Event contract
Fields the query expects
| Field | Type | Why it exists |
|---|---|---|
| timestamp_utc | Timestamp | Ingestion attempt time in UTC. |
| event_name | Utf8 | Controlled event name. |
| source | Utf8 | Bounded producer or SDK source. |
| payload_bytes | Int64 | Serialized event size before transport compression. |
| accepted | Boolean | Whether ingestion accepted the event. |
| environment | Utf8 | Deployment environment. |
Copy the query
SELECT
event_name,
source,
COUNT(*) AS events,
SUM(payload_bytes) AS total_payload_bytes,
AVG(payload_bytes) AS avg_payload_bytes,
SUM(CASE WHEN accepted THEN 0 ELSE 1 END) AS rejected_events,
100.0 * SUM(CASE WHEN accepted THEN 0 ELSE 1 END)
/ NULLIF(COUNT(*), 0) AS rejection_rate_pct
FROM telemetry_ingestion_events
WHERE timestamp_utc >= now() - INTERVAL '24 hours'
AND environment = 'production'
GROUP BY event_name, source
ORDER BY total_payload_bytes DESC, event_name;This read-only query is planned and executed against an empty typed table with Apache DataFusion 45.2.0. The deterministic sample output is synthetic and reviewed separately; validate field types, thresholds, and business definitions against your own data. Read the testing methodology.
Query result
Payload volume by event contract
The synthetic debug trace has the largest byte volume despite having fewer events than page views.
| event_name | source | events | total_payload_bytes | avg_payload_bytes | rejected_events | rejection_rate_pct |
|---|---|---|---|---|---|---|
| debug_trace | worker | 4 | 16,000 | 4,000 | 1 | 25 |
| llm_request_completed | api | 3 | 6,000 | 2,000 | 0 | 0 |
| page_viewed | web | 6 | 3,000 | 500 | 1 | 16.67 |
Synthetic example output. Run the query against your own event schema and thresholds before using it for operational decisions.
Reproduce the example
Download the public fixture
The JSON bundle includes the typed event contract, reproducible input rows, exact SQL, expected output, review notes, and engine version. The CSV contains the displayed result.
How the SQL works
- 1Total bytes and average bytes distinguish a high-frequency event from an oversized contract.
- 2Source keeps ownership visible when the same event name can be emitted by multiple producers.
- 3Rejection rate turns collection changes into a data-quality review instead of a cost-only exercise.
Edge cases to decide
- Serialized payload size is not stored size, scan bytes, network egress, or invoice cost.
- Measure dimension cardinality separately; a small event can still create expensive or unusable groups.
- Exclude synthetic and development traffic before changing production retention.
Recommended dashboard
- Bars: total_payload_bytes by event_name
- Trend: event count and bytes by source
- Table: average size, rejection rate, retention owner, and schema version
Alert guidance
Alert on sustained contract-size or volume changes relative to a reviewed baseline, not on a fixed global byte threshold.
Read alert setupPut the recipe to work
Related instrumentation and guides
Continue the analysis
Measure Event Ingestion Freshness
Find event sources that stopped delivering data or are arriving substantially later than they occurred.
Open recipeFind Duplicate Event IDs
Identify event identifiers delivered more than once and measure whether duplicate handling is working.
Open recipeMeasure Required-Field Null Rate
Find event contracts where a required account, status, or correlation field is disappearing.
Open recipeRun it on real events
Create a table, adapt the fields, and save the result
Start free, send structured events, and use the query result as a chart, shared dashboard widget, or alert input.