Snowflake Event Tables: Centralizing Logs, Traces, and Audit Data

Event Tables are dedicated Snowflake tables for collecting log, trace, and metric events emitted by UDFs, stored procedures, Streamlit apps, and similar workloads. They turn what used to be hard-to-debug function execution into structured event data you can analyze with SQL, providing an observability foundation for Snowflake.

Creating and Enabling an Event Table

-- Event Tableの作成
CREATE OR REPLACE EVENT TABLE observability_db.events.app_events;

-- アカウントレベルでEvent Tableを有効化（ACCOUNTADMIN必須）
ALTER ACCOUNT SET EVENT_TABLE = 'observability_db.events.app_events';

-- データベースレベルでログレベルを設定
ALTER DATABASE my_app_db SET LOG_LEVEL = 'INFO';

-- スキーマレベルでログレベルを設定（より細かい制御）
ALTER SCHEMA my_app_db.analytics SET LOG_LEVEL = 'DEBUG';

-- 特定のUDF/プロシージャだけログレベルを変更
ALTER FUNCTION my_app_db.public.process_data(VARCHAR)
  SET LOG_LEVEL = 'TRACE';

-- トレースレベルの設定
ALTER DATABASE my_app_db SET TRACE_LEVEL = 'ON_EVENT';

LOG_LEVEL Hierarchy and Inheritance

LOG_LEVEL can be overridden in the order Account → Database → Schema → Object (function/procedure). If not set, the value is inherited from the next level up.

TRACE_LEVEL Configuration

Emitting Events from UDFs and Stored Procedures

-- Python UDFからログを出力
CREATE OR REPLACE FUNCTION process_order(order_json VARIANT)
RETURNS VARIANT
LANGUAGE PYTHON
RUNTIME_VERSION = '3.10'
HANDLER = 'run'
AS $
import logging
logger = logging.getLogger('order_processor')

def run(order_json):
    logger.info(f"Processing order: {order_json['order_id']}")
    try:
        total = sum(item['price'] * item['qty'] for item in order_json['items'])
        logger.info(f"Order total calculated: {total}")
        return {"order_id": order_json['order_id'], "total": total, "status": "success"}
    except Exception as e:
        logger.error(f"Failed to process order: {str(e)}")
        raise
$;

-- JavaScriptプロシージャからログを出力
CREATE OR REPLACE PROCEDURE sync_inventory()
RETURNS VARCHAR
LANGUAGE JAVASCRIPT
EXECUTE AS CALLER
AS $
  snowflake.log("info", "Starting inventory sync");
  var rs = snowflake.execute({sqlText: "SELECT COUNT(*) FROM inventory"});
  rs.next();
  var count = rs.getColumnValue(1);
  snowflake.log("info", "Inventory records: " + count);
  return "Synced " + count + " records";
$;

-- SQLスクリプトからログを出力
CALL SYSTEM$LOG('INFO', 'Data pipeline started');

-- トレースイベントの出力
CALL SYSTEM$ADD_TRACE('pipeline_run', '{"stage": "transform", "rows": 50000}');

Key Columns of an Event Table

Querying the Event Table

-- 直近1時間のエラーログを取得
SELECT
  timestamp,
  resource_attributes['snow.database.name']::VARCHAR AS db_name,
  resource_attributes['snow.schema.name']::VARCHAR AS schema_name,
  resource_attributes['snow.executable.name']::VARCHAR AS function_name,
  record['severity_text']::VARCHAR AS severity,
  record['body']['text']::VARCHAR AS message
FROM observability_db.events.app_events
WHERE record_type = 'LOG'
  AND record['severity_text']::VARCHAR IN ('ERROR', 'FATAL')
  AND timestamp >= DATEADD(HOUR, -1, CURRENT_TIMESTAMP())
ORDER BY timestamp DESC;

-- 関数別の実行回数とエラー率を集計
SELECT
  resource_attributes['snow.executable.name']::VARCHAR AS function_name,
  COUNT(*) AS total_events,
  COUNT_IF(record['severity_text']::VARCHAR = 'ERROR') AS error_count,
  ROUND(error_count / total_events * 100, 2) AS error_rate_pct
FROM observability_db.events.app_events
WHERE record_type = 'LOG'
  AND timestamp >= DATEADD(DAY, -7, CURRENT_TIMESTAMP())
GROUP BY function_name
ORDER BY error_rate_pct DESC;

-- トレーススパンの実行時間を分析
SELECT
  scope['name']::VARCHAR AS span_name,
  record_attributes,
  DATEDIFF('millisecond',
    record['start_time']::TIMESTAMP_NTZ,
    timestamp
  ) AS duration_ms
FROM observability_db.events.app_events
WHERE record_type = 'SPAN'
ORDER BY duration_ms DESC
LIMIT 20;

Operational Best Practices

• INFO in production, DEBUG in development: Switch LOG_LEVEL per database to keep log volume and cost down in production
• Copy to regular tables for long-term storage: Keep the Event Table retention short and periodically migrate the logs you need into regular tables
• Avoid TRACE_LEVEL = ALWAYS: It records every function call as a span and generates a huge number of events. Use ON_EVENT to record only where you need it
• Integrate with alerts: Set up alerts (ALTER ALERT) against the Event Table to automatically detect spikes in error rate
• Use structured logging: Include context in your log messages as JSON so you can later search them via VARIANT path access

Check Your Understanding

Frequently Asked Questions