Event table columns¶

An event table is a special kind of database table with a predefined set of columns. The table’s structure is designed to support the data model for OpenTelemetry, a framework for handling telemetry data.

For more information about working with event tables, see Working with event tables.

Event table columns¶

Event tables have the following columns:

Data captured by event type¶

Data for logs¶

Data for metrics¶

Data for trace events¶

Data for Iceberg automated refresh events¶

Snowflake logs an event to your event table when it processes a snapshot for Iceberg automated refresh. The following table describes the columns for Iceberg automated refresh events:

EXEMPLARS column¶

Reserved for future use.

OBSERVED_TIMESTAMP column¶

A log’s UTC timestamp. Not used for trace events.

RECORD column¶

Provides core information about the event, include the log level for a log event, or the name for trace event (span or span event record).

Attributes, if any, for the record are recorded in the RECORD_ATTRIBUTES column.

Values contained by this column will vary depending on the value of the RECORD_TYPE column (LOG, SPAN or SPAN_EVENT), as described in the following sections.

For LOG RECORD_TYPE¶

When the RECORD_TYPE column value is LOG, the RECORD column value contains the severity of the log message. The column value may contain the following keys:

Example¶

{
  "severity_text": "INFO"
}

For METRIC RECORD_TYPE¶

Metrics are CPU and memory data generated by Snowflake. You can use this data to analyze resource consumption.

The execution handler language and its environment significantly affect the meaning of the metrics data. See Emitting metrics data from handler code for more information.

Example¶

{
  "metric": {
    "name": "process.memory.usage",
    "unit": "bytes"
  },
  "metric_type": "sum",
  "value_type": "INT"
}

For SPAN RECORD_TYPE¶

Spans represent individual executions of functions and procedures. For stored procedures there will be a single span. For user-defined functions there may be multiple spans for a single function call, depending on how Snowflake decides to schedule execution.

All spans for a given query have the same value for the trace_id key of the TRACE column.

The duration of a span is the difference between the values in the start_timestamp and timestamp columns, indicating the time of the beginning and end of the span execution, respectively.

The ID of the span and the query trace are represented in the value in the TRACE column.

Snowflake will create one span for each execution with the keys shown below:

In the case of user-defined functions, Snowflake may add attributes for spans to indicate the number of rows processed and emitted by the function.

For SPAN_EVENT RECORD_TYPE¶

Span events are event records attached to a particular span execution, described above. You can create events to fit the needs of your application. The number of span events is limited to 128.

The value of the TRACE column will identify the span in which the event was created.

Span events have a single key, name, and can have arbitrary attributes added in the RECORD_ATTRIBUTES column.

For EVENT RECORD_TYPE for Iceberg automated refresh events¶

For EVENT RECORD_TYPE for Snowflake Native Apps lifecycle events¶

RECORD_ATTRIBUTES column¶

Describes the event with metadata set by Snowflake or by code. The value will vary depending on the type of record the row contains, as described in the following sections.

For LOG RECORD_TYPE¶

The location in code from which the log event was emitted, including the code file path, function name, line number, and so on.

In addition to the attributes listed below, you can add your own attributes to include in the RECORD_ATTRIBUTES value.

Example¶

In the following example, all attributes have been added by Snowflake except employee.id, which was added by a custom attribute.

{
  "code.filepath": "main.scala",
  "code.function": "$anonfun$new$10",
  "code.lineno": 149,
  "code.namespace": "main.main$",
  "thread.id": 1,
  "thread.name": "main"
  "employee.id": "52307953446424"
}

For SPAN RECORD_TYPE¶

Attributes, if any, assigned to the span when it is recorded. Attribute names and values are set by code or by Snowflake.

The following table lists attributes that might be set by Snowflake.

Example¶

Code in the following example includes attributes set by Snowflake.

{
  "snow.input.rows": 12
  "snow.output.rows": 12
}

Example¶

Code in the following example includes attributes set by handler code.

{
  "MyFunctionVersion": "1.1.0"
}

For SPAN_EVENT RECORD_TYPE¶

Attributes, if any, assigned to the span event when it is recorded. Attribute names and values may be set by Snowflake or by user code.

Example¶

Code in the following example includes attributes set by handler code.

{
  "mykey1": "value1",
  "mykey2": "value2"
}

For EVENT RECORD_TYPE for Iceberg automated refresh events¶

Attributes assigned to the EVENT event when it is recorded for Iceberg automated refresh. Attribute names and values are set by Snowflake.

RECORD_TYPE column¶

Specifies the kind of record described by the event table row. This column’s value identifies which of the various types of records for which the event table may contain data.

The RECORD column contains this record’s data. The RECORD_ATTRIBUTES column contains this record’s metadata, if any.

The following table lists possible values for this column.

RESOURCE column¶

Reserved for future use.

RESOURCE_ATTRIBUTES column¶

Describes the source of an event in terms of Snowflake objects.

Attributes making up this column’s value are set by Snowflake and cannot be changed.

Resource attributes for event source¶

Resource attributes for execution environment¶

Resource attributes for apps¶

Resource attributes for Snowflake version¶

Example¶

{
  "db.user": "MYUSERNAME",
  "snow.database.id": 13,
  "snow.database.name": "MY_DB",
  "snow.executable.id": 197,
  "snow.executable.name": "FUNCTION_NAME(I NUMBER):ARG_NAME(38,0)",
  "snow.executable.type": "FUNCTION",
  "snow.owner.id": 2,
  "snow.owner.name": "MY_ROLE",
  "snow.query.id": "01ab0f07-0000-15c8-0000-0129000592c2",
  "snow.schema.id": 16,
  "snow.schema.name": "PUBLIC",
  "snow.session.id": 1275605667850,
  "snow.session.role.primary.id": 2,
  "snow.session.role.primary.name": "MY_ROLE",
  "snow.user.id": 25,
  "snow.warehouse.id": 5,
  "snow.warehouse.name": "MYWH",
  "telemetry.sdk.language": "python"
}

SCOPE column¶

For log events, the namespace of the code that emitted the event, such as the name of the class creating a log entry. This is not used for trace events.

The following table lists attributes that may be included in this column.

Scope value¶

Example¶

{
  "name": "com.sample.MyClass"
}

SCOPE_ATTRIBUTES column¶

Reserved for future use.

START_TIMESTAMP column¶

The time a span started as a UTC timestamp.

TIMESTAMP column¶

The time an event was emitted. The value’s meaning will vary depending on the type of record the row represents, as listed in the following table:

TRACE column¶

Unique identifiers representing execution for functions and procedures.

Trace value¶

The following table lists attributes that may be included in this column.

Example¶

Code in the following example shows the attributes that would be present for a span or span event.

{
  "span_id": "b4c28078330873a2",
  "trace_id": "6992e9febf0b97f45b34a62e54936adb"
}

VALUE column¶

• For log events, this is usually the log message. When the event logged is for an unhandled exception, the value in this column will be simply exception.
• For metrics, this is the numeric value of the metric.

Note that the VALUE column’s type is VARIANT (not STRING) so that it can have non-string values for some languages, such as JavaScript.

For EVENT VALUE for Iceberg automated refresh events¶

For EVENT VALUE for Snowflake Native Apps application lifecycle events¶

Example¶

{
  "metadata_file_location": "<path>",
  "snapshot_state": "errored",
  "error_message": "<error_message>"
}