Telemetry
API reliability SQL recipe

Rank Error Fingerprints by Customer Impact

Rank normalized application errors by occurrences and affected accounts instead of letting one retry loop dominate the incident view.

Beginnerapi_requestsReviewed 2026-07-27

Question answered

Which error groups affect the most customer accounts?

An error fingerprint groups equivalent failures. Counting both events and distinct accounts separates noisy repetition from broad customer impact.

Event contract

Fields the query expects

FieldTypeWhy it exists
timestamp_utcTimestampFailure time.
error_fingerprintUtf8Stable normalized error group.
team_idUtf8Safe affected account identifier.
status_codeInt64HTTP status code.
DataFusion SQL

Copy the query

sql
SELECT
  error_fingerprint,
  COUNT(*) AS occurrences,
  COUNT(DISTINCT team_id) AS affected_teams
FROM api_requests
WHERE timestamp_utc >= now() - INTERVAL '24 hours'
  AND status_code >= 500
  AND error_fingerprint IS NOT NULL
GROUP BY error_fingerprint
ORDER BY affected_teams DESC, occurrences DESC
LIMIT 20;

This recipe is read-only and reviewed against Telemetry's DataFusion query patterns. Sample output is deterministic and synthetic; validate field types, thresholds, and business definitions against your own data.

Query result

Affected teams by error fingerprint

The tax-service timeout has less repetition than the OAuth error but much broader impact.

error_fingerprintoccurrencesaffected_teams
checkout.tax_service_timeout18473
sync.oauth_token_expired92018
report.pdf_render_failed4416

Synthetic example output. Run the query against your own event schema and thresholds before using it for operational decisions.

How the SQL works

  1. 1A stable fingerprint should remove request IDs and other volatile message fragments.
  2. 2COUNT DISTINCT team_id measures breadth while occurrences measures repetition.
  3. 3Ordering by affected accounts makes the first triage view closer to user impact.

Edge cases to decide

  • Hashing an entire raw error message creates a new group whenever identifiers change.
  • Anonymous or unauthenticated requests need a different impact dimension.
  • Do not include raw stack traces or personal data in the grouping field.

Recommended dashboard

  • Bar: affected_teams by fingerprint
  • Table: occurrences and newest release
  • Trend: top fingerprints over time

Alert guidance

Alert on a new fingerprint affecting multiple accounts, not on every individual exception.

Read alert setup

Put the recipe to work

Related instrumentation and guides

Continue the analysis

Run it on real events

Create a table, adapt the fields, and save the result

Start free, send structured events, and use the query result as a chart, shared dashboard widget, or alert input.

Get an API key