Event contract
Fields the query expects
| Field | Type | Why it exists |
|---|---|---|
| timestamp_utc | Timestamp | Failure time. |
| error_fingerprint | Utf8 | Stable normalized error group. |
| team_id | Utf8 | Safe affected account identifier. |
| status_code | Int64 | HTTP status code. |
Copy the query
SELECT
error_fingerprint,
COUNT(*) AS occurrences,
COUNT(DISTINCT team_id) AS affected_teams
FROM api_requests
WHERE timestamp_utc >= now() - INTERVAL '24 hours'
AND status_code >= 500
AND error_fingerprint IS NOT NULL
GROUP BY error_fingerprint
ORDER BY affected_teams DESC, occurrences DESC
LIMIT 20;This recipe is read-only and reviewed against Telemetry's DataFusion query patterns. Sample output is deterministic and synthetic; validate field types, thresholds, and business definitions against your own data.
Query result
Affected teams by error fingerprint
The tax-service timeout has less repetition than the OAuth error but much broader impact.
| error_fingerprint | occurrences | affected_teams |
|---|---|---|
| checkout.tax_service_timeout | 184 | 73 |
| sync.oauth_token_expired | 920 | 18 |
| report.pdf_render_failed | 44 | 16 |
Synthetic example output. Run the query against your own event schema and thresholds before using it for operational decisions.
How the SQL works
- 1A stable fingerprint should remove request IDs and other volatile message fragments.
- 2COUNT DISTINCT team_id measures breadth while occurrences measures repetition.
- 3Ordering by affected accounts makes the first triage view closer to user impact.
Edge cases to decide
- Hashing an entire raw error message creates a new group whenever identifiers change.
- Anonymous or unauthenticated requests need a different impact dimension.
- Do not include raw stack traces or personal data in the grouping field.
Recommended dashboard
- Bar: affected_teams by fingerprint
- Table: occurrences and newest release
- Trend: top fingerprints over time
Alert guidance
Alert on a new fingerprint affecting multiple accounts, not on every individual exception.
Read alert setupPut the recipe to work
Related instrumentation and guides
Continue the analysis
Calculate API Error Rate by Route
Use SQL to rank API routes by 5xx error rate while protecting the result from low-volume noise.
Open recipeCalculate p50, p95, and p99 API Latency
Compare median and tail latency by endpoint with DataFusion-compatible percentile SQL.
Open recipeCalculate API Error-Budget Burn Rate
Turn hourly request failures into an SLO burn-rate series that shows how quickly the allowed error budget is being consumed.
Open recipeRun it on real events
Create a table, adapt the fields, and save the result
Start free, send structured events, and use the query result as a chart, shared dashboard widget, or alert input.