Standard attributes

service.name

The service. Required for traces and APM; services are grouped by it.

service.version

The release, used by release impact and deploy markers.

deployment.environment.name

The environment name (production, staging). The older deployment.environment is read too.

host.name, host.id

The host. Infrastructure entities are built from them.

cloud.provider, cloud.region, cloud.account.id, cloud.resource_id

Where the workload runs. cloud.resource_id links utilization series to cost lines.

k8s.cluster.name, k8s.namespace.name, k8s.pod.name, k8s.node.name, k8s.deployment.name

Kubernetes placement.

container.id, container.name, container.image.name

The container.

telemetry.sdk.language, telemetry.sdk.name

Which SDK produced the data.

trace_id, span_id

Correlation. A log with both opens the trace beside it.

http.request.method, http.response.status_code, http.route, url.path

HTTP spans; http.route is the low-cardinality route used for endpoints.

db.system, db.query.text, db.operation.name

Database spans; query text is normalized before grouping.

error.type, exception.type, exception.message, exception.stacktrace

Errors; exceptions feed issue grouping.

enduser.id, user.id

The end user, for user-centric error counts.

wt.sample_rate

the sampling stage

One kept record stands for this many. Counts and rates are extrapolated by it.

wt.dedupe_count

the dedupe stage

How many identical records the surviving one stands for.

wt.reduce_count

the reduce stage

How many records were folded into this one.

wt.timestamp_adjusted

the gateway

The event time was corrected (clock skew, future or too-old time).

wt.cast_failed

the remap stage

A type cast in a pipeline failed and the original value was kept.

wt.retention_days

the route stage

The retention class chosen for the record.

wt.tier

tail sampling

The retention tier stamped on a kept span.

wt.export_destination

the route stage

The export destination the record is routed to.

wt.single_span

tail sampling

The span was kept on its own although its trace was dropped.

wt.truncated

ingest limits

A value or a record was cut to a limit. See limits.

wt.fingerprint

browser error pipeline

The grouping fingerprint of an error; a client override is honored.

cloudtrail

aws.event_name, aws.outcome, aws.principal, aws.user_type, aws.error_message, cloud.account.id, cloud.region

gcp_audit

gcp.method_name, gcp.service_name, gcp.principal, gcp.outcome, cloud.account.id

azure_activity

azure.operation, azure.caller, azure.outcome, cloud.account.id

entra

entra.activity, entra.outcome, geo.country, geo.lat, geo.lon

okta

okta.event_type, okta.outcome

google_workspace

gws.event_name

onepassword

op.action, op.outcome

cloudflare

cf.action, cf.event

github

github.action, github.actor, github.org, github.oauth_application

kubernetes

k8s.audit.verb, k8s.audit.resource, k8s.audit.subresource, k8s.user.name, k8s.namespace.name

falco, tetragon, wazuh, generic

security.rule, security.severity, security.entity, plus container.id and k8s.* where the sensor knows them