Event Center¶

Event Center is TrueWatch's unified event query and analysis platform. It aggregates event data from multiple sources, including Monitors, Smart Monitoring, AI Monitors, SLOs, Security Monitoring, Audit, and OpenAPI, and provides multi-dimensional filtering, detail viewing, and correlation analysis capabilities.

Event Center only performs event aggregation and querying; it does not generate events, configure rules, or send notifications. Events are independently generated by the source modules and automatically aggregated here.

Event Sources¶

Source	Generation Method	`df_source` Value
Monitor	Configure detection rules in the Monitor module; triggered when conditions are met	`monitor`
Smart Monitoring	Detects anomalies according to built-in rules or fixed rules generated and saved by AI	`smartMonitor`
AI Monitor	AI analyzes observability data based on natural language prompts on each execution and generates an event report when it finds issues supported by evidence	`aiMonitor`
Change Events	Records runtime activities in Kubernetes clusters that differ from expected patterns	`change`
SLO	Configure service quality objectives in the SLO module; triggered when objectives are breached	`slo`
Security Monitoring	Alerts for abnormal behavior or vulnerabilities detected by the security module	`security`
Audit Events	Records of user operations on the TrueWatch platform	`audit`
Custom Events	Actively written via OpenAPI	`user`

Event Content Composition¶

Event content is determined by the source system at the time of generation. Event Center only displays it.

Rule Monitor Events¶

Monitor event content is based on the template configured under Create Rules > Event Notification and supports dynamic population through variables:

Variable (Example)	Description	Example
`{{Result}}`	Detection result value	`85.5`
`{{df_dimension_tags}}`	Event dimensions	`{"host":"web01"}`
`{{df_monitor_checker_name}}`	Monitor name	`主机 CPU 监控`

The system replaces variables based on actual monitoring data to generate the final event content.

As shown in the following figure, the event title is defined as 日志检测-多索引, and the event content includes the DQL query statement and variables. The system generates and displays the final result based on actual monitoring data.

After a rule detects an anomaly, you can view the related event content in Events > Event Details.

Smart Monitoring Event Analysis Reports¶

Smart Monitoring performs detection according to saved fixed rules. Once a rule meets its trigger conditions, the system generates a Smart Monitoring event and provides an analysis report in the event details.

A single detection may trigger multiple rules simultaneously. The system aggregates the rules matched in that detection into a single analysis report, presenting information by detection dimension, such as anomaly summary, rule details, monitoring signals, current values, judgment basis, anomaly causes, and trends. Smart Monitoring events have a df_source value of smartMonitor; you can filter by df_source:smartMonitor to view them.

AI Monitor Event Reports¶

AI Monitor treats prompts as continuously effective detection rules, querying and analyzing relevant observability data on each execution. When it finds a problem that matches the description and is supported by data evidence, the system generates a structured event report and displays it in Event Center as an event record.

The event report provides a problem summary, confidence level, and supporting evidence, along with impact scope, diagnosis, and recommended actions, to help users understand the issue, confirm its impact, and proceed with follow-up handling.

AI Monitor event reports have a df_source value of aiMonitor. Go to Event Center > All Events and filter by df_source:aiMonitor to view them.

Event Field Reference¶

Common Fields¶

Final event records generally include the following fields:

Field	Description
`date` / `timestamp`	Generation time. Unit: seconds
`df_date_range`	Time range. Unit: seconds
`df_check_range_start`	Detection range start time. Unit: seconds
`df_check_range_end`	Detection range end time. Unit: seconds
`df_issue_start_time`	Time when the first fault occurred in this round. Unit: seconds
`df_issue_duration`	Duration of this fault round, in seconds (from `df_issue_start_time` to this event)
`df_source`	Event source. See Event Sources for common values
`df_status`	Event status. Includes ok, info, fatal, warning, error, critical, nodata, nodata_ok, nodata_as_ok, manual_ok
`df_sub_status`	Event detail status (supplementary to `df_status`)
`df_event_id`	Unique event ID
`df_title`	Title
`df_message`	Description

Fields Specific to Monitor Events¶

When df_source = monitor, the following additional fields exist:

Field	Description
`df_dimension_tags`	Detection dimension tags, e.g., `{"host":"web01"}`
`df_monitor_id`	Alert Policy ID
`df_monitor_name`	Alert Policy Name
`df_monitor_type`	Type: `custom` for custom monitor events, `slo` for SLO events, and `bot_obs` for Intelligent Inspection events
`df_monitor_checker`	Execution function name, e.g., `custom_metric`
`df_monitor_checker_sub`	Detection phase: `nodata` for events generated during the data gap detection phase, `check` for events generated during the normal detection phase
`df_monitor_checker_id`	Monitor ID
`df_monitor_checker_name`	Monitor name
`df_monitor_checker_value`	Anomaly value when the event was generated
`df_monitor_checker_value_dumps`	Anomaly value when the event was generated (JSON serialized) Makes it convenient for consumers to obtain the raw value through deserialization
`df_monitor_checker_value_with_unit`	Anomaly value when the event was generated (optimal unit)
`df_monitor_checker_ref`	Monitor correlation; fields associated only with the DQL statement in the detection configuration
`df_monitor_checker_event_ref`	Monitor event correlation; fields associated only with `df_dimension_tags` and `df_monitor_checker_id`
`df_monitor_ref_key`	Correlation key for self-built inspections, used to map to the corresponding self-built inspection
`df_fault_id`	Fault ID for this round, set to the `df_event_id` of the first fault event
`df_fault_status`	Fault status for this round; a redundant field of `df_status` and `df_sub_status` that indicates whether it is OK. Values: ok: normal fault: fault
`df_fault_start_time`	Start time of this fault round
`df_fault_duration`	Duration of this fault round, in seconds (from `df_issue_start_time` to this event)
`df_event_detail`	Event detection details
`df_user_id`	User ID of the operator when manually recovered
`df_user_name`	Username of the operator when manually recovered
`df_user_email`	User email of the operator when manually recovered
`df_crontab_exec_mode`	Execution mode. Available values: Automatic trigger (scheduled execution) `crontab` Asynchronous invocation (manual execution) `manual`
`df_site_name`	Current TrueWatch site name
`df_workspace_name`	Workspace name to which it belongs
`df_workspace_uuid`	UUID of the workspace to which it belongs
`df_label`	Monitor labels. Labels specified in the monitor are stored in this field UUID
`df_alert_policy_ids`	Alert Policy IDs (list)
`df_alert_policy_names`	Alert Policy Names (list)
`df_matched_alert_policy_rules`	Alert policy names and all matched rule names (list)
`df_channels`	List of Incident channels to which the event belongs
`df_at_accounts`	@account information
`df_at_accounts_nodata`	@account information (data gap)
`df_message_at_accounts`	List of `@用户` details in fault alert messages
`df_nodata_message_at_accounts`	List of `@用户` details in data gap alert messages
`df_workspace_declaration`	Workspace Attribute Claims
`df_matched_alert_members`	When sending by member is selected, list of all matched alert notification member information
`df_matched_alert_upgrade_members`	When sending by member is selected, list of all matched alert escalation notification member information
`df_matched_alert_member_groups`	When sending by member is selected, names of all matched member groups
`df_charts`	Chart information appended when charts are added to the monitor configuration and this alert event needs to send a message
`df_alert_info`	Records alert notification information
`df_is_silent`	Whether the event is muted; value is the string `"true"` / `"false"`
`df_sent_target_types`	List of deduplicated alert notification target types sent for this event
`df_check_targets`	Records the detection time and detection metrics in the monitor configuration
`df_check_condition`, `df_check_condition_expr`	Record the trigger rules in the monitor configuration
`df_check_rules`	Records the detection count and detection rules in the monitor configuration
`df_check_targets`	Records the detection time and detection metrics in the monitor configuration
`df_check_condition`	Records the trigger rules in the monitor configuration
`df_check_interval`	Records the detection frequency in the monitor configuration
`df_fault_end_time`	Records the fault recovery time

Fields Specific to Smart Monitoring Events¶

When df_source = smartMonitor, df_event_report records the Smart Monitoring analysis report data. Multiple rules matched in the same detection are aggregated into this analysis report.

Fields Specific to AI Monitor Events¶

When df_source = aiMonitor, you can identify the event source and view the data on which the AI analysis is based through the following fields:

Field	Description
`df_monitor_type` / `df_monitor_checker_type`	Fixed to `ai`, indicating that the event was generated by an AI Monitor.
`df_monitor_checker_id` / `df_monitor_checker_name`	ID and name of the AI Monitor that generated the event.
`df_message`	Structured event report generated by AI.
`df_check_targets`	Data objects and query information used in this detection, used to correlate analysis evidence.

Fields Specific to Audit Events¶

When df_source = audit, the following additional fields exist:

Field	Description
`df_user_id`	Operator user ID
`df_user_name`	Operator username
`df_user_email`	Operator user email
{Other fields}	Other fields based on specific audit data requirements

Fields Specific to Custom Events¶

When df_source = user, the following additional fields exist:

Field	Description
`df_user_id`	Creator user ID
`df_user_name`	Creator username
`df_user_email`	Creator user email
{Other fields}	Other fields for events generated by user operations

Event Query and Viewing¶

Event Center provides multiple explorers to meet event query and analysis needs in different scenarios.

Event View Dimension	Description	Core Capabilities
All Events	Full event querying	Aggregates event data from all sources in the current workspace, supporting both list and chart display modes, with capabilities such as multi-dimensional filtering, search, export, and snapshot saving
Unrecovered Events	Active fault tracking	Displays events with `df_status != ok` from the last 48 hours, aggregated by `df_fault_id` to show fault duration
Change Events	K8s change audit	Records runtime activities in Kubernetes clusters that differ from expected patterns, showing configuration differences before and after changes
Smart Monitoring Events	Smart anomaly viewing	View anomaly events detected by Smart Monitoring rules and the analysis report generated by merging multiple matched rules in a single detection
Event Details	In-depth analysis of a single event	Click any event to view complete information, including basic attributes, extended fields, alert notifications, history, related events, and related SLOs