Telemetry
Structured events SQL recipe

Reconstruct a Correlated Workflow Timeline

Reconstruct ordered cross-service workflow steps and elapsed time from a shared workflow identifier.

Advancedworkflow_timeline_eventsReviewed 2026-07-28Tested with Apache DataFusion 45.2.0

Reviewed by the Telemetry product team on . SQL compatibility, event contract, synthetic output, and operational caveats. Editorial ownership

Question answered

What happened, in order, during the latest failed workflow?

A failed workflow often crosses an API, queue, worker, and external dependency. This query chooses the latest failed workflow, finds its start time, and orders every correlated event on one elapsed-time axis.

Event contract

Fields the query expects

FieldTypeWhy it exists
timestamp_utcTimestampEvent time in UTC.
workflow_idUtf8Identifier shared across workflow steps.
event_nameUtf8Bounded lifecycle event name.
statusUtf8ok or failed.
serviceUtf8Service that emitted the event.
correlation_idUtf8Optional request-to-workflow correlation identifier.
environmentUtf8Deployment environment.
DataFusion SQL

Copy the query

sql
WITH target_workflow AS (
  SELECT workflow_id
  FROM workflow_timeline_events
  WHERE timestamp_utc >= now() - INTERVAL '24 hours'
    AND environment = 'production'
    AND status = 'failed'
  ORDER BY timestamp_utc DESC
  LIMIT 1
),
workflow_start AS (
  SELECT
    events.workflow_id,
    MIN(events.timestamp_utc) AS started_at
  FROM workflow_timeline_events AS events
  JOIN target_workflow AS target
    ON target.workflow_id = events.workflow_id
  GROUP BY events.workflow_id
)
SELECT
  events.workflow_id,
  ROW_NUMBER() OVER (
    PARTITION BY events.workflow_id
    ORDER BY events.timestamp_utc, events.event_name
  ) AS step_number,
  events.event_name,
  events.service,
  events.status,
  date_part('epoch', events.timestamp_utc - starts.started_at)
    AS elapsed_seconds
FROM workflow_timeline_events AS events
JOIN workflow_start AS starts
  ON starts.workflow_id = events.workflow_id
ORDER BY events.workflow_id, step_number;

This read-only query is planned and executed against an empty typed table with Apache DataFusion 45.2.0. The deterministic sample output is synthetic and reviewed separately; validate field types, thresholds, and business definitions against your own data. Read the testing methodology.

Query result

Failed workflow event timeline

Shipment creation fails 47 seconds after the workflow begins, after payment and inventory both succeed.

workflow_idstep_numberevent_nameservicestatuselapsed_seconds
workflow_10241workflow_startedcheckout-apiok0
workflow_10242payment_authorizedcheckout-apiok8
workflow_10243inventory_reservedfulfillment-workerok21
workflow_10244shipment_createdfulfillment-workerfailed47

Synthetic example output. Run the query against your own event schema and thresholds before using it for operational decisions.

Failed workflow event timeline: static chart of synthetic elapsed_seconds values from the Reconstruct a Correlated Workflow Timeline example result
Indexable SVG of the deterministic example output. Download it for an article, runbook, or design review with attribution.

Reproduce the example

Download the public fixture

The JSON bundle includes the typed event contract, reproducible input rows, exact SQL, expected output, review notes, and engine version. The CSV contains the displayed result.

How the SQL works

  1. 1The target CTE selects one failed workflow rather than mixing independent executions.
  2. 2The workflow start supplies a common elapsed-time origin across services.
  3. 3ROW_NUMBER produces a human-readable step sequence while the status and service fields preserve debugging context.

Edge cases to decide

  • Use a collision-resistant workflow identifier and document where it is propagated.
  • Late or clock-skewed events may need ingestion time as a secondary ordering field.
  • High-volume workflows may need a bounded event-name allowlist or trace sampling.

Recommended dashboard

  • Timeline: elapsed_seconds by event_name and service
  • Table: failed workflows with the last successful step
  • Link: filtered event detail by workflow_id

Alert guidance

Alert on the failing business event or workflow SLO; use the correlated timeline as investigation context.

Read alert setup

Put the recipe to work

Related instrumentation and guides

Continue the analysis

Run it on real events

Create a table, adapt the fields, and save the result

Start free, send structured events, and use the query result as a chart, shared dashboard widget, or alert input.

Get an API key