Nest Engineering Docs
Event Logging

Interfaces

Inbound contract and failure model for Event Logging

Protocol

  • Connect Protocol (JSON) over HTTP/2 / h2c.
  • Unary route: /events.v1.EventLoggingService/LogEvent
  • Service definition: proto/events/v1/events.proto

Authentication

  • Internal ingress only. Cloud Run IAM is the auth boundary.
  • Callers need roles/run.invoker on the deployed service.
  • The app records platform-provided caller identity from x-goog-authenticated-user-email and x-goog-authenticated-user-id into service-managed audit metadata.
  • The app does not perform a second bearer-token validation pass.

RPC catalog

RPCDirectionAuthNotes
LogEventUnaryRequiredPersist one event row and optionally forward it to Statsig.

LogEvent request contract

FieldRequiredSemantics
event_nameYesStable platform event name. Blank values are rejected.
event_typeNoCaller-supplied event classification. Persisted to the event_type column when present.
actor_idNoCaller-supplied actor identifier. Persisted to the actor_id column when present.
metadataNoArbitrary nested JSON, capped at 256 top-level keys and 64 KiB serialized size.
event_tsNoLogical occurrence time. Defaults to current UTC when omitted.
idempotency_keyNoCorrelation token only. Presence does not guarantee deduplication.
forward_to_statsigNoDefaults to true when omitted. Set to false for Spanner-only writes.

Additional rules:

  • Callers never send event_id; the service generates it.
  • _eventLog is reserved for service-managed metadata and is rejected if sent by a caller.
  • Retries can create duplicate rows because v1 does not deduplicate on idempotency_key.

Response contract

FieldPresent whenNotes
event_idFull successGenerated by the service and persisted as the row key.
idempotency_keyCaller supplied a non-blank key and the RPC fully succeededEchoed for correlation.

Error model

ConditionConnect codeNotes
Proto validation or normalization failureINVALID_ARGUMENTIncludes blank event_name, blank event_type or actor_id when supplied, reserved _eventLog, or oversized metadata.
Spanner write failureINTERNALNo Statsig forwarding is attempted.
Statsig forward failure after a successful writeUNAVAILABLEThe event row is already stored, so retries may create duplicates.

Failure-after-write behavior

The service writes to Spanner before forwarding to Statsig. That means UNAVAILABLE does not imply "nothing was written." It specifically means "the write succeeded, but the downstream Statsig side effect failed."

Last updated on

On this page