Default Standard Attributes

The following table lists the attributes automatically applied to data sent to Datadog by the Agent by each of the RUM, Logs, and APM products, as applicable to the data domain. Optionally, filter the list by product or search by keyword or description text to find the attributes you're interested in.

Docs > Default Standard Attributes

Domain	Attribute Name	Type	Description
Reserved	host	string	The name of the originating host as defined in metrics. Datadog automatically retrieves corresponding host tags from the matching host in Datadog and applies them to your telemetry. The Agent sets this value automatically.
Reserved	device	string	The type of originating device.
Reserved	source	string	This corresponds to the integration name, the technology from which the data originated. When it matches an integration name, Datadog automatically installs the corresponding parsers and facets. For example, `nginx`, `postgresql`, and so on.
Reserved	status	string	This corresponds to the level or severity of the data. For logs, it is used to define log patterns and has a dedicated layout in the Log Management UI.
Reserved	service	string	The unified service name for the application or service that is generating the data, used to correlate user sessions. It is used to switch from APM to other products, so make sure you define the same value when you use both products. In the RUM Browser SDK, a service denotes a set of pages built by a team that offers a specific functionality in your browser application. You can assign web pages to a service with manual view tracking.
Reserved	trace_id	number	The Trace ID used for traces. It is used to correlate your traces with other data, including logs.
Reserved	message	string	The body of a log entry, highlighted and displayed in Logs Live Tail, where it is indexed for full text search.
Network communications	network.bytes_read	number	Total number of bytes transmitted from the client to the server when the log is emitted.
Network communications	network.bytes_written	number	Total number of bytes transmitted from the server to the client when the log is emitted.
Geolocation	network.client.geoip.country.name	string	Name of the country.
Geolocation	network.client.geoip.country.iso_code	string	ISO Code of the country (for example, `US` for the United States, `FR` for France).
Geolocation	network.client.geoip.continent.code	string	ISO code of the continent (`EU`, `AS`, `NA`, `AF`, `AN`, `SA`, `OC`).
Geolocation	network.client.geoip.continent.name	string	Name of the continent (`Europe`, `Australia`, `North America`, `Africa`, `Antartica`, `South America`, `Oceania`).
Geolocation	network.client.geoip.subdivision.name	string	Name of the first subdivision level of the country (for example, `California` in the United States or the `Sarthe` department in France).
Geolocation	network.client.geoip.subdivision.iso_code	string	ISO Code of the first subdivision level of the country (for example, `CA` in the United States or the `SA` department in France).
Geolocation	network.client.geoip.city.name	string	The name of the city (for example, `Paris`, `New York`).
HTTP	http.referer	string	HTTP header field that identifies the address of the webpage that linked to the resource being requested.
HTTP	http.request_id	string	The ID of the HTTP request.
HTTP, URL Details	http.url_details.host	string	The HTTP host part of the URL.
HTTP, URL Details	http.url_details.port	number	The HTTP port part of the URL.
HTTP, URL Details	http.url_details.path	string	The HTTP path part of the URL.
HTTP, URL Details	http.url_details.queryString	object	The HTTP query string parts of the URL decomposed as query params key/value attributes.
HTTP, URL Details	http.url_details.scheme	string	The protocol name of the URL (HTTP or HTTPS).
User-Agent	http.useragent_details.os.family	string	The OS family reported by the User-Agent.
User-Agent	http.useragent_details.browser.family	string	The Browser Family reported by the User-Agent.
User-Agent	http.useragent_details.device.family	string	The Device family reported by the User-Agent.
Source code	logger.name	string	The name of the logger.
Source code	logger.thread_name	string	The name of the current thread when the log is fired.
Source code	logger.method_name	string	The class method name.
Source code	logger.version	string	The version of the logger.
Source code	error.kind	string	The error type or kind (or code in some cases).
Database	db.instance	string	The name of the database being connected to. For example, in Java, if `jdbc.url="jdbc:mysql://127.0.0.1:3306/customers"`, the instance name is `customers`.
Database	db.statement	string	A database statement for the given database type. For example, for mySQL: `'SELECT * FROM wuser_table';` and for Redis: `'SET mykey 'WuValue''`.
Database	db.user	string	User that performs the operation.
Performance	duration	number	A duration of any kind in nanoseconds: HTTP response time, database query time, latency, and so on. Remap any durations within logs to this attribute because Datadog displays and uses it as a default measure for trace search.
User	usr.id	string	The user identifier.
User	usr.name	string	The user-friendly name.
User	usr.email	string	The user email.
Syslog and log shippers	syslog.hostname	string	The hostname.
Syslog and log shippers	syslog.appname	string	The application name. Generally remapped to the `service` reserved attribute.
Syslog and log shippers	syslog.severity	number	The log severity. Generally remapped to the `status` reserved attribute.
Syslog and log shippers	syslog.timestamp	string	The log timestamp. Generally remapped to the `date` reserved attribute.
Syslog and log shippers	syslog.env	string	The environment name where the source of logs come from.
DNS	dns.id	string	The DNS query identifier.
DNS	dns.question.name	string	The queried domain name.
DNS	dns.question.type	string	A two octet code which specifies the DNS question type.
DNS	dns.question.class	string	The class looked up by the DNS question (such as IP when using the internet).
DNS	dns.question.size	number	The DNS question size in bytes.
DNS	dns.answer.name	string	The IP address that the DNS answers with.
DNS	dns.answer.type	string	A two octet code which specifies the DNS answer type.
DNS	dns.answer.class	string	The class answered by the DNS.
DNS	dns.answer.size	number	The DNS answer size in bytes.
DNS	dns.flags.rcode	string	The DNS reply code.
Events	evt.name	string	The shared name across events generated by the same activity (for example, authentication).
Events	evt.outcome	string	The result of the event (for example, `success`, `failure`).
RUM core attributes	date	integer	Start of the event in milliseconds from epoch.
RUM core attributes	type	string	The type of the event (for example, `view` or `resource`).
RUM core attributes	application.id	string	The Datadog application ID generated when you create a RUM application.
RUM core attributes	application.name	string	The Datadog application name.
Device (Android, iOS, Roku)	device.type	string	The device type as reported by the device (System User-Agent).
Device (Android, iOS, Roku)	device.brand	string	The device brand as reported by the device (System User-Agent).
Device (Android, iOS, Roku)	device.model	string	The device model as reported by the device (System User-Agent).
Device (Android, iOS, Roku)	device.name	string	The device name as reported by the device (System User-Agent).
Connectivity (Android, iOS)	connectivity.status	string	Status of device network reachability (`connected`, `not connected`, or `maybe`).
Connectivity (Android, iOS)	connectivity.interfaces	string	The list of available network interfaces (for example, `bluetooth`, `cellular`, `ethernet`, or `wifi`).
Connectivity (Android, iOS)	connectivity.cellular.technology	string	The type of a radio technology used for cellular connection.
Connectivity (Android, iOS)	connectivity.cellular.carrier_name	string	The name of the SIM carrier.
Operating System (Android, iOS, Roku)	os.name	string	The OS name as reported by the device (System User-Agent).
Operating System (Android, iOS, Roku)	os.version	string	The OS version as reported by the device (System User-Agent).
Operating System (Android, iOS, Roku)	os.version_major	string	The OS version major as reported by the device (System User-Agent).
Geo-location	geo.country	string	Name of the country.
Geo-location	geo.country_iso_code	string	The ISO Code of the country (for example, `US` for the United States or `FR` for France).
Geo-location	geo.country_subdivision	string	Name of the first subdivision level of the country (for example, `California` in the United States or the `Sarthe` department in France).
Geo-location	geo.continent_code	string	ISO code of the continent (`EU`, `AS`, `NA`, `AF`, `AN`, `SA`, or `OC`).
Geo-location	geo.continent	string	Name of the continent (`Europe`, `Australia`, `North America`, `Africa`, `Antarctica`, `South America`, or `Oceania`).
Geo-location	geo.city	string	The name of the city (for example, `San Francisco`, `Paris`, or `New York`).
RUM user attributes (Android, Roku)	user.id	string	Identifier of the user.
RUM user attributes (iOS)	usr.id	string	Identifier of the user.
Global user attributes (Android, iOS, Roku)	usr.name	string	Name of the user.
Global user attributes (Android, iOS, Roku)	usr.email	string	Email of the user.
Session (Android events, iOS events, Roku events)	session.id	string	Unique ID of the session.
Session (Android events, iOS events, Roku events)	session.type	string	Type of the session (`user`).
Session (Android events, iOS events, Roku events)	session.is_active	boolean	Indicates if the session is currently active. The session ends if a user navigates away from the application or closes the browser window, and expires after 4 hours of activity or 15 minutes of inactivity.
Session (Android events, iOS events, Roku events)	session.initial_view.url	string	URL of the initial view of the session.
Session (Android events, iOS events, Roku events)	session.initial_view.name	string	Name of the initial view of the session.
Session (Android events, iOS events, Roku events)	session.last_view.url	string	URL of the last view of the session.
Session (Android events, iOS events, Roku events)	session.last_view.name	string	Name of the last view of the session.
Session (Android events, iOS events, Roku events)	session.ip	string	IP address of the session extracted from the TCP connection of the intake. If you want to stop collecting this attribute, change the setting in your application details.
Session (Android events, iOS events, Roku events)	session.useragent	string	System `User-Agent` info to interpret device info.
View (Android events, iOS events, Roku events)	view.id	string	Unique ID of the initial view corresponding to the event.
View (Android events, iOS events, Roku events)	view.url	string	Canonical name of the class corresponding to the event. For iOS, the URL of the `UIViewController` class corresponding to the event.
View (Android events, iOS events, Roku events)	view.name	string	Customizable name of the view corresponding to the event.
Resource (Android events, iOS events, Roku events)	resource.id	string	Unique identifier of the resource.
Resource (Android events, iOS events, Roku events)	resource.type	string	The type of resource being collected (for example, `xhr`, `image`, `font`, `css`, or `js`).
Resource (Android events, iOS events, Roku events)	resource.method	string	The HTTP method (for example, `POST`, `GET`, `PATCH`, or `DELETE`).
Resource (Android events, iOS events, Roku events)	resource.status_code	number	The response status code.
Resource (Android events, iOS events, Roku events)	resource.url	string	The resource URL.
Resource (Android events, iOS events, Roku events)	resource.provider.name	string	The resource provider name. Default is `unknown`.
Resource (Android events, iOS events, Roku events)	resource.provider.domain	string	The resource provider domain.
Resource (Android events, iOS events, Roku events)	resource.provider.type	string	The resource provider type (for example, `first-party`, `cdn`, `ad`, or `analytics`).
Error (Browser events, Android events, iOS events, Roku events)	error.source	string	Where the error originates from (for example, `webview`, `logger`, or `network`).
Error (Browser events, Android events, iOS events, Roku events)	error.type	string	The error type (or error code in some cases).
Error (Browser events, Android events, iOS events, Roku events)	error.message	string	A concise, human-readable, one-line message explaining the event.
Error (Browser events, Android events, iOS events, Roku events)	error.stack	string	The stack trace or complementary information about the error.
Error (Android events, iOS events, Roku events)	error.issue_id	string	The stack trace or complementary information about the error.
Network error (Android events, iOS events, Roku events)	error.resource.status_code	number	The response status code.
Network error (Android events, iOS events, Roku events)	error.resource.method	string	The HTTP method (for example, `POST` or `GET`).
Network error (Android events, iOS events, Roku events)	error.resource.url	string	The resource URL.
Network error (Android events, iOS events, Roku events)	error.resource.provider.name	string	The resource provider name. Default is `unknown`.
Network error (Android events, iOS events, Roku events)	error.resource.provider.domain	string	The resource provider domain.
Network error (Android events, iOS events, Roku events)	error.resource.provider.type	string	The resource provider type (for example, `first-party`, `cdn`, `ad`, or `analytics`).
Action (Browser events, Android events, iOS events, Roku events)	action.id	string	UUID of the user action.
Action (Browser events, Android events, iOS events, Roku events)	action.type	string	Type of the user action (for example, `tap` or `application_start`). For Custom Browser User Actions, it is set to `custom`.
Action (Browser events, Android events, iOS events, Roku events)	action.name	string	A user-friendly name (for example, `Click on checkout`). For Custom Browser User Actions, the action name given in the API call.
Action (Browser events, Android events, iOS events, Roku events)	action.target.name	string	Element that the user interacted with. Only for automatically collected actions.
View (Browser)	view.id	string	Randomly generated ID for each page view.
View (Browser)	view.loading_type	string	The type of page load, `initial_load` or `route_change`. For more information, see the single page applications support docs.
View (Browser)	view.referrer	string	The URL of the previous web page from which a link to the currently requested page was followed.
View (Browser)	view.url	string	The view URL.
View (Browser)	view.url_hash	string	The hash part of the URL.
View (Browser)	view.url_host	string	The host part of the URL.
View (Browser)	view.url_path	string	The path part of the URL.
View (Browser)	view.url_path_group	string	The automatic URL group generated for similar URLs (for example, `/dashboard/?` for `/dashboard/123` and `/dashboard/456`).
View (Browser)	view.url_query	object	The query string parts of the URL decomposed as query params key/value attributes.
View (Browser)	view.url_scheme	object	The scheme part of the URL.
Device (Browser)	device.type	string	The device type as reported by the device (User-Agent HTTP header).
Device (Browser)	device.brand	string	The device brand as reported by the device (User-Agent HTTP header).
Device (Browser)	device.model	string	The device model as reported by the device (User-Agent HTTP header).
Device (Browser)	device.name	string	The device name as reported by the device (User-Agent HTTP header).
Operating system (Browser)	os.name	string	The OS name as reported by the device (User-Agent HTTP header).
Operating system (Browser)	os.version	string	The OS version as reported by the device (User-Agent HTTP header).
Operating system (Browser)	os.version_major	string	The OS version major as reported by the device (User-Agent HTTP header).
Session (Browser events)	session.id	string	Randomly generated ID for each session.
Session (Browser events)	session.ip	string	Client IP address. If you want to stop collecting this attribute, change the setting in your application details.
Session (Browser events)	session.is_active	boolean	Indicates if the session is currently active. The session ends after 4 hours of activity or 15 minutes of inactivity.
Session (Browser events)	session.type	string	The type of session, `user` or `synthetics`. Sessions from Synthetic Browser Tests are excluded from billing.
Session (Browser events)	session.referrer	string	The URL of the previous web page from which a link to the currently requested page was followed.
Session (Browser events)	session.initial_view.id	string	The ID of the first RUM view generated by the user.
Session (Browser events)	session.initial_view.url_host	string	The host part of the URL.
Session (Browser events)	session.initial_view.url_path	string	The path part of the URL.
Session (Browser events)	session.initial_view.url_path_group	string	The automatic URL group generated for similar URLs (for example, `/dashboard/?` for `/dashboard/123` and `/dashboard/456`).
Session (Browser events)	session.initial_view.url_query	object	The query string parts of the URL decomposed as query params key/value attributes.
Session (Browser events)	session.initial_view.url_scheme	object	The scheme part of the URL.
Session (Browser events)	session.last_view.id	string	The ID of the last RUM view generated by the user.
Session (Browser events)	session.last_view.url_host	string	The host part of the URL.
Session (Browser events)	session.last_view.url_path	string	The path part of the URL.
Session (Browser events)	session.last_view.url_path_group	string	The automatic URL group generated for similar URLs (for example, `/dashboard/?` for `/dashboard/123` and `/dashboard/456`).
Session (Browser events)	session.last_view.url_query	object	The query string parts of the URL decomposed as query params key/value attributes.
Session (Browser events)	session.last_view.url_scheme	object	The scheme part of the URL.
Resource (Browser events)	resource.type	string	The type of resource being collected (for example, `css`, `javascript`, `media`, `XHR`, or `image`).
Resource (Browser events)	resource.method	string	The HTTP method (for example `POST` or `GET`).
Resource (Browser events)	resource.status_code	number	The response status code.
Resource (Browser events)	resource.url	string	The resource URL.
Resource (Browser events)	resource.url_host	string	The host part of the URL.
Resource (Browser events)	resource.url_path	string	The path part of the URL.
Resource (Browser events)	resource.url_query	object	The query string parts of the URL decomposed as query params key/value attributes.
Resource (Browser events)	resource.url_scheme	string	The protocol name of the URL (HTTP or HTTPS).
Resource (Browser events)	resource.provider.name	string	The resource provider name. Default is `unknown`.
Resource (Browser events)	resource.provider.domain	string	The resource provider domain.
Resource (Browser events)	resource.provider.type	string	The resource provider type (for example, `first-party`, `cdn`, `ad`, or `analytics`).
Frustration signals (Browser events)	action.frustration.type:dead_click	string	The dead clicks detected by the RUM Browser SDK.
Frustration signals (Browser events)	action.frustration.type:rage_click	string	The rage clicks detected by the RUM Browser SDK.
Frustration signals (Browser events)	action.frustration.type:error_click	string	The error clicks detected by the RUM Browser SDK.
UTM (Browser events)	view.url_query.utm_source	string	The parameter in the URL tracking the source of traffic.
UTM (Browser events)	view.url_query.utm_medium	string	The parameter in the URL tracking the channel where the traffic is coming from.
UTM (Browser events)	view.url_query.utm_campaign	string	The parameter in the URL identifying the specific marketing campaign tied to that view.
UTM (Browser events)	view.url_query.utm_content	string	The parameter in the URL identifying the specific element a user clicked within a marketing campaign.
UTM (Browser events)	view.url_query.utm_term	string	The parameter in the URL tracking the keyword a user searched to trigger a given campaign.
APM core	language	string	The client SDK language used to generate the span. It can be one of `cpp`, `dotnet`, `go`, `jvm`, `javascript`, `php`, `python`, `ruby`.
APM core (Reserved)	env	string	The value of the `DD_ENV` environment variable or user-defined `env` for the running process.
APM core (Reserved)	version	string	The value of the `DD_VERSION` environment variable or user-defined `version` for the running process.
APM core	span.kind	string	The string representing the type of work unit handled by the span. It can be one of server, client, producer, consumer, or internal. For more information, see the OpenTelemetry SpanKind documentation.
APM core	component	string	The name of the library or integration that created the span.
Network communications	network.client.ip	string	The IP address of the client that initiated the inbound connection.
Network communications	network.destination.ip	string	The IP address to where the outbound connection is being made.
Network communications	network.host.ip	string	The local host IP address.
Network communications	network.client.port	number	The port of the client that initiated the connection.
Network communications	network.destination.port	number	The remote port number of the outbound connection.
Network communications	network.client.name	string	The hostname of the client that initiated the inbound connection.
Network communications	network.host.name	string	The local hostname.
Network communications	network.client.transport	string	The transport protocol used to make the inbound connection.
Network communications	network.destination.transport	string	The transport protocol used to make the outbound connection.
HTTP requests	http.status_code	string	The HTTP response status code.
HTTP requests	http.url	string	The URL of the HTTP request, including the obfuscated query string. For more information on obfuscation, see Configure Data Security.
HTTP requests	http.version	string	The version of HTTP used for the request.
HTTP requests	http.method	string	The port of the client that initiated the connection.
HTTP requests	http.route	string	The matched route (path template). For example, `/users/:userID`.
HTTP requests	http.client_ip	string	The IP address of the original client behind all proxies, if known. Discovered from headers such as `X-Forwarded-For`.
HTTP requests	http.useragent	string	The `User-Agent` header received with the request.
HTTP requests	http.request.content_length	number	The size of the request payload body in bytes.
HTTP requests	http.response.content_length	number	The size of the response payload body in bytes.
HTTP requests	http.request.content_length_uncompressed	number	The size of the uncompressed request payload body after transport decoding.
HTTP requests	http.response.content_length_uncompressed	number	The size of the uncompressed response payload body after transport decoding.
HTTP requests	http.request.headers.*	string	The request HTTP headers. None are collected by default, but can be optionally configured with `DD_TRACE_HEADER_TAGS`.
Database spans	db.system	string	Identifier for the database management system (DBMS) product being used.
HTTP requests	http.response.headers.*	string	The response HTTP headers. None are collected by default, but can be optionally configured with `DD_TRACE_HEADER_TAGS`.
Database spans	db.connection_string	string	The connection string used to connect to the database.
Database spans	db.operation	string	The name of the operation being executed. For example, `SELECT`, `findAndModify`, `HMSET`.
Database spans	db.sql.table	string	The name of the primary table that the operation is acting upon, including the database name (if applicable).
Database spans	db.row_count	number	The number of rows/results from the query or operation.
Message queue spans	messaging.system	string	The identifier of the messaging system.
Message queue spans	messaging.destination	string	The message destination name.
Message queue spans	messaging.destination_kind	string	The kind of message destination.
Message queue spans	messaging.protocol	string	The name of the transport protocol.
Message queue spans	messaging.protocol_version	string	The version of the transport protocol.
Message queue spans	messaging.url	string	The connection string to the messaging system.
Message queue spans	messaging.message_id	string	A value used by the messaging system as an identifier for the message, represented as a string.
Message queue spans	messaging.conversation_id	string	The conversation ID identifying the conversation to which the message belongs, represented as a string.
Message queue spans	messaging.message_payload_size	number	The size of the uncompressed message payload in bytes.
Message queue spans	messaging.operation	string	A string identifying the kind of message consumption. For example, `send` (a message sent to a producer), `receive` (a message is received by a consumer), or `process` (a message previously received is processed by a consumer).
Message queue spans	messaging.consumer_id	string	The identifier for the consumer receiving a message.
Remote procedure calls	rpc.system	string	The identifier of the remote system.
Remote procedure calls	rpc.service	string	The name of the service being called.
Remote procedure calls	rpc.method	string	The name of the method being called.

Default Standard Attributes

Further reading