Common event contract
Fields these queries need
- timestamp_utc, event_name, source, environment, and schema_version
- correlation_id, request_id, user_id, team_id, and release
- Typed status, duration, amount, count, and categorized error fields
Definitions before SQL
Decisions the query cannot make for you
- 1Use one event for a completed unit of work instead of many partial messages.
- 2Preserve typed fields and explicit units so SQL remains portable.
- 3Keep secrets and raw private content outside the event contract.
Recommended sequence
Find the change, then investigate its cause
Analysis patterns
Use the result to choose your next action
Send one completion event
Record the inputs, outcome, duration, stable identifiers, and categorized failure context for a completed unit of work.
Specify field types and allowed values
Prefer explicit numbers, booleans, units, and named categories over values that require parsing or create unbounded groups.
Keep correlation deliberate
Use request, run, delivery, account, or job identifiers only where they connect events needed for a defined question.
Complete recipes
Copy the query, then validate the assumptions
Detect missing service heartbeats
Find services, workers, or scheduled tasks that stopped reporting before a failure event appeared.
Which expected telemetry sources have stopped sending heartbeats?
See SQL and resultQuery nested AI tool-call events
Filter dotted nested fields and rank failing tools without flattening the original event payload.
Which AI tools and arguments are associated with the most failed calls?
See SQL and resultDetect error-rate spikes with a rolling baseline
Compare each hourly API error rate with a rolling seven-bucket average instead of relying on one permanent threshold.
Which hourly error-rate buckets are far above their recent baseline?
See SQL and resultReconstruct a correlated workflow timeline
Reconstruct ordered cross-service workflow steps and elapsed time from a shared workflow identifier.
What happened, in order, during the latest failed workflow?
See SQL and resultCheck event fields before setting thresholds
Keep the analysis pattern, but validate table names, field types, business definitions, time windows, and minimum-volume rules against your own events. Every published query is also planned and executed against an empty typed table with the pinned engine.