| Reserved | host | string | The name of the originating host as defined in metrics. Datadog automatically retrieves corresponding host tags from the matching host in Datadog and applies them to your telemetry. The Agent sets this value automatically. |
| Reserved | device | string | The type of originating device. |
| Reserved | source | string | This corresponds to the integration name, the technology from which the data originated. When it matches an integration name, Datadog automatically installs the corresponding parsers and facets. For example, nginx, postgresql, and so on. |
| Reserved | status | string | This corresponds to the level or severity of the data. For logs, it is used to define log patterns and has a dedicated layout in the Log Management UI. |
| Reserved | service | string | The unified service name for the application or service that is generating the data, used to correlate user sessions. It is used to switch from APM to other products, so make sure you define the same value when you use both products. In the RUM Browser SDK, a service denotes a set of pages built by a team that offers a specific functionality in your browser application. You can assign web pages to a service with manual view tracking. |
| Reserved | trace_id | number | The Trace ID used for traces. It is used to correlate your traces with other data, including logs. |
| Reserved | message | string | The body of a log entry, highlighted and displayed in Logs Live Tail, where it is indexed for full text search. |
| Network communications | network.bytes_read | number | Total number of bytes transmitted from the client to the server when the log is emitted. |
| Network communications | network.bytes_written | number | Total number of bytes transmitted from the server to the client when the log is emitted. |
| Geolocation | network.client.geoip.country.name | string | Name of the country. |
| Geolocation | network.client.geoip.country.iso_code | string | ISO Code of the country (for example, US for the United States, FR for France). |
| Geolocation | network.client.geoip.continent.code | string | ISO code of the continent (EU, AS, NA, AF, AN, SA, OC). |
| Geolocation | network.client.geoip.continent.name | string | Name of the continent (Europe, Australia, North America, Africa, Antartica, South America, Oceania). |
| Geolocation | network.client.geoip.subdivision.name | string | Name of the first subdivision level of the country (for example, California in the United States or the Sarthe department in France). |
| Geolocation | network.client.geoip.subdivision.iso_code | string | ISO Code of the first subdivision level of the country (for example, CA in the United States or the SA department in France). |
| Geolocation | network.client.geoip.city.name | string | The name of the city (for example, Paris, New York). |
| HTTP | http.referer | string | HTTP header field that identifies the address of the webpage that linked to the resource being requested. |
| HTTP | http.request_id | string | The version of HTTP used for the request. |
| HTTP, URL Details | http.url_details.host | string | The HTTP host part of the URL. |
| HTTP, URL Details | http.url_details.port | number | The HTTP port part of the URL. |
| HTTP, URL Details | http.url_details.path | string | The HTTP path part of the URL. |
| HTTP, URL Details | http.url_details.queryString | object | The HTTP query string parts of the URL decomposed as query params key/value attributes. |
| HTTP, URL Details | http.url_details.scheme | string | The protocol name of the URL (HTTP or HTTPS). |
| User-Agent | http.useragent_details.os.family | string | The OS family reported by the User-Agent. |
| User-Agent | http.useragent_details.browser.family | string | The Browser Family reported by the User-Agent. |
| User-Agent | http.useragent_details.device.family | string | The Device family reported by the User-Agent. |
| Source code | logger.name | string | The name of the logger. |
| Source code | logger.thread_name | string | The name of the current thread when the log is fired. |
| Source code | logger.method_name | string | The class method name. |
| Source code | logger.version | string | The version of the logger. |
| Source code | error.kind | string | The error type or kind (or code in some cases). |
| Database | db.instance | string | The name of the database being connected to. For example, in Java, if jdbc.url="jdbc:mysql://127.0.0.1:3306/customers", the instance name is customers. |
| Database | db.statement | string | A database statement for the given database type. For example, for mySQL: 'SELECT * FROM wuser_table'; and for Redis: 'SET mykey 'WuValue''. |
| Database | db.user | string | User that performs the operation. |
| Performance | duration | number | A duration of any kind in nanoseconds: HTTP response time, database query time, latency, and so on. Remap any durations within logs to this attribute because Datadog displays and uses it as a default measure for trace search. |
| User | usr.id | string | The user identifier. |
| User | usr.name | string | The user-friendly name. |
| User | usr.email | string | The user email. |
| Syslog and log shippers | syslog.hostname | string | The hostname. |
| Syslog and log shippers | syslog.appname | string | The application name. Generally remapped to the service reserved attribute. |
| Syslog and log shippers | syslog.severity | number | The log severity. Generally remapped to the status reserved attribute. |
| Syslog and log shippers | syslog.timestamp | string | The log timestamp. Generally remapped to the date reserved attribute. |
| Syslog and log shippers | syslog.env | string | The environment name where the source of logs come from. |
| DNS | dns.id | string | The DNS query identifier. |
| DNS | dns.question.name | string | The queried domain name. |
| DNS | dns.question.type | string | A two octet code which specifies the DNS question type. |
| DNS | dns.question.class | string | The class looked up by the DNS question (such as IP when using the internet). |
| DNS | dns.question.size | number | The DNS question size in bytes. |
| DNS | dns.answer.name | string | The IP address that the DNS answers with. |
| DNS | dns.answer.type | string | A two octet code which specifies the DNS answer type. |
| DNS | dns.answer.class | string | The class answered by the DNS. |
| DNS | dns.answer.size | number | The DNS answer size in bytes. |
| DNS | dns.flags.rcode | string | The DNS reply code. |
| Events | evt.name | string | The shared name across events generated by the same activity (for example, authentication). |
| Events | evt.outcome | string | The result of the event (for example, success, failure). |
| RUM core attributes | date | integer | Start of the event in milliseconds from epoch. |
| RUM core attributes | type | string | The type of the event (for example, view or resource). |
| RUM core attributes | application.id | string | The Datadog application ID generated when you create a RUM application. |
| RUM core attributes | application.name | string | The Datadog application name. |
| Device (Android, iOS, Roku) | device.type | string | The device type as reported by the device (System User-Agent). |
| Device (Android, iOS, Roku) | device.brand | string | The device brand as reported by the device (System User-Agent). |
| Device (Android, iOS, Roku) | device.model | string | The device model as reported by the device (System User-Agent). |
| Device (Android, iOS, Roku) | device.name | string | The device name as reported by the device (System User-Agent). |
| Connectivity (Android, iOS) | connectivity.status | string | Status of device network reachability (connected, not connected, or maybe). |
| Connectivity (Android, iOS) | connectivity.interfaces | string | The list of available network interfaces (for example, bluetooth, cellular, ethernet, or wifi). |
| Connectivity (Android, iOS) | connectivity.cellular.technology | string | The type of a radio technology used for cellular connection. |
| Connectivity (Android, iOS) | connectivity.cellular.carrier_name | string | The name of the SIM carrier. |
| Operating System (Android, iOS, Roku) | os.name | string | The OS name as reported by the device (System User-Agent). |
| Operating System (Android, iOS, Roku) | os.version | string | The OS version as reported by the device (System User-Agent). |
| Operating System (Android, iOS, Roku) | os.version_major | string | The OS version major as reported by the device (System User-Agent). |
| Geo-location | geo.country | string | Name of the country. |
| Geo-location | geo.country_iso_code | string | The ISO Code of the country (for example, US for the United States or FR for France). |
| Geo-location | geo.country_subdivision | string | Name of the first subdivision level of the country (for example, California in the United States or the Sarthe department in France). |
| Geo-location | geo.continent_code | string | ISO code of the continent (EU, AS, NA, AF, AN, SA, or OC). |
| Geo-location | geo.continent | string | Name of the continent (Europe, Australia, North America, Africa, Antarctica, South America, or Oceania). |
| Geo-location | geo.city | string | The name of the city (for example, San Francisco, Paris, or New York). |
| RUM user attributes (Android, Roku) | user.id | string | Identifier of the user. |
| RUM user attributes (iOS) | usr.id | string | Identifier of the user. |
| Global user attributes (Android, iOS, Roku) | usr.name | string | Name of the user. |
| Global user attributes (Android, iOS, Roku) | usr.email | string | Email of the user. |
| Session (Android events, iOS events, Roku events) | session.id | string | Unique ID of the session. |
| Session (Android events, iOS events, Roku events) | session.type | string | Type of the session (user). |
| Session (Android events, iOS events, Roku events) | session.is_active | boolean | Indicates if the session is currently active. The session ends if a user navigates away from the application or closes the browser window, and expires after 4 hours of activity or 15 minutes of inactivity. |
| Session (Android events, iOS events, Roku events) | session.initial_view.url | string | URL of the initial view of the session. |
| Session (Android events, iOS events, Roku events) | session.initial_view.name | string | Name of the initial view of the session. |
| Session (Android events, iOS events, Roku events) | session.last_view.url | string | URL of the last view of the session. |
| Session (Android events, iOS events, Roku events) | session.last_view.name | string | Name of the last view of the session. |
| Session (Android events, iOS events, Roku events) | session.ip | string | IP address of the session extracted from the TCP connection of the intake. If you want to stop collecting this attribute, change the setting in your application details. |
| Session (Android events, iOS events, Roku events) | session.useragent | string | System User-Agent info to interpret device info. |
| View (Android events, iOS events, Roku events) | view.id | string | Unique ID of the initial view corresponding to the event. |
| View (Android events, iOS events, Roku events) | view.url | string | Canonical name of the class corresponding to the event. For iOS, the URL of the UIViewController class corresponding to the event. |
| View (Android events, iOS events, Roku events) | view.name | string | Customizable name of the view corresponding to the event. |
| Resource (Android events, iOS events, Roku events) | resource.id | string | Unique identifier of the resource. |
| Resource (Android events, iOS events, Roku events) | resource.type | string | The type of resource being collected (for example, xhr, image, font, css, or js). |
| Resource (Android events, iOS events, Roku events) | resource.method | string | The HTTP method (for example, POST, GET, PATCH, or DELETE). |
| Resource (Android events, iOS events, Roku events) | resource.status_code | number | The response status code. |
| Resource (Android events, iOS events, Roku events) | resource.url | string | The resource URL. |
| Resource (Android events, iOS events, Roku events) | resource.provider.name | string | The resource provider name. Default is unknown. |
| Resource (Android events, iOS events, Roku events) | resource.provider.domain | string | The resource provider domain. |
| Resource (Android events, iOS events, Roku events) | resource.provider.type | string | The resource provider type (for example, first-party, cdn, ad, or analytics). |
| Error (Browser events, Android events, iOS events, Roku events) | error.source | string | Where the error originates from (for example, webview, logger, or network). |
| Error (Browser events, Android events, iOS events, Roku events) | error.type | string | The error type (or error code in some cases). |
| Error (Browser events, Android events, iOS events, Roku events) | error.message | string | A concise, human-readable, one-line message explaining the event. |
| Error (Browser events, Android events, iOS events, Roku events) | error.stack | string | The stack trace or complementary information about the error. |
| Error (Android events, iOS events, Roku events) | error.issue_id | string | The stack trace or complementary information about the error. |
| Network error (Android events, iOS events, Roku events) | error.resource.status_code | number | The response status code. |
| Network error (Android events, iOS events, Roku events) | error.resource.method | string | The HTTP method (for example, POST or GET). |
| Network error (Android events, iOS events, Roku events) | error.resource.url | string | The resource URL. |
| Network error (Android events, iOS events, Roku events) | error.resource.provider.name | string | The resource provider name. Default is unknown. |
| Network error (Android events, iOS events, Roku events) | error.resource.provider.domain | string | The resource provider domain. |
| Network error (Android events, iOS events, Roku events) | error.resource.provider.type | string | The resource provider type (for example, first-party, cdn, ad, or analytics). |
| Action (Browser events, Android events, iOS events, Roku events) | action.id | string | UUID of the user action. |
| Action (Browser events, Android events, iOS events, Roku events) | action.type | string | Type of the user action (for example, tap or application_start). For Custom Browser User Actions, it is set to custom. |
| Action (Browser events, Android events, iOS events, Roku events) | action.name | string | A user-friendly name (for example, Click on checkout). For Custom Browser User Actions, the action name given in the API call. |
| Action (Browser events, Android events, iOS events, Roku events) | action.target.name | string | Element that the user interacted with. Only for automatically collected actions. |
| View (Browser) | view.id | string | Randomly generated ID for each page view. |
| View (Browser) | view.loading_type | string | The type of page load, initial_load or route_change. For more information, see the single page applications support docs. |
| View (Browser) | view.referrer | string | The URL of the previous web page from which a link to the currently requested page was followed. |
| View (Browser) | view.url | string | The view URL. |
| View (Browser) | view.url_hash | string | The hash part of the URL. |
| View (Browser) | view.url_host | string | The host part of the URL. |
| View (Browser) | view.url_path | string | The path part of the URL. |
| View (Browser) | view.url_path_group | string | The automatic URL group generated for similar URLs (for example, /dashboard/? for /dashboard/123 and /dashboard/456). |
| View (Browser) | view.url_query | object | The query string parts of the URL decomposed as query params key/value attributes. |
| View (Browser) | view.url_scheme | object | The scheme part of the URL. |
| Device (Browser) | device.type | string | The device type as reported by the device (User-Agent HTTP header). |
| Device (Browser) | device.brand | string | The device brand as reported by the device (User-Agent HTTP header). |
| Device (Browser) | device.model | string | The device model as reported by the device (User-Agent HTTP header). |
| Device (Browser) | device.name | string | The device name as reported by the device (User-Agent HTTP header). |
| Operating system (Browser) | os.name | string | The OS name as reported by the device (User-Agent HTTP header). |
| Operating system (Browser) | os.version | string | The OS version as reported by the device (User-Agent HTTP header). |
| Operating system (Browser) | os.version_major | string | The OS version major as reported by the device (User-Agent HTTP header). |
| Session (Browser events) | session.id | string | Randomly generated ID for each session. |
| Session (Browser events) | session.ip | string | Client IP address. If you want to stop collecting this attribute, change the setting in your application details. |
| Session (Browser events) | session.is_active | boolean | Indicates if the session is currently active. The session ends after 4 hours of activity or 15 minutes of inactivity. |
| Session (Browser events) | session.type | string | The type of session, user or synthetics. Sessions from Synthetic Browser Tests are excluded from billing. |
| Session (Browser events) | session.referrer | string | The URL of the previous web page from which a link to the currently requested page was followed. |
| Session (Browser events) | session.initial_view.id | string | The ID of the first RUM view generated by the user. |
| Session (Browser events) | session.initial_view.url_host | string | The host part of the URL. |
| Session (Browser events) | session.initial_view.url_path | string | The path part of the URL. |
| Session (Browser events) | session.initial_view.url_path_group | string | The automatic URL group generated for similar URLs (for example, /dashboard/? for /dashboard/123 and /dashboard/456). |
| Session (Browser events) | session.initial_view.url_query | object | The query string parts of the URL decomposed as query params key/value attributes. |
| Session (Browser events) | session.initial_view.url_scheme | object | The scheme part of the URL. |
| Session (Browser events) | session.last_view.id | string | The ID of the last RUM view generated by the user. |
| Session (Browser events) | session.last_view.url_host | string | The host part of the URL. |
| Session (Browser events) | session.last_view.url_path | string | The path part of the URL. |
| Session (Browser events) | session.last_view.url_path_group | string | The automatic URL group generated for similar URLs (for example, /dashboard/? for /dashboard/123 and /dashboard/456). |
| Session (Browser events) | session.last_view.url_query | object | The query string parts of the URL decomposed as query params key/value attributes. |
| Session (Browser events) | session.last_view.url_scheme | object | The scheme part of the URL. |
| Resource (Browser events) | resource.type | string | The type of resource being collected (for example, css, javascript, media, XHR, or image). |
| Resource (Browser events) | resource.method | string | The HTTP method (for example POST or GET). |
| Resource (Browser events) | resource.status_code | number | The response status code. |
| Resource (Browser events) | resource.url | string | The resource URL. |
| Resource (Browser events) | resource.url_host | string | The host part of the URL. |
| Resource (Browser events) | resource.url_path | string | The path part of the URL. |
| Resource (Browser events) | resource.url_query | object | The query string parts of the URL decomposed as query params key/value attributes. |
| Resource (Browser events) | resource.url_scheme | string | The protocol name of the URL (HTTP or HTTPS). |
| Resource (Browser events) | resource.provider.name | string | The resource provider name. Default is unknown. |
| Resource (Browser events) | resource.provider.domain | string | The resource provider domain. |
| Resource (Browser events) | resource.provider.type | string | The resource provider type (for example, first-party, cdn, ad, or analytics). |
| Frustration signals (Browser events) | action.frustration.type:dead_click | string | The dead clicks detected by the RUM Browser SDK. |
| Frustration signals (Browser events) | action.frustration.type:rage_click | string | The rage clicks detected by the RUM Browser SDK. |
| Frustration signals (Browser events) | action.frustration.type:error_click | string | The error clicks detected by the RUM Browser SDK. |
| UTM (Browser events) | view.url_query.utm_source | string | The parameter in the URL tracking the source of traffic. |
| UTM (Browser events) | view.url_query.utm_medium | string | The parameter in the URL tracking the channel where the traffic is coming from. |
| UTM (Browser events) | view.url_query.utm_campaign | string | The parameter in the URL identifying the specific marketing campaign tied to that view. |
| UTM (Browser events) | view.url_query.utm_content | string | The parameter in the URL identifying the specific element a user clicked within a marketing campaign. |
| UTM (Browser events) | view.url_query.utm_term | string | The parameter in the URL tracking the keyword a user searched to trigger a given campaign. |
| APM core | language | string | The client SDK language used to generate the span. It can be one of cpp, dotnet, go, jvm, javascript, php, python, ruby. |
| APM core (Reserved) | env | string | The value of the DD_ENV environment variable or user-defined env for the running process. |
| APM core (Reserved) | version | string | The value of the DD_VERSION environment variable or user-defined version for the running process. |
| APM core | span.kind | string | The string representing the type of work unit handled by the span. It can be one of server, client, producer, consumer, or internal. For more information, see the OpenTelemetry SpanKind documentation. |
| APM core | component | string | The name of the library or integration that created the span. |
| Network communications | network.client.ip | string | The IP address of the client that initiated the inbound connection. |
| Network communications | network.destination.ip | string | The IP address to where the outbound connection is being made. |
| Network communications | network.host.ip | string | The local host IP address. |
| Network communications | network.client.port | number | The port of the client that initiated the connection. |
| Network communications | network.destination.port | number | The remote port number of the outbound connection. |
| Network communications | network.client.name | string | The hostname of the client that initiated the inbound connection. |
| Network communications | network.host.name | string | The local hostname. |
| Network communications | network.client.transport | string | The transport protocol used to make the inbound connection. |
| Network communications | network.destination.transport | string | The transport protocol used to make the outbound connection. |
| HTTP requests | http.status_code | string | The HTTP response status code. |
| HTTP requests | http.url | string | The URL of the HTTP request, including the obfuscated query string. For more information on obfuscation, see Configure Data Security. |
| HTTP requests | http.version | string | The version of HTTP used for the request. |
| HTTP requests | http.method | string | The port of the client that initiated the connection. |
| HTTP requests | http.route | string | The matched route (path template). For example, /users/:userID. |
| HTTP requests | http.client_ip | string | The IP address of the original client behind all proxies, if known. Discovered from headers such as X-Forwarded-For. |
| HTTP requests | http.useragent | string | The User-Agent header received with the request. |
| HTTP requests | http.request.content_length | number | The size of the request payload body in bytes. |
| HTTP requests | http.response.content_length | number | The size of the response payload body in bytes. |
| HTTP requests | http.request.content_length_uncompressed | number | The size of the uncompressed request payload body after transport decoding. |
| HTTP requests | http.response.content_length_uncompressed | number | The size of the uncompressed response payload body after transport decoding. |
| HTTP requests | http.request.headers.* | string | The request HTTP headers. None are collected by default, but can be optionally configured with DD_TRACE_HEADER_TAGS. |
| Database spans | db.system | string | Identifier for the database management system (DBMS) product being used. |
| HTTP requests | http.response.headers.* | string | The response HTTP headers. None are collected by default, but can be optionally configured with DD_TRACE_HEADER_TAGS. |
| Database spans | db.connection_string | string | The connection string used to connect to the database. |
| Database spans | db.operation | string | The name of the operation being executed. For example, SELECT, findAndModify, HMSET. |
| Database spans | db.sql.table | string | The name of the primary table that the operation is acting upon, including the database name (if applicable). |
| Database spans | db.row_count | number | The number of rows/results from the query or operation. |
| Message queue spans | messaging.system | string | The identifier of the messaging system. |
| Message queue spans | messaging.destination | string | The message destination name. |
| Message queue spans | messaging.destination_kind | string | The kind of message destination. |
| Message queue spans | messaging.protocol | string | The name of the transport protocol. |
| Message queue spans | messaging.protocol_version | string | The version of the transport protocol. |
| Message queue spans | messaging.url | string | The connection string to the messaging system. |
| Message queue spans | messaging.message_id | string | A value used by the messaging system as an identifier for the message, represented as a string. |
| Message queue spans | messaging.conversation_id | string | The conversation ID identifying the conversation to which the message belongs, represented as a string. |
| Message queue spans | messaging.message_payload_size | number | The size of the uncompressed message payload in bytes. |
| Message queue spans | messaging.operation | string | A string identifying the kind of message consumption. For example, send (a message sent to a producer), receive (a message is received by a consumer), or process (a message previously received is processed by a consumer). |
| Message queue spans | messaging.consumer_id | string | The identifier for the consumer receiving a message. |
| Remote procedure calls | rpc.system | string | The identifier of the remote system. |
| Remote procedure calls | rpc.service | string | The name of the service being called. |
| Remote procedure calls | rpc.method | string | The name of the method being called. |
