Model
Identity and environments
MonitOps identifies a monitored service from the attributes in its telemetry, within the tenant and source fixed by the sender's credential. The environment scopes health, signals and correlation, and it is never part of what makes two services the same service.
How it works#
Authentication establishes who is allowed to send: the credential fixes the tenant, the source, the system the source belongs to and its forwarding policy, and a sender cannot override them. Within that authority, the attributes on each record group say which service the telemetry describes.
| Attribute | Role |
|---|---|
service.namespace, service.name | Identity of the logical service within the tenant |
service.instance.id | Identity of a running instance, when the sender provides it |
service.version | Release context. A new version is not a new service |
deployment.environment.name | Operational scope for health, signals and correlation |
Identity versus context#
Identity is the namespace and name. Instance and version are context: a new release or a new running instance of order-api is the same service. The environment is scope, not identity, so order-api in production and order-api in staging are one logical service with separate operational state. MonitOps does not merge the operational state of unrelated environments.
Resolution#
MonitOps matches or registers each distinct identity before the telemetry becomes queryable. A service that starts sending appears without registration, with the version of the mapping recorded. Systems and journeys are different: they exist because someone declared them (see Declared systems).
Several sources, one entity#
More than one source can observe the same service. Observing it gives a source no authority over the service's membership of a system or of correlation; those come from trusted configuration.
Configuration#
The source's metadata policy can supply service.namespace and deployment.environment.name, either as a default, which fills the value only when absent, or as an enforced value, which also rejects a sender value that conflicts. The version and instance come from the producer. Rotating a credential changes neither the policy nor any identity. The policy table is in Sources.
The environment attribute#
The canonical attribute is deployment.environment.name. The older deployment.environment is normalised to it when the canonical attribute is absent. If both are present with conflicting values, the records in that group are rejected with environment_alias_conflict.
What you see in the console#
The service map and every health view show an entity in one environment at a time. Entities that appear without any declaration are shown as services; a service seen in a log line alone is not an edge or a dependency (see Service map).
Failure states#
| State | Behaviour |
|---|---|
| Identity missing or ambiguous | The records stay masked and pending, with visible diagnostics, until the identity is resolved. No service is created under a placeholder name to make them queryable |
| Conflict with an enforced policy | Rejected with enforced_metadata_conflict |
| Conflicting environment attributes | Rejected with environment_alias_conflict |
Related#
Last updated October 2026