Schema Reference

In AppScope, events are structured according to one pattern, and metrics are structured according to another. These patterns are defined rigorously, in validatable JSON Schema.

Three definitions schemas govern the basic patterns. Then there is an individual schema for each event and metric, documented below. The definitions schemas define the elements that can be present in individual event and metric schemas, as well as the overall structures into which those elements fit.

When we say "the AppScope schema," we mean the whole set of schemas. The AppScope schema now in use was introduced in AppScope 1.0.1.

A few event and metric schema elements, namely title and description, have placeholder values. In the future, we might make these more informative. They are essentially "internal documentation" within the schemas and do not affect how the schemas function in AppScope. In the event that you develop any code that depends on AppScope schemas, be aware that the content of title and description fields may evolve.

For more about how events and metrics work in AppScope, see this overview.

---

dns.req ^

Structure of the dns.req event

Example

{
  "type": "evt",
  "id": "ubuntu-firefox-/usr/lib/firefox/firefox",
  "_channel": "13470757294558",
  "body": {
    "sourcetype": "dns",
    "_time": 1643735942.526987,
    "source": "dns.req",
    "host": "ubuntu",
    "proc": "firefox",
    "cmd": "/usr/lib/firefox/firefox",
    "pid": 6544,
    "data": {
      "domain": "detectportal.firefox.com"
    }
  }
}

dns.req properties

Property	Description
type required (string)	Distinguishes events from metrics. Value must be evt.
id required (string)	Identifies the application that the process is associated with.
_channel required (string)	Identifies the operation during whose lifetime the event or metric is emitted.
body required (object)	body Details below.

dns.req.body properties

Property	Description
sourcetype required (string)	Sourcetype - dns Value must be dns.
_time required (number)	_time Example: 1643662126.91777
source required (string)	Source - DNS request Value must be dns.req.
host required (string)	host
proc required (string)	proc
cmd required (string)	cmd Example: top
pid required (integer)	pid Example: 1000
data required (object)	data Details below.

dns.req.body.data properties

Property	Description
domain required (string)	domain

---

dns.resp ^

Structure of the dns.resp event

Example

{
  "type": "evt",
  "id": "ubuntu-firefox-/usr/lib/firefox/firefox",
  "_channel": "13470823778038",
  "body": {
    "sourcetype": "dns",
    "_time": 1643735942.552667,
    "source": "dns.resp",
    "host": "ubuntu",
    "proc": "firefox",
    "cmd": "/usr/lib/firefox/firefox",
    "pid": 6544,
    "data": {
      "duration": 25,
      "domain": "detectportal.firefox.com",
      "addrs": [
        "34.107.221.82"
      ]
    }
  }
}

dns.resp properties

Property	Description
type required (string)	Distinguishes events from metrics. Value must be evt.
id required (string)	Identifies the application that the process is associated with.
_channel required (string)	Identifies the operation during whose lifetime the event or metric is emitted.
body required (object)	body Details below.

dns.resp.body properties

Property	Description
sourcetype required (string)	Sourcetype - dns Value must be dns.
_time required (number)	_time Example: 1643662126.91777
source required (string)	Source - DNS response Value must be dns.resp.
host required (string)	host
proc required (string)	proc
cmd required (string)	cmd Example: top
pid required (integer)	pid Example: 1000
data required (object)	data Details below.

dns.resp.body.data properties

Property	Description
duration (number)	duration Example: 55
domain (string)	domain
addrs (array)	addrs

---

fs.close ^

Structure of the fs.close event

Example

{
  "type": "evt",
  "id": "8bc1398c19f3-accept01-/kernel/syscalls/accept/accept01",
  "_channel": "5890090429747",
  "body": {
    "sourcetype": "fs",
    "_time": 1643735835.455002,
    "source": "fs.close",
    "host": "8bc1398c19f3",
    "proc": "accept01",
    "cmd": "/opt/test/ltp/testcases/kernel/syscalls/accept/accept01",
    "pid": 1933,
    "data": {
      "proc": "accept01",
      "pid": 1933,
      "host": "8bc1398c19f3",
      "file": "/dev/shm/ltp_accept01_1931",
      "proc_uid": 0,
      "proc_gid": 0,
      "proc_cgroup": "0::/system.slice/containerd.service",
      "file_perms": 600,
      "file_owner": 0,
      "file_group": 0,
      "file_read_bytes": 0,
      "file_read_ops": 0,
      "file_write_bytes": 0,
      "file_write_ops": 0,
      "duration": 0,
      "op": "close"
    }
  }
}

fs.close properties

Property	Description
type required (string)	Distinguishes events from metrics. Value must be evt.
id required (string)	Identifies the application that the process is associated with.
_channel required (string)	Identifies the operation during whose lifetime the event or metric is emitted.
body required (object)	body Details below.

fs.close.body properties

Property	Description
sourcetype required (string)	Sourcetype - fs Value must be fs.
_time required (number)	_time Example: 1643662126.91777
source required (string)	Source - File Close Value must be fs.close.
host required (string)	host
proc required (string)	proc
cmd required (string)	cmd Example: top
pid required (integer)	pid Example: 1000
data required (object)	data Details below.

fs.close.body.data properties

Property	Description
proc (string)	proc
pid (integer)	pid Example: 1000
host (string)	host
file (string)	file
proc_uid (integer)	proc_uid Example: 0
proc_gid (integer)	proc_gid Example: 0
proc_cgroup (string)	proc_cgroup Example: 0::/user.slice/user-1000.slice/session-3.scope
file_perms (integer)	file_perms Example: 777
file_owner (number)	file_owner Example: 0
file_group (number)	file_group Example: 0
file_read_bytes (integer)	file_read_bytes Example: 512
file_read_ops (integer)	file_read_ops Example: 5
file_write_bytes (integer)	file_write_bytes Example: 10
file_write_ops (integer)	file_write_ops Example: 5
duration (number)	duration Example: 55
op (string)	op_fs_close Possible values: go_close closedir freopen freopen64 close fclose close$NOCANCEL guarded_close_np close_nocancel

---

fs.delete ^

Structure of the fs.delete event

Example

{
  "type": "evt",
  "id": "b6209181773f-rm-rm test.txt",
  "_channel": "none",
  "body": {
    "sourcetype": "fs",
    "_time": 1643793922.040438,
    "source": "fs.delete",
    "host": "b6209181773f",
    "proc": "rm",
    "cmd": "rm test.txt",
    "pid": 306,
    "data": {
      "proc": "rm",
      "pid": 306,
      "host": "b6209181773f",
      "op": "unlinkat",
      "file": "test.txt",
      "unit": "operation"
    }
  }
}

fs.delete properties

Property	Description
type required (string)	Distinguishes events from metrics. Value must be evt.
id required (string)	Identifies the application that the process is associated with.
_channel required (string)	Identifies the operation during whose lifetime the event or metric is emitted.
body required (object)	body Details below.

fs.delete.body properties

Property	Description
sourcetype required (string)	Sourcetype - fs Value must be fs.
_time required (number)	_time Example: 1643662126.91777
source required (string)	Source - File Delete Value must be fs.delete.
host required (string)	host
proc required (string)	proc
cmd required (string)	cmd Example: top
pid required (integer)	pid Example: 1000
data required (object)	data Details below.

fs.delete.body.data properties

Property	Description
proc (string)	proc
pid (integer)	pid Example: 1000
host (string)	host
op (string)	op_fs_delete Possible values: unlink unlinkat
file (string)	file
unit (string)	Unit - operation Value must be operation.

---

fs.duration ^

Structure of the fs.duration event

Example

{
  "type": "evt",
  "id": "8bc1398c19f3-accept01-/kernel/syscalls/accept/accept01",
  "_channel": "5890091215105",
  "body": {
    "sourcetype": "metric",
    "_time": 1643735835.455057,
    "source": "fs.duration",
    "host": "8bc1398c19f3",
    "proc": "accept01",
    "cmd": "/opt/test/ltp/testcases/kernel/syscalls/accept/accept01",
    "pid": 1933,
    "data": {
      "_metric": "fs.duration",
      "_metric_type": "histogram",
      "_value": 12,
      "proc": "accept01",
      "pid": 1933,
      "fd": 3,
      "op": "fgets_unlocked",
      "file": "/etc/passwd",
      "numops": 1,
      "unit": "microsecond"
    }
  }
}

fs.duration properties

Property	Description
type required (string)	Distinguishes events from metrics. Value must be evt.
id required (string)	Identifies the application that the process is associated with.
_channel required (string)	Identifies the operation during whose lifetime the event or metric is emitted.
body required (object)	body Details below.

fs.duration.body properties

Property	Description
sourcetype required (string)	Sourcetype - metric Value must be metric.
_time required (number)	_time Example: 1643662126.91777
source required (string)	Source - File Duration Value must be fs.duration.
host required (string)	host
proc required (string)	proc
cmd required (string)	cmd Example: top
pid required (integer)	pid Example: 1000
data required (object)	data Details below.

fs.duration.body.data properties

Property	Description
_metric (string)	Source - File Duration Value must be fs.duration.
_metric_type (string)	histogram Value must be histogram.
_value (number)	_value Example: 1
proc (string)	proc
pid (integer)	pid Example: 1000
fd (integer)	fd Example: 4
op (string)	op
file (string)	file
numops (number)	numops
unit (string)	Unit - microsecond Value must be microsecond.

---

fs.error ^

Structure of the fs.error event

Example

{
  "type": "evt",
  "id": "8bc1398c19f3-accept01-/kernel/syscalls/accept/accept01",
  "_channel": "5890094642989",
  "body": {
    "sourcetype": "metric",
    "_time": 1643735835.45777,
    "source": "fs.error",
    "host": "8bc1398c19f3",
    "proc": "accept01",
    "cmd": "/opt/test/ltp/testcases/kernel/syscalls/accept/accept01",
    "pid": 1931,
    "data": {
      "_metric": "fs.error",
      "_metric_type": "counter",
      "_value": 1,
      "proc": "accept01",
      "pid": 1931,
      "op": "access",
      "file": "/dev/shm/ltp_accept01_1931",
      "class": "stat",
      "unit": "operation"
    }
  }
}

fs.error properties

Property	Description
type required (string)	Distinguishes events from metrics. Value must be evt.
id required (string)	Identifies the application that the process is associated with.
_channel required (string)	Identifies the operation during whose lifetime the event or metric is emitted.
body required (object)	body Details below.

fs.error.body properties

Property	Description
sourcetype required (string)	Sourcetype - metric Value must be metric.
_time required (number)	_time Example: 1643662126.91777
source required (string)	Source - File Error Value must be fs.error.
host required (string)	host
proc required (string)	proc
cmd required (string)	cmd Example: top
pid required (integer)	pid Example: 1000
data required (object)	data Details below.

fs.error.body.data properties

Property	Description
_metric (string)	Source - File Error Value must be fs.error.
_metric_type (string)	counter Value must be counter.
_value (number)	_value Example: 1
proc (string)	proc
pid (integer)	pid Example: 1000
op (string)	op
file (string)	file
class (string)	class fs.error Possible values: open_close read_write stat
unit (string)	Unit - operation Value must be operation.

---

fs.open ^

Structure of the fs.open event

Example

{
  "type": "evt",
  "id": "8bc1398c19f3-accept01-/kernel/syscalls/accept/accept01",
  "_channel": "5890090429747",
  "body": {
    "sourcetype": "fs",
    "_time": 1643735835.454946,
    "source": "fs.open",
    "host": "8bc1398c19f3",
    "proc": "accept01",
    "cmd": "/opt/test/ltp/testcases/kernel/syscalls/accept/accept01",
    "pid": 1933,
    "data": {
      "proc": "accept01",
      "pid": 1933,
      "host": "8bc1398c19f3",
      "file": "/dev/shm/ltp_accept01_1931",
      "proc_uid": 0,
      "proc_gid": 0,
      "proc_cgroup": "0::/system.slice/containerd.service",
      "file_perms": 600,
      "file_owner": 0,
      "file_group": 0,
      "op": "open"
    }
  }
}

fs.open properties

Property	Description
type required (string)	Distinguishes events from metrics. Value must be evt.
id required (string)	Identifies the application that the process is associated with.
_channel required (string)	Identifies the operation during whose lifetime the event or metric is emitted.
body required (object)	body Details below.

fs.open.body properties

Property	Description
sourcetype required (string)	Sourcetype - fs Value must be fs.
_time required (number)	_time Example: 1643662126.91777
source required (string)	Source - File open Value must be fs.open.
host required (string)	host
proc required (string)	proc
cmd required (string)	cmd Example: top
pid required (integer)	pid Example: 1000
data required (object)	data Details below.

fs.open.body.data properties

Property	Description
proc (string)	proc
pid (integer)	pid Example: 1000
host (string)	host
file (string)	file
proc_uid (integer)	proc_uid Example: 0
proc_gid (integer)	proc_gid Example: 0
proc_cgroup (string)	proc_cgroup Example: 0::/user.slice/user-1000.slice/session-3.scope
file_perms (integer)	file_perms Example: 777
file_owner (number)	file_owner Example: 0
file_group (number)	file_group Example: 0
op (string)	op_fs_open Possible values: open openat opendir creat fopen freopen open64 openat64 __open_2 __openat_2 creat64 fopen64 freopen64 recvmsg console output console input

---

fs.read ^

Structure of the fs.read event

Example

{
  "type": "evt",
  "id": "8bc1398c19f3-accept01-/kernel/syscalls/accept/accept01",
  "_channel": "5890091215105",
  "body": {
    "sourcetype": "metric",
    "_time": 1643735835.455076,
    "source": "fs.read",
    "host": "8bc1398c19f3",
    "proc": "accept01",
    "cmd": "/opt/test/ltp/testcases/kernel/syscalls/accept/accept01",
    "pid": 1933,
    "data": {
      "_metric": "fs.read",
      "_metric_type": "histogram",
      "_value": 4096,
      "proc": "accept01",
      "pid": 1933,
      "fd": 3,
      "op": "fgets_unlocked",
      "file": "/etc/passwd",
      "numops": 1,
      "unit": "byte"
    }
  }
}

fs.read properties

Property	Description
type required (string)	Distinguishes events from metrics. Value must be evt.
id required (string)	Identifies the application that the process is associated with.
_channel required (string)	Identifies the operation during whose lifetime the event or metric is emitted.
body required (object)	body Details below.

fs.read.body properties

Property	Description
sourcetype required (string)	Sourcetype - metric Value must be metric.
_time required (number)	_time Example: 1643662126.91777
source required (string)	Source - File Read Value must be fs.read.
host required (string)	host
proc required (string)	proc
cmd required (string)	cmd Example: top
pid required (integer)	pid Example: 1000
data required (object)	data Details below.

fs.read.body.data properties

Property	Description
_metric (string)	Source - File Read Value must be fs.read.
_metric_type (string)	histogram Value must be histogram.
_value (number)	_value Example: 1
proc (string)	proc
pid (integer)	pid Example: 1000
fd (integer)	fd Example: 4
op (string)	op_fs_read Possible values: go_read readdir pread64 preadv preadv2 preadv64v2 __pread_chk __read_chk __fread_unlocked_chk read readv pread fread __fread_chk fread_unlocked fgets __fgets_chk fgets_unlocked __fgetws_chk fgetws fgetwc fgetc fscanf getline getdelim __getdelim
file (string)	file
numops (number)	numops
unit (string)	Unit - byte Value must be byte.

---

fs.seek ^

Structure of the fs.seek event

Example

{
  "type": "evt",
  "id": "8bc1398c19f3-sh-/bin/sh ./file_x",
  "_channel": "5891441789884",
  "body": {
    "sourcetype": "metric",
    "_time": 1643735836.805196,
    "source": "fs.seek",
    "host": "8bc1398c19f3",
    "proc": "sh",
    "cmd": "/bin/sh ./file_x",
    "pid": 2061,
    "data": {
      "_metric": "fs.seek",
      "_metric_type": "counter",
      "_value": 1,
      "proc": "sh",
      "pid": 2061,
      "fd": 3,
      "op": "lseek",
      "file": "./file_x",
      "unit": "operation"
    }
  }
}

fs.seek properties

Property	Description
type required (string)	Distinguishes events from metrics. Value must be evt.
id required (string)	Identifies the application that the process is associated with.
_channel required (string)	Identifies the operation during whose lifetime the event or metric is emitted.
body required (object)	body Details below.

fs.seek.body properties

Property	Description
sourcetype required (string)	Sourcetype - metric Value must be metric.
_time required (number)	_time Example: 1643662126.91777
source required (string)	Source - File Seek Value must be fs.seek.
host required (string)	host
proc required (string)	proc
cmd required (string)	cmd Example: top
pid required (integer)	pid Example: 1000
data required (object)	data Details below.

fs.seek.body.data properties

Property	Description
_metric (string)	Source - File Seek Value must be fs.seek.
_metric_type (string)	counter Value must be counter.
_value (number)	_value Example: 1
proc (string)	proc
pid (integer)	pid Example: 1000
fd (integer)	fd Example: 4
op (string)	op_fs_seek Possible values: lseek64 fseek64 ftello64 fsetpos64 lseek fseek fseeko ftell ftello rewind fsetpos fgetpos fgetpos64
file (string)	file
unit (string)	Unit - operation Value must be operation.

---

fs.stat ^

Structure of the fs.stat event

Example

{
  "type": "evt",
  "id": "8bc1398c19f3-accept01-/kernel/syscalls/accept/accept01",
  "_channel": "5890091777333",
  "body": {
    "sourcetype": "metric",
    "_time": 1643735835.454905,
    "source": "fs.stat",
    "host": "8bc1398c19f3",
    "proc": "accept01",
    "cmd": "/opt/test/ltp/testcases/kernel/syscalls/accept/accept01",
    "pid": 1933,
    "data": {
      "_metric": "fs.stat",
      "_metric_type": "counter",
      "_value": 1,
      "proc": "accept01",
      "pid": 1933,
      "op": "access",
      "file": "/dev/shm",
      "unit": "operation"
    }
  }
}

fs.stat properties

Property	Description
type required (string)	Distinguishes events from metrics. Value must be evt.
id required (string)	Identifies the application that the process is associated with.
_channel required (string)	Identifies the operation during whose lifetime the event or metric is emitted.
body required (object)	body Details below.

fs.stat.body properties

Property	Description
sourcetype required (string)	Sourcetype - metric Value must be metric.
_time required (number)	_time Example: 1643662126.91777
source required (string)	Source - File Stat Value must be fs.stat.
host required (string)	host
proc required (string)	proc
cmd required (string)	cmd Example: top
pid required (integer)	pid Example: 1000
data required (object)	data Details below.

fs.stat.body.data properties

Property	Description
_metric (string)	Source - File Stat Value must be fs.stat.
_metric_type (string)	counter Value must be counter.
_value (number)	_value Example: 1
proc (string)	proc
pid (integer)	pid Example: 1000
op (string)	op_fs_stat Possible values: statfs64 __xstat __xstat64 __lxstat __lxstat64 __fxstat __fxstatat __fxstatat64 statx statfs statvfs statvfs64 access faccessat stat lstat fstatfs64 __fxstat __fxstat64 fstatfs fstatvfs fstatvfs64 fstat fstatat
file (string)	file
unit (string)	Unit - operation Value must be operation.

---

fs.write ^

Structure of the fs.write event

Example

{
  "type": "evt",
  "id": "8bc1398c19f3-access02-/kernel/syscalls/access/access02",
  "_channel": "5891407740765",
  "body": {
    "sourcetype": "metric",
    "_time": 1643735836.773249,
    "source": "fs.write",
    "host": "8bc1398c19f3",
    "proc": "access02",
    "cmd": "/opt/test/ltp/testcases/kernel/syscalls/access/access02",
    "pid": 2058,
    "data": {
      "_metric": "fs.write",
      "_metric_type": "histogram",
      "_value": 10,
      "proc": "access02",
      "pid": 2058,
      "fd": 3,
      "op": "__write_libc",
      "file": "file_x",
      "numops": 1,
      "unit": "byte"
    }
  }
}

fs.write properties

Property	Description
type required (string)	Distinguishes events from metrics. Value must be evt.
id required (string)	Identifies the application that the process is associated with.
_channel required (string)	Identifies the operation during whose lifetime the event or metric is emitted.
body required (object)	body Details below.

fs.write.body properties

Property	Description
sourcetype required (string)	Sourcetype - metric Value must be metric.
_time required (number)	_time Example: 1643662126.91777
source required (string)	Source - File Write Value must be fs.write.
host required (string)	host
proc required (string)	proc
cmd required (string)	cmd Example: top
pid required (integer)	pid Example: 1000
data required (object)	data Details below.

fs.write.body.data properties

Property	Description
_metric (string)	Source - File Write Value must be fs.write.
_metric_type (string)	histogram Value must be histogram.
_value (number)	_value Example: 1
proc (string)	proc
pid (integer)	pid Example: 1000
fd (integer)	fd Example: 4
op (string)	op_fs_write Possible values: go_write pwrite64 pwritev pwritev64 pwritev2 pwritev64v2 __overflow __write_libc __write_pthread fwrite_unlocked __stdio_write write pwrite writev fwrite puts putchar fputs fputs_unlocked fputc fputc_unlocked putwc fputwc
file (string)	file
numops (number)	numops
unit (string)	Unit - byte Value must be byte.

---

http.req ^

Structure of the http.req event

Example

{
  "type": "evt",
  "id": "ubuntu-firefox-/usr/lib/firefox/firefox",
  "_channel": "13470846442500",
  "body": {
    "sourcetype": "http",
    "_time": 1643735942.588626,
    "source": "http.req",
    "host": "ubuntu",
    "proc": "firefox",
    "cmd": "/usr/lib/firefox/firefox",
    "pid": 6544,
    "data": {
      "http_method": "GET",
      "http_target": "/canonical.html",
      "http_flavor": "1.1",
      "http_scheme": "http",
      "http_host": "detectportal.firefox.com",
      "http_user_agent": "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0",
      "net_transport": "IP.TCP",
      "net_peer_ip": "34.107.221.82",
      "net_peer_port": 80,
      "net_host_ip": "172.16.198.210",
      "net_host_port": 33712
    }
  }
}

http.req properties

Property	Description
type required (string)	Distinguishes events from metrics. Value must be evt.
id required (string)	Identifies the application that the process is associated with.
_channel required (string)	Identifies the operation during whose lifetime the event or metric is emitted.
body required (object)	body Details below.

http.req.body properties

Property	Description
sourcetype required (string)	Sourcetype - http Value must be http.
_time required (number)	_time Example: 1643662126.91777
source required (string)	Source - HTTP request Value must be http.req.
host required (string)	host
proc required (string)	proc
cmd required (string)	cmd Example: top
pid required (integer)	pid Example: 1000
data required (object)	data Details below.

http.req.body.data properties

Property	Description
http_method (string)	http_method
http_frame (string)	http_frame Possible values: HEADERS PUSH_PROMISE
http_target (string)	http_target
http_flavor (string)	http_flavor
http_stream (integer)	http_stream
http_scheme (string)	http_scheme Possible values: http https
http_host (string)	http_host
http_user_agent (string)	http_user_agent
http_client_ip (string)	http_client_ip
net_transport (string)	net_transport Possible values: IP.TCP IP.UDP IP.RAW IP.RDM IP.SEQPACKET Unix.TCP Unix.UDP Unix.RAW Unix.RDM Unix.SEQPACKET
net_peer_ip (string)	net_peer_ip
net_peer_port (integer)	net_peer_port
net_host_ip (string)	net_host_ip
net_host_port (integer)	net_host_port
x_appscope (string)	x-appscope Value must be x-appscope.

---

http.resp ^

Structure of the http.resp event

Example

{
  "type": "evt",
  "id": "ubuntu-firefox-/usr/lib/firefox/firefox",
  "_channel": "13470846442500",
  "body": {
    "sourcetype": "http",
    "_time": 1643735942.613892,
    "source": "http.resp",
    "host": "ubuntu",
    "proc": "firefox",
    "cmd": "/usr/lib/firefox/firefox",
    "pid": 6544,
    "data": {
      "http_method": "GET",
      "http_target": "/canonical.html",
      "http_scheme": "http",
      "http_flavor": "1.1",
      "http_status_code": 200,
      "http_status_text": "OK",
      "http_server_duration": 26,
      "http_host": "detectportal.firefox.com",
      "http_user_agent": "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0",
      "net_transport": "IP.TCP",
      "net_peer_ip": "34.107.221.82",
      "net_peer_port": 80,
      "net_host_ip": "172.16.198.210",
      "net_host_port": 33712,
      "http_response_content_length": 90
    }
  }
}

http.resp properties

Property	Description
type required (string)	Distinguishes events from metrics. Value must be evt.
id required (string)	Identifies the application that the process is associated with.
_channel required (string)	Identifies the operation during whose lifetime the event or metric is emitted.
body required (object)	body Details below.

http.resp.body properties

Property	Description
sourcetype required (string)	Sourcetype - http Value must be http.
_time required (number)	_time Example: 1643662126.91777
source required (string)	Source - HTTP response Value must be http.resp.
host required (string)	host
proc required (string)	proc
cmd required (string)	cmd Example: top
pid required (integer)	pid Example: 1000
data required (object)	data Details below.

http.resp.body.data properties

Property	Description
http_method (string)	http_method
http_target (string)	http_target
http_stream (integer)	http_stream
http_scheme (string)	http_scheme Possible values: http https
http_flavor (string)	http_flavor
http_status_code (integer)	http_status_code Possible values: 100 101 102 200 201 202 203 204 205 206 207 208 226 300 301 302 303 304 305 307 400 401 402 403 404 405 406 407 408 409 410 411 412 413 414 415 416 417 418 421 422 423 424 426 428 429 431 444 451 499 500 501 502 503 504 505 506 507
http_status_text (string)	http_status_text Possible values: Continue Switching Protocols Processing OK Created Accepted Non-authoritative Information No Content Reset Content Partial Content Multi-Status Already Reported IM Used Multiple Choices Moved Permanently Found See Other Not Modified Use Proxy Temporary Redirect Permanent Redirect Bad Request Unauthorized Payment Required Forbidden Not Found Method Not Allowed Not Acceptable Proxy Authentication Required Request Timeout Conflict Gone Length Required Precondition Failed Payload Too Large Request-URI Too Long Unsupported Media Type Requested Range Not Satisfiable Expectation Failed I'm a teapot Misdirected Request Unprocessable Entity Locked Failed Dependency Upgrade Required Precondition Required Too Many Requests Request Header Fields Too Large Connection Closed Without Response Unavailable For Legal Reasons Client Closed Request Internal Server Error Not Implemented Bad Gateway Service Unavailable Gateway Timeout HTTP Version Not Supported Variant Also Negotiates Insufficient Storage
http_client_duration (number)	http_client_duration
http_server_duration (number)	http_server_duration
http_host (string)	http_host
http_user_agent (string)	http_user_agent
net_transport (string)	net_transport Possible values: IP.TCP IP.UDP IP.RAW IP.RDM IP.SEQPACKET Unix.TCP Unix.UDP Unix.RAW Unix.RDM Unix.SEQPACKET
net_peer_ip (string)	net_peer_ip
net_peer_port (integer)	net_peer_port
net_host_ip (string)	net_host_ip
net_host_port (integer)	net_host_port
http_response_content_length (number)	http_response_content_length

---

net.app ^

Structure of the net.app event

Example

{
  "type": "evt",
  "id": "ubuntu-firefox-/usr/lib/firefox/firefox",
  "_channel": "13470846442500",
  "body": {
    "sourcetype": "net",
    "_time": 1643735942.588594,
    "source": "net.app",
    "host": "ubuntu",
    "proc": "firefox",
    "cmd": "/usr/lib/firefox/firefox",
    "pid": 6544,
    "data": {
      "proc": "firefox",
      "pid": 6544,
      "fd": 91,
      "host": "ubuntu",
      "protocol": "HTTP"
    }
  }
}

net.app properties

Property	Description
type required (string)	Distinguishes events from metrics. Value must be evt.
id required (string)	Identifies the application that the process is associated with.
_channel required (string)	Identifies the operation during whose lifetime the event or metric is emitted.
body required (object)	body Details below.

net.app.body properties

Property	Description
sourcetype required (string)	Sourcetype - net Value must be net.
_time required (number)	_time Example: 1643662126.91777
source required (string)	Source - Net App Value must be net.app.
host required (string)	host
proc required (string)	proc
cmd required (string)	cmd Example: top
pid required (integer)	pid Example: 1000
data required (object)	data Details below.

net.app.body.data properties

Property	Description
proc (string)	proc
pid (integer)	pid Example: 1000
fd (integer)	fd Example: 4
host (string)	host
protocol (string)	protocol Possible values: HTTP

---

net.close ^

Structure of the net.close event

Example

{
  "type": "evt",
  "id": "8bc1398c19f3-recvfrom01-nel/syscalls/recvfrom/recvfrom01",
  "_channel": "5912618970557",
  "body": {
    "sourcetype": "net",
    "_time": 1643735857.983449,
    "source": "net.close",
    "host": "8bc1398c19f3",
    "proc": "recvfrom01",
    "cmd": "/opt/test/ltp/testcases/kernel/syscalls/recvfrom/recvfrom01",
    "pid": 3793,
    "data": {
      "net_transport": "IP.TCP",
      "net_peer_ip": "0.0.0.0",
      "net_peer_port": 35533,
      "net_host_ip": "127.0.0.1",
      "net_host_port": 40184,
      "duration": 0,
      "net_bytes_sent": 0,
      "net_bytes_recv": 6,
      "net_close_reason": "local"
    }
  }
}

net.close properties

Property	Description
type required (string)	Distinguishes events from metrics. Value must be evt.
id required (string)	Identifies the application that the process is associated with.
_channel required (string)	Identifies the operation during whose lifetime the event or metric is emitted.
body required (object)	body Details below.

net.close.body properties

Property	Description
sourcetype required (string)	Sourcetype - net Value must be net.
_time required (number)	_time Example: 1643662126.91777
source required (string)	Source - Net Close Value must be net.close.
host required (string)	host
proc required (string)	proc
cmd required (string)	cmd Example: top
pid required (integer)	pid Example: 1000
data required (object)	data Details below.

net.close.body.data properties

Property	Description
net_transport (string)	net_transport Possible values: IP.TCP IP.UDP IP.RAW IP.RDM IP.SEQPACKET Unix.TCP Unix.UDP Unix.RAW Unix.RDM Unix.SEQPACKET
net_peer_ip (string)	net_peer_ip
net_peer_port (integer)	net_peer_port
net_host_ip (string)	net_host_ip
net_host_port (integer)	net_host_port
net_protocol (string)	net_protocol Value must be http.
unix_peer_inode (number)	unix_peer_inode
unix_local_inode (number)	unix_local_inode
duration (number)	duration Example: 55
net_bytes_sent (number)	net_bytes_sent
net_bytes_recv (number)	net_bytes_recv
net_close_reason (string)	net_close_reason Possible values: local remote

---

net.duration ^

Structure of the net.duration event

Example

{
  "type": "evt",
  "id": "8bc1398c19f3-recvmsg01-ernel/syscalls/recvmsg/recvmsg01",
  "_channel": "5912681876432",
  "body": {
    "sourcetype": "metric",
    "_time": 1643735858.046756,
    "source": "net.duration",
    "host": "8bc1398c19f3",
    "proc": "recvmsg01",
    "cmd": "/opt/test/ltp/testcases/kernel/syscalls/recvmsg/recvmsg01",
    "pid": 3798,
    "data": {
      "_metric": "net.duration",
      "_metric_type": "timer",
      "_value": 1,
      "proc": "recvmsg01",
      "pid": 3798,
      "fd": 4,
      "proto": "TCP",
      "port": 41482,
      "numops": 1,
      "unit": "millisecond"
    }
  }
}

net.duration properties

Property	Description
type required (string)	Distinguishes events from metrics. Value must be evt.
id required (string)	Identifies the application that the process is associated with.
_channel required (string)	Identifies the operation during whose lifetime the event or metric is emitted.
body required (object)	body Details below.

net.duration.body properties

Property	Description
sourcetype required (string)	Sourcetype - metric Value must be metric.
_time required (number)	_time Example: 1643662126.91777
source required (string)	Source - Net duration Value must be net.duration.
host required (string)	host
proc required (string)	proc
cmd required (string)	cmd Example: top
pid required (integer)	pid Example: 1000
data required (object)	data Details below.

net.duration.body.data properties

Property	Description
_metric (string)	Source - Net duration Value must be net.duration.
_metric_type (string)	timer Value must be timer.
_value (number)	_value Example: 1
proc (string)	proc
pid (integer)	pid Example: 1000
fd (integer)	fd Example: 4
proto (string)	proto Possible values: TCP UDP RAW RDM SEQPACKET OTHER
port (number)	port
numops (number)	numops
unit (string)	Unit - millisecond Value must be millisecond.

---

net.error ^

Structure of the net.error event

Example

{
  "type": "evt",
  "id": "90aac4bb0722-accept01-/kernel/syscalls/accept/accept01",
  "_channel": "2745569202700291",
  "body": {
    "sourcetype": "metric",
    "_time": 1643972258.00885,
    "source": "net.error",
    "host": "90aac4bb0722",
    "proc": "accept01",
    "cmd": "/opt/test/ltp/testcases/kernel/syscalls/accept/accept01",
    "pid": 1934,
    "data": {
      "_metric": "net.error",
      "_metric_type": "counter",
      "_value": 1,
      "proc": "accept01",
      "pid": 1934,
      "op": "accept",
      "class": "connection",
      "unit": "operation"
    }
  }
}

net.error properties

Property	Description
type required (string)	Distinguishes events from metrics. Value must be evt.
id required (string)	Identifies the application that the process is associated with.
_channel required (string)	Identifies the operation during whose lifetime the event or metric is emitted.
body required (object)	body Details below.

net.error.body properties

Property	Description
sourcetype required (string)	Sourcetype - metric Value must be metric.
_time required (number)	_time Example: 1643662126.91777
source required (string)	Source - Net Error Value must be net.error.
host required (string)	host
proc required (string)	proc
cmd required (string)	cmd Example: top
pid required (integer)	pid Example: 1000
data required (object)	data Details below.

net.error.body.data properties

Property	Description
_metric (string)	Source - Net Error Value must be net.error.
_metric_type (string)	counter Value must be counter.
_value (number)	_value Example: 1
proc (string)	proc
pid (integer)	pid Example: 1000
op (string)	op
class (string)	connection Value must be connection.
unit (string)	Unit - operation Value must be operation.

---

net.open ^

Structure of the net.open event

Example

{
  "type": "evt",
  "id": "8bc1398c19f3-accept02-/kernel/syscalls/accept/accept02",
  "_channel": "5890157346952",
  "body": {
    "sourcetype": "net",
    "_time": 1643735835.521928,
    "source": "net.open",
    "host": "8bc1398c19f3",
    "proc": "accept02",
    "cmd": "/opt/test/ltp/testcases/kernel/syscalls/accept/accept02",
    "pid": 1936,
    "data": {
      "net_transport": "IP.TCP",
      "net_peer_ip": "127.0.0.1",
      "net_peer_port": 58625,
      "net_host_ip": "0.0.0.0",
      "net_host_port": 0
    }
  }
}

net.open properties

Property	Description
type required (string)	Distinguishes events from metrics. Value must be evt.
id required (string)	Identifies the application that the process is associated with.
_channel required (string)	Identifies the operation during whose lifetime the event or metric is emitted.
body required (object)	body Details below.

net.open.body properties

Property	Description
sourcetype required (string)	Sourcetype - net Value must be net.
_time required (number)	_time Example: 1643662126.91777
source required (string)	Source - Net Open Value must be net.open.
host required (string)	host
proc required (string)	proc
cmd required (string)	cmd Example: top
pid required (integer)	pid Example: 1000
data required (object)	data Details below.

net.open.body.data properties

Property	Description
net_transport (string)	net_transport Possible values: IP.TCP IP.UDP IP.RAW IP.RDM IP.SEQPACKET Unix.TCP Unix.UDP Unix.RAW Unix.RDM Unix.SEQPACKET
net_peer_ip (string)	net_peer_ip
net_peer_port (integer)	net_peer_port
net_host_ip (string)	net_host_ip
net_host_port (integer)	net_host_port
unix_peer_inode (number)	unix_peer_inode
unix_local_inode (number)	unix_local_inode
net_protocol (string)	net_protocol Value must be http.

---

net.other ^

Structure of the net.other event

Example

{
  "type": "evt",
  "id": "test_user-server_seqpacket-./server_seqpacket",
  "_channel": "11977632602680",
  "body": {
    "sourcetype": "metric",
    "_time": 1643886739.820863,
    "source": "net.other",
    "host": "test_user",
    "proc": "server_seqpacket",
    "cmd": "./server_seqpacket",
    "pid": 232570,
    "data": {
      "_metric": "net.other",
      "_metric_type": "gauge",
      "_value": 1,
      "proc": "server_seqpacket",
      "pid": 232570,
      "fd": 3,
      "proto": "SEQPACKET",
      "port": 0,
      "unit": "connection"
    }
  }
}

net.other properties

Property	Description
type required (string)	Distinguishes events from metrics. Value must be evt.
id required (string)	Identifies the application that the process is associated with.
_channel required (string)	Identifies the operation during whose lifetime the event or metric is emitted.
body required (object)	body Details below.

net.other.body properties

Property	Description
sourcetype required (string)	Sourcetype - metric Value must be metric.
_time required (number)	_time Example: 1643662126.91777
source required (string)	Source - Net other Value must be net.other.
host required (string)	host
proc required (string)	proc
cmd required (string)	cmd Example: top
pid required (integer)	pid Example: 1000
data required (object)	data Details below.

net.other.body.data properties

Property	Description
_metric (string)	Source - Net other Value must be net.other.
_metric_type (string)	gauge Value must be gauge.
_value (number)	_value Example: 1
proc (string)	proc
pid (integer)	pid Example: 1000
fd (integer)	fd Example: 4
proto (string)	proto Possible values: TCP UDP RAW RDM SEQPACKET OTHER
port (number)	port
unit (string)	Unit - connection Value must be connection.

---

net.port ^

Structure of the net.port event

Example

{
  "type": "evt",
  "id": "8bc1398c19f3-accept01-/kernel/syscalls/accept/accept01",
  "_channel": "5890091645261",
  "body": {
    "sourcetype": "metric",
    "_time": 1643735835.455222,
    "source": "net.port",
    "host": "8bc1398c19f3",
    "proc": "accept01",
    "cmd": "/opt/test/ltp/testcases/kernel/syscalls/accept/accept01",
    "pid": 1933,
    "data": {
      "_metric": "net.port",
      "_metric_type": "gauge",
      "_value": 1,
      "proc": "accept01",
      "pid": 1933,
      "fd": 4,
      "proto": "TCP",
      "port": 0,
      "unit": "instance"
    }
  }
}

net.port properties

Property	Description
type required (string)	Distinguishes events from metrics. Value must be evt.
id required (string)	Identifies the application that the process is associated with.
_channel required (string)	Identifies the operation during whose lifetime the event or metric is emitted.
body required (object)	body Details below.

net.port.body properties

Property	Description
sourcetype required (string)	Sourcetype - metric Value must be metric.
_time required (number)	_time Example: 1643662126.91777
source required (string)	Source - Net port Value must be net.port.
host required (string)	host
proc required (string)	proc
cmd required (string)	cmd Example: top
pid required (integer)	pid Example: 1000
data required (object)	data Details below.

net.port.body.data properties

Property	Description
_metric (string)	Source - Net port Value must be net.port.
_metric_type (string)	gauge Value must be gauge.
_value (number)	_value Example: 1
proc (string)	proc
pid (integer)	pid Example: 1000
fd (integer)	fd Example: 4
proto (string)	proto Possible values: TCP UDP RAW RDM SEQPACKET OTHER
port (number)	port
unit (string)	Unit - instance Value must be instance.

---

net.rx ^

Structure of the net.rx event

Example

{
  "type": "evt",
  "id": "8bc1398c19f3-recvfrom01-nel/syscalls/recvfrom/recvfrom01",
  "_channel": "5912618970557",
  "body": {
    "sourcetype": "metric",
    "_time": 1643735857.983368,
    "source": "net.rx",
    "host": "8bc1398c19f3",
    "proc": "recvfrom01",
    "cmd": "/opt/test/ltp/testcases/kernel/syscalls/recvfrom/recvfrom01",
    "pid": 3793,
    "data": {
      "_metric": "net.rx",
      "_metric_type": "counter",
      "_value": 6,
      "proc": "recvfrom01",
      "pid": 3793,
      "fd": 4,
      "domain": "AF_INET",
      "proto": "TCP",
      "localip": "127.0.0.1",
      "localp": 40184,
      "remoteip": "0.0.0.0",
      "remotep": 35533,
      "data": "clear",
      "numops": 1,
      "unit": "byte"
    }
  }
}

net.rx properties

Property	Description
type required (string)	Distinguishes events from metrics. Value must be evt.
id required (string)	Identifies the application that the process is associated with.
_channel required (string)	Identifies the operation during whose lifetime the event or metric is emitted.
body required (object)	body Details below.

net.rx.body properties

Property	Description
sourcetype required (string)	Sourcetype - metric Value must be metric.
_time required (number)	_time Example: 1643662126.91777
source required (string)	Source - Net RX Value must be net.rx.
host required (string)	host
proc required (string)	proc
cmd required (string)	cmd Example: top
pid required (integer)	pid Example: 1000
data required (object)	data Details below.

net.rx.body.data properties

Property	Description
_metric (string)	Source - Net RX Value must be net.rx.
_metric_type (string)	counter Value must be counter.
_value (number)	_value Example: 1
proc (string)	proc
pid (integer)	pid Example: 1000
fd (integer)	fd Example: 4
domain (string)	domain
proto (string)	proto Possible values: TCP UDP RAW RDM SEQPACKET OTHER
localip (string)	localip Example: 127.0.0.1
localp (number)	localp Example: 9109
localn (number)	localn
remoteip (string)	remoteip Example: 192.158.1.38
remotep (number)	remotep Example: 9108
remoten (number)	remoten
data (string)	data Possible values: ssl clear
numops (number)	numops
unit (string)	Unit - byte Value must be byte.

---

net.tcp ^

Structure of the net.tcp event

Example

{
  "type": "evt",
  "id": "8bc1398c19f3-accept01-/kernel/syscalls/accept/accept01",
  "_channel": "5890091645261",
  "body": {
    "sourcetype": "metric",
    "_time": 1643735835.455387,
    "source": "net.tcp",
    "host": "8bc1398c19f3",
    "proc": "accept01",
    "cmd": "/opt/test/ltp/testcases/kernel/syscalls/accept/accept01",
    "pid": 1933,
    "data": {
      "_metric": "net.tcp",
      "_metric_type": "gauge",
      "_value": 0,
      "proc": "accept01",
      "pid": 1933,
      "fd": 4,
      "proto": "TCP",
      "port": 0,
      "unit": "connection"
    }
  }
}

net.tcp properties

Property	Description
type required (string)	Distinguishes events from metrics. Value must be evt.
id required (string)	Identifies the application that the process is associated with.
_channel required (string)	Identifies the operation during whose lifetime the event or metric is emitted.
body required (object)	body Details below.

net.tcp.body properties

Property	Description
sourcetype required (string)	Sourcetype - metric Value must be metric.
_time required (number)	_time Example: 1643662126.91777
source required (string)	Source - Net tcp Value must be net.tcp.
host required (string)	host
proc required (string)	proc
cmd required (string)	cmd Example: top
pid required (integer)	pid Example: 1000
data required (object)	data Details below.

net.tcp.body.data properties

Property	Description
_metric (string)	Source - Net tcp Value must be net.tcp.
_metric_type (string)	gauge Value must be gauge.
_value (number)	_value Example: 1
proc (string)	proc
pid (integer)	pid Example: 1000
fd (integer)	fd Example: 4
proto (string)	proto_tcp Value must be TCP.
port (number)	port
unit (string)	Unit - connection Value must be connection.

---

net.tx ^

Structure of the net.tx event

Example

{
  "type": "evt",
  "id": "8bc1398c19f3-recvfrom01-nel/syscalls/recvfrom/recvfrom01",
  "_channel": "5912618642035",
  "body": {
    "sourcetype": "metric",
    "_time": 1643735857.983059,
    "source": "net.tx",
    "host": "8bc1398c19f3",
    "proc": "recvfrom01",
    "cmd": "/opt/test/ltp/testcases/kernel/syscalls/recvfrom/recvfrom01",
    "pid": 3795,
    "data": {
      "_metric": "net.tx",
      "_metric_type": "counter",
      "_value": 6,
      "proc": "recvfrom01",
      "pid": 3795,
      "fd": 4,
      "domain": "AF_INET",
      "proto": "TCP",
      "localip": "0.0.0.0",
      "localp": 0,
      "remoteip": "127.0.0.1",
      "remotep": 40184,
      "data": "clear",
      "numops": 1,
      "unit": "byte"
    }
  }
}

net.tx properties

Property	Description
type required (string)	Distinguishes events from metrics. Value must be evt.
id required (string)	Identifies the application that the process is associated with.
_channel required (string)	Identifies the operation during whose lifetime the event or metric is emitted.
body required (object)	body Details below.

net.tx.body properties

Property	Description
sourcetype required (string)	Sourcetype - metric Value must be metric.
_time required (number)	_time Example: 1643662126.91777
source required (string)	Source - Net TX Value must be net.tx.
host required (string)	host
proc required (string)	proc
cmd required (string)	cmd Example: top
pid required (integer)	pid Example: 1000
data required (object)	data Details below.

net.tx.body.data properties

Property	Description
_metric (string)	Source - Net TX Value must be net.tx.
_metric_type (string)	counter Value must be counter.
_value (number)	_value Example: 1
proc (string)	proc
pid (integer)	pid Example: 1000
fd (integer)	fd Example: 4
domain (string)	domain
proto (string)	proto Possible values: TCP UDP RAW RDM SEQPACKET OTHER
localip (string)	localip Example: 127.0.0.1
localp (number)	localp Example: 9109
localn (number)	localn
remoteip (string)	remoteip Example: 192.158.1.38
remotep (number)	remotep Example: 9108
remoten (number)	remoten
data (string)	data Possible values: ssl clear
numops (number)	numops
unit (string)	Unit - byte Value must be byte.

---

net.udp ^

Structure of the net.udp event

Example

{
  "type": "evt",
  "id": "8bc1398c19f3-accept01-/kernel/syscalls/accept/accept01",
  "_channel": "5890091656419",
  "body": {
    "sourcetype": "metric",
    "_time": 1643735835.455419,
    "source": "net.udp",
    "host": "8bc1398c19f3",
    "proc": "accept01",
    "cmd": "/opt/test/ltp/testcases/kernel/syscalls/accept/accept01",
    "pid": 1933,
    "data": {
      "_metric": "net.udp",
      "_metric_type": "gauge",
      "_value": 0,
      "proc": "accept01",
      "pid": 1933,
      "fd": 5,
      "proto": "UDP",
      "port": 0,
      "unit": "connection"
    }
  }
}

net.udp properties

Property	Description
type required (string)	Distinguishes events from metrics. Value must be evt.
id required (string)	Identifies the application that the process is associated with.
_channel required (string)	Identifies the operation during whose lifetime the event or metric is emitted.
body required (object)	body Details below.

net.udp.body properties

Property	Description
sourcetype required (string)	Sourcetype - metric Value must be metric.
_time required (number)	_time Example: 1643662126.91777
source required (string)	Source - Net udp Value must be net.udp.
host required (string)	host
proc required (string)	proc
cmd required (string)	cmd Example: top
pid required (integer)	pid Example: 1000
data required (object)	data Details below.

net.udp.body.data properties

Property	Description
_metric (string)	Source - Net udp Value must be net.udp.
_metric_type (string)	gauge Value must be gauge.
_value (number)	_value Example: 1
proc (string)	proc
pid (integer)	pid Example: 1000
fd (integer)	fd Example: 4
proto (string)	proto_udp Value must be UDP.
port (number)	port
unit (string)	Unit - connection Value must be connection.

---

notice ^

Structure of the notice event

Example

{
  "type": "evt",
  "id": "9a721a6ad0be-htop-htop",
  "_channel": "13544129471303",
  "body": {
    "sourcetype": "metric",
    "_time": 1643888296.317304,
    "source": "notice",
    "host": "9a721a6ad0be",
    "proc": "htop",
    "cmd": "htop",
    "pid": 302,
    "data": "Truncated metrics. Your rate exceeded 10000 metrics per second"
  }
}

notice properties

Property	Description
type required (string)	Distinguishes events from metrics. Value must be evt.
id required (string)	Identifies the application that the process is associated with.
_channel required (string)	Identifies the operation during whose lifetime the event or metric is emitted.
body required (object)	body Details below.

notice.body properties

Property	Description
sourcetype required (string)	Sourcetype - metric Value must be metric.
_time required (number)	_time Example: 1643662126.91777
source required (string)	Source - notice Value must be notice.
host required (string)	host
proc required (string)	proc
cmd required (string)	cmd Example: top
pid required (integer)	pid Example: 1000
data required (string)	data

---

console ^

Structure of the console event

Example

{
  "type": "evt",
  "id": "eaf4d0598443-a.out-./a.out",
  "_channel": "8499188821284",
  "body": {
    "sourcetype": "console",
    "_time": 1643883251.376672,
    "source": "stderr",
    "host": "eaf4d0598443",
    "proc": "a.out",
    "cmd": "./a.out",
    "pid": 986,
    "data": {
      "message": "stderr hello world"
    }
  }
}

console properties

Property	Description
type required (string)	Distinguishes events from metrics. Value must be evt.
id required (string)	Identifies the application that the process is associated with.
_channel required (string)	Identifies the operation during whose lifetime the event or metric is emitted.
body required (object)	body Details below.

console.body properties

Property	Description
sourcetype required (string)	Sourcetype - console Value must be console.
_time required (number)	_time Example: 1643662126.91777
source required (string)	Specifies whether AppScope is capturing either stderr or file from console. Value must be stderr or file.
host required (string)	host
proc required (string)	proc
cmd required (string)	cmd Example: top
pid required (integer)	pid Example: 1000
data required (object)	data Details below.

console.body.data properties

Property	Description
message (string)	message

---

file ^

Structure of the file event

Example

{
  "type": "evt",
  "id": "ubuntu-sh- /usr/bin/which /usr/bin/firefox",
  "_channel": "13468365092424",
  "body": {
    "sourcetype": "file",
    "_time": 1643735941.602952,
    "source": "/var/log/firefox.log",
    "host": "ubuntu",
    "proc": "sh",
    "cmd": "/bin/sh /usr/bin/which /usr/bin/firefox",
    "pid": 6545,
    "data": {
      "message": "/usr/bin/firefox\n"
    }
  }
}

file properties

Property	Description
type required (string)	Distinguishes events from metrics. Value must be evt.
id required (string)	Identifies the application that the process is associated with.
_channel required (string)	Identifies the operation during whose lifetime the event or metric is emitted.
body required (object)	body Details below.

file.body properties

Property	Description
sourcetype required (string)	Sourcetype - file Value must be file.
_time required (number)	_time Example: 1643662126.91777
source required (string)	String that describes a file path.
host required (string)	host
proc required (string)	proc
cmd required (string)	cmd Example: top
pid required (integer)	pid Example: 1000
data required (object)	data Details below.

file.body.data properties

Property	Description
message (string)	message

---

fs.close ^

Structure of the fs.close metric

Examples

{
  "type": "metric",
  "body": {
    "_metric": "fs.close",
    "_metric_type": "counter",
    "_value": 1,
    "proc": "accept01",
    "pid": 13687,
    "host": "1f0ec6c8a7bc",
    "unit": "operation",
    "summary": "true",
    "_time": 1643826403.121424
  }
}

{
  "type": "metric",
  "body": {
    "_metric": "fs.close",
    "_metric_type": "counter",
    "_value": 1,
    "proc": "accept01",
    "pid": 9871,
    "fd": 3,
    "host": "1f0ec6c8a7bc",
    "op": "close",
    "file": "/dev/shm/ltp_accept01_9870",
    "unit": "operation",
    "_time": 1643826292.07658
  }
}

fs.close properties

Property	Description
type required (string)	Distinguishes metrics from events. Value must be metric.
body required (object)	body Details below.

fs.close.body properties

Property	Description
_metric required (string)	Source - File Close Value must be fs.close.
_metric_type required (string)	counter Value must be counter.
_value required (number)	_value Example: 1
proc required (string)	proc
pid required (integer)	pid Example: 1000
fd (integer)	fd Example: 4
host required (string)	host
op (string)	op_fs_close Possible values: go_close closedir freopen freopen64 close fclose close$NOCANCEL guarded_close_np close_nocancel
file (string)	file
unit required (string)	Unit - operation Value must be operation.
summary (string)	summary Value must be true.
_time required (number)	_time Example: 1643662126.91777

---

fs.duration ^

Structure of the fs.duration metric

Examples

{
  "type": "metric",
  "body": {
    "_metric": "fs.duration",
    "_metric_type": "histogram",
    "_value": 1,
    "proc": "access01",
    "pid": 13697,
    "host": "1f0ec6c8a7bc",
    "unit": "microsecond",
    "summary": "true",
    "_time": 1643826404.006442
  }
}

{
  "type": "metric",
  "body": {
    "_metric": "fs.duration",
    "_metric_type": "histogram",
    "_value": 16,
    "proc": "accept01",
    "pid": 9871,
    "fd": 3,
    "host": "1f0ec6c8a7bc",
    "op": "fgets_unlocked",
    "file": "/etc/passwd",
    "numops": 1,
    "unit": "microsecond",
    "_time": 1643826292.076675
  }
}

fs.duration properties

Property	Description
type required (string)	Distinguishes metrics from events. Value must be metric.
body required (object)	body Details below.

fs.duration.body properties

Property	Description
_metric required (string)	Source - File Duration Value must be fs.duration.
_metric_type required (string)	histogram Value must be histogram.
_value required (number)	_value Example: 1
proc required (string)	proc
pid required (integer)	pid Example: 1000
fd (integer)	fd Example: 4
host required (string)	host
op (string)	op
file (string)	file
numops (number)	numops
unit required (string)	Unit - microsecond Value must be microsecond.
summary (string)	summary Value must be true.
_time required (number)	_time Example: 1643662126.91777

---

fs.error ^

Structure of the fs.error metric

Examples

{
  "type": "metric",
  "body": {
    "_metric": "fs.error",
    "_metric_type": "counter",
    "_value": 1,
    "proc": "accept01",
    "pid": 13686,
    "host": "1f0ec6c8a7bc",
    "class": "stat",
    "unit": "operation",
    "summary": "true",
    "_time": 1643826403.123802
  }
}

{
  "type": "metric",
  "body": {
    "_metric": "fs.error",
    "_metric_type": "counter",
    "_value": 1,
    "proc": "accept02",
    "pid": 9872,
    "host": "1f0ec6c8a7bc",
    "op": "readdir",
    "file": "/tmp/QxbCjC",
    "class": "read_write",
    "unit": "operation",
    "_time": 1643826292.14466
  }
}

fs.error properties

Property	Description
type required (string)	Distinguishes metrics from events. Value must be metric.
body required (object)	body Details below.

fs.error.body properties

Property	Description
_metric required (string)	Source - File Error Value must be fs.error.
_metric_type required (string)	counter Value must be counter.
_value required (number)	_value Example: 1
proc required (string)	proc
pid required (integer)	pid Example: 1000
host required (string)	host
op (string)	op
file (string)	file
class required (string)	class fs.error Possible values: open_close read_write stat
unit required (string)	Unit - operation Value must be operation.
summary (string)	summary Value must be true.
_time required (number)	_time Example: 1643662126.91777

---

fs.open ^

Structure of the fs.open metric

Examples

{
  "type": "metric",
  "body": {
    "_metric": "fs.open",
    "_metric_type": "counter",
    "_value": 1,
    "proc": "accept01",
    "pid": 13687,
    "host": "1f0ec6c8a7bc",
    "unit": "operation",
    "summary": "true",
    "_time": 1643826403.121411
  }
}

{
  "type": "metric",
  "body": {
    "_metric": "fs.open",
    "_metric_type": "counter",
    "_value": 1,
    "proc": "accept01",
    "pid": 9871,
    "fd": 3,
    "host": "1f0ec6c8a7bc",
    "op": "open",
    "file": "/dev/shm/ltp_accept01_9870",
    "unit": "operation",
    "_time": 1643826292.076503
  }
}

fs.open properties

Property	Description
type required (string)	Distinguishes metrics from events. Value must be metric.
body required (object)	body Details below.

fs.open.body properties

Property	Description
_metric required (string)	Source - File open Value must be fs.open.
_metric_type required (string)	counter Value must be counter.
_value required (number)	_value Example: 1
proc required (string)	proc
pid required (integer)	pid Example: 1000
fd (integer)	fd Example: 4
host required (string)	host
op (string)	op_fs_open Possible values: open openat opendir creat fopen freopen open64 openat64 __open_2 __openat_2 creat64 fopen64 freopen64 recvmsg console output console input
file (string)	file
unit required (string)	Unit - operation Value must be operation.
summary (string)	summary Value must be true.
_time required (number)	_time Example: 1643662126.91777

---

fs.read ^

Structure of the fs.read metric

Examples

{
  "type": "metric",
  "body": {
    "_metric": "fs.read",
    "_metric_type": "counter",
    "_value": 13312,
    "proc": "access01",
    "pid": 13697,
    "host": "1f0ec6c8a7bc",
    "unit": "byte",
    "summary": "true",
    "_time": 1643826404.006381
  }
}

{
  "type": "metric",
  "body": {
    "_metric": "fs.read",
    "_metric_type": "counter",
    "_value": 4096,
    "proc": "accept01",
    "pid": 9871,
    "fd": 3,
    "host": "1f0ec6c8a7bc",
    "op": "fgets_unlocked",
    "file": "/etc/passwd",
    "numops": 1,
    "unit": "byte",
    "_time": 1643826292.076709
  }
}

fs.read properties

Property	Description
type required (string)	Distinguishes metrics from events. Value must be metric.
body required (object)	body Details below.

fs.read.body properties

Property	Description
_metric required (string)	Source - File Read Value must be fs.read.
_metric_type required (string)	counter Value must be counter.
_value required (number)	_value Example: 1
proc required (string)	proc
pid required (integer)	pid Example: 1000
fd (integer)	fd Example: 4
host required (string)	host
op (string)	op_fs_read Possible values: go_read readdir pread64 preadv preadv2 preadv64v2 __pread_chk __read_chk __fread_unlocked_chk read readv pread fread __fread_chk fread_unlocked fgets __fgets_chk fgets_unlocked __fgetws_chk fgetws fgetwc fgetc fscanf getline getdelim __getdelim
file (string)	file
numops (number)	numops
unit required (string)	Unit - byte Value must be byte.
summary (string)	summary Value must be true.
_time required (number)	_time Example: 1643662126.91777

---

fs.seek ^

Structure of the fs.seek metric

Examples

{
  "type": "metric",
  "body": {
    "_metric": "fs.seek",
    "_metric_type": "counter",
    "_value": 3,
    "proc": "sh",
    "pid": 13810,
    "host": "1f0ec6c8a7bc",
    "unit": "operation",
    "summary": "true",
    "_time": 1643826404.175738
  }
}

{
  "type": "metric",
  "body": {
    "_metric": "fs.seek",
    "_metric_type": "counter",
    "_value": 1,
    "proc": "sh",
    "pid": 9994,
    "fd": 3,
    "host": "1f0ec6c8a7bc",
    "op": "lseek",
    "file": "./file_x",
    "unit": "operation",
    "_time": 1643826293.407508
  }
}

fs.seek properties

Property	Description
type required (string)	Distinguishes metrics from events. Value must be metric.
body required (object)	body Details below.

fs.seek.body properties

Property	Description
_metric required (string)	Source - File Seek Value must be fs.seek.
_metric_type required (string)	counter Value must be counter.
_value required (number)	_value Example: 1
proc required (string)	proc
pid required (integer)	pid Example: 1000
fd (integer)	fd Example: 4
host required (string)	host
op (string)	op
file (string)	file
unit required (string)	Unit - operation Value must be operation.
summary (string)	summary Value must be true.
_time required (number)	_time Example: 1643662126.91777

---

fs.stat ^

Structure of the fs.stat metric

Examples

{
  "type": "metric",
  "body": {
    "_metric": "fs.stat",
    "_metric_type": "counter",
    "_value": 1,
    "proc": "accept01",
    "pid": 13686,
    "host": "1f0ec6c8a7bc",
    "unit": "operation",
    "summary": "true",
    "_time": 1643826403.123752
  }
}

{
  "type": "metric",
  "body": {
    "_metric": "fs.stat",
    "_metric_type": "counter",
    "_value": 1,
    "proc": "accept01",
    "pid": 9871,
    "host": "1f0ec6c8a7bc",
    "op": "access",
    "file": "/dev/shm",
    "unit": "operation",
    "_time": 1643826292.076446
  }
}

fs.stat properties

Property	Description
type required (string)	Distinguishes metrics from events. Value must be metric.
body required (object)	body Details below.

fs.stat.body properties

Property	Description
_metric required (string)	Source - File Stat Value must be fs.stat.
_metric_type required (string)	counter Value must be counter.
_value required (number)	_value Example: 1
proc required (string)	proc
pid required (integer)	pid Example: 1000
host required (string)	host
op (string)	op
file (string)	file
unit required (string)	Unit - operation Value must be operation.
summary (string)	summary Value must be true.
_time required (number)	_time Example: 1643662126.91777

---

fs.write ^

Structure of the fs.write metric

Examples

{
  "type": "metric",
  "body": {
    "_metric": "fs.write",
    "_metric_type": "counter",
    "_value": 10,
    "proc": "access02",
    "pid": 13806,
    "host": "1f0ec6c8a7bc",
    "unit": "byte",
    "summary": "true",
    "_time": 1643826404.234963
  }
}

{
  "type": "metric",
  "body": {
    "_metric": "fs.write",
    "_metric_type": "counter",
    "_value": 10,
    "proc": "access02",
    "pid": 9991,
    "fd": 3,
    "host": "1f0ec6c8a7bc",
    "op": "__write_libc",
    "file": "file_x",
    "numops": 1,
    "unit": "byte",
    "_time": 1643826293.385378
  }
}

fs.write properties

Property	Description
type required (string)	Distinguishes metrics from events. Value must be metric.
body required (object)	body Details below.

fs.write.body properties

Property	Description
_metric required (string)	Source - File Write Value must be fs.write.
_metric_type required (string)	counter Value must be counter.
_value required (number)	_value Example: 1
proc required (string)	proc
pid required (integer)	pid Example: 1000
fd (integer)	fd Example: 4
host required (string)	host
op (string)	op_fs_write Possible values: go_write pwrite64 pwritev pwritev64 pwritev2 pwritev64v2 __overflow __write_libc __write_pthread fwrite_unlocked __stdio_write write pwrite writev fwrite puts putchar fputs fputs_unlocked fputc fputc_unlocked putwc fputwc
file (string)	file
numops (number)	numops
unit required (string)	Unit - byte Value must be byte.
summary (string)	summary Value must be true.
_time required (number)	_time Example: 1643662126.91777

---

http.duration.client ^

Structure of the http.duration.client metric

Examples

{
  "type": "metric",
  "body": {
    "_metric": "http.duration.client",
    "_metric_type": "timer",
    "_value": 6,
    "http_target": "/",
    "numops": 1,
    "proc": "lt-curl",
    "pid": 788,
    "host": "c067d78736db",
    "unit": "millisecond",
    "summary": "true",
    "_time": 1643924553.681483
  }
}

{
  "type": "metric",
  "body": {
    "_metric": "http.duration.client",
    "_metric_type": "timer",
    "_value": 7,
    "http_target": "/",
    "numops": 1,
    "proc": "lt-curl",
    "pid": 30,
    "host": "c067d78736db",
    "unit": "millisecond",
    "summary": "true",
    "_time": 1643924472.648148
  }
}

http.duration.client properties

Property	Description
type required (string)	Distinguishes metrics from events. Value must be metric.
body required (object)	body Details below.

http.duration.client.body properties

Property	Description
_metric required (string)	Source - HTTP client duration Value must be http.duration.client.
_metric_type required (string)	timer Value must be timer.
_value required (number)	_value Example: 1
http_target required (string)	http_target
numops required (number)	numops
proc required (string)	proc
pid required (integer)	pid Example: 1000
host required (string)	host
unit required (string)	Unit - millisecond Value must be millisecond.
summary (string)	summary Value must be true.
_time required (number)	_time Example: 1643662126.91777

---

http.req.content_length ^

Structure of the http.req.content_length metric

Example

{
  "type": "metric",
  "body": {
    "_metric": "http.req.content_length",
    "_metric_type": "counter",
    "_value": 38,
    "http_target": "/echo/post/json",
    "numops": 1,
    "proc": "curl",
    "pid": 525,
    "host": "272cc69a120a",
    "unit": "byte",
    "summary": "true",
    "_time": 1644230452.63037
  }
}

http.req.content_length properties

Property	Description
type required (string)	Distinguishes metrics from events. Value must be metric.
body required (object)	body Details below.

http.req.content_length.body properties

Property	Description
_metric required (string)	Source - HTTP request content length Value must be http.req.content_length.
_metric_type required (string)	counter Value must be counter.
_value required (number)	_value Example: 1
http_target required (string)	http_target
numops required (number)	numops
proc required (string)	proc
pid required (integer)	pid Example: 1000
host required (string)	host
unit required (string)	Unit - byte Value must be byte.
summary (string)	summary Value must be true.
_time required (number)	_time Example: 1643662126.91777

---

http.req ^

Structure of the http.req metric

Examples

{
  "type": "metric",
  "body": {
    "_metric": "http.req",
    "_metric_type": "counter",
    "_value": 1,
    "http_target": "/",
    "http_status_code": 200,
    "proc": "lt-curl",
    "pid": 788,
    "host": "c067d78736db",
    "unit": "request",
    "summary": "true",
    "_time": 1643924553.681441
  }
}

{
  "type": "metric",
  "body": {
    "_metric": "http.req",
    "_metric_type": "counter",
    "_value": 1,
    "http_target": "/",
    "http_status_code": 200,
    "proc": "lt-curl",
    "pid": 30,
    "host": "c067d78736db",
    "unit": "request",
    "summary": "true",
    "_time": 1643924472.64811
  }
}

http.req properties

Property	Description
type required (string)	Distinguishes metrics from events. Value must be metric.
body required (object)	body Details below.

http.req.body properties

Property	Description
_metric required (string)	Source - HTTP requests Value must be http.req.
_metric_type required (string)	counter Value must be counter.
_value required (number)	_value Example: 1
http_target required (string)	http_target
http_status_code required (integer)	http_status_code Possible values: 100 101 102 200 201 202 203 204 205 206 207 208 226 300 301 302 303 304 305 307 400 401 402 403 404 405 406 407 408 409 410 411 412 413 414 415 416 417 418 421 422 423 424 426 428 429 431 444 451 499 500 501 502 503 504 505 506 507
proc required (string)	proc
pid required (integer)	pid Example: 1000
host required (string)	host
unit required (string)	Unit - request Value must be request.
summary (string)	summary Value must be true.
_time required (number)	_time Example: 1643662126.91777

---

http.resp.content_length ^

Structure of the http.resp.content_length metric

Examples

{
  "type": "metric",
  "body": {
    "_metric": "http.resp.content_length",
    "_metric_type": "counter",
    "_value": 58896,
    "http_target": "/",
    "numops": 1,
    "proc": "lt-curl",
    "pid": 788,
    "host": "c067d78736db",
    "unit": "byte",
    "summary": "true",
    "_time": 1643924553.6815
  }
}

{
  "type": "metric",
  "body": {
    "_metric": "http.resp.content_length",
    "_metric_type": "counter",
    "_value": 58896,
    "http_target": "/",
    "numops": 1,
    "proc": "lt-curl",
    "pid": 30,
    "host": "c067d78736db",
    "unit": "byte",
    "summary": "true",
    "_time": 1643924472.648165
  }
}

http.resp.content_length properties

Property	Description
type required (string)	Distinguishes metrics from events. Value must be metric.
body required (object)	body Details below.

http.resp.content_length.body properties

Property	Description
_metric required (string)	Source - HTTP response content length Value must be http.resp.content_length.
_metric_type required (string)	counter Value must be counter.
_value required (number)	_value Example: 1
http_target required (string)	http_target
numops required (number)	numops
proc required (string)	proc
pid required (integer)	pid Example: 1000
host required (string)	host
unit required (string)	Unit - byte Value must be byte.
summary (string)	summary Value must be true.
_time required (number)	_time Example: 1643662126.91777

---

http.duration.server ^

Structure of the http.duration.server metric

Examples

{
  "type": "metric",
  "body": {
    "_metric": "http.duration.server",
    "_metric_type": "timer",
    "_value": 0,
    "http_target": "/",
    "numops": 1,
    "proc": "httpd",
    "pid": 2260,
    "host": "c067d78736db",
    "unit": "millisecond",
    "summary": "true",
    "_time": 1643924563.450939
  }
}

{
  "type": "metric",
  "body": {
    "_metric": "http.duration.server",
    "_metric_type": "timer",
    "_value": 1,
    "http_target": "/",
    "numops": 1,
    "proc": "httpd",
    "pid": 648,
    "host": "c067d78736db",
    "unit": "millisecond",
    "summary": "true",
    "_time": 1643924498.350866
  }
}

http.duration.server properties

Property	Description
type required (string)	Distinguishes metrics from events. Value must be metric.
body required (object)	body Details below.

http.duration.server.body properties

Property	Description
_metric required (string)	Source - HTTP server duration Value must be http.duration.server.
_metric_type required (string)	timer Value must be timer.
_value required (number)	_value Example: 1
http_target required (string)	http_target
numops required (number)	numops
proc required (string)	proc
pid required (integer)	pid Example: 1000
host required (string)	host
unit required (string)	Unit - millisecond Value must be millisecond.
summary (string)	summary Value must be true.
_time required (number)	_time Example: 1643662126.91777

---

net.close ^

Structure of the net.close metric

Examples

{
  "type": "metric",
  "body": {
    "_metric": "net.close",
    "_metric_type": "counter",
    "_value": 1,
    "proc": "accept01",
    "pid": 13687,
    "host": "1f0ec6c8a7bc",
    "unit": "connection",
    "summary": "true",
    "_time": 1643826403.12145
  }
}

{
  "type": "metric",
  "body": {
    "_metric": "net.close",
    "_metric_type": "counter",
    "_value": 1,
    "proc": "accept01",
    "pid": 9871,
    "fd": 5,
    "host": "1f0ec6c8a7bc",
    "proto": "UDP",
    "port": 0,
    "unit": "connection",
    "_time": 1643826292.077388
  }
}

net.close properties

Property	Description
type required (string)	Distinguishes metrics from events. Value must be metric.
body required (object)	body Details below.

net.close.body properties

Property	Description
_metric required (string)	Source - Net Close Value must be net.close.
_metric_type required (string)	counter Value must be counter.
_value required (number)	_value Example: 1
proc required (string)	proc
pid required (integer)	pid Example: 1000
fd (integer)	fd Example: 4
host required (string)	host
op (string)	op
proto (string)	proto Possible values: TCP UDP RAW RDM SEQPACKET OTHER
port (number)	port
unit required (string)	Unit - connection Value must be connection.
summary (string)	summary Value must be true.
_time required (number)	_time Example: 1643662126.91777

---

dns.req ^

Structure of the dns.req metric

Examples

{
  "type": "metric",
  "body": {
    "_metric": "dns.req",
    "_metric_type": "counter",
    "_value": 1,
    "proc": "lt-curl",
    "pid": 31,
    "host": "2a6bc132b07a",
    "unit": "request",
    "summary": "true",
    "_time": 1643832467.795134
  }
}

{
  "type": "metric",
  "body": {
    "_metric": "dns.req",
    "_metric_type": "counter",
    "_value": 1,
    "proc": "lt-curl",
    "pid": 2485,
    "host": "2a6bc132b07a",
    "domain": "cribl.io",
    "duration": 0,
    "unit": "request",
    "_time": 1643832569.764219
  }
}

dns.req properties

Property	Description
type required (string)	Distinguishes metrics from events. Value must be metric.
body required (object)	body Details below.

dns.req.body properties

Property	Description
_metric required (string)	Source - Net DNS Value must be dns.req.
_metric_type required (string)	counter Value must be counter.
_value required (number)	_value Example: 1
proc required (string)	proc
pid required (integer)	pid Example: 1000
host required (string)	host
domain (string)	domain
duration (number)	duration Example: 55
unit required (string)	Unit - request Value must be request.
summary (string)	summary Value must be true.
_time required (number)	_time Example: 1643662126.91777

---

net.duration ^

Structure of the net.duration metric

Examples

{
  "type": "metric",
  "body": {
    "_metric": "net.duration",
    "_metric_type": "timer",
    "_value": 1,
    "proc": "sendfile06_64",
    "pid": 15385,
    "host": "1f0ec6c8a7bc",
    "unit": "millisecond",
    "summary": "true",
    "_time": 1643826428.960074
  }
}

{
  "type": "metric",
  "body": {
    "_metric": "net.duration",
    "_metric_type": "timer",
    "_value": 53,
    "proc": "send02",
    "pid": 11555,
    "fd": 3,
    "host": "1f0ec6c8a7bc",
    "proto": "UDP",
    "port": 0,
    "numops": 1,
    "unit": "millisecond",
    "_time": 1643826318.65727
  }
}

net.duration properties

Property	Description
type required (string)	Distinguishes metrics from events. Value must be metric.
body required (object)	body Details below.

net.duration.body properties

Property	Description
_metric required (string)	Source - Net duration Value must be net.duration.
_metric_type required (string)	timer Value must be timer.
_value required (number)	_value Example: 1
proc required (string)	proc
pid required (integer)	pid Example: 1000
fd (integer)	fd Example: 4
host required (string)	host
proto (string)	proto Possible values: TCP UDP RAW RDM SEQPACKET OTHER
port (number)	port
numops (number)	numops
unit required (string)	Unit - millisecond Value must be millisecond.
summary (string)	summary Value must be true.
_time required (number)	_time Example: 1643662126.91777

---

net.error ^

Structure of the net.error metric

Examples

{
  "type": "metric",
  "body": {
    "_metric": "net.error",
    "_metric_type": "counter",
    "_value": 6,
    "proc": "accept01",
    "pid": 5920,
    "host": "7cb66c7f77dd",
    "op": "summary",
    "class": "connection",
    "unit": "operation",
    "_time": 1643749774.573214
  }
}

{
  "type": "metric",
  "body": {
    "_metric": "net.error",
    "_metric_type": "counter",
    "_value": 1,
    "proc": "recv01",
    "pid": 3593,
    "host": "7cb66c7f77dd",
    "op": "recv",
    "class": "rx_tx",
    "unit": "operation",
    "_time": 1643749590.518109
  }
}

net.error properties

Property	Description
type required (string)	Distinguishes metrics from events. Value must be metric.
body required (object)	body Details below.

net.error.body properties

Property	Description
_metric required (string)	Source - Net Error Value must be net.error.
_metric_type required (string)	counter Value must be counter.
_value required (number)	_value Example: 1
proc required (string)	proc
pid required (integer)	pid Example: 1000
host required (string)	host
op (string)	op
class required (string)	class net.error Possible values: connection rx_tx
unit required (string)	Unit - operation Value must be operation.
summary (string)	summary Value must be true.
_time required (number)	_time Example: 1643662126.91777

---

net.open ^

Structure of the net.open metric

Examples

{
  "type": "metric",
  "body": {
    "_metric": "net.open",
    "_metric_type": "counter",
    "_value": 1,
    "proc": "accept01",
    "pid": 13687,
    "host": "1f0ec6c8a7bc",
    "unit": "connection",
    "summary": "true",
    "_time": 1643826403.121437
  }
}

{
  "type": "metric",
  "body": {
    "_metric": "net.open",
    "_metric_type": "counter",
    "_value": 1,
    "proc": "lt-curl",
    "pid": 2485,
    "fd": 7,
    "host": "2a6bc132b07a",
    "proto": "UDP",
    "port": 0,
    "unit": "connection",
    "_time": 1643832569.764144
  }
}

net.open properties

Property	Description
type required (string)	Distinguishes metrics from events. Value must be metric.
body required (object)	body Details below.

net.open.body properties

Property	Description
_metric required (string)	Source - Net Open Value must be net.open.
_metric_type required (string)	counter Value must be counter.
_value required (number)	_value Example: 1
proc required (string)	proc
pid required (integer)	pid Example: 1000
fd (integer)	fd Example: 4
host required (string)	host
proto (string)	proto Possible values: TCP UDP RAW RDM SEQPACKET OTHER
port (number)	port
unit required (string)	Unit - connection Value must be connection.
summary (string)	summary Value must be true.
_time required (number)	_time Example: 1643662126.91777

---

net.other ^

Structure of the net.other metric

Examples

{
  "type": "metric",
  "body": {
    "_metric": "net.other",
    "_metric_type": "gauge",
    "_value": 1,
    "proc": "server_seqpacket",
    "pid": 234979,
    "host": "test_user",
    "unit": "connection",
    "summary": "true",
    "_time": 1643887036.00144
  }
}

{
  "type": "metric",
  "body": {
    "_metric": "net.other",
    "_metric_type": "gauge",
    "_value": 1,
    "proc": "server_seqpacket",
    "pid": 235293,
    "fd": 4,
    "host": "test_user",
    "proto": "SEQPACKET",
    "port": 0,
    "unit": "connection",
    "_time": 1643887122.646226
  }
}

net.other properties

Property	Description
type required (string)	Distinguishes metrics from events. Value must be metric.
body required (object)	body Details below.

net.other.body properties

Property	Description
_metric required (string)	Source - Net other Value must be net.other.
_metric_type required (string)	gauge Value must be gauge.
_value required (number)	_value Example: 1
proc required (string)	proc
pid required (integer)	pid Example: 1000
fd (integer)	fd Example: 4
host required (string)	host
proto (string)	proto Possible values: TCP UDP RAW RDM SEQPACKET OTHER
port (number)	port
unit required (string)	Unit - connection Value must be connection.
summary (string)	summary Value must be true.
_time required (number)	_time Example: 1643662126.91777

---

net.port ^

Structure of the net.port metric

Examples

{
  "type": "metric",
  "body": {
    "_metric": "net.port",
    "_metric_type": "gauge",
    "_value": 2,
    "proc": "accept02",
    "pid": 13689,
    "host": "1f0ec6c8a7bc",
    "unit": "instance",
    "summary": "true",
    "_time": 1643826403.184484
  }
}

{
  "type": "metric",
  "body": {
    "_metric": "net.port",
    "_metric_type": "gauge",
    "_value": 1,
    "proc": "accept01",
    "pid": 9871,
    "fd": 4,
    "host": "1f0ec6c8a7bc",
    "proto": "TCP",
    "port": 0,
    "unit": "instance",
    "_time": 1643826292.076967
  }
}

net.port properties

Property	Description
type required (string)	Distinguishes metrics from events. Value must be metric.
body required (object)	body Details below.

net.port.body properties

Property	Description
_metric required (string)	Source - Net port Value must be net.port.
_metric_type required (string)	gauge Value must be gauge.
_value required (number)	_value Example: 1
proc required (string)	proc
pid required (integer)	pid Example: 1000
fd (integer)	fd Example: 4
host required (string)	host
proto (string)	proto Possible values: TCP UDP RAW RDM SEQPACKET OTHER
port (number)	port
unit required (string)	Unit - instance Value must be instance.
summary (string)	summary Value must be true.
_time required (number)	_time Example: 1643662126.91777

---

net.rx ^

Structure of the net.rx metric

Examples

{
  "type": "metric",
  "body": {
    "_metric": "net.rx",
    "_metric_type": "counter",
    "_value": 99000,
    "proc": "send02",
    "pid": 15371,
    "host": "1f0ec6c8a7bc",
    "unit": "byte",
    "class": "inet_udp",
    "summary": "true",
    "_time": 1643826428.564141
  }
}

{
  "type": "metric",
  "body": {
    "_metric": "net.rx",
    "_metric_type": "counter",
    "_value": 6,
    "proc": "recvfrom01",
    "pid": 11544,
    "fd": 4,
    "host": "1f0ec6c8a7bc",
    "domain": "AF_INET",
    "proto": "TCP",
    "localip": "127.0.0.1",
    "localp": 37432,
    "remoteip": "0.0.0.0",
    "remotep": 40765,
    "data": "clear",
    "numops": 1,
    "unit": "byte",
    "_time": 1643826317.098972
  }
}

{
  "type": "metric",
  "body": {
    "_metric": "net.rx",
    "_metric_type": "counter",
    "_value": 16,
    "proc": "send02",
    "pid": 11555,
    "fd": 3,
    "host": "1f0ec6c8a7bc",
    "domain": "AF_INET",
    "proto": "UDP",
    "localip": "127.0.0.1",
    "localp": 0,
    "remoteip": " ",
    "remotep": 0,
    "data": "clear",
    "numops": 1,
    "unit": "byte",
    "_time": 1643826318.241899
  }
}

net.rx properties

Property	Description
type required (string)	Distinguishes metrics from events. Value must be metric.
body required (object)	body Details below.

net.rx.body properties

Property	Description
_metric required (string)	Source - Net RX Value must be net.rx.
_metric_type required (string)	counter Value must be counter.
_value required (number)	_value Example: 1
proc required (string)	proc
pid required (integer)	pid Example: 1000
fd (integer)	fd Example: 4
host required (string)	host
domain (string)	domain
proto (string)	proto Possible values: TCP UDP RAW RDM SEQPACKET OTHER
localn (number)	localn
localip (string)	localip Example: 127.0.0.1
localp (number)	localp Example: 9109
remoten (number)	remoten
remoteip (string)	remoteip Example: 192.158.1.38
remotep (number)	remotep Example: 9108
data (string)	data
numops (number)	numops
unit required (string)	Unit - byte Value must be byte.
class (string)	class net.rxrx Possible values: inet_tcp inet_udp unix_tcp unix_udp other
summary (string)	summary Value must be true.
_time required (number)	_time Example: 1643662126.91777

---

net.tcp ^

Structure of the net.tcp metric

Examples

{
  "type": "metric",
  "body": {
    "_metric": "net.tcp",
    "_metric_type": "gauge",
    "_value": 1,
    "proc": "accept02",
    "pid": 13689,
    "host": "1f0ec6c8a7bc",
    "unit": "connection",
    "summary": "true",
    "_time": 1643826403.184497
  }
}

{
  "type": "metric",
  "body": {
    "_metric": "net.tcp",
    "_metric_type": "gauge",
    "_value": 0,
    "proc": "accept01",
    "pid": 9871,
    "fd": 4,
    "host": "1f0ec6c8a7bc",
    "proto": "TCP",
    "port": 0,
    "unit": "connection",
    "_time": 1643826292.07731
  }
}

net.tcp properties

Property	Description
type required (string)	Distinguishes metrics from events. Value must be metric.
body required (object)	body Details below.

net.tcp.body properties

Property	Description
_metric required (string)	Source - Net tcp Value must be net.tcp.
_metric_type required (string)	gauge Value must be gauge.
_value required (number)	_value Example: 1
proc required (string)	proc
pid required (integer)	pid Example: 1000
fd (integer)	fd Example: 4
host required (string)	host
proto (string)	proto_tcp Value must be TCP.
port (number)	port
unit required (string)	Unit - connection Value must be connection.
summary (string)	summary Value must be true.
_time required (number)	_time Example: 1643662126.91777

---

net.tx ^

Structure of the net.tx metric

Examples

{
  "type": "metric",
  "body": {
    "_metric": "net.tx",
    "_metric_type": "counter",
    "_value": 3,
    "proc": "recvmsg01",
    "pid": 15364,
    "host": "1f0ec6c8a7bc",
    "unit": "byte",
    "class": "unix_tcp",
    "summary": "true",
    "_time": 1643826427.279136
  }
}

{
  "type": "metric",
  "body": {
    "_metric": "net.tx",
    "_metric_type": "counter",
    "_value": 16,
    "proc": "send02",
    "pid": 11555,
    "fd": 4,
    "host": "1f0ec6c8a7bc",
    "domain": "AF_INET",
    "proto": "UDP",
    "localip": "0.0.0.0",
    "localp": 0,
    "remoteip": "127.0.0.1",
    "remotep": 38725,
    "data": "clear",
    "numops": 1,
    "unit": "byte",
    "_time": 1643826318.241855
  }
}

{
  "type": "metric",
  "body": {
    "_metric": "net.tx",
    "_metric_type": "counter",
    "_value": 1,
    "proc": "recvmsg01",
    "pid": 11548,
    "fd": 3,
    "host": "1f0ec6c8a7bc",
    "domain": "UNIX",
    "proto": "TCP",
    "localn": 48335,
    "remoten": 46396,
    "data": "clear",
    "numops": 1,
    "unit": "byte",
    "_time": 1643826317.162209
  }
}

net.tx properties

Property	Description
type required (string)	Distinguishes metrics from events. Value must be metric.
body required (object)	body Details below.

net.tx.body properties

Property	Description
_metric required (string)	Source - Net TX Value must be net.tx.
_metric_type required (string)	counter Value must be counter.
_value required (number)	_value Example: 1
proc required (string)	proc
pid required (integer)	pid Example: 1000
fd (integer)	fd Example: 4
host required (string)	host
domain (string)	domain
proto (string)	proto Possible values: TCP UDP RAW RDM SEQPACKET OTHER
localn (number)	localn
localip (string)	localip Example: 127.0.0.1
localp (number)	localp Example: 9109
remoten (number)	remoten
remoteip (string)	remoteip Example: 192.158.1.38
remotep (number)	remotep Example: 9108
data (string)	data
numops (number)	numops
unit required (string)	Unit - byte Value must be byte.
class (string)	class net.rxrx Possible values: inet_tcp inet_udp unix_tcp unix_udp other
summary (string)	summary Value must be true.
_time required (number)	_time Example: 1643662126.91777

---

net.udp ^

Structure of the net.udp metric

Example

{
  "type": "metric",
  "body": {
    "_metric": "net.udp",
    "_metric_type": "gauge",
    "_value": 0,
    "proc": "accept01",
    "pid": 9871,
    "fd": 5,
    "host": "1f0ec6c8a7bc",
    "proto": "UDP",
    "port": 0,
    "unit": "connection",
    "_time": 1643826292.077372
  }
}

net.udp properties

Property	Description
type required (string)	Distinguishes metrics from events. Value must be metric.
body required (object)	body Details below.

net.udp.body properties

Property	Description
_metric required (string)	Source - Net udp Value must be net.udp.
_metric_type required (string)	gauge Value must be gauge.
_value required (number)	_value Example: 1
proc required (string)	proc
pid required (integer)	pid Example: 1000
fd required (integer)	fd Example: 4
host required (string)	host
proto required (string)	proto_udp Value must be UDP.
port required (number)	port
unit required (string)	Unit - connection Value must be connection.
summary (string)	summary Value must be true.
_time required (number)	_time Example: 1643662126.91777

---

proc.child ^

Structure of the proc.child metric

Example

{
  "type": "metric",
  "body": {
    "_metric": "proc.child",
    "_metric_type": "gauge",
    "_value": 0,
    "proc": "accept01",
    "pid": 1946,
    "host": "7cb66c7f77dd",
    "unit": "process",
    "_time": 1643749566.030543
  }
}

proc.child properties

Property	Description
type required (string)	Distinguishes metrics from events. Value must be metric.
body required (object)	body Details below.

proc.child.body properties

Property	Description
_metric required (string)	Source - proc child Value must be proc.child.
_metric_type required (string)	gauge Value must be gauge.
_value required (number)	_value Example: 1
proc required (string)	proc
pid required (integer)	pid Example: 1000
host required (string)	host
unit required (string)	Unit - process Value must be process.
_time required (number)	_time Example: 1643662126.91777

---

proc.cpu ^

Structure of the proc.cpu metric

Example

{
  "type": "metric",
  "body": {
    "_metric": "proc.cpu",
    "_metric_type": "counter",
    "_value": 2107,
    "proc": "accept01",
    "pid": 1946,
    "host": "7cb66c7f77dd",
    "unit": "microsecond",
    "_time": 1643749566.030295
  }
}

proc.cpu properties

Property	Description
type required (string)	Distinguishes metrics from events. Value must be metric.
body required (object)	body Details below.

proc.cpu.body properties

Property	Description
_metric required (string)	Source - proc cpu Value must be proc.cpu.
_metric_type required (string)	counter Value must be counter.
_value required (number)	_value Example: 1
proc required (string)	proc
pid required (integer)	pid Example: 1000
host required (string)	host
unit required (string)	Unit - microsecond Value must be microsecond.
_time required (number)	_time Example: 1643662126.91777

---

proc.cpu.perc ^

Structure of the proc.cpu_perc metric

Example

{
  "type": "metric",
  "body": {
    "_metric": "proc.cpu_perc",
    "_metric_type": "gauge",
    "_value": 0.02107,
    "proc": "accept01",
    "pid": 1946,
    "host": "7cb66c7f77dd",
    "unit": "percent",
    "_time": 1643749566.030327
  }
}

proc.cpu.perc properties

Property	Description
type required (string)	Distinguishes metrics from events. Value must be metric.
body required (object)	body Details below.

proc.cpu.perc.body properties

Property	Description
_metric required (string)	Source - proc cpu_perc Value must be proc.cpu_perc.
_metric_type required (string)	gauge Value must be gauge.
_value required (number)	_value Example: 1
proc required (string)	proc
pid required (integer)	pid Example: 1000
host required (string)	host
unit required (string)	Unit - percent Value must be percent.
_time required (number)	_time Example: 1643662126.91777

---

proc.fd ^

Structure of the proc.fd metric

Example

{
  "type": "metric",
  "body": {
    "_metric": "proc.fd",
    "_metric_type": "gauge",
    "_value": 5,
    "proc": "accept01",
    "pid": 1946,
    "host": "7cb66c7f77dd",
    "unit": "file",
    "_time": 1643749566.030497
  }
}

proc.fd properties

Property	Description
type required (string)	Distinguishes metrics from events. Value must be metric.
body required (object)	body Details below.

proc.fd.body properties

Property	Description
_metric required (string)	Source - proc fd Value must be proc.fd.
_metric_type required (string)	gauge Value must be gauge.
_value required (number)	_value Example: 1
proc required (string)	proc
pid required (integer)	pid Example: 1000
host required (string)	host
unit required (string)	Unit - file Value must be file.
_time required (number)	_time Example: 1643662126.91777

---

proc.mem ^

Structure of the proc.mem metric

Example

{
  "type": "metric",
  "body": {
    "_metric": "proc.mem",
    "_metric_type": "gauge",
    "_value": 31284,
    "proc": "accept01",
    "pid": 1946,
    "host": "7cb66c7f77dd",
    "unit": "kibibyte",
    "_time": 1643749566.030388
  }
}

proc.mem properties

Property	Description
type required (string)	Distinguishes metrics from events. Value must be metric.
body required (object)	body Details below.

proc.mem.body properties

Property	Description
_metric required (string)	Source - proc memory Value must be proc.mem.
_metric_type required (string)	gauge Value must be gauge.
_value required (number)	_value Example: 1
proc required (string)	proc
pid required (integer)	pid Example: 1000
host required (string)	host
unit required (string)	Unit - kibibyte Value must be kibibyte.
_time required (number)	_time Example: 1643662126.91777

---

proc.start ^

Structure of the proc.start metric

Example

{
  "type": "metric",
  "body": {
    "_metric": "proc.start",
    "_metric_type": "counter",
    "_value": 1,
    "proc": "accept01",
    "pid": 1945,
    "gid": 0,
    "groupname": "root",
    "uid": 0,
    "username": "root",
    "host": "7cb66c7f77dd",
    "args": "/opt/test/ltp/testcases/kernel/syscalls/accept/accept01",
    "unit": "process",
    "_time": 1643749566.026885
  }
}

proc.start properties

Property	Description
type required (string)	Distinguishes metrics from events. Value must be metric.
body required (object)	body Details below.

proc.start.body properties

Property	Description
_metric required (string)	Source - proc start Value must be proc.start.
_metric_type required (string)	counter Value must be counter.
_value required (number)	_value Example: 1
proc required (string)	proc
pid required (integer)	pid Example: 1000
gid required (integer)	gid Example: 0
groupname required (string)	groupname Example: root
uid required (integer)	uid Example: 0
username required (string)	username Example: root
host required (string)	host
args required (string)	args
unit required (string)	Unit - process Value must be process.
_time required (number)	_time Example: 1643662126.91777

---

proc.thread ^

Structure of the proc.thread metric

Example

{
  "type": "metric",
  "body": {
    "_metric": "proc.thread",
    "_metric_type": "gauge",
    "_value": 1,
    "proc": "accept01",
    "pid": 1946,
    "host": "7cb66c7f77dd",
    "unit": "thread",
    "_time": 1643749566.030435
  }
}

proc.thread properties

Property	Description
type required (string)	Distinguishes metrics from events. Value must be metric.
body required (object)	body Details below.

proc.thread.body properties

Property	Description
_metric required (string)	Source - proc thread Value must be proc.thread.
_metric_type required (string)	gauge Value must be gauge.
_value required (number)	_value Example: 1
proc required (string)	proc
pid required (integer)	pid Example: 1000
host required (string)	host
unit required (string)	Unit - thread Value must be thread.
_time required (number)	_time Example: 1643662126.91777