Event schemas

Each record in the log contains several fields that are added by default by the Google Logging API and are not useful for Glean usage analysis. The relevant fields are:

type GleanCustomerEvent struct {
    // Timestamp of the activity.
    Timestamp timestamp

    // A unique ID for the record.
    insertId string

    // All data for the record are contained in this struct field.
    jsonPayload *GleanCustomerEventPayload
}

This is an omnibus log that contains many different kinds of events. Each record contains this as its outermost struct field:

type GleanCustomerEventPayload struct {
    // The type of the record. Will be one of: SEARCH, AUTOCOMPLETE, CHAT, HUMAN_ONLY_CHAT_MESSAGE, VOICE_CHAT,
    // CHAT_CITATIONS, AI_SUMMARY, AI_ANSWER, SHORTCUT, SEARCH_CLICK, CHAT_CITATION_CLICK, CHAT_FEEDBACK, CLIENT_EVENT,
    // SEARCH_FEEDBACK, AI_ANSWER_VOTE, AI_SUMMARY_VOTE, ACTION, ARTIFACT, WORKFLOW_RUN, WORKFLOW_CONVERSATION,
    // WORKFLOW_CLASSIFICATION, LLM_CALL, MCP_USAGE, WORKFLOW, GLEAN_BOT_ACTIVITY, PRODUCT_SNAPSHOT.
    // WORKFLOW is deprecated.
    Type string

    // Whether the record was written in scrubbed mode and contains no PII.
    IsScrubbed bool

    // Identifies the user taking the action.
    User *GleanCustomerEventUserIdentity

    // At most one of the following struct fields will be populated
    // corresponding to the type indicated in `Type`.
    Search *GleanCustomerEventSearch
    Autocomplete *GleanCustomerEventAutocomplete
    Chat *GleanCustomerEventChat
    ChatMessage *GleanCustomerEventHumanOnlyChatMessage
    VoiceChat *GleanCustomerEventVoiceChat
    ChatCitations *GleanCustomerEventChatCitations
    AiSummary *GleanCustomerEventAiSummary
    AiAnswer *GleanCustomerEventAiAnswer
    Shortcut *GleanCustomerEventShortcut
    SearchClick *GleanCustomerEventSearchClick
    ChatFeedback *GleanCustomerEventChatFeedback
    ClientEvent *GleanCustomerEventClientEvent
    SearchFeedback *GleanCustomerEventSearchFeedback
    AiAnswerVote *GleanCustomerEventAiAnswerVote
    AiSummaryVote *GleanCustomerEventAiSummaryVote
    ChatCitationClick *GleanCustomerEventChatCitationClick
    Action *GleanCustomerEventAction
    Artifact *GleanCustomerEventArtifact
    WorkflowRun *GleanCustomerEventWorkflowRun
    WorkflowConversation *GleanCustomerEventWorkflowConversation

    // Emitted by the Python classification pipeline. In the raw JSON log the key
    // is lowercase: `workflowclassification`.
    WorkflowClassification *GleanCustomerEventWorkflowClassification

    Workflow *GleanCustomerWorkflow
    GleanBotActivity *GleanCustomerGleanBotActivity
    ProductSnapshot *GleanCustomerEventProductSnapshot
    LlmCall *GleanCustomerEventLlmCall
    McpUsage *GleanCustomerEventMcpUsage
}

note

Glean writes this log from three emitters: a Go service, a Java service, and a Python batch pipeline that emits only WORKFLOW_CLASSIFICATION. A few field names differ between them, and each emitter only produces a subset of the event types. Where a name differs, the schemas below record both spellings.

// Identifies the user taking the action.
type GleanCustomerEventUserIdentity struct {
    // Internal unique ID for the user.
    UserId string

    // Internal ID used to attribute the activity for billing.
    // Only emitted by the Go service.
    BillingUserId string

    // Email address of the user. omitted if scrubbed
    UserEmail string

    // Current department of the user. omitted if scrubbed
    Department string

    // ID of the user's department
    DepartmentId int32
}

Event Type Schemas

Documents a SEARCH action, that is, a search request.

type GleanCustomerEventSearch struct {
    // Unique ID for the search request. Used to track the full
    // lifecycle of this specific search request across systems and related events.
    TrackingToken string

    // ID for the app session during which the search took place. Used
    // for session-level grouping and tracking.
    SessionTrackingToken string

    /*
    Manner by which the search request was initiated. Common values:
    - USER: a user initiated this search as a main request
    - PAGE_LOAD: a user initiated this search by reloading search results
    - INTERNAL: a Glean tool or agent issued this search to fulfill another request
    */
    Initiator string

    /*
    Surface from which the search request was initiated. Common values:
    - CHAT: search issued by Glean to fulfill a response
    - FULLPAGE: from fullpage Glean webapp
    - EMBEDDED_SEARCH: from an embedded component built with the Web SDK
    - SIDEBAR: from Glean sidebar
    - NSR: from Native Search Replacement, when Glean's search functionality is
      embedded directly within other applications
    - OMNIBOX: from the browser's address bar (omnibox) integration.
    - GLEANBOT: the Search query triggered programmatically by the GleanBot assistant
      (e.g., proactive digests, follow-ups).
    - CONTEXT_MENU: search triggered via right-click context menu (e.g., "Search with
      Glean" on selected text).
    */
    Modality string

    // For searches from embedded components, the embedding site's domain.
    // Eg: company.glean.com
    HostDomain string

    // Query string. omitted if scrubbed
    Query string

    // List of connector filters applied in the search request. If empty,
    // no connector filter was applied (e.g. a search from the "All" tab.)
    DatasourcesFilter []string

    // List of first-page results returned by the search. omitted if scrubbed
    Results []*GleanCustomerEventSearchResult

    // Latency of the search response, in milliseconds.
    BackendMillis int64

    // Whether the request was made via the REST Client API.
    IsRestClientApi bool

    // Number of people returned in the results.
    NumPeopleResults int32

    // HTTP status code returned by the search API.
    HttpStatusCode int32
}

// Representation of a search result.
type GleanCustomerEventSearchResult struct {
    Url string
    Title string
    DocId string
    Datasource string
    DocType string
    CombinedTextLength int64
}

Documents an Autocomplete action, that is, an autocomplete request.

// Documents an AUTOCOMPLETE action, i.e. autocomplete request.
// Definitions are similar to SEARCH events above.
type GleanCustomerEventAutocomplete struct {
    TrackingToken string
    SessionTrackingToken string
    HostDomain string
    Query string // omitted if scrubbed
    QueryLength int
    BackendMillis int64
    IsRestClientApi bool
    Results []*autocomplete_logging.RawAutocompleteResultLogEntry // omitted if scrubbed
}

Documents a CHAT action, that is, a message sent to Glean.

// Documents a CHAT action, i.e. message sent to Glean.
type GleanCustomerEventChat struct {
    // Unique identifier for a "turn" in the conversation, i.e. a user
    // query and agent response pair.
    Qtt string

    // Unique identifier for the response message sent by the agent.
    ResponseMessageId string

    // ID for the app session during which the chat took place (same as
    // for SEARCH actions.)
    SessionTrackingToken string

    // ID for the chat session during which the chat took place (recreated
    // each time the user visits the chat UI, or clicks "New Chat").
    ChatSessionId string

    /*
    Surface from which the chat message was sent:
    - WEB: Glean web UI
    - SLACK: Slackbot
    - REST_API: API request by an external developer or integration
    - SERVER: Backend or server-side system, such as for scheduled jobs,
      auto-digests, or background agents.
    - MICROSOFT_TEAMS: Glean's Microsoft Teams integration
    */
    Platform string

    /* Manner by which the initial chat message was sent:
    - USER: a user sent the message
    - EVAL: Internal evaluation
    - RECOMMENDATION: An information-seeking intent is detected from the
      user's activity and a chat request is issued proactively
    - PRODUCTION_PROBE:
    - PROMPT_TEMPLATE:The user triggered a predefined prompt template
    - UNKNOWN: Unknown initiator
    - ONBOARDING: Part of user onboarding flow, such as a welcome message
    - GLEAN: sent during response generation for a Glean search
    - AUTOMATION: Initiated from the summarize API
    */
    Initiator string

    // If populated, it identifies the AI App for this chat message.
    ApplicationId string

    // Details about the AI agent that responded to the chat.
    AgentConfig *GleanCustomerEventAgentConfig

    // Query string. omitted if scrubbed
    UserQuery string

    // Full response message from the agent. omitted if scrubbed
    Response string

    // Datasource to which the chat result belongs.
    Datasource string

    // Total latency (in milliseconds) for generating the chat response.
    TotalResponseMillis int64

    // Domain of the host from which the chat was initiated.
    HostDomain string

    // Token(s) used to track any linked searches during this chat turn.
    SearchTrackingTokens []string

    // Ordered list of document IDs from search results page. omitted if scrubbed
    SerpOrderedDocIds []string

    // Follow-up question suggestions generated by the AI. omitted if scrubbed
    FollowupQuestions []string

    // Feature flag or product area associated with this chat event.
    Feature string

    // Time taken (in milliseconds) to generate the first response token.
    FirstResponseTokenMillis int64

    // Serialized UI tree metadata for the frontend view context.
    UiTree []string

    // Indicates whether a file was uploaded with the chat.
    HasFileUpload bool

    // Indicates whether the chat was triggered via REST client API.
    IsRestClientApi bool

    // Unique identifier for the workflow run associated with the chat, if any.
    WorkflowRunId string
}

// Details about the AI agent that responded to the chat.
type GleanCustomerEventAgentConfig struct {
    // The type of agent that responded to the request. Values:
    // - DEFAULT: the default Glean RAG agent.
    // - GPT: communicates directly with the underlying LLM.
    Agent string

    // Execution mode for the agent. Values:
    // - DEFAULT: default execution mode.
    // - QUICK: Trades accuracy and precision for speed.
    Mode string
}

Captures metadata for a user-authored chat message. Unlike CHAT, this event does not contain the assistant response.

type GleanCustomerEventHumanOnlyChatMessage struct {
    // Unique identifier for the chat message.
    MessageId string

    // Chat session containing the message.
    ChatSessionId string

    // Message type, such as a user query or follow-up.
    MessageType string

    // Length of the message text.
    MessageLength int

    // Whether the message included a file upload.
    HasFileUpload bool
}

Captures a real-time voice interaction, including transcription and response latency.

type GleanCustomerEventVoiceChat struct {
    MessageId string
    ChatSessionId string
    WorkflowRunId string
    SessionTrackingToken string
    Platform string
    Feature string
    Initiator string
    Author string
    Transcript string // omitted if scrubbed
    SttLatencyMs int64
    FirstTextResponseMs int64
    TotalTextResponseMs int64
    FirstAudioResponseMs int64
    TotalAudioResponseMs int64
}

Documents the citations that were used to generate a chat response.

// Documents the citations that were used to generate a chat response.
type GleanCustomerEventChatCitations struct {
    // The query to which these citations pertain. Allows joins to CHAT events.
    Qtt string

    // The chat session to which these citations pertain.
    ChatSessionId string

    // List of citations.
    Citations *[]GleanCustomerEventChatCitation

    // Workflow ID for the AI agent's processing session.
    WorkflowRunId string
}

// Details the citation used to generate a chat response.
type GleanCustomerEventChatCitation struct {
    // TrackingToken. Some may start with SEARCH_, indicating that the citations shown
    // in the chat response were retrieved via a SEARCH query under the hood.
    TrackingToken string

    // Tracking tokens for all searches whose results included this citation.
    ResultTrackingTokens []string

    // Populated when the citation refers to a document-like asset
    SourceDocument *GleanCustomerEventChatCitationSourceDocument

    // Populated when the citation refers to a refers to a raw file (e.g. PDF)
    SourceFile *GleanCustomerEventChatCitationSourceFile

    // Populated when the citation refers to a refers to a person
    SourcePerson *GleanCustomerEventChatCitationSourcePerson
}

type GleanCustomerEventChatCitationSourceDocument struct {
    Datasource string
    DocType string
    Id string // obfuscated if scrubbed
    Title string // omitted if scrubbed
    Url string // omitted if scrubbed

    // Connector type that supplied the document.
    ConnectorType string
}

type GleanCustomerEventChatCitationSourceFile struct {
    Id string // obfuscated if scrubbed
    Name string // omitted if scrubbed
}

type GleanCustomerEventChatCitationSourcePerson struct {
    Id string // obfuscated if scrubbed
    Name string // omitted if scrubbed
}

Documents usages of the AI Summary feature.

// Documents usages of the AI Summary feature.
type GleanCustomerEventAiSummary struct {
    // Document IDs for which summary was requested. obfuscated if scrubbed
    DocIds []string

    // Full text of the AI-generated summary. omitted if scrubbed
    SummaryText string

    TrackingToken string
}

Documents invocations of AI-generated answers to user searches.

// Documents invocations of AI-generated answers to user searches.
type GleanCustomerEventAiAnswer struct {
    // ID of the search that resulted in the AI-generated answer.
    TrackingToken string

    // Full text of the AI-generated answer. omitted if scrubbed
    Response string

    // Unique identifier for the AI-generated answer.
    Qtt string

    // Follow-up question suggestions generated by the AI. omitted if scrubbed
    FollowupQuestions []string
}

Documents usage of Glean Shortcuts API.

// Documents usage of Glean Shortcuts API.
type GleanCustomerEventShortcut struct {
    // Which shortcut operation was performed.
    // Type: ShortcutEnumType (enum with values: CREATE, DELETE, GET, REDIRECT, UPDATE)
    Event ShortcutEnumType

    // Unique identifier for the shortcut.
    Id int32

    // Canonical link text following go/ prefix. omitted if scrubbed
    Alias string

    // Link text following go/ prefix as input by user. omitted if scrubbed
    InputAlias string

    // Destination URL for the shortcut. omitted if scrubbed
    DestinationUrl string

    // Glean Document ID for the URL, if known. omitted if scrubbed
    DocumentIdForUrl string
}

Documents a click on a search result.

// Documents a click on a search result.
type GleanCustomerEventSearchClick struct {
    // Identifies the search to which this result click belongs. Allows joins
    // joins to SEARCH events.
    TrackingToken string

    // The index of the result on the search results page.
    Position int

    // Unique identifier for the search result. omitted if scrubbed
    DocId string

    // URL of the search result. omitted if scrubbed
    DocUrl string

    // Datasource to which the search result belongs.
    Datasource string

    // Title of the document that was clicked. omitted if scrubbed
    DocTitle string

    // Type of the document that was clicked.
    DocType string
}

Feedback left on chat messages.

// Feedback left on chat messages.
type GleanCustomerEventChatFeedback struct {
    // Identifier for the chat message this feedback was left on.
    MessageId string

    // ID for the app session during which the feedback event occurred.
    SessionTrackingToken string

    // Identifier for the trace associated with this feedback.
    TraceId string

    // Feedback action that was taken by the user. Values: UPVOTE, DOWNVOTE, MANUAL_FEEDBACK.
    Event string

    // If populated, identifies the AI App for this chat feedback.
    ApplicationId string

    // Feedback comments provided by the user. Only populated for MANUAL_FEEDBACK. omitted if scrubbed
    Comments string

    // Vote cast by the user at the time of giving manual feedback
    // Values: UPVOTE, DOWNVOTE
    Vote string

    // ID for the chat session during which the feedback event occurred
    ChatSessionId string

    Rating int64 // Always NULL. Not advised to use.
    RatingKey string // Always undefined. Not advised to use.

    // Ties together all steps in a multi-step flow.
    RunId string

    // Identifier for the workflow associated with this feedback.
    WorkflowId string

    AgentId string

    // Text of the user's query for the chat message this feedback was left on. omitted if scrubbed
    UserQuery string

    // Estimated time saved for the user from this interaction, in minutes.
    TimeSaved float64

    // Issue categories selected by the user for MANUAL_FEEDBACK downvotes, if any.
    Issues []string

    // Free-form sub-issue details for the selected issue categories, if any.
    IssueSubtypes []string
}

Events taken by users in the Glean application. Captures a wide variety of actions.

// Events taken by users in the Glean application. Captures a wide variety of actions.
type GleanCustomerEventClientEvent struct {
    // Event type. A wide variety of actions are included here; see sample queries for examples on useful values.
    Event string

    // The feature or product area to which the event belongs.
    Category string

    // The path in the Glean application on which the event took place.
    PagePath string

    // An identifying label for the event used to further differentiate actions.
    Label string

    // ID for the app session during which the action took place.
    SessionTrackingToken string

    /*
    Surface from which the Client Event was initiated. Common values:
    - New Tab Page: Glean homepage in browser
    - Full Page: Fullscreen Glean web app
    - Extension Sidebar: from Glean sidebar
    - Extension Overlay: Embedded overlay from browser extension
    - NSR: Native Search Replacement embedded in 3rd-party tools
    - Desktop App: Glean desktop application
    - PWA: Progressive Web App
    - Mobile: Glean mobile application
    */
    Modality string

    // The specific UI component involved in the interaction
    UiElement string

    // The domain/website where the event occurred.
    // Eg: company.glean.com
    Domain string

    // For events from embedded components, the external session the event
    // belongs to.
    ExternalSessionId string

    // For events from embedded components, the external user the event
    // belongs to. salted and hashed if scrubbed
    ExternalUserId string

    // URL of the document being interacted with (currently only for support widget events). omitted if scrubbed
    DocUrl string
}

Feedback left on search results.

// Feedback left on search results.
type GleanCustomerEventSearchFeedback struct {
    // Identifier for the search request this feedback was left on.
    TrackingToken string

    // Numerical rating left by the user.
    Rating int

    // Label on the rating left by the user.
    // Values include "downvoted", "upvoted", "very_satisfied", "satisfied"
    RatingKey string

    // Query text for the search request this feedback was left on. omitted if scrubbed
    Query string

    // Feedback comments left by the user, if any. omitted if scrubbed
    Comments string

    // Issue(s) selected by the user, if any.
    Issues []string
}

Upvotes and downvotes left on AI-generated answers.

// Upvotes and downvotes left on AI-generated answers.
type GleanCustomerEventAiAnswerVote struct {
    // Identifier for the search request this vote was left on.
    TrackingToken string

    // Vote cast by the user for this answer. One of UPVOTE, DOWNVOTE
    Vote string
}

Upvotes and downvotes left on AI-generated summaries.

// Upvotes and downvotes left on AI-generated summaries.
type GleanCustomerEventAiSummaryVote struct {
    // Identifier for the search request this vote was left on, if applicable.
    TrackingToken string

    // Vote cast by the user for this answer. One of UPVOTE, DOWNVOTE
    Vote string

    // Document IDs for the summary this vote was left on. obfuscated if scrubbed
    DocIds []string
}

Logs an action execution, including its status, timing, and identifiers used to associate it with a workflow or session. This is distinct from ACTION entities represented inside PRODUCT_SNAPSHOT events.

type GleanCustomerEventAction struct {
    ActionId string
    ActionInstanceId string
    ActionRunId string
    ActionName string
    Caller string
    ExecutionMode string
    EndpointRequestId string
    ErrorStr string
    ExecutionStatus string
    StartTimeMs int64
    EndTimeMs int64
    WorkflowId string
    ApplicationId string
    ErrorType string
    WebSearchProvider string
    SearchTrackingTokens []string
    SessionTrackingToken string
}

Logs artifact lifecycle actions and metadata.

type GleanCustomerEventArtifact struct {
    Action string
    ArtifactId string
    ArtifactType string
    Version int32 // omitted when not applicable
    ExportFormat string // omitted when not applicable
    IsOwner bool
    Surface string // omitted when not applicable
    ChatSessionId string // omitted when not applicable
}

A single top-level invocation of a Glean Workflow request. Includes details for all associated and nested workflow executions.

// A single top-level invocation of a Glean Workflow request.
// Includes details for all associated and nested workflow executions.
type GleanCustomerEventWorkflowRun struct {
    // If populated, identifies the AI App for this workflow run.
    ApplicationId string

    // Globally unique identifier for the invocation.
    RunId string

    // Root workflow identifier for the top-level workflow in nested executions.
    RootWorkflowId string

    // Identifier for the chat session.
    ChatSessionId string

    // Identifier for the Glean session.
    SessionTrackingToken string

    // Source tracking token that initiated this workflow.
    SourceTrackingToken string

    /* Name of Glean feature associated with this workflow.
    - AI_ANSWER: Generates AI-powered answers
    - THREAD_SUMMARIZER: Summarizes long message threads into concise takeaways.
    - SUPPORT_NEXT_STEPS: Suggests follow-up actions after support-related interactions.
    - DAILY_DIGESTS: Creates daily summaries of updates, messages, or documents.
    - AI_FEED: Surfaces recommended or trending content.
    - AGENT: Executes multi-step autonomous workflows across tools.
    - KNOWLEDGE_GRAPH: Explores relationships in Glean's knowledge graph.
    - DEEP_RESEARCH: Performs multi-hop research to synthesize deeper answers.
    - INLINE_MENU: Displays contextual actions inline (e.g., summarize, refine).
    - REFINE_ANSWER: Refines or clarifies AI responses through follow-up.
    - GITHUB_PR_DESCRIPTION_GENERATOR: Creates PR summaries from code changes.
    */
    Feature string

    /* The initiator of the workflow execution.
    - USER: a user sent the message
    - EVAL: Internal evaluation
    - RECOMMENDATION: An information-seeking intent is detected from the user's activity and a chat request is issued proactively
    - PRODUCTION_PROBE: Synthetic probes to validate production readiness
    - PROMPT_TEMPLATE:The user triggered a predefined prompt template
    - UNKNOWN: Unknown initiator
    - ONBOARDING: Part of user onboarding flow, such as a welcome message
    - GLEAN: sent during response generation for a Glean search
    - AUTOMATION: Initiated from background agents(Schedule/Content Trigger agent runs)
    - SUMMARIZE: Initiated to summarize a document, thread, tickets, etc
    */
    Initiator string

    /* The platform or surface from which the workflow was triggered.
    - WEB: Glean web UI
    - SLACK: Slackbot
    - REST_API: API request by an external developer or integration
    - SERVER: Backend or server-side system, such as for scheduled jobs,
      auto-digests, or background agents.
    - MICROSOFT_TEAMS: Glean's Microsoft Teams integration
    */
    Platform string

    // Knowledge mode used for this workflow execution (e.g., "DEEP", "QUICK").
    KnowledgeMode string

    // Agent operating mode: DEFAULT, FAST, ADVANCED, AUTO, DEEP_RESEARCH, etc.
    AgentMode string

    // Namespace of the top-level workflow. Only emitted by the Go service.
    Namespace string

    // For workflows from embedded components, the embedding site's domain.
    // Only emitted by the Go service.
    HostDomain string

    // Whether the model picker selected a model automatically.
    // Only emitted by the Go service.
    IsAutoSelectedModel bool

    // RFC3339 timestamp of when the workflow was created.
    // Only emitted by the Go service.
    WorkflowCreatedAt string

    // Total workflow execution time, in milliseconds.
    // Only emitted by the Go service.
    TotalExecutionLatency uint64

    // Time to first token from the first LLM call, in milliseconds.
    // Only emitted by the Go service.
    TimeTillFirstResponseToken uint64

    // Time until the first thinking message completes, in milliseconds.
    // Only emitted by the Go service.
    TimeTillFirstThinkingToken uint64

    // Time to first token of the final response, in milliseconds.
    // Only emitted by the Go service.
    TimeTillFirstFinalResponseToken uint64

    // All workflows associated with this top-level request.
    WorkflowExecutions []*GleanCustomerEventWorkflowExecution

    // All workflow steps associated with this top-level request.
    StepExecutions []*GleanCustomerEventStepExecution

    // All action executions associated with this top-level request.
    ActionExecutions []*GleanCustomerEventActionExecution
}

type GleanCustomerEventWorkflowExecution struct {
    // Identifier for the type of Workflow run.
    WorkflowId string

    // Creator of this Workflow. Either `GLEAN` for Glean-created workflows or `USER` for user-created workflows.
    CreationSource string

    /* The namespace of the workflow that was run.
    - STATIC_WORKFLOW: statically defined workflow
    - AGENT: workflow associated with Agents
    */
    Namespace string

    // Overall execution status for this Workflow: `SUCCESS`, `ERROR`, `CANCELLED`.
    Status string

    // Error classification.
    ErrorType string

    // True if the workflow, or any imported workflow, contains a replication config.
    // Examples: Workflow A (parent) -> Workflow B (child)
    // Case 1: A and B do not contain loops -> HasLoop is false for both.
    // Case 2: A contains a loop, but B does not -> HasLoop is true for A.
    // Case 3: A does not contain a loop, but B does -> HasLoop is true for both.
    HasLoop bool
}

type GleanCustomerEventStepExecution struct {
    // Identifier for the type of Workflow Step.
    StepId string

    // Identifier for the type of Workflow run.
    WorkflowId string

    // Overall execution status for this step: `EXECUTED`, `SKIPPED`, `ERROR`.
    Status string

    // Error classification.
    ErrorType string

    // Name of the Tool associated with this step.
    ActionInstanceId string

    // Search citations associated with this step, if any. obfuscated if scrubbed
    Citations []*GleanCustomerEventChatCitation
}

type GleanCustomerEventActionExecution struct {
    // Identifier for the action instance executed.
    ActionInstanceId string

    // Identifier for the workflow step that executed this action.
    StepId string

    // Search tracking tokens associated with this action execution.
    SearchTrackingTokens []string
}

Logs LLM (Large Language Model) API calls made by Glean.

// Logs LLM (Large Language Model) API calls made by Glean.
type GleanCustomerEventLlmCall struct {
    // HTTP status code returned from the LLM provider API.
    HttpStatusCode int

    // Name of the LLM model used (e.g., "gpt-4", "claude-3-opus").
    Model string

    // Number of input tokens sent to the LLM.
    InputTokens int64

    // Number of output tokens received from the LLM (includes reasoning tokens)
    OutputTokens int64

    // Number of tokens used to create cache entries.
    CacheCreationInputTokens int64

    // Number of tokens read from cache.
    CacheReadInputTokens int64

    // Number of audio input tokens read from cache.
    CacheReadInputAudioTokens int64

    // Number of audio input tokens sent to the LLM.
    InputAudioTokens int64

    // Number of audio output tokens received from the LLM.
    OutputAudioTokens int64

    // Duration of the audio input, in milliseconds.
    AudioDurationMs int64

    // LLM provider name (e.g., "openai", "anthropic", "azure").
    Provider string

    // Associated workflow run identifier, if this call was part of a workflow.
    WorkflowRunId string

    // Whether the model is hosted by Glean.
    IsGleanHostedModel bool

    // Sub-categorization of the LLM call for analytics.
    SubType string

    // Deployment type used for the call, such as PAYGO or HOSTED.
    DeploymentType string

    // Platform from which the request originated, such as WEB, SLACK, or REST_API.
    Platform string

    // Initiator of the request, such as USER, EVAL, or GLEAN.
    Initiator string

    // Product feature making the request, such as CHAT, AGENT, or VOICE_CHAT.
    Feature string

    // Authenticated OAuth client ID for LLM Gateway traffic. First-party Glean traffic uses "glean".
    GatewayClientId string

    // Operating mode for the request, such as LLM_GATEWAY.
    Mode string

    // Detected client application for LLM Gateway traffic.
    Application string

    // Agent operating mode, such as DEFAULT, FAST, ADVANCED, AUTO, or DEEP_RESEARCH.
    AgentMode string

    // Whether the model picker selected a model automatically.
    IsAutoSelectedModel bool

    // Whether the associated workflow contains a loop.
    HasLoop bool

    // Time to first token, in milliseconds.
    TimeToFirstTokenMillis int64

    // Total LLM call latency, in milliseconds.
    TotalLatencyMillis int64
}

Logs MCP tool usage, including the tool, server, client, authentication, status, and timing.

type GleanCustomerEventMcpUsage struct {
    // MCP event type, such as TOOL_CALL, TOOLS_LIST, or RESOURCES_LIST.
    EventType string

    // Name of the MCP tool.
    ToolName string

    // MCP tool category, such as BUILT_IN, AGENT, or EXTERNAL.
    ToolType string

    // MCP server subpath handling the request.
    Server string

    // Client application name.
    Application string

    // Authentication method, such as OAUTH_GLEAN, OAUTH_IDP, or API_TOKEN.
    AuthMethod string

    // Execution status, such as SUCCESS, ERROR, or CANCELLED.
    Status string

    // Error code when the request fails.
    ErrorCode string

    // Request duration, in milliseconds.
    DurationMs int64

    // MCP transport type, such as REMOTE or LOCAL.
    McpType string

    // MCP protocol version.
    McpProtocol string

    // External MCP server name, when applicable.
    ExternalServerName string
}

Captures the conversation history and input fields associated with a workflow run.

// Captures the conversation history and input fields associated with a workflow run.
type GleanCustomerEventWorkflowConversation struct {
    // Associated workflow run identifier.
    WorkflowRunId string

    // List of messages in the conversation.
    Messages []*GleanCustomerEventChatMessage

    // Input fields supplied to the workflow, when applicable.
    InputFields []*GleanCustomerEventInputField // nullable
}

type GleanCustomerEventChatMessage struct {
    // Author of the message (e.g., "user", "agent", "system").
    Author string

    // Text content of the message.
    Text string
}

type GleanCustomerEventInputField struct {
    // Input field name.
    Name string

    // Input field value.
    Value string
}

Records the taxonomy classification assigned to an agent or workflow. A batch pipeline classifies every agent once per day, so these records describe agent definitions rather than individual user activity.

Unlike the other event types, this record is written by a Python pipeline. It populates only Type and the classification struct: there is no User or IsScrubbed field, and the record carries no user identifiers or query text. In the raw JSON log the payload key is lowercase (workflowclassification).

type GleanCustomerEventWorkflowClassification struct {
    // Identifier of the classified workflow or agent.
    WorkflowId string

    // Functional domain of the workflow, that is, who owns or benefits from it.
    // Display name from the classification taxonomy, such as "Sales", "Engineering",
    // "Human Resources", "Legal & Compliance", or "Cross-Functional / General".
    // "UNKNOWN" when the classifier cannot assign a domain.
    FunctionalDomain string

    // Model confidence in the assigned functional domain, from 0.0 to 1.0.
    FunctionalDomainConfidence float64

    // More specific domain within FunctionalDomain, such as "Onboarding" within
    // Human Resources. Empty when no subdomain applies.
    FunctionalSubdomain string

    // Model confidence in the assigned functional subdomain, from 0.0 to 1.0.
    FunctionalSubdomainConfidence float64

    // What the workflow does, independent of audience. Display name from the
    // taxonomy, such as "Summarize Content", "Triage & Route", "Compile Report",
    // or "General". "UNKNOWN" when the classifier cannot assign a pattern.
    TaskPattern string

    // Model confidence in the assigned task pattern, from 0.0 to 1.0.
    TaskPatternConfidence float64
}

PLEASE NOTE: The Workflow logs have been deprecated and replaced with WORKFLOW_RUN. The Workflow logs were only present in the data starting April-29 to Jun-13, and contain important Chat data.

type GleanCustomerEventWorkflow struct {
    // ID for the chat session during which the workflow event occurred
    // Useful for linking workflow actions to chat interactions.
    ChatSessionId string

    // List of citations.
    Citations *[]GleanCustomerEventChatCitation

    // Name of the connector where the workflow originated or is acting on.
    Datasource string

    /* Name of Glean feature associated with this workflow.
    - AI_ANSWER: Generates AI-powered answers
    - THREAD_SUMMARIZER: Summarizes long message threads into concise takeaways.
    - SUPPORT_NEXT_STEPS: Suggests follow-up actions after support-related interactions.
    - DAILY_DIGESTS: Creates daily summaries of updates, messages, or documents.
    - AI_FEED: Surfaces recommended or trending content.
    - AGENT: Executes multi-step autonomous workflows across tools.
    - KNOWLEDGE_GRAPH: Explores relationships in Glean's knowledge graph.
    - DEEP_RESEARCH: Performs multi-hop research to synthesize deeper answers.
    - INLINE_MENU: Displays contextual actions inline (e.g., summarize, refine).
    - REFINE_ANSWER: Refines or clarifies AI responses through follow-up.
    - GITHUB_PR_DESCRIPTION_GENERATOR: Creates PR summaries from code changes.
    */
    Feature string

    /* The initiator of the workflow execution.
    - USER: a user sent the message
    - EVAL: Internal evaluation
    - RECOMMENDATION: An information-seeking intent is detected from the user's activity and a chat request is issued proactively
    - PRODUCTION_PROBE: Synthetic probes to validate production readiness
    - PROMPT_TEMPLATE:The user triggered a predefined prompt template
    - UNKNOWN: Unknown initiator
    - ONBOARDING: Part of user onboarding flow, such as a welcome message
    - GLEAN: sent during response generation for a Glean search
    - AUTOMATION: AUTOMATION: Initiated from background agents(Schedule/Content Trigger agent runs)
    - SUMMARIZE: Initiated to summarize a document, thread, tickets, etc
    */
    Initiator string

    /* The platform or surface from which the workflow was triggered.
    - WEB: Glean web UI
    - SLACK: Slackbot
    - REST_API: API request by an external developer or integration
    - SERVER: Backend or server-side system, such as for scheduled jobs,
      auto-digests, or background agents.
    - MICROSOFT_TEAMS: Glean's Microsoft Teams integration
    */
    Platform string

    // Unique identifier for the overall workflow run.
    // Ties together all steps in a multi-step flow.
    RunId string

    // Status of the current step execution within the workflow.
    // Example: "UNSPECIFIED", "EXECUTED", "SKIPPED", "ERROR"
    StepExecutionStatus string

    // Identifier for the specific step within the workflow.
    // Example: "REFLECT", "RESPOND", "SEARCH", "PARSE_QUERY_LANGUAGE" etc.
    StepId string

    // Overall status of the full workflow execution.
    // Example: "SUCCESS", "ERROR", "CANCELLED"
    WorkflowExecutionStatus string

    // Identifier for the workflow template or definition.
    // Helps categorize which flow was executed.
    WorkflowId string
}

Documents activities performed by Glean Bot across various platforms.

type GleanCustomerEventGleanBotActivity struct {
    // Identifier for the AI application associated with this Glean Bot activity.
    ApplicationId string

    // ID of the Slack or chat channel where the interaction occurred.
    ChannelId string

    // Metadata for the event, as key-value pairs. Keys are EventMetadataType
    // names, such as NUM_URLS_IN_CHAT_REQUEST or EXECUTE_ACTION_ACTION_INSTANCE_ID.
    EventMetadata map[string]string

    // Token used to uniquely track this specific Glean Bot event across logs.
    EventTrackingToken string

    /* Type of activity performed by Glean Bot.
    Indicates the nature of the event that resulted from bot interaction.
    - NON_TAGGED_MESSAGE: A message sent to Gleanbot without an explicit trigger (e.g., @ mention or command).
    - PROACTIVE_DISCUSSION_SUMMARIZER: Bot proactively summarizes a thread.
    - DAILY_DIGEST_REMINDER: Reminder to view the daily digest.
    - ASSISTANT_THREAD: Thread started with Glean.
    - DM_TO_GLEANBOT_MESSAGE: Direct message sent to Gleanbot.
    - VIEW_DIGEST_CLICK: User clicks to view a digest.
    - DIGEST_SETTINGS: User opens or updates digest settings.
    - SHOW_SOURCES: Bot shows sources behind an answer.
    - SHARE_HELPFULNESS: User rates the helpfulness of a message.
    - TAGGED_MESSAGE: Gleanbot was explicitly mentioned or tagged.
    - GENERATE_ANSWER: Bot generates an AI-powered response.
    - COMMAND: Command issued to Gleanbot (e.g., /glean).
    - FEEDBACK_CLICK: User clicks quick feedback options.
    - SHARE_CLICK: User clicks a share button or link.
    - SUBMIT_FEEDBACK: Detailed feedback submitted by user.
    - DISMISS_SUGGESTION: User dismisses a bot suggestion.
    - EXECUTE_ACTION: Bot executes a follow-up action.
    - TEAMS_BOT_INSTALL: Gleanbot installed in Microsoft Teams.
    */
    EventType string

    // Latency measurements for different parts of the bot response pipeline,
    // in milliseconds, keyed by pipeline stage.
    LatenciesMillisMap map[string]int64

    // Description of what response was sent by the bot.
    // Eg: DAILY_DIGEST_REMINDER_SENT, REACTIVE_ACT_MESSAGE
    ResponseEvents []string

    // Source system or trigger for the bot action.
    Source string

    // Session tracking token used to link this activity with other user actions.
    Stt string

    // Entry point or reason for triggering the workflow
    // e.g. PROACTIVE_WORKFLOW_START, DSE_EVENT_START, PROACTIVE_BOT_DISABLED_FAILURE
    WorkflowExecutionPoints []string

    // Identifier for the workspace where this activity took place.
    WorkspaceId string

    // Agent identifier associated with this Glean Bot activity.
    AgentId string

    // Identifier for the team where this activity took place.
    TeamId string

    // ID for the chat session during which the activity occurred.
    ChatSessionId string
}

// Keys used in LatenciesMillisMap. Each value is a duration in milliseconds.
type GleanBotActivityLatenciesMillis struct {
    // Time in milliseconds for various Gleanbot actions during message handling.
    ReactiveActMessage int64
    // Time to send the bot's main reactive message.
    ReactiveReaction int64
    // Time taken to plan the bot's response message.
    ReactivePlanMessage int64
    // Time to delete a planned message.
    ReactivePlanMessageDeleted int64
    // Time to share a private response (e.g., converting draft to public message).
    ReactivePrivateResponseShared int64
    // Time to send a proactive message. (not in response to user input).
    ProactiveMessage int64
    // Time to display a response modal.
    ReactiveGenerationResponseModal int64
    // Time to send an error message.
    ReactiveErrorMessage int64
}

Documents clicks on citations within chat responses.

type GleanCustomerEventChatCitationClick struct {
    // Name of the connector where the cited content resides.
    Datasource string

    // Identifier linking the citation click back to the original chat query.
    TrackingToken string

    // Document ID that was clicked. omitted if scrubbed
    DocId string
}

Note that since this is snapshot data, any user, workflow, workflow step, subscription, action pack, action, or action instance that is deleted on a given date will stop showing up in the data from the next day.

type GleanCustomerEventProductSnapshot struct {
    // Which entity this snapshot describes. One of: USER, WORKFLOW, WORKFLOW_STEP,
    // SUBSCRIPTION, ACTION_PACK, ACTION, ACTION_INSTANCE, SERVICE_CREDENTIAL,
    // SAVED_VERSION.
    Type string
    User *UserSnapshot
    Workflow *WorkflowSnapshot
    WorkflowStep *WorkflowStepSnapshot
    Subscription *SubscriptionSnapshot
    ActionPack *ActionPackSnapshot
    Action *ActionSnapshot
    ActionInstance *ActionInstanceSnapshot
    ServiceCredential *ServiceCredentialSnapshot
    SavedVersion *SavedVersionSnapshot
}

type ServiceCredentialSnapshot struct {
    // Unique identifier for the service credential.
    Id string

    // Identifier of the template the credential was created from.
    TemplateId string

    // Connector instance the credential belongs to.
    DatasourceInstance string

    // Whether the credential belongs to a Glean-managed app.
    IsManagedApp bool

    // Display name for the credential.
    DisplayName string

    // Which users the credential is available to. One of ALL, SOME, NONE.
    Audience string

    // When the credential was created.
    CreatedAt string

    // When the credential was last updated.
    UpdatedAt string

    // User who created the credential. salted and hashed if scrubbed
    CreatedBy string

    // User who last updated the credential. salted and hashed if scrubbed
    UpdatedBy string
}

type SavedVersionSnapshot struct {
    // Workflow the saved version belongs to.
    WorkflowId string

    // Identifier for the saved version.
    SavedVersionId int64
}

type UserSnapshot struct {
    // The user's title, email address, and manager ID are held on the internal
    // snapshot but are never written to this log.

    // Internal unique ID for the user. salted and hashed if scrubbed
    Id string

    // Canonical ID used for identity resolution across systems. salted and hashed if scrubbed
    CanonicalId string

    // List of alternate user identifiers used across systems. salted and hashed if scrubbed
    AliasIds []string

    // Internal logging identifier for the user. omitted if scrubbed
    LoggingId string

    // Timestamp when the user signed up.
    SignUpTime string

    // The user's role within the product (e.g., "Member").
    PermissionsRole string

    // Secondary roles assigned to the user.
    PermissionsSecondaryRoles []string

    // Department name the user belongs to. salted and hashed if scrubbed
    Department string

    // Internal ID associated with the user's department.
    DepartmentId int32

    // User's job function (e.g., "Research").
    JobFunction string

    // User's employment type, e.g., "FULL_TIME".
    EmployeeType string

    // Timestamp representing when the user account was created.
    StartDate string

    // User's configured timezone, e.g., "Pacific Daylight Time".
    Timezone string

    // Timezone offset in seconds from UTC (e.g., -25200 for PDT).
    TimezoneOffset int64

    // Eligibility string for product features.
    ProductEligibility string

    // Billing labels applied to the user.
    BillingLabels []string

    // List of user settings as key-value pairs.
    UserSettings *[]UserSetting
}

type UserSetting struct {
    // Key for the user setting (e.g., "general.theme").
    Key string

    // Value associated with the setting key.
    Value string
}

type WorkflowSnapshot struct {
    // Unique identifier for the workflow.
    WorkflowId string

    // Creation timestamp of the workflow.
    CreatedAt string

    // Timestamp of the last update (default may be "0001-01-01T00:00:00Z").
    UpdatedAt string

    // ID of the user who created the workflow. salted and hashed if scrubbed
    CreatedBy string

    // ID of the user who last updated the workflow. salted and hashed if scrubbed
    LastUpdateBy string

    // Workflow namespace (e.g., "STATIC_WORKFLOW").
    NamespaceEnum string

    // Number of placeholders used in the workflow definition.
    NumPlaceholders string

    // Application ID the workflow belongs to.
    ApplicationId string

    // List of access roles for this workflow.
    Roles []WorkflowRole

    // Details about what triggers this workflow.
    Trigger WorkflowTrigger

    // Indicates if the workflow is a routing target.
    IsRoutingTarget string

    // Indicates if the workflow is an autonomous agent.
    IsAutonomousAgent string

    // Notes or annotations (may be blank).
    Notes []Note

    // Indicates if the workflow is hidden from standard listings.
    Unlisted string

    // Associated ML model (if any; blank if unused).
    Model string

    // Workflow provider (if any; may be empty).
    Provider string

    // Indicates if the workflow is only a draft.
    IsDraftOnly string

    // Workflow version number.
    Version string

    // Workflow name. omitted if scrubbed
    Name string

    // Information about workflow creation source.
    CreationSourceInfo CreationSourceInfo
}

type CreationSourceInfo struct {
    // Source of creation (e.g., "TEMPLATE", "SCRATCH").
    Source string

    // Source template ID if created from template.
    SourceId string
}

type WorkflowRole struct {
    // Role name, e.g., "VIEWER".
    Role string

    // Scope type for the role, e.g., "ALL".
    Type string

    // Role scope identifier. salted and hashed if scrubbed
    Id string
}

type Note struct {
    // Background color of the note.
    BackgroundColor string
}

type WorkflowTrigger struct {
    // Type of trigger, e.g., "INPUT_FORM".
    Type string

    // Template ID if applicable.
    TemplateId string

    // Connector for the trigger event.
    Datasource string

    // Associated document type (may be blank).
    DocType string

    // Reason for event-based trigger (if any).
    EventReason string

    // Additional dimensions or metadata (if any).
    Facets []string

    // Whether scheduled triggers are enabled.
    ScheduleEnabled string
}

type WorkflowStepSnapshot struct {
    // Unique action identifier (e.g., "Respond").
    ActionId string

    // Whether the step is a branching step in logic.
    IsBrancher string

    // Enum representing the step type, e.g., "DEFAULT".
    TypeEnum string

    // Associated ML model (if any; blank if unused).
    Model string

    // Unique step identifier within the workflow.
    StepId string

    // IDs of steps that must execute before this one.
    StepDependencies []string

    // Provider responsible for this step (if any).
    Provider string

    // Expected input type, e.g., "STEP_INSTRUCTION".
    InputType string

    // Indicates if this step contains looping logic.
    HasLoop string

    // Sampling temperature for LLM use (blank if unused).
    Temperature string

    // ID of the parent workflow.
    WorkflowId string

    // Defines the scope of memory this step includes.
    MemoryInclusion string
}

type SubscriptionSnapshot struct {
    // Unique identifier for the subscription.
    SubscriptionId string

    // Associated workflow identifier.
    WorkflowId string

    // Document type for the subscription.
    DocType string

    // Whether the doc type was filled by the end user.
    EndUserFilledDocType bool

    // Current status of the subscription.
    Status string

    // How often the subscription repeats (e.g., "DAILY", "WEEKLY").
    RepeatFrequency string

    // Timezone for the subscription schedule.
    Timezone string

    // When the subscription starts.
    StartsAt string

    // Reason for the current status.
    StatusReason string

    // User who created the subscription. salted and hashed if scrubbed
    CreatedBy string

    // When the subscription was created.
    CreatedAt string

    // User who last updated the subscription. salted and hashed if scrubbed
    UpdatedBy string

    // When the subscription was last updated.
    UpdatedAt string

    // Type of trigger for this subscription.
    TriggerType string
}

type ActionPackSnapshot struct {
    // Unique identifier for the action pack.
    Id string

    // Name of the action pack.
    Name string

    // Type of action pack (OOTB/CUSTOM).
    Type string

    // Associated connector instance.
    DataSourceInstance string

    // When the action pack was created.
    CreatedAt string

    // When the action pack was last updated.
    UpdatedAt string

    // User who created the action pack. salted and hashed if scrubbed
    CreatedBy string

    // User who last updated the action pack. salted and hashed if scrubbed
    UpdatedBy string

    // Provider for the action pack.
    Provider string

    // Authentication configuration data.
    AuthData AuthConfigs
}

type AuthConfigs struct {
    // List of authentication configurations.
    Configs []AuthConfig
}

type AuthConfig struct {
    // Type of authentication.
    AuthType string

    // Whether central authentication is used.
    UsesCentralAuth bool
}

type ActionSnapshot struct {
    // Unique identifier for the action.
    Id string

    // Name of the action.
    Name string

    // Type of action.
    Type string

    // Source of the action.
    Source string

    // Target surfaces where action is available.
    TargetSurfaces string

    // Glean configuration for the action.
    AssistantConfig string

    // Creator configuration for the action.
    CreatorConfig string

    // When the action was created.
    CreatedAt string

    // When the action was last updated.
    UpdatedAt string

    // User who created the action. salted and hashed if scrubbed
    CreatedBy string

    // User who last updated the action. salted and hashed if scrubbed
    UpdatedBy string

    // Background execution policy for the action.
    BackgroundExecutionPolicy string

    // Associated action pack ID.
    ActionPackId string

    // Name of the associated action pack.
    ActionPackName string

    // Type of the associated action pack.
    ActionPackType string

    // Connector instance of the associated action pack.
    ActionPackDataSourceInstance string

    // When the associated action pack was created.
    ActionPackCreatedAt string

    // When the associated action pack was last updated.
    ActionPackUpdatedAt string

    // User who created the associated action pack. salted and hashed if scrubbed
    ActionPackCreatedBy string

    // User who last updated the associated action pack. salted and hashed if scrubbed
    ActionPackUpdatedBy string

    // Provider of the associated action pack.
    ActionPackProvider string
}

type ActionInstanceSnapshot struct {
    // Unique identifier for the action instance.
    Id string

    // Deployment surface where the action instance is deployed.
    DeploymentSurface string

    // Specific surface ID.
    SurfaceId string

    // Current status of the action instance.
    Status string

    // User who created the action instance. salted and hashed if scrubbed
    CreatedBy string

    // User who last updated the action instance. salted and hashed if scrubbed
    UpdatedBy string

    // When the action instance was created.
    CreatedAt string

    // When the action instance was last updated.
    UpdatedAt string

    // Associated action ID.
    ActionId string

    // Name of the associated action.
    ActionName string

    // Type of the associated action.
    ActionType string

    // Source of the associated action.
    ActionSource string

    // Target surfaces of the associated action.
    ActionTargetSurfaces []string

    // Glean configuration of the associated action.
    ActionAssistantConfig string

    // Creator configuration of the associated action.
    ActionCreatorConfig string

    // When the associated action was created.
    ActionCreatedAt string

    // When the associated action was last updated.
    ActionUpdatedAt string

    // User who created the associated action. salted and hashed if scrubbed
    ActionCreatedBy string

    // User who last updated the associated action. salted and hashed if scrubbed
    ActionUpdatedBy string

    // Associated action pack ID.
    ActionPackId string

    // Name of the associated action pack.
    ActionPackName string

    // Type of the associated action pack.
    ActionPackType string

    // Connector instance of the associated action pack.
    ActionPackDataSourceInstance string

    // When the associated action pack was created.
    ActionPackCreatedAt string

    // When the associated action pack was last updated.
    ActionPackUpdatedAt string

    // User who created the associated action pack. salted and hashed if scrubbed
    ActionPackCreatedBy string

    // User who last updated the associated action pack. salted and hashed if scrubbed
    ActionPackUpdatedBy string

    // Provider of the associated action pack.
    ActionPackProvider string
}