Real-Time Metrics GraphQL API Fields
Each GraphQL API dataset has specific fields that can be used when querying for data from that specific dataset. These fields are also used for the Real-Time Metrics interface on Azion Console.
See each available field and their descriptions next.
httpMetrics (Edge Applications, WAF)
| Field | Description |
|---|---|
| bytesSent | Number of bytes sent to a client. This field is the result of a sum. Example: 191 |
| configurationId | Unique Azion configuration identifier set on virtual host configuration file. Example: 1595368520 |
| geolocCountryName | Country name resolution based on client IP. Example: Canada |
| geolocRegionName | Region/state name resolution based on client IP. Example: Parana |
| host | Host information sent on the request line. Stores: host name from the request line, or host name from the “Host” request header field, or the server name matching a request. Example: hello.myhost.net |
| proxyStatus | HTTP error status code or origin when no response is obtained from the upstream. Example: 500. In case of cache, the response is -. |
| remoteAddressClass | Class of the IP address of the origin that generated the request. Example: 44.192.0.0/11 |
| requestLength | Request length in bytes, including request line, headers, and body. This field is the result of a sum. Example: 167 |
| requestMethod | HTTP request method. Example: GET or POST. |
| requestTime | Request processing time, in seconds, since the first bytes were read from the client. This field is the result of a sum. Example: 0.234 |
| requests | Total amount of requests in the aggregation being used. This field is the result of a sum. Example: 11 |
| scheme | Request scheme. Example: HTTP or HTTPS. |
| sentHttpXOriginalImageSize | “X-Original-Image-Size” header sent in the origin’s response. Used by IMS to inform original image size. This field is the result of a sum. Example: 987390 |
| serverProtocol | Version of the request protocol. Example: HTTP/1.1, HTTP/2.0, HTTP/3.0 |
| sourceLocPop | Location and PoP of the edge that received the request. Example: lax-bso |
| status | HTTP status code of the request. Example: 200 |
| ts | Timestamp of when the event was created. Example: 2022-10-20T10:10:10 |
| upstreamBytesReceived | Number of bytes received by the origin’s edge if the content isn’t cached. This field is the result of a sum. Example: 8304 |
| upstreamCacheStatus | Status of the local edge cache. Can be: MISS, BYPASS, EXPIRED, STALE, UPDATING, REVALIDATED, HIT, or - |
| upstreamResponseTime | Time it takes for the edge to receive a default response from the origin, in seconds, including headers and body. This field is the result of a sum. Example: 0.876. In case of cache, the response is - |
| upstreamStatus | HTTP status code of the origin. If a server can’t be selected, the variable keeps the 502 (Bad Gateway) status code. Example: 200. In case of cache, the response is -. |
| wafBlock | Informs whether the WAF blocked the action or not. 0 when action wasn’t blocked and 1 when action was blocked. When in Learning Mode, it won’t be blocked regardless of the return. |
| wafLearning | Informs if WAF is in Learning mode. Returns 0 if it isn’t and 1 if it’s. |
Calculated fields
When a field is a result of any kind of calculation, such as a sum, they’re considered as calculated fields.
| Calculated field | Description |
|---|---|
| bandwidthImagesProcessedSavedData | The saved data bandwidth in bytes achieved with Images Processor through Azion services. Example: 1026730813 |
| bandwidthMissedData | The missed data bandwidth in bytes rate achieved through Azion services. Example: 3.76 |
| bandwidthOffload | Percentage of the bandwidth that was offloaded through Azion services. Example: 85.23 |
| bandwidthSavedData | The saved data bandwidth rate in bytes achieved through Azion services. Example: 0.21 |
| bandwidthTotal | The bandwidth rate in bytes achieved through Azion services. Example: 4.21 |
| dataTransferredIn | Sum of the request length in bytes. If the data wasn’t a cache hit, the request length is summed once more. Example: 1202 |
| dataTransferredOut | Sum of the bytes sent. If the data wasn’t a cache hit, the upstream bytes sent is summed. Example: 6460 |
| dataTransferredTotal | Value of Data Transferred In + Data Transferred Out in bytes. Example: 766 |
| edgeRequestsTotal | Total amount of all requests in the edge application. Example: 23 |
| edgeRequestsTotalPerSecond | Total amount of requests per second in the edge application. Example: 0.00026 |
| httpRequestsTotal | Total amount of requests using the HTTP protocol. Example: 10 |
| httpsRequestsTotal | Total amount of requests using the HTTPS protocol. Example: 120 |
| missedData | Total amount of data that was missing and fetched from the origin. Example: 384 |
| missedRequests | Total amount of requests missed by using Azion services. Example: 5 |
| missedRequestsPerSecond | Total amount of requests missed per second by using Azion services. Example: 0.00034 |
| offload | Percentage of client data delivered by Azion, saving data. Example: 9.71 |
| requestsHttpMethodGet | Total amount of requests with the HTTP method GET. Example: 18 |
| requestsHttpMethodHead | Total amount of requests with HTTP method HEAD. Example: 2 |
| requestsHttpMethodOthers | Total amount of requests with others HTTP methods. Example: 3 |
| requestsHttpMethodPost | Total amount of requests with the HTTP method POST. Example: 6 |
| requestsOffloaded | Percentage of client requests delivered by Azion. Example: 50 |
| requestsPerSecondOffloaded | Percentage of the requests per second that were offloaded through Azion services. Example: 10 |
| requestsStatusCode200 | Total amount of requests with the HTTP 200 status code. Example: 45 |
| requestsStatusCode204 | Total amount of requests with the HTTP 204 status code. Example: 20 |
| requestsStatusCode206 | Total amount of requests with the HTTP 206 status code. Example: 30 |
| requestsStatusCode2xx | Total amount of requests with other 2XX HTTP status codes. Example: 60 |
| requestsStatusCode301 | Total amount of requests with the HTTP 301 status code. Example: 10 |
| requestsStatusCode302 | Total amount of requests with the HTTP 302 status code. Example: 12 |
| requestsStatusCode304 | Total amount of requests with the HTTP 304 status code. Example: 5 |
| requestsStatusCode3xx | Total amount of requests with other 3XX HTTP status codes. Example: 30 |
| requestsStatusCode400 | Total amount of requests with the HTTP 400 status code. Example: 24 |
| requestsStatusCode403 | Total amount of requests with the HTTP 403 status code. Example: 14 |
| requestsStatusCode404 | Total amount of requests with the HTTP 404 status code. Example: 35 |
| requestsStatusCode4xx | Total amount of requests with other 4XX HTTP status codes. Example: 50 |
| requestsStatusCode500 | Total amount of requests with the HTTP 500 status code. Example: 6 |
| requestsStatusCode502 | Total amount of requests with the HTTP 502 status code. Example: 18 |
| requestsStatusCode503 | Total amount of requests with the HTTP 503 status code. Example: 40 |
| requestsStatusCode5xx | Total amount of requests with other 5XX HTTP status codes. Example: 100 |
| savedData | Total amount of data that was saved by using Azion services. Example: 8300 |
| savedRequests | Total amount of requests saved by using Azion services. Example: 18 |
| savedRequestsPerSecond | Total amount of requests saved per second by using Azion services. Example: 11 |
| wafRequestsAllowed | Total amount of requests allowed by WAF. Example: 10 |
| wafRequestsBlocked | Total amount of requests blocked by WAF. Example: 4 |
| wafRequestsOthersAttacks | Total amount of requests with Others attacks, not considering XSS, RFI, and SQL Injection threats. Example: 2 |
| wafRequestsRfiAttacks | Total amount of requests with Remote File Inclusion (RFI) attack. Example: 5 |
| wafRequestsSqlAttacks | Total amount of requests with SQL Injection attack. Example: 3 |
| wafRequestsThreat | When WAF is in learning mode, total number of requests identified as threats processed but not blocked by WAF. Example: 10 |
| wafRequestsXssAttacks | Total amount of requests with Cross-site scripting (XSS) attack. Example: 1 |
tieredCacheMetrics (Tiered Cache)
| Field | Description |
|---|---|
| bytesSent | Number of bytes sent to a client. This field is the result of a sum. Example: 191 |
| configurationId | Unique Azion configuration identifier set on virtual host configuration file. Example: 1595368520 |
| host | Host information sent on the request line. Stores: host name from the request line, or host name from the “Host” request header field, or the server name matching a request. Example: hello.myhost.net |
| proxyStatus | HTTP error status code or origin when no response is obtained from the upstream. Example: 520. In case of cache, the response is -. |
| remoteAddressClass | Class of the IP address of the origin that generated the request. Example: 44.192.0.0/11 |
| requestLength | Request length in bytes, including request line, headers, and body. This field is the result of a sum. Example: 167 |
| requestMethod | HTTP request method. Example: GET or POST. |
| requestTime | Request processing time, in seconds, since the first bytes were read from the client. This field is the result of a sum. Example: 0.234 |
| requests | Total amount of requests in the aggregation being used. This field is the result of a sum. Example: 11 |
| scheme | Request scheme. Example: HTTP or HTTPS. |
| sourceLocPop | Location and PoP of the server that received the request. Example: lax-bso |
| status | HTTP status code of the request. Example: 200 |
| ts | Timestamp the event was created. Example: 2022-10-20T10:10:10 |
| upstreamBytesReceived | Number of bytes received by the origin’s edge if the content isn’t cached. This field is the result of a sum. Example: 8304 |
| upstreamCacheStatus | Status of the local edge cache. Can be: MISS, BYPASS, EXPIRED, STALE, UPDATING, REVALIDATED, HIT, or - |
| upstreamResponseTime | Time it takes for the edge to receive a default response from the origin, in seconds, including headers and body. This field is the result of a sum. Example: 0.876. In case of cache, the response is - |
| upstreamStatus | HTTP status code of the origin. If a server can’t be selected, the variable keeps the 502 (Bad Gateway) status code. Example: 200. In case of cache, the response is -. |
Calculated fields
When a field is a result of any kind of calculation, such as a sum, they’re considered as calculated fields.
| Calculated field | Description |
|---|---|
| dataTransferredIn | Sum of the request length in bytes. If the data wasn’t a cache hit, the request length is summed once more. Example: 1202 |
| dataTransferredOut | Sum of the bytes sent. If the data wasn’t a cache hit, the upstream bytes sent is summed. Example: 6460 |
| dataTransferredTotal | Value of Data Transferred In + Data Transferred Out in bytes. Example: 766 |
| offload | Percentage of client data delivered by Azion, saving data. Example: 9.71 |
edgeFunctionsMetrics (Edge Functions)
| Field | Description |
|---|---|
| computeTime | Total execution time, in milliseconds, for the function during its processing. This field is the result of a sum. Example: 120 |
| configurationId | Unique Azion configuration identifier set on virtual host configuration file. Example: 1595368520 |
| edgeFunctionId | Identification of your Edge Function. Example: 1321 |
| edgeFunctionInstanceId | Identification of your Edge Function Instance. Example: 10590 |
| edgeFunctionsInstanceIdList | List of edge functions instances that were invocated during the request. Example: 10728 |
| functionLanguage | Language used in the function. Example: javascript |
| initiatorType | Initiator used in the function. Can be 1 (Edge Application) or 2 (Edge Firewall). |
| invocations | Total amount of an invocation. This field is the result of a sum. Example: 8 |
| sourceLocPop | Location and PoP of the server that received the request. Example: lax-bso |
| ts | Timestamp of when the event was created. Example: 2022-10-20T10:10:10 |
Calculated fields
When a field is a result of any kind of calculation, such as a sum, they’re considered as calculated fields.
| Calculated field | Description |
|---|---|
| edgeApplicationInvocations | Total amount of invocations of a function from an edge application. Example: 50 |
| edgeFirewallInvocations | Total amount of invocations of a function from an edge firewall. Example: 30 |
imageProcessedMetrics (Image Processor)
| Field | Description |
|---|---|
| bytesSent | Number of bytes sent to a client. This field is the result of a sum. Example: 191 |
| configurationId | Unique Azion configuration identifier set on virtual host configuration file. Example: 1595368520 |
| host | Host information sent on the request line. Stores: host name from the request line, or host name from the “Host” request header field, or the server name matching a request. Example: hello.myhost.net |
| remoteAddressClass | Class of the IP address of the origin that generated the request. Example: 44.192.0.0/11 |
| requestMethod | HTTP request method. Example: GET or POST. |
| requestTime | Request processing time, in seconds, since the first bytes were read from the client. This field is the result of a sum. Example: 0.234 |
| requests | Total amount of requests in the aggregation being used. This field is the result of a sum. Example: 11 |
| scheme | Request scheme. Example: HTTP or HTTPS. |
| sourceLocPop | Location and PoP of the server that received the request. Example: lax-bso |
| status | HTTP status code of the request. Example: 200 |
| ts | Timestamp of when the event was created. Example: 2022-10-20T10:10:10 |
| upstreamCacheStatus | Status of the local edge cache. Can be: MISS, BYPASS, EXPIRED, STALE, UPDATING, REVALIDATED, HIT, or - |
| upstreamResponseTime | Time it takes for the edge to receive a default response from the origin, in seconds, including headers and body. This field is the result of a sum. Example: 0.876. In case of cache, the response is - |
| upstreamStatus | HTTP status code of the origin. If a server can’t be selected, the variable keeps the 502 (Bad Gateway) status code. Example: 200. In case of cache, the response is -. |
edgeDnsQueriesMetrics (Edge DNS)
| Field | Description |
|---|---|
| qtype | Definition of the type of record that’ll be used. Example: PTR, A, AAAA, HTTPS, NS, SRV |
| requests | Total amount of requests in the aggregation being used. This field is the result of a sum. Example: 11 |
| sourceLocPop | Location and PoP of the server that received the request. Example: lax-bso |
| ts | Timestamp of when the event was created. Example: 2022-10-20T10:10:10 |
| zoneId | Unique identifier of the Edge DNS zone. Example: 1340 |
dataStreamedMetrics (Data Stream)
| Field | Description |
|---|---|
| configurationId | Unique Azion configuration identifier set on virtual host configuration file. Example: 1595368520 |
| dataStreamed | Total amount of data streamed in bytes to the configured endpoint. This field is the result of a sum. Example: 1270 |
| endpointType | Type of endpoint used in the configured Data Stream. Example: S3 |
| requests | Total amount of requests in the aggregation being used. This field is the result of a sum. Example: 11 |
| sourceLocPop | Location and PoP of the server that received the request. Example: lax-bso |
| streamedLines | Total amount of lines streamed to the configured endpoint. Maximum value of 2000. This field is the result of a sum. Example: 837 |
| ts | Timestamp of when the event was created. Example: 2022-10-20T10:10:10 |
connectedUsersMetrics (Live Ingest)
| Field | Description |
|---|---|
| ts | A field in the result set representing the timestamp of the data point |
| host | A field in the result set representing the host from which the data was collected |
Calculated fields
When a field is a result of any kind of calculation, such as a sum, they’re considered as calculated fields.
| Calculated field | Description |
|---|---|
| uniqueSessions | A field in the result set representing the number of unique sessions recorded by the host |
| uniqueSessionsTotal | Total unique sessions calculated among all hosts |
botManagerMetrics
| Field | Description |
|---|---|
action | Action performed by Azion Bot Manager for accesses identified as bots. Example: deny. Possible values: allow, deny, redirect, custom_html, drop, random_delay, and hold_connection |
botCategory | Bot category identified in the request. Example: scraping, crawling, brute-force |
botMode | Bot protection mode used in the request. Example: Web |
challengeSolved | Flag that indicates if the bot either passed or failed the CAPTCHA challenge. This is a boolean, where 1 indicates Solved and 0 indicates Not Solved. |
classified | Traffic identification, being bad bot, good bot, legitimate, or under evaluation the possible values. |
geolocCountryName | Geographic origin of bot attacks by country. Example: Brazil |
geolocRegionName | Geographic origin of bot attacks by state or region. Example: Pernambuco |
host | Host information sent on the request line. Stores: host name from the request line, or host name from the Host request header field, or the server name matching a request. Example: hello.myhost.net |
requestMethod | HTTP method used in the request. Example: GET |
sourceLocPop | Location and PoP of the edge that received the request. Example: lax-bso |
ts | Timestamp of when the event was created. Example: 2022-10-20T10:10:10 |
About actions
Azion Bot Manager can execute 7 different actions, with the behavior being defined during configuration:
allow: allows the continuation of the request.deny: delivers a standard Status Code 403 response.drop: terminates the request without a response to the user.redirect: allows the request to be redirected to a new URL/location when the security threshold is reached.custom_html: allows customized HTML content to be delivered to the user in case of a threshold violation.random_delay: makes the function wait for a random period between 1 and 10 seconds before allowing the request to proceed.hold_connection: holds the request, keeping the connection open for 1 minute before dropping it.
Calculated fields
When a field results from any kind of calculation, such as a sum, they’re considered as calculated fields.
| Calculated field | Description |
|---|---|
requests | Total amount of requests analyzed by Azion Bot Manager. This field is the result of a sum. Example: 11 |
botManagerBreakdownMetrics
| Field | Description |
|---|---|
host | Host information sent on the request line. Stores: host name from the request line, or host name from the Host request header field, or the server name matching a request. Example: hello.myhost.net |
remoteAddr | IP address of the origin that generated the request. Example: 127.0.0.1 |
requestUrl | URL of the request made by the end user, with the host and path information and without arguments. Example: hello.myhost.net/v1 |
ts | Timestamp of when the event was created. Example: 2022-10-20T10:10:10 |
Calculated fields
When a field results from any kind of calculation, such as a sum, they’re considered as calculated fields.
| Calculated field | Description |
|---|---|
badBotRequests | Total amount of requests classified as bad bots. This field is the result of a sum. Example: 12 |
botRequests | Total amount of requests classified as bots. This field is the result of a sum. Example: 11 |
uniqRequestUrl | Number of unique URLs accessed by bots. This field represents the count of distinct URLs requested by bots. Example: 5 |
Deprecated datasets
The following datasets were discontinued. It’s recommended to use the new datasets which replaced them.
l2CacheMetrics (Tiered Cache)
| Field | Description |
|---|---|
| bytesSent | Number of bytes sent to a client. This field is the result of a sum. Example: 191 |
| configurationId | Unique Azion configuration identifier set on virtual host configuration file. Example: 1595368520 |
| host | Host information sent on the request line. Stores: host name from the request line, or host name from the “Host” request header field, or the server name matching a request. Example: hello.myhost.net |
| proxyStatus | HTTP error status code or origin when no response is obtained from the upstream. Example: 520. In case of cache, the response is -. |
| remoteAddressClass | Class of the IP address of the origin that generated the request. Example: 44.192.0.0/11 |
| requestLength | Request length in bytes, including request line, headers, and body. This field is the result of a sum. Example: 167 |
| requestMethod | HTTP request method. Example: GET or POST. |
| requestTime | Request processing time, in seconds, since the first bytes were read from the client. This field is the result of a sum. Example: 0.234 |
| requests | Total amount of requests in the aggregation being used. This field is the result of a sum. Example: 11 |
| scheme | Request scheme. Example: HTTP or HTTPS. |
| sourceLocPop | Location and PoP of the server that received the request. Example: lax-bso |
| status | HTTP status code of the request. Example: 200 |
| ts | Timestamp the event was created. Example: 2022-10-20T10:10:10 |
| upstreamBytesReceived | Number of bytes received by the origin’s edge if the content isn’t cached. This field is the result of a sum. Example: 8304 |
| upstreamCacheStatus | Status of the local edge cache. Can be: MISS, BYPASS, EXPIRED, STALE, UPDATING, REVALIDATED, HIT, or - |
| upstreamResponseTime | Time it takes for the edge to receive a default response from the origin, in seconds, including headers and body. This field is the result of a sum. Example: 0.876. In case of cache, the response is - |
| upstreamStatus | HTTP status code of the origin. If a server can’t be selected, the variable keeps the 502 (Bad Gateway) status code. Example: 200. In case of cache, the response is -. |
Calculated fields
When a field is a result of any kind of calculation, such as a sum, they’re considered as calculated fields.
| Calculated field | Description |
|---|---|
| dataTransferredIn | Sum of the request length in bytes. If the data wasn’t a cache hit, the request length is summed once more. Example: 1202 |
| dataTransferredOut | Sum of the bytes sent. If the data wasn’t a cache hit, the upstream bytes sent is summed. Example: 6460 |
| dataTransferredTotal | Value of Data Transferred In + Data Transferred Out in bytes. Example: 766 |
| offload | Percentage of client data delivered by Azion, saving data. Example: 9.71 |
idnsQueriesMetrics (Edge DNS)
| Field | Description |
|---|---|
| qtype | Definition of the type of record that’ll be used. Example: PTR, A, AAAA, HTTPS, NS, SRV |
| requests | Total amount of requests in the aggregation being used. This field is the result of a sum. Example: 11 |
| sourceLocPop | Location and PoP of the server that received the request. Example: lax-bso |
| ts | Timestamp of when the event was created. Example: 2022-10-20T10:10:10 |
| zoneID | Unique identifier of the Edge DNS zone. Example: 1340 |
Contributors
