事件表列

An event table is a special kind of database table with a predefined set of columns. The table’s structure is designed to support the data model for OpenTelemetry (https://opentelemetry.io/), a framework for handling telemetry data.

For more information about working with event tables, see Working with event tables.

事件表列

事件表包含以下列:

ColumnData TypeDescription
TIMESTAMPTIMESTAMP_NTZThe UTC timestamp when an event was created. For events representing a span of time, this is the end of the time span.
START_TIMESTAMPTIMESTAMP_NTZFor events representing a span of time, such as trace events, the start of the time span as a UTC timestamp.
OBSERVED_TIMESTAMPTIMESTAMP_NTZA UTC time used for logs. Currently the same value as for TIMESTAMP.
TRACEOBJECTTracing context for all signal types. Contains string values trace_id and span_id.
RESOURCEOBJECTReserved for future use.
RESOURCE_ATTRIBUTESOBJECTAttributes that identify the source of an event such as database, schema, user, warehouse, Openflow, etc.
SCOPEOBJECTScopes for events. For example, class names for logs.
SCOPE_ATTRIBUTESOBJECTReserved for future use.
RECORD_TYPESTRING

事件类型。以下其中一项:

  • LOG for a log message.
  • SPAN for user-defined function invocations performed sequentially on the same thread. For more information, see RECORD_TYPE 列.
  • SPAN_EVENT for a single trace event. A single query can emit more than one SPAN_EVENT.
  • EVENT for an event associated with an operation such as Iceberg automated refresh.
RECORDOBJECTFixed values for each record type, as described in RECORD 列.
RECORD_ATTRIBUTESOBJECTVariable attributes for each record type, as described in RECORD_ATTRIBUTES 列.
VALUEVARIANTPrimary event value.
EXEMPLARSARRAYReserved for future use.

按事件类型获取的数据

日志数据

属性描述
OBSERVED_TIMESTAMP当前值与 TIMESTAMP 的值相同。
RECORDThe severity level recorded by the log event.
RECORD_ATTRIBUTES代码中发出日志事件的位置。这些值因语言而异,但可以包括代码文件路径、函数名称、行号等。
RECORD_TYPEThe event type: LOG for a log message
RESOURCE_ATTRIBUTES用于标识事件源(例如数据库、架构、用户、仓库等)的属性。
SCOPE事件发生的作用域,例如创建日志事件的类的名称。
TIMESTAMP事件创建时的时间戳。
VALUE日志消息。

指标数据

属性描述
RECORD对于指标事件,为包含指标名称和单位的对象。
RECORD_TYPEThe event type: METRIC for a metric data point.
RESOURCE_ATTRIBUTES用于标识事件源(例如数据库、架构、用户或仓库)的属性。
START_TIMESTAMPWhen the RECORD column metric_type value is sum, this is the time when the metric was collected. Not used when the metric_type value is gauge.
TIMESTAMP事件创建时的时间戳。
VALUE指标的数值。

跟踪事件的数据

属性描述
RECORDFor a span, an object that includes the span’s name and kind; for a span event, the object includes the span’s name.
RECORD_ATTRIBUTESAttribute data associated with a span or span event.
RECORD_TYPEThe event type: SPAN for a span, SPAN_EVENT for a span event.
RESOURCE_ATTRIBUTES用于标识事件源(例如数据库、架构、用户、仓库等)的属性。
START_TIMESTAMP适用于 span、span 开始的时间。不适用于 span 事件。
TIMESTAMP事件创建时的时间戳。
TRACEIdentifiers trace_id and span_id for a span and the span events within it.

Data for Iceberg automated refresh events

Snowflake logs an event to your event table when it processes a snapshot for Iceberg automated refresh. The following table describes the columns for Iceberg automated refresh events:

属性描述
TIMESTAMP事件创建时的时间戳。
RESOURCE_ATTRIBUTES用于标识事件源(例如数据库、架构、用户或仓库)的属性。
RECORD_TYPEThe event type EVENT.
RECORDDetailed information about the status of the operation associated with the event, including name and severity.
RECORD_ATTRIBUTESAttributes associated with the event.
VALUEAdditional information specific to the event.

EXEMPLARS 列

保留以供将来使用。

OBSERVED_TIMESTAMP 列

日志的 UTC 时间戳。不用于跟踪事件。

RECORD 列

提供有关事件的核心信息,包括日志事件的日志级别或跟踪事件(span 或 span 事件记录)的名称。

Attributes, if any, for the record are recorded in the RECORD_ATTRIBUTES column.

Values contained by this column will vary depending on the value of the RECORD_TYPE column (LOG, SPAN or SPAN_EVENT), as described in the following sections.

For LOG RECORD_TYPE

When the RECORD_TYPE column value is LOG, the RECORD column value contains the severity of the log message. The column value may contain the following keys:

KeyTypeDescription
severity_textSTRING

日志严重性的文本。以下其中一项:

  • TRACE
  • DEBUG
  • INFO
  • WARN
  • ERROR
  • FATAL

When the log entry is for an unhandled exception, this value is the highest-severity error level for the current language runtime. For example, for code written in Python, the value is FATAL.

示例

{
  "severity_text": "INFO"
}

For METRIC RECORD_TYPE

指标为 CPU 和由 Snowflake 生成的内存数据。您可以使用此数据来分析资源消耗。

The execution handler language and its environment significantly affect the meaning of the metrics data. See Emitting metrics data from handler code for more information.

KeyTypeDescription
metric.namestring

按行记录的指标的名称。以下其中一项:

  • process.memory.usage: Amount of memory, in bytes, consumed during execution.
  • process.cpu.utilization: CPU use. Measured differently based on the handler language.

For more information, see Emitting metrics data from handler code.

metric.unitstringThe units of the metric; for example, bytes.
metric_typestringThe OpenTelemetry Metric Point type of the metric data; for example, sum or gauge.
value_typestringThe data type of the value in the VALUE column; for example, DOUBLE or INT.

示例

{
  "metric": {
    "name": "process.memory.usage",
    "unit": "bytes"
  },
  "metric_type": "sum",
  "value_type": "INT"
}

For SPAN RECORD_TYPE

span 表示函数和过程的单独执行。对于存储过程,有单个 span。对于用户定义的函数,单个函数调用可能有多个 span,具体取决于 Snowflake 如何决定计划执行。

All spans for a given query have the same value for the trace_id key of the TRACE column.

The duration of a span is the difference between the values in the start_timestamp and timestamp columns, indicating the time of the beginning and end of the span execution, respectively.

span 和查询跟踪的 ID 使用 TRACE 列中的值表示。

Snowflake 将为每个执行创建一个 span,具有如下所示的键:

KeyTypeDescription
dropped_attributes_countintThe number of attributes ignored after the recorded maximum has been reached.
namestring

当可执行文件的处理程序用 Python 编写时,那么它就标识了发出数据的函数或过程的处理程序。这因可执行文件类型而异,如下所示:

  • 过程:处理程序函数名称
  • 用户定义的函数 (UDF):处理程序函数名称
  • 用户定义的表函数 (UDTF):处理程序类名称
  • 客户端代码:开始 span 的客户端 API 的名称。

When the traced code is written in SQL, such as a SQL statement executed within a procedure, this is the name of the executed statement, such as SELECT or INSERT.

When the executable’s handler is written in a language other than Python or SQL, this is a fixed value such as snow.auto_instrumented.

kindstringSPAN_KIND_SERVER when the traced code is written in SQL. Otherwise, this is the fixed value SPAN_KIND_INTERNAL.
parent_span_idHex string

Identifies the span of the procedure or UDF from which the current trace passed. When this value is present, it means that the current procedure or UDF call was made by another procedure in a call chain relationship. That “parent” procedure’s span_id value is the same as this parent_span_id.

snow.process.memory.usage.maxstringOptional. When present, specifies the maximum amount of memory, in bytes, used during this span’s execution.
statusstring

STATUS_CODE_ERROR when the span corresponds to an unhandled exception. Otherwise, STATUS_CODE_UNSET.

对于用户定义的函数,Snowflake 可以添加 span 属性,指示函数处理和发出的行数。

For SPAN_EVENT RECORD_TYPE

span 事件是附加到特定 span 执行的事件记录,如上所述。您可以创建事件以满足应用程序的需求。span 事件数上限为 128 个。

TRACE 列的值将标识事件创建的 span。

Span events have a single key, name, and can have arbitrary attributes added in the RECORD_ATTRIBUTES column.

类型描述
name字符串span 事件的名称。

For EVENT RECORD_TYPE for Iceberg automated refresh events

KeyTypeDescription
nameVARCHARThe name of the event; for example, iceberg_auto_refresh_snapshot_lifecycle
severity_textVARCHAR

日志严重性的文本。以下其中一项:

  • DEBUG
  • WARN
  • ERROR

The severity text when the snapshot_state is "errored" is one of the following values:

  • WARN if Snowflake encountered an error that can be resolved without human intervention.
  • ERROR if Snowflake encountered an error that requires human intervention to resolve.

The snapshot_state is a key-value pair in an object in the VALUE column. For more information, see For VALUE for Iceberg automated refresh events.

For EVENT RECORD_TYPE for Snowflake Native Apps lifecycle events

KeyTypeDescription
nameVARCHARThe name of the event; for example, application.state_change
severity_numberNUMBERThe severity number of the event.
severity_textVARCHAR

日志严重性的文本。以下其中一项:

  • INFO
  • WARN
  • ERROR

RECORD_ATTRIBUTES 列

使用由 Snowflake 或代码设置的元数据描述事件。该值将因行包含的记录类型而异,如以下部分所述。

For LOG RECORD_TYPE

代码中发出日志事件的位置,包括代码文件路径、函数名称、行号等。

除了下面列出的属性外,您还可以添加自己的属性,以便将其包含在 RECORD_ATTRIBUTES 值中。

属性类型描述
code.filepath整数包含生成消息的代码的文件。
code.function字符串生成消息的函数的名称。
code.lineno整数代码中生成消息的行号。
code.namespace整数生成消息的代码的命名空间。
exception.message字符串The error message from an unhandled exception.
exception.type字符串The name of the class for an unhandled exception.
exception.stacktrace字符串An unhandled exception’s stack trace formatted by a language runtime.
exception.escaped布尔true if this entry is from an unhandled exception.
thread.id整数用于创建日志事件的线程。
thread.name字符串用于创建日志事件的线程。

示例

In the following example, all attributes have been added by Snowflake except employee.id, which was added by a custom attribute.

{
  "code.filepath": "main.scala",
  "code.function": "$anonfun$new$10",
  "code.lineno": 149,
  "code.namespace": "main.main$",
  "thread.id": 1,
  "thread.name": "main"
  "employee.id": "52307953446424"
}

For SPAN RECORD_TYPE

记录 span 时为 span 分配的属性(如果有)。属性名称和值由代码或 Snowflake 设置。

下表列出了 Snowflake 可能设置的属性。

属性类型描述
db.query.executable.names字符串在此时间段内跟踪的查询下执行的可执行文件的名称。
db.query.table.names字符串在此时间段内跟踪的查询中读取或修改的表的名称。
db.query.view.names字符串在此时间段内跟踪的查询中访问的视图的名称。
db.query.text字符串The text of the SQL query traced in this span. Included only if SQL trace query text is enabled for tracing. For more information, see SQL statement tracing.
snow.input.rows整数函数的 span 处理的输入行数。
snow.output.rows整数函数的 span 成功处理的输出行数。

示例

以下示例中的代码包括 Snowflake 设置的属性。

{
  "snow.input.rows": 12
  "snow.output.rows": 12
}

示例

以下示例中的代码包括由处理程序代码设置的属性。

{
  "MyFunctionVersion": "1.1.0"
}

For SPAN_EVENT RECORD_TYPE

记录 span 事件时为事件分配的属性(如果有)。属性名称和值可以由 Snowflake 或用户代码设置。

示例

以下示例中的代码包括由处理程序代码设置的属性。

{
  "mykey1": "value1",
  "mykey2": "value2"
}

For EVENT RECORD_TYPE for Iceberg automated refresh events

Attributes assigned to the EVENT event when it is recorded for Iceberg automated refresh. Attribute names and values are set by Snowflake.

属性类型描述示例
snow.snapshot.id整数The ID of the Iceberg snapshot being processed during Iceberg automated refresh. NULL if the automated refresh process fails.12345

RECORD_TYPE 列

指定事件表行描述的记录的类型。此列的值标识事件表可能包含三类记录中哪类记录的数据。

The RECORD column contains this record’s data. The RECORD_ATTRIBUTES column contains this record’s metadata, if any.

下表列出了此列的可能值。

Column ValueDescription
LOGThe row represents a log entry generated by handler code.
SPAN

该行表示一个 span。

对于存储过程,有单个 span。对于可以并行化的用户定义函数,执行该函数的每个线程都有一个 span。线程数将因多种因素而异,包括执行函数的 Snowflake 仓库的大小。

A span may contain multiple span events. For more information, see Span data recorded.

SPAN_EVENT

该行表示一个 span 事件。一个特定 span 可以附加多个 span 事件记录。处理程序代码可能会创建事件以满足您的需求。span 事件数上限为 128 个。

METRICThe row represents an observation of a metric. Multiple observations of multiple metrics can be associated with a particular span.
EVENTThe row represents an event associated with a particular operation, such as Iceberg automated refresh.

RESOURCE 列

保留以供将来使用。

RESOURCE_ATTRIBUTES 列

根据 Snowflake 对象描述事件的源。

构成此列值的属性由 Snowflake 设置,无法更改。

事件源的资源属性

Note

When the event source is Iceberg automated refresh, only the following attribute types are set:

  • :code:snow.application.name
  • :code:snow.executable.name
  • :code:snow.database.name
  • :code:snow.schema.name
  • :code:snow.executable.name
Attribute NameAttribute TypeDescriptionExample
snow.catalog.integration.namestringThe name of the catalog integration associated with the executable for Iceberg automated refresh.MY_CATALOG_INTEGRATION_NAME
snow.catalog.table.namestringThe name of the Iceberg table in the catalog.MY_CATALOG_TABLE_NAME
snow.database.idintThe internal/system-generated identifier of the database containing the executable.12345
snow.database.namestringThe name of the database containing the executable.MY_DATABASE
snow.executable.idintThe internal/system-generated identifier of the executable (procedure, function, SnowService, etc.) generating the event.12345
snow.executable.namestringThe name of the executable generating the event. For example, this might be the name of the procedure, function, or Streamlit app.MY_UDF
snow.executable.runtime.versionstring

可执行语言的运行时版本。这将是特定于语言的值,如下所述:

  • Java: 11 or 17
  • JavaScript:无值
  • Python: From 3.10 to 3.12
  • Scala: 2.12
  • SQL:无值
procedure
snow.executable.typestring

以下其中一项:

  • procedure for stored procedure
  • function for a user-defined function
  • query for an event in which SQL was executed, such as when a SQL statement is executed within a stored procedure.
  • sql for an event from a single query, such as a Snowflake Scripting block.
  • spcs for a Snowpark Container Services service.
  • streamlit for a Streamlit app
procedure
snow.owner.idintThe internal/system-generated identifier of the role with OWNERSHIP privilege for the executable.1234
snow.owner.namestringThe name of the role with OWNERSHIP privilege for the executable.UDF_OWNER_RL
snow.schema.idintThe internal/system-generated identifier of the schema containing the executable.12345
snow.schema.namestringThe name of the schema containing the executable.MY_SCHEMA
snow.table.namestringThe name of the table associated with the executable.MY_TABLE_NAME
telemetry.sdk.languagestringThe language of the resource/SDK. Snowflake uses java, scala, python, javascript and sql.java

执行环境的资源属性

属性类型描述示例
db.user字符串对于函数或过程,这是指执行该函数或过程的用户的名称。对于 Streamlit 应用程序,这是指在某一事件中查看该应用程序的用户的名称。MY_USER_NAME
snow.query.id字符串查询的 ID。01a6aeb7-0604-c466-0000-097127d13812
snow.release.version字符串生成事件时运行的 Snowflake 版本7.9.0
snow.session.id整数运行可执行文件的会话的 ID。10
snow.session.role.primary.id整数会话中主要角色的内部/系统生成的标识符。10
snow.session.role.primary.name字符串会话中主要角色的名称。MY_ROLE
snow.user.id整数运行查询的用户的内部/系统生成的标识符。1234
snow.warehouse.id整数运行(生成事件的)查询的仓库的内部/系统生成的标识符。12345
snow.warehouse.name字符串运行(生成事件的)查询的仓库的名称。MY_WAREHOUSE

应用程序的资源属性

属性类型描述示例
snow.application.consumer.account_locator字符串For a Snowflake Native App, the account locator of the consumer’s account.XY12345
snow.application.consumer.account_name字符串For a Snowflake Native App, the name of the consumer’s account.MY_CONSUMER_ACCOUNT
snow.application.consumer.name字符串For a Snowflake Native App, the account locator of the consumer’s account (deprecated; use snow.application.consumer.account_locator instead).XY12345
snow.application.consumer.organization字符串For a Snowflake Native App, the name of the consumer’s organization.CONSUMER_ORG_NAME
snow.application.consumer.snowflake_region字符串For a Snowflake Native App, the Snowflake region of the consumer’s account.AWS_US_WEST_2
snow.application.id字符串For a Snowflake Native App, the internal/system-generated identifier of the app.ABCZN3J3
snow.application.name字符串For a Snowflake Native App, the name of the app.MY_INSTALLED_APP_NAME
snow.application.package.name字符串For a Snowflake Native App, the name of the application package.MY_INSTALLED_PACKAGE_NAME
snow.listing.global_name字符串For a Snowflake Native App, the internal/system-generated identifier of the listing.GZYZN3J3
snow.listing.name字符串For a Snowflake Native App, the name of the listing.MY_LISTING_NAME

Snowflake 版本的资源属性

属性类型描述示例
service.version字符串The version of the executable, where relevant. The combination of snow.version and snow.patch joined by a dot where they exist. Standard OpenTelemetry attribute.2.3.1
snow.patch字符串正在运行的可执行文件的补丁级别。1
snow.version字符串正在运行的可执行文件的版本。2.3

示例

{
  "db.user": "MYUSERNAME",
  "snow.database.id": 13,
  "snow.database.name": "MY_DB",
  "snow.executable.id": 197,
  "snow.executable.name": "FUNCTION_NAME(I NUMBER):ARG_NAME(38,0)",
  "snow.executable.type": "FUNCTION",
  "snow.owner.id": 2,
  "snow.owner.name": "MY_ROLE",
  "snow.query.id": "01ab0f07-0000-15c8-0000-0129000592c2",
  "snow.schema.id": 16,
  "snow.schema.name": "PUBLIC",
  "snow.session.id": 1275605667850,
  "snow.session.role.primary.id": 2,
  "snow.session.role.primary.name": "MY_ROLE",
  "snow.user.id": 25,
  "snow.warehouse.id": 5,
  "snow.warehouse.name": "MYWH",
  "telemetry.sdk.language": "python"
}

SCOPE 列

适用于日志事件,发出事件的代码的命名空间,例如创建日志条目的类的名称。这不用于跟踪事件。

下表列出了此列中可能包含的属性。

范围值

属性类型描述示例
name字符串发出事件的代码的命名空间。com.sample.MyClass

示例

{
  "name": "com.sample.MyClass"
}

SCOPE_ATTRIBUTES 列

保留以供将来使用。

START_TIMESTAMP 列

span 以 UTC 时间戳开始的时间。

RECORD_TYPE Column ValueSTART_TIMESTAMP Value Description
LOGNot used.
SPANThe time the span started.
SPAN_EVENTNot used.
METRICWhen the RECORD column metric_type value is sum, this is the time when the metric was collected. Not used when the metric_type value is gauge.

TIMESTAMP 列

发出事件的时间。该值的含义将因行所表示的记录类型而异,如下表所示:

RECORD_TYPE Column ValueTIMESTAMP Value Description
LOGThe wall-clock time that the event was emitted.
SPANThe time at which execution concluded.
SPAN_EVENTThe wall-clock time that the event was emitted.

TRACE 列

表示函数和过程执行的唯一标识符。

RECORD_TYPE Column ValueTRACE Value Description
LOGNot used.
SPANtrace_id and span_id
SPAN_EVENTtrace_id and span_id

跟踪值

下表列出了此列中可能包含的属性。

AttributeTypeDescriptionExamples
span_idHex string

A unique identifier to the threading model. Procedures, which are single-threaded, will have a single span_id value. Functions, which may be executed by Snowflake on multiple threads (such as for multiple rows), may have multiple span_id values.

When the current span is from a procedure that called another procedure or UDF in the trace, this span_id value is the same as the RECORD column parent_span_id value of the span for the procedure or UDF it called.

b4c28078330873a2
trace_idHex string

A unique identifier for calls made from a query. When a stored procedure is not being called in a chain of calls, each call has its own trace_id value. Within a query, calls to all functions made from the query share the same trace_id value.

When a procedure is called by another procedure or UDF in a call chain, it has the same trace_id value as other procedures and UDFs in the chain.

此值对于每个查询均唯一,并且对于查询中的所有 span 均相同。您可以使用它对单个查询执行中的事件进行分组。

6992e9febf0b97f45b34a62e54936adb

示例

以下示例中的代码显示 span 或 span 事件将存在的属性。

{
  "span_id": "b4c28078330873a2",
  "trace_id": "6992e9febf0b97f45b34a62e54936adb"
}

VALUE 列

  • For log events, this is usually the log message. When the event logged is for an unhandled exception, the value in this column will be simply exception.
  • 对于指标,这是指标的数值。

请注意,VALUE 列的类型为 VARIANT(不是 STRING),因此它可以具有某些语言(例如 JavaScript)的非字符串值。

For EVENT VALUE for Iceberg automated refresh events

KeyTypeDescriptionExample
metadata_file_locationVARCHARThe location of the Iceberg metadata file, which can be NULL if the automated refresh process failed."s3china://my_bucket/iceberg_snapshots/metadata/...metadata.json"
snapshot_stateVARCHAR

按行记录的指标的名称。以下其中一项:

  • started: Snowflake has started to process a snapshot.
  • completed: Snowflake completed processing a snapshot
  • errored: Snowflake failed to process a snapshot.
"errored"
error_messageVARCHARIf the value in snapshot_state is errored, this column includes an error message.

“Iceberg Auto Refresh encountered a fatal error. Please disable Auto Refresh and manually refresh the table before re-enabling Auto Refresh. FailedMetadataFile: s3china://my_bucket/…, FailedSnapshotId: null.n”

For EVENT VALUE for Snowflake Native Apps application lifecycle events

KeyTypeDescription
upgrade_stateVARCHARThe current state of the background installation or upgrade.
upgrade_attemptVARCHARIndicates whether an upgrade was attempted for the app.
target_upgrade_versionVARCHARThe version of the app that is running or pending upgrade.
target_upgrade_patchVARCHARThe version patch level of the app that is running or pending upgrade.
upgrade_failure_reasonVARCHARThe reason the upgrade failed, if applicable.
health_statusVARCHAR

The health status of the app. Possible values:

  • OK
  • PAUSE
  • FAILED
actionVARCHAR

The action applied to privileges during installation or upgrade. Possible values:

  • GRANTED
  • REVOKED
privilegesVARCHARA list of privileges that were granted or revoked during installation or upgrade.

示例

{
  "metadata_file_location": "<path>",
  "snapshot_state": "errored",
  "error_message": "<error_message>"
}