Manage event schemas
Event schemas are first-class entities in Ticketra: instead of working with opaque raw event codes, you define schemas that describe the shape and meaning of a class of events. This page covers their lifecycle.
The schema lifecycle
| State | Meaning |
|---|---|
DRAFT | Editable working version; fields and identifiers can change. |
ACTIVE | Published and in use. |
DEPRECATED | Retired; kept for historical data but no longer recommended. |
Define a schema
Create a schema as a DRAFT, then add fields and identifiers.
Fields describe the data each event carries. Each field has a field_name and a data_type:
STRING · INTEGER · IP_ADDRESS · TIMESTAMP · ENUM · FLOAT · BOOLEAN
A field can optionally map to an observable type (e.g. an IP_ADDRESS field that should be extracted as an IP observable).
Identifiers tell Ticketra how to recognize an event as belonging to this schema:
EVENT_ID · SYSLOG_PATTERN · ACTION_CODE
Field names are case-insensitively unique within a schema. You'll get a validation error on duplicates.
Versioning
Schemas are versioned. You edit fields/identifiers only while the latest version is a DRAFT. Once a version is ACTIVE, create a new version before changing its structure — this preserves the integrity of data captured under the published version.
Publish and deprecate
- Publish a draft to make it
ACTIVE(schemas:publish). - Deprecate an active schema when it's superseded (
schemas:deprecate). Deprecated schemas remain for historical reference.
Permissions
| Action | Permission |
|---|---|
| View schemas | schemas:read |
| Create schema | schemas:create |
| Edit a draft | schemas:edit_draft |
| Publish | schemas:publish |
| Deprecate | schemas:deprecate |