41-45

cloud.azure.cosmosdb.date_plane_requests
cloud.azure.cosmosdb.metrics
cloud.azure.cosmosdb.mongo_requests
cloud.azure.cosmosdb.partition_key_ru_consumption
cloud.azure.cosmosdb.partition_key_statistics

tag41cloud.azure.cosmosdb.date_plane_requests

Field	Type	Extra fields
eventdate	`timestamp`
region	`str`
host	`str`
time	`timestamp`
resourceId	`str`
category	`str`
operationName	`str`
subscriptionId	`str`
properties__ipRangeFilter	`str`
properties__httpstatusCode	`str`
properties__cors	`str`
properties__privateEndpointArmUrl	`str`
properties__defaultConsistencyLevel	`str`
properties__httpMethod	`str`
properties__enableAutomaticFailover	`str`
properties__result	`str`
properties__activityId	`str`
properties__enableMultipleWriteLocations	`str`
properties__privateEndpointConnections	`str`
properties__maxStalenessPrefix	`str`
properties__maxStalenessIntervalInSeconds	`str`
properties__virtualNetworkResourceEntries	`str`
properties__enablePrivateEndpointConnection	`str`
properties__enableVirtualNetworkFilter	`str`
properties__enableDataPlaneRequestsTrace	`str`
properties__enableCassandraRequestsTrace	`str`
properties__enableGremlinRequestsTrace	`str`
properties__enableMongoRequestsTrace	`str`
properties__enableControlPlaneRequestsTrace	`str`
properties__sqlQueryTextTraceType	`str`
properties__apiKindResourceType	`str`
properties__resourceDetails	`str`
properties__apiKind	`str`
properties__operationType	`str`
properties__resourceUri	`str`
properties__duration	`str`
properties__roleAssignmentScope	`str`
properties__roleAssignmentPrincipalId	`str`
properties__roleAssignmentId	`str`
properties__associatedRoleDefinitionId	`str`
properties__roleAssignmentPrincipalType	`str`
hostchain	`str`	✓
tag	`str`	✓
rawMessage	`str`	✓

tag42cloud.azure.cosmosdb.metrics

Field	Type	Extra fields
eventdate	`timestamp`
region	`str`
host	`str`
time	`timestamp`
resourceId	`str`
average	`float8`
timeGrain	`str`
total	`int4`
metricName	`str`
count	`int4`
maximum	`int4`
minimum	`int4`
hostchain	`str`	✓
tag	`str`	✓
rawMessage	`str`	✓

tag43cloud.azure.cosmosdb.mongo_requests

Field	Type	Extra fields
eventdate	`timestamp`
region	`str`
host	`str`
time	`timestamp`
resourceId	`str`
category	`str`
operationName	`str`
properties__address	`str`
properties__databaseName	`str`
properties__retriedDueToRateLimiting	`str`
properties__responseLength	`str`
properties__errorCode	`str`
properties__userAgent	`str`
properties__requestLength	`str`
properties__requestCharge	`str`
properties__userId	`str`
properties__collectionName	`str`
properties__duration	`str`
properties__activityId	`str`
properties__authorizationTokenType	`str`
properties__estimatedDelayFromRateLimitingInMilliseconds	`str`
properties__piiCommandText	`str`
properties__region	`str`
hostchain	`str`	✓
tag	`str`	✓
rawMessage	`str`	✓

tag44cloud.azure.cosmosdb.partition_key_ru_consumption

Field	Type	Extra fields
eventdate	`timestamp`
region	`str`
host	`str`
time	`timestamp`
resourceId	`str`
category	`str`
properties__databaseName	`str`
properties__partitionKey	`str`
properties__regionName	`str`
properties__partitionKeyRangeId	`str`
properties__operationType	`str`
properties__requestCharge	`str`
properties__subscriptionId	`str`
properties__collectionName	`str`
hostchain	`str`	✓
tag	`str`	✓
rawMessage	`str`	✓

tag45cloud.azure.cosmosdb.partition_key_statistics

Field	Type	Extra fields
eventdate	`timestamp`
region	`str`
host	`str`
time	`timestamp`
resourceId	`str`
category	`str`
properties__databaseName	`str`
properties__partitionKey	`str`
properties__regionName	`str`
properties__sizeKb	`int4`
properties__accountName	`str`
properties__subscriptionId	`str`
properties__collectionName	`str`
hostchain	`str`	✓
tag	`str`	✓
rawMessage	`str`	✓

46-50

cloud.azure.cosmosdb.query_runtime_statistics
cloud.azure.datafactory.administrative
cloud.azure.eh.events
cloud.azure.eh.metrics

tag46cloud.azure.cosmosdb.query_runtime_statistics

Field	Type	Extra fields
eventdate	`timestamp`
region	`str`
host	`str`
time	`timestamp`
resourceId	`str`
category	`str`
traceDestination	`int4`
properties__resourcegroupname	`str`
properties__numberofrowsreturned	`str`
properties__partitionkeyrangeid	`str`
properties__signature	`str`
properties__shapesignature	`str`
properties__useragent	`str`
properties__partialipaddress	`str`
properties__querytext	`str`
properties__databasename	`str`
properties__activityId	`str`
properties__queryexecutionstatus	`str`
properties__subscriptionid	`str`
properties__collectionname	`str`
hostchain	`str`	✓
tag	`str`	✓
rawMessage	`str`	✓

tag47cloud.azure.datafactory.administrative

Field	Type	Source field name	Extra fields
eventdate	`timestamp`
hostname	`str`
region	`str`
roleLocation	`str`
timestamp	`timestamp`	time
resourceId	`str`
operationName	`str`
category	`str`
resultType	`str`
resultSignature	`str`
durationMs	`str`
callerIpAddress	`ip4`
correlationId	`str`
identity__authorization__scope	`str`
identity__authorization__action	`str`
identity__authorization__evidence__role	`str`
identity__authorization__evidence__roleAssignmentScope	`str`
identity__authorization__evidence__roleAssignmentId	`str`
identity__authorization__evidence__roleDefinitionId	`str`
identity__authorization__evidence__principalId	`str`
identity__authorization__evidence__principalType	`str`
identity__claims	`json`
identity__claims__aud	`str`
identity__claims__iss	`str`
identity__claims__iat	`str`
identity__claims__nbf	`str`
identity__claims__exp	`str`
identity__claims__aio	`str`
identity__claims__appid	`str`
identity__claims__appidacr	`str`
identity__claims__hasgroups	`str`
identity__claims__ipaddr	`ip4`
identity__claims__name	`str`
identity__claims__onprem_sid	`str`
identity__claims__puid	`str`
identity__claims__rh	`str`
identity__claims__uti	`str`
identity__claims__ver	`str`
identity__claims__xms_tcdt	`str`
level	`str`
properties__statusCode	`str`
properties__serviceRequestId	`str`
properties__eventCategory	`str`
properties__entity	`str`
properties__message	`str`
properties__hierarchy	`str`
tenantId	`str`
at_devo_collector_version	`int4`
at_entry_offset	`str`
at_enqueued_time	`timestamp`
hostchain	`str`		✓
tag	`str`		✓
rawMessage	`str`		✓

tag48cloud.azure.eh.events

Field	Type	Source field name	Extra fields
eventdate	`timestamp`
hostname	`str`
region	`str`
devo_collector_version	`int4`
activityId	`str`
activityName	`str`
activityRunId	`str`
archiveStep	`str`
caller	`str`
callerIpAddress	`str`
category	`str`
correlationId	`str`
durationInSeconds	`int8`
durationMs	`int4`
end	`str`
eventHub	`str`
eventName	`str`
eventProperties	`str`
eventTimeString	`str`
failures	`int8`
httpStatusCodeCategory	`str`
identity	`str`
isRequestSuccess	`str`
level	`str`
location	`str`
message	`str`
operationName	`str`
operationVersion	`str`
partitionId	`str`
pipelineName	`str`
pipelineRunId	`str`
properties_Category	`str`
properties_ClientRequestId	`str`
properties_ColumnName	`str`
properties_DatatypeName	`str`
properties_detail	`str`
properties_Domain	`str`
properties_DomainName	`str`
properties_EgressCacheHit	`str`
properties_EgressCacheMiss	`str`
properties_EgressCacheNoCache	`str`
properties_EgressCacheOthers	`str`
properties_EgressCacheUncacheable	`str`
properties_EgressHttpStatus2xx	`str`
properties_EgressHttpStatus3xx	`str`
properties_EgressHttpStatus4xx	`str`
properties_EgressHttpStatus5xx	`str`
properties_EgressHttpStatusOthers	`str`
properties_EgressTotal	`float8`
properties_Error	`str`
properties_EventEnqueuedUtcTime	`str`
properties_EventProcessedUtcTime	`str`
properties_Input	`str`
properties_JobName	`str`
properties_JobRuntimeName	`str`
properties_LogicalServerName	`str`
properties_Logical_server_name	`str`
properties_OperationName	`str`
properties_Output	`str`
properties_Parameters_ScheduleTime	`str`
properties_Parameters_TriggerTime	`str`
properties_Path	`str`
properties_Prefix	`str`
properties_RequestContentLength	`int8`
properties_RequestCountCacheHit	`str`
properties_RequestCountCacheMiss	`str`
properties_RequestCountCacheNoCache	`str`
properties_RequestCountCacheOthers	`str`
properties_RequestCountCacheUncacheable	`str`
properties_RequestCountHttpStatus200	`int8`
properties_RequestCountHttpStatus206	`int8`
properties_RequestCountHttpStatus2xx	`int8`
properties_RequestCountHttpStatus302	`int8`
properties_RequestCountHttpStatus304	`int8`
properties_RequestCountHttpStatus3xx	`int8`
properties_RequestCountHttpStatus404	`int8`
properties_RequestCountHttpStatus4xx	`int8`
properties_RequestCountHttpStatus5xx	`int8`
properties_RequestCountHttpStatusOthers	`int8`
properties_RequestCountTotal	`int8`
properties_RequestSize	`int8`
properties_Resource	`str`
properties_ResourceGroup	`str`
properties_ResourceId	`str`
properties_ResourceProvider	`str`
properties_ResourceType	`str`
properties_ResponseSize	`int8`
properties_RunbookName	`str`
properties_SKU	`str`
properties_SchemaName	`str`
properties_SourceSystem	`str`
properties_StreamName	`str`
properties_SubmitTime	`str`
properties_SubscriptionId	`str`
properties_SystemParameters_ExecutionStart	`str`
properties_SystemParameters_SubscriptionId	`str`
properties_SystemParameters_TriggerId	`str`
properties_TenantId	`str`
properties_TimeGenerated	`str`
properties_Type	`str`
properties_action	`str`
properties_activityDateTime	`str`
properties_activityDisplayName	`str`
properties_additionalDetails	`str`
properties_additionalTargets	`str`
properties_ancestors	`str`
properties_apiId	`str`
properties_apimSubscriptionId	`str`
properties_appDisplayName	`str`
properties_appId	`str`
properties_appliedConditionalAccessPolicies	`str`
properties_auditEventCategory	`str`
properties_authType_acceptingIpFilterRule	`str`
properties_authType_issuer	`str`
properties_authType_scope	`str`
properties_authType_type	`str`
properties_authenticationMethodsUsed	`str`
properties_authenticationProcessingDetails	`str`
properties_authenticationType_acceptingIpFilterRule	`str`
properties_authenticationType_issuer	`str`
properties_authenticationType_scope	`str`
properties_authenticationType_type	`str`
properties_avg_cpu_percent	`str`
properties_backendId	`str`
properties_backendMethod	`str`
properties_backendProtocol	`str`
properties_backendResponseCode	`int4`
properties_backendTime	`float8`
properties_backendUrl	`str`
properties_batching	`str`
properties_blobUri	`str`
properties_cache	`str`
properties_cacheTime	`str`
properties_calleeLocalTimeUtc	`str`
properties_caller	`str`
properties_callerLocalTimeUtc	`str`
properties_category	`str`
properties_clientAppUsed	`str`
properties_clientInfo	`str`
properties_clientIp	`str`
properties_clientPort	`int4`
properties_clientProtocol	`str`
properties_clientTime	`float8`
properties_cloudServiceConfiguration_osFamily	`str`
properties_cloudServiceConfiguration_targetOsVersion	`str`
properties_code	`str`
properties_conditionalAccessStatus	`str`
properties_conditions_destinationIP	`str`
properties_conditions_destinationPortRange	`str`
properties_conditions_protocols	`str`
properties_conditions_sourceIP	`str`
properties_conditions_sourcePortRange	`str`
properties_configurationId	`str`
properties_constraints_maxTaskRetryCount	`int4`
properties_continuation	`str`
properties_correlationId	`str`
properties_correlation_actionTrackingId	`str`
properties_correlation_clientTrackingId	`str`
properties_count_executions	`str`
properties_cpu_time	`str`
properties_createdDateTime	`str`
properties_currentDedicatedNodes	`int4`
properties_currentLowPriorityNodes	`int4`
properties_database	`str`
properties_deliveryAcknowledgement	`str`
properties_deliveryCount	`str`
properties_details_data	`str`
properties_details_file	`str`
properties_details_line	`str`
properties_details_message	`str`
properties_deviceDetail_browser	`str`
properties_deviceDetail_operatingSystem	`str`
properties_deviceId	`str`
properties_dipDownCount	`int8`
properties_direction	`str`
properties_displayName	`str`
properties_dollar_schema	`str`
properties_dop	`str`
properties_duration	`str`
properties_enableAutoScale	`bool`
properties_enableAutoscale	`bool`
properties_enableInterNodeCommunication	`bool`
properties_endTime	`str`
properties_endpointName	`str`
properties_endpointType	`str`
properties_errorCode	`str`
properties_errorLevel	`str`
properties_eventDescription	`str`
properties_eventName	`str`
properties_eventProperties_public_ip_address	`str`
properties_exec_type	`str`
properties_executionInfo_endTime	`str`
properties_executionInfo_exitCode	`int4`
properties_executionInfo_requeueCount	`int4`
properties_executionInfo_retryCount	`int4`
properties_executionInfo_startTime	`str`
properties_execution_type	`str`
properties_expiryTime	`str`
properties_failedOn	`str`
properties_failedRequestCount	`str`
properties_failureStatus	`str`
properties_filter	`str`
properties_healthPercentage	`int8`
properties_healthyHostCount	`str`
properties_host	`str`
properties_hostname	`str`
properties_httpMethod	`str`
properties_httpStatus	`int4`
properties_httpStatusCode	`int4`
properties_httpVersion	`str`
properties_id	`str`
properties_identityType	`str`
properties_imageType	`str`
properties_ingestionSourceId	`str`
properties_ingestionSourcePath	`str`
properties_initiatedBy	`str`
properties_insert_id	`str`
properties_instanceId	`str`
properties_interval_end_time	`str`
properties_interval_start_time	`str`
properties_io_bytes_read	`str`
properties_io_bytes_written	`str`
properties_io_requests	`str`
properties_ipAddress	`str`
properties_isAutoPool	`bool`
properties_isComplianceCheck	`str`
properties_isInteractive	`bool`
properties_isRoutingEnabled	`str`
properties_is_parameterizable	`str`
properties_jobId	`str`
properties_lastError_elapsed	`str`
properties_lastError_message	`str`
properties_lastError_reason	`str`
properties_lastError_scope	`str`
properties_lastError_section	`str`
properties_lastError_source	`str`
properties_last_insert_id	`str`
properties_latency	`str`
properties_location_city	`str`
properties_location_countryOrRegion	`str`
properties_location_geoCoordinates_latitude	`float8`
properties_location_geoCoordinates_longitude	`float8`
properties_location_state	`str`
properties_lock_time	`str`
properties_log_bytes_used	`str`
properties_loggedByService	`str`
properties_logical_io_reads	`str`
properties_logical_io_writes	`str`
properties_macAddress	`str`
properties_maskedIpAddress	`str`
properties_matchedConnections	`int8`
properties_maxTasksPerNode	`int4`
properties_max_cpu_time	`str`
properties_max_dop	`str`
properties_max_duration	`str`
properties_max_log_bytes_used	`str`
properties_max_logical_io_reads	`str`
properties_max_logical_io_writes	`str`
properties_max_num_physical_io_reads	`str`
properties_max_physical_io_reads	`str`
properties_max_query_wait_time_ms	`str`
properties_max_rowcount	`str`
properties_message	`str`
properties_messageId	`str`
properties_messageSize	`str`
properties_messageSizeInBytes	`str`
properties_method	`str`
properties_moduleId	`str`
properties_multiInstanceSettings_numberOfInstances	`int4`
properties_networkConfiguration_subnetId	`str`
properties_networkLocationDetails	`str`
properties_nodeDeallocationOption	`str`
properties_nodeInfo_nodeId	`str`
properties_nodeInfo_poolId	`str`
properties_num_physical_io_reads	`str`
properties_operationId	`str`
properties_operationType	`str`
properties_originalHost	`str`
properties_originatesFromUpdatePolicy	`bool`
properties_pageSize	`str`
properties_parentSpanId	`str`
properties_partitionId	`str`
properties_physical_io_reads	`str`
properties_plan_id	`str`
properties_policies	`str`
properties_policyId	`str`
properties_policyScope	`str`
properties_policyScopeName	`str`
properties_poolId	`str`
properties_port	`str`
properties_primaryIPv4Address	`str`
properties_priority	`str`
properties_processingTimeInMilliseconds	`int8`
properties_productId	`str`
properties_protocol	`str`
properties_publicIpAddress	`str`
properties_query	`str`
properties_query_hash	`str`
properties_query_id	`str`
properties_query_max_used_memory	`str`
properties_query_param_type	`str`
properties_query_plan_hash	`str`
properties_query_time	`str`
properties_receivedBytes	`int8`
properties_requestCount	`str`
properties_requestName	`str`
properties_requestQuery	`str`
properties_requestSize	`int8`
properties_requestUri	`str`
properties_reserved_storage_mb	`str`
properties_resizeTimeout	`str`
properties_resourceDisplayName	`str`
properties_resourceId	`str`
properties_resourceLocation	`str`
properties_resource_actionName	`str`
properties_resource_location	`str`
properties_resource_resourceGroupName	`str`
properties_resource_runId	`str`
properties_resource_subscriptionId	`str`
properties_resource_workflowId	`str`
properties_resource_workflowName	`str`
properties_responseCode	`int4`
properties_responseSize	`int8`
properties_result_str	`str`
properties_result	`int8`	properties_result_str
properties_resultCode	`str`
properties_resultMessage	`str`
properties_resultReason	`str`
properties_resultSize	`str`
properties_riskDetail	`str`
properties_riskEventTypes	`str`
properties_riskLevelAggregated	`str`
properties_riskLevelDuringSignIn	`str`
properties_riskState	`str`
properties_rootActivityId	`str`
properties_routeName	`str`
properties_rowcount	`str`
properties_rows_examined	`str`
properties_rows_sent	`str`
properties_ruleId	`str`
properties_ruleName	`str`
properties_ruleSetType	`str`
properties_ruleSetVersion	`str`
properties_sdkVersion	`str`
properties_sentBytes	`int8`
properties_serverResponseLatency	`str`
properties_serverRouted	`str`
properties_serverStatus	`str`
properties_server_id	`str`
properties_shouldRetry	`bool`
properties_site	`str`
properties_sql_text	`str`
properties_sslCipher	`str`
properties_sslEnabled	`str`
properties_sslProtocol	`str`
properties_startTime	`str`
properties_startTimeUtc	`str`
properties_start_time	`str`
properties_statement_key_hash	`str`
properties_statement_sql_handle	`str`
properties_statement_type	`str`
properties_status	`str`
properties_statusCode	`str`
properties_storage_space_used_mb	`str`
properties_subnetPrefix	`str`
properties_succeededOn	`str`
properties_systemTaskVersion	`int8`
properties_table	`str`
properties_targetDedicatedComputeNodes	`int4`
properties_targetDedicatedNodes	`int4`
properties_targetLowPriorityNodes	`int4`
properties_targetResourceName	`str`
properties_targetResourceType	`str`
properties_targetResources	`str`
properties_targetUpdatedProperties	`str`
properties_taskType	`str`
properties_thread_id	`str`
properties_throughput	`str`
properties_timeInSystem	`str`
properties_timeTaken	`float8`
properties_tokenIssuerType	`str`
properties_totalDipCount	`int8`
properties_total_query_wait_time_ms	`str`
properties_transactionId	`str`
properties_ttl	`str`
properties_type	`str`
properties_unHealthyHostCount	`str`
properties_url	`str`
properties_userAgent	`str`
properties_userDisplayName	`str`
properties_userId	`str`
properties_userPrincipalName	`str`
properties_user_host	`str`
properties_virtualMachineConfiguration_imageReference_offer	`str`
properties_virtualMachineConfiguration_imageReference_publisher	`str`
properties_virtualMachineConfiguration_imageReference_sku	`str`
properties_virtualMachineConfiguration_imageReference_version	`str`
properties_virtualMachineConfiguration_nodeAgentId	`str`
properties_virtual_core_count	`str`
properties_vmFillType	`str`
properties_vmSize	`str`
properties_vnetResourceGuid	`str`
properties_wait_category	`str`
resourceId	`str`
resultDescription	`str`
resultSignature	`str`
resultType	`str`
runId	`str`
start	`str`
startTime	`str`
status	`str`
subscriptionId	`str`
taskName	`str`
tenantId	`str`
timestamp	`timestamp`
trackingId	`str`
triggerEvent	`str`
triggerId	`str`
triggerName	`str`
triggerType	`str`
workflowId	`str`
source_message	`str`	rawMessage
hostchain	`str`		✓
tag	`str`		✓
rawMessage	`str`		✓

tag49cloud.azure.eh.metrics

Field	Type	Extra fields
eventdate	`timestamp`
hostname	`str`
region	`str`
count	`int8`
minimum	`int8`
maximum	`int8`
total	`int8`
average	`int8`
resourceId	`str`
timestamp	`timestamp`
metricName	`str`
timeGrain	`str`
hostchain	`str`	✓
tag	`str`	✓
rawMessage	`str`	✓

51-55

cloud.azure.factories.activity_runs
cloud.azure.factories.pipeline_runs
cloud.azure.factories.sandbox_activity_runs
cloud.azure.factories.sandbox_pipeline_runs
cloud.azure.factories.trigger_runs

tag51cloud.azure.factories.activity_runs

Field	Type	Extra fields
eventdate	`timestamp`
hostname	`str`
region	`str`
diag_level_info	`str`
correlation_id	`str`
time	`str`
activity_run_id	`str`
pipeline_run_id	`str`
resource_id	`str`
category	`str`
operation_name	`str`
activity_iteration_count	`int4`
pipeline_name	`str`
activity_name	`str`
start	`str`
end	`str`
status	`str`
failure_type	`str`
location	`str`
properties__input	`str`
properties__output	`str`
properties__error	`str`
properties__user_properties	`str`
properties__annotations	`str`
activity_type	`str`
tags	`str`
recovery_status	`str`
activity_retry_count	`int4`
billing_resource_id	`str`
at_devo_collector_version	`int4`
at_entry_offset	`str`
at_enqueued_time	`timestamp`
hostchain	`str`	✓
tag	`str`	✓
rawMessage	`str`	✓

tag52cloud.azure.factories.pipeline_runs

Field	Type	Extra fields
eventdate	`timestamp`
hostname	`str`
region	`str`
diag_level_info	`str`
correlation_id	`str`
time	`str`
run_id	`str`
resource_id	`str`
category	`str`
operation_name	`str`
pipeline_name	`str`
start	`str`
end	`str`
status	`str`
failure_type	`str`
location	`str`
properties__parameters	`str`
properties__system_parameters	`str`
properties__predecessors	`str`
properties__user_properties	`str`
properties__annotations	`str`
properties__message	`str`
tags	`str`
group_id	`str`
at_devo_collector_version	`int4`
at_entry_offset	`str`
at_enqueued_time	`timestamp`
hostchain	`str`	✓
tag	`str`	✓
rawMessage	`str`	✓

tag53cloud.azure.factories.sandbox_activity_runs

Field	Type	Extra fields
eventdate	`timestamp`
hostname	`str`
region	`str`
diag_level_info	`str`
correlation_id	`str`
time	`str`
activity_run_id	`str`
pipeline_run_id	`str`
resource_id	`str`
category	`str`
operation_name	`str`
activity_iteration_count	`int4`
pipeline_name	`str`
activity_name	`str`
start	`str`
end	`str`
status	`str`
failure_type	`str`
location	`str`
properties__input	`str`
properties__output	`str`
properties__error	`str`
properties__user_properties	`str`
properties__annotations	`str`
activity_type	`str`
tags	`str`
recovery_status	`str`
activity_retry_count	`int4`
meter_id	`str`
billing_resource_id	`str`
at_devo_collector_version	`int4`
at_entry_offset	`str`
at_enqueued_time	`timestamp`
hostchain	`str`	✓
tag	`str`	✓
rawMessage	`str`	✓

tag54cloud.azure.factories.sandbox_pipeline_runs

Field	Type	Extra fields
eventdate	`timestamp`
hostname	`str`
region	`str`
diag_level_info	`str`
correlation_id	`str`
time	`str`
run_id	`str`
resource_id	`str`
category	`str`
operation_name	`str`
pipeline_name	`str`
start	`str`
end	`str`
status	`str`
failure_type	`str`
location	`str`
properties__parameters	`str`
properties__system_parameters	`str`
properties__predecessors	`str`
properties__user_properties	`str`
properties__annotations	`str`
properties__message	`str`
tags	`str`
group_id	`str`
at_devo_collector_version	`int4`
at_entry_offset	`str`
at_enqueued_time	`timestamp`
hostchain	`str`	✓
tag	`str`	✓
rawMessage	`str`	✓

tag55cloud.azure.factories.trigger_runs

Field	Type	Extra fields
eventdate	`timestamp`
hostname	`str`
region	`str`
diag_level_info	`str`
correlation_id	`str`
time	`str`
trigger_id	`str`
resource_id	`str`
category	`str`
operation_name	`str`
trigger_name	`str`
trigger_resource_type	`str`
trigger_type	`str`
trigger_event	`str`
start	`str`
status	`str`
location	`str`
properties__parameters	`str`
properties__system_parameters	`str`
properties__message	`str`
properties__user_properties	`str`
properties__dependency_status	`str`
properties__triggered_pipelines	`str`
properties__trigger_resource_type	`str`
properties__annotations	`str`
tags	`str`
group_id	`str`
meter_id	`str`
billing_resource_id	`str`
at_devo_collector_version	`int4`
at_entry_offset	`str`
at_enqueued_time	`timestamp`
hostchain	`str`	✓
tag	`str`	✓
rawMessage	`str`	✓

56-60

cloud.azure.firewall.application_rule
cloud.azure.firewall.dns_proxy
cloud.azure.firewall.network_rule
cloud.azure.frontdoor.access
cloud.azure.frontdoor.waf

tag56cloud.azure.firewall.application_rule

Field	Type	Extra fields
eventdate	`timestamp`
hostname	`str`
region	`str`
devo_collector_version	`int4`
category	`str`
timestamp	`timestamp`
resourceId	`str`
operationName	`str`
entry_offset	`str`
enqueued_time	`str`
properties_msg	`str`
protocol	`str`
src	`str`
srcPort	`int4`
dst	`str`
dstPort	`int4`
action	`str`
reason	`str`
policy	`str`
ruleCollectionGroup	`str`
ruleCollection	`str`
rule	`str`
url	`str`
hostchain	`str`	✓
tag	`str`	✓
rawMessage	`str`	✓

tag57cloud.azure.firewall.dns_proxy

Field	Type	Extra fields
eventdate	`timestamp`
hostname	`str`
region	`str`
devo_collector_version	`int4`
category	`str`
timestamp	`timestamp`
resourceId	`str`
operationName	`str`
entry_offset	`str`
enqueued_time	`str`
properties_msg	`str`
protocol	`str`
src	`str`
srcPort	`int4`
dst	`str`
dstPort	`int4`
reason	`str`
queryID	`str`
type	`str`
class	`str`
name	`str`
size	`str`
dnsSec	`str`
bufferSize	`str`
responseCode	`str`
responseFlag	`str`
responseSize	`str`
responseDuration	`str`
errorCode	`str`
hostchain	`str`	✓
tag	`str`	✓
rawMessage	`str`	✓

tag58cloud.azure.firewall.network_rule

Field	Type	Extra fields
eventdate	`timestamp`
hostname	`str`
region	`str`
devo_collector_version	`int4`
category	`str`
timestamp	`timestamp`
resourceId	`str`
operationName	`str`
entry_offset	`str`
enqueued_time	`str`
properties_msg	`str`
protocol	`str`
src	`str`
srcPort	`int4`
dst	`str`
dstPort	`int4`
redirectedIp	`str`
redirectedPort	`int4`
action	`str`
threatIntel	`str`
reason	`str`
policy	`str`
ruleCollectionGroup	`str`
ruleCollection	`str`
rule	`str`
hostchain	`str`	✓
tag	`str`	✓
rawMessage	`str`	✓

tag59cloud.azure.frontdoor.access

Field	Type	Extra fields
eventdate	`timestamp`
hostname	`str`
region	`str`
timestamp	`timestamp`
resourceId	`str`
category	`str`
operationName	`str`
properties__trackingReference	`str`
properties__httpMethod	`str`
properties__httpVersion	`str`
properties__requestUri	`str`
properties__requestBytes	`str`
properties__responseBytes	`str`
properties__userAgent	`str`
properties__clientIp	`ip4`
properties__socketIp	`ip4`
properties__clientPort	`str`
properties__timeToFirstByte	`str`
properties__timeTaken	`str`
properties__requestProtocol	`str`
properties__securityProtocol	`str`
properties__routingRuleName	`str`
properties__rulesEngineMatchNames	`json`
properties__backendHostname	`str`
properties__isReceivedFromClient	`bool`
properties__httpStatusCode	`str`
properties__httpStatusDetails	`str`
properties__pop	`str`
properties__cacheStatus	`str`
properties__ErrorInfo	`str`
at_devo_collector_version	`int4`
at_entry_offset	`str`
at_enqueued_time	`timestamp`
hostchain	`str`	✓
tag	`str`	✓
rawMessage	`str`	✓

tag60cloud.azure.frontdoor.waf

Field	Type	Extra fields
eventdate	`timestamp`
hostname	`str`
region	`str`
timestamp	`timestamp`
resourceId	`str`
category	`str`
operationName	`str`
properties__clientIP	`str`
properties__clientPort	`str`
properties__socketIP	`str`
properties__requestUri	`str`
properties__ruleName	`str`
properties__policy	`str`
properties__action	`str`
properties__host	`str`
properties__trackingReference	`str`
properties__policyMode	`str`
properties__details__matches	`json`
properties__details__msg	`str`
properties__details__data	`str`
at_devo_collector_version	`int4`
at_entry_offset	`str`
at_enqueued_time	`timestamp`
hostchain	`str`	✓
tag	`str`	✓
rawMessage	`str`	✓

Table structure 41-60