curiosity within Canvas Live Events - can you help explain it?

[pgo586]

I've been using Canvas Live events (Caliper format)  to find instances of files being downloaded in Canvas courses. However, recently it's come to my attention that these events may refer to files with names that do not exist as such within the course's file area. More specifically, I've seen recent live events  (raw data) that look like the following: (note: real numbers and file names have been substituted)

        {"sensor":"http://canvas.northwestern.edu/","sendTime":"2025-01-10T21:15:19.939Z","dataVersion":"http://purl.imsglobal.org/ctx/caliper/v1p1",
"data":[{"@context":"http://purl.imsglobal.org/ctx/caliper/v1p1",
"id":"urn:uuid:379e2aaa-c86e-4b3c-8d4f-fb27e094d8ec",
"type":"NavigationEvent",
"actor":{"id":"urn:instructure:canvas:user:1111111111111111","type":"Person","extensions":{"com.instructure.canvas":{"user_login":"user1","user_sis_id":"user1","root_account_id":"18760000000000001","root_account_lti_guid":"7db438071375c02373713c12c73869ff2f470b68.new-northwestern.instructure.com","root_account_uuid":"WTbP67mC863Zx9qZ1XtqGSxhiLCO5sjJQ2lPGfgf","entity_id":"18760000000174824"}}},
"action":"NavigatedTo",
"object":{"id":"urn:instructure:canvas:attachment:18760000018432828","type":"Entity","name":"attachment","extensions":{"com.instructure.canvas":{"asset_name":"Real File Name 1.pdf","asset_type":"attachment","entity_id":"18760000018432828","context_account_id":"18760000000000517","http_method":"GET","filename":"Real-File-Name-prefix_62780081+%282%29.pdf","display_name":"Real File Name 1.pdf"}}},
"eventTime":"2025-01-10T21:15:19.245Z",

etc...
}]}

What's noticeable here is the following: in the object.extensions field, there are at least 3 attributes as follows:
- com.instructure.canvas.asset_name
- com.instructure.canvas.display_name

- com.instructure.canvas.filename

If one looks carefully at the values assigned to the 3 fields above, the first 2 correspond to the actual file name of the file, while the last one does not. Instead, it has a prefix of the actual file name, followed by the number and some special characters (if one URL decodes the filename value, it looks like a fileNamePrefix_<number> (2).pdf ).

Could somebody at Instructure shed some light as to why the 'filename' attribute contains that, versus the actual file name, and how it is calculated? Note that this file happens to NOT have been edited by any user in this course for months.

It certainly does appear that the 'filename' attribute should not be trusted to contain the name of the file (contrary to my earlier expectations on this), and  that either 'asset_name' or 'display_name' should, but it would be nice to understand what filename actually means (perhaps a file 'part' somewhere in the back end?). Would love to hear from Instructure on this.