monitor.dynatrace

Introduction

The tags beginning with monitor.dynatrace identify events generated by Dynatrace.

Valid tags and data tables

The full tag must have 4 levels. The first two are fixed as monitor.dynatrace. The third level identifies the type of events sent. The fourth level indicates the event subtype.

These are the valid tags and corresponding data tables that will receive the parsers' data:

Product / Service	Tags	Data tables
Dynatrace API	`monitor.dynatrace.api.audit_log`	`monitor.dynatrace.api.audit_log`
Dynatrace API	`monitor.dynatrace.api.grail_query`	`monitor.dynatrace.api.grail_query`

For more information, read more About Devo tags.

Table structure

monitor.dynatrace.api.audit_log

Field	Type	Extra fields
eventdate	`timestamp`
hostname	`str`
log_id	`str`
event_type	`str`
category	`str`
entity_id	`str`
environment_id	`str`
user	`str`
user_type	`str`
user_origin	`str`
timestamp	`timestamp`
success	`bool`
patch	`str`
at_devo_pulling_id	`str`
at_devo_environment	`str`
hostchain	`str`	✓
tag	`str`	✓
rawMessage	`str`	✓

monitor.dynatrace.api.grail_query

Field	Type	Field Transformation	Source field name	Extra fields
eventdate	`timestamp`
machine	`str`
event_timestamp	`timestamp`
content	`str`
dt_entity_host	`str`
dt_entity_host_group	`str`
dt_entity_process_group	`str`
dt_entity_process_group_instance	`str`
dt_host_group_id	`str`
dt_process_name	`str`
dt_source_entity	`str`
event_type	`str`
host_name	`str`
log_source	`str`
loglevel	`str`
process_technology	`str`	join(process_technology_array, ',')	process_technology_array
status	`str`
dt_process_group_detected_name	`str`
at_devo_environment	`str`
at_devo_pulling_id	`str`
web_server_iis_application_pool	`str`	join(web_server_iis_application_pool_array, ',')	web_server_iis_application_pool_array
web_server_iis_site_id	`str`
web_server_iis_site_name	`str`
winlog_level	`str`
winlog_opcode	`str`
winlog_provider	`str`
winlog_task	`str`
record_id	`str`
winlog_eventid	`str`
azure_location	`str`
dt_entity_azure_region	`str`
dt_entity_azure_vm	`str`
azure_vmid	`str`
aws_region	`str`
aws_resource_id	`str`
dt_entity_aws_availability_zone	`str`
dt_entity_ec2_instance	`str`
aws_availability_zone	`str`
hostchain	`str`			✓
tag	`str`			✓
rawMessage	`str`			✓