TraceFlux

RESOURCES · TECHNICAL

Example Telemetry Payloads

Canonical JSON payload shapes for deterministic correlation across network, cloud, and edge environments.

Overview

These examples represent canonical telemetry formats supported by the TraceFlux ingestion pipeline. Every payload is wrapped in a structured envelope to support deterministic correlation and tenant isolation.

Canonical Envelope Format

{
  "tenant_id": "t_001",
  "ts": "2026-03-01T12:01:22Z",
  "source": {
    "type": "collector",
    "id": "agent-us-east-1"
  },
  "signal": {
    "type": "metric"
  },
  "entity": {
    "id": "service-checkout",
    "kind": "service",
    "region": "us-east-1"
  },
  "attributes": {}
}

All telemetry types extend this base envelope. Deterministic grouping depends on stable entity identifiers and signal type.

Metric Signal Example

{
  "tenant_id": "t_001",
  "ts": "2026-03-01T12:01:22Z",
  "signal": { "type": "metric" },
  "entity": { "id": "service-checkout", "kind": "service" },
  "attributes": {
    "metric": "latency_ms",
    "value": 1800,
    "unit": "ms"
  }
}

Event Signal Example

{
  "tenant_id": "t_001",
  "ts": "2026-03-01T12:02:10Z",
  "signal": { "type": "event" },
  "entity": { "id": "router-01", "kind": "device" },
  "attributes": {
    "severity": "critical",
    "message": "Interface Gi0/1 down"
  }
}

Network Flow Example

{
  "tenant_id": "t_001",
  "ts": "2026-03-01T12:03:01Z",
  "signal": { "type": "flow" },
  "entity": { "id": "edge-nyc-1", "kind": "device" },
  "attributes": {
    "src_ip": "10.0.0.5",
    "dst_ip": "172.16.0.2",
    "bytes": 3400000
  }
}

BGP Update Example

{
  "tenant_id": "t_001",
  "ts": "2026-03-01T12:04:01Z",
  "signal": { "type": "bgp" },
  "entity": { "id": "edge-nyc-1", "kind": "device" },
  "attributes": {
    "prefix": "203.0.113.0/24",
    "asn": 64512,
    "action": "withdraw"
  }
}

DNS Anomaly Example

{
  "tenant_id": "t_001",
  "ts": "2026-03-01T12:05:15Z",
  "signal": { "type": "dns" },
  "entity": { "id": "resolver-01", "kind": "service" },
  "attributes": {
    "query": "api.internal",
    "rcode": "NXDOMAIN",
    "count": 340
  }
}

Configuration Change Example

{
  "tenant_id": "t_001",
  "ts": "2026-03-01T12:06:55Z",
  "signal": { "type": "change" },
  "entity": { "id": "firewall-01", "kind": "device" },
  "attributes": {
    "change_type": "rule_update",
    "user": "admin",
    "diff": "allow tcp 443 from 10.0.0.0/8"
  }
}

Batch Ingestion Example

[
  { "tenant_id": "t_001", "signal": { "type": "metric" }, "entity": { "id": "svc-a", "kind": "service" }, "attributes": { "metric": "cpu", "value": 85 } },
  { "tenant_id": "t_001", "signal": { "type": "event" }, "entity": { "id": "svc-a", "kind": "service" }, "attributes": { "severity": "warning", "message": "CPU high" } }
]

Validation Checklist

  • • Timestamp in RFC3339 format
  • • Stable entity.id for deterministic grouping
  • • signal.type matches payload structure
  • • Severity included for event signals
  • • Units included for metric values

Next Steps