Skip to content
Telemetry
Data quality SQL recipe

Measure Telemetry volume by event name

Rank event types by payload bytes, average event size, and rejection rate before changing retention or collection policy.

Beginnertelemetry_ingestion_eventsReviewed 2026-07-28Tested with Apache DataFusion 45.2.0

Reviewed by the Telemetry product team on . We checked the SQL syntax, required event fields, sample results, and limits on using the query. Who reviews this page

Question answered

Which event contracts create the most ingestion volume?

Count events and their bytes together to find frequent events and oversized payloads. Payload bytes alone do not tell you what a vendor will charge.

Event schema

Fields the query expects

FieldTypeWhy it exists
timestamp_utcTimestampIngestion attempt time in UTC.
event_nameUtf8Controlled event name.
sourceUtf8Bounded producer or SDK source.
payload_bytesInt64Serialized event size before transport compression.
acceptedBooleanWhether ingestion accepted the event.
environmentUtf8Deployment environment.
DataFusion SQL

Copy the query

sql
SELECT
  event_name,
  source,
  COUNT(*) AS events,
  SUM(payload_bytes) AS total_payload_bytes,
  AVG(payload_bytes) AS avg_payload_bytes,
  SUM(CASE WHEN accepted THEN 0 ELSE 1 END) AS rejected_events,
  100.0 * SUM(CASE WHEN accepted THEN 0 ELSE 1 END)
    / NULLIF(COUNT(*), 0) AS rejection_rate_pct
FROM telemetry_ingestion_events
WHERE timestamp_utc >= now() - INTERVAL '24 hours'
  AND environment = 'production'
GROUP BY event_name, source
ORDER BY total_payload_bytes DESC, event_name;

This read-only query is planned and executed against an empty typed table with Apache DataFusion 45.2.0. We review the synthetic sample output separately. Check field types, thresholds, and counting rules against your own data. Read the testing methodology.

Query result

Payload volume by event contract

The synthetic debug trace has the largest byte volume despite having fewer events than page views.

event_namesourceeventstotal_payload_bytesavg_payload_bytesrejected_eventsrejection_rate_pct
debug_traceworker416,0004,000125
llm_request_completedapi36,0002,00000
page_viewedweb63,000500116.67

Synthetic example output. Run the query against your own event schema and thresholds before using it for operational decisions.

Payload volume by event contract: static chart of synthetic total_payload_bytes values from the Measure Telemetry volume by event name example result
Download this SVG chart of the sample results for an article, runbook, or design review. Please credit Telemetry.

Reproduce the example

Download the sample data

The JSON bundle includes the event schema with field types, reproducible input rows, exact SQL, expected output, review notes, and engine version. The CSV contains the displayed result.

Run in browserSample JSONExpected output CSVStatic SVG chart

How the SQL works

  1. 1Total and average event bytes show whether a table grows because of event volume or large individual events.
  2. 2Source keeps ownership visible when the same event name can be emitted by multiple producers.
  3. 3Rejection rate turns collection changes into a data-quality review instead of a cost-only exercise.

Edge cases to check

  • Serialized payload size is not stored size, scan bytes, network egress, or invoice cost.
  • Measure dimension cardinality separately; a small event can still create expensive or unusable groups.
  • Exclude synthetic and development traffic before changing production retention.

Recommended dashboard

  • Bars: total_payload_bytes by event_name
  • Trend: event count and bytes by source
  • Table: average size, rejection rate, retention owner, and schema version

Alert guidance

Alert when event size or volume stays above its reviewed baseline. Use a threshold for each event type.

Read alert setup

Set up the events this query needs

Related instrumentation and guides

Telemetry cost-management guideHigh-cardinality fieldsData quality recipes

Continue the analysis

Count sensor deliveries and measurements separately

Run SQL on six fictional sensor deliveries. A network retry adds rows without adding measurements, changing a row-weighted average.

Open recipe

Measure event ingestion freshness

Find event sources that stopped delivering data or are arriving substantially later than they occurred.

Open recipe

Find duplicate event ids

Identify event identifiers delivered more than once and measure whether duplicate handling is working.

Open recipe

Run it on your events

Create a table, adapt the fields, and save the result

Start free, send structured events, and use the query result as a chart, shared dashboard widget, or alert input.

Get an API key