Event contract
Fields the query expects
| Field | Type | Why it exists |
|---|---|---|
| timestamp_utc | Timestamp | Webhook lifecycle event time. |
| delivery_id | Utf8 | Stable provider delivery identifier. |
| provider | Utf8 | Webhook provider. |
| event_type | Utf8 | Provider event type. |
| event_name | Utf8 | webhook_received or downstream_completed. |
| status | Utf8 | success or failed for terminal outcomes. |
Copy the query
WITH deliveries AS (
SELECT
delivery_id,
provider,
event_type,
MIN(CASE
WHEN event_name = 'webhook_received' THEN timestamp_utc
ELSE NULL
END) AS received_at,
MIN(CASE
WHEN event_name = 'downstream_completed' AND status = 'success'
THEN timestamp_utc ELSE NULL
END) AS completed_at
FROM webhook_lifecycle_events
WHERE timestamp_utc >= now() - INTERVAL '7 days'
GROUP BY delivery_id, provider, event_type
),
delivery_outcomes AS (
SELECT
delivery_id,
provider,
event_type,
received_at,
completed_at,
date_part('second', completed_at - received_at) AS completion_seconds
FROM deliveries
WHERE received_at IS NOT NULL
)
SELECT
provider,
event_type,
COUNT(*) AS received_deliveries,
SUM(CASE WHEN completed_at IS NOT NULL THEN 1 ELSE 0 END)
AS completed_deliveries,
100.0 * SUM(CASE
WHEN completion_seconds <= 300.0 THEN 1 ELSE 0
END) / NULLIF(COUNT(*), 0) AS completed_within_target_pct,
approx_percentile_cont(completion_seconds, 0.95) AS p95_completion_seconds
FROM delivery_outcomes
GROUP BY provider, event_type
HAVING COUNT(*) >= 20
ORDER BY completed_within_target_pct, received_deliveries DESC;This read-only query is planned and executed against an empty typed table with Apache DataFusion 45.2.0. The deterministic sample output is synthetic and reviewed separately; validate field types, thresholds, and business definitions against your own data. Read the testing methodology.
Query result
Webhook deliveries completed within target
GitHub push processing is acknowledged at receipt but frequently misses the five-minute downstream completion target.
| provider | event_type | received_deliveries | completed_deliveries | completed_within_target_pct | p95_completion_seconds |
|---|---|---|---|---|---|
| stripe | invoice.payment_succeeded | 8,420 | 8,346 | 96.21 | 242 |
| github | push | 3,180 | 2,890 | 83.55 | 811 |
Synthetic example output. Run the query against your own event schema and thresholds before using it for operational decisions.
How the SQL works
- 1The delivery CTE collapses lifecycle events to one receipt and one successful downstream completion.
- 2Completion latency measures the business workflow rather than only HTTP handler time.
- 3The final aggregation reports both completion share and p95 time so missing outcomes remain visible.
Edge cases to decide
- Deduplicated provider retries should retain the same delivery ID and not create new logical work.
- Some event types intentionally fan out into several outcomes and need an explicit terminal definition.
- Exclude very recent receipts that have not had the full completion window when calculating a final service level.
Recommended dashboard
- Bars: completed_within_target_pct by event_type
- Trend: p95_completion_seconds
- Table: oldest received deliveries without completion
Alert guidance
Alert when mature deliveries miss the completion target at meaningful volume, even if webhook response codes remain healthy.
Read alert setupPut the recipe to work
Related instrumentation and guides
Continue the analysis
Run it on real events
Create a table, adapt the fields, and save the result
Start free, send structured events, and use the query result as a chart, shared dashboard widget, or alert input.