Real User Monitoring log data fields - Application Real-Time Monitoring Service

This topic describes the data fields in Real User Monitoring logs.

Overview

Real User Monitoring logs include detail tables and an aggregation table.

Detail tables: View table, Resource table, Exception table, Action table, Custom table, Application table, and System table

Aggregation table: Session table

The Application and System tables are used only for native application monitoring.

Glossary

Attribute: An index that is typically a String. It is used to group, filter, and aggregate data. Attributes are not quantifiable, have a limited set of possible values, and are indexed.
Measure: An index that is typically a Number. It is a quantifiable value.
Metadata: Data that is not indexed by default. It describes other data, primarily by providing information about data properties.

Common attributes

Common attributes must be indexed. They are essential for data filtering and aggregation and exist in both detail and aggregation tables. Within the same session, common attributes usually have consistent values. However, values can differ if, for example, a user switches accounts within a session, which changes the user ID (UID).

Attribute	Type	Field name	Description
timestamp	long	Time of occurrence	The start time of the event. If not available, the system time is used.
event_type	string	Event type	view, resource, exception, longtask, action, custom, and the session aggregation table.
event_id	string	Event ID	resource, exception, longtask, action, and custom events, excluding view and session.
app.id	string	Application ID	The unique application ID generated when you create a Real User Monitoring (RUM) application.
app.version	string	Application version	The user-defined version number.
app.channel	string	Application channel	The application channel.
app.env	string	Environment context	The environment type, used to distinguish between environments such as production (prod) (default), grayscale (gray), and pre-release (pre).
app.type	string	Application type	The application type selected when the application was created. It is specified by both the reporting side and the data stream. Valid values: android ios browser miniapp
app.package	string	Application package name	The definition of Package varies by platform: Android: PackageName iOS: BundleIdentifier Miniapp: AppId Browser: User-defined
user.id	string	User ID	User ID (visitor identifier). It is automatically generated by the software development kit (SDK) and cannot be modified.
user.name	string	Username	Username (business user identifier). Requires custom configuration.
user.tags	string	User tag	The user tag.
device.id	string	Device ID	The device ID.
device.type	string	Device type	The device type reported by the device, such as mobile phone or PC.
device.brand	string	Device brand	The device brand reported by the device, such as Mac, iPad, Huawei, or Xiaomi.
device.model	string	Device model	The device model reported by the device.
device.name	string	Device name	The device name reported by the device.
os.type	string	Operating system	The operating system name reported by the device.
os.version	string	Operating system version	The operating system version reported by the device.
os.container	string	Container type	Examples: Chrome, WeChat mini program, or App (application name).
os.container_version	string	Container version	Example: The version of Chrome.
geo.country	string	Country	The country name.
geo.country_id	string	Country ISO	The ISO code of the country.
geo.province	string	Province/Region	The province or region name.
geo.province_id	string	Region Code	The province or region code.
geo.city	string	City	The city name.
geo.city_id	string	City Code	The city code.
isp.id	string	Carrier ID	The carrier ID.
isp.name	string	Carrier name	The carrier name.
net.model	string	Connection type	The network connection type, such as 2G, 3G, 4G, 5G, WIFI, or Unknown. The value is returned based on platform-specific information.
net.name	string	Network name	The Ethernet name.

Common measures

Metric	Type	Description
times	int	The number of times the event occurred. The default value is 1.

Common metadata

Field name	Type	Description
os.user_agent	string	Reported request header.
net.ip	string	Client IP
device.sr	string	Screen resolution.
os.container_vp	string	Page size resolution.

Detail table design

View table

A View is an interactive user view that focuses on access volume and related performance data. Views are classified into the following types:

PV: Used to count the number of times a View is accessed. A PV must be reported for each View access. It provides the basic data used to associate various events and calculate various timing metrics.
Web Vitals: Based on the three core view performance metrics proposed by Google. They are stored separately because their collection timing varies greatly and the standards are clearly defined.
Perf: Common performance data for a view. It is a miscellaneous category of metrics based on the Performance standard. This type focuses on the objective performance of a page. Subjective performance metrics are not included.
Note
For example, page dwell time is a type of subjective performance. By definition, page dwell time is a type of user behavioral data and is more appropriately managed in the Action table.

Web Vitals and Perf are optional reporting types and may not apply to native views.

Attributes

Attribute	Type	Field name	Description
session.id	string	Session ID	The associated session.
view.id	string	View ID	A randomly generated ID for each page view.
view.name	string	View name	An alias for a class of views. By default, it is the path part of the URL. It can be matched based on rules or configured by the user.
view.loading_type	string	View loading type	View loading type: initial_load route_change
view.type	string	View event type	View event type: pv perf
view.view_type	string	View rendering type	-

Measures

Attribute	Type	Field name	Description
view.time_spent	long (ms)	Page	The time spent on the current view.
view.largest_contentful_paint	long (ms)	Largest Contentful Paint	The time when the largest DOM object (visible on the screen) in the view is rendered in the page load timeline. A value greater than 2.5 seconds is marked as slow.
view.first_input_delay	long (ms)	First Input Delay	The time elapsed between the user's first interaction with the page and the browser's response.
view.cumulative_layout_shift	long	Cumulative Layout Shift	Quantifies unexpected page movement caused by dynamically loaded content, such as third-party ads. A value of 0 indicates no shift.
view.first_contentful_paint	long (ms)	First Contentful Paint (blank screen time)	The time when the browser first renders text, an image (including background images), a non-white canvas, or an SVG.
view.dom_interactive	long (ms)	Time to Interactive	The time when the content becomes interactive.
view.dom_content_loaded	long (ms)	HTML complete load time (DOM Ready time)	The event is triggered when the initial HTML document is fully loaded and parsed, without waiting for non-render-blocking stylesheets, images, and subframes to finish loading.
view.dom_complete	long (ms)	DOM	The page and all its sub-resources are ready. For the user, the loading spinner has stopped.
view.load_event	long (ms)	Page full load time	The event triggered when the page is fully loaded. It is often a trigger for additional application logic. Note A page load time of less than 2 seconds is considered excellent, and up to 4 seconds is acceptable. A page load time greater than 5 seconds not only affects the website's search engine ranking but also severely impacts the user experience.

Metadata

Attribute	Type	Description
view.referrer	string	The URL of the previous webpage from which a link to the currently requested page was followed.
view.url	string	The URL corresponding to the View. The full URL includes the scheme, host, path, query, and hash parts.
view.timing_data	string	A JSON string of PerformanceResourceTiming.
view.snapshots	string	A JSON string of the View snapshot, mainly used for native applications.

Resource table

A Resource event is a summary of network requests. It is a Real User Monitoring (RUM) event type based on the HTTP protocol and the Performance standard. Because the Performance standard varies significantly across different platforms, RUM has made adjustments to align these differences.

From a business and practical perspective, resources are divided into two main categories: static resources and APIs. Although static resources and APIs are both resources requested over HTTP, the focus for each is quite different, as described in the following list:

Static resources (where `resource.type` is `css`, `javascript`, `image`, `media`, and so on) focus on the resource type, CDN, and network stability. When `resource.type` is `navigation`, the resource data is associated with the View (same `view.id`).
APIs (where `resource.type` is `XHR`, `fetch`, or `API`) are primarily concerned with server-side interactions, such as response codes and Response content, and have a strong association with Tracing.
XHR and fetch are mainly used in browsers and WebViews, or in similar scenarios.
If an API type is not specified, the default value is API. This value is common in native and miniapp scenarios.

Generally, a Resource event focuses only on cases where a real network request is initiated. For data retrieved from the cache, we recommend that you filter it out and do not report it. If reporting this data is valuable (for example, to calculate the cache hit ratio or resource usage), you must mark the resource type as cached to distinguish it from resources that initiated a network request.

Attributes

Attribute	Type	Description
session.id	string	The associated session.
view.id	string	The associated View.
view.name	string	The associated view.name.
resource.type	string	The type of resource collected. Examples: `css`, `javascript`, `media`, `XHR`, `image`, `navigation`. Note If the request is an XHR or fetch request, the resource type is considered an API.
resource.method	string	The HTTP request method. Examples: POST, GET.
resource.status_code	string	Resource status code.
resource.message	string	The content of the returned result, typically provided when an error occurs. It corresponds to `resource.error_msg`.
resource.url	string	Resource URL.
resource.name	string	By default, this is the path part of the URL. It can be matched based on rules or configured by the user.
resource.provider_type	string	The type of resource provider. Examples: `first-party`, `cdn`, `ad`, `analytics`.
resource.trace_id	string	The trace ID of the resource request.

Measure

Metric	Type	Description
resource.success	number	Indicates whether the resource was loaded successfully: 1 (default): Success 0: Failed
resource.duration	long (ms)	The total time spent loading the resource. Formula: `responseEnd - redirectStart`
resource.size	long (bytes)	The size of the resource, corresponding to `decodedBodySize`.
resource.connect_duration	long (ms)	The time spent establishing a connection to the server. Formula: `connectEnd - connectStart`
resource.ssl_duration	long (ms)	The time spent on the TLS handshake. This metric does not appear if the last request was not made over HTTPS. Formula: `connectEnd - secureConnectionStart` If the value of `secureConnectionStart` is 0, it means no SSL-VPN connection was initiated. In this case, `ssl_duration` is not calculated and is set to 0.
resource.dns_duration	long (ms)	The time spent resolving the DNS name for the last request. Formula: `domainLookupEnd - domainLookupStart`
resource.redirect_duration	long (ms)	The time spent on HTTP request redirection. Formula: `redirectEnd - redirectStart`
resource.first_byte_duration	long (ms)	The time spent waiting to receive the first byte of the response. Formula: `responseStart - requestStart`
resource.download_duration	long (ms)	The time spent downloading the response. Formula: `responseEnd - responseStart`

Metadata

Attribute	Type	Description
resource.timing_data	string	A JSON string of PerformanceResourceTiming.
resource.trace_data	string	Snapshot of Tracing Analysis information: `{ "propagatorType": "tracecontext", "traceId": "57599e11233cc6ebe1a3f539bbb1f238", "spanId": "3be6827e9b4f0956", "sample": 1, }`
resource.snapshots	string	View snapshot, mainly included for native applications. `"resource.flavor": "1.0", "resource.client.tcp.ip": "127.0.0.1", "resource.client.tcp.port": 8080, "resource.request.content_length": 1024, "resource.request.header.content_type": [ "application/json" ], "resource.request.header.accept_encoding": [ "gzip", "deflate", "br" ], "resource.response.content_length": 2048, "resource.response.header.eagleid": [ "670f632716687515436056344e" ],`
resource.node_name	string	The DOM type that initiated the request.
resource.xpath	string	The location where the XPath occurred. html. > body. > img.
resource.provider_name	string	The name of the resource provider. The default value is `unknown`.
resource.provider_domain	string	The domain name of the resource provider.

Exception table

An Exception is an unexpected event that occurs during code execution.

Crash: The application terminates unexpectedly.
ANR: Application Not Responding. This occurs when a specific message, such as a Key Dispatch, Broadcast, or Service message, is not processed within the specified time in the application's UI thread (main thread). By definition, an ANR has all the characteristics of an exception and is classified as an Exception, not a LongTask.
Exception: Other abnormal situations that do not cause a Crash or ANR.
Custom: A custom error that is actively reported by the user.
Error: Mainly used to record JavaScript-related errors.
Blank: Used for blank screen monitoring, primarily for blank screen events in browsers.

Attributes

Attribute	Type	Description
session.id	string	The associated session.
view.id	string	The associated View.
view.name	string	The associated view.name.
exception.source	string	The source of the error. Examples: `console`, `event`.
exception.file	string	Error file.
exception.type	string	The error type. It includes: crash custom (custom error) error (execution error)
exception.subtype	string	A sub-category of the error type.
exception.name	string	Error name.
exception.message	string	A concise, human-readable message that explains the event.

Metadata

Attribute	Type	Description
exception.stack	string	A stack trace or supplementary information about the error.
exception.caused_by	string	Cause of the exception.
exception.line	long	The line number where the exception occurred.
exception.column	long	The column number where the exception occurred.
exception.thread_id	string	Thread ID.
exception.binary_images	string	Error source.
exception.snapshots	string	Error snapshot.

Action table

Attributes

Attribute	Type	Description
session.id	string	The associated session.
view.id	string	The associated View.
view.name	string	The associated view.name.
action.type	string	User behavior type.
action.name	string	A semantic name. Example: `Click #checkout`.
action.target_name	string	The element with which the user interacted. Used only for automatically collected actions.

Measure

Metric	Type	Description
action.duration	long (ms)	Duration of the behavior.

Metadata

Attribute	Type	Description
action.snapshots	string	Behavior snapshot.
action.method_info	string	Behavior callback. Example: `onClick()`.

Custom table

Attributes

Attribute	Type	Description
session.id	string	The associated session.
view.id	string	The associated View.
view.name	string	The associated view.name.
custom.type	string	Custom type.
custom.name	string	Custom event name.
custom.group	string	Custom event group.

Measure

Attribute	Type	Description
custom.value	number	You can customize event groups.

Metadata

Attribute	Type	Description
custom.snapshots	string	The character length generally does not exceed 5,000 characters.

Application table

This table records application-level events, such as cold or hot starts, application exits, and switching the application between the background and foreground.

Attributes

Attribute	Type	Description
session.id	string	The associated session.
application.type	string	Enumeration type: launch exit background: Runs in the background. Bring to foreground
application.name	string	A more granular type for `application.type`. Examples: Cold start Hot launch: Hot start first launch background: Run in the background Bring to foreground

Measure

Metric	Type	Description
application.duration	long (ms)	The duration corresponding to the application event type.

Metadata

Attribute	Type	Description
application.snapshots	string	Snapshot data of the application launch event, which is generally a thread method.

System table

Attributes

Attribute	Type	Description
session.id	string	The associated session.
system.type	string	User behavior type.
system.name	string	A semantic name. Example: `Click #checkout`.

Metadata

Attribute

Type

Description

system.snapshots

string

"sys.net_change.before.ip": "1.1.XX.XX",
"sys.net_change.before.standard": "wifi",
"sys.net_change.after.ip": "2.2.2.2",
"sys.net_change.after.standard": "4G",

Aggregation table design

Session table

Attributes

Attribute	Type	Description
session.id	string	A randomly generated ID for each session.
session.ip	string	Client IP address.
session.referrer	string	The URL of the previous webpage from which a link to the currently requested page was followed.
session.initial_view_id	string	The first View ID generated by the user.
session.initial_view_name	string	The first View Name generated by the user.
session.last_view_id	string	The last View ID generated by the user.
session.last_view_name	string	The last View Name generated by the user.
session.start	long	The start timestamp of the session.
session.end	long	The end timestamp of the session.

Metadata

Attribute	Type	Description
session.initial_view.url	string	The first View URL generated by the user.
session.last_view_url	string	The last View URL generated by the user.

Measure

Metric	Type	Name	Description
session.time_spent	long (ms)	Session duration	The duration of the user session.
session.view_count	long	View count	The total count of all page views collected in this session.
session.exception_count	long	Exception count	The total count of all exceptions collected in this session.
session.resource_count	long	Resource request count	The total count of all resources collected in this session.
session.resource_error_count	long	Resource error count	The total count of all resource errors collected in this session.
session.api_count	long	API request count	The total count of all API requests collected in this session.
session.api_error_count	long	API error count	The total count of all API request errors collected in this session.
session.action_count	long	User event count	The total count of all actions collected in this session.
session.long_task_count	long	Stuttering count	The total count of all long tasks collected in this session.