# Use stable event identities that stay useful at scale.

> Reference for TrafficWar event categories, labels, sources, operation types, traces, HTTP fields, timestamps, and properties.

TrafficWar accepts custom events, but a consistent taxonomy makes maps, metrics, traces, filters, and alerts agree across services.

## Canonical identity fields

- event: the category, normally http, database, redis, or s3.
- operation_type: the concrete work, such as route.handler, postgres.select, redis.get, or s3.get_object.
- source: the emitting host or dependency alias, such as backend-a, db-primary, redis-1, or assets.ovh-s3.
- label: the human route or operation name shared across related spans.
- path and http_method: the URL path and normalized HTTP method for HTTP work.

## Measurements and outcome

- latency_ms: non-negative duration in milliseconds.
- status_code: the HTTP or operation status when one exists.
- is_error: derived canonically by the server from status_code, error, or error_code.
- timestamp: RFC3339 or epoch milliseconds for presentation order; received time remains the operational axis.

## Actors, traces, and custom data

- distinct_id identifies the application actor without changing the account-level metric grain.
- trace_id connects spans from one request.
- span_kind describes client or server trace role.
- properties carries tenant-owned JSON for investigation; avoid secrets and unnecessary personal data.

## Related

- [Capture your first TrafficWar event with Node.js.](https://trafficwar.tech/docs/getting-started.md)
- [Connect spans with one trace ID and route label.](https://trafficwar.tech/docs/traces.md)
- [Send events over the TrafficWar ingest API.](https://trafficwar.tech/docs/ingest-api.md)