Real-Time Events GraphQL API Fields

Each GraphQL API dataset has specific fields that can be used when querying for data from that dataset.

See each available field and their descriptions below.


activityHistoryEvents (Activity History)

FieldDescription
accountIdAccount’s identifier on Azion. Example: 8437
authorEmailEmail address of the Azion Console user who performed the action. Example: myemail@gmail.com
authorNameName of the Azion Console user who performed the action. Example: Hannah
commentEditable space available for users to add comments when performing changes. Example: Action performed during investigation
refererHeaderHeader Referer from the page from which the API was called. Returns when the API call is made from an UI. Example: Test 123
remotePortPort of the origin that generated the request. Example: 80
resourceIdUnique identifier of the resource that was created or modified. Example: 8190
resourceTypeIdentifier of the resource that was created or modified. Example: edge_application
requestDataData received on the payload of the request generated by the user. Example: {"test": 123}
titleTitle of the activity, composed of: model name, name, and type of activity. Example: Pathorigin Default Origin was changed
tsTimestamp of when the event was created. Example: 2022-10-20T10:10:10
typeType of performed action on Azion Console: CREATED, CHANGED, DELETED, or SIGNED UP
userAgentHeader User-Agent sent in the request. Example: curl 1.2.6
userIdUnique identifier of the user that executed the action. Example: 999
userIpIP address of the user/origin that generated the request. Example: 127.0.0.1
uuidUnique request identifier. Example: c09k4385-o8f4-9fb9-8088-238555dd

cellsConsoleEvents (Azion Runtime)

FieldDescription
configurationIdUnique Azion configuration identifier set on virtual host configuration file. Example: 1595368520
functionIdUnique Azion function identifier number. Can be found on Azion Console’s function URL path or via API request. Example: 1111
idRequest identifier. Aggregates multiple messages from a single request. Example: 240g95f04832f2872dd6e8ae308e8a73
levelMessage with the level type for the function. Can be MDN, DEBUG, INFO, ERROR, LOG, or WARN
lineLog message generated by the Cells platform. Example: at async mainFetch (ext:deno_fetch/26_fetch.js:266:12)
lineSourceLog message category. Example: CONSOLE, RUNTIME
solutionIdUnique Azion ID set on virtual host configuration file for the solution. Example: 1441740010
tsTimestamp of when the event was created. Example: 2022-10-20T10:10:10

dataStreamedEvents (Data Stream)

FieldDescription
configurationIdUnique Azion configuration identifier set on virtual host configuration file. Example: 1595368520
dataStreamedTotal amount of data streamed, in bytes, to the configured endpoint. This field is the result of a sum. Example: 1270
endpointTypeType of endpoint used in the configured Data Stream. Can be: HTTP_POST, S3, ELASTICSEARCH, QRADAR, AWS_KINESIS_FIREHOSE, KAFKA, DATADOG, BIG_QUERY, SPLUNK, AZURE_MONITOR, AZURE_BLOB_STORAGE
jobNameUnique Azion identifier for the type of stream created. Example: Data Stream HTTP, Data Stream WAF
statusCodeHTTP status code of the request. Example: 200
streamedLinesTotal amount of lines streamed to the configured endpoint. Maximum value of 2000. This field is the result of a sum. Example: 837
tsTimestamp of when the event was created. Example: 2022-10-20T10:10:10
urlThe URL to which the client data was sent/sink. Example for a HTTP POST endpoint: https://log-receiver.com:3000

edgeFunctionsEvents (Edge Functions)

FieldDescription
configurationIdUnique Azion configuration identifier set on virtual host configuration file. Example: 1595368520
edgeFunctionsInstanceIdListList of edge functions instances that were invoked during the request. Example: 10728
edgeFunctionsInitiatorTypeListList of initiators used in the function separated by ;. Can be 1 (Edge Application) or 2 (Edge Firewall).
edgeFunctionsListList of edge functions that were invocated during the request, in order. The order begins from left to right, meaning functions on the left were invocated first. Example: 3324;43
edgeFunctionsSolutionIdIdentifier of your edge function. Example: 1321
edgeFunctionsTimeTotal execution time, in seconds, for the function during its processing. This field is the result of a sum. Example: 0.021
functionLanguageLanguage used in the function. Example: javascript
tsTimestamp of when the event was created. Example: 2022-10-20T10:10:10
virtualHostIdUnique ID available on Azion Console. Set on virtual host configuration file. Example: 2410001a

httpEvents (Edge Applications, WAF)

FieldDescription
bytesSentNumber of bytes sent to a client. This field is the result of a sum. Example: 191
configurationIdUnique Azion configuration identifier. Set on virtual host configuration file. Example: 1595368520
debugLogValue of any variable from the request set through a new Rules Engine behavior. Example: {\\\"idHash\\\":\\\"pQ04xXYD4JSYyOERu3mcwA==\\\",\\\"type\\\":\\\"product_screen_element_element_action\\\",\\\"message\\\":{\\\"event\\\":\\\"product_screen_element_element_action\\\",\\\"action\\\":\\\"value\\\",\\\"product\\\":\\\"value\\\",\\\"screen\\\":\\\"value\\\",\\\"element\\\":\\\"value\\\"},\\\"date\\\":\\\"2023-10-27T19:44:57.251Z\\\"}"
geolocAsnAutonomous System Number (ASN) Allocation queried from the MaxMind table. Example: AS52580 Azion Technologies Ltda.
geolocCountryNameRemote client’s country detected via IP address geolocation. Example: United States, Russian Federation
geolocRegionNameRemote client’s region detected via IP address geolocation. Example: California, Rio Grande do Sul
hostHost information sent on the request line. Stores: host name from the request line, or host name from the Host request header field, or the server name matching a request. Example: hello.myhost.net
httpRefererAddress of the page the user made the request from. Example: https://example.com
httpUserAgentEnd user’s application, operating system, vendor, and/or version. Value of the User-Agent header. Example: Mozilla/5.0 (Windows NT 10.0; Win64; x64)
proxyStatusHTTP error status code or origin when no response is obtained from the upstream. Example: 520. In case of cache, the response is -.
requestIdUnique request identifier. Example: 5f222ae5938482c32a822dbf15e19f0f
requestLengthRequest length in bytes, including request line, headers, and body. This field is the result of a sum. Example: 167
requestMethodHTTP request method. Example: GET or POST
requestTimeRequest processing time, in seconds, since the first bytes were read from the client. This field is the result of a sum. Example: 0.234
requestUriURI of the request made by the end user, without the host and protocol information and with arguments. Example: /v1?v=bo%20dim
remoteAddressIP address of the origin that generated the request. Example: 127.0.0.1
remotePortPort of the origin that generated the request. Example: 8080
schemeRequest scheme. Example: HTTP or HTTPS
serverProtocolVersion of the request protocol. Example: HTTP/1.1, HTTP/2.0, HTTP/3.0
sentHttpContentTypeContent-Type header sent in the origin’s response. Example: text/html; charset=UTF-8
sentHttpXOriginalImageSizeX-Original-Image-Size header sent in the origin’s response. Used by IMS to inform original image size in bytes. Example: 987390
sessionIdID of the session set through virtual host configuration file based on location directive. Example: f41eabd4-c172-43e4-ac21-d9f5fc427128
serverAddrIP address of the server that received the request. Example: 192.158.1.38
serverPortRemote port of the server that received the request. Example: 443
solutionIdUnique Azion ID set on virtual host configuration file for the solution. Example: 1441740010
sslCipherCipher string used to establish TLS connection. Example: TLS_AES_256_GCM_SHA384
sslProtocolProtocol for an established TLS connection. Example: TLS v1.2
sslServerNameReturns the session identifier of an established SSL connection. Example: mywebsite.com
sslSessionReusedReturns r if an SSL session was reused or . if it wasn’t.
stacktraceProvides the names of the Rules Engine from your edge application or your edge firewall that are run by the request. Example: {\\\"edge_firewall\\\":[\\\"Global - Set WAF\\\"]}
statusHTTP status code of the request. Example: 200
streamNameID set through virtual host configuration based on location directive. Set on virtual host configuration file. Example: company_sector.sdp
tcpinfoRttRound-Trip Time (RTT) in microseconds measured by the edge for the user. Available on systems that support the TCP_INFO socket option. Example: 72052
tsTimestamp of when the event was created. Example: 2022-10-20T10:10:10
upstreamAddrClient’s IP address and port. Can also store multiple servers or server groups. Example: 192.168.1.1:80. When the response is 127.0.0.1:1666, the upstream is Azion Cells Runtime.
upstreamAddrStrList with all upstreamAddr responses.
upstreamBytesReceivedNumber of bytes received by the origin’s edge if the content isn’t cached. Example: 8304
upstreamBytesReceivedStrList with all upstreamBytesReceived responses.
upstreamBytesSentNumber of bytes sent to the origin. Example: 2733
upstreamBytesSentStrList with all upstreamBytesSent responses.
upstreamCacheStatusStatus of the local edge cache. Can be: MISS, BYPASS, EXPIRED, STALE, UPDATING, REVALIDATED, HIT, or -
upstreamConnectTimeTime it takes for the edge to establish a connection with the origin, in seconds. In the case of TLS, it includes time spent on handshake. Example: 0.123. Returns 0 for KeepAlive and - for cache
upstreamConnectTimeStrList with all upstreamConnectTime responses.
upstreamHeaderTimeTime it takes for the edge to receive the response header from the origin, in seconds. Example: 0.345. In case of cache, the response is -
upstreamHeaderTimeStrList with all upstreamHeaderTime responses.
upstreamResponseTimeTime it takes for the edge to receive a default response from the origin, in seconds, including headers and body. Example: 0.876. In case of cache, the response is -
upstreamResponseTimeStrList with all upstreamResponseTime responses.
upstreamStatusHTTP status code of the origin. If a server can’t be selected, the variable keeps the 502 (Bad Gateway) status code. Example: 200. In case of cache, the response is -.
upstreamStatusStrList with all upstreamStatus responses.
virtualhostIdUnique ID available on Azion Console set on virtual host configuration file. Example: 2410001a
wafBlockInforms whether WAF blocked the action or not. 0 when action wasn’t blocked; 1 when action was blocked. When in Learning Mode, it won’t be blocked regardless of the return.
wafEvheadersWhen the request headers sent by the user are analyzed by the WAF module and tagged as blocked with $waf_block = 1, it contains a base64 encoded string. Otherwise, it contains a dash character -. It applies to both WAF Learning or Blocking modes.
wafLearningInforms if WAF is in Learning mode. Returns 0 if it isn’t and 1 if it’s.
wafMatchList of infractions found in the end user’s request. It’s formed by key-value elements: the key refers to the type of violation detected; the value shows the string that generated the infraction. Example: 0:1402:HEADERS:cookie
wafScoreReports the score that will be increased in case of a match with the rules set for the WAF. Can be SQL, XSS, TRAVERSAL, RFI, or -
wafTotalBlockedTotal number of blocked requests. Example: 2
wafTotalProcessedTotal number of processed requests. Example: 5

edgeDnsQueriesEvents (Edge DNS)

FieldDescription
levelLevel of the log generator: ERROR, WARN, INFO, DEBUG, or TRACE
qtypeDefinition of the type of record that’ll be used. Example: PTR, A, AAAA, HTTPS, NS, SRV
resolutionTypeMethod types used to resolve hosts. Example: standard
statusCodeHTTP status code of the request. Example: 200
solutionIdIdentifier of your Edge DNS instance. Example: 1321
tsTimestamp of when the event was created. Example: 2022-10-20T10:10:10
uuidUnique request identifier. Example: b204b8c3-e463-4c3d-af3d-025703a4
zoneIDUnique identifier of the Edge DNS zone. Example: 1340

imageProcessedEvents (Image Processor)

FieldDescription
bytesSentNumber of bytes sent to a client. This field is the result of a sum. Example: 191
configurationIdUnique Azion configuration identifier set on virtual host configuration file. Example: 1595368520
hostHost information sent on the request line. Stores: host name from the request line, or host name from the Host request header field, or the server name matching a request. Example: hello.myhost.net
httpRefererAddress of the page the user made the request from. Example: https://example.com
httpUserAgentEnd user’s application, operating system, vendor, and/or version. Value of the User-Agent header. Example: Mozilla/5.0 (Windows NT 10.0; Win64; x64)
referenceErrorReference ID of the request. Generated when the status code is bigger than 400. Example: #AECFE66100000000C947B9B3B3BFBE46FFFFFFFF9401. Can also be -
remoteAddrIP address of the origin that generated the request. Example: 127.0.0.1
remotePortPort of the origin that generated the request. Example: 8080
requestMethodHTTP request method. Example: GET or POST
requestTimeRequest processing time, in seconds, since the first bytes were read from the client. This field is the result of a sum. Example: 0.234
requestUriURI of the request made by the end user, without the host and protocol information and with arguments. Example: /v1?v=bo%20dim
schemeRequest scheme. Example: HTTP or HTTPS
sentHttpContentTypeContent-Type header sent in the origin’s response. Example: text/html; charset=UTF-8
serverProtocolVersion of the request protocol. Example: HTTP/1.1, HTTP/2.0, HTTP/3.0
solutionIdentifier of your edge application. Example: 1321
sslCipherCipher string used to establish TLS connection. Example: TLS_AES_256_GCM_SHA384
sslProtocolProtocol for an established TLS connection. Example: TLS v1.2
sslSessionReusedReturns r if an SSL session was reused or . if it wasn’t.
statusHTTP status code of the request. Example: 200
tcpInfoRttRound-Trip Time (RTT) in microseconds measured by the edge for the user. Available on systems that support the TCP_INFO socket option. Example: 72052
tsTimestamp of when the event was created. Example: 2022-10-20T10:10:10
upstreamCacheStatusStatus of the local edge cache. Can be: MISS, BYPASS, EXPIRED, STALE, UPDATING, REVALIDATED, HIT, or -
upstreamResponseTimeTime it takes for the edge to receive a default response from the origin, in seconds, including headers and body. This field is the result of a sum. Example: 0.876. In case of cache, the response is -
upstreamResponseTimeStrList with all upstreamResponseTime responses.
upstreamStatusHTTP status code of the origin. If a server can’t be selected, the variable keeps the 502 (Bad Gateway) status code. Example: 200. In case of cache, the response is -.
upstreamStatusStrList with all upstreamStatus responses.

tieredCacheEvents (Tiered Cache)

FieldDescription
bytesSentNumber of bytes sent to a client. This field is the result of a sum. Example: 191
cacheKeyThe stored object cache identification key for the content requested by a client. Example: /index.html
cacheTtlTime, in seconds, the cached object is considered valid (not expired). After the time expiration, when a new request occurs, Tiered Cache queries the data on the origin (upstream). Example: 31536000
configurationIdUnique Azion configuration identifier set on virtual host configuration file. Example: 1595368520
hostHost information sent on the request line. Stores: host name from the request line, or host name from the Host request header field, or the server name matching a request. Example: hello.myhost.net
proxyHostHostname being proxied. Example: storage.googleapis.com:443
proxyStatusHTTP error status code or origin when no response is obtained from the upstream. Example: 520. In case of cache, the response is -.
proxyUpstreamOrigin (upstream) address. In some cases, the second origin can be Image Processor (IMS) to process the image and then cache it. Example: ims_http
referenceErrorReference ID of the request. Generated when the status code is 4xx or 5xx. Example: #AECFE66100000000C947B9B3B3BFBE46FFFFFFFF9401. Can also be -
remoteAddrIP address of the origin that generated the request. Example: 127.0.0.1
remotePortPort of the origin that generated the request. Example: 8080
requestLengthRequest length, including request line, headers, and body. This field is the result of a sum. Example: 167
requestMethodHTTP request method. Example: GET or POST
requestTimeRequest processing time, in seconds, since the first bytes were read from the client. This field is the result of a sum. Example: 0.234
requestUriURI of the request made by the end user, without the host and protocol information and with arguments. Example: /v1?v=bo%20dim
schemeRequest scheme. Example: HTTP or HTTPS
sentHttpContentTypeContent-Type header sent in the origin’s response. Example: text/html; charset=UTF-8
serverProtocolVersion of the request protocol. Example: HTTP/1.1, HTTP/2.0, HTTP/3.0
solutionIdentifier of your edge application. Example: 1321
statusHTTP status code of the request. Example: 200
tcpinfoRttRound-Trip Time (RTT) in microseconds measured by the edge for the user. Available on systems that support the TCP_INFO socket option. Example: 72052
tsTimestamp of when the event was created. Example: 2022-10-20T10:10:10
upstreamBytesReceivedNumber of bytes received by the origin’s edge if the content isn’t cached. Example: 8304
upstreamBytesReceivedStrList with all upstreamBytesReceived responses.
upstreamCacheStatusStatus of the local edge cache. Can be: MISS, BYPASS, EXPIRED, STALE, UPDATING, REVALIDATED, HIT, or -
upstreamConnectTimeTime it takes for the edge to establish a connection with the origin, in seconds. In the case of TLS, it includes time spent on handshake. Example: 0.123. Returns 0 for KeepAlive and - for cache
upstreamHeaderTimeTime it takes for the edge to receive the response header from the origin, in seconds. Example: 0.345. In case of cache, the response is -
upstreamResponseTimeTime it takes for the edge to receive a default response from the origin, in seconds, including headers and body. Example: 0.876. In case of cache, the response is -
upstreamStatusHTTP status code of the origin. If a server can’t be selected, the variable keeps the 502 (Bad Gateway) status code. Example: 200. In case of cache, the response is -.

telemetryDeviceInfoEvents (Azion Mobile SDK)

FieldDescription
agentIdentifier of the Azion SDK version. Example: AzionSDK-Android-v0.0.1
azionFingerprintFingerprint generated by the SDK. Example: 1cc48e375c84610c1d90d93f80c03
boardName of the development board. Example: goldfish_arm64
bootloaderThe version of the system’s bootloader. Example: unknown
clientIdUnique Azion client identifier. Example: 8437r
deviceName of the device, such as the codename or model name. Example: emu64a
deviceIdDevice ID to identify an Android device. Example: c2e38e0eb35a62f1
displayResolutionFor iOS devices, returns the screen size in [H]x[W] format. Example: 1179.0x2556.0
fingerprintUnique identifier of the build, usually including information about the device and system version. Example: google/sdk_gphone64_arm64/emu64a:14/UE1A.230829.030/10921827:userdebug/dev-keys"
hardwareInformation about the device’s hardware. Example: ranch
kernelVersionKernel version. Example: 6.1.23-android14-4-00257-g7e35917775b8-ab9964412
manufacturerName of the device manufacturer. Example: Google
modelDevice model name. Example: sdk_gphone64_arm64
osReleaseOperating system release version. Example: 15
osTypeOperating system type. Example: 16
osVersionOperating system version. Example: 18
sdkVersionAndroid SDK version number used to compile the application. Example: 34
tagsTags associated with the Android system build. Example: dev-keys
tsDate and time of the request. Example: 2022-10-20T10:10:10
userUser name performing the build. Example: android-build
versionVersion of the Azion Cells log used. Example: v2

telemetrySensorsEvents (Azion Mobile SDK)

FieldDescription
accelTsList of timestamps at the moment of accelerometer sensor data collection. Example: 2023-12-14-T00:00:00
accelXList of values for the X-axis reading of the accelerometer. Example: 0.1
accelYList of values for the Y-axis reading of the accelerometer. Example: 0.343
accelZList of values for the Z-axis reading of the accelerometer. Example: 0.243
azionFingerprintFingerprint generated by the SDK. Example: 1cc48e375c84610c1d90d93f80c03
clientIdUnique Azion client identifier. Example: 8437r
gyroTsList of timestamps at the moment of gyroscope sensor data collection. Example: 2023-12-14-T00:00:00
gyroXList of values for the X-axis reading of the gyroscope. Example: 0.1
gyroYList of values for the Y-axis reading of the gyroscope. Example: 0.343
gyroZList of values for the Z-axis reading of the gyroscope. Example: 0.243
touchTsList of timestamps at the moment of touch screen events collection. Example: 2023-12-14-T00:00:00
touchXList of values for the X-axis reading of the touch screen. Example: 0.343
touchYList of values for the Y-axis reading of the touch screen. Example: 0.243
tsDate and time of the request. Example: 2022-10-20T10:10:10
versionVersion of the Azion Cells log used. Example: v2

Deprecated datasets

The following datasets were discontinued. It’s recommended to use the new datasets which replaced them.

l2CacheEvents (Tiered Cache)

FieldDescription
bytesSentNumber of bytes sent to a client. This field is the result of a sum. Example: 191
cacheKeyThe stored object cache identification key for the content requested by a client. Example: /index.html
cacheTtlTime, in seconds, the cached object is considered valid (not expired). After the time expiration, when a new request occurs, L2 Caching queries the data on the origin (upstream). Example: 31536000
configurationIdUnique Azion configuration identifier set on virtual host configuration file. Example: 1595368520
hostHost information sent on the request line. Stores: host name from the request line, or host name from the Host request header field, or the server name matching a request. Example: hello.myhost.net
proxyHostHostname being proxied. Example: storage.googleapis.com:443
proxyStatusHTTP error status code or origin when no response is obtained from the upstream. Example: 520. In case of cache, the response is -.
proxyUpstreamOrigin (upstream) address. In some cases, the L2 origin can be Image Processor (IMS) to process the image and then cache it. Example: ims_http
referenceErrorReference ID of the request. Generated when the status code is 4xx or 5xx. Example: #AECFE66100000000C947B9B3B3BFBE46FFFFFFFF9401. Can also be -
remoteAddrIP address of the origin that generated the request. Example: 127.0.0.1
remotePortPort of the origin that generated the request. Example: 8080
requestLengthRequest length, including request line, headers, and body. This field is the result of a sum. Example: 167
requestMethodHTTP request method. Example: GET or POST
requestTimeRequest processing time, in seconds, since the first bytes were read from the client. This field is the result of a sum. Example: 0.234
requestUriURI of the request made by the end user, without the host and protocol information and with arguments. Example: /v1?v=bo%20dim
schemeRequest scheme. Example: HTTP or HTTPS
sentHttpContentTypeContent-Type header sent in the origin’s response. Example: text/html; charset=UTF-8
serverProtocolRequest protocol. Example: HTTP/1.1, HTTP/2.0, HTTP/3.0
solutionIdentifier of your edge application. Example: 1321
statusHTTP status code of the request. Example: 200
tcpinfoRttRound-Trip Time (RTT) measured by the edge for the user. Available on systems that support the TCP_INFO socket option. Example: 72052
tsTimestamp of when the event was created. Example: 2022-10-20T10:10:10
upstreamBytesReceivedNumber of bytes received by the origin’s edge if the content isn’t cached. Example: 8304
upstreamBytesReceivedStrList with all upstreamBytesReceived responses.
upstreamCacheStatusStatus of the local edge cache. Can be: MISS, BYPASS, EXPIRED, STALE, UPDATING, REVALIDATED, HIT, or -
upstreamConnectTimeTime it takes for the edge to establish a connection with the origin, in seconds. In the case of TLS, it includes time spent on handshake. Example: 0.123. Returns 0 for KeepAlive and - for cache
upstreamHeaderTimeTime it takes for the edge to receive the response header from the origin, in seconds. Example: 0.345. In case of cache, the response is -
upstreamResponseTimeTime it takes for the edge to receive a default response from the origin, in seconds, including headers and body. Example: 0.876. In case of cache, the response is -
upstreamStatusHTTP status code of the origin. If a server can’t be selected, the variable keeps the 502 (Bad Gateway) status code. Example: 200. In case of cache, the response is -.

idnsQueriesEvents (Edge DNS)

FieldDescription
levelLevel of the log generator: ERROR, WARN, INFO, DEBUG, or TRACE
qtypeDefinition of the type of record that’ll be used. Example: PTR, A, AAAA, HTTPS, NS, SRV
resolutionTypeMethod types used to resolve hosts. Example: standard
statusCodeHTTP status code of the request. Example: 200
solutionIdIdentifier of your Edge DNS instance. Example: 1321
tsTimestamp of when the event was created. Example: 2022-10-20T10:10:10
uuidUnique request identifier. Example: b204b8c3-e463-4c3d-af3d-025703a4
zoneIDUnique identifier of the Edge DNS zone. Example: 1340

Contributors