This topic provides details on the data model of TrueSight Intelligence.
What data can you collect for analyzing?
TrueSight Intelligence data model
Metrics data model
Define metrics and send measures data
Apps and app associations
Apps provide you the capability to associate data from multiple sources, and view this data collectively for the purpose of analytics.
- Metric data is tagged when a measurement is sent with the app_id at the source.
- For events, the tag ID field is used for specifying the name of the app.
In the following example, metric data from Source_1 and Source_3 is associated to App X, whereas data from Source_2, Source_4, and Source_5 is associated to App Y.
Events data model
|eventId||Unique ID for the event|
|createdAt||Epoch time when the event was created. |
Automatically set by the server, if not specified.
|receivedAt||Epoch time when the event was received by the server|
|Title||Text field to specify the title|
|EventClass||Categorize similar events|
|Fingerprint fields||List of fields used to uniquely identify an event|
|Properties||(optional) Custom properties for an event|
|Tags||Any tag. For example, app_id="my app"|
|Source||Source of the event|
|Sender||Sender of the event|
|Message||Text field to specify a detailed message|
|Severity||Event severity. For example, info, minor, major|
|Status||Event status. For example, open, close|
Send event data
Fingerprint fields are defined to have unique values that do not change with time. For example, an event ID is used to identify an event, and the status of the event can be either 'open' or 'close'. The event ID field is never updated in this case. If the value for any fingerprint field is changed, a new event is created.
Ensure that the value of the fingerprint fields are not changed when sending multiple values for other event parameters.
Specify any key:values pairs as part of the event definition. A maximum of 128 fields can be defined for each event, provided the total size of each event is less than 32K.