for example, the name of the component or system that generated the event.Tags: permission
LIMA_USAGE_TRACKER
event.type
string
stableDisplay name: Event typeThe unique type identifier of a given event.Tags: permission
Files - Ingest & Process
event.version
string
stableDisplay name: Event versionDescribes the version of the event.
1.0.0
timestamp
timestamp
stableDisplay name: TimestampStart time of the usage timeframe (inclusive).
2023-05-22T11:15:00.000000Z
usage.end
timestamp
stableEnd time of the usage timeframe (exclusive).
2023-05-22T11:30:00.000000Z
usage.start
timestamp
stableStart time of the usage timeframe (inclusive).
2023-05-22T11:15:00.000000Z
Values
event.kind MUST be one of the following:
Value
Description
BILLING_USAGE_EVENT
Billing usage event
event.provider MUST be one of the following:
Value
Description
LIMA_CLIENT
LIMA Client Service
event.type MUST be one of the following:
Value
Description
Files - Ingest & Process
Files - Ingest & Process
dt.security_context MUST be one of the following:
Value
Description
BILLING_USAGE_EVENT
Billing usage event
Files - Query billing usage
Model describing a billing usage event of a files query execution. Billing usage events are stored in the dt.system.events table.
Query
Analyze billing usage events.
fetch dt.system.events
|filter event.kind == "BILLING_USAGE_EVENT" and event.type == "Files - Query"
Files - Query billing usage fields
Attribute
Type
Description
Examples
action_type
string
stableIndicates if the query was executed to fetch records or to delete them.
stableContains information about the invoked workflow. For example, the workflow.id.
8a9c9ceb-7eb3-4e88-8c4b-681f8d52eb32
dt.security_context
string
resourcestableDisplay name: DT security contextThe security context is used in access permissions to limit the visibility. Learn more about the Dynatrace permission modelTags: permission
BILLING_USAGE_EVENT
event.id
string
stableDisplay name: Event IDUnique identifier string of an event; is stable across multiple refreshes and updates.
5547782627070661074_1647601320000
event.kind
string
stableDisplay name: Event kindGives high-level information about what kind of information the event contains without being specific about the contents of the event. It helps to determine the record type of a raw event.Tags: permission
BILLING_USAGE_EVENT
event.provider
string
stableDisplay name: Event providerSource of the event, for example, the name of the component or system that generated the event.Tags: permission
LIMA_USAGE_TRACKER
event.type
string
stableDisplay name: Event typeThe unique type identifier of a given event.Tags: permission
Files - Query
event.version
string
stableDisplay name: Event versionDescribes the version of the event.
1.0.0
query_id
string
stableThe UUID identifying a particular query.
e68e5cc8-c31e-4e57-90d7-c6dde20b19d5
query_start
long
stableQuery start time.
1683012271413
timestamp
timestamp
stableDisplay name: TimestampThe time (UNIX Epoch time in nanoseconds) when the event originated, typically when the source created it. If no original timestamp is available, it will be populated at ingest time and required for all events. In the case of a correlated event (for example, ITIL events), this time could be different from the event.start time, as this time represents the actual timestamp when the "update" for the event was created.
1649822520123123123
user.email
string
stableDisplay name: User emailEmail of the user.
user@mail.com
user.id
string
stableDisplay name: User IDUnique UUID of a human user. If the system itself has to be represented, the constant 'system' is used.
35ba9499-f87c-4047-962c-14dc32e255e5; system
Files - Retain billing usage
Model describing the billing usage event for the retention of files. Billing usage events are stored in the dt.system.events table.
Query
Fetch Files - Retain billing usage events.
fetch dt.system.events
|filter event.kind == "BILLING_USAGE_EVENT" and event.type == "Files - Retain"
|dedup event.id
Files - Retain billing usage fields
Attribute
Type
Description
Examples
billed_bytes
long
stableThe number of bytes that will be billed.
1113359256
dt.cost.costcenter
record[]
resourcestableDisplay name: Cost centerCan be used to assign usage to a Cost Center.
resourcestableDisplay name: DT security contextThe security context is used in access permissions to limit the visibility. Learn more about the Dynatrace permission modelTags: permission
BILLING_USAGE_EVENT
event.id
string
stableDisplay name: Event IDUnique identifier string of an event; is stable across multiple refreshes and updates.
5547782627070661074_1647601320000
event.kind
string
stableDisplay name: Event kindGives high-level information about what kind of information the event contains without being specific about the contents of the event. It helps to determine the record type of a raw event.Tags: permission
BILLING_USAGE_EVENT
event.provider
string
stableDisplay name: Event providerSource of the event, for example, the name of the component or system that generated the event.Tags: permission
LIMA_USAGE_STREAM
event.type
string
stableDisplay name: Event typeThe unique type identifier of a given event.Tags: permission
Files - Retain
event.version
string
stableDisplay name: Event versionDescribes the version of the event.
1.0.0
file.category
string
stableContains the value of the File Category.
Custom files
timestamp
timestamp
stableDisplay name: TimestampThe time (UNIX Epoch time in nanoseconds) when the event originated, typically when the source created it. If no original timestamp is available, it will be populated at ingest time and required for all events. In the case of a correlated event (for example, ITIL events), this time could be different from the event.start time, as this time represents the actual timestamp when the "update" for the event was created.
1649822520123123123
Values
event.kind MUST be one of the following:
Value
Description
BILLING_USAGE_EVENT
Billing usage event
event.provider MUST be one of the following:
Value
Description
LIMA_USAGE_STREAM
LIMA Usage Stream Service
event.type MUST be one of the following:
Value
Description
Files - Retain
Files Retain
dt.security_context MUST be one of the following:
Value
Description
BILLING_USAGE_EVENT
Billing usage event
Foundation & Discovery billing usage
Model describing a billing usage event for the Foundation & Discovery DPS capability.
Billing usage events are stored in the dt.system.events table.
Query
Analyze billing usage for Foundation & Discovery on 15-minute billing intervals.
Note that complete usage for events is displayed only for Dynatrace versions 1.312+. Earlier versions will display partial usage.
fetch dt.system.events
|filter event.kind == "BILLING_USAGE_EVENT" and event.type == "Foundation & Discovery"
|dedup event.id
Foundation & Discovery billing usage fields
Attribute
Type
Description
Examples
billed_host_hours
double
stableHow many host hours of the capability have been consumed by the host.
2.0
dt.cost.costcenter
string
resourcestableDisplay name: Cost centerCan be used to assign usage to a Cost Center.
Team A
dt.cost.product
string
resourcestableDisplay name: Cost productCan be used to assign usage to a Product or Application ID.
Product A
dt.entity.host
string
resource **deprecatedThis field is deprecated and will be removed in the future. Use dt.smartscape.host instead.**Display name: HostAn entity ID of an entity of type HOST.Tags: entity-id
HOST-E0D8F94D9065F24F
dt.security_context
string
resourcestableDisplay name: DT security contextThe security context is used in access permissions to limit the visibility. Learn more about the Dynatrace permission modelTags: permission
BILLING_USAGE_EVENT
event.id
string
stableDisplay name: Event IDUnique identifier string of an event; is stable across multiple refreshes and updates.
5547782627070661074_1647601320000
event.kind
string
stableDisplay name: Event kindGives high-level information about what kind of information the event contains without being specific about the contents of the event. It helps to determine the record type of a raw event.Tags: permission
BILLING_USAGE_EVENT
event.provider
string
stableDisplay name: Event providerSource of the event, for example, the name of the component or system that generated the event.Tags: permission
LIMA_CLIENT
event.type
string
stableDisplay name: Event typeThe unique type identifier of a given event.Tags: permission
Foundation & Discovery
event.version
string
stableDisplay name: Event versionDescribes the version of the event.
1.0.0
timestamp
timestamp
stableDisplay name: TimestampThe time (UNIX Epoch time in nanoseconds) when the event originated, typically when the source created it. If no original timestamp is available, it will be populated at ingest time and required for all events. In the case of a correlated event (for example, ITIL events), this time could be different from the event.start time, as this time represents the actual timestamp when the "update" for the event was created.
1649822520123123123
usage.end
timestamp
stableEnd time of the usage timeframe (exclusive).
2023-05-22T11:30:00.000000Z
usage.start
timestamp
stableStart time of the usage timeframe (inclusive).
2023-05-22T11:15:00.000000Z
Values
event.kind MUST be one of the following:
Value
Description
BILLING_USAGE_EVENT
Billing usage event
event.provider MUST be one of the following:
Value
Description
LIMA_CLIENT
LIMA Client Service
event.type MUST be one of the following:
Value
Description
Foundation & Discovery
Foundation & Discovery
dt.security_context MUST be one of the following:
Value
Description
BILLING_USAGE_EVENT
Billing usage event
Full-Stack Monitoring billing usage
Model describing a billing usage event for the Full-Stack Monitoring DPS capability.
Billing usage events are stored in the dt.system.events table.
Query
Analyze billing usage for Full-Stack Monitoring on 15-minute billing intervals.
Note that complete usage for events is displayed only for Dynatrace versions 1.312+. Earlier versions will display partial usage.
fetch dt.system.events
|filter event.kind == "BILLING_USAGE_EVENT" and event.type == "Full-Stack Monitoring"
|dedup event.id
Full-Stack Monitoring billing usage fields
Attribute
Type
Description
Examples
billed_gibibyte_hours
double
stableHow many gibibyte hours of the capability has been consumed by the host
16.02
dt.cost.costcenter
string
resourcestableDisplay name: Cost centerCan be used to assign usage to a Cost Center.
Team A
dt.cost.product
string
resourcestableDisplay name: Cost productCan be used to assign usage to a Product or Application ID.
Product A
dt.entity.host
string
resource **deprecatedThis field is deprecated and will be removed in the future. Use dt.smartscape.host instead.**Display name: HostAn entity ID of an entity of type HOST.Tags: entity-id
HOST-E0D8F94D9065F24F
dt.security_context
string
resourcestableDisplay name: DT security contextThe security context is used in access permissions to limit the visibility. Learn more about the Dynatrace permission modelTags: permission
BILLING_USAGE_EVENT
event.id
string
stableDisplay name: Event IDUnique identifier string of an event; is stable across multiple refreshes and updates.
5547782627070661074_1647601320000
event.kind
string
stableDisplay name: Event kindGives high-level information about what kind of information the event contains without being specific about the contents of the event. It helps to determine the record type of a raw event.Tags: permission
BILLING_USAGE_EVENT
event.provider
string
stableDisplay name: Event providerSource of the event, for example, the name of the component or system that generated the event.Tags: permission
LIMA_CLIENT
event.type
string
stableDisplay name: Event typeThe unique type identifier of a given event.Tags: permission
Full-Stack Monitoring
event.version
string
stableDisplay name: Event versionDescribes the version of the event.
1.0.0
timestamp
timestamp
stableDisplay name: TimestampThe time (UNIX Epoch time in nanoseconds) when the event originated, typically when the source created it. If no original timestamp is available, it will be populated at ingest time and required for all events. In the case of a correlated event (for example, ITIL events), this time could be different from the event.start time, as this time represents the actual timestamp when the "update" for the event was created.
1649822520123123123
usage.end
timestamp
stableEnd time of the usage timeframe (exclusive).
2023-05-22T11:30:00.000000Z
usage.start
timestamp
stableStart time of the usage timeframe (inclusive).
2023-05-22T11:15:00.000000Z
Values
event.kind MUST be one of the following:
Value
Description
BILLING_USAGE_EVENT
Billing usage event
event.provider MUST be one of the following:
Value
Description
LIMA_CLIENT
LIMA Client Service
event.type MUST be one of the following:
Value
Description
Full-Stack Monitoring
Full-Stack Monitoring
dt.security_context MUST be one of the following:
Value
Description
BILLING_USAGE_EVENT
Billing usage event
GenAI event
GenAI events are emitted when a GenAI skill is invoked or feedback is provided.
They provide tracking data for skill usage and user feedback. Examples:
What skills were used
Was positive or negative feedback provided
How long did the skill execution take
…
Query
Retrieve all GenAI events.
fetch dt.system.events
|filter event.kind == "GENAI_EVENT"
Count of GenAI skill invocations.
fetch dt.system.events
|filter event.kind == "GENAI_EVENT"
|filter event.type == "GenAI Skill Invocation"
|summarize count()
Count the GenAI invocations per skill.
fetch dt.system.events
|filter event.kind == "GENAI_EVENT"
|filter event.type == "GenAI Skill Invocation"
|summarize invocations=count(), by: skill
Count of the GenAI feedback type per skill.
fetch dt.system.events
|filter event.kind == "GENAI_EVENT"
|filter event.type == "GenAI Feedback"
|summarize count(), by: {feedback.type, skill}
Time series of the GenAI execution duration per skill.
experimentalThe type of caller that invoked the GenAI skill.
INTERNAL; MCP; API
client.application_context
string
stableA Dynatrace app ID.
dynatrace.davis.copilot
client.originating_application_context
string
experimentalName of the originating application if the conversation started from another app.
dynatrace.davis.problems
conversation_id
string
experimentalA UUID identifying a conversation across multiple messages.
55239b04-8f8d-4e26-88fa-f75357a626a2
event.kind
string
stableDisplay name: Event kindGives high-level information about what kind of information the event contains without being specific about the contents of the event. It helps to determine the record type of a raw event.Tags: permission
GENAI_EVENT
event.provider
string
stableDisplay name: Event providerSource of the event, for example, the name of the component or system that generated the event.Tags: permission
DAVIS_COPILOT; MCP_GATEWAY
event.type
string
stableDisplay name: Event typeThe unique type identifier of a given event.Tags: permission
experimentalCategory of feedback, selected by the user.
error; incomplete; incorrect; misunderstood; other
feedback.text
string
experimentalUnmasked free-text feedback provided by the user.
The answer was not correct.
feedback.type
string
experimentalType of feedback provided by the user, such as positive or negative.
positive; negative
mcp_client.name
string
experimentalAn MCP Client name
Visual Studio Code
mcp_client.version
string
experimentalAn MCP Client version
1.103.1
response
string
experimentalThe response was generated by the skill.
Here are today's errors...
server
string
experimentalThe name of the MCP server that was invoked.
dynatrace-mcp
session_id
string
experimentalUUID of the MCP protocol session; created at client connection and spans all messages exchanged during that connection.
cf45e99d-43c2-466f-a455-ab37cf942a54
skill
string
experimentalThe name of the skill that was executed.
nl2dql; chat; dql2nl; document-search
status
string
experimentalThe outcome of the query.
SUCCEEDED; FAILED; BLOCKED
supplementary
string
experimentalAdditional context information was provided for the skill (chat only).
Error details: ...
timestamp
timestamp
stableDisplay name: TimestampThe time (UNIX Epoch time in nanoseconds) when the event originated, typically when the source created it. If no original timestamp is available, it will be populated at ingest time and required for all events. In the case of a correlated event (for example, ITIL events), this time could be different from the event.start time, as this time represents the actual timestamp when the "update" for the event was created.
1649822520123123123
tool
string
experimentalThe name of the MCP server tool or AI function tool that was invoked.
experimentalGeneral topic addressed by the user input (for chat events only).
Root cause analysis of Davis problem
user.email
string
stableDisplay name: User emailEmail of the user.
john.doe@dynatrace.com
user.id
string
stableDisplay name: User IDUnique UUID of a human user. If the system itself has to be represented, the constant 'system' is used.
b5998ff1-26fd-4aec-80c4-6c59633b5d66
user_input
string
experimentalThe user input was provided for the skill.
Show me errors for today
workflow.execution.id
string
stableThe unique identifier of a workflow execution as UUID.
d3ddbb4f-f6cb-4286-be5a-e3a8bca53825
workflow.id
string
stableThe unique identifier of a workflow as UUID.
26c0334e-a3e1-4585-8cd8-2d72742fe141
Values
event.type MUST be one of the following:
Value
Description
GenAi Skill Invocation
GenAI skill was invoked.
GenAi Skill Feedback
Feedback for a GenAI skill was provided.
skill MAY be one of the following:
Value
Description
chat
Events associated with the conversations skill also used in the Davis CoPilot Chat App.
nl2dql
Events associated with the skill translating natural language into DQL queries.
dql2nl
Events associated with the skill explaining DQL queries in natural text.
status MUST be one of the following:
Value
Description
SUCCEEDED
Skill invocation succeeded.
FAILED
Skill invocation failed.
BLOCKED
Skill invocation was blocked by guardrail or content filter.
failure_reason MAY be one of the following:
Value
Description
BAD_REQUEST_ERROR
There was a technical problem.
CONTENT_FILTER
Content filter check failed.
GUARDRAIL_CHECK_FAILED
Guardrail check failed.
INVALID_DQL_GENERATED
Generated DQL was invalid.
feedback.type MUST be one of the following:
Value
Description
positive
Positive feedback.
negative
Negative feedback.
feedback.category MAY be one of the following:
Value
Description
error
The execution of the skill did not work.
incomplete
The response was incomplete.
incorrect
The response was incorrect.
misunderstood
The response misunderstood the question.
other
No provided feedback category fits.
HTTP Monitor billing usage per HTTP Monitor
Model describing a billing usage event for HTTP Monitor. Billing usage events are stored in the dt.system.events table.
Query
Analyze billing usage events for the "HTTP Monitor" capability.
fetch dt.system.events
|filter event.kind == "BILLING_USAGE_EVENT" and event.type == "HTTP Monitor"
|dedup event.id
HTTP Monitor billing usage per HTTP Monitor fields
Attribute
Type
Description
Examples
billed_http_request_count
long
experimentalThe number of HTTP requests performed. This is the billable unit related to the rate card of this capability.
10
dt.entity.http_check
string
resource **deprecatedThis field is deprecated and will be removed in the future. Use dt.smartscape.http_monitor instead.**Display name: HTTP checkAn entity ID of an entity of type HTTP_CHECK.Tags: entity-id
HTTP_CHECK-A140F3B85BCCBD1A
dt.security_context
string
resourcestableDisplay name: DT security contextThe security context is used in access permissions to limit the visibility. Learn more about the Dynatrace permission modelTags: permission
BILLING_USAGE_EVENT
event.id
string
stableDisplay name: Event IDUnique identifier string of an event; is stable across multiple refreshes and updates.
5547782627070661074_1647601320000
event.kind
string
stableDisplay name: Event kindGives high-level information about what kind of information the event contains without being specific about the contents of the event. It helps to determine the record type of a raw event.Tags: permission
BILLING_USAGE_EVENT
event.provider
string
stableDisplay name: Event providerSource of the event, for example, the name of the component or system that generated the event.Tags: permission
LIMA_CLIENT
event.type
string
stableDisplay name: Event typeThe unique type identifier of a given event.Tags: permission
HTTP Monitor
event.version
string
stableDisplay name: Event versionDescribes the version of the event.
1.0.0
timestamp
timestamp
stableDisplay name: TimestampStart time of the usage timeframe (inclusive).
2023-05-22T11:15:00.000000Z
usage.end
timestamp
stableEnd time of the usage timeframe (exclusive).
2023-05-22T11:30:00.000000Z
usage.start
timestamp
stableStart time of the usage timeframe (inclusive).
2023-05-22T11:15:00.000000Z
Values
event.kind MUST be one of the following:
Value
Description
BILLING_USAGE_EVENT
Billing usage event
event.provider MUST be one of the following:
Value
Description
LIMA_CLIENT
LIMA Client Service
event.type MUST be one of the following:
Value
Description
HTTP Monitor
HTTP Monitor
dt.security_context MUST be one of the following:
Value
Description
BILLING_USAGE_EVENT
Billing usage event
Infrastructure Monitoring billing usage
Model describing a billing usage event for the Infrastructure Monitoring DPS capability.
Billing usage events are stored in the dt.system.events table.
Query
Analyze billing usage for Infrastructure Monitoring on 15-minute billing intervals.
Note that complete usage for events is displayed only for Dynatrace versions 1.312+. Earlier versions will display partial usage.
fetch dt.system.events
|filter event.kind == "BILLING_USAGE_EVENT" and event.type == "Infrastructure Monitoring"
|dedup event.id
Infrastructure Monitoring billing usage fields
Attribute
Type
Description
Examples
billed_host_hours
double
stableHow many host hours of the capability have been consumed by the host.
2.0
dt.cost.costcenter
string
resourcestableDisplay name: Cost centerCan be used to assign usage to a Cost Center.
Team A
dt.cost.product
string
resourcestableDisplay name: Cost productCan be used to assign usage to a Product or Application ID.
Product A
dt.entity.host
string
resource **deprecatedThis field is deprecated and will be removed in the future. Use dt.smartscape.host instead.**Display name: HostAn entity ID of an entity of type HOST.Tags: entity-id
HOST-E0D8F94D9065F24F
dt.security_context
string
resourcestableDisplay name: DT security contextThe security context is used in access permissions to limit the visibility. Learn more about the Dynatrace permission modelTags: permission
BILLING_USAGE_EVENT
event.id
string
stableDisplay name: Event IDUnique identifier string of an event; is stable across multiple refreshes and updates.
5547782627070661074_1647601320000
event.kind
string
stableDisplay name: Event kindGives high-level information about what kind of information the event contains without being specific about the contents of the event. It helps to determine the record type of a raw event.Tags: permission
BILLING_USAGE_EVENT
event.provider
string
stableDisplay name: Event providerSource of the event, for example, the name of the component or system that generated the event.Tags: permission
LIMA_CLIENT
event.type
string
stableDisplay name: Event typeThe unique type identifier of a given event.Tags: permission
Infrastructure Monitoring
event.version
string
stableDisplay name: Event versionDescribes the version of the event.
1.0.0
timestamp
timestamp
stableDisplay name: TimestampThe time (UNIX Epoch time in nanoseconds) when the event originated, typically when the source created it. If no original timestamp is available, it will be populated at ingest time and required for all events. In the case of a correlated event (for example, ITIL events), this time could be different from the event.start time, as this time represents the actual timestamp when the "update" for the event was created.
1649822520123123123
usage.end
timestamp
stableEnd time of the usage timeframe (exclusive).
2023-05-22T11:30:00.000000Z
usage.start
timestamp
stableStart time of the usage timeframe (inclusive).
2023-05-22T11:15:00.000000Z
Values
event.kind MUST be one of the following:
Value
Description
BILLING_USAGE_EVENT
Billing usage event
event.provider MUST be one of the following:
Value
Description
LIMA_CLIENT
LIMA Client Service
event.type MUST be one of the following:
Value
Description
Infrastructure Monitoring
Infrastructure Monitoring
dt.security_context MUST be one of the following:
Value
Description
BILLING_USAGE_EVENT
Billing usage event
Kubernetes Platform Monitoring Billing Usage
Model describing a billing usage event for Kubernetes Platform Monitoring. Billing usage events are stored in the dt.system.events table.
Query
Analyze billing usage events for the "Kubernetes Platform Monitoring" capability.
fetch dt.system.events
|filter event.kind == "BILLING_USAGE_EVENT" and event.type == "Kubernetes Platform Monitoring"
stableThe number of pod-hours billed per namespace in a Kubernetes cluster
8.25
dt.entity.cloud_application_namespace
string
resource **deprecatedThis field is deprecated and will be removed in the future. Use dt.smartscape.k8s_namespace instead.**Display name: Cloud application namespaceAn entity ID of an entity of type CLOUD_APPLICATION_NAMESPACE. A CLOUD_APPLICATION_NAMESPACE is a Kubernetes namespace.Tags: entity-id
CLOUD_APPLICATION_NAMESPACE-C61324AA70F57BCB
dt.entity.kubernetes_cluster
string
resource **deprecatedThis field is deprecated and will be removed in the future. Use dt.smartscape.k8s_cluster instead.**Display name: Kubernetes clusterAn entity ID of an entity of type KUBERNETES_CLUSTER.Tags: entity-id
KUBERNETES_CLUSTER-E0D8F94D9065F24F
dt.security_context
string
resourcestableDisplay name: DT security contextThe security context is used in access permissions to limit the visibility. Learn more about the Dynatrace permission modelTags: permission
BILLING_USAGE_EVENT
dt.smartscape.k8s_cluster
smartscapeId
resourcestableDisplay name: Kubernetes cluster IDA Smartscape ID that can be used to query Kubernetes cluster entities from the Smartscape storage.Tags: smartscape-id
K8S_CLUSTER-0123456789ABCDEF
dt.smartscape.k8s_namespace
smartscapeId
resourcestableDisplay name: Kubernetes namespace IDSmartscape ID referencing a Kubernetes namespace.Tags: smartscape-id
K8S_NAMESPACE-AABBCCDDEEFF0011
event.id
string
stableDisplay name: Event IDUnique identifier string of an event; is stable across multiple refreshes and updates.
5547782627070661074_1647601320000
event.kind
string
stableDisplay name: Event kindGives high-level information about what kind of information the event contains without being specific about the contents of the event. It helps to determine the record type of a raw event.Tags: permission
BILLING_USAGE_EVENT
event.provider
string
stableDisplay name: Event providerSource of the event, for example, the name of the component or system that generated the event.Tags: permission
LIMA_CLIENT
event.type
string
stableDisplay name: Event typeThe unique type identifier of a given event.Tags: permission
Kubernetes Platform Monitoring
event.version
string
stableDisplay name: Event versionDescribes the version of the event.
2.0.0
timestamp
timestamp
stableDisplay name: TimestampThe time (UNIX Epoch time in nanoseconds) when the event originated, typically when the source created it. If no original timestamp is available, it will be populated at ingest time and required for all events. In the case of a correlated event (for example, ITIL events), this time could be different from the event.start time, as this time represents the actual timestamp when the "update" for the event was created.
1649822520123123123
usage.end
timestamp
stableEnd time of the usage timeframe (exclusive).
2023-05-22T11:30:00.000000Z
usage.start
timestamp
stableStart time of the usage timeframe (inclusive).
2023-05-22T11:15:00.000000Z
Values
event.kind MUST be one of the following:
Value
Description
BILLING_USAGE_EVENT
Billing usage event
event.provider MUST be one of the following:
Value
Description
LIMA_CLIENT
LIMA Client Service
event.type MUST be one of the following:
Value
Description
Kubernetes Platform Monitoring
Kubernetes Platform Monitoring
dt.security_context MUST be one of the following:
Value
Description
BILLING_USAGE_EVENT
Billing usage event
Log Management & Analytics - Ingest & Process billing usage
Model describing a billing usage event for ingest and process of logs. Billing usage events are stored in the dt.system.events table.
Query
Analyze billing usage events for the "Log Management & Analytics - Ingest & Process" capability.
resourcestableDisplay name: Cost centerCan be used to assign usage to a Cost Center.
Team A
dt.cost.product
string
resourcestableDisplay name: Cost productCan be used to assign usage to a Product or Application ID.
Product A
dt.security_context
string
resourcestableDisplay name: DT security contextThe security context is used in access permissions to limit the visibility. Learn more about the Dynatrace permission modelTags: permission
BILLING_USAGE_EVENT
event.id
string
stableDisplay name: Event IDUnique identifier string of an event; is stable across multiple refreshes and updates.
5547782627070661074_1647601320000
event.kind
string
stableDisplay name: Event kindGives high-level information about what kind of information the event contains without being specific about the contents of the event. It helps to determine the record type of a raw event.Tags: permission
BILLING_USAGE_EVENT
event.provider
string
stableDisplay name: Event providerSource of the event, for example, the name of the component or system that generated the event.Tags: permission
LIMA_CLIENT
event.type
string
stableDisplay name: Event typeThe unique type identifier of a given event.Tags: permission
Log Management & Analytics - Ingest & Process
event.version
string
stableDisplay name: Event versionDescribes the version of the event.
1.0.0
timestamp
timestamp
stableDisplay name: TimestampStart time of the usage timeframe (inclusive).
2023-05-22T11:15:00.000000Z
usage.bucket
string
stableA Dynatrace Grail usage event bucket name.
default_logs
usage.end
timestamp
stableEnd time of the usage timeframe (exclusive).
2023-05-22T11:30:00.000000Z
usage.start
timestamp
stableStart time of the usage timeframe (inclusive).
2023-05-22T11:15:00.000000Z
Values
event.kind MUST be one of the following:
Value
Description
BILLING_USAGE_EVENT
Billing usage event
event.provider MUST be one of the following:
Value
Description
LIMA_CLIENT
LIMA Client Service
event.type MUST be one of the following:
Value
Description
Log Management & Analytics - Ingest & Process
Log Management & Analytics - Ingest & Process
dt.security_context MUST be one of the following:
Value
Description
BILLING_USAGE_EVENT
Billing usage event
Log Management & Analytics - Query billing usage
Model describing a billing usage event of a logs query execution. Billing usage events are stored in the dt.system.events table.
stableContains information about the invoked workflow. For example, the workflow.id.
8a9c9ceb-7eb3-4e88-8c4b-681f8d52eb32
dt.security_context
string
resourcestableDisplay name: DT security contextThe security context is used in access permissions to limit the visibility. Learn more about the Dynatrace permission modelTags: permission
BILLING_USAGE_EVENT
event.id
string
stableDisplay name: Event IDUnique identifier string of an event; is stable across multiple refreshes and updates.
5547782627070661074_1647601320000
event.kind
string
stableDisplay name: Event kindGives high-level information about what kind of information the event contains without being specific about the contents of the event. It helps to determine the record type of a raw event.Tags: permission
BILLING_USAGE_EVENT
event.provider
string
stableDisplay name: Event providerSource of the event, for example, the name of the component or system that generated the event.Tags: permission
LIMA_USAGE_TRACKER
event.type
string
stableDisplay name: Event typeThe unique type identifier of a given event.Tags: permission
Log Management & Analytics - Query
event.version
string
stableDisplay name: Event versionDescribes the version of the event.
1.0
query_id
string
stableThe UUID identifying a particular query.
e68e5cc8-c31e-4e57-90d7-c6dde20b19d5
query_start
long
stableQuery start time.
1683012271413
timestamp
timestamp
stableDisplay name: TimestampThe time (UNIX Epoch time in nanoseconds) when the event originated, typically when the source created it. If no original timestamp is available, it will be populated at ingest time and required for all events. In the case of a correlated event (for example, ITIL events), this time could be different from the event.start time, as this time represents the actual timestamp when the "update" for the event was created.
1649822520123123123
user.email
string
stableDisplay name: User emailEmail of the user.
user@mail.com
user.id
string
stableDisplay name: User IDUnique UUID of a human user. If the system itself has to be represented, the constant 'system' is used.
35ba9499-f87c-4047-962c-14dc32e255e5; system
Values
event.kind MUST be one of the following:
Value
Description
BILLING_USAGE_EVENT
Billing usage event
event.provider MUST be one of the following:
Value
Description
LIMA_USAGE_TRACKER
LIMA Usage Tracker Service
event.type MUST be one of the following:
Value
Description
Log Management & Analytics - Query
Logs Query Execution
dt.security_context MUST be one of the following:
Value
Description
BILLING_USAGE_EVENT
Billing usage event
Log Management & Analytics - Retain billing usage
Model describing the billing usage event for retention of events per Grail bucket. Billing usage events are stored in the dt.system.events table.
resourcestableDisplay name: DT security contextThe security context is used in access permissions to limit the visibility. Learn more about the Dynatrace permission modelTags: permission
BILLING_USAGE_EVENT
event.id
string
stableDisplay name: Event IDUnique identifier string of an event; is stable across multiple refreshes and updates.
5547782627070661074_1647601320000
event.kind
string
stableDisplay name: Event kindGives high-level information about what kind of information the event contains without being specific about the contents of the event. It helps to determine the record type of a raw event.Tags: permission
BILLING_USAGE_EVENT
event.provider
string
stableDisplay name: Event providerSource of the event, for example, the name of the component or system that generated the event.Tags: permission
LIMA_USAGE_STREAM
event.type
string
stableDisplay name: Event typeThe unique type identifier of a given event.Tags: permission
Log Management & Analytics - Retain
event.version
string
stableDisplay name: Event versionDescribes the version of the event.
1.0.0
timestamp
timestamp
stableDisplay name: TimestampThe time (UNIX Epoch time in nanoseconds) when the event originated, typically when the source created it. If no original timestamp is available, it will be populated at ingest time and required for all events. In the case of a correlated event (for example, ITIL events), this time could be different from the event.start time, as this time represents the actual timestamp when the "update" for the event was created.
1649822520123123123
usage.bucket
string
stableA Dynatrace Grail usage log bucket name.
default_logs
Values
event.kind MUST be one of the following:
Value
Description
BILLING_USAGE_EVENT
Billing usage event
event.provider MUST be one of the following:
Value
Description
LIMA_USAGE_STREAM
LIMA Usage Stream Service
event.type MUST be one of the following:
Value
Description
Log Management & Analytics - Retain
Logs Retain
dt.security_context MUST be one of the following:
Value
Description
BILLING_USAGE_EVENT
Billing usage event
Log Management & Analytics - Retain with Included Queries billing usage
Model describing the billing usage event for retention of events per Grail bucket. Billing usage events are stored in the dt.system.events table.
Query
Fetch Log Management & Analytics - Retain with Included Queries usage events.
fetch dt.system.events
|filter event.kind == "BILLING_USAGE_EVENT" and event.type == "Log Management & Analytics - Retain with Included Queries"
Log Management & Analytics - Retain with Included Queries billing usage fields
Attribute
Type
Description
Examples
billed_bytes
long
stableThe number of bytes that will be billed.
1113359256
dt.cost.costcenter
record[]
resourcestableDisplay name: Cost centerCan be used to assign usage to a Cost Center.
resourcestableDisplay name: DT security contextThe security context is used in access permissions to limit the visibility. Learn more about the Dynatrace permission modelTags: permission
BILLING_USAGE_EVENT
event.id
string
stableDisplay name: Event IDUnique identifier string of an event; is stable across multiple refreshes and updates.
5547782627070661074qi_1647601320000
event.kind
string
stableDisplay name: Event kindGives high-level information about what kind of information the event contains without being specific about the contents of the event. It helps to determine the record type of a raw event.Tags: permission
BILLING_USAGE_EVENT
event.provider
string
stableDisplay name: Event providerSource of the event, for example, the name of the component or system that generated the event.Tags: permission
LIMA_USAGE_STREAM
event.type
string
stableDisplay name: Event typeThe unique type identifier of a given event.Tags: permission
Log Management & Analytics - Retain with Included Queries
event.version
string
stableDisplay name: Event versionDescribes the version of the event.
1.0.0
timestamp
timestamp
stableDisplay name: TimestampThe time (UNIX Epoch time in nanoseconds) when the event originated, typically when the source created it. If no original timestamp is available, it will be populated at ingest time and required for all events. In the case of a correlated event (for example, ITIL events), this time could be different from the event.start time, as this time represents the actual timestamp when the "update" for the event was created.
1649822520123123123
usage.bucket
string
stableA Dynatrace Grail usage log bucket name.
default_logs
Values
event.kind MUST be one of the following:
Value
Description
BILLING_USAGE_EVENT
Billing usage event
event.provider MUST be one of the following:
Value
Description
LIMA_USAGE_STREAM
LIMA Usage Stream Service
event.type MUST be one of the following:
Value
Description
Log Management and Analytics - Retain with Included Queries
Retain with Included Queries
dt.security_context MUST be one of the following:
Value
Description
BILLING_USAGE_EVENT
Billing usage event
Mainframe Monitoring billing usage
Model describing a billing usage event for Mainframe Monitoring. Billing usage events are stored in the dt.system.events table.
Query
Analyze billing usage events for the "Mainframe Monitoring" capability.
fetch dt.system.events
|filter event.kind == "BILLING_USAGE_EVENT" and event.type == "Mainframe Monitoring"
|dedup event.id
Mainframe Monitoring billing usage fields
Attribute
Type
Description
Examples
billed_msu_hours
double
stableThe number of msu-hours billed for the mainframe host.
8.25
dt.entity.host
string
resource **deprecatedThis field is deprecated and will be removed in the future. Use dt.smartscape.host instead.**Display name: HostAn entity ID of an entity of type HOST.Tags: entity-id
HOST-E0D8F94D9065F24F
dt.security_context
string
resourcestableDisplay name: DT security contextThe security context is used in access permissions to limit the visibility. Learn more about the Dynatrace permission modelTags: permission
BILLING_USAGE_EVENT
event.id
string
stableDisplay name: Event IDUnique identifier string of an event; is stable across multiple refreshes and updates.
5547782627070661074_1647601320000
event.kind
string
stableDisplay name: Event kindGives high-level information about what kind of information the event contains without being specific about the contents of the event. It helps to determine the record type of a raw event.Tags: permission
BILLING_USAGE_EVENT
event.provider
string
stableDisplay name: Event providerSource of the event, for example, the name of the component or system that generated the event.Tags: permission
LIMA_CLIENT
event.type
string
stableDisplay name: Event typeThe unique type identifier of a given event.Tags: permission
Mainframe Monitoring
event.version
string
stableDisplay name: Event versionDescribes the version of the event.
1.0.0
timestamp
timestamp
stableDisplay name: TimestampThe time (UNIX Epoch time in nanoseconds) when the event originated, typically when the source created it. If no original timestamp is available, it will be populated at ingest time and required for all events. In the case of a correlated event (for example, ITIL events), this time could be different from the event.start time, as this time represents the actual timestamp when the "update" for the event was created.
1649822520123123123
usage.end
timestamp
stableEnd time of the usage timeframe (exclusive).
2023-05-22T11:30:00.000000Z
usage.start
timestamp
stableStart time of the usage timeframe (inclusive).
2023-05-22T11:15:00.000000Z
Values
event.kind MUST be one of the following:
Value
Description
BILLING_USAGE_EVENT
Billing usage event
event.provider MUST be one of the following:
Value
Description
LIMA_CLIENT
LIMA Client Service
event.type MUST be one of the following:
Value
Description
Mainframe Monitoring
Mainframe Monitoring
dt.security_context MUST be one of the following:
Value
Description
BILLING_USAGE_EVENT
Billing usage event
Metrics - Ingest & Process billing usage
Model describing a billing usage event of ingest & process for metrics. Billing usage events are stored in the dt.system.events table.
resourcestableDisplay name: DT security contextThe security context is used in access permissions to limit the visibility. Learn more about the Dynatrace permission modelTags: permission
BILLING_USAGE_EVENT
event.id
string
stableDisplay name: Event IDUnique identifier string of an event; is stable across multiple refreshes and updates.
5547782627070661074_1647601320000
event.kind
string
stableDisplay name: Event kindGives high-level information about what kind of information the event contains without being specific about the contents of the event. It helps to determine the record type of a raw event.Tags: permission
BILLING_USAGE_EVENT
event.provider
string
stableDisplay name: Event providerSource of the event, for example, the name of the component or system that generated the event.Tags: permission
LIMA_USAGE_STREAM
event.type
string
stableDisplay name: Event typeThe unique type identifier of a given event.Tags: permission
Metrics - Ingest & Process
event.version
string
stableDisplay name: Event versionDescribes the version of the event.
1.0.0
metric.type
string
stableDisplay name: Metric typeIdentifies the type of metric and therefore the timeseries rollup functions it supports.
summary_stats
monitoring_source
string
stableMonitoring source that originally reported the data. See 'dt.system.monitoring_source'.
fullstack_host
timestamp
timestamp
stableDisplay name: TimestampThe time (UNIX Epoch time in nanoseconds) when the event originated, typically when the source created it. If no original timestamp is available, it will be populated at ingest time and required for all events. In the case of a correlated event (for example, ITIL events), this time could be different from the event.start time, as this time represents the actual timestamp when the "update" for the event was created.
stableEnd time of the usage timeframe (exclusive).
2023-05-22T11:30:00.000000Z
usage.start
timestamp
stableStart time of the usage timeframe (inclusive).
2023-05-22T11:15:00.000000Z
Values
event.kind MUST be one of the following:
Value
Description
BILLING_USAGE_EVENT
Billing usage event
event.provider MUST be one of the following:
Value
Description
LIMA_USAGE_STREAM
LIMA Usage Stream Service
event.type MUST be one of the following:
Value
Description
Metrics - Ingest & Process
Metrics - Ingest & Process
dt.security_context MUST be one of the following:
Value
Description
BILLING_USAGE_EVENT
Billing usage event
Metrics - Retain billing usage
Model describing the billing usage event for retention of metrics per Grail bucket. Billing usage events are stored in the dt.system.events table.
Query
Fetch Metrics Retain billing usage events.
fetch dt.system.events
|filter event.kind == "BILLING_USAGE_EVENT" and event.type == "Metrics - Retain"
Metrics - Retain billing usage fields
Attribute
Type
Description
Examples
billed_bytes
long
stableThe number of bytes that will be billed.
1113359256
dt.security_context
string
resourcestableDisplay name: DT security contextThe security context is used in access permissions to limit the visibility. Learn more about the Dynatrace permission modelTags: permission
BILLING_USAGE_EVENT
event.id
string
stableDisplay name: Event IDUnique identifier string of an event; is stable across multiple refreshes and updates.
5547782627070661074_1647601320000
event.kind
string
stableDisplay name: Event kindGives high-level information about what kind of information the event contains without being specific about the contents of the event. It helps to determine the record type of a raw event.Tags: permission
BILLING_USAGE_EVENT
event.provider
string
stableDisplay name: Event providerSource of the event, for example, the name of the component or system that generated the event.Tags: permission
LIMA_USAGE_STREAM
event.type
string
stableDisplay name: Event typeThe unique type identifier of a given event.Tags: permission
Metrics - Retain
event.version
string
stableDisplay name: Event versionDescribes the version of the event.
1.0.0
timestamp
timestamp
stableDisplay name: TimestampThe time (UNIX Epoch time in nanoseconds) when the event originated, typically when the source created it. If no original timestamp is available, it will be populated at ingest time and required for all events. In the case of a correlated event (for example, ITIL events), this time could be different from the event.start time, as this time represents the actual timestamp when the "update" for the event was created.
1649822520123123123
usage.bucket
string
stableA Dynatrace Grail usage metric bucket name.
default_metrics
Values
event.kind MUST be one of the following:
Value
Description
BILLING_USAGE_EVENT
Billing usage event
event.provider MUST be one of the following:
Value
Description
LIMA_USAGE_STREAM
LIMA Usage Stream Service
event.type MUST be one of the following:
Value
Description
Metrics - Retain
Metrics Retain
dt.security_context MUST be one of the following:
Value
Description
BILLING_USAGE_EVENT
Billing usage event
Query execution events
Dynatrace stores a query execution event for each query that got executed in the dt.system.events table.
Query
Analyze query execution events.
fetch dt.system.events
|filter event.kind == "QUERY_EXECUTION_EVENT"
The amount of succeeded queries.
fetch dt.system.events
|filter event.kind == "QUERY_EXECUTION_EVENT"
|filter status == "SUCCEEDED"
|summarize countDistinct(query_id)
The amount of failed queries.
fetch dt.system.events
|filter event.kind == "QUERY_EXECUTION_EVENT"
|summarize sum(failed_count)
Query execution event fields
Attribute
Type
Description
Examples
analysis_timeframe.end
timestamp
experimentalEnd time of query analysis timeframe.
2023-05-22T13:15:57.416654000
analysis_timeframe.start
timestamp
experimentalStart time of query analysis timeframe.
2023-05-22T11:15:57.416654000
bucket
string
experimentalA Dynatrace Grail bucket name.
default_logs; default_events
client.api_version
string
stableThe REST API version used by the client to perform the request.
experimentalThe number of records returned by the query. Might differ from actual number of records delivered to the client due to the additional response size limits (max result bytes, max result records, etc.).
1000
dt.security_context
string
resourcestableDisplay name: DT security contextThe security context is used in access permissions to limit the visibility. Learn more about the Dynatrace permission modelTags: permission
environment
string
experimentalA Dynatrace environment/tenant ID.
umsaywsjuo
event.kind
string
stableDisplay name: Event kindGives high-level information about what kind of information the event contains without being specific about the contents of the event. It helps to determine the record type of a raw event.Tags: permission
QUERY_EXECUTION_EVENT
execution_duration_ms
long
deprecatedThe duration of the query in milliseconds.
123
failed_count
long
experimentalNumber of failed queries represented by the record. failed_count > 1 represents cases like 'failure_reason=THROTTLED' with individual queries aggregated into a single record.
1; 321
failure_reason
string
experimentalAdditional information if query execution has 'FAILED'.
QUEUE_TIMEOUT; THROTTLED
flags
string[]
experimentalAdvisory flags attached to the query result by the query execution engine.
['CLASSIC_ENTITY_MIGRATION_ADVISED']
matched_records_ratio
double
experimentalThe ratio of records that matched the query filter conditions out of the total number of scanned records. A value of 1.0 means all scanned records matched; 0.0 means none matched.
0.42
query_end
long
stableQuery end time. For aggregated events the query end time may be zero and not reflect the exact end time.
1683012271413
query_id
string
stableThe UUID identifying a particular query. For aggregated events this field is null.
e68e5cc8-c31e-4e57-90d7-c6dde20b19d5
query_pool
string
experimentalThe resource pool of the query.
DASHBOARDS
query_queue_time_ms
long
deprecatedThe time query spent in queued state (in milliseconds).
456
query_start
long
stableQuery start time. For failed queries the start time may be aggregated and not reflect the exact start time but rather the aggregation time.
1683012271413
query_string
string
experimentalThe query string. For aggregated events this field is null.
fetch bizevents, from:-30m | limit 1
sampling_ratio
long
experimentalThe sampling ratio of the executed query.
1
scanned_bytes
long
experimentalThe number of scanned bytes.
1113359256
scanned_data_points
long
experimentalNumber of scanned data points for metric queries.
20
scanned_records
long
experimentalThe number of scanned records.
9209037
status
string
experimentalThe outcome of the query.
SUCCEEDED
table
string
experimentalA Dynatrace Grail table name.
logs; metrics
timestamp
timestamp
stableDisplay name: TimestampThe time (UNIX Epoch time in nanoseconds) when the event originated, typically when the source created it. If no original timestamp is available, it will be populated at ingest time and required for all events. In the case of a correlated event (for example, ITIL events), this time could be different from the event.start time, as this time represents the actual timestamp when the "update" for the event was created.
1649822520123123123
user
string
experimentalThe user ID that triggered the query. For aggregated events this field is null.
b5998ff1-26fd-4aec-80c4-6c59633b5d66
user.email
string
stableDisplay name: User emailThe user email that triggered the query. For aggregated events this field is null.
john.doe@dynatrace.com
user.id
string
stableDisplay name: User IDThe user UUID that triggered the query. For aggregated events this field is null.
b5998ff1-26fd-4aec-80c4-6c59633b5d66
version
string
resourcedeprecatedUsed in Extension Framework 2.0Display name: SNMP versionThe record version
1
Values
failure_reason MUST be one of the following:
Value
Description
QUEUE_TIMEOUT
Query timed out before execution due to resource or tenant quota limit.
THROTTLED
Query was rejected due to too many queries waiting in the queue. Reported either as records with full details or as aggregated batches with limited metadata.
INVALID_QUERY
Query cannot be parsed due to a syntax error.
PARSING_LIMIT
Query cannot be parsed because it exceeds the complexity limit of the parser.
PARSING_FAILED
Query cannot be parsed due to an internal error.
EXECUTION_FAILED
Execution of the submitted query failed because of internal an error.
INSUFFICIENT_PERMISSIONS
Query cannot be executed because the requester doesn't have permissions to a queried table.
EXECUTION_TIMEOUT
Query execution was canceled because it exceeded the allowed running time.
MEMORY_LIMIT
Query execution was canceled because the memory usage limit was exceeded.
DISK_LIMIT
Query execution was canceled because the disk space limit was exceeded.
FUNCTION_LIMIT
Query execution was canceled because the user-defined functions limit was exceeded.
RECORD_SIZE_LIMIT
Query execution was canceled because the record size limit was exceeded.
TABLE_SIZE_LIMIT
Query execution was canceled because the table size limit was exceeded.
FAILIF_CONDITION
Query execution was canceled because the condition of a failIf command was met.
Real User Monitoring Property billing usage by application
Model describing a billing usage event for Real User Monitoring Property. Billing usage events are stored in the dt.system.events table.
Query
Analyze billing usage events for the "Real User Monitoring Property" capability.
fetch dt.system.events
|filter event.kind == "BILLING_USAGE_EVENT" and event.type == "Real User Monitoring Property"
|dedup event.id
Real User Monitoring Property billing usage by application fields
Attribute
Type
Description
Examples
billed_property_sessions
long
experimentalUser action and session properties counted by application.
8
device.type
string
resourceexperimentalThe type of the device.
mobile
dt.entity.application
string
resource **deprecatedThis field is deprecated and will be removed in the future. Use dt.smartscape.frontend instead.**Display name: ApplicationThe ME ID of a web application.Tags: entity-id
APPLICATION-DC92E74A7A844E6E
dt.entity.device_application
string
resource **deprecatedThis field is deprecated and will be removed in the future. Use dt.smartscape.frontend instead.**Display name: Device applicationThe ME ID of a device application.
DEVICE_APPLICATION-EA8A8751A60D5BCE8
dt.security_context
string
resourcestableDisplay name: DT security contextThe security context is used in access permissions to limit the visibility. Learn more about the Dynatrace permission modelTags: permission
BILLING_USAGE_EVENT
event.id
string
stableDisplay name: Event IDUnique identifier string of an event; is stable across multiple refreshes and updates.
5547782627070661074_1647601320000
event.kind
string
stableDisplay name: Event kindGives high-level information about what kind of information the event contains without being specific about the contents of the event. It helps to determine the record type of a raw event.Tags: permission
BILLING_USAGE_EVENT
event.provider
string
stableDisplay name: Event providerSource of the event, for example, the name of the component or system that generated the event.Tags: permission
LIMA_CLIENT
event.type
string
stableDisplay name: Event typeThe unique type identifier of a given event.Tags: permission
Real User Monitoring Property
event.version
string
stableDisplay name: Event versionDescribes the version of the event.
1.0.0
timestamp
timestamp
stableDisplay name: TimestampStart time of the usage timeframe (inclusive).
2023-05-22T11:15:00.000000Z
usage.end
timestamp
stableEnd time of the usage timeframe (exclusive).
2023-05-22T11:30:00.000000Z
usage.start
timestamp
stableStart time of the usage timeframe (inclusive).
2023-05-22T11:15:00.000000Z
Values
event.kind MUST be one of the following:
Value
Description
BILLING_USAGE_EVENT
Billing usage event
event.provider MUST be one of the following:
Value
Description
LIMA_CLIENT
LIMA Client Service
event.type MUST be one of the following:
Value
Description
Real User Monitoring Property
Real User Monitoring Property
dt.security_context MUST be one of the following:
Value
Description
BILLING_USAGE_EVENT
Billing usage event
Real User Monitoring billing usage by application
Model describing a billing usage event for Real User Monitoring. Billing usage events are stored in the dt.system.events table.
Query
Analyze billing usage events for the "Real User Monitoring" capability.
fetch dt.system.events
|filter event.kind == "BILLING_USAGE_EVENT" and event.type == "Real User Monitoring"
|dedup event.id
Real User Monitoring billing usage by application fields
Attribute
Type
Description
Examples
billed_sessions
long
experimentalSession count without Session Replay counted by application.
8
device.type
string
resourceexperimentalThe type of the device.
mobile
dt.entity.application
string
resource **deprecatedThis field is deprecated and will be removed in the future. Use dt.smartscape.frontend instead.**Display name: ApplicationThe ME ID of a web application.Tags: entity-id
APPLICATION-DC92E74A7A844E6E
dt.entity.device_application
string
resource **deprecatedThis field is deprecated and will be removed in the future. Use dt.smartscape.frontend instead.**Display name: Device applicationThe ME ID of a device application.
DEVICE_APPLICATION-EA8A8751A60D5BCE8
dt.security_context
string
resourcestableDisplay name: DT security contextThe security context is used in access permissions to limit the visibility. Learn more about the Dynatrace permission modelTags: permission
BILLING_USAGE_EVENT
event.id
string
stableDisplay name: Event IDUnique identifier string of an event; is stable across multiple refreshes and updates.
5547782627070661074_1647601320000
event.kind
string
stableDisplay name: Event kindGives high-level information about what kind of information the event contains without being specific about the contents of the event. It helps to determine the record type of a raw event.Tags: permission
BILLING_USAGE_EVENT
event.provider
string
stableDisplay name: Event providerSource of the event, for example, the name of the component or system that generated the event.Tags: permission
LIMA_CLIENT
event.type
string
stableDisplay name: Event typeThe unique type identifier of a given event.Tags: permission
Real User Monitoring
event.version
string
stableDisplay name: Event versionDescribes the version of the event.
1.0.0
timestamp
timestamp
stableDisplay name: TimestampStart time of the usage timeframe (inclusive).
2023-05-22T11:15:00.000000Z
usage.end
timestamp
stableEnd time of the usage timeframe (exclusive).
2023-05-22T11:30:00.000000Z
usage.start
timestamp
stableStart time of the usage timeframe (inclusive).
2023-05-22T11:15:00.000000Z
Values
event.kind MUST be one of the following:
Value
Description
BILLING_USAGE_EVENT
Billing usage event
event.provider MUST be one of the following:
Value
Description
LIMA_CLIENT
LIMA Client Service
event.type MUST be one of the following:
Value
Description
Real User Monitoring
Real User Monitoring
dt.security_context MUST be one of the following:
Value
Description
BILLING_USAGE_EVENT
Billing usage event
Real User Monitoring with Session Replay billing usage by application
Model describing a billing usage event for Real User Monitoring with Session Replay. Billing usage events are stored in the dt.system.events table.
Query
Analyze billing usage events for the "Real User Monitoring with Session Replay" capability.
fetch dt.system.events
|filter event.kind == "BILLING_USAGE_EVENT" and event.type == "Real User Monitoring with Session Replay"
|dedup event.id
Real User Monitoring with Session Replay billing usage by application fields
Attribute
Type
Description
Examples
billed_replay_sessions
long
experimentalSession count with Session Replay counted by application.
8
device.type
string
resourceexperimentalThe type of the device.
mobile
dt.entity.application
string
resource **deprecatedThis field is deprecated and will be removed in the future. Use dt.smartscape.frontend instead.**Display name: ApplicationThe ME ID of a web application.Tags: entity-id
APPLICATION-DC92E74A7A844E6E
dt.entity.device_application
string
resource **deprecatedThis field is deprecated and will be removed in the future. Use dt.smartscape.frontend instead.**Display name: Device applicationThe ME ID of a device application.
DEVICE_APPLICATION-EA8A8751A60D5BCE8
dt.security_context
string
resourcestableDisplay name: DT security contextThe security context is used in access permissions to limit the visibility. Learn more about the Dynatrace permission modelTags: permission
BILLING_USAGE_EVENT
event.id
string
stableDisplay name: Event IDUnique identifier string of an event; is stable across multiple refreshes and updates.
5547782627070661074_1647601320000
event.kind
string
stableDisplay name: Event kindGives high-level information about what kind of information the event contains without being specific about the contents of the event. It helps to determine the record type of a raw event.Tags: permission
BILLING_USAGE_EVENT
event.provider
string
stableDisplay name: Event providerSource of the event, for example, the name of the component or system that generated the event.Tags: permission
LIMA_CLIENT
event.type
string
stableDisplay name: Event typeThe unique type identifier of a given event.Tags: permission
Real User Monitoring with Session Replay
event.version
string
stableDisplay name: Event versionDescribes the version of the event.
1.0.0
timestamp
timestamp
stableDisplay name: TimestampStart time of the usage timeframe (inclusive).
2023-05-22T11:15:00.000000Z
usage.end
timestamp
stableEnd time of the usage timeframe (exclusive).
2023-05-22T11:30:00.000000Z
usage.start
timestamp
stableStart time of the usage timeframe (inclusive).
2023-05-22T11:15:00.000000Z
Values
event.kind MUST be one of the following:
Value
Description
BILLING_USAGE_EVENT
Billing usage event
event.provider MUST be one of the following:
Value
Description
LIMA_CLIENT
LIMA Client Service
event.type MUST be one of the following:
Value
Description
Real User Monitoring with Session Replay
Real User Monitoring with Session Replay
dt.security_context MUST be one of the following:
Value
Description
BILLING_USAGE_EVENT
Billing usage event
Runtime Application Protection billing usage
Model describing a billing usage event for the Runtime Application Protection DPS capability.
Billing usage events are stored in the dt.system.events table.
Query
Analyze billing usage for Runtime Application Protection on 15-minute billing intervals.
Note that complete usage for events is displayed only for Dynatrace versions 1.312+. Earlier versions will display partial usage.
fetch dt.system.events
|filter event.kind == "BILLING_USAGE_EVENT" and event.type == "Runtime Application Protection"
stableHow many gibibyte hours of the capability has been consumed by the host
16.02
dt.cost.costcenter
string
resourcestableDisplay name: Cost centerCan be used to assign usage to a Cost Center.
Team A
dt.cost.product
string
resourcestableDisplay name: Cost productCan be used to assign usage to a Product or Application ID.
Product A
dt.entity.host
string
resource **deprecatedThis field is deprecated and will be removed in the future. Use dt.smartscape.host instead.**Display name: HostAn entity ID of an entity of type HOST.Tags: entity-id
HOST-E0D8F94D9065F24F
dt.security_context
string
resourcestableDisplay name: DT security contextThe security context is used in access permissions to limit the visibility. Learn more about the Dynatrace permission modelTags: permission
BILLING_USAGE_EVENT
event.id
string
stableDisplay name: Event IDUnique identifier string of an event; is stable across multiple refreshes and updates.
5547782627070661074_1647601320000
event.kind
string
stableDisplay name: Event kindGives high-level information about what kind of information the event contains without being specific about the contents of the event. It helps to determine the record type of a raw event.Tags: permission
BILLING_USAGE_EVENT
event.provider
string
stableDisplay name: Event providerSource of the event, for example, the name of the component or system that generated the event.Tags: permission
LIMA_CLIENT
event.type
string
stableDisplay name: Event typeThe unique type identifier of a given event.Tags: permission
Runtime Application Protection
event.version
string
stableDisplay name: Event versionDescribes the version of the event.
1.0.0
timestamp
timestamp
stableDisplay name: TimestampThe time (UNIX Epoch time in nanoseconds) when the event originated, typically when the source created it. If no original timestamp is available, it will be populated at ingest time and required for all events. In the case of a correlated event (for example, ITIL events), this time could be different from the event.start time, as this time represents the actual timestamp when the "update" for the event was created.
1649822520123123123
usage.end
timestamp
stableEnd time of the usage timeframe (exclusive).
2023-05-22T11:30:00.000000Z
usage.start
timestamp
stableStart time of the usage timeframe (inclusive).
2023-05-22T11:15:00.000000Z
Values
event.kind MUST be one of the following:
Value
Description
BILLING_USAGE_EVENT
Billing usage event
event.provider MUST be one of the following:
Value
Description
LIMA_CLIENT
LIMA Client Service
event.type MUST be one of the following:
Value
Description
Runtime Application Protection
Runtime Application Protection
dt.security_context MUST be one of the following:
Value
Description
BILLING_USAGE_EVENT
Billing usage event
Runtime Vulnerability Analytics billing usage
Model describing a billing usage event for the Runtime Vulnerability Analytics DPS capability.
Billing usage events are stored in the dt.system.events table.
Query
Analyze billing usage for Runtime Vulnerability Analytics on 15-minute billing intervals.
Note that complete usage for events is displayed only for Dynatrace versions 1.312+. Earlier versions will display partial usage.
fetch dt.system.events
|filter event.kind == "BILLING_USAGE_EVENT" and event.type == "Runtime Vulnerability Analytics"
stableHow many gibibyte hours of the capability has been consumed by the host
16.02
dt.cost.costcenter
string
resourcestableDisplay name: Cost centerCan be used to assign usage to a Cost Center.
Team A
dt.cost.product
string
resourcestableDisplay name: Cost productCan be used to assign usage to a Product or Application ID.
Product A
dt.entity.host
string
resource **deprecatedThis field is deprecated and will be removed in the future. Use dt.smartscape.host instead.**Display name: HostAn entity ID of an entity of type HOST.Tags: entity-id
HOST-E0D8F94D9065F24F
dt.security_context
string
resourcestableDisplay name: DT security contextThe security context is used in access permissions to limit the visibility. Learn more about the Dynatrace permission modelTags: permission
BILLING_USAGE_EVENT
event.id
string
stableDisplay name: Event IDUnique identifier string of an event; is stable across multiple refreshes and updates.
5547782627070661074_1647601320000
event.kind
string
stableDisplay name: Event kindGives high-level information about what kind of information the event contains without being specific about the contents of the event. It helps to determine the record type of a raw event.Tags: permission
BILLING_USAGE_EVENT
event.provider
string
stableDisplay name: Event providerSource of the event, for example, the name of the component or system that generated the event.Tags: permission
LIMA_CLIENT
event.type
string
stableDisplay name: Event typeThe unique type identifier of a given event.Tags: permission
Runtime Vulnerability Analytics
event.version
string
stableDisplay name: Event versionDescribes the version of the event.
1.0.0
timestamp
timestamp
stableDisplay name: TimestampThe time (UNIX Epoch time in nanoseconds) when the event originated, typically when the source created it. If no original timestamp is available, it will be populated at ingest time and required for all events. In the case of a correlated event (for example, ITIL events), this time could be different from the event.start time, as this time represents the actual timestamp when the "update" for the event was created.
1649822520123123123
usage.end
timestamp
stableEnd time of the usage timeframe (exclusive).
2023-05-22T11:30:00.000000Z
usage.start
timestamp
stableStart time of the usage timeframe (inclusive).
2023-05-22T11:15:00.000000Z
Values
event.kind MUST be one of the following:
Value
Description
BILLING_USAGE_EVENT
Billing usage event
event.provider MUST be one of the following:
Value
Description
LIMA_CLIENT
LIMA Client Service
event.type MUST be one of the following:
Value
Description
Runtime Vulnerability Protection
Runtime Vulnerability Protection
dt.security_context MUST be one of the following:
Value
Description
BILLING_USAGE_EVENT
Billing usage event
Security Posture Management billing usage
Model describing a billing usage event for Security Posture Management. Billing usage events are stored in the dt.system.events table.
Query
Analyze usage events for the "Security Posture Management" capability.
fetch dt.system.events
|filter event.kind == "BILLING_USAGE_EVENT" and event.type == "Security Posture Management"
|dedup event.id
Analyze Security Posture Management billing usage events for a specific Kubernetes cluster.
fetch dt.system.events
|filter event.kind == "BILLING_USAGE_EVENT" and event.type == "Security Posture Management"
|filter k8s.cluster.name == "my-cluster"
|dedup event.id
Analyze Security Posture Management billing usage in the last 24 hours grouped by Smartscape source entity to identify which entities drive the most usage.
fetch dt.system.events, from:now()-24h
|filter event.kind == "BILLING_USAGE_EVENT" and event.type == "Security Posture Management"
resource **deprecatedWill be replaced by an equivalent dt.smartscape_source attribute.**Display name: Kubernetes clusterAn entity ID of an entity of type KUBERNETES_CLUSTER.Tags: entity-id
KUBERNETES_CLUSTER-E0D8F94D9065F24F
dt.entity.kubernetes_node
string
resource **deprecatedWill be replaced by an equivalent dt.smartscape_source attribute.**Display name: Kubernetes nodeAn entity ID of an entity of type KUBERNETES_NODE.Tags: entity-id
KUBERNETES_NODE-874C66B68CE15070
dt.security_context
string
resourcestableDisplay name: DT security contextThe security context is used in access permissions to limit the visibility. Learn more about the Dynatrace permission modelTags: permission
BILLING_USAGE_EVENT
dt.smartscape_source.id
smartscapeId
resourcestableDisplay name: Smartscape source IDThe ID of the entity considered the source of the signal. The string represents an entity ID of an entity that is stored in the Smartscape storage. 1Tags: smartscape-id
stableDisplay name: Smartscape source typeThe entity type of the entity whose identifier is held in dt.smartscape_source.id.
K8S_CLUSTER; AWS_LAMBDA_FUNCTION
event.id
string
stableDisplay name: Event IDUnique identifier string of an event; is stable across multiple refreshes and updates.
5547782627070661074_1647601320000
event.kind
string
stableDisplay name: Event kindGives high-level information about what kind of information the event contains without being specific about the contents of the event. It helps to determine the record type of a raw event.Tags: permission
BILLING_USAGE_EVENT
event.provider
string
stableDisplay name: Event providerSource of the event, for example, the name of the component or system that generated the event.Tags: permission
LIMA_USAGE_STREAM
event.type
string
stableDisplay name: Event typeThe unique type identifier of a given event.Tags: permission
Security Posture Management
event.version
string
stableDisplay name: Event versionDescribes the version of the event.
1.0.0
k8s.cluster.name
string
resourcestableDisplay name: Kubernetes cluster nameThe user-defined name of the cluster in Dynatrace. Doesn't need to be unique or immutable.Tags: permissionprimary-field
unguard-dev; acme-prod10
timestamp
timestamp
stableDisplay name: TimestampThe time (UNIX Epoch time in nanoseconds) when the event originated, typically when the source created it. If no original timestamp is available, it will be populated at ingest time and required for all events. In the case of a correlated event (for example, ITIL events), this time could be different from the event.start time, as this time represents the actual timestamp when the "update" for the event was created.
1649822520123123123
1
The value of this field will be based on the value of one of the dt.smartscape.<type> fields. That means that the dt.smartscape_source.id and dt.smartscape.<type> fields will both be set to the same ID.
Values
event.kind MUST be one of the following:
Value
Description
BILLING_USAGE_EVENT
Billing usage event
event.provider MUST be one of the following:
Value
Description
LIMA_USAGE_STREAM
LIMA Usage Stream Service
event.type MUST be one of the following:
Value
Description
Security Posture Management
Security Posture Management
dt.security_context MUST be one of the following:
Value
Description
BILLING_USAGE_EVENT
Billing usage event
Third-Party Synthetic API Ingestion billing usage per external browser monitor
Model describing a billing usage event for Third-Party Synthetic API Ingestion. Billing usage events are stored in the dt.system.events table.
Query
Analyze billing usage events for the "Third-Party Synthetic API Ingestion" capability.
fetch dt.system.events
|filter event.kind == "BILLING_USAGE_EVENT" and event.type == "Third-Party Synthetic API Ingestion"
|dedup event.id
Third-Party Synthetic API Ingestion billing usage per external browser monitor fields
Attribute
Type
Description
Examples
billed_test_result_ingestion_count
long
experimentalThe number of synthetic test results pushed into Dynatrace with Synthetic 3rd party API. This is the billable unit related to the rate card of this capability.
10
dt.entity.external_synthetic_test
string
resource **deprecatedThis field is deprecated and will be removed in the future.**Display name: External synthetic testAn entity ID of an entity of type EXTERNAL_SYNTHETIC_TEST.Tags: entity-id
EXTERNAL_SYNTHETIC_TEST-A140F3B85BCCBD1A
dt.security_context
string
resourcestableDisplay name: DT security contextThe security context is used in access permissions to limit the visibility. Learn more about the Dynatrace permission modelTags: permission
BILLING_USAGE_EVENT
event.id
string
stableDisplay name: Event IDUnique identifier string of an event; is stable across multiple refreshes and updates.
5547782627070661074_1647601320000
event.kind
string
stableDisplay name: Event kindGives high-level information about what kind of information the event contains without being specific about the contents of the event. It helps to determine the record type of a raw event.Tags: permission
BILLING_USAGE_EVENT
event.provider
string
stableDisplay name: Event providerSource of the event, for example, the name of the component or system that generated the event.Tags: permission
LIMA_CLIENT
event.type
string
stableDisplay name: Event typeThe unique type identifier of a given event.Tags: permission
Third-Party Synthetic API Ingestion
event.version
string
stableDisplay name: Event versionDescribes the version of the event.
1.0.0
timestamp
timestamp
stableDisplay name: TimestampStart time of the usage timeframe (inclusive).
2023-05-22T11:15:00.000000Z
usage.end
timestamp
stableEnd time of the usage timeframe (exclusive).
2023-05-22T11:30:00.000000Z
usage.start
timestamp
stableStart time of the usage timeframe (inclusive).
2023-05-22T11:15:00.000000Z
Values
event.kind MUST be one of the following:
Value
Description
BILLING_USAGE_EVENT
Billing usage event
event.provider MUST be one of the following:
Value
Description
LIMA_CLIENT
LIMA Client Service
event.type MUST be one of the following:
Value
Description
Third-Party Synthetic API Ingestion
Third-Party Synthetic API Ingestion
dt.security_context MUST be one of the following:
Value
Description
BILLING_USAGE_EVENT
Billing usage event
Traces - Ingest & Process billing usage
Model describing a billing usage event for ingest and process of traces. Billing usage events are stored in the dt.system.events table.
Query
Analyze billing usage events for the "Traces - Ingest & Process" capability.
resourcestableDisplay name: Cost centerCan be used to assign usage to a Cost Center.
Team A
dt.cost.product
string
resourcestableDisplay name: Cost productCan be used to assign usage to a Product or Application ID.
Product A
dt.security_context
string
resourcestableDisplay name: DT security contextThe security context is used in access permissions to limit the visibility. Learn more about the Dynatrace permission modelTags: permission
BILLING_USAGE_EVENT
event.id
string
stableDisplay name: Event IDUnique identifier string of an event; is stable across multiple refreshes and updates.
5547782627070661074_1647601320000
event.kind
string
stableDisplay name: Event kindGives high-level information about what kind of information the event contains without being specific about the contents of the event. It helps to determine the record type of a raw event.Tags: permission
BILLING_USAGE_EVENT
event.provider
string
stableDisplay name: Event providerSource of the event, for example, the name of the component or system that generated the event.Tags: permission
LIMA_CLIENT
event.type
string
stableDisplay name: Event typeThe unique type identifier of a given event.Tags: permission
Traces - Ingest & Process
event.version
string
stableDisplay name: Event versionDescribes the version of the event.
1.0.0
ingested_bytes
long
experimentalThe size in bytes of ingested spans.
1113359256
ingested_spans
long
experimentalThe number of ingested spans.
1113359256
licensing_type
string
experimentalThe origin/type of the ingested spans.
fullstack-adaptive
timestamp
timestamp
stableDisplay name: TimestampStart time of the usage timeframe (inclusive).
2023-05-22T11:15:00.000000Z
usage.bucket
string
stableA Dynatrace Grail usage event bucket name.
default_metrics
usage.end
timestamp
stableEnd time of the usage timeframe (exclusive).
2023-05-22T11:30:00.000000Z
usage.start
timestamp
stableStart time of the usage timeframe (inclusive).
2023-05-22T11:15:00.000000Z
Values
event.kind MUST be one of the following:
Value
Description
BILLING_USAGE_EVENT
Billing usage event
event.provider MUST be one of the following:
Value
Description
LIMA_CLIENT
LIMA Client Service
event.type MUST be one of the following:
Value
Description
Traces - Ingest & Process
Traces - Ingest & Process
dt.security_context MUST be one of the following:
Value
Description
BILLING_USAGE_EVENT
Billing usage event
licensing_type MUST be one of the following:
Value
Description
fullstack-adaptive
The ingested_bytes origins from an ATM aware fullstack source.
fullstack-fixed-rate
The ingested_bytes origins from an ATM unaware fullstack source.
otlp-trace-ingest
The ingested_bytes origins from the "OTLP Trace Ingest API".
serverless
The ingested_bytes origins from a serverless source.
Traces - Query billing usage
Model describing a billing usage event of a traces query execution. Billing usage events are stored in the dt.system.events table.
Query
Analyze billing usage events.
fetch dt.system.events
|filter event.kind == "BILLING_USAGE_EVENT" and event.type == "Traces - Query"
Traces - Query billing usage fields
Attribute
Type
Description
Examples
action_type
string
stableIndicates if the query was executed to fetch records or to delete them.
stableContains information about the invoked workflow. For example, the workflow.id.
8a9c9ceb-7eb3-4e88-8c4b-681f8d52eb32
dt.security_context
string
resourcestableDisplay name: DT security contextThe security context is used in access permissions to limit the visibility. Learn more about the Dynatrace permission modelTags: permission
BILLING_USAGE_EVENT
event.id
string
stableDisplay name: Event IDUnique identifier string of an event; is stable across multiple refreshes and updates.
5547782627070661074_1647601320000
event.kind
string
stableDisplay name: Event kindGives high-level information about what kind of information the event contains without being specific about the contents of the event. It helps to determine the record type of a raw event.Tags: permission
BILLING_USAGE_EVENT
event.provider
string
stableDisplay name: Event providerSource of the event, for example, the name of the component or system that generated the event.Tags: permission
LIMA_USAGE_TRACKER
event.type
string
stableDisplay name: Event typeThe unique type identifier of a given event.Tags: permission
Traces - Query
event.version
string
stableDisplay name: Event versionDescribes the version of the event.
1.0
query_id
string
stableThe UUID identifying a particular query.
e68e5cc8-c31e-4e57-90d7-c6dde20b19d5
query_start
long
stableQuery start time.
1683012271413
timestamp
timestamp
stableDisplay name: TimestampThe time (UNIX Epoch time in nanoseconds) when the event originated, typically when the source created it. If no original timestamp is available, it will be populated at ingest time and required for all events. In the case of a correlated event (for example, ITIL events), this time could be different from the event.start time, as this time represents the actual timestamp when the "update" for the event was created.
1649822520123123123
user.email
string
stableDisplay name: User emailEmail of the user.
user@mail.com
user.id
string
stableDisplay name: User IDUnique UUID of a human user. If the system itself has to be represented, the constant 'system' is used.
35ba9499-f87c-4047-962c-14dc32e255e5; system
Values
event.kind MUST be one of the following:
Value
Description
BILLING_USAGE_EVENT
Billing usage event
event.provider MUST be one of the following:
Value
Description
LIMA_USAGE_TRACKER
LIMA Usage Tracker Service
event.type MUST be one of the following:
Value
Description
Traces - Query
Traces Query Execution
dt.security_context MUST be one of the following:
Value
Description
BILLING_USAGE_EVENT
Billing usage event
Traces - Retain billing usage
Model describing the billing usage event for retention of events per Grail bucket. Billing usage events are stored in the dt.system.events table.
Query
Analyze billing usage events.
fetch dt.system.events
|filter event.kind == "BILLING_USAGE_EVENT" and event.type == "Traces - Retain"
Traces - Retain billing usage fields
Attribute
Type
Description
Examples
billed_bytes
long
stableThe number of bytes that will be billed.
1113359256
dt.security_context
string
resourcestableDisplay name: DT security contextThe security context is used in access permissions to limit the visibility. Learn more about the Dynatrace permission modelTags: permission
BILLING_USAGE_EVENT
event.id
string
stableDisplay name: Event IDUnique identifier string of an event; is stable across multiple refreshes and updates.
5547782627070661074_1647601320000
event.kind
string
stableDisplay name: Event kindGives high-level information about what kind of information the event contains without being specific about the contents of the event. It helps to determine the record type of a raw event.Tags: permission
BILLING_USAGE_EVENT
event.provider
string
stableDisplay name: Event providerSource of the event, for example, the name of the component or system that generated the event.Tags: permission
LIMA_USAGE_STREAM
event.type
string
stableDisplay name: Event typeThe unique type identifier of a given event.Tags: permission
Traces - Retain
event.version
string
stableDisplay name: Event versionDescribes the version of the event.
1.0.0
timestamp
timestamp
stableDisplay name: TimestampThe time (UNIX Epoch time in nanoseconds) when the event originated, typically when the source created it. If no original timestamp is available, it will be populated at ingest time and required for all events. In the case of a correlated event (for example, ITIL events), this time could be different from the event.start time, as this time represents the actual timestamp when the "update" for the event was created.