Reference

The canonical catalog. Metric names follow the base package's convention (lowercase, dot-namespaced; . becomes _ in Prometheus, so statamic.static_cache.operations scrapes as statamic_static_cache_operations_total).

Span attributes

All on the request root span unless noted. Attributes are per-span, so their cardinality is unconstrained — ids and slugs are fine here (unlike metric labels).

enduser.id, enduser.type and enduser.guard come from the base package; the addon adds the three role/group/super attributes on top.

Request span naming

Every Statamic frontend request runs through one catch-all route, so the base package's default METHOD /route/{pattern} name collapses to a single value. The addon renames the root span from the resolved content:

Names are bounded — collection/blueprint/taxonomy handles, never ids or slugs. http.route keeps the raw catch-all pattern regardless, so route-based filtering still works. A static cache hit never reaches the controller, so hit traces keep the generic route-pattern name (with statamic.static_cache: hit).

Metrics

The base package's cache.operations counter additionally carries the key_group label from the addon's classifier when telemetry.instrument.cache is on.

statamic.content.changes labels

type and action are derived from the event class name (EntrySaved → entry/saved, AssetReplaced → asset/replaced). Subscribed families: entries, terms, localized terms, assets (saved, deleted, uploaded, replaced, reuploaded, references-updated), asset folders and containers, collections and their trees, taxonomies, globals (GlobalVariablesSaved — the actual content edit — as well as the set), navs and their trees, forms, users, roles, groups, blueprints, fieldsets, sites, deleted submissions. Two carry explicit labels: EntryScheduleReached → entry/schedule_reached, DuplicateIdRegenerated → duplicate_id/regenerated.

statamic.auth.events labels

impersonation_started, impersonation_ended, user_registered, password_changed, two_factor_enabled, two_factor_disabled, two_factor_challenged, two_factor_failed, two_factor_passed, two_factor_recovery_code_replaced. No user ids on the metric — identity lives on the request trace via enduser.*.

Config

config/statamic-telemetry.php. All instrument.* flags are also settable via STATAMIC_TELEMETRY_* env vars (see the published config).

What is deliberately not instrumented

• Full-measure static cache hits — served by the web server, never reach PHP, so they produce no telemetry at all. Only PHP-served hits, misses and writes appear.
• Search queries — Statamic fires no query event; latency shows up on the request span. Only index updates are counted.
• Field augmentation — no core events. Its cost is visible indirectly through the Blink tallies, the Antlers tag spans and the view spans.
• Halting / lifecycle events — FormSubmitted (a listener return cancels the submission), *Saving/*Deleting, *BlueprintFound are payload-manipulation hooks, not outcomes.
• UrlInvalidated — already counted at the cacher as invalidate.