Fact event field reference-AgentLoop(AgentLoop)-阿里云帮助中心

This topic is intended for users who need to write custom queries, understand the audit data structure, or integrate with external analysis systems. It describes the fields and common values of the application-side event tables agent-event / agent-event-webtracking and the runtime event table ebpf-event.

Note

All sample values in this topic are anonymized, synthetic, or documentation placeholders that illustrate field forms and data semantics. They do not represent real user data. Sensitive values in actual events may be anonymized, truncated, or summarized on the collection side.

Table overview

Audit fact events form the data foundation of the audit module. They record raw behavioral events during AI Agent execution, including model requests and responses, tool calls and results, session lifecycle, and runtime observation data. Risk detection, audit fact browsing, entity investigation, and token analysis all work based on these event tables.

Table	Description
`agent-event`	Stores standardized events from application-side AI Agent session logs, reported by Agent applications through the server-side ingestion pipeline.
`agent-event-webtracking`	Has an identical field contract to `agent-event`. The only difference is that events are reported through WebTracking client-side upload. Query both tables together.
`ebpf-event`	Stores observation events collected by runtime eBPF probes on AI nodes, including model calls, tool executions, process activity, file operations, and network behavior observed at the runtime layer.

Common fields

The following fields are shared across agent-event, agent-event-webtracking, and ebpf-event.

Event identification

Field	Type	Description
`event.id`	string	Globally unique event identifier.
`event.name`	string	The event type, which indicates the behavior category described by this record. For valid values, see the Event type enumeration section of this topic.
`time_unix_nano`	int64	The time when the event occurred, as a Unix timestamp in nanoseconds.

Host and service

Field	Type	Description
`__tag__:__hostname__`	string	SLS LogGroup hostname metadata. Used as the compatible hostname value when `host.name` is empty or missing.
`__source__`	string	SLS ingestion source metadata. Used as the compatible Agent host IP value when `host.ip` is empty or missing. It does not indicate a network peer or an outbound destination.
`host.id`	string	Stable identifier of the host or execution environment.
`host.name`	string	Name of the host, pod, container, or execution environment where the Agent runs.
`host.ip`	string	IP address of the host where the Agent runs. Audit result tables flatten this value into `source_ip`.

User and Agent identification

Field	Type	Description
`user.id`	string	Identifier of the user who initiated the request.
`gen_ai.agent.type`	string	Agent type identifier, such as `qoder`, `cursor`, or `claude-code`.
`gen_ai.agent.id`	string	Unique identifier of the Agent instance.
`gen_ai.agent.name`	string	Human-readable name of the Agent instance.

Session hierarchy

Agent events are organized in a three-level hierarchy: Session → Turn → Step. These levels represent a conversation, a round of user interaction, and a single reasoning-action cycle respectively.

Field	Type	Description
`gen_ai.session.id`	string	Unique session identifier corresponding to a complete Agent conversation or task.
`gen_ai.turn.id`	string	Unique Turn identifier corresponding to the full interaction from one user input to the Agent's final response.
`gen_ai.turn.start`	boolean	Whether this is the starting event of a Turn. Written only when the value is `true`.
`gen_ai.turn.end`	boolean	Whether this is the ending event of a Turn. Written only when the value is `true`.
`gen_ai.step.id`	string	Unique Step identifier corresponding to one ReAct cycle (think → act → observe).

Model calls

Field	Type	Description
`gen_ai.provider.name`	string	Model service provider identifier, such as `anthropic`, `openai`, `qwen`, or `deepseek`.
`gen_ai.request.model`	string	Requested model name.
`gen_ai.response.model`	string	Actual model name in the response, which may differ from the requested model.
`gen_ai.response.id`	string	Unique identifier of the model response, returned by the model service.
`gen_ai.response.finish_reasons`	string[]	Reasons why the model stopped generating. Common values include `stop`, `tool_calls`, `length`, `content_filter`, and `error`.

Model input and output content

Field	Type	Description
`gen_ai.input.messages_delta`	json	Incremental input messages that record new messages since the last reconstructable input. This is the primary input content field used in audit analysis and session browsing.
`gen_ai.input.messages`	json	Complete message history sent to the model. This field may contain sensitive information and is collected on demand.
`gen_ai.output.messages`	json	Model output messages, including roles, text, tool calls, and reasoning content.
`gen_ai.system_instructions`	json	System instructions or developer instructions, which are prompt content separated from conversation messages.
`gen_ai.tool.definitions`	json	List of tool definitions available in the model request.

Token usage

Field	Type	Description
`gen_ai.usage.input_tokens`	int	Number of input tokens (including cache reads).
`gen_ai.usage.output_tokens`	int	Number of output tokens.
`gen_ai.usage.cache_read.input_tokens`	int	Number of input tokens read from cache, already included in `input_tokens`.
`gen_ai.usage.cache_creation.input_tokens`	int	Number of input tokens written to cache, already included in `input_tokens`.
`gen_ai.usage.total_tokens`	int	Total token count, equal to `input_tokens + output_tokens`.

Tool calls

Field	Type	Description
`gen_ai.tool.name`	string	Tool name, matching the function/tool name in the model call.
`gen_ai.tool.call.id`	string	Tool call identifier generated by the model, used to correlate calls with results.
`gen_ai.tool.call.arguments`	json	Tool call arguments. This field may contain sensitive information.
`gen_ai.tool.call.result`	json	Tool execution result. This field may contain sensitive information.
`gen_ai.tool.call.duration`	int	Tool execution duration in milliseconds.
`gen_ai.skill.name`	string	Name of the Skill loaded by the tool (if applicable).

Error information

Field	Type	Description
`error.type`	string	Error type identifier, written when an error occurs during the operation. This field does not exist when there is no error.
`error.message`	string	Human-readable description of the error details.

Tracing

Field	Type	Description
`trace_id`	string	W3C Trace ID (32-character hexadecimal) for distributed trace correlation.
`span_id`	string	Span ID (16-character hexadecimal).
`parent_span_id`	string	Parent Span ID (16-character hexadecimal).

Application-side supplementary fields

The following fields are used only in agent-event / agent-event-webtracking.

Field	Type	Description
`__tag__:__service_name__`	string	Agent application or service name, used for filtering and attribution by application dimension.
`service.name`	string	Application name (fallback). Used as a supplement when `__tag__:__service_name__` is absent.

Runtime supplementary fields

The following fields are used only in ebpf-event to record process, file, and network behavior observed at the runtime layer.

Event type enumeration

event.name indicates the behavior category of an event and is the most commonly used filter field in queries and analysis.

Application-side event types

Application-side event types use the gen_ai. prefix to describe the semantic behavior of an Agent.

event.name	Description
`gen_ai.model.request`	Model request. The Agent sends an inference request to the model service.
`gen_ai.model.response`	Model response. The Agent receives an inference result from the model service.
`gen_ai.tool.call`	Tool call. The Agent executes a tool or function.
`gen_ai.tool.result`	Tool result. The tool completes execution and returns a result.
`gen_ai.agent.invoke`	Sub-Agent invocation. The current Agent calls another Agent.
`gen_ai.agent.result`	Sub-Agent result. The called Agent returns a result.

Runtime event types

Runtime event types currently include only gen_ai.* events (model and tool behavior observed at the runtime layer).

event.name	Description
`gen_ai.model.request`	Model request observed at the runtime layer.
`gen_ai.model.response`	Model response observed at the runtime layer.
`gen_ai.tool.call`	Tool call observed at the runtime layer.
`gen_ai.tool.result`	Tool result observed at the runtime layer.

Common field examples

Field	Example value	Description
`event.id`	`evt-7f3a8b2c-1d4e-4f5a-9b6c-2e8d3f4a5b6c`	The specific format is system-generated. External systems only need to use it as a stable ID.
`event.name`	`gen_ai.tool.call`, `runtime.file.write`	Indicates the behavior category described by the event.
`time_unix_nano`	`1719763200000000000`	Nanosecond timestamp, corresponding to 2024-06-30T12:00:00Z.
`user.id`	`alice`	User identifier. The specific format depends on the integration method.
`gen_ai.agent.type`	`qoder`, `cursor`, `claude-code`	Agent product type.
`gen_ai.session.id`	`sess-20240630-demo`	Used to correlate all events within the same session.
`gen_ai.provider.name`	`anthropic`, `openai`, `qwen`	Model service provider.
`gen_ai.request.model`	`claude-sonnet-4-20250514`, `gpt-4o`	Requested model name.
`gen_ai.tool.name`	`bash`, `read_file`, `WebFetch`	Name of the called tool.
`gen_ai.tool.call.arguments`	`{"command":"git status"}`	Tool call arguments in JSON format.
`gen_ai.usage.input_tokens`	`12500`	Input token count for a single model request.
`gen_ai.usage.output_tokens`	`3200`	Output token count for a single model request.

Field usage suggestions

Scenario	Recommended fields	Description
Reconstruct full session interaction	`gen_ai.session.id` + `event.name` + `time_unix_nano`	Aggregate events by session and sort them by time to reconstruct the complete behavior timeline of the Agent.
Analyze a single-turn interaction	`gen_ai.turn.id` + `gen_ai.step.id`	A Turn corresponds to one user interaction, and a Step corresponds to one reasoning-action cycle. Use them together to understand the Agent's decision chain.
Token consumption statistics	`gen_ai.usage.input_tokens` + `gen_ai.usage.output_tokens` + `gen_ai.provider.name`	Calculate token usage by model provider and application dimension.
Tool usage analysis	`gen_ai.tool.name` + `gen_ai.tool.call.duration` + `error.type`	Analyze tool call frequency, execution duration distribution, and failure rate.
Trace back from risk events to original context	`event.id` + the risk event's `evidence_event_ids`	High-fidelity security events reference original fact event IDs through `evidence_event_ids`, which you can use to locate the evidence context.
Filter by application or host	`__tag__:__service_name__` (application-side) / `__tag__:__hostname__`	Used to aggregate or filter events by application and host dimensions respectively.

Relationships with other audit data

Data	Relationship
`security-event`	Low-fidelity security findings identified from fact events by risk detection rules. They reference fact events as evidence sources.
`incident-event`	High-fidelity security events elevated from low-fidelity findings. They trace back to original fact events through `evidence_event_ids`.
`audit-event`	Intent recognition results generated from application-side fact events by user and session. They trace back to the original user input and session through `evidence_event_id` and `evidence_session_id`.
Audit facts page	Browse and query fact events directly, with support for session browsing, token analysis, and behavior analysis.
Risk audit page	Displays and ranks high-fidelity risk and user intent results derived from fact events.