Dify Enterprise Telemetry Data Dictionary

Quick reference for all telemetry signals emitted by Dify Enterprise. For configuration and architecture details, see README.md.

Resource Attributes

Attached to every signal (Span, Metric, Log).

Traces (Spans)

dify.workflow.run

dify.node.execution

dify.node.execution.draft

Same attributes as dify.node.execution. Emitted during Preview/Debug runs.

Counters

All counters are cumulative and emitted at 100% accuracy.

Token Counters

Labels:

• tenant_id, app_id, operation_type, model_provider, model_name, node_type (if node_execution)

⚠️ Warning: dify.tokens.total at workflow level includes all node tokens. Filter by operation_type to avoid double-counting.

Token Hierarchy & Query Patterns

Token metrics are emitted at multiple layers. Understanding the hierarchy prevents double-counting:

App-level total
├── workflow          ← sum of all node_execution tokens (DO NOT add both)
│   └── node_execution ← per-node breakdown
├── message           ← independent (non-workflow chat apps only)
├── rule_generate     ← independent helper LLM call
├── code_generate     ← independent helper LLM call
├── structured_output ← independent helper LLM call
└── instruction_modify← independent helper LLM call

Key rule: workflow tokens already include all node_execution tokens. Never sum both.

Available labels on token metrics: tenant_id, app_id, operation_type, model_provider, model_name, node_type. App name is only available on span attributes (dify.app.name), not metric labels — use app_id for metric queries.

Common queries (PromQL):

# ── Totals ──────────────────────────────────────────────────
# App-level total (exclude node_execution to avoid double-counting)
sum by (app_id) (dify_tokens_total{operation_type!="node_execution"})

# Single app total
sum (dify_tokens_total{app_id="<app_id>", operation_type!="node_execution"})

# Per-tenant totals
sum by (tenant_id) (dify_tokens_total{operation_type!="node_execution"})

# ── Drill-down ──────────────────────────────────────────────
# Workflow-level tokens for an app
sum (dify_tokens_total{app_id="<app_id>", operation_type="workflow"})

# Node-level breakdown within an app
sum by (node_type) (dify_tokens_total{app_id="<app_id>", operation_type="node_execution"})

# Model breakdown for an app
sum by (model_provider, model_name) (dify_tokens_total{app_id="<app_id>"})

# Input vs output per model
sum by (model_name) (dify_tokens_input_total{app_id="<app_id>"})
sum by (model_name) (dify_tokens_output_total{app_id="<app_id>"})

# ── Rates ───────────────────────────────────────────────────
# Token consumption rate (per hour)
sum(rate(dify_tokens_total{operation_type!="node_execution"}[1h]))

# Per-app consumption rate
sum by (app_id) (rate(dify_tokens_total{operation_type!="node_execution"}[1h]))

Finding app_id from app name (trace query — Tempo / Jaeger):

{ resource.dify.app.name = "My Chatbot" } | select(resource.dify.app.id)

Request Counters

Labels by type:

Error Counters

Labels by type:

Other Counters

Histograms

Structured Logs

Span Companion Logs

Logs that accompany spans. Signal type: span_detail

dify.workflow.run Companion Log

Common attributes: All span attributes (see Traces section) plus:

Event attributes:

• dify.event.name: "dify.workflow.run"
• dify.event.signal: "span_detail"
• trace_id, span_id, tenant_id, user_id

dify.node.execution and dify.node.execution.draft Companion Logs

Common attributes: All span attributes (see Traces section) plus:

Event attributes:

• dify.event.name: "dify.node.execution" or "dify.node.execution.draft"
• dify.event.signal: "span_detail"
• trace_id, span_id, tenant_id, user_id

Standalone Logs

Logs without structural spans. Signal type: metric_only

dify.message.run

dify.tool.execution

dify.moderation.check

dify.suggested_question.generation

dify.dataset.retrieval

dify.generate_name.execution

dify.prompt_generation.execution

dify.app.created

dify.app.updated

dify.app.deleted

dify.feedback.created

dify.telemetry.rehydration_failed

Diagnostic event for telemetry system health monitoring.

Content-Gated Attributes

When ENTERPRISE_INCLUDE_CONTENT=false, these attributes are replaced with reference strings (ref:{id_type}={uuid}).

Appendix

Operation Types

• workflow, node_execution, message, rule_generate, code_generate, structured_output, instruction_modify

Node Types

• start, end, answer, llm, knowledge-retrieval, knowledge-index, if-else, code, template-transform, question-classifier, http-request, tool, datasource, variable-aggregator, loop, iteration, parameter-extractor, assigner, document-extractor, list-operator, agent, trigger-webhook, trigger-schedule, trigger-plugin, human-input

Workflow Statuses

• running, succeeded, failed, stopped, partial-succeeded, paused

Payload Types

• workflow, node, message, tool, moderation, suggested_question, dataset_retrieval, generate_name, prompt_generation, app, feedback

Null Value Behavior

Spans: Attributes with null values are omitted.

Logs: Attributes with null values appear as null in JSON.

Content-Gated: Replaced with reference strings, not set to null.