Event table columns¶
An event table is a special kind of database table with a predefined set of columns. The table’s structure is designed to support the data model for OpenTelemetry, a framework for handling telemetry data.
For more information about working with event tables, see Working with event tables.
Event table columns¶
Event tables have the following columns:
Column |
Data Type |
Description |
---|---|---|
TIMESTAMP_NTZ |
The UTC timestamp when an event was created. For events representing a span of time, this is the end of the time span. |
|
TIMESTAMP_NTZ |
For events representing a span of time, such as trace events, the start of the time span as a UTC timestamp. |
|
TIMESTAMP_NTZ |
A UTC time used for logs. Currently the same value as for TIMESTAMP. |
|
OBJECT |
Tracing context for all signal types. Contains string values |
|
OBJECT |
Reserved for future use. |
|
OBJECT |
Attributes that identify the source of an event such as database, schema, user, warehouse, etc. |
|
OBJECT |
Scopes for events. For example, class names for logs. |
|
OBJECT |
Reserved for future use. |
|
STRING |
The event type. One of the following:
|
|
OBJECT |
Fixed values for each record type, as described in RECORD column. |
|
OBJECT |
Variable attributes for each record type, as described in RECORD_ATTRIBUTES column. |
|
VARIANT |
Primary event value. |
|
ARRAY |
Reserved for future use. |
Data captured by event type¶
Data for logs¶
Attribute |
Description |
---|---|
Currently the same value as for TIMESTAMP. |
|
The severity level recorded by the log event. |
|
The location in code from which the log event was emitted. The values vary by language, but can include the code file path, function name, line number, and so on. |
|
The event type: |
|
Attributes that identify the source of the event, such as database, schema, user, warehouse, and so on. |
|
Scope within which the event occurred, such as the name of the class where the log event was created. |
|
The timestamp when the event was created. |
|
The log message. |
Data for metrics¶
Note
Metrics data collection is a preview feature available to all accounts.
Attribute |
Description |
---|---|
For a metric event, an object that includes the metric’s name and unit. |
|
The event type: |
|
Attributes that identify the source of the event, such as database, schema, user, or warehouse. |
|
When the RECORD column |
|
The timestamp when the event was created. |
|
The numeric value of the metric. |
Data for trace events¶
Attribute |
Description |
---|---|
For a span, an object that includes the span’s name and kind; for a span event, the object includes the span’s name. |
|
Attribute data associated with a span or span event. |
|
The event type: |
|
Attributes that identify the source of the event, such as database, schema, user, warehouse, and so on. |
|
For a span, the time when the span began. Not used for a span event. |
|
The timestamp when the event was created. |
|
Identifers |
EXEMPLARS column¶
Reserved for future use.
OBSERVED_TIMESTAMP column¶
A log’s UTC timestamp. Not used for trace events.
RECORD column¶
Provides core information about the event, include the log level for a log event, or the name for trace event (span or span event record).
Attributes, if any, for the record are recorded in the RECORD_ATTRIBUTES column.
Values contained by this column will vary depending on the value of the RECORD_TYPE column
(LOG
, SPAN
or SPAN_EVENT
), as described in the following sections.
For LOG
RECORD_TYPE¶
When the RECORD_TYPE column value is LOG
, the RECORD column value contains the severity of the log message. The column value may
contain the following keys:
Key |
Type |
Description |
---|---|---|
|
STRING |
The text for the log severity. One of the following:
When the log entry is for an unhandled exception, this value
is the highest-severity error level for the current language runtime. For example, for code written in Python, the value is |
Example¶
{
"severity_text": "INFO"
}
For METRIC
RECORD_TYPE¶
Note
Metrics data collection is a preview feature available to all accounts.
Metrics are CPU and memory data generated by Snowflake. You can use this data to analyze resource consumption.
The execution handler language and its environment significantly affect the meaning of the metrics data. See Emitting metrics data from handler code for more information.
Key |
Type |
Description |
---|---|---|
|
string |
The name of the metric recorded by the row. One of the following:
For more information, see Emitting metrics data from handler code. |
|
string |
The units of the metric; for example, |
|
string |
The OpenTelemetry Metric Point type of the metric data; for example, |
|
string |
The data type of the value in the VALUE column; for example, |
Example¶
{
"metric": {
"name": "process.memory.usage",
"unit": "bytes"
},
"metric_type": "sum",
"value_type": "INT"
}
For SPAN
RECORD_TYPE¶
Spans represent individual executions of functions and procedures. For stored procedures there will be a single span. For user-defined functions there may be multiple spans for a single function call, depending on how Snowflake decides to schedule execution.
All spans for a given query have the same value for the trace_id
key of the TRACE
column.
The duration of a span is the difference between the values in the start_timestamp
and timestamp
columns, indicating the
time of the beginning and end of the span execution, respectively.
The ID of the span and the query trace are represented in the value in the TRACE column.
Snowflake will create one span for each execution with the keys shown below:
Key |
Type |
Description |
---|---|---|
|
int |
The number of attributes ignored after the recorded maximum has been reached. |
|
string |
When the executable’s handler is written in Python, this identifies the handler for the function or procedure that emitted the data. This varies by executable type, as follows:
When the executable’s handler is written in a language other than Python, this is a fixed value such as |
|
string |
Fixed value |
|
Hex string |
Identifies the span of the procedure or UDF from which the current trace passed. When this value is present, it means that the
current procedure or UDF call was made by another procedure in a call chain relationship. That “parent” procedure’s
|
|
string |
Optional. When present, specifies the maximum amount of memory, in bytes, used during this span’s execution. |
|
string |
|
In the case of user-defined functions, Snowflake may add attributes for spans to indicate the number of rows processed and emitted by the function.
For SPAN_EVENT
RECORD_TYPE¶
Span events are event records attached to a particular span execution, described above. You can create events to fit the needs of your application. The number of span events is limited to 128.
The value of the TRACE column will identify the span in which the event was created.
Span events have a single key, name
, and can have arbitrary attributes added in the RECORD_ATTRIBUTES column.
Key |
Type |
Description |
---|---|---|
|
string |
The name of the span event. |
RECORD_ATTRIBUTES column¶
Describes the event with metadata set by Snowflake or by code. The value will vary depending on the type of record the row contains, as described in the following sections.
For LOG
RECORD_TYPE¶
The location in code from which the log event was emitted, including the code file path, function name, line number, and so on.
In addition to the attributes listed below, you can add your own attributes to include in the RECORD_ATTRIBUTES value.
Attribute |
Type |
Description |
---|---|---|
|
int |
The file containing code that generated the message. |
|
string |
The name of the function that generated the message. |
|
int |
The line number in code that generated the message. |
|
int |
The namespace of code that generated the messages. |
|
string |
The error message from an unhandled exception. |
|
string |
The name of the class for an unhandled exception. |
|
string |
An unhandled exception’s stack trace formatted by a language runtime. |
|
boolean |
|
|
int |
The thread on which the log event was created. |
|
string |
The thread on which the log event was created. |
Example¶
In the following example, all attributes have been added by Snowflake except employee.id
, which was added by a custom attribute.
{
"code.filepath": "main.scala",
"code.function": "$anonfun$new$10",
"code.lineno": 149,
"code.namespace": "main.main$",
"thread.id": 1,
"thread.name": "main"
"employee.id": "52307953446424"
}
For SPAN
RECORD_TYPE¶
Attributes, if any, assigned to the span when it is recorded. Attribute names and values are set by code or by Snowflake.
The following table lists attributes that might be set by Snowflake.
Attribute |
Type |
Description |
---|---|---|
|
int |
The number of input rows processed by the span of the function. |
|
int |
The number of output rows successfully processed by the span of the function. |
Example¶
Code in the following example includes attributes set by Snowflake.
{
"snow.input.rows": 12
"snow.output.rows": 12
}
Example¶
Code in the following example includes attributes set by handler code.
{
"MyFunctionVersion": "1.1.0"
}
For SPAN_EVENT
RECORD_TYPE¶
Attributes, if any, assigned to the span event when it is recorded. Attribute names and values may be set by Snowflake or by user code.
Example¶
Code in the following example includes attributes set by handler code.
{
"mykey1": "value1",
"mykey2": "value2"
}
RECORD_TYPE column¶
Specifies the kind of record described by the event table row. This column’s value identifies which of the three types of records for which then event table may contain data.
The RECORD column contains this record’s data. The RECORD_ATTRIBUTES column contains this record’s metadata, if any.
The following table lists possible values for this column.
Column Value |
Description |
---|---|
|
The row represents a log entry generated by handler code. |
|
The row represents a span. For a stored procedure there will be a single span. For a user-defined function, which may be parallelized, there will be a span for each thread on which the function executes. The number of threads will vary depending on multiple factors, including the size of the Snowflake warehouse in which the function executes. A span may contain multiple span events. For more information, see Span data recorded. |
|
The row represents a span event. The may be multiple span event records attached to a particular span. Your handler code may create events to fit your needs. The number of span events is limited to 128. |
|
The row represents an observation of a metric. Multiple observations of multiple metrics can be associated with a particular span. |
RESOURCE column¶
Reserved for future use.
RESOURCE_ATTRIBUTES column¶
Describes the source of an event in terms of Snowflake objects.
Attributes making up this column’s value are set by Snowflake and cannot be changed.
Resource attributes for event source¶
Attribute Name |
Attribute Type |
Description |
Example |
---|---|---|---|
|
int |
The internal/system-generated identifier of the database containing the executable. |
|
|
string |
The name of the database containing the executable. |
|
|
int |
The internal/system-generated identifier of the executable (procedure, function, SnowService, etc.) generating the event. |
|
|
string |
The name of the executable generating the event. For example, this might be the name of the procedure, function, or Streamlit app. |
|
|
string |
The executable language’s runtime version. This will be a value specific to the language, as described below:
|
|
|
string |
One of the following:
|
|
|
int |
The internal/system-generated identifier of the role with OWNERSHIP privilege for the executable. |
|
|
string |
The name of the role with OWNERSHIP privilege for the executable. |
|
|
int |
The internal/system-generated identifier of the schema containing the executable. |
|
|
string |
The name of the schema containing the executable. |
|
|
string |
The language of the resource/SDK. Snowflake uses java, scala, python, javascript and sql. |
|
Resource attributes for execution environment¶
Attribute |
Type |
Description |
Examples |
---|---|---|---|
|
string |
For a function or procedure, the name of the user executing the function or procedure. For a Streamlit app, the name of the user who was viewing the app for a given event. |
|
|
string |
The ID of the query. |
|
|
string |
The Snowflake release running when event was generated |
|
|
int |
The ID of the session running the executable. |
|
|
int |
The internal/system-generated identifier of the primary role in the session. |
|
|
string |
The name of the primary role in the session. |
|
|
int |
The internal/system-generated identifier of the user running the query. |
|
|
int |
The internal/system-generated identifier of the warehouse running the query generating the event. |
|
|
string |
The name of the warehouse running the query generating the event. |
|
Resource attributes for apps¶
Attribute |
Type |
Description |
Examples |
---|---|---|---|
|
string |
For a Snowflake Native App, the name of the consumer’s account. |
|
|
string |
For a Snowflake Native App, the name of the consumer’s organization. |
|
|
string |
For a Snowflake Native App, the internal/system-generated identifier of the app. |
|
|
string |
For a Snowflake Native App, the name of the app. |
|
|
string |
For a Snowflake Native App, the name of the application package. |
|
|
string |
For a Snowflake Native App, the internal/system-generated identifier of the listing. |
|
|
string |
For a Snowflake Native App, the name of the listing. |
|
Resource attributes for Snowflake version¶
Attribute |
Type |
Description |
Examples |
---|---|---|---|
|
string |
The version of the executable, where relevant. The combination of |
|
|
string |
The patch level of the executable running. |
|
|
string |
The version of the executable running. |
|
Example¶
{
"db.user": "MYUSERNAME",
"snow.database.id": 13,
"snow.database.name": "MY_DB",
"snow.executable.id": 197,
"snow.executable.name": "FUNCTION_NAME(I NUMBER):ARG_NAME(38,0)",
"snow.executable.type": "FUNCTION",
"snow.owner.id": 2,
"snow.owner.name": "MY_ROLE",
"snow.query.id": "01ab0f07-0000-15c8-0000-0129000592c2",
"snow.schema.id": 16,
"snow.schema.name": "PUBLIC",
"snow.session.id": 1275605667850,
"snow.session.role.primary.id": 2,
"snow.session.role.primary.name": "MY_ROLE",
"snow.user.id": 25,
"snow.warehouse.id": 5,
"snow.warehouse.name": "MYWH",
"telemetry.sdk.language": "python"
}
SCOPE column¶
For log events, the namespace of the code that emitted the event, such as the name of the class creating a log entry. This is not used for trace events.
The following table lists attributes that may be included in this column.
Scope value¶
Attribute |
Type |
Description |
Examples |
---|---|---|---|
|
String |
Namespace of code emitting the event. |
|
Example¶
{
"name": "com.sample.MyClass"
}
SCOPE_ATTRIBUTES column¶
Reserved for future use.
START_TIMESTAMP column¶
The time a span started as a UTC timestamp.
RECORD_TYPE Column Value |
START_TIMESTAMP Value Description |
---|---|
|
Not used. |
|
The time the span started. |
|
Not used. |
|
When the RECORD column |
Metrics data collection is a preview feature available to all accounts.
TIMESTAMP column¶
The time an event was emitted. The value’s meaning will vary depending on the type of record the row represents, as listed in the following table:
RECORD_TYPE Column Value |
TIMESTAMP Value Description |
---|---|
|
The wall-clock time that the event was emitted. |
|
The time at which execution concluded. |
|
The wall-clock time that the event was emitted. |
TRACE column¶
Unique identifiers representing execution for functions and procedures.
RECORD_TYPE Column Value |
TRACE Value Description |
---|---|
|
Not used. |
|
|
|
|
Trace value¶
The following table lists attributes that may be included in this column.
Attribute |
Type |
Description |
Examples |
---|---|---|---|
|
Hex string |
A unique identifier to the threading model. Procedures, which are single-threaded, will have a single When the current span is from a procedure that called another procedure or UDF in the trace, this |
|
|
Hex string |
A unique identifier for calls made from a query. When a stored procedure is not being called in a chain of calls, each call has
its own When a procedure is called by another procedure or UDF in a call chain, it has the same This value is unique for each query and will be the same for all spans within a query. You can use it for grouping events within a single query execution. |
|
Example¶
Code in the following example shows the attributes that would be present for a span or span event.
{
"span_id": "b4c28078330873a2",
"trace_id": "6992e9febf0b97f45b34a62e54936adb"
}
VALUE column¶
For log events, this is usually the log message. When the event logged is for an unhandled exception, the value in this column will be simply
exception
.For metrics, this is the numeric value of the metric. [3]
Note that the VALUE column’s type is VARIANT (not STRING) so that it can have non-string values for some languages, such as JavaScript.
Metrics data collection is a preview feature available to all accounts.