Event table columnsΒΆ
An event table has a predefined set of columns. This topic describes the columns.
For more information about working with event tables, refer to Working with Event Tables.
Event table columnsΒΆ
Event tables have the following columns:
Column |
Data Type |
Description |
---|---|---|
TIMESTAMP_NTZ |
The UTC timestamp when an event was created. For events representing a span of time, this is the end of the time span. |
|
TIMESTAMP_NTZ |
For events representing a span of time, such as trace events, the start of the time span as a UTC timestamp. |
|
TIMESTAMP_NTZ |
A UTC time used for logs. Currently the same value as for TIMESTAMP. |
|
OBJECT |
Tracing context for all signal types. Contains string values |
|
OBJECT |
Reserved for future use. |
|
OBJECT |
Attributes that identify the source of an event such as database, schema, user, warehouse, etc. |
|
OBJECT |
Scopes for events. For example, class names for logs. |
|
OBJECT |
Reserved for future use. |
|
STRING |
The event type. One of the following:
|
|
OBJECT |
Fixed values for each record type, as described in RECORD column. |
|
OBJECT |
Variable attributes for each record type, as described in RECORD_ATTRIBUTES column. |
|
VARIANT |
Primary event value. |
|
ARRAY |
Reserved for future use. |
Data captured by event typeΒΆ
Data for logsΒΆ
Attribute |
Description |
---|---|
Currently the same value as for TIMESTAMP. |
|
The severity level recorded by the log event. |
|
The location in code from which the log event was emitted. The values vary by language, but can include the code file path, function name, line number, and so on. |
|
The event type: |
|
Attributes that identify the source of the event, such as database, schema, user, warehouse, and so on. |
|
Scope within which the event occurred, such as the name of the class where the log event was created. |
|
The timestamp when the event was created. |
|
The log message. |
Data for trace eventsΒΆ
Attribute |
Description |
---|---|
For a span, an object that includes the spanβs name and kind; for a span event, the object includes the spanβs name. |
|
Attribute data associated with a span or span event. |
|
The event type: |
|
Attributes that identify the source of the event, such as database, schema, user, warehouse, and so on. |
|
For a span, the time when the span began. Not used for a span event. |
|
The timestamp when the event was created. |
|
Identifers |
EXEMPLARS columnΒΆ
Reserved for future use.
OBSERVED_TIMESTAMP columnΒΆ
A logβs UTC timestamp. Not used for trace events.
RECORD columnΒΆ
Provides core information about the event, include the log level for a log event, or the name for trace event (span or span event record).
Attributes, if any, for the record are recorded in the RECORD_ATTRIBUTES column.
Values contained by this column will vary depending on the value of the RECORD_TYPE column
(LOG
, SPAN
or SPAN_EVENT
), as described in the following sections.
For LOG
RECORD_TYPEΒΆ
When the RECORD_TYPE column value is LOG
, the RECORD column value contains the severity of the log message. The column value may
contain the following keys:
Key |
Type |
Description |
---|---|---|
|
STRING |
The text for the log severity. One of the following:
When the log entry is for an unhandled exception, this value
is the highest-severity error level for the current language runtime. For example, for code written in Python, the value is |
ExampleΒΆ
{
"severity_text": "INFO"
}
For SPAN
RECORD_TYPEΒΆ
Spans represent individual executions of functions and procedures. For stored procedures there will be a single span. For user-defined functions there may be multiple spans for a single function call, depending on how Snowflake decides to schedule execution.
All spans for a given query have the same value for the trace_id
key of the TRACE
column.
The duration of a span is the difference between the values in the start_timestamp
and timestamp
columns, indicating the
time of the beginning and end of the span execution, respectively.
The ID of the span and the query trace are represented in the value in the TRACE column.
Snowflake will create one span for each execution with the keys shown below:
Key |
Type |
Description |
---|---|---|
|
int |
The number of attributes ignored after the recorded maximum has been reached. |
|
string |
Fixed value. |
|
string |
Fixed value |
|
Hex string |
Identifies the span of the procedure or UDF from which the current trace passed. When this value is present, it means that the
current procedure or UDF call was made by another Java or Scala procedure in a call chain relationship. That βparentβ procedureβs
|
|
string |
|
In the case of user-defined functions, Snowflake may add attributes for spans to indicate the number of rows processed and emitted by the function.
For SPAN_EVENT
RECORD_TYPEΒΆ
Span events are event records attached to a particular span execution, described above. You can create events to fit the needs of your application. The number of span events is limited to 128.
The value of the TRACE column will identify the span in which the event was created.
Span events have a single key, name
, and can have arbitrary attributes added in the RECORD_ATTRIBUTES column.
Key |
Type |
Description |
---|---|---|
|
string |
The name of the span event. |
RECORD_ATTRIBUTES columnΒΆ
Describes the event with metadata set by Snowflake or by code. The value will vary depending on the type of record the row contains, as described in the following sections.
For LOG
RECORD_TYPEΒΆ
The location in code from which the log event was emitted, including the code file path, function name, line number, and so on.
In addition to the attributes listed below, you can add your own attributes to include in the RECORD_ATTRIBUTES value.
Attribute |
Type |
Description |
---|---|---|
|
int |
The file containing code that generated the message. |
|
string |
The name of the function that generated the message. |
|
int |
The line number in code that generated the message. |
|
int |
The namespace of code that generated the messages. |
|
string |
The error message from an unhandled exception. |
|
string |
The name of the class for an unhandled exception. |
|
string |
An unhandled exceptionβs stack trace formatted by a language runtime. |
|
boolean |
|
|
int |
The thread on which the log event was created. |
|
string |
The thread on which the log event was created. |
ExampleΒΆ
In the following example, all attributes have been added by Snowflake except employee.id
, which was added by a custom attribute.
{
"code.filepath": "main.scala",
"code.function": "$anonfun$new$10",
"code.lineno": 149,
"code.namespace": "main.main$",
"thread.id": 1,
"thread.name": "main"
"employee.id": "52307953446424"
}
For SPAN
RECORD_TYPEΒΆ
Attributes, if any, assigned to the span when it is recorded. Attribute names and values are set by code or by Snowflake.
The following table lists attributes that might be set by Snowflake.
Attribute |
Type |
Description |
---|---|---|
|
int |
The number of rows processed by the span of the function. |
ExampleΒΆ
Code in the following example includes attributes set by Snowflake.
{
"snow.rows.processed": 12
}
ExampleΒΆ
Code in the following example includes attributes set by handler code.
{
"MyFunctionVersion": "1.1.0"
}
For SPAN_EVENT
RECORD_TYPEΒΆ
Attributes, if any, assigned to the span event when it is recorded. Attribute names and values may be set by Snowflake or by user code.
ExampleΒΆ
Code in the following example includes attributes set by handler code.
{
"mykey1": "value1",
"mykey2": "value2"
}
RECORD_TYPE columnΒΆ
Specifies the kind of record described by the event table row. This columnβs value identifies which of the three types of records for which then event table may contain data.
The RECORD column contains this recordβs data. The RECORD_ATTRIBUTES column contains this recordβs metadata, if any.
The following table lists possible values for this column.
Column Value |
Description |
---|---|
|
The row represents a log entry generated by handler code. |
|
The row represents a span. For a stored procedure there will be a single span. For a user-defined function, which may be parallelized, there will be a span for each thread on which the function executes. The number of threads will vary depending on multiple factors, including the size of the Snowflake warehouse in which the function executes. A span may contain multiple span events. For more information, refer to Span data recorded. |
|
The row represents a span event. The may be multiple span event records attached to a particular span. Your handler code may create events to fit your needs. The number of span events is limited to 128. |
RESOURCE columnΒΆ
Reserved for future use.
RESOURCE_ATTRIBUTES columnΒΆ
Describes the source of an event in terms of Snowflake objects.
Attributes making up this columnβs value are set by Snowflake and cannot be changed.
Resource Attributes for event sourceΒΆ
Attribute Name |
Attribute Type |
Description |
Example |
---|---|---|---|
|
int |
The internal/system-generated identifier of the database containing the executable. |
|
|
string |
The name of the database containing the executable. |
|
|
int |
The internal/system-generated identifier of the executable (procedure, function, SnowService, etc.) generating the event. |
|
|
string |
The name of the executable generating the event. For example, this might be the name of the procedure, function, or Streamlit app. |
|
|
string |
One of the following:
|
|
|
int |
The internal/system-generated identifier of the role with OWNERSHIP privilege for the executable. |
|
|
string |
The name of the role with OWNERSHIP privilege for the executable. |
|
|
int |
The internal/system-generated identifier of the schema containing the executable. |
|
|
string |
The name of the schema containing the executable. |
|
|
string |
The language of the resource/SDK. Snowflake uses java, scala, python, javascript and sql. |
|
Resource attributes for execution environmentΒΆ
Attribute |
Type |
Description |
Examples |
---|---|---|---|
|
string |
For a function or procedure, the name of the user executing the function or procedure. For a Streamlit app, the name of the user who was viewing the app for a given event. |
|
|
string |
The ID of the query. |
|
|
string |
The Snowflake release running when event was generated |
|
|
int |
The ID of the session running the executable. |
|
|
int |
The internal/system-generated identifier of the primary role in the session. |
|
|
string |
The name of the primary role in the session. |
|
|
int |
The internal/system-generated identifier of the user running the query. |
|
|
int |
The internal/system-generated identifier of the warehouse running the query generating the event. |
|
|
string |
The name of the warehouse running the query generating the event. |
|
Resource attributes for appsΒΆ
Attribute |
Type |
Description |
Examples |
---|---|---|---|
|
string |
For a Snowflake Native App, the name of the consumerβs account. |
|
|
string |
For a Snowflake Native App, the name of the consumerβs organization. |
|
|
string |
For a Snowflake Native App, the internal/system-generated identifier of the app. |
|
|
string |
For a Snowflake Native App, the name of the app. |
|
|
string |
For a Snowflake Native App, the name of the application package. |
|
|
string |
For a Snowflake Native App, the internal/system-generated identifier of the listing. |
|
|
string |
For a Snowflake Native App, the name of the listing. |
|
Resource attributes for snowflake versionΒΆ
Attribute |
Type |
Description |
Examples |
---|---|---|---|
|
string |
The version of the executable, where relevant. The combination of |
|
|
string |
The patch level of the executable running. |
|
|
string |
The version of the executable running. |
|
ExampleΒΆ
{
"db.user": "MYUSERNAME",
"snow.database.id": 13,
"snow.database.name": "MY_DB",
"snow.executable.id": 197,
"snow.executable.name": "FUNCTION_NAME(I NUMBER):ARG_NAME(38,0)",
"snow.executable.type": "FUNCTION",
"snow.owner.id": 2,
"snow.owner.name": "MY_ROLE",
"snow.query.id": "01ab0f07-0000-15c8-0000-0129000592c2",
"snow.schema.id": 16,
"snow.schema.name": "PUBLIC",
"snow.session.id": 1275605667850,
"snow.session.role.primary.id": 2,
"snow.session.role.primary.name": "MY_ROLE",
"snow.user.id": 25,
"snow.warehouse.id": 5,
"snow.warehouse.name": "MYWH",
"telemetry.sdk.language": "python"
}
SCOPE columnΒΆ
For log events, the namespace of the code that emitted the event, such as the name of the class creating a log entry. This is not used for trace events.
The following table lists attributes that may be included in this column.
Scope valueΒΆ
Attribute |
Type |
Description |
Examples |
---|---|---|---|
|
String |
Namespace of code emitting the event. |
|
ExampleΒΆ
{
"name": "com.sample.MyClass"
}
SCOPE_ATTRIBUTES columnΒΆ
Reserved for future use.
START_TIMESTAMP columnΒΆ
The time a span started as a UTC timestamp.
RECORD_TYPE Column Value |
START_TIMESTAMP Value Description |
---|---|
|
Not used. |
|
The time the span started. |
|
Not used. |
TIMESTAMP columnΒΆ
The time an event was emitted. The valueβs meaning will vary depending on the type of record the row represents, as listed in the following table:
RECORD_TYPE Column Value |
TIMESTAMP Value Description |
---|---|
|
The wall-clock time that the event was emitted. |
|
The time at which execution concluded. |
|
The wall-clock time that the event was emitted. |
TRACE columnΒΆ
Unique identifiers representing execution for functions and procedures.
RECORD_TYPE Column Value |
TRACE Value Description |
---|---|
|
Not used. |
|
|
|
|
Trace valueΒΆ
The following table lists attributes that may be included in this column.
Attribute |
Type |
Description |
Examples |
---|---|---|---|
|
Hex string |
A unique identifier to the threading model. Procedures, which are single-threaded, will have a single When the current span is from a procedure that called another procedure or UDF in the trace, this |
|
|
Hex string |
A unique identifier for calls made from a query. When a stored procedure is not being called in a chain of calls, each call has
its own When a procedure is called by another procedure or UDF in a call chain, it has the same This value is unique for each query and will be the same for all spans within a query. You can use it for grouping events within a single query execution. |
|
ExampleΒΆ
Code in the following example shows the attributes that would be present for a span or span event.
{
"span_id": "b4c28078330873a2",
"trace_id": "6992e9febf0b97f45b34a62e54936adb"
}
VALUE columnΒΆ
For log events, this is usually the log message. When the event logged is for an
unhandled exception, the value in this column will be simply
exception
.
Note that the VALUE columnβs type is VARIANT (not STRING) so that it can have non-string values for some languages, such as JavaScript.