New Relic data dictionary

This data dictionary defines some of our default-reported data stored in NRDB and queryable via NRQL. This includes events like Transaction, MobileRequest, and BrowserInteraction, and our Metric, Log, and Span data types. These definitions are also available from our query builder UI by mousing over applicable data type and attribute names.

This dictionary doesn't contain:

  • Data from our infrastructure integrations (for that, see docs for a specific integration)
  • Custom data
  • Detailed integration-specific attributes for Metric data

NrAiIncident

Data source:

An NrAiIncident is created when violation of an alerts condition generates a violation event, which passes important information downstream.

Attribute nameDefinitionData types
accountId

The ID of the account where the violation occurred.

Available for muting rules.

aggregationDuration

The active condition's aggregation window.

closeCause

If applicable, what caused the incident to close. Available values:

  • CONDITION_DELETED: condition deleted.
  • CONDITION_DISABLED condition disabled.
  • CONDITION_MODIFIED condition edited
  • EVALUATOR: natural close because the metric has ceased to breach the threshold.
  • EXPIRED: incident closed due to TTL.
  • INCIDENT_WORKFLOW_INTEGRATION: a third party closed the issue or incident through an API call.
  • LABEL_BINDINGS_CHANGED : label was removed from the target, causing it to no longer be covered by the condition. This only applies to APM/Mobile/Browser/Infrastructure conditions.
  • LOSS_OF_SIGNAL: signal was lost, and incident was closed based on loss of signal settings.
  • MAINTENANCE: New Relic was performing maintenance and we closed the incident as part of it.
  • POLICY_DELETED: policy was deleted.
  • TARGET_REMOVED: the target was removed from the condition.
  • USER: closed manually by a user.
closeTime

The timestamp when the incident was closed.

closeViolationsOnExpiration

If true, open violations on the signal are closed if the signal is lost. Default is false. To use this field, an expirationDuration must be specified.

conditionId

The ID of the condition that triggered the violation.

Available for muting rules.

conditionName

The name of the condition that triggered the violation.

Available for muting rules.

degradationTime

The timestamp when the targeted metric started to breach the active condition’s threshold.

description

The contents of the active condition’s Violation Description field.

NRQL or Infrastructure conditions only.

entity.guid
ID

The GUID, assigned by New Relic, for the New Relic-monitored entity (host, application, etc.). This value is stored as a Base64 encoded value.

entity.name

The targeted entity's name, if available.

entity.type

The targeted entity's type, if available.

evaluationOffsetSeconds

The active condition's evaluation offset. A time delay (in seconds) to ensure data points are placed in the correct aggregation window.

evaluationType

The reason the violation was opened. Available values:

  • threshold (the condition threshold was breached)
  • expiration (the entity's signal was lost)
  • anomaly (an automatic anomaly was generated)
event

The record's event type.

Available values: open and close.

expirationDuration

The active condition's signal loss time window.

incidentId

The unique identifier of the violation.

muted

Shows whether the active condition was muted at the time of the incident event.

mutingRuleId

The unqiue identifier of the muting rule that caused the violation to be muted.

nrqlEventType

The type of data targeted by a NRQL condition. In this context, this refers to any NRQL-queryable data type.

Available for muting rules.

nrqlQuery

The full string of the NRQL query. Can be used for sub-string matching on attributes in the WHERE clause.

Available for muting rules.

openTime

The timestamp when the violation was opened.

operator

The violation threshold's operator, such as =, <, or >.

For signal loss violations, this is an empty string.

policyId

The ID of the policy that triggered the violation.

Available for muting rules.

policyName

The name of the policy that triggered the violation.

Available for muting rules.

priority

The incident's priority: low, medium, high, or critical. Default: high.

recoveryTime

The timestamp when the active condition's targeted metric stops breaching the threshold.

runbookUrl

The runbook URL for the condition that triggered the violation.

Available for muting rules.

tags.*

Arbitrary key-value metadata, or tags, associated with the violation. tags. is the prefix and * is the metadata/tag name. For details on how to use this, see the documentation for muting rules or alerts condition descriptions.

Available for muting rules.

targetName

The name of the violation’s target. This can be an entity or a query.

Available for muting rules.

threshold

The active condition's threshold value.

thresholdDuration

The active condition's threshold time window.

thresholdOccurrences

Shows whether for at least or at least once in occurrence values are being used in the active condition's threshold. Available values: all or any.

timestamp

The event's wall clock time using an epoch timestamp.

title

The incident's title.

type

The incident's type.

Available values: Incident.

valueFunction

The active condition's aggregation function.

Used in APM, browser, and mobile alert condition types.

violationTimeLimitSeconds

The active condition's violation time limit setting.

violationUuId

Deprecated. Do not use.

NrAiIncidentExternal

Data source:

An NrAiIncidentExternal event is created when a custom incident event is received via the incident event API.

Attribute nameDefinitionData types
aggregationTag.*

The aggregationTag attribute has a unique suffix added to it. Any events with aggregationTag and the same suffix value are grouped together in an incident. A resolve event resets this aggregation grouping.

When resolving an incident, make sure the resolve event includes the same aggregation tag.

deepLinkUrl

A URL to a page related to the incident.

description

The triggering event description.

entity.guid
ID

The GUID, assigned by New Relic, for the New Relic-monitored entity (host, application, etc.). This value is stored as a Base64 encoded value.

priority

The incident's priority: low, medium, high, or critical. Default: high.

runbookUrl

The runbook URL for the condition that triggered the violation.

source

The system that triggered the notification, not the entity that faulted. Required for trigger.

state

Whether the event should trigger a new incident or resolve an existing one. The values can be trigger, resolve, or acknowledge. Required.

tag.*

Arbitrary key-value metadata, or tags, associated with the violation. tag is the prefix and * is the metadata/tag name.

timestamp

The event's wall clock time using an epoch timestamp.

title

The triggering event title. Required for trigger.

version

The version of the current format.

NrAiIssue

Data source:

An NrAiIssue is created when a threshold of an alert condition generates an incident event, which passes important information downstream.

Attribute nameDefinitionData types
accountIds
ID

ID of the account where incidents occurred.

activateTime

The timestamp when the issue was activated.

closeCause

What caused the incident to close. Available values:

  • CLOSED_BY_ISSUE: Issue in a created state that closed naturally before activation.

  • CLOSED_BY_USER: Issue in a created state that the user closes before activation.

  • CLOSE_INACTIVE: Issue reached 5000 (max) incidents.

  • closeTtl: Issue closed due to issue TTL (issue settings).

  • CONDITION_DELETED: Condition deleted.

  • CONDITION_DISABLED: Condition disabled.

  • CONDITION_MODIFIED: Condition edited.

  • EVALUATOR: Natural close because the metric has ceased to breach the threshold.

  • EXPIRED: Incident closed due to TTL.

  • INCIDENT_CLOSED: The issue contains only anomalies and is closed when the last anomaly is closed.

  • LOSS_OF_SIGNAL: Signal was lost, and incident was closed based on loss of signal settings.

  • POLICY_DELETED: Policy was deleted.

  • TARGET_REMOVED: The target was removed from the condition.

  • thirdPartyIntegration: A third party closed the issue through an API call.

  • USER: Closed manually by a user on the legacy version.

  • userAction: Closed manually by a user.

closeTime

The timestamp when the incident was closed.

correlated

Indicates whether the issue was correlated (true/false).

correlatedCandidate

Indicates whether the issue was a correlated candidate (true/false).

correlationRuleIds
ID

The unique identifier of the correlation rule.

correlationRuleNames

The name of the correlation rule.

createTime

The timestamp when the issue was created.

entitiesCount
count

Number of impacted entities.

entity.names

The name of the targeted entity.

entity.types

The type of the targeted entity.

event

The event type of the record.

incidentCount
count

Number of incidents in the issue.

incidentIds
ID

The unique identifiers of the issue's incidents.

isIdle
ID

Indicates whether the issue is idle (true/false).

issueId
ID

The unique identifier of the issue.

issueLink

Link to the issue page.

lastModifiedTime
millisecond (s)

The timestamp of the last modification.

muted

Shows whether the active condition was muted at the time of the incident event.

parentId
ID

The unique identifier of the parent issue.

priority

The issue's priority: LOW, MEDIUM, HIGH, or CRITICAL. Default: HIGH.

sources

If applicable, the source of the issue.

timestamp

The wall clock time of the event using an epoch timestamp.

title

The incident's title.

NrAiNotification

Data source:

NrAiNotification shows details from every sent notification on your account, including both successful and failed notifications.

Attribute nameDefinitionData types
destinationName

Name of the destination used to send the notification.

destinationType

Destination type, such as Slack, email, or Jira.

notificationId

Internal identifier for the notification. Mostly used for debugging purposes.

notificationResult

If the integration allows us to create or fetch a link for the notification, this will show that link. If not, this will show the response json (for example, with webhook notifications).

operation

Notification operation, for example, Notify, Acknowledge, Close.

payload

For webhook operations, this will show the outgoing payload.

status

Whether the notification was SUCCESS or FAIL.

timestamp

Time the notification was sent.

NrAiSignal

Data source:

NrAiSignal shows details from every NRQL alert condition and every signal on your account, for every aggregation window that passes. This data is posted immediately after each aggregation window is aggregated and evaluated, so it will show you exactly what our alerts are seeing.

Attribute nameDefinitionData types
aggregatedDataPointsCount

Count of the number of data points that were aggregated for this window.

aggregationDuration

Duration of the aggregation window of the active condition, in seconds.

conditionId

ID of the active condition.

dataAccountId

The account ID containing the data being evaluated.

earlyEventDropCount
count

The number of data points that arrived too early to be included in the data aggregation window and were dropped from evaluation.

endTimestamp

Moment when this event was created, and the end of the aggregation window.

entity.guid
ID

The GUID, assigned by New Relic, for the New Relic-monitored entity (host, application, etc.). This value is stored as a Base64 encoded value.

entity.type

Type of the active entity. Note that NA indicates an infrastructure entity.

error

This captures any errors when evaluating the signal.

event

The type of event captured in this data point.

  • value: A single value was evaluated (most common).
  • expiration: A signal loss is detected.
  • reset: Indicates a detail of the condition was changed, and the signal has been reset.
  • summary: Indicates that data points were dropped for being early and/or late
  • removed: Indicates that a facet was removed from correlation because of a limit or ttl
expirationDuration

Duration of the loss of signal of the active condition.

expirationLastSeenTime

Exclusively for expiration events, it's the wall-clock time of the last data point received.

fillOption

Gap-filling setting from the active condition.

lateEventDropCount
count

The number of data points that arrived too late to be included in the data aggregation window and were dropped from evaluation.

numberOfDeviations

For baseline conditions only. Indicates the number of standard deviations between the actual value and the predicted value. Formally called z-score or standard score.

predictedValue

For baseline conditions only. Indicates the value that our models predicted for this data point.

removalCause

For removal events only. Available values:

  • facet_limit_reached: The number of facets being correlated has reached the limit.
  • facet_ttl_expired: A facet being correlated has not been updated within the defined ttl.
resetCause

For reset events only. Available values:

  • new: It's a new signal coming online.
  • expired: Signal reset due to loss of signal configuration.
  • conditionDisabled: The user disabled the condition in the UI.
  • delayedEvaluation: The condition has a delayed evaluation configured. Therefore, New Relic sends resets through the system to prevent evaluation before the expected time.
  • suppression: Because of an ongoing incident, alerts are suppressed.
  • interrupt: When we detect issues, we internally interrupt our services. Issues are mainly out-of-order data points that can cause false alerts.
  • conditionDeleted: The user has deleted the condition in the UI.
  • conditionModified: The user has modified the condition in a way that requires re-registration on our side.
  • policyDeleted: Deleted the entire policy.
  • user: The user has closed the incident manually in the UI.
serverTime

New Relic’s server clock time when the data point was evaluated.

signalId

Unique identifier for this data stream.

signalValue

Value of the signal for this aggregation window.

slideBySeconds

For sliding windows conditions only. Duration of the slide-by interval, in seconds.

standardDeviation

Tells you how closely the signal value and the baseline prediction track each other: Standard deviation will be low when they track each other closely, and high when they don't. This attribute uses the same units as the signal.

tags.<TagName>

All the system and custom tags that have been added to a signal.

timestamp

The start of the aggregation window.

type

The type of event being reported. Available values:

  • signal: A signal value that was evaluated.
  • info: Updates to a signal that do not correspond to a specific evaluation window.