Common event contract
Fields that keep these queries reusable
- timestamp_utc, event_name, source, environment, and schema_version
- correlation_id, request_id, user_id, team_id, and release
- Typed status, duration, amount, count, and categorized error fields
Definitions before SQL
Decisions the query cannot make for you
- 1Use one event for a completed unit of work instead of many partial messages.
- 2Preserve typed fields and explicit units so SQL remains portable.
- 3Keep secrets and raw private content outside the event contract.
Recommended sequence
Build detection first, then diagnosis
Analysis patterns
Make the result explain a decision
Emit one canonical completion event
Record the inputs, outcome, duration, stable identifiers, and categorized failure context for a completed unit of work.
Use typed, bounded dimensions
Prefer explicit numbers, booleans, units, and named categories over values that require parsing or create unbounded groups.
Keep correlation deliberate
Use request, run, delivery, account, or job identifiers only where they connect events needed for a defined question.
Complete recipes
Copy the query, then validate the assumptions
Detect Missing Service Heartbeats
Find services, workers, or scheduled tasks that stopped reporting before a failure event appeared.
Which expected telemetry sources have stopped sending heartbeats?
See SQL and resultQuery Nested AI Tool-Call Events
Filter dotted nested fields and rank failing tools without flattening the original event payload.
Which AI tools and arguments are associated with the most failed calls?
See SQL and resultDetect Error-Rate Spikes With a Rolling Baseline
Compare each hourly API error rate with a rolling seven-bucket average instead of relying on one permanent threshold.
Which hourly error-rate buckets are far above their recent baseline?
See SQL and resultReconstruct a Correlated Workflow Timeline
Reconstruct ordered cross-service workflow steps and elapsed time from a shared workflow identifier.
What happened, in order, during the latest failed workflow?
See SQL and resultAdapt the event contract before the threshold
Keep the analysis pattern, but validate table names, field types, business definitions, time windows, and minimum-volume rules against your own events. Every published query is also planned and executed against an empty typed table with the pinned engine.