How to query data from the httpBreakdownMetrics dataset

The httpBreakdownMetrics dataset provides real-time, detailed, aggregated data on HTTP request events blocked. This dataset is part of the Real-Time Metrics GraphQL.

This data is retained and available for up to 90 days.

This guide will explain how to query data from the httpBreakdownMetrics dataset using the GraphiQL playground.

Querying data

This example queries the top 20 blocked remoteAddress entries. To know more about the available fields, check the Real-Time Metrics GraphQL API Fields documentation.

Access the GraphiQL playground in this link: https://api.azion.com/v4/metrics/graphql.
- You must be logged in to your Azion account. Otherwise, you’ll receive an error message.
Send a query following this format:

query {
  httpBreakdownMetrics(
    aggregate: { sum: blockedRequests }
    groupBy: [remoteAddress]
    orderBy: [sum_DESC],
    limit: 20,
    filter: {
      tsGte: "2024-10-21T11:00:00"
      tsLt: "2024-10-21T12:00:00"
    }
  ) {
    remoteAddress
    totalBlocked: sum
  }
}

Where:

Field	Description
`sum: blockedRequests`	Returns the total number of requests blocked within the specified time range, after applying any filters
`groupBy`	Specifies the fields by which the query results should be grouped. Example: `[remoteAddress]`
`orderBy`	Specifies the order in which the results should be returned. Examples: `[sum_DESC]`, for descending order, and `[sum_ASC]`, for ascending order
`limit`	Specifies the maximum number of results to return. Example: `20` for retrieving the top 20. System maximum: `10,000`
`filter`	Defines the criteria used to filter the data returned by the query
`tsGte`	A subfield of `filter`. Specifies the start time (greater than or equal to) for the data query, ensuring results include records from this timestamp onward. Format: “YYYY-MM-DDTHH:mm ”; example: `"2024-10-21T11:00:00"`
`tsLt`	A subfield of `filter`. Specifies the end time (less than) for the data query, filtering out any records with timestamps equal to or after this timestamp. Format: “YYYY-MM-DDTHH:mm ”; example: `"2024-10-21T12:00:00"`

You’ll receive a response similar to this:

{
  "data": {
    "httpBreakdownMetrics": [
      {
        "remoteAddress": "192.168.0.1",
        "totalBlocked": 6732
      },
      {
        "remoteAddress": "10.0.0.2",
        "totalBlocked": 5872
      },
      {
        "remoteAddress": "172.16.0.3",
        "totalBlocked": 3958
      },
      {
        "remoteAddress": "192.168.1.4",
        "totalBlocked": 3952
      },
      {
        "remoteAddress": "10.0.1.5",
        "totalBlocked": 3806
      },
      {
        "remoteAddress": "172.16.1.6",
        "totalBlocked": 3730
      },
      {
        "remoteAddress": "192.168.2.7",
        "totalBlocked": 3378
      },
      {
        "remoteAddress": "10.0.2.8",
        "totalBlocked": 3318
      },
      {
        "remoteAddress": "172.16.2.9",
        "totalBlocked": 3284
      },
      {
        "remoteAddress": "192.168.3.10",
        "totalBlocked": 3282
      },
      {
        "remoteAddress": "10.0.3.11",
        "totalBlocked": 2958
      },
      {
        "remoteAddress": "172.16.3.12",
        "totalBlocked": 2884
      },
      {
        "remoteAddress": "192.168.4.13",
        "totalBlocked": 2530
      },
      {
        "remoteAddress": "10.0.4.14",
        "totalBlocked": 2348
      },
      {
        "remoteAddress": "172.16.4.15",
        "totalBlocked": 2004
      },
      {
        "remoteAddress": "192.168.5.16",
        "totalBlocked": 1902
      },
      {
        "remoteAddress": "10.0.5.17",
        "totalBlocked": 1538
      },
      {
        "remoteAddress": "172.16.5.18",
        "totalBlocked": 1440
      },
      {
        "remoteAddress": "192.168.6.19",
        "totalBlocked": 1390
      },
      {
        "remoteAddress": "10.0.6.20",
        "totalBlocked": 1314
      }
    ]
  }
}

Where:

Field	Description
`remoteAddress`	Specifies the IP address of the source making the request. Example: `10.0.6.20`
`totalBlocked`	Refers to the total number of times requests from this IP address have been blocked. This field is the result of a sum. Example: `1314`