Skip to content
Structured events SQL recipe

Reconstruct a correlated workflow timeline

Reconstruct ordered cross-service workflow steps and elapsed time from a shared workflow identifier.

Advancedworkflow_timeline_eventsReviewed 2026-07-28Tested with Apache DataFusion 45.2.0

Reviewed by the Telemetry product team on . We checked the SQL syntax, required event fields, sample results, and limits on using the query. Who reviews this page

Question answered

What happened, in order, during the latest failed workflow?

A failed workflow often crosses an API, queue, worker, and external dependency. This query chooses the latest failed workflow, finds its start time, and orders every correlated event on one elapsed-time axis.

Event schema

Fields the query expects

FieldTypeWhy it exists
timestamp_utcTimestampEvent time in UTC.
workflow_idUtf8Identifier shared across workflow steps.
event_nameUtf8Bounded lifecycle event name.
statusUtf8ok or failed.
serviceUtf8Service that emitted the event.
correlation_idUtf8Optional request-to-workflow correlation identifier.
environmentUtf8Deployment environment.
DataFusion SQL

Copy the query

sql
WITH target_workflow AS (
  SELECT workflow_id
  FROM workflow_timeline_events
  WHERE timestamp_utc >= now() - INTERVAL '24 hours'
    AND environment = 'production'
    AND status = 'failed'
  ORDER BY timestamp_utc DESC
  LIMIT 1
),
workflow_start AS (
  SELECT
    events.workflow_id,
    MIN(events.timestamp_utc) AS started_at
  FROM workflow_timeline_events AS events
  JOIN target_workflow AS target
    ON target.workflow_id = events.workflow_id
  GROUP BY events.workflow_id
)
SELECT
  events.workflow_id,
  ROW_NUMBER() OVER (
    PARTITION BY events.workflow_id
    ORDER BY events.timestamp_utc, events.event_name
  ) AS step_number,
  events.event_name,
  events.service,
  events.status,
  date_part('epoch', events.timestamp_utc - starts.started_at)
    AS elapsed_seconds
FROM workflow_timeline_events AS events
JOIN workflow_start AS starts
  ON starts.workflow_id = events.workflow_id
ORDER BY events.workflow_id, step_number;

This read-only query is planned and executed against an empty typed table with Apache DataFusion 45.2.0. We review the synthetic sample output separately. Check field types, thresholds, and counting rules against your own data. Read the testing methodology.

Query result

Failed workflow event timeline

Shipment creation fails 47 seconds after the workflow begins, after payment and inventory both succeed.

workflow_idstep_numberevent_nameservicestatuselapsed_seconds
workflow_10241workflow_startedcheckout-apiok0
workflow_10242payment_authorizedcheckout-apiok8
workflow_10243inventory_reservedfulfillment-workerok21
workflow_10244shipment_createdfulfillment-workerfailed47

Synthetic example output. Run the query against your own event schema and thresholds before using it for operational decisions.

Failed workflow event timeline: static chart of synthetic elapsed_seconds values from the Reconstruct a correlated workflow timeline example result
Download this SVG chart of the sample results for an article, runbook, or design review. Please credit Telemetry.

Reproduce the example

Download the sample data

The JSON bundle includes the event schema with field types, reproducible input rows, exact SQL, expected output, review notes, and engine version. The CSV contains the displayed result.

How the SQL works

  1. 1The target CTE selects one failed workflow rather than mixing independent executions.
  2. 2The workflow start supplies a common elapsed-time origin across services.
  3. 3ROW_NUMBER produces a human-readable step sequence while the status and service fields preserve debugging context.

Edge cases to check

  • Use a collision-resistant workflow identifier and document where it is propagated.
  • Late or clock-skewed events may need ingestion time as a secondary ordering field.
  • For high-volume workflows, limit which event names you collect or sample traces.

Recommended dashboard

  • Timeline: elapsed_seconds by event_name and service
  • Table: failed workflows with the last successful step
  • Link: filtered event detail by workflow_id

Alert guidance

Alert on the failing business event or workflow SLO; use the correlated timeline as investigation context.

Read alert setup

Set up the events this query needs

Related instrumentation and guides

Continue the analysis

Run it on your events

Create a table, adapt the fields, and save the result

Start free, send structured events, and use the query result as a chart, shared dashboard widget, or alert input.

Get an API key