Each GraphQL API dataset has specific fields that can be used when querying for data from that specific dataset. These fields are also used for the Real-Time Metrics interface on Azion Console.
See each available field and their descriptions next.
httpMetrics (Applications, WAF)
| Field | Description |
|---|---|
| bytesSent | Number of bytes sent to a client. This field is the result of a sum. Example: 191 |
| configurationId | Unique Azion configuration identifier set on virtual host configuration file. Example: 1595368520 |
| geolocCountryName | Country name resolution based on client IP. Example: Canada |
| geolocRegionName | Region/state name resolution based on client IP. Example: Parana |
| host | Host information sent on the request line. Stores: host name from the request line, or host name from the “Host” request header field, or the server name matching a request. Example: hello.myhost.net |
| proxyStatus | HTTP error status code or origin when no response is obtained from the upstream. Example: 500. In case of cache, the response is -. |
| remoteAddressClass | Class of the IP address of the origin that generated the request. Example: 44.192.0.0/11 |
| requestLength | Request length in bytes, including request line, headers, and body. This field is the result of a sum. Example: 167 |
| requestMethod | HTTP request method. Example: GET or POST. |
| requestTime | Request processing time, in seconds, since the first bytes were read from the client. This field is the result of a sum. Example: 0.234 |
| requests | Total amount of requests in the aggregation being used. This field is the result of a sum. Example: 11 |
| scheme | Request scheme. Example: HTTP or HTTPS. |
| sentHttpXOriginalImageSize | “X-Original-Image-Size” header sent in the origin’s response. Used by IMS to inform original image size. This field is the result of a sum. Example: 987390 |
| serverProtocol | Version of the request protocol. Example: HTTP/1.1, HTTP/2.0, HTTP/3.0 |
| sourceLocPop | Location and PoP of the edge that received the request. Example: lax-bso |
| sslProtocol | Protocol for an established TLS connection. Example: TLS v1.2 |
| status | HTTP status code of the request. Example: 200 |
| ts | Timestamp of when the event was created. Example: 2022-10-20T10:10:10 |
| upstreamBytesReceived | Number of bytes received by the origin’s edge if the content isn’t cached. This field is the result of a sum. Example: 8304 |
| upstreamCacheStatus | Status of the local cache. Can be: MISS, BYPASS, EXPIRED, STALE, UPDATING, REVALIDATED, HIT, or - |
| upstreamResponseTime | Time it takes for the edge to receive a default response from the origin, in seconds, including headers and body. This field is the result of a sum. Example: 0.876. In case of cache, the response is - |
| upstreamStatus | HTTP status code of the origin. If a server can’t be selected, the variable keeps the 502 (Bad Gateway) status code. Example: 200. In case of cache, the response is -. |
| wafAttackFamily | Category or type of attack detected by the Web Application Firewall (WAF), based on their characteristics. Example: $SQL, $RFI, $SQL, $XSS, $OTHERS |
| wafBlock | Informs whether the WAF blocked the action or not. 0 when action wasn’t blocked and 1 when action was blocked. When in Learning Mode, it won’t be blocked regardless of the return. |
| wafLearning | Informs if WAF is in Learning mode. Returns 0 if it isn’t and 1 if it’s. |
Calculated fields
When a field is a result of any kind of calculation, such as a sum, they’re considered as calculated fields.
| Calculated field | Description |
|---|---|
| bandwidthImagesProcessedSavedData | The saved data bandwidth in bytes achieved with Images Processor through Azion services. Example: 1026730813 |
| bandwidthMissedData | The missed data bandwidth in bytes rate achieved through Azion services. Example: 3.76 |
| bandwidthOffload | Percentage of the bandwidth that was offloaded through Azion services. Example: 85.23 |
| bandwidthSavedData | The saved data bandwidth rate in bytes achieved through Azion services. Example: 0.21 |
| bandwidthTotal | The bandwidth rate in bytes achieved through Azion services. Example: 4.21 |
| dataTransferredIn | Sum of the request length in bytes. If the data wasn’t a cache hit, the request length is summed once more. Example: 1202 |
| dataTransferredOut | Sum of the bytes sent. If the data wasn’t a cache hit, the upstream bytes sent is summed. Example: 6460 |
| dataTransferredTotal | Value of Data Transferred In + Data Transferred Out in bytes. Example: 766 |
| edgeRequestsTotal | Total amount of all requests in the application. Example: 23 |
| edgeRequestsTotalPerSecond | Total amount of requests per second in the application. Example: 0.00026 |
| httpRequestsTotal | Total amount of requests using the HTTP protocol. Example: 10 |
| httpsRequestsTotal | Total amount of requests using the HTTPS protocol. Example: 120 |
| missedData | Total amount of data that was missing and fetched from the origin. Example: 384 |
| missedRequests | Total amount of requests missed by using Azion services. Example: 5 |
| missedRequestsPerSecond | Total amount of requests missed per second by using Azion services. Example: 0.00034 |
| offload | Percentage of client data delivered by Azion, saving data. Example: 9.71 |
| requestsHttpMethodGet | Total amount of requests with the HTTP method GET. Example: 18 |
| requestsHttpMethodHead | Total amount of requests with HTTP method HEAD. Example: 2 |
| requestsHttpMethodOthers | Total amount of requests with others HTTP methods. Example: 3 |
| requestsHttpMethodPost | Total amount of requests with the HTTP method POST. Example: 6 |
| requestsOffloaded | Percentage of client requests delivered by Azion. Example: 50 |
| requestsPerSecondOffloaded | Percentage of the requests per second that were offloaded through Azion services. Example: 10 |
| requestsStatusCode200 | Total amount of requests with the HTTP 200 status code. Example: 45 |
| requestsStatusCode204 | Total amount of requests with the HTTP 204 status code. Example: 20 |
| requestsStatusCode206 | Total amount of requests with the HTTP 206 status code. Example: 30 |
| requestsStatusCode2xx | Total amount of requests with other 2XX HTTP status codes. Example: 60 |
| requestsStatusCode301 | Total amount of requests with the HTTP 301 status code. Example: 10 |
| requestsStatusCode302 | Total amount of requests with the HTTP 302 status code. Example: 12 |
| requestsStatusCode304 | Total amount of requests with the HTTP 304 status code. Example: 5 |
| requestsStatusCode3xx | Total amount of requests with other 3XX HTTP status codes. Example: 30 |
| requestsStatusCode400 | Total amount of requests with the HTTP 400 status code. Example: 24 |
| requestsStatusCode403 | Total amount of requests with the HTTP 403 status code. Example: 14 |
| requestsStatusCode404 | Total amount of requests with the HTTP 404 status code. Example: 35 |
| requestsStatusCode4xx | Total amount of requests with other 4XX HTTP status codes. Example: 50 |
| requestsStatusCode500 | Total amount of requests with the HTTP 500 status code. Example: 6 |
| requestsStatusCode502 | Total amount of requests with the HTTP 502 status code. Example: 18 |
| requestsStatusCode503 | Total amount of requests with the HTTP 503 status code. Example: 40 |
| requestsStatusCode5xx | Total amount of requests with other 5XX HTTP status codes. Example: 100 |
| savedData | Total amount of data that was saved by using Azion services. Example: 8300 |
| savedRequests | Total amount of requests saved by using Azion services. Example: 18 |
| savedRequestsPerSecond | Total amount of requests saved per second by using Azion services. Example: 11 |
| wafRequestsAllowed | Total amount of requests allowed by WAF. Example: 10 |
| wafRequestsBlocked | Total amount of requests blocked by WAF. Example: 4 |
| wafRequestsOthersAttacks | Total amount of requests with Others attacks, not considering XSS, RFI, and SQL Injection threats. Example: 2 |
| wafRequestsRfiAttacks | Total amount of requests with Remote File Inclusion (RFI) attack. Example: 5 |
| wafRequestsSqlAttacks | Total amount of requests with SQL Injection attack. Example: 3 |
| wafRequestsThreat | When WAF is in learning mode, total number of requests identified as threats processed but not blocked by WAF. Example: 10 |
| wafRequestsXssAttacks | Total amount of requests with Cross-site scripting (XSS) attack. Example: 1 |
httpBreakdownMetrics
| Field | Description |
|---|---|
ts | Timestamp of when the event was created. Example: 2022-10-20T10:10:10 |
host | Host information sent on the request line. Stores: hostname from the request line, or hostname from the Host request header field, or the server name matching a request. Example: hello.myhost.net |
remoteAddress | IP address of the origin that generated the request. Example: 127.0.0.1 |
requestPath | Path of the request made by the end user, without the host, protocol, and arguments. Example: /v1/application |
geolocAsn | Autonomous System Number (ASN) Allocation queried from the MaxMind table. Example: AS52580 Azion Technologies Ltda. |
geolocCountryName | Remote client’s country detected via IP address geolocation. Example: United States, Russian Federation |
httpUserAgent | End user’s application, operating system, vendor, and/or version. Value of the User-Agent header. Example: Mozilla/5.0 (Windows NT 10.0; Win64; x64) |
httpReferer | Address of the page the user made the request from. Example: https://example.com |
sentHttpContentType | Content-Type header sent in the origin’s response. Example: text/html; charset=UTF-8 |
upstreamAddr | Client’s IP address and port. It can also store multiple servers or server groups. Example: 192.168.1.1:80. When the response is 127.0.0.1:1666, the upstream is Azion Cells Runtime |
Calculated fields
When a field results from any kind of calculation, such as a sum, they’re considered as calculated fields.
| Calculated field | Description |
|---|---|
blockedRequests | Total amount of blocked requests in the aggregation being used. This field is the result of a sum. Example: 17 |
requests | Total amount of requests in the aggregation being used. This field is the result of a sum. Example: 11 |
wafThreatRequests | Total amount of requests detected and blocked by the Web Application Firewall (WAF) due to identified security threats. Example: 1523 |
tieredCacheMetrics (Tiered Cache)
| Field | Description |
|---|---|
| bytesSent | Number of bytes sent to a client. This field is the result of a sum. Example: 191 |
| configurationId | Unique Azion configuration identifier set on virtual host configuration file. Example: 1595368520 |
| host | Host information sent on the request line. Stores: host name from the request line, or host name from the “Host” request header field, or the server name matching a request. Example: hello.myhost.net |
| proxyStatus | HTTP error status code or origin when no response is obtained from the upstream. Example: 520. In case of cache, the response is -. |
| remoteAddressClass | Class of the IP address of the origin that generated the request. Example: 44.192.0.0/11 |
| requestLength | Request length in bytes, including request line, headers, and body. This field is the result of a sum. Example: 167 |
| requestMethod | HTTP request method. Example: GET or POST. |
| requestTime | Request processing time, in seconds, since the first bytes were read from the client. This field is the result of a sum. Example: 0.234 |
| requests | Total amount of requests in the aggregation being used. This field is the result of a sum. Example: 11 |
| scheme | Request scheme. Example: HTTP or HTTPS. |
| sourceLocPop | Location and PoP of the server that received the request. Example: lax-bso |
| status | HTTP status code of the request. Example: 200 |
| ts | Timestamp the event was created. Example: 2022-10-20T10:10:10 |
| upstreamBytesReceived | Number of bytes received by the origin’s edge if the content isn’t cached. This field is the result of a sum. Example: 8304 |
| upstreamCacheStatus | Status of the local cache. Can be: MISS, BYPASS, EXPIRED, STALE, UPDATING, REVALIDATED, HIT, or - |
| upstreamResponseTime | Time it takes for the edge to receive a default response from the origin, in seconds, including headers and body. This field is the result of a sum. Example: 0.876. In case of cache, the response is - |
| upstreamStatus | HTTP status code of the origin. If a server can’t be selected, the variable keeps the 502 (Bad Gateway) status code. Example: 200. In case of cache, the response is -. |
Calculated fields
When a field is a result of any kind of calculation, such as a sum, they’re considered as calculated fields.
| Calculated field | Description |
|---|---|
| dataTransferredIn | Sum of the request length in bytes. If the data wasn’t a cache hit, the request length is summed once more. Example: 1202 |
| dataTransferredOut | Sum of the bytes sent. If the data wasn’t a cache hit, the upstream bytes sent is summed. Example: 6460 |
| dataTransferredTotal | Value of Data Transferred In + Data Transferred Out in bytes. Example: 766 |
| offload | Percentage of client data delivered by Azion, saving data. Example: 9.71 |
edgeFunctionsMetrics (Functions)
| Field | Description |
|---|---|
| computeTime | Total execution time, in milliseconds, for the function during its processing. This field is the result of a sum. Example: 120 |
| configurationId | Unique Azion configuration identifier set on virtual host configuration file. Example: 1595368520 |
| edgeFunctionId | Identification of your Function. Example: 1321 |
| edgeFunctionInstanceId | Identification of your Function Instance. Example: 10590 |
| edgeFunctionsInstanceIdList | List of functions instances that were invocated during the request. Example: 10728 |
| functionLanguage | Language used in the function. Example: javascript |
| initiatorType | Initiator used in the function. Can be 1 (Applications) or 2 (Firewall). |
| invocations | Total amount of an invocation. This field is the result of a sum. Example: 8 |
| sourceLocPop | Location and PoP of the server that received the request. Example: lax-bso |
| ts | Timestamp of when the event was created. Example: 2022-10-20T10:10:10 |
Calculated fields
When a field is a result of any kind of calculation, such as a sum, they’re considered as calculated fields.
| Calculated field | Description |
|---|---|
| edgeApplicationInvocations | Total amount of invocations of a function from an application. Example: 50 |
| edgeFirewallInvocations | Total amount of invocations of a function from a firewall. Example: 30 |
imageProcessedMetrics (Image Processor)
| Field | Description |
|---|---|
| bytesSent | Number of bytes sent to a client. This field is the result of a sum. Example: 191 |
| configurationId | Unique Azion configuration identifier set on virtual host configuration file. Example: 1595368520 |
| host | Host information sent on the request line. Stores: host name from the request line, or host name from the “Host” request header field, or the server name matching a request. Example: hello.myhost.net |
| remoteAddressClass | Class of the IP address of the origin that generated the request. Example: 44.192.0.0/11 |
| requestMethod | HTTP request method. Example: GET or POST. |
| requestTime | Request processing time, in seconds, since the first bytes were read from the client. This field is the result of a sum. Example: 0.234 |
| requests | Total amount of requests in the aggregation being used. This field is the result of a sum. Example: 11 |
| scheme | Request scheme. Example: HTTP or HTTPS. |
| sourceLocPop | Location and PoP of the server that received the request. Example: lax-bso |
| status | HTTP status code of the request. Example: 200 |
| ts | Timestamp of when the event was created. Example: 2022-10-20T10:10:10 |
| upstreamCacheStatus | Status of the local cache. Can be: MISS, BYPASS, EXPIRED, STALE, UPDATING, REVALIDATED, HIT, or - |
| upstreamResponseTime | Time it takes for the edge to receive a default response from the origin, in seconds, including headers and body. This field is the result of a sum. Example: 0.876. In case of cache, the response is - |
| upstreamStatus | HTTP status code of the origin. If a server can’t be selected, the variable keeps the 502 (Bad Gateway) status code. Example: 200. In case of cache, the response is -. |
edgeDnsQueriesMetrics (Edge DNS)
| Field | Description |
|---|---|
| qtype | Definition of the type of record that’ll be used. Example: PTR, A, AAAA, HTTPS, NS, SRV |
| requests | Total amount of requests in the aggregation being used. This field is the result of a sum. Example: 11 |
| sourceLocPop | Location and PoP of the server that received the request. Example: lax-bso |
| ts | Timestamp of when the event was created. Example: 2022-10-20T10:10:10 |
| zoneId | Unique identifier of the Edge DNS zone. Example: 1340 |
dataStreamedMetrics (Data Stream)
| Field | Description |
|---|---|
| configurationId | Unique Azion configuration identifier set on virtual host configuration file. Example: 1595368520 |
| dataStreamed | Total amount of data streamed in bytes to the configured endpoint. This field is the result of a sum. Example: 1270 |
| endpointType | Type of endpoint used in the configured Data Stream. Example: S3 |
| requests | Total amount of requests in the aggregation being used. This field is the result of a sum. Example: 11 |
| sourceLocPop | Location and PoP of the server that received the request. Example: lax-bso |
| streamedLines | Total amount of lines streamed to the configured endpoint. Maximum value of 2000. This field is the result of a sum. Example: 837 |
| ts | Timestamp of when the event was created. Example: 2022-10-20T10:10:10 |
connectedUsersMetrics (Live Ingest)
| Field | Description |
|---|---|
| ts | A field in the result set representing the timestamp of the data point |
| host | A field in the result set representing the host from which the data was collected |
Calculated fields
When a field is a result of any kind of calculation, such as a sum, they’re considered as calculated fields.
| Calculated field | Description |
|---|---|
| uniqueSessions | A field in the result set representing the number of unique sessions recorded by the host |
| uniqueSessionsTotal | Total unique sessions calculated among all hosts |
botManagerMetrics
| Field | Description |
|---|---|
action | Action performed by Azion Bot Manager for accesses identified as bots. Example: deny. Possible values: allow, deny, redirect, custom_html, drop, random_delay, and hold_connection |
botCategory | Bot category identified in the request. Example: scraping, crawling, brute-force |
botMode | Bot protection mode used in the request. Example: Web |
challengeSolved | Flag that indicates if the bot either passed or failed the CAPTCHA challenge. This is a boolean, where 1 indicates Solved and 0 indicates Not Solved. |
classified | Traffic identification, being bad bot, good bot, legitimate, or under evaluation the possible values. |
geolocCountryName | Geographic origin of bot attacks by country. Example: Brazil |
geolocRegionName | Geographic origin of bot attacks by state or region. Example: Pernambuco |
host | Host information sent on the request line. Stores: host name from the request line, or host name from the Host request header field, or the server name matching a request. Example: hello.myhost.net |
requestMethod | HTTP method used in the request. Example: GET |
sourceLocPop | Location and PoP of the edge that received the request. Example: lax-bso |
ts | Timestamp of when the event was created. Example: 2022-10-20T10:10:10 |
About actions
Azion Bot Manager can execute 7 different actions, with the behavior being defined during configuration:
allow: allows the continuation of the request.deny: delivers a standard Status Code 403 response.drop: terminates the request without a response to the user.redirect: allows the request to be redirected to a new URL/location when the security threshold is reached.custom_html: allows customized HTML content to be delivered to the user in case of a threshold violation.random_delay: makes the function wait for a random period between 1 and 10 seconds before allowing the request to proceed.hold_connection: holds the request, keeping the connection open for 1 minute before dropping it.
Calculated fields
When a field results from any kind of calculation, such as a sum, they’re considered as calculated fields.
| Calculated field | Description |
|---|---|
requests | Total amount of requests analyzed by Azion Bot Manager. This field is the result of a sum. Example: 11 |
botManagerBreakdownMetrics
| Field | Description |
|---|---|
host | Host information sent on the request line. Stores: host name from the request line, or host name from the Host request header field, or the server name matching a request. Example: hello.myhost.net |
remoteAddr | IP address of the origin that generated the request. Example: 127.0.0.1 |
requestUrl | URL of the request made by the end user, with the host and path information and without arguments. Example: hello.myhost.net/v1 |
ts | Timestamp of when the event was created. Example: 2022-10-20T10:10:10 |
Calculated fields
When a field results from any kind of calculation, such as a sum, they’re considered as calculated fields.
| Calculated field | Description |
|---|---|
badBotRequests | Total amount of requests classified as bad bots. This field is the result of a sum. Example: 12 |
botRequests | Total amount of requests classified as bots. This field is the result of a sum. Example: 11 |
uniqRequestUrl | Number of unique URLs accessed by bots. This field represents the count of distinct URLs requested by bots. Example: 5 |
Deprecated datasets
The following datasets were discontinued. It’s recommended to use the new datasets which replaced them.
l2CacheMetrics (Tiered Cache)
| Field | Description |
|---|---|
| bytesSent | Number of bytes sent to a client. This field is the result of a sum. Example: 191 |
| configurationId | Unique Azion configuration identifier set on virtual host configuration file. Example: 1595368520 |
| host | Host information sent on the request line. Stores: host name from the request line, or host name from the “Host” request header field, or the server name matching a request. Example: hello.myhost.net |
| proxyStatus | HTTP error status code or origin when no response is obtained from the upstream. Example: 520. In case of cache, the response is -. |
| remoteAddressClass | Class of the IP address of the origin that generated the request. Example: 44.192.0.0/11 |
| requestLength | Request length in bytes, including request line, headers, and body. This field is the result of a sum. Example: 167 |
| requestMethod | HTTP request method. Example: GET or POST. |
| requestTime | Request processing time, in seconds, since the first bytes were read from the client. This field is the result of a sum. Example: 0.234 |
| requests | Total amount of requests in the aggregation being used. This field is the result of a sum. Example: 11 |
| scheme | Request scheme. Example: HTTP or HTTPS. |
| sourceLocPop | Location and PoP of the server that received the request. Example: lax-bso |
| status | HTTP status code of the request. Example: 200 |
| ts | Timestamp the event was created. Example: 2022-10-20T10:10:10 |
| upstreamBytesReceived | Number of bytes received by the origin’s edge if the content isn’t cached. This field is the result of a sum. Example: 8304 |
| upstreamCacheStatus | Status of the local cache. Can be: MISS, BYPASS, EXPIRED, STALE, UPDATING, REVALIDATED, HIT, or - |
| upstreamResponseTime | Time it takes for the edge to receive a default response from the origin, in seconds, including headers and body. This field is the result of a sum. Example: 0.876. In case of cache, the response is - |
| upstreamStatus | HTTP status code of the origin. If a server can’t be selected, the variable keeps the 502 (Bad Gateway) status code. Example: 200. In case of cache, the response is -. |
Calculated fields
When a field is a result of any kind of calculation, such as a sum, they’re considered as calculated fields.
| Calculated field | Description |
|---|---|
| dataTransferredIn | Sum of the request length in bytes. If the data wasn’t a cache hit, the request length is summed once more. Example: 1202 |
| dataTransferredOut | Sum of the bytes sent. If the data wasn’t a cache hit, the upstream bytes sent is summed. Example: 6460 |
| dataTransferredTotal | Value of Data Transferred In + Data Transferred Out in bytes. Example: 766 |
| offload | Percentage of client data delivered by Azion, saving data. Example: 9.71 |
idnsQueriesMetrics (Edge DNS)
| Field | Description |
|---|---|
| qtype | Definition of the type of record that’ll be used. Example: PTR, A, AAAA, HTTPS, NS, SRV |
| requests | Total amount of requests in the aggregation being used. This field is the result of a sum. Example: 11 |
| sourceLocPop | Location and PoP of the server that received the request. Example: lax-bso |
| ts | Timestamp of when the event was created. Example: 2022-10-20T10:10:10 |
| zoneID | Unique identifier of the Edge DNS zone. Example: 1340 |