Skip to content

Fields and Types


When you create an event you can send a JSON document which consists of multiple fields. Each field can contain event main information or metadata. Even though there is no strict format of such a JSON document we recommend to some of fields. An event can contain the following set of fields, most of which are optional:

Field Name Field Type Required Notes
timestamp date no Time when event happened (if not specified,current time will be assumed). The format is dateOptionalTime e.g.: 2014-02-17T21:37:04+0100 or2014-02-17T14:15:01.534471+02:00.
type string yes Event type which could be e.g. alert, deployment, etc. Events are later grouped in timeline based on event type which significantly improves visibility.
message string yes Short description of event, e.g. Elasticsearch node03 onhost somehost06 restarted. This is a default search field in Sematext UI, so it is good to keep it concise, but search-friendly. Data in this field can be stored in Markdown format to make your messages more pretty and easier to read. For more details see.
title string no Event title, can be used as a short label for event, e.g. Elasticsearch restart.
tags string array no Multivalued field. Each tag should be specified as aseparate array element e.g.,
"tags":[ "elasticsearch", "restart", "emergency fix"]
severity string no A single-valued field which says what kind of an event it is. It should have such values as error, info or warning and let's you easily navigate through important and less important events.
creator string no Person, application, or component that created an event. E.g. John Smith, Elasticsearch, Some Batch Job
data string no Additional event data. It can be anything you may find useful to have along inside of event object. E.g., it could be stacktrace in case of app_error event,base64 encoded content of file, etc.


Sematext Cloud helps you manage your events better and distinguish between different kinds of events when you provide event type as a JSON field. There are no limitations to the number of possible values of type field. To get the most value out of typed events we strongly suggest using a smaller number of distinct event types (1-10) to keep things manageable. Keeping the list of unique types concise help with faster navigation. Examples of recommended types: alert, server-info, deployment, infra, outage.

Note: when using curl to call the Events API, you may experience "SSL certificate problem" errors. The reason is that curl doesn't bundle any CA certs any more. For more info see this. Regardless of curl errors, HTTPS communication should be successful.

Example of well defined event

  "timestamp": "2019-05-30T09:58:43.455Z",
  "creator": "Jenkins",
  "host": "jenkins-host",
  "title": "Starting deployment",
  "message": "Started deployment of Test v1.23 to production",
  "severity": "info",
  "type": "deployment",
  "tags": ["version:1.23", "env:prod"],

Markdown in events

Event message supports markdown.

An example below. Notice message field which contains a text formatted with Markdown.

  "title": "Hello Sematext",
  "message": "### Hello Sematext\nClick [link]( \"Sematext\") \n",
  "tags": ["msg", "env:dev"],
  "severity": "info"