Common event contract
Fields these queries need
- timestamp_utc, received_at, event_id, event_name, and schema_version
- source, environment, producer_version, and required business fields
- ingestion_status, validation_error, and duplicate outcome
Definitions before SQL
Decisions the query cannot make for you
- 1Define expected event volume and freshness separately for each source.
- 2Choose stable event identifiers before attempting deduplication.
- 3Measure field completeness only where the field is truly required.
Recommended sequence
Find the change, then investigate its cause
Analysis patterns
Use the result to choose your next action
Monitor the telemetry itself
Check event freshness, missing fields, duplicates, and schema versions alongside the product metrics that use those events.
Separate event time from receipt time
Compare when work happened with when it arrived to expose delayed clients, backfills, and blocked ingestion.
Segment by producer
Group regressions by source, environment, schema version, or release to find which deployment changed and who should investigate.
Complete recipes
Copy the query, then validate the assumptions
Count sensor deliveries and measurements separately
Run SQL on six fictional sensor deliveries. A network retry adds rows without adding measurements, changing a row-weighted average.
Did the sensor measure six times, or did the network deliver four measurements six times?
See SQL and resultMeasure event ingestion freshness
Find event sources that stopped delivering data or are arriving substantially later than they occurred.
Which production event sources are stale or delayed right now?
See SQL and resultFind duplicate event ids
Identify event identifiers delivered more than once and measure whether duplicate handling is working.
Which event IDs were received more than once?
See SQL and resultMeasure required-field null rate
Find event contracts where a required account, status, or correlation field is disappearing.
Which event names have an unacceptable missing account identifier rate?
See SQL and resultMeasure late-arriving events
Measure event delivery delay by source and identify producers that send stale or out-of-order data.
Which event producers deliver data late enough to distort analysis?
See SQL and resultTrack event schema-version adoption
Measure schema-version rollout by producer and find old event contracts that remain active after a deployment.
Which producers still emit old versions of a critical event?
See SQL and resultMeasure Telemetry volume by event name
Rank event types by payload bytes, average event size, and rejection rate before changing retention or collection policy.
Which event contracts create the most ingestion volume?
See SQL and resultCheck event fields before setting thresholds
Keep the analysis pattern, but validate table names, field types, business definitions, time windows, and minimum-volume rules against your own events. Every published query is also planned and executed against an empty typed table with the pinned engine.