Fields and Types
Fields¶
When you create an event you can send a JSON
document which consists of multiple
fields. Each field can contain event main information or metadata. Even though there is
no strict format of such a JSON
document we recommend to some of fields. An event
can contain the following set of fields, most of which are optional:
Field Name | Field Type | Required | Notes |
---|---|---|---|
timestamp |
date | no | Time when event happened (if not specified,current time will be assumed). The format is dateOptionalTime e.g.: 2014-02-17T21:37:04+0100 or2014-02-17T14:15:01.534471+02:00 . |
type |
string | yes | Event type which could be e.g. alert , deployment , etc. Events are later grouped in timeline based on event type which significantly improves visibility. |
message |
string | yes | Short description of event, e.g. Elasticsearch node03 onhost somehost06 restarted . This is a default search field in Sematext UI, so it is good to keep it concise, but search-friendly. Data in this field can be stored in Markdown format to make your messages more pretty and easier to read. For more details see. |
title |
string | no | Event title, can be used as a short label for event, e.g. Elasticsearch restart . |
tags |
string array | no | Multivalued field. Each tag should be specified as aseparate array element e.g., "tags":[ "elasticsearch", "restart", "emergency fix"] |
severity |
string | no | A single-valued field which says what kind of an event it is. It should have such values as error , info or warning and let's you easily navigate through important and less important events. |
creator |
string | no | Person, application, or component that created an event. E.g. John Smith , Elasticsearch , Some Batch Job |
data |
string | no | Additional event data. It can be anything you may find useful to have along inside of event object. E.g., it could be stacktrace in case of app_error event,base64 encoded content of file, etc. |
Types¶
Sematext Cloud helps you manage your events better and
distinguish between different kinds of events when you provide event type as a JSON
field. There are no limitations to the number of possible values of type
field.
To get the most value out of typed events we strongly suggest using a
smaller number of distinct event types (1-10) to keep things manageable.
Keeping the list of unique types concise help with faster navigation. Examples of
recommended types: alert
, server-info
, deployment
, infra
,
outage
.
Note: when using curl to call the Events API, you may experience "SSL certificate problem" errors. The reason is that curl doesn't bundle any CA certs any more. For more info see this. Regardless of curl errors, HTTPS communication should be successful.
Example of well defined event¶
{ "timestamp": "2019-05-30T09:58:43.455Z", "creator": "Jenkins", "host": "jenkins-host", "title": "Starting deployment", "message": "Started deployment of Test v1.23 to production", "severity": "info", "type": "deployment", "tags": ["version:1.23", "env:prod"], }
Markdown in events¶
Event message supports markdown.
An example below. Notice message field which contains a text formatted with Markdown.
{ "title": "Hello Sematext", "message": "### Hello Sematext\nClick [link](http://sematext.com/ \"Sematext\") \n", "tags": ["msg", "env:dev"], "severity": "info" }