# Filters and time range [Real-Time Metrics](/en/documentation/platform/real-time-metrics/) shows each dashboard in Azion Console under one set of controls: a category dropdown, product tabs, a filter row, and a dashboard selector. The time range and the filters you set in the filter row apply to every chart of the dashboard you are viewing. --- ## Screen layout The Real-Time Metrics screen groups its dashboards by category and product. Under **Build**, the product tabs are [Applications](/en/documentation/platform/applications/), [Tiered Cache](/en/documentation/platform/applications/cache/tiered-cache/), [Functions](/en/documentation/platform/functions/), and [Image Processor](/en/documentation/platform/applications/#image-processor). Under **Secure**, they are [WAF](/en/documentation/platform/firewall/#waf), [Edge DNS](/en/documentation/platform/edge-dns/), [Bot Manager](/en/documentation/platform/firewall/#bot-manager), and **Threats Breakdown**. Under **Observe**, the one tab is [Data Stream](/en/documentation/platform/data-stream/). The controls sit in this order, from the top of the screen: | Control | Form | Behavior | | ------------------ | ---------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------- | | Category | A dropdown with **Build**, **Secure**, and **Observe** | Changing the category opens its first product and that product's first dashboard. | | Product tabs | One tab per product of the category | Each tab opens the dashboards of one product. | | Filter row | The filter button, the query input, the time-range picker, and the **Refresh** button, inside a card | Sets the data that every chart of the dashboard fetches. | | Applied filters | One chip per filter, under the filter row | Each chip shows one filter and opens it for editing. | | Dashboard selector | A segmented button, such as **Data Transferred** and **Requests** | Shows only when the product has more than one dashboard: **Applications** and **Bot Manager**. | | Charts | Big-number cards in the first row, then the other charts in a 12-column grid | Charts that do not fit the screen continue down the page. | With no product or dashboard in the URL, the screen opens on **Build** › **Applications** › **Data Transferred**. While the charts load, four placeholder cards hold their place. Each dashboard and its charts are described in [Build dashboards](/en/documentation/platform/real-time-metrics/build-dashboards/), [Secure dashboards](/en/documentation/platform/real-time-metrics/secure-dashboards/), and [Observe dashboards](/en/documentation/platform/real-time-metrics/observe-dashboards/). --- ## Time range The time range sets the period that every chart of the dashboard fetches. It is one date-range picker in the filter row, and the screen opens on **Last 5 minutes**. The picker has four tabs: | Tab | What it sets | | -------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | **Quick** | A direction, **Last** or **Next**; a number, minimum 1, default 15; and a unit, default **Minutes**; then **Apply**. The **Commonly used** presets follow the row. | | **Absolute**, **Relative** | One shared form: **Start date** and **End date** fields, a calendar in `dd/mm/yy` format, time slots every 30 minutes from `00:00` to `23:30`, an option labeled **From now**, and **Apply**. | | **Now** | The **Set Now** button. The tab states: `Selecting 'Set Now' sets the time dynamically to the exact moment of each refresh.` | The unit dropdown of the **Quick** tab offers **Minutes**, **Hours**, **Days**, **Weeks**, **Months**, and **Years**. ### Commonly used presets The **Quick** tab lists 12 presets in two columns, in this order: | Preset | Period covered | | ------------------- | -------------------------------------------------------- | | **Today** | The current day, from 00:00 to 23:59:59 | | **This week** | The current week, from Sunday 00:00 to Saturday 23:59:59 | | **Last 1 minute** | 1 minute | | **Last 5 minutes** | 5 minutes | | **Last 15 minutes** | 15 minutes | | **Last 30 minutes** | 30 minutes | | **Last 1 hour** | 1 hour | | **Last 24 hours** | 24 hours | | **Last 7 days** | 7 days | | **Last 30 days** | 30 days | | **Last 90 days** | 90 days | | **Last 1 year** | 365 days | ### Range bounds and display The calendar accepts dates from 730 days back up to the current moment, and a date outside that window is clamped to its nearest bound. A chosen boundary displays in the form `Mon D, YYYY @ HH:MM:SS`. After you change the range, the **Refresh** button reads **Update**. Select **Update** to load every chart for the new range. The length of the range also sets the resolution of the time charts: one point per minute, per hour, or per day. For the thresholds, refer to [How Real-Time Metrics works](/en/documentation/platform/real-time-metrics/how-it-works/). For how far back data goes, refer to [Real-Time Metrics limits](/en/documentation/platform/real-time-metrics/limits/). --- ## Auto-refresh Real-Time Metrics reloads the charts on a timer only when you turn auto-refresh on. The control sits in the **Quick** tab of the time-range picker: | Control | Values | Default | | ------------------------ | --------------------------------------------------------- | ----------- | | **Refresh Every** switch | On or off | Off | | Interval | A number, minimum 1, editable only while the switch is on | 10 | | Unit | **Seconds**, **Minutes**, or **Hours** | **Seconds** | Auto-refresh works with any range, and no preset turns it on by itself. To keep the end of the range at the moment of each refresh, use **Set Now** in the **Now** tab. Beside the picker, the **Refresh** button reloads every chart on demand. After you change the range or edit the query input without applying it, the button reads **Update** and applies the change. **Refresh** and **Update** are both disabled while the query input shows a validation error or the start of the range is after its end. --- ## Timezone Real-Time Metrics reads and plots data in the timezone of your account. The charts convert the range with the account's UTC offset and shift each point on the x-axis by the same offset. The footer of the time-range picker shows `UTC:` followed by the account timezone, and a **UTC Offset:** selector. The selector's first option, such as `Account (UTC-03:00)`, is the account offset and the default. The other options read `(UTC +hh:mm)` followed by a timezone name, sorted by offset, and the **Search timezone** box narrows the list. On a time chart, x-axis ticks use the format `%b-%d %H:%M`, such as `Oct-02 11:15`. Tooltip titles use the `en-US` date and time format. --- ## Filters With no filter, the charts of a dashboard show data for the whole account. A filter keeps only the data whose field matches a value, on every chart of the dashboard. To add, edit, or remove a filter step by step, refer to [Filter a Real-Time Metrics dashboard](/en/documentation/guides/platform/observability/add-filters-metrics/). ### Filter popover The filter button is an icon with the tooltip **Add filter**. It opens the **Filter** popover, or a bottom sheet on a screen 768 px wide or narrower. The popover states: `Each combination of operator can only be used once.` | Control | Caption | Behavior | | -------- | ------------------------------------------------ | -------------------------------------------------------------------------------------------------------------- | | Field | **Filter**, placeholder **Select a field** | A searchable list of the dashboard's fields, the most relevant first. | | Operator | **Operator**, placeholder **Select an operator** | Hidden until you choose a field. When the field has one operator, it is selected and locked. | | Value | Depends on the field type | Described in Value types. A field's description from the GraphQL schema can show as a note on the value input. | | Buttons | **Cancel** and **Apply** | **Apply** stays disabled until the form is valid. | While the field list loads, the filter row shows a placeholder. ### Fields The field list is not fixed. When a dashboard opens, Real-Time Metrics reads the filter inputs of the dashboard's dataset from the GraphQL schema and lists them as fields. A field label is the input name split into words, without its operator suffix, with each word capitalized: `upstreamCacheStatusEq` becomes **Upstream Cache Status**. Inputs whose schema description marks them as deprecated do not appear, and neither do a fixed set of excluded inputs such as `clientId`. For every field of a dataset and its type, refer to [Real-Time Metrics GraphQL fields](/en/documentation/devtools/graphql/gql-real-time-metrics-fields/). Some fields carry a list of values instead of free input: | Field | Values | | ------------------------------------------ | --------------------------------------------------------------------------------------------------- | | **Domain** or **Workload** | The workloads of your account. The label depends on whether your account uses domains or workloads. | | The Edge DNS zone field | Your Edge DNS zones, by name | | The function field | Your functions, by name | | **Classified**, and the bot category field | *Legitimate*, *Good Bot*, *Bad Bot*, *Under Evaluation* | | The challenge field | *Solved*, *Not Solved* | | **Action** | *Allow*, *Custom HTML*, *Deny*, *Drop*, *Hold Connection*, *Random Delay*, *Redirect* | The field dropdown lists a few fields first, by dashboard. The remaining fields follow in alphabetical order: | Dashboard | Fields listed first | | ------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------ | | **Applications**: **Data Transferred**, **Requests**, **Status Codes**, **Bandwidth Saving**; **Image Processor**: **Requests** | **Domain** or **Workload**, **Status**, **Upstream Status**, **Upstream Cache Status**, **Request Time** | | **Tiered Cache**: **Caching Offload** | **Upstream Bytes Received**, **Status**, **Upstream Status**, **Upstream Cache Status**, **Request Time** | | **Functions**: **Invocations** | **Domain** or **Workload**, **Edge Function Id**, **Compute Time**, **Invocations**, **Edge Functions Instance Id List** | | **Edge DNS**: **Standard Queries** | **Qtype**, **Requests**, **Source Loc Pop**, **Zone Id** | | **Data Stream**: **Data Streamed** | **Domain** or **Workload**, **Status**, **Data Streamed**, **Endpoint Type**, **Requests** | The **Bot Manager** dashboards, **Request Breakdown**, and **Threats Breakdown** list every field in alphabetical order. ### Operators The operators a field offers depend on its type. Each operator has a label in the **Operator** dropdown, a symbol on the applied-filter chip, a form in the query input, and the GraphQL operator the chart's query sends: | Operator | Chip symbol | Query-input form | GraphQL operator | | ------------------------- | ----------- | ---------------- | ---------------- | | **Equals** | `=` | `=` | `Eq` | | **Not Equals** | `≠` | `<>` | `Ne` | | **Contains** | `⊃` | `like` | `Like` | | **Not Contains** | `⊅` | `ilike` | `Ilike` | | **In** | `in` | `in` | `In` | | **Between** | `≤` | `between` | `Range` | | **Less Than** | `<` | `<` | `Lt` | | **Less Than or Equal** | `≤` | `<=` | `Lte` | | **Greater Than** | `>` | `>` | `Gt` | | **Greater Than or Equal** | `≥` | `>=` | `Gte` | **Contains** and **Not Contains** wrap the value as `%value%` before the query runs. For what each GraphQL operator matches, refer to [GraphQL queries](/en/documentation/devtools/graphql/features/#operators). ### Value types The value input follows the type of the field: | Field type | Value input | | --------------------------------- | ---------------------------------------------------------------------------------------------- | | Text, `String` | A text box | | Integer, `Int` | A whole number | | Decimal, `Float` | A number with 2 to 5 decimals | | Range, `IntRange` or `FloatRange` | A **Begin** and **End** pair | | A field with a list of values | A multi-select with a **Search** box, or a single select, both with the placeholder **Select** | A range needs a begin lower than its end. Otherwise, the popover shows `Begin must be different from end`, `Begin must be less than end`, `End must be different from begin`, or `End must be more than begin`. When a list of values cannot load, a `Loading failed` message appears. ### Applied filters Each applied filter shows as a chip under the filter row, in the form ` : `, with the operator label in lowercase. A range shows as `(begin,end)` and an **In** list as `(a, b)`. Selecting a chip opens the **Filter** popover with that filter's values, and a lock icon replaces the field arrow, because the field cannot change. The remove icon on a chip deletes that filter. ### Filter combination As the **Filter** popover states, each combination of operator can be used only once. The query input joins conditions with `and`, so the charts show only the data that matches every applied filter. To match any of several values of one field, use **In**. ### Filters on a dashboard switch Switching to a dashboard that reads a different dataset clears the filters and keeps the time range. Filters whose field does not exist in the new dataset are dropped from the query. The dataset of each dashboard is listed in [Build dashboards](/en/documentation/platform/real-time-metrics/build-dashboards/). --- ## Query input The query input in the filter row filters the dashboard with a typed expression in Azion Query Language. Its placeholder reads `Filter using Azion Query Language syntax...`. An expression follows these rules: - A condition is a field, an operator, and a value, separated by spaces: `status = 200`. - A field name of more than one word goes in double quotes: `"Upstream Status"`. - The `in` operator takes its values in parentheses, with no comma after the last one: `domain in (domain1, domain2)`. - The `between` operator takes exactly two different values in parentheses: `status between (200, 300)`. - Conditions join with `and`. While you type, the input suggests fields, then operators, then values. `Ctrl` + `Space`, or `Cmd` + `Space`, opens the suggestions; `Enter` applies the expression; and `Esc` closes the suggestions. ### Validation messages The query input shows these messages as rendered, and **Refresh** stays disabled until the expression is valid: | Message | Cause | | ---------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------- | | `please add spaces between the field, operator, and value. For example, write "status = 200" instead of "status=200".` | A condition has no spaces around its operator. | | `composite fields must be included in quotes. e.g: "Upstream Status".` | A field name of more than one word is not in double quotes. | | `some provided fields do not match the currently available ones. Please, check and try again.` | A field does not exist in the dashboard's dataset. | | `there are fields with 'in' operator that need to be inside parentheses. Please, check and try again. e.g: domain in (domain1, domain2)` | The values of an `in` condition are not in parentheses. | | `fields with 'in' operator that need the comma removed at the end of the values in parentheses. Please, check and try again.` | The value list of an `in` condition ends with a comma. | | `Please enclose the values for the BETWEEN operator in parentheses. For example: status between (200, 300).` | The values of a `between` condition are not in parentheses. | | `The BETWEEN operator requires its values to be enclosed in parentheses. For example: status between (200, 300).` | The values of a `between` condition are not in parentheses. | | `The BETWEEN operator must have exactly two values. For example: status between (200, 300).` | A `between` condition has one value, or more than two. | | `The two values for the BETWEEN operator must be different. For example: status between (200, 300).` | A `between` condition repeats the same value. | --- ## Shareable URL The path of the Real-Time Metrics URL names the product tab and the dashboard, such as `https://console.azion.com/real-time-metrics/edge-applications/data-transferred` for **Applications** › **Data Transferred**. Another user of the account who opens that URL lands on the same dashboard. A URL can also carry a `filters` query parameter. Its value is a base64-encoded JSON object, and Real-Time Metrics reads its `external.tsRange` key, with `begin` and `end`, as the time range to open on. --- ## Chart anatomy Each chart is a card. From the top, it carries the owner icon, the chart title, and the menu button; then the description; then the aggregation tag and, where it applies, the variation tag; then the chart itself. | Part | What it shows | | --------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Owner icon | An icon with no text for who owns the chart: the Azion logo, a group icon for the account, or a person icon for a user. Every chart Real-Time Metrics ships carries the Azion logo. | | Title | The chart's name, such as **Edge Offload** or **Missed Data**. | | Menu button | An icon button labeled **More options** that opens the chart menu. | | Description | A short text on what the chart plots. | | Aggregation tag | **Sum** or **Average**, with a calculator icon: the aggregation the chart's query uses. | | Variation tag | The change against the preceding window of the same length, described in Variation tag. | | Series | One category of data. For example, a requests chart can carry one series per domain, each a line of points over time. | | X-axis | On a time chart, the period of the selected range. | | Legend | One entry per series, in the form ` - `. | | Tooltip | The name and value of each series at the point under the cursor, in descending order of value. | ### Legend Each legend entry shows the series name and its total over the range. On a chart whose aggregation tag reads **Average**, the total is divided by the number of points. Select a legend entry to hide or show its series. A chart plots at most 16 series; further series are not added. The legend sits at the bottom of the chart by default. It moves to the right when the chart is wider than two grid columns and has more than five series, and it stays at the bottom in a window narrower than 1024 px. Ordered bar charts show no legend. ### Tooltip and zoom The tooltip shows only in a window wider than 540 px. Charts whose x-axis is time can be zoomed: scroll up over the chart to zoom in, and scroll down to zoom out. Inside the range, a time bucket with no data plots as zero. ### List charts A list chart is a table. Its column headers come from the field names: `sum` reads **Total**, `geolocCountryName` reads **Country**, `geolocAsn` reads **ASN**, `geolocRegionName` reads **Region**, and other names are title-cased. The table scrolls inside a 375 px height, and an empty table reads `No registers found.` ### Chart states A chart card shows one of these states in place of the chart: | State | What shows | | ----------- | ------------------------------------------------------------------------------------------------------- | | Loading | A placeholder in the chart's place | | No data | `No data available` | | Query error | `The chart can't be plotted. There was an issue loading the data.`, in place of the aggregation tag row | --- ## Chart menu The **More options** button of a chart card opens the chart menu. Each item shows only when it applies to the chart: | Item | What it does | | ------------------------------------------------------------ | ----------------------------------------------------------------------------------------------------------- | | **Open Help Center** | Opens the chart's Help Center article in the Console side panel. | | **Copy query** | Copies the chart's GraphQL query and its variables to the clipboard. It opens nothing. | | **Export CSV** | Downloads a `.csv` file named after the chart, with the points as plotted. | | **Show Mean Line**, **Hide Mean Line** | Draws or removes one line at the mean of all points. Shown on time charts with at least one series. | | **Show Mean Line per series**, **Hide Mean Line per series** | Draws or removes one mean line per series, to compare series. Shown on time charts with two or more series. | ### Copy query **Copy query** puts a text block on the clipboard: the line `# QUERY`, the chart's GraphQL query, then the line `# VARIABLES` and the variables as a JSON object. Both marker lines are GraphQL comments. The query reads its filter values from the variables, so it does not run on its own. To run it, paste the query into the GraphiQL Playground and move the JSON after `# VARIABLES` into the variables pane. For more information, refer to [GraphiQL Playground](/en/documentation/devtools/graphql/graphql-playground/). ### Export CSV **Export CSV** writes the file with `;` as the separator and dates in the `en-US` form, month first with a 12-hour clock. The file holds the points as the chart plots them for the selected range and filters. ### Mean lines A mean line is the sum of the chart's points divided by the number of points, for the selected range. Its legend entry reads `Mean Line - `. A mean line per series computes the same mean for each series, and its entry reads `Mean Line - - `. --- ## Variation tag The variation tag compares the selected range with the window of the same length immediately before it. It shows on time charts whose result is a single series and on big-number cards. Charts by category, such as pie charts, ordered bar charts, and lists, never show it. The value is `(current − previous) / previous × 100`, shown as a percentage with two decimals. For example, with **Last 1 hour** selected at 10:00, the tag compares 09:00 to 10:00 with 08:00 to 09:00. When the change is between –0.01% and +0.01%, the tag reads **Can't compare**, in a warning color with a triangle icon. It also reads **Can't compare** when either value is missing or the previous value is 0. Otherwise, the color says whether the change is good for that chart: | Chart | Increase | Decrease | Example | | -------------------------------- | -------- | -------- | ----------------------------------- | | An increase is good | Green | Red | **Edge Offload** | | An increase is bad | Red | Green | **Missed Data** | | Neither direction is good or bad | Blue | Blue | **Good Bot Hits**, **Transactions** | On a chart where an increase is good, the tag adds an up-right arrow for an increase and a down-left arrow for a decrease. Blue tags appear only on big-number cards. --- ## Related resources - [Filter a Real-Time Metrics dashboard](/en/documentation/guides/platform/observability/add-filters-metrics.md): The steps to add, edit, and remove a filter on a dashboard. - [Export a chart's data and query](/en/documentation/guides/platform/observability/analyze-metrics.md): The steps to export a chart as CSV and run its query outside the Console. - [Build dashboards](/en/documentation/platform/real-time-metrics/build-dashboards.md): Every Build dashboard, its dataset, and what each chart plots. - [Real-Time Metrics limits](/en/documentation/platform/real-time-metrics/limits.md): How far back the time range reaches, the series cap, and the other bounds.