# Query types and raw-log frame fields match the installed VictoriaLogs plugin: # https://github.com/VictoriaMetrics/victorialogs-datasource/blob/v0.33.1/src/types.ts # https://github.com/VictoriaMetrics/victorialogs-datasource/blob/v0.33.1/pkg/plugin/response_logs.go # Client breakdowns use numeric stats and rowsToFields to name each category. # Bar gauges need a nonempty default displayName to keep single-category labels; # the empty displayName override lets each generated field supply its own name. apiVersion: grafana.integreatly.org/v1beta1 kind: GrafanaDashboard metadata: name: http-traffic-dashboard spec: folderRef: networking datasources: - inputName: DS_VICTORIALOGS datasourceName: victorialogs-default json: | { "__inputs": [ { "name": "DS_VICTORIALOGS", "label": "VictoriaLogs", "description": "Gateway access logs", "type": "datasource", "pluginId": "victoriametrics-logs-datasource", "pluginName": "VictoriaLogs" } ], "uid": "http-traffic", "title": "HTTP Traffic", "description": "Detailed HTTP traffic, reported visitors, endpoints and gateway/backend diagnostics from completed access logs. New metadata appears after Envoy configuration sync. Cloudflare cache hits and requests blocked before the gateways are not captured. Browser/OS/device breakdowns are inferred from reported User-Agent; the map uses reported country codes, not precise IP locations. No Cloudflare Analytics API collection is required.", "schemaVersion": 39, "version": 4, "editable": true, "graphTooltip": 1, "tags": [ "http", "gateways", "victorialogs" ], "timezone": "browser", "refresh": "30s", "time": { "from": "now-1h", "to": "now" }, "templating": { "list": [ { "name": "gateway", "label": "Gateway", "type": "query", "datasource": { "type": "victoriametrics-logs-datasource", "uid": "${DS_VICTORIALOGS}" }, "query": { "type": "fieldValue", "field": "gateway_name", "query": "log_type:=\"gateway-access\"", "limit": 1000 }, "refresh": 2, "sort": 1, "multi": true, "includeAll": true, "allValue": "*", "current": { "text": [ "All" ], "value": [ "$__all" ] }, "options": [] }, { "name": "hostname", "label": "Hostname", "type": "query", "datasource": { "type": "victoriametrics-logs-datasource", "uid": "${DS_VICTORIALOGS}" }, "query": { "type": "fieldValue", "field": "authority", "query": "log_type:=\"gateway-access\" gateway_name:in($gateway)", "limit": 1000 }, "refresh": 2, "sort": 1, "multi": true, "includeAll": true, "allValue": "*", "current": { "text": [ "All" ], "value": [ "$__all" ] }, "options": [] }, { "name": "path", "label": "Path", "type": "query", "datasource": { "type": "victoriametrics-logs-datasource", "uid": "${DS_VICTORIALOGS}" }, "query": { "type": "fieldValue", "field": "path", "query": "log_type:=\"gateway-access\" gateway_name:in($gateway) authority:in($hostname)", "limit": 1000 }, "refresh": 2, "sort": 1, "multi": true, "includeAll": true, "allValue": "*", "current": { "text": [ "All" ], "value": [ "$__all" ] }, "options": [] }, { "name": "method", "label": "Method", "type": "query", "datasource": { "type": "victoriametrics-logs-datasource", "uid": "${DS_VICTORIALOGS}" }, "query": { "type": "fieldValue", "field": "method", "query": "log_type:=\"gateway-access\" gateway_name:in($gateway) authority:in($hostname)", "limit": 1000 }, "refresh": 2, "sort": 1, "multi": true, "includeAll": true, "allValue": "*", "current": { "text": [ "All" ], "value": [ "$__all" ] }, "options": [] }, { "name": "status", "label": "Status", "type": "query", "datasource": { "type": "victoriametrics-logs-datasource", "uid": "${DS_VICTORIALOGS}" }, "query": { "type": "fieldValue", "field": "response_code", "query": "log_type:=\"gateway-access\" gateway_name:in($gateway) authority:in($hostname)", "limit": 1000 }, "refresh": 2, "sort": 1, "multi": true, "includeAll": true, "allValue": "*", "current": { "text": [ "All" ], "value": [ "$__all" ] }, "options": [] }, { "name": "visitor", "label": "Reported visitor IP", "type": "query", "datasource": { "type": "victoriametrics-logs-datasource", "uid": "${DS_VICTORIALOGS}" }, "query": { "type": "fieldValue", "field": "cf_connecting_ip_reported", "query": "log_type:=\"gateway-access\" gateway_name:in($gateway) authority:in($hostname)", "limit": 1000 }, "refresh": 2, "sort": 1, "multi": true, "includeAll": true, "allValue": "*", "current": { "text": [ "All" ], "value": [ "$__all" ] }, "options": [] }, { "name": "peer", "label": "Network peer IP", "type": "query", "datasource": { "type": "victoriametrics-logs-datasource", "uid": "${DS_VICTORIALOGS}" }, "query": { "type": "fieldValue", "field": "peer_address", "query": "log_type:=\"gateway-access\" gateway_name:in($gateway) authority:in($hostname) | copy downstream_remote_address as peer_address | replace_regexp (\":([0-9]+)$\", \"\") at peer_address | replace_regexp (\"^\\\\[(.*)\\\\]$\", \"${1}\") at peer_address | format if (cf_country_reported:in(\"\", \"-\")) \"Unknown\" as cf_country_reported | format if (user_agent:in(\"\", \"-\")) \"Unknown\" as user_agent | format if (upstream_cluster:in(\"\", \"-\")) \"Unknown\" as upstream_cluster | format if (response_code_details:in(\"\", \"-\")) \"Unknown\" as response_code_details | format if (upstream_transport_failure_reason:in(\"\", \"-\")) \"Unknown\" as upstream_transport_failure_reason", "limit": 1000 }, "refresh": 2, "sort": 1, "multi": true, "includeAll": true, "allValue": "*", "current": { "text": [ "All" ], "value": [ "$__all" ] }, "options": [] }, { "name": "country", "label": "Reported country", "type": "query", "datasource": { "type": "victoriametrics-logs-datasource", "uid": "${DS_VICTORIALOGS}" }, "query": { "type": "fieldValue", "field": "cf_country_reported", "query": "log_type:=\"gateway-access\" gateway_name:in($gateway) authority:in($hostname) | copy downstream_remote_address as peer_address | replace_regexp (\":([0-9]+)$\", \"\") at peer_address | replace_regexp (\"^\\\\[(.*)\\\\]$\", \"${1}\") at peer_address | format if (cf_country_reported:in(\"\", \"-\")) \"Unknown\" as cf_country_reported | format if (user_agent:in(\"\", \"-\")) \"Unknown\" as user_agent | format if (upstream_cluster:in(\"\", \"-\")) \"Unknown\" as upstream_cluster | format if (response_code_details:in(\"\", \"-\")) \"Unknown\" as response_code_details | format if (upstream_transport_failure_reason:in(\"\", \"-\")) \"Unknown\" as upstream_transport_failure_reason", "limit": 1000 }, "refresh": 2, "sort": 1, "multi": true, "includeAll": true, "allValue": "*", "current": { "text": [ "All" ], "value": [ "$__all" ] }, "options": [] }, { "name": "agent", "label": "User agent", "type": "query", "datasource": { "type": "victoriametrics-logs-datasource", "uid": "${DS_VICTORIALOGS}" }, "query": { "type": "fieldValue", "field": "user_agent", "query": "log_type:=\"gateway-access\" gateway_name:in($gateway) authority:in($hostname) | copy downstream_remote_address as peer_address | replace_regexp (\":([0-9]+)$\", \"\") at peer_address | replace_regexp (\"^\\\\[(.*)\\\\]$\", \"${1}\") at peer_address | format if (cf_country_reported:in(\"\", \"-\")) \"Unknown\" as cf_country_reported | format if (user_agent:in(\"\", \"-\")) \"Unknown\" as user_agent | format if (upstream_cluster:in(\"\", \"-\")) \"Unknown\" as upstream_cluster | format if (response_code_details:in(\"\", \"-\")) \"Unknown\" as response_code_details | format if (upstream_transport_failure_reason:in(\"\", \"-\")) \"Unknown\" as upstream_transport_failure_reason", "limit": 1000 }, "refresh": 2, "sort": 1, "multi": true, "includeAll": true, "allValue": "*", "current": { "text": [ "All" ], "value": [ "$__all" ] }, "options": [] }, { "name": "backend", "label": "Backend", "type": "query", "datasource": { "type": "victoriametrics-logs-datasource", "uid": "${DS_VICTORIALOGS}" }, "query": { "type": "fieldValue", "field": "upstream_cluster", "query": "log_type:=\"gateway-access\" gateway_name:in($gateway) authority:in($hostname) | copy downstream_remote_address as peer_address | replace_regexp (\":([0-9]+)$\", \"\") at peer_address | replace_regexp (\"^\\\\[(.*)\\\\]$\", \"${1}\") at peer_address | format if (cf_country_reported:in(\"\", \"-\")) \"Unknown\" as cf_country_reported | format if (user_agent:in(\"\", \"-\")) \"Unknown\" as user_agent | format if (upstream_cluster:in(\"\", \"-\")) \"Unknown\" as upstream_cluster | format if (response_code_details:in(\"\", \"-\")) \"Unknown\" as response_code_details | format if (upstream_transport_failure_reason:in(\"\", \"-\")) \"Unknown\" as upstream_transport_failure_reason", "limit": 1000 }, "refresh": 2, "sort": 1, "multi": true, "includeAll": true, "allValue": "*", "current": { "text": [ "All" ], "value": [ "$__all" ] }, "options": [] }, { "name": "flags", "label": "Response flag", "type": "query", "datasource": { "type": "victoriametrics-logs-datasource", "uid": "${DS_VICTORIALOGS}" }, "query": { "type": "fieldValue", "field": "response_flags", "query": "log_type:=\"gateway-access\" gateway_name:in($gateway) authority:in($hostname)", "limit": 1000 }, "refresh": 2, "sort": 1, "multi": true, "includeAll": true, "allValue": "*", "current": { "text": [ "All" ], "value": [ "$__all" ] }, "options": [] }, { "name": "request_id", "label": "Request ID lookup", "type": "textbox", "description": "Exact match; * means all. Values are escaped as JSON strings.", "query": "*", "current": { "text": "*", "value": "*" }, "options": [] }, { "name": "ray_id", "label": "Ray ID lookup", "type": "textbox", "description": "Exact match; * means all. Values are escaped as JSON strings.", "query": "*", "current": { "text": "*", "value": "*" }, "options": [] } ] }, "annotations": { "list": [] }, "panels": [ { "id": 1, "type": "row", "title": "Overview", "collapsed": false, "gridPos": { "x": 0, "y": 0, "w": 24, "h": 1 }, "panels": [] }, { "id": 2, "title": "Requests", "type": "stat", "datasource": { "type": "victoriametrics-logs-datasource", "uid": "${DS_VICTORIALOGS}" }, "description": "All matching completed access-log records, including requests with no HTTP response.", "gridPos": { "x": 0, "y": 1, "w": 6, "h": 4 }, "fieldConfig": { "defaults": { "unit": "short", "noValue": "\u2014", "color": { "mode": "palette-classic" } }, "overrides": [] }, "targets": [ { "refId": "A", "datasource": { "type": "victoriametrics-logs-datasource", "uid": "${DS_VICTORIALOGS}" }, "expr": "log_type:=\"gateway-access\" gateway_name:in($gateway) authority:in($hostname) path:in($path) method:in($method) response_code:in($status) cf_connecting_ip_reported:in($visitor) | copy downstream_remote_address as peer_address | replace_regexp (\":([0-9]+)$\", \"\") at peer_address | replace_regexp (\"^\\\\[(.*)\\\\]$\", \"${1}\") at peer_address | format if (cf_country_reported:in(\"\", \"-\")) \"Unknown\" as cf_country_reported | format if (user_agent:in(\"\", \"-\")) \"Unknown\" as user_agent | format if (upstream_cluster:in(\"\", \"-\")) \"Unknown\" as upstream_cluster | format if (response_code_details:in(\"\", \"-\")) \"Unknown\" as response_code_details | format if (upstream_transport_failure_reason:in(\"\", \"-\")) \"Unknown\" as upstream_transport_failure_reason | filter peer_address:in($peer) cf_country_reported:in($country) user_agent:in($agent) upstream_cluster:in($backend) response_flags:in($flags) request_id:in(${request_id:json}) cf_ray:in(${ray_id:json}) | stats count() as requests", "queryType": "stats", "editorMode": "code", "legendFormat": "{{__name__}}", "maxLines": 1000, "direction": "desc" } ], "options": { "reduceOptions": { "calcs": [ "lastNotNull" ], "fields": "", "values": false }, "orientation": "auto", "textMode": "auto", "colorMode": "value", "graphMode": "none", "justifyMode": "auto" } }, { "id": 3, "title": "Requests / second", "type": "stat", "datasource": { "type": "victoriametrics-logs-datasource", "uid": "${DS_VICTORIALOGS}" }, "description": "Average rate over the selected time range.", "gridPos": { "x": 6, "y": 1, "w": 6, "h": 4 }, "fieldConfig": { "defaults": { "unit": "reqps", "noValue": "\u2014", "color": { "mode": "palette-classic" } }, "overrides": [] }, "targets": [ { "refId": "A", "datasource": { "type": "victoriametrics-logs-datasource", "uid": "${DS_VICTORIALOGS}" }, "expr": "log_type:=\"gateway-access\" gateway_name:in($gateway) authority:in($hostname) path:in($path) method:in($method) response_code:in($status) cf_connecting_ip_reported:in($visitor) | copy downstream_remote_address as peer_address | replace_regexp (\":([0-9]+)$\", \"\") at peer_address | replace_regexp (\"^\\\\[(.*)\\\\]$\", \"${1}\") at peer_address | format if (cf_country_reported:in(\"\", \"-\")) \"Unknown\" as cf_country_reported | format if (user_agent:in(\"\", \"-\")) \"Unknown\" as user_agent | format if (upstream_cluster:in(\"\", \"-\")) \"Unknown\" as upstream_cluster | format if (response_code_details:in(\"\", \"-\")) \"Unknown\" as response_code_details | format if (upstream_transport_failure_reason:in(\"\", \"-\")) \"Unknown\" as upstream_transport_failure_reason | filter peer_address:in($peer) cf_country_reported:in($country) user_agent:in($agent) upstream_cluster:in($backend) response_flags:in($flags) request_id:in(${request_id:json}) cf_ray:in(${ray_id:json}) | stats rate() as requests_per_second", "queryType": "stats", "editorMode": "code", "legendFormat": "{{__name__}}", "maxLines": 1000, "direction": "desc" } ], "options": { "reduceOptions": { "calcs": [ "lastNotNull" ], "fields": "", "values": false }, "orientation": "auto", "textMode": "auto", "colorMode": "value", "graphMode": "none", "justifyMode": "auto" } }, { "id": 4, "title": "Reported public IPs", "type": "stat", "datasource": { "type": "victoriametrics-logs-datasource", "uid": "${DS_VICTORIALOGS}" }, "description": "Distinct reported CF-Connecting-IP values on public traffic. Addresses are not unique people or authenticated identities.", "gridPos": { "x": 12, "y": 1, "w": 6, "h": 4 }, "fieldConfig": { "defaults": { "unit": "short", "noValue": "\u2014", "color": { "mode": "palette-classic" } }, "overrides": [] }, "targets": [ { "refId": "A", "datasource": { "type": "victoriametrics-logs-datasource", "uid": "${DS_VICTORIALOGS}" }, "expr": "log_type:=\"gateway-access\" gateway_name:in($gateway) authority:in($hostname) path:in($path) method:in($method) response_code:in($status) cf_connecting_ip_reported:in($visitor) | copy downstream_remote_address as peer_address | replace_regexp (\":([0-9]+)$\", \"\") at peer_address | replace_regexp (\"^\\\\[(.*)\\\\]$\", \"${1}\") at peer_address | format if (cf_country_reported:in(\"\", \"-\")) \"Unknown\" as cf_country_reported | format if (user_agent:in(\"\", \"-\")) \"Unknown\" as user_agent | format if (upstream_cluster:in(\"\", \"-\")) \"Unknown\" as upstream_cluster | format if (response_code_details:in(\"\", \"-\")) \"Unknown\" as response_code_details | format if (upstream_transport_failure_reason:in(\"\", \"-\")) \"Unknown\" as upstream_transport_failure_reason | filter peer_address:in($peer) cf_country_reported:in($country) user_agent:in($agent) upstream_cluster:in($backend) response_flags:in($flags) request_id:in(${request_id:json}) cf_ray:in(${ray_id:json}) | stats count_uniq(cf_connecting_ip_reported) if (gateway_name:=\"cloudflare-gateway\" cf_connecting_ip_reported:!=\"\" cf_connecting_ip_reported:!=\"-\") as addresses", "queryType": "stats", "editorMode": "code", "legendFormat": "{{__name__}}", "maxLines": 1000, "direction": "desc" } ], "options": { "reduceOptions": { "calcs": [ "lastNotNull" ], "fields": "", "values": false }, "orientation": "auto", "textMode": "auto", "colorMode": "value", "graphMode": "none", "justifyMode": "auto" } }, { "id": 5, "title": "Active hostnames", "type": "stat", "datasource": { "type": "victoriametrics-logs-datasource", "uid": "${DS_VICTORIALOGS}" }, "description": "Distinct HTTP hostnames in the selected records.", "gridPos": { "x": 18, "y": 1, "w": 6, "h": 4 }, "fieldConfig": { "defaults": { "unit": "short", "noValue": "\u2014", "color": { "mode": "palette-classic" } }, "overrides": [] }, "targets": [ { "refId": "A", "datasource": { "type": "victoriametrics-logs-datasource", "uid": "${DS_VICTORIALOGS}" }, "expr": "log_type:=\"gateway-access\" gateway_name:in($gateway) authority:in($hostname) path:in($path) method:in($method) response_code:in($status) cf_connecting_ip_reported:in($visitor) | copy downstream_remote_address as peer_address | replace_regexp (\":([0-9]+)$\", \"\") at peer_address | replace_regexp (\"^\\\\[(.*)\\\\]$\", \"${1}\") at peer_address | format if (cf_country_reported:in(\"\", \"-\")) \"Unknown\" as cf_country_reported | format if (user_agent:in(\"\", \"-\")) \"Unknown\" as user_agent | format if (upstream_cluster:in(\"\", \"-\")) \"Unknown\" as upstream_cluster | format if (response_code_details:in(\"\", \"-\")) \"Unknown\" as response_code_details | format if (upstream_transport_failure_reason:in(\"\", \"-\")) \"Unknown\" as upstream_transport_failure_reason | filter peer_address:in($peer) cf_country_reported:in($country) user_agent:in($agent) upstream_cluster:in($backend) response_flags:in($flags) request_id:in(${request_id:json}) cf_ray:in(${ray_id:json}) | stats count_uniq(authority) as hostnames", "queryType": "stats", "editorMode": "code", "legendFormat": "{{__name__}}", "maxLines": 1000, "direction": "desc" } ], "options": { "reduceOptions": { "calcs": [ "lastNotNull" ], "fields": "", "values": false }, "orientation": "auto", "textMode": "auto", "colorMode": "value", "graphMode": "none", "justifyMode": "auto" } }, { "id": 6, "title": "Response body bytes", "type": "stat", "datasource": { "type": "victoriametrics-logs-datasource", "uid": "${DS_VICTORIALOGS}" }, "description": "Total logged HTTP response body bytes. This is not tunnel or wire bandwidth; for WebSockets Envoy can include handshake headers.", "gridPos": { "x": 0, "y": 5, "w": 6, "h": 4 }, "fieldConfig": { "defaults": { "unit": "bytes", "noValue": "\u2014", "color": { "mode": "palette-classic" } }, "overrides": [] }, "targets": [ { "refId": "A", "datasource": { "type": "victoriametrics-logs-datasource", "uid": "${DS_VICTORIALOGS}" }, "expr": "log_type:=\"gateway-access\" gateway_name:in($gateway) authority:in($hostname) path:in($path) method:in($method) response_code:in($status) cf_connecting_ip_reported:in($visitor) | copy downstream_remote_address as peer_address | replace_regexp (\":([0-9]+)$\", \"\") at peer_address | replace_regexp (\"^\\\\[(.*)\\\\]$\", \"${1}\") at peer_address | format if (cf_country_reported:in(\"\", \"-\")) \"Unknown\" as cf_country_reported | format if (user_agent:in(\"\", \"-\")) \"Unknown\" as user_agent | format if (upstream_cluster:in(\"\", \"-\")) \"Unknown\" as upstream_cluster | format if (response_code_details:in(\"\", \"-\")) \"Unknown\" as response_code_details | format if (upstream_transport_failure_reason:in(\"\", \"-\")) \"Unknown\" as upstream_transport_failure_reason | filter peer_address:in($peer) cf_country_reported:in($country) user_agent:in($agent) upstream_cluster:in($backend) response_flags:in($flags) request_id:in(${request_id:json}) cf_ray:in(${ray_id:json}) | stats sum(bytes_sent) as response_bytes | math max(0, response_bytes) as response_bytes", "queryType": "stats", "editorMode": "code", "legendFormat": "{{__name__}}", "maxLines": 1000, "direction": "desc" } ], "options": { "reduceOptions": { "calcs": [ "lastNotNull" ], "fields": "", "values": false }, "orientation": "auto", "textMode": "auto", "colorMode": "value", "graphMode": "none", "justifyMode": "auto" } }, { "id": 7, "title": "HTTP 4xx", "type": "stat", "datasource": { "type": "victoriametrics-logs-datasource", "uid": "${DS_VICTORIALOGS}" }, "description": "4xx as a percentage of HTTP responses (100\u2013599); excludes code 0. No responses yields 0%.", "gridPos": { "x": 6, "y": 5, "w": 6, "h": 4 }, "fieldConfig": { "defaults": { "unit": "percent", "noValue": "\u2014", "color": { "mode": "palette-classic" } }, "overrides": [] }, "targets": [ { "refId": "A", "datasource": { "type": "victoriametrics-logs-datasource", "uid": "${DS_VICTORIALOGS}" }, "expr": "log_type:=\"gateway-access\" gateway_name:in($gateway) authority:in($hostname) path:in($path) method:in($method) response_code:in($status) cf_connecting_ip_reported:in($visitor) | copy downstream_remote_address as peer_address | replace_regexp (\":([0-9]+)$\", \"\") at peer_address | replace_regexp (\"^\\\\[(.*)\\\\]$\", \"${1}\") at peer_address | format if (cf_country_reported:in(\"\", \"-\")) \"Unknown\" as cf_country_reported | format if (user_agent:in(\"\", \"-\")) \"Unknown\" as user_agent | format if (upstream_cluster:in(\"\", \"-\")) \"Unknown\" as upstream_cluster | format if (response_code_details:in(\"\", \"-\")) \"Unknown\" as response_code_details | format if (upstream_transport_failure_reason:in(\"\", \"-\")) \"Unknown\" as upstream_transport_failure_reason | filter peer_address:in($peer) cf_country_reported:in($country) user_agent:in($agent) upstream_cluster:in($backend) response_flags:in($flags) request_id:in(${request_id:json}) cf_ray:in(${ray_id:json}) | stats count() if (response_code:>=100 response_code:<600) as responses, count() if (response_code:>=400 response_code:<500) as errors | math 100 * errors / max(responses, 1) as error_percent | fields error_percent", "queryType": "stats", "editorMode": "code", "legendFormat": "{{__name__}}", "maxLines": 1000, "direction": "desc" } ], "options": { "reduceOptions": { "calcs": [ "lastNotNull" ], "fields": "", "values": false }, "orientation": "auto", "textMode": "auto", "colorMode": "value", "graphMode": "none", "justifyMode": "auto" } }, { "id": 8, "title": "HTTP 5xx", "type": "stat", "datasource": { "type": "victoriametrics-logs-datasource", "uid": "${DS_VICTORIALOGS}" }, "description": "5xx as a percentage of HTTP responses (100\u2013599); excludes code 0. No responses yields 0%.", "gridPos": { "x": 12, "y": 5, "w": 6, "h": 4 }, "fieldConfig": { "defaults": { "unit": "percent", "noValue": "\u2014", "color": { "mode": "palette-classic" } }, "overrides": [] }, "targets": [ { "refId": "A", "datasource": { "type": "victoriametrics-logs-datasource", "uid": "${DS_VICTORIALOGS}" }, "expr": "log_type:=\"gateway-access\" gateway_name:in($gateway) authority:in($hostname) path:in($path) method:in($method) response_code:in($status) cf_connecting_ip_reported:in($visitor) | copy downstream_remote_address as peer_address | replace_regexp (\":([0-9]+)$\", \"\") at peer_address | replace_regexp (\"^\\\\[(.*)\\\\]$\", \"${1}\") at peer_address | format if (cf_country_reported:in(\"\", \"-\")) \"Unknown\" as cf_country_reported | format if (user_agent:in(\"\", \"-\")) \"Unknown\" as user_agent | format if (upstream_cluster:in(\"\", \"-\")) \"Unknown\" as upstream_cluster | format if (response_code_details:in(\"\", \"-\")) \"Unknown\" as response_code_details | format if (upstream_transport_failure_reason:in(\"\", \"-\")) \"Unknown\" as upstream_transport_failure_reason | filter peer_address:in($peer) cf_country_reported:in($country) user_agent:in($agent) upstream_cluster:in($backend) response_flags:in($flags) request_id:in(${request_id:json}) cf_ray:in(${ray_id:json}) | stats count() if (response_code:>=100 response_code:<600) as responses, count() if (response_code:>=500 response_code:<600) as errors | math 100 * errors / max(responses, 1) as error_percent | fields error_percent", "queryType": "stats", "editorMode": "code", "legendFormat": "{{__name__}}", "maxLines": 1000, "direction": "desc" } ], "options": { "reduceOptions": { "calcs": [ "lastNotNull" ], "fields": "", "values": false }, "orientation": "auto", "textMode": "auto", "colorMode": "value", "graphMode": "none", "justifyMode": "auto" } }, { "id": 9, "title": "p95 duration", "type": "stat", "datasource": { "type": "victoriametrics-logs-datasource", "uid": "${DS_VICTORIALOGS}" }, "description": "95th percentile completed-request duration. Includes long-lived requests. No samples shows no value.", "gridPos": { "x": 18, "y": 5, "w": 6, "h": 4 }, "fieldConfig": { "defaults": { "unit": "ms", "noValue": "\u2014", "color": { "mode": "palette-classic" } }, "overrides": [] }, "targets": [ { "refId": "A", "datasource": { "type": "victoriametrics-logs-datasource", "uid": "${DS_VICTORIALOGS}" }, "expr": "log_type:=\"gateway-access\" gateway_name:in($gateway) authority:in($hostname) path:in($path) method:in($method) response_code:in($status) cf_connecting_ip_reported:in($visitor) | copy downstream_remote_address as peer_address | replace_regexp (\":([0-9]+)$\", \"\") at peer_address | replace_regexp (\"^\\\\[(.*)\\\\]$\", \"${1}\") at peer_address | format if (cf_country_reported:in(\"\", \"-\")) \"Unknown\" as cf_country_reported | format if (user_agent:in(\"\", \"-\")) \"Unknown\" as user_agent | format if (upstream_cluster:in(\"\", \"-\")) \"Unknown\" as upstream_cluster | format if (response_code_details:in(\"\", \"-\")) \"Unknown\" as response_code_details | format if (upstream_transport_failure_reason:in(\"\", \"-\")) \"Unknown\" as upstream_transport_failure_reason | filter peer_address:in($peer) cf_country_reported:in($country) user_agent:in($agent) upstream_cluster:in($backend) response_flags:in($flags) request_id:in(${request_id:json}) cf_ray:in(${ray_id:json}) | filter response_code:>=100 response_code:<600 | stats quantile(0.95, duration_ms) as p95_ms | filter p95_ms:!=\"\"", "queryType": "stats", "editorMode": "code", "legendFormat": "{{__name__}}", "maxLines": 1000, "direction": "desc" } ], "options": { "reduceOptions": { "calcs": [ "lastNotNull" ], "fields": "", "values": false }, "orientation": "auto", "textMode": "auto", "colorMode": "value", "graphMode": "none", "justifyMode": "auto" } }, { "id": 52, "title": "Geography", "type": "row", "collapsed": false, "gridPos": { "x": 0, "y": 9, "w": 24, "h": 1 }, "panels": [] }, { "id": 50, "title": "Public requests by reported country", "type": "geomap", "datasource": { "type": "victoriametrics-logs-datasource", "uid": "${DS_VICTORIALOGS}" }, "description": "Country-level request counts from the reported CF-IPCountry header, placed at country centroids. Not precise visitor locations. Missing/XX/T1 country values remain in the country ranking and coverage panels but cannot be mapped. Country data needs Cloudflare visitor-location headers; no IP geolocation service is used. OpenStreetMap provides the basemap without an API key; country markers still need reported country data.", "gridPos": { "x": 0, "y": 10, "w": 12, "h": 10 }, "fieldConfig": { "defaults": { "unit": "short", "color": { "mode": "continuous-BlYlRd" }, "noValue": "\u2014" }, "overrides": [] }, "targets": [ { "refId": "A", "datasource": { "type": "victoriametrics-logs-datasource", "uid": "${DS_VICTORIALOGS}" }, "expr": "log_type:=\"gateway-access\" gateway_name:in($gateway) authority:in($hostname) path:in($path) method:in($method) response_code:in($status) cf_connecting_ip_reported:in($visitor) | copy downstream_remote_address as peer_address | replace_regexp (\":([0-9]+)$\", \"\") at peer_address | replace_regexp (\"^\\\\[(.*)\\\\]$\", \"${1}\") at peer_address | format if (cf_country_reported:in(\"\", \"-\")) \"Unknown\" as cf_country_reported | format if (user_agent:in(\"\", \"-\")) \"Unknown\" as user_agent | format if (upstream_cluster:in(\"\", \"-\")) \"Unknown\" as upstream_cluster | format if (response_code_details:in(\"\", \"-\")) \"Unknown\" as response_code_details | format if (upstream_transport_failure_reason:in(\"\", \"-\")) \"Unknown\" as upstream_transport_failure_reason | filter peer_address:in($peer) cf_country_reported:in($country) user_agent:in($agent) upstream_cluster:in($backend) response_flags:in($flags) request_id:in(${request_id:json}) cf_ray:in(${ray_id:json}) | filter gateway_name:=\"cloudflare-gateway\" cf_country_reported:~\"^[A-Z]{2}$\" cf_country_reported:!=\"XX\" | stats by (cf_country_reported) count() as requests", "queryType": "instant", "editorMode": "code", "legendFormat": "{{__name__}}", "maxLines": 300, "direction": "desc" } ], "options": { "view": { "id": "zero", "lat": 20, "lon": 0, "zoom": 1, "allLayers": true }, "controls": { "showZoom": true, "mouseWheelZoom": false, "showAttribution": true, "showScale": false }, "tooltip": { "mode": "details" }, "basemap": { "name": "OpenStreetMap", "type": "osm-standard", "config": {}, "opacity": 1 }, "layers": [ { "name": "Requests", "type": "markers", "location": { "mode": "lookup", "lookup": "Reported country", "gazetteer": "public/gazetteer/countries.json" }, "config": { "showLegend": true, "style": { "color": { "field": "Requests", "fixed": "blue" }, "size": { "field": "Requests", "fixed": 6, "min": 5, "max": 28 }, "opacity": 0.8, "symbol": { "mode": "fixed", "fixed": "img/icons/marker/circle.svg" }, "text": { "mode": "field", "field": "Reported country", "fixed": "" } } }, "opacity": 1, "tooltip": true } ] }, "transformations": [ { "id": "extractFields", "options": { "source": "labels", "format": "json", "replace": true, "keepTime": false } }, { "id": "convertFieldType", "options": { "conversions": [ { "targetField": "requests", "destinationType": "number" } ], "fields": {} } }, { "id": "organize", "options": { "includeByName": { "cf_country_reported": true, "requests": true }, "indexByName": { "cf_country_reported": 0, "requests": 1 }, "renameByName": { "cf_country_reported": "Reported country", "requests": "Requests" } } } ] }, { "id": 22, "title": "Reported country ranking", "type": "table", "datasource": { "type": "victoriametrics-logs-datasource", "uid": "${DS_VICTORIALOGS}" }, "description": "Public requests by CF-IPCountry. Requires Cloudflare visitor-location headers. Codes XX and T1 are preserved; missing values are Unknown.", "gridPos": { "x": 12, "y": 10, "w": 12, "h": 10 }, "fieldConfig": { "defaults": { "unit": "none", "noValue": "\u2014", "color": { "mode": "palette-classic" } }, "overrides": [ { "matcher": { "id": "byName", "options": "Reported country" }, "properties": [] }, { "matcher": { "id": "byName", "options": "Requests" }, "properties": [ { "id": "unit", "value": "short" }, { "id": "decimals", "value": 0 } ] } ] }, "targets": [ { "refId": "A", "datasource": { "type": "victoriametrics-logs-datasource", "uid": "${DS_VICTORIALOGS}" }, "expr": "log_type:=\"gateway-access\" gateway_name:in($gateway) authority:in($hostname) path:in($path) method:in($method) response_code:in($status) cf_connecting_ip_reported:in($visitor) | copy downstream_remote_address as peer_address | replace_regexp (\":([0-9]+)$\", \"\") at peer_address | replace_regexp (\"^\\\\[(.*)\\\\]$\", \"${1}\") at peer_address | format if (cf_country_reported:in(\"\", \"-\")) \"Unknown\" as cf_country_reported | format if (user_agent:in(\"\", \"-\")) \"Unknown\" as user_agent | format if (upstream_cluster:in(\"\", \"-\")) \"Unknown\" as upstream_cluster | format if (response_code_details:in(\"\", \"-\")) \"Unknown\" as response_code_details | format if (upstream_transport_failure_reason:in(\"\", \"-\")) \"Unknown\" as upstream_transport_failure_reason | filter peer_address:in($peer) cf_country_reported:in($country) user_agent:in($agent) upstream_cluster:in($backend) response_flags:in($flags) request_id:in(${request_id:json}) cf_ray:in(${ray_id:json}) | filter gateway_name:=\"cloudflare-gateway\" | stats by (cf_country_reported) count() as requests | sort by (requests) desc | limit 20", "queryType": "instant", "editorMode": "code", "legendFormat": "{{__name__}}", "maxLines": 20, "direction": "desc" } ], "options": { "showHeader": true, "cellHeight": "sm", "footer": { "show": false }, "sortBy": [ { "displayName": "Requests", "desc": true } ] }, "transformations": [ { "id": "extractFields", "options": { "source": "labels", "format": "json", "replace": true, "keepTime": false } }, { "id": "convertFieldType", "options": { "conversions": [ { "targetField": "requests", "destinationType": "number" } ], "fields": {} } }, { "id": "organize", "options": { "excludeByName": {}, "includeByName": { "cf_country_reported": true, "requests": true }, "indexByName": { "cf_country_reported": 0, "requests": 1 }, "renameByName": { "cf_country_reported": "Reported country", "requests": "Requests" } } } ] }, { "id": 53, "title": "Client breakdowns", "type": "row", "collapsed": false, "gridPos": { "x": 0, "y": 20, "w": 24, "h": 1 }, "panels": [] }, { "id": 47, "title": "Top browsers (inferred)", "type": "bargauge", "datasource": { "type": "victoriametrics-logs-datasource", "uid": "${DS_VICTORIALOGS}" }, "description": "Inferred from the reported User-Agent using broad patterns. Headers can be spoofed; Unknown includes old logs, missing headers and unrecognized clients. Bot/crawler means the user agent claims to be one, not verified bot detection.", "gridPos": { "x": 0, "y": 21, "w": 8, "h": 10 }, "fieldConfig": { "defaults": { "unit": "short", "color": { "mode": "fixed", "fixedColor": "blue" }, "noValue": "\u2014", "decimals": 0, "min": 0, "displayName": "Category" }, "overrides": [ { "matcher": { "id": "byRegexp", "options": ".*" }, "properties": [ { "id": "displayName", "value": "" } ] } ] }, "targets": [ { "refId": "A", "datasource": { "type": "victoriametrics-logs-datasource", "uid": "${DS_VICTORIALOGS}" }, "expr": "log_type:=\"gateway-access\" gateway_name:in($gateway) authority:in($hostname) path:in($path) method:in($method) response_code:in($status) cf_connecting_ip_reported:in($visitor) | copy downstream_remote_address as peer_address | replace_regexp (\":([0-9]+)$\", \"\") at peer_address | replace_regexp (\"^\\\\[(.*)\\\\]$\", \"${1}\") at peer_address | format if (cf_country_reported:in(\"\", \"-\")) \"Unknown\" as cf_country_reported | format if (user_agent:in(\"\", \"-\")) \"Unknown\" as user_agent | format if (upstream_cluster:in(\"\", \"-\")) \"Unknown\" as upstream_cluster | format if (response_code_details:in(\"\", \"-\")) \"Unknown\" as response_code_details | format if (upstream_transport_failure_reason:in(\"\", \"-\")) \"Unknown\" as upstream_transport_failure_reason | filter peer_address:in($peer) cf_country_reported:in($country) user_agent:in($agent) upstream_cluster:in($backend) response_flags:in($flags) request_id:in(${request_id:json}) cf_ray:in(${ray_id:json}) | format \"Unknown\" as browser | format if (user_agent:~\"(?i)Safari\") \"Safari\" as browser | format if (user_agent:~\"(?i)(Chrome|CriOS)\") \"Chrome\" as browser | format if (user_agent:~\"(?i)(Firefox|FxiOS)\") \"Firefox\" as browser | format if (user_agent:~\"(?i)(Edg/|EdgiOS|EdgA/)\") \"Edge\" as browser | format if (user_agent:~\"(?i)(OPR/|Opera)\") \"Opera\" as browser | format if (user_agent:~\"(?i)(curl/|Wget/)\") \"Command-line client\" as browser | format if (user_agent:~\"(?i)(bot|crawler|spider)\") \"Bot/crawler\" as browser | format if (user_agent:~\"(?i)Googlebot\") \"Googlebot\" as browser | format if (user_agent:~\"(?i)bingbot\") \"Bingbot\" as browser | format if (user_agent:~\"(?i)Applebot\") \"Applebot\" as browser | stats by (browser) count() as requests | sort by (requests) desc | limit 20", "queryType": "stats", "editorMode": "code", "legendFormat": "{{browser}}", "maxLines": 20, "direction": "desc" } ], "options": { "reduceOptions": { "values": false, "calcs": [ "lastNotNull" ], "fields": "", "limit": 20 }, "orientation": "horizontal", "displayMode": "basic", "showUnfilled": true, "minVizHeight": 40, "minVizWidth": 0, "valueMode": "color", "namePlacement": "top", "maxVizHeight": 40, "sizing": "manual", "text": { "titleSize": 14, "valueSize": 14 } }, "transformations": [ { "id": "rowsToFields", "options": { "mappings": [ { "fieldName": "browser", "handlerKey": "field.name" }, { "fieldName": "Value #A", "handlerKey": "field.value" } ] } } ] }, { "id": 48, "title": "Top operating systems (inferred)", "type": "bargauge", "datasource": { "type": "victoriametrics-logs-datasource", "uid": "${DS_VICTORIALOGS}" }, "description": "Inferred from the reported User-Agent using broad patterns. Headers can be spoofed; Unknown includes old logs, missing headers and unrecognized clients. Bot/crawler means the user agent claims to be one, not verified bot detection.", "gridPos": { "x": 8, "y": 21, "w": 8, "h": 10 }, "fieldConfig": { "defaults": { "unit": "short", "color": { "mode": "fixed", "fixedColor": "blue" }, "noValue": "\u2014", "decimals": 0, "min": 0, "displayName": "Category" }, "overrides": [ { "matcher": { "id": "byRegexp", "options": ".*" }, "properties": [ { "id": "displayName", "value": "" } ] } ] }, "targets": [ { "refId": "A", "datasource": { "type": "victoriametrics-logs-datasource", "uid": "${DS_VICTORIALOGS}" }, "expr": "log_type:=\"gateway-access\" gateway_name:in($gateway) authority:in($hostname) path:in($path) method:in($method) response_code:in($status) cf_connecting_ip_reported:in($visitor) | copy downstream_remote_address as peer_address | replace_regexp (\":([0-9]+)$\", \"\") at peer_address | replace_regexp (\"^\\\\[(.*)\\\\]$\", \"${1}\") at peer_address | format if (cf_country_reported:in(\"\", \"-\")) \"Unknown\" as cf_country_reported | format if (user_agent:in(\"\", \"-\")) \"Unknown\" as user_agent | format if (upstream_cluster:in(\"\", \"-\")) \"Unknown\" as upstream_cluster | format if (response_code_details:in(\"\", \"-\")) \"Unknown\" as response_code_details | format if (upstream_transport_failure_reason:in(\"\", \"-\")) \"Unknown\" as upstream_transport_failure_reason | filter peer_address:in($peer) cf_country_reported:in($country) user_agent:in($agent) upstream_cluster:in($backend) response_flags:in($flags) request_id:in(${request_id:json}) cf_ray:in(${ray_id:json}) | format \"Unknown\" as os | format if (user_agent:~\"(?i)(Linux|X11)\") \"Linux\" as os | format if (user_agent:~\"(?i)(Macintosh|Mac OS X)\") \"macOS\" as os | format if (user_agent:~\"(?i)Windows\") \"Windows\" as os | format if (user_agent:~\"(?i)CrOS\") \"ChromeOS\" as os | format if (user_agent:~\"(?i)Android\") \"Android\" as os | format if (user_agent:~\"(?i)(iPhone|iPad|iPod)\") \"iOS\" as os | stats by (os) count() as requests | sort by (requests) desc | limit 20", "queryType": "stats", "editorMode": "code", "legendFormat": "{{os}}", "maxLines": 20, "direction": "desc" } ], "options": { "reduceOptions": { "values": false, "calcs": [ "lastNotNull" ], "fields": "", "limit": 20 }, "orientation": "horizontal", "displayMode": "basic", "showUnfilled": true, "minVizHeight": 40, "minVizWidth": 0, "valueMode": "color", "namePlacement": "top", "maxVizHeight": 40, "sizing": "manual", "text": { "titleSize": 14, "valueSize": 14 } }, "transformations": [ { "id": "rowsToFields", "options": { "mappings": [ { "fieldName": "os", "handlerKey": "field.name" }, { "fieldName": "Value #A", "handlerKey": "field.value" } ] } } ] }, { "id": 26, "title": "Top user agents", "type": "bargauge", "datasource": { "type": "victoriametrics-logs-datasource", "uid": "${DS_VICTORIALOGS}" }, "description": "Raw reported User-Agent values, not verified browser/device identities or bot detection. Older records and missing headers appear as Unknown.", "gridPos": { "x": 16, "y": 21, "w": 8, "h": 10 }, "fieldConfig": { "defaults": { "unit": "short", "noValue": "\u2014", "color": { "mode": "fixed", "fixedColor": "blue" }, "decimals": 0, "min": 0, "displayName": "Category" }, "overrides": [ { "matcher": { "id": "byRegexp", "options": ".*" }, "properties": [ { "id": "displayName", "value": "" } ] } ] }, "targets": [ { "refId": "A", "datasource": { "type": "victoriametrics-logs-datasource", "uid": "${DS_VICTORIALOGS}" }, "expr": "log_type:=\"gateway-access\" gateway_name:in($gateway) authority:in($hostname) path:in($path) method:in($method) response_code:in($status) cf_connecting_ip_reported:in($visitor) | copy downstream_remote_address as peer_address | replace_regexp (\":([0-9]+)$\", \"\") at peer_address | replace_regexp (\"^\\\\[(.*)\\\\]$\", \"${1}\") at peer_address | format if (cf_country_reported:in(\"\", \"-\")) \"Unknown\" as cf_country_reported | format if (user_agent:in(\"\", \"-\")) \"Unknown\" as user_agent | format if (upstream_cluster:in(\"\", \"-\")) \"Unknown\" as upstream_cluster | format if (response_code_details:in(\"\", \"-\")) \"Unknown\" as response_code_details | format if (upstream_transport_failure_reason:in(\"\", \"-\")) \"Unknown\" as upstream_transport_failure_reason | filter peer_address:in($peer) cf_country_reported:in($country) user_agent:in($agent) upstream_cluster:in($backend) response_flags:in($flags) request_id:in(${request_id:json}) cf_ray:in(${ray_id:json}) | stats by (user_agent) count() as requests | sort by (requests) desc | limit 20", "queryType": "stats", "editorMode": "code", "legendFormat": "{{user_agent}}", "maxLines": 20, "direction": "desc" } ], "options": { "reduceOptions": { "values": false, "calcs": [ "lastNotNull" ], "fields": "", "limit": 20 }, "orientation": "horizontal", "displayMode": "basic", "showUnfilled": true, "minVizHeight": 40, "minVizWidth": 0, "valueMode": "color", "namePlacement": "top", "maxVizHeight": 40, "sizing": "manual", "text": { "titleSize": 14, "valueSize": 14 } }, "transformations": [ { "id": "rowsToFields", "options": { "mappings": [ { "fieldName": "user_agent", "handlerKey": "field.name" }, { "fieldName": "Value #A", "handlerKey": "field.value" } ] } } ] }, { "id": 51, "title": "Top HTTP versions", "type": "bargauge", "datasource": { "type": "victoriametrics-logs-datasource", "uid": "${DS_VICTORIALOGS}" }, "description": "Top 20 HTTP versions observed on the gateway connection, not necessarily the visitor-to-Cloudflare connection.", "gridPos": { "x": 0, "y": 31, "w": 8, "h": 10 }, "fieldConfig": { "defaults": { "unit": "short", "noValue": "\u2014", "color": { "mode": "fixed", "fixedColor": "blue" }, "decimals": 0, "min": 0, "displayName": "Category" }, "overrides": [ { "matcher": { "id": "byRegexp", "options": ".*" }, "properties": [ { "id": "displayName", "value": "" } ] } ] }, "targets": [ { "refId": "A", "datasource": { "type": "victoriametrics-logs-datasource", "uid": "${DS_VICTORIALOGS}" }, "expr": "log_type:=\"gateway-access\" gateway_name:in($gateway) authority:in($hostname) path:in($path) method:in($method) response_code:in($status) cf_connecting_ip_reported:in($visitor) | copy downstream_remote_address as peer_address | replace_regexp (\":([0-9]+)$\", \"\") at peer_address | replace_regexp (\"^\\\\[(.*)\\\\]$\", \"${1}\") at peer_address | format if (cf_country_reported:in(\"\", \"-\")) \"Unknown\" as cf_country_reported | format if (user_agent:in(\"\", \"-\")) \"Unknown\" as user_agent | format if (upstream_cluster:in(\"\", \"-\")) \"Unknown\" as upstream_cluster | format if (response_code_details:in(\"\", \"-\")) \"Unknown\" as response_code_details | format if (upstream_transport_failure_reason:in(\"\", \"-\")) \"Unknown\" as upstream_transport_failure_reason | filter peer_address:in($peer) cf_country_reported:in($country) user_agent:in($agent) upstream_cluster:in($backend) response_flags:in($flags) request_id:in(${request_id:json}) cf_ray:in(${ray_id:json}) | stats by (protocol) count() as requests | sort by (requests) desc | limit 20", "queryType": "stats", "editorMode": "code", "legendFormat": "{{protocol}}", "maxLines": 20, "direction": "desc" } ], "options": { "reduceOptions": { "values": false, "calcs": [ "lastNotNull" ], "fields": "", "limit": 20 }, "orientation": "horizontal", "displayMode": "basic", "showUnfilled": true, "minVizHeight": 40, "minVizWidth": 0, "valueMode": "color", "namePlacement": "top", "maxVizHeight": 40, "sizing": "manual", "text": { "titleSize": 14, "valueSize": 14 } }, "transformations": [ { "id": "rowsToFields", "options": { "mappings": [ { "fieldName": "protocol", "handlerKey": "field.name" }, { "fieldName": "Value #A", "handlerKey": "field.value" } ] } } ] }, { "id": 37, "title": "Top gateway status codes", "type": "bargauge", "datasource": { "type": "victoriametrics-logs-datasource", "uid": "${DS_VICTORIALOGS}" }, "description": "Top 20 response codes seen at the gateway, including responses generated by Envoy. Code 0 is No HTTP response. This is not Cloudflare edge-status data.", "gridPos": { "x": 8, "y": 31, "w": 8, "h": 10 }, "fieldConfig": { "defaults": { "unit": "short", "noValue": "\u2014", "color": { "mode": "fixed", "fixedColor": "blue" }, "decimals": 0, "min": 0, "displayName": "Category" }, "overrides": [ { "matcher": { "id": "byRegexp", "options": ".*" }, "properties": [ { "id": "displayName", "value": "" } ] } ] }, "targets": [ { "refId": "A", "datasource": { "type": "victoriametrics-logs-datasource", "uid": "${DS_VICTORIALOGS}" }, "expr": "log_type:=\"gateway-access\" gateway_name:in($gateway) authority:in($hostname) path:in($path) method:in($method) response_code:in($status) cf_connecting_ip_reported:in($visitor) | copy downstream_remote_address as peer_address | replace_regexp (\":([0-9]+)$\", \"\") at peer_address | replace_regexp (\"^\\\\[(.*)\\\\]$\", \"${1}\") at peer_address | format if (cf_country_reported:in(\"\", \"-\")) \"Unknown\" as cf_country_reported | format if (user_agent:in(\"\", \"-\")) \"Unknown\" as user_agent | format if (upstream_cluster:in(\"\", \"-\")) \"Unknown\" as upstream_cluster | format if (response_code_details:in(\"\", \"-\")) \"Unknown\" as response_code_details | format if (upstream_transport_failure_reason:in(\"\", \"-\")) \"Unknown\" as upstream_transport_failure_reason | filter peer_address:in($peer) cf_country_reported:in($country) user_agent:in($agent) upstream_cluster:in($backend) response_flags:in($flags) request_id:in(${request_id:json}) cf_ray:in(${ray_id:json}) | format \"\" as status_label | format if (response_code:=0) \"No HTTP response\" as status_label | format if (response_code:=101) \"101 Switching Protocols\" as status_label | format if (response_code:=200) \"200 OK\" as status_label | format if (response_code:=201) \"201 Created\" as status_label | format if (response_code:=204) \"204 No Content\" as status_label | format if (response_code:=301) \"301 Moved Permanently\" as status_label | format if (response_code:=302) \"302 Found\" as status_label | format if (response_code:=304) \"304 Not Modified\" as status_label | format if (response_code:=307) \"307 Temporary Redirect\" as status_label | format if (response_code:=308) \"308 Permanent Redirect\" as status_label | format if (response_code:=400) \"400 Bad Request\" as status_label | format if (response_code:=401) \"401 Unauthorized\" as status_label | format if (response_code:=403) \"403 Forbidden\" as status_label | format if (response_code:=404) \"404 Not Found\" as status_label | format if (response_code:=405) \"405 Method Not Allowed\" as status_label | format if (response_code:=408) \"408 Request Timeout\" as status_label | format if (response_code:=429) \"429 Too Many Requests\" as status_label | format if (response_code:=500) \"500 Internal Server Error\" as status_label | format if (response_code:=502) \"502 Bad Gateway\" as status_label | format if (response_code:=503) \"503 Service Unavailable\" as status_label | format if (response_code:=504) \"504 Gateway Timeout\" as status_label | stats by (status_label) count() as requests | sort by (requests) desc | limit 20", "queryType": "stats", "editorMode": "code", "legendFormat": "{{status_label}}", "maxLines": 20, "direction": "desc" } ], "options": { "reduceOptions": { "values": false, "calcs": [ "lastNotNull" ], "fields": "", "limit": 20 }, "orientation": "horizontal", "displayMode": "basic", "showUnfilled": true, "minVizHeight": 40, "minVizWidth": 0, "valueMode": "color", "namePlacement": "top", "maxVizHeight": 40, "sizing": "manual", "text": { "titleSize": 14, "valueSize": 14 } }, "transformations": [ { "id": "rowsToFields", "options": { "mappings": [ { "fieldName": "status_label", "handlerKey": "field.name" }, { "fieldName": "Value #A", "handlerKey": "field.value" } ] } } ] }, { "id": 49, "title": "Requests by device type (inferred)", "type": "piechart", "datasource": { "type": "victoriametrics-logs-datasource", "uid": "${DS_VICTORIALOGS}" }, "description": "Inferred from the reported User-Agent using broad patterns. Headers can be spoofed; Unknown includes old logs, missing headers and unrecognized clients. Bot/crawler means the user agent claims to be one, not verified bot detection.", "gridPos": { "x": 16, "y": 31, "w": 8, "h": 10 }, "fieldConfig": { "defaults": { "unit": "short", "color": { "mode": "palette-classic" }, "noValue": "\u2014" }, "overrides": [] }, "targets": [ { "refId": "A", "datasource": { "type": "victoriametrics-logs-datasource", "uid": "${DS_VICTORIALOGS}" }, "expr": "log_type:=\"gateway-access\" gateway_name:in($gateway) authority:in($hostname) path:in($path) method:in($method) response_code:in($status) cf_connecting_ip_reported:in($visitor) | copy downstream_remote_address as peer_address | replace_regexp (\":([0-9]+)$\", \"\") at peer_address | replace_regexp (\"^\\\\[(.*)\\\\]$\", \"${1}\") at peer_address | format if (cf_country_reported:in(\"\", \"-\")) \"Unknown\" as cf_country_reported | format if (user_agent:in(\"\", \"-\")) \"Unknown\" as user_agent | format if (upstream_cluster:in(\"\", \"-\")) \"Unknown\" as upstream_cluster | format if (response_code_details:in(\"\", \"-\")) \"Unknown\" as response_code_details | format if (upstream_transport_failure_reason:in(\"\", \"-\")) \"Unknown\" as upstream_transport_failure_reason | filter peer_address:in($peer) cf_country_reported:in($country) user_agent:in($agent) upstream_cluster:in($backend) response_flags:in($flags) request_id:in(${request_id:json}) cf_ray:in(${ray_id:json}) | format \"Unknown\" as device | format if (user_agent:~\"(?i)(Windows NT|Macintosh|X11|CrOS)\") \"Desktop\" as device | format if (user_agent:~\"(?i)(Mobile|Android|iPhone|iPod)\") \"Mobile\" as device | format if (user_agent:~\"(?i)(iPad|Tablet)\" OR (user_agent:~\"(?i)Android\" user_agent:!~\"(?i)Mobile\")) \"Tablet\" as device | format if (user_agent:~\"(?i)(bot|crawler|spider)\") \"Bot/crawler\" as device | format if (user_agent:~\"(?i)(curl/|Wget/|containerd/)\") \"Command-line client\" as device | stats by (device) count() as requests | sort by (requests) desc | limit 20", "queryType": "stats", "editorMode": "code", "legendFormat": "{{device}}", "maxLines": 20, "direction": "desc" } ], "options": { "reduceOptions": { "values": false, "calcs": [ "lastNotNull" ], "fields": "", "limit": 20 }, "pieType": "donut", "displayLabels": [ "name", "percent" ], "legend": { "displayMode": "table", "placement": "right", "showLegend": true, "values": [ "value", "percent" ] }, "tooltip": { "mode": "single", "sort": "desc" } }, "transformations": [ { "id": "rowsToFields", "options": { "mappings": [ { "fieldName": "device", "handlerKey": "field.name" }, { "fieldName": "Value #A", "handlerKey": "field.value" } ] } } ] }, { "id": 10, "type": "row", "title": "Traffic and endpoints", "collapsed": true, "gridPos": { "x": 0, "y": 41, "w": 24, "h": 1 }, "panels": [ { "id": 11, "title": "Request rate by gateway", "type": "timeseries", "datasource": { "type": "victoriametrics-logs-datasource", "uid": "${DS_VICTORIALOGS}" }, "description": "Recorded request completions per second.", "gridPos": { "x": 0, "y": 42, "w": 12, "h": 8 }, "fieldConfig": { "defaults": { "unit": "reqps", "noValue": "\u2014", "color": { "mode": "palette-classic" }, "custom": { "drawStyle": "line", "lineInterpolation": "linear", "lineWidth": 2, "fillOpacity": 10, "spanNulls": false, "showPoints": "never", "axisCenteredZero": false } }, "overrides": [] }, "targets": [ { "refId": "A", "datasource": { "type": "victoriametrics-logs-datasource", "uid": "${DS_VICTORIALOGS}" }, "expr": "log_type:=\"gateway-access\" gateway_name:in($gateway) authority:in($hostname) path:in($path) method:in($method) response_code:in($status) cf_connecting_ip_reported:in($visitor) | copy downstream_remote_address as peer_address | replace_regexp (\":([0-9]+)$\", \"\") at peer_address | replace_regexp (\"^\\\\[(.*)\\\\]$\", \"${1}\") at peer_address | format if (cf_country_reported:in(\"\", \"-\")) \"Unknown\" as cf_country_reported | format if (user_agent:in(\"\", \"-\")) \"Unknown\" as user_agent | format if (upstream_cluster:in(\"\", \"-\")) \"Unknown\" as upstream_cluster | format if (response_code_details:in(\"\", \"-\")) \"Unknown\" as response_code_details | format if (upstream_transport_failure_reason:in(\"\", \"-\")) \"Unknown\" as upstream_transport_failure_reason | filter peer_address:in($peer) cf_country_reported:in($country) user_agent:in($agent) upstream_cluster:in($backend) response_flags:in($flags) request_id:in(${request_id:json}) cf_ray:in(${ray_id:json}) | stats by (gateway_name) rate() as requests_per_second", "queryType": "statsRange", "editorMode": "code", "legendFormat": "{{gateway_name}}", "maxLines": 1000, "direction": "desc" } ], "interval": "30s", "options": { "legend": { "displayMode": "table", "placement": "bottom", "showLegend": true, "calcs": [ "lastNotNull", "max" ] }, "tooltip": { "mode": "multi", "sort": "desc" } } }, { "id": 12, "title": "Request rate by hostname", "type": "timeseries", "datasource": { "type": "victoriametrics-logs-datasource", "uid": "${DS_VICTORIALOGS}" }, "description": "Top 10 hostnames by requests over the selected range.", "gridPos": { "x": 12, "y": 42, "w": 12, "h": 8 }, "fieldConfig": { "defaults": { "unit": "reqps", "noValue": "\u2014", "color": { "mode": "palette-classic" }, "custom": { "drawStyle": "line", "lineInterpolation": "linear", "lineWidth": 2, "fillOpacity": 10, "spanNulls": false, "showPoints": "never", "axisCenteredZero": false } }, "overrides": [] }, "targets": [ { "refId": "A", "datasource": { "type": "victoriametrics-logs-datasource", "uid": "${DS_VICTORIALOGS}" }, "expr": "log_type:=\"gateway-access\" gateway_name:in($gateway) authority:in($hostname) path:in($path) method:in($method) response_code:in($status) cf_connecting_ip_reported:in($visitor) | copy downstream_remote_address as peer_address | replace_regexp (\":([0-9]+)$\", \"\") at peer_address | replace_regexp (\"^\\\\[(.*)\\\\]$\", \"${1}\") at peer_address | format if (cf_country_reported:in(\"\", \"-\")) \"Unknown\" as cf_country_reported | format if (user_agent:in(\"\", \"-\")) \"Unknown\" as user_agent | format if (upstream_cluster:in(\"\", \"-\")) \"Unknown\" as upstream_cluster | format if (response_code_details:in(\"\", \"-\")) \"Unknown\" as response_code_details | format if (upstream_transport_failure_reason:in(\"\", \"-\")) \"Unknown\" as upstream_transport_failure_reason | filter peer_address:in($peer) cf_country_reported:in($country) user_agent:in($agent) upstream_cluster:in($backend) response_flags:in($flags) request_id:in(${request_id:json}) cf_ray:in(${ray_id:json}) | filter authority:in(log_type:=\"gateway-access\" gateway_name:in($gateway) authority:in($hostname) path:in($path) method:in($method) response_code:in($status) cf_connecting_ip_reported:in($visitor) | copy downstream_remote_address as peer_address | replace_regexp (\":([0-9]+)$\", \"\") at peer_address | replace_regexp (\"^\\\\[(.*)\\\\]$\", \"${1}\") at peer_address | format if (cf_country_reported:in(\"\", \"-\")) \"Unknown\" as cf_country_reported | format if (user_agent:in(\"\", \"-\")) \"Unknown\" as user_agent | format if (upstream_cluster:in(\"\", \"-\")) \"Unknown\" as upstream_cluster | format if (response_code_details:in(\"\", \"-\")) \"Unknown\" as response_code_details | format if (upstream_transport_failure_reason:in(\"\", \"-\")) \"Unknown\" as upstream_transport_failure_reason | filter peer_address:in($peer) cf_country_reported:in($country) user_agent:in($agent) upstream_cluster:in($backend) response_flags:in($flags) request_id:in(${request_id:json}) cf_ray:in(${ray_id:json}) | stats by (authority) count() as requests | sort by (requests) desc | limit 10 | fields authority) | stats by (authority) rate() as requests_per_second", "queryType": "statsRange", "editorMode": "code", "legendFormat": "{{authority}}", "maxLines": 1000, "direction": "desc" } ], "interval": "30s", "options": { "legend": { "displayMode": "table", "placement": "bottom", "showLegend": true, "calcs": [ "lastNotNull", "max" ] }, "tooltip": { "mode": "multi", "sort": "desc" } } }, { "id": 13, "title": "Request rate by method", "type": "timeseries", "datasource": { "type": "victoriametrics-logs-datasource", "uid": "${DS_VICTORIALOGS}" }, "description": "HTTP method distribution over time.", "gridPos": { "x": 0, "y": 50, "w": 12, "h": 8 }, "fieldConfig": { "defaults": { "unit": "reqps", "noValue": "\u2014", "color": { "mode": "palette-classic" }, "custom": { "drawStyle": "line", "lineInterpolation": "linear", "lineWidth": 2, "fillOpacity": 10, "spanNulls": false, "showPoints": "never", "axisCenteredZero": false } }, "overrides": [] }, "targets": [ { "refId": "A", "datasource": { "type": "victoriametrics-logs-datasource", "uid": "${DS_VICTORIALOGS}" }, "expr": "log_type:=\"gateway-access\" gateway_name:in($gateway) authority:in($hostname) path:in($path) method:in($method) response_code:in($status) cf_connecting_ip_reported:in($visitor) | copy downstream_remote_address as peer_address | replace_regexp (\":([0-9]+)$\", \"\") at peer_address | replace_regexp (\"^\\\\[(.*)\\\\]$\", \"${1}\") at peer_address | format if (cf_country_reported:in(\"\", \"-\")) \"Unknown\" as cf_country_reported | format if (user_agent:in(\"\", \"-\")) \"Unknown\" as user_agent | format if (upstream_cluster:in(\"\", \"-\")) \"Unknown\" as upstream_cluster | format if (response_code_details:in(\"\", \"-\")) \"Unknown\" as response_code_details | format if (upstream_transport_failure_reason:in(\"\", \"-\")) \"Unknown\" as upstream_transport_failure_reason | filter peer_address:in($peer) cf_country_reported:in($country) user_agent:in($agent) upstream_cluster:in($backend) response_flags:in($flags) request_id:in(${request_id:json}) cf_ray:in(${ray_id:json}) | stats by (method) rate() as requests_per_second", "queryType": "statsRange", "editorMode": "code", "legendFormat": "{{method}}", "maxLines": 1000, "direction": "desc" } ], "interval": "30s", "options": { "legend": { "displayMode": "table", "placement": "bottom", "showLegend": true, "calcs": [ "lastNotNull", "max" ] }, "tooltip": { "mode": "multi", "sort": "desc" } } }, { "id": 14, "title": "Request rate by HTTP protocol", "type": "timeseries", "datasource": { "type": "victoriametrics-logs-datasource", "uid": "${DS_VICTORIALOGS}" }, "description": "Protocol observed on the gateway connection, not necessarily the original visitor-to-Cloudflare protocol.", "gridPos": { "x": 12, "y": 50, "w": 12, "h": 8 }, "fieldConfig": { "defaults": { "unit": "reqps", "noValue": "\u2014", "color": { "mode": "palette-classic" }, "custom": { "drawStyle": "line", "lineInterpolation": "linear", "lineWidth": 2, "fillOpacity": 10, "spanNulls": false, "showPoints": "never", "axisCenteredZero": false } }, "overrides": [] }, "targets": [ { "refId": "A", "datasource": { "type": "victoriametrics-logs-datasource", "uid": "${DS_VICTORIALOGS}" }, "expr": "log_type:=\"gateway-access\" gateway_name:in($gateway) authority:in($hostname) path:in($path) method:in($method) response_code:in($status) cf_connecting_ip_reported:in($visitor) | copy downstream_remote_address as peer_address | replace_regexp (\":([0-9]+)$\", \"\") at peer_address | replace_regexp (\"^\\\\[(.*)\\\\]$\", \"${1}\") at peer_address | format if (cf_country_reported:in(\"\", \"-\")) \"Unknown\" as cf_country_reported | format if (user_agent:in(\"\", \"-\")) \"Unknown\" as user_agent | format if (upstream_cluster:in(\"\", \"-\")) \"Unknown\" as upstream_cluster | format if (response_code_details:in(\"\", \"-\")) \"Unknown\" as response_code_details | format if (upstream_transport_failure_reason:in(\"\", \"-\")) \"Unknown\" as upstream_transport_failure_reason | filter peer_address:in($peer) cf_country_reported:in($country) user_agent:in($agent) upstream_cluster:in($backend) response_flags:in($flags) request_id:in(${request_id:json}) cf_ray:in(${ray_id:json}) | stats by (protocol) rate() as requests_per_second", "queryType": "statsRange", "editorMode": "code", "legendFormat": "{{protocol}}", "maxLines": 1000, "direction": "desc" } ], "interval": "30s", "options": { "legend": { "displayMode": "table", "placement": "bottom", "showLegend": true, "calcs": [ "lastNotNull", "max" ] }, "tooltip": { "mode": "multi", "sort": "desc" } } }, { "id": 15, "title": "HTTP body byte rate", "type": "timeseries", "datasource": { "type": "victoriametrics-logs-datasource", "uid": "${DS_VICTORIALOGS}" }, "description": "Logged body-byte rates at request completion, not instantaneous wire bandwidth. Long transfers appear when their access records arrive.", "gridPos": { "x": 0, "y": 58, "w": 12, "h": 8 }, "fieldConfig": { "defaults": { "unit": "Bps", "noValue": "\u2014", "color": { "mode": "palette-classic" }, "custom": { "drawStyle": "line", "lineInterpolation": "linear", "lineWidth": 2, "fillOpacity": 10, "spanNulls": false, "showPoints": "never", "axisCenteredZero": false } }, "overrides": [] }, "targets": [ { "refId": "A", "datasource": { "type": "victoriametrics-logs-datasource", "uid": "${DS_VICTORIALOGS}" }, "expr": "log_type:=\"gateway-access\" gateway_name:in($gateway) authority:in($hostname) path:in($path) method:in($method) response_code:in($status) cf_connecting_ip_reported:in($visitor) | copy downstream_remote_address as peer_address | replace_regexp (\":([0-9]+)$\", \"\") at peer_address | replace_regexp (\"^\\\\[(.*)\\\\]$\", \"${1}\") at peer_address | format if (cf_country_reported:in(\"\", \"-\")) \"Unknown\" as cf_country_reported | format if (user_agent:in(\"\", \"-\")) \"Unknown\" as user_agent | format if (upstream_cluster:in(\"\", \"-\")) \"Unknown\" as upstream_cluster | format if (response_code_details:in(\"\", \"-\")) \"Unknown\" as response_code_details | format if (upstream_transport_failure_reason:in(\"\", \"-\")) \"Unknown\" as upstream_transport_failure_reason | filter peer_address:in($peer) cf_country_reported:in($country) user_agent:in($agent) upstream_cluster:in($backend) response_flags:in($flags) request_id:in(${request_id:json}) cf_ray:in(${ray_id:json}) | stats rate_sum(bytes_sent) as response_bytes_per_second, rate_sum(bytes_received) as request_bytes_per_second", "queryType": "statsRange", "editorMode": "code", "legendFormat": "{{__name__}}", "maxLines": 1000, "direction": "desc" } ], "interval": "30s", "options": { "legend": { "displayMode": "table", "placement": "bottom", "showLegend": true, "calcs": [ "lastNotNull", "max" ] }, "tooltip": { "mode": "multi", "sort": "desc" } } }, { "id": 16, "title": "Hostname summary", "type": "table", "datasource": { "type": "victoriametrics-logs-datasource", "uid": "${DS_VICTORIALOGS}" }, "description": "Top 20 hostnames. IP counts cover reported public addresses only; duration includes long-lived requests.", "gridPos": { "x": 12, "y": 58, "w": 12, "h": 8 }, "fieldConfig": { "defaults": { "unit": "none", "noValue": "\u2014", "color": { "mode": "palette-classic" } }, "overrides": [ { "matcher": { "id": "byName", "options": "Hostname" }, "properties": [ { "id": "links", "value": [ { "title": "Filter Hostname", "url": "/d/http-traffic/http-traffic?${__url_time_range}&${gateway:queryparam}&${path:queryparam}&${method:queryparam}&${status:queryparam}&${visitor:queryparam}&${peer:queryparam}&${country:queryparam}&${agent:queryparam}&${backend:queryparam}&${flags:queryparam}&${request_id:queryparam}&${ray_id:queryparam}&var-hostname=${__value.raw:percentencode}", "targetBlank": false } ] } ] }, { "matcher": { "id": "byName", "options": "Requests" }, "properties": [ { "id": "unit", "value": "short" }, { "id": "decimals", "value": 0 } ] }, { "matcher": { "id": "byName", "options": "Reported IPs" }, "properties": [ { "id": "unit", "value": "short" }, { "id": "decimals", "value": 0 } ] }, { "matcher": { "id": "byName", "options": "Response body bytes" }, "properties": [ { "id": "unit", "value": "bytes" }, { "id": "decimals", "value": 0 } ] }, { "matcher": { "id": "byName", "options": "p95 duration" }, "properties": [ { "id": "unit", "value": "ms" }, { "id": "decimals", "value": 0 } ] } ] }, "targets": [ { "refId": "A", "datasource": { "type": "victoriametrics-logs-datasource", "uid": "${DS_VICTORIALOGS}" }, "expr": "log_type:=\"gateway-access\" gateway_name:in($gateway) authority:in($hostname) path:in($path) method:in($method) response_code:in($status) cf_connecting_ip_reported:in($visitor) | copy downstream_remote_address as peer_address | replace_regexp (\":([0-9]+)$\", \"\") at peer_address | replace_regexp (\"^\\\\[(.*)\\\\]$\", \"${1}\") at peer_address | format if (cf_country_reported:in(\"\", \"-\")) \"Unknown\" as cf_country_reported | format if (user_agent:in(\"\", \"-\")) \"Unknown\" as user_agent | format if (upstream_cluster:in(\"\", \"-\")) \"Unknown\" as upstream_cluster | format if (response_code_details:in(\"\", \"-\")) \"Unknown\" as response_code_details | format if (upstream_transport_failure_reason:in(\"\", \"-\")) \"Unknown\" as upstream_transport_failure_reason | filter peer_address:in($peer) cf_country_reported:in($country) user_agent:in($agent) upstream_cluster:in($backend) response_flags:in($flags) request_id:in(${request_id:json}) cf_ray:in(${ray_id:json}) | stats by (authority) count() as requests, count_uniq(cf_connecting_ip_reported) if (gateway_name:=\"cloudflare-gateway\" cf_connecting_ip_reported:!=\"\" cf_connecting_ip_reported:!=\"-\") as addresses, sum(bytes_sent) as response_bytes, quantile(0.95, duration_ms) as p95_ms | sort by (requests) desc | limit 20", "queryType": "instant", "editorMode": "code", "legendFormat": "{{__name__}}", "maxLines": 20, "direction": "desc" } ], "options": { "showHeader": true, "cellHeight": "sm", "footer": { "show": false }, "sortBy": [ { "displayName": "Requests", "desc": true } ] }, "transformations": [ { "id": "extractFields", "options": { "source": "labels", "format": "json", "replace": true, "keepTime": false } }, { "id": "convertFieldType", "options": { "conversions": [ { "targetField": "requests", "destinationType": "number" }, { "targetField": "addresses", "destinationType": "number" }, { "targetField": "response_bytes", "destinationType": "number" }, { "targetField": "p95_ms", "destinationType": "number" } ], "fields": {} } }, { "id": "organize", "options": { "excludeByName": {}, "includeByName": { "authority": true, "requests": true, "addresses": true, "response_bytes": true, "p95_ms": true }, "indexByName": { "authority": 0, "requests": 1, "addresses": 2, "response_bytes": 3, "p95_ms": 4 }, "renameByName": { "authority": "Hostname", "requests": "Requests", "addresses": "Reported IPs", "response_bytes": "Response body bytes", "p95_ms": "p95 duration" } } } ] }, { "id": 17, "title": "Busiest endpoints", "type": "table", "datasource": { "type": "victoriametrics-logs-datasource", "uid": "${DS_VICTORIALOGS}" }, "description": "Top 20 hostname/path combinations. Click a hostname or path to filter this dashboard.", "gridPos": { "x": 0, "y": 66, "w": 12, "h": 8 }, "fieldConfig": { "defaults": { "unit": "none", "noValue": "\u2014", "color": { "mode": "palette-classic" } }, "overrides": [ { "matcher": { "id": "byName", "options": "Hostname" }, "properties": [ { "id": "links", "value": [ { "title": "Filter Hostname", "url": "/d/http-traffic/http-traffic?${__url_time_range}&${gateway:queryparam}&${path:queryparam}&${method:queryparam}&${status:queryparam}&${visitor:queryparam}&${peer:queryparam}&${country:queryparam}&${agent:queryparam}&${backend:queryparam}&${flags:queryparam}&${request_id:queryparam}&${ray_id:queryparam}&var-hostname=${__value.raw:percentencode}", "targetBlank": false } ] } ] }, { "matcher": { "id": "byName", "options": "Path" }, "properties": [ { "id": "links", "value": [ { "title": "Filter Path", "url": "/d/http-traffic/http-traffic?${__url_time_range}&${gateway:queryparam}&${hostname:queryparam}&${method:queryparam}&${status:queryparam}&${visitor:queryparam}&${peer:queryparam}&${country:queryparam}&${agent:queryparam}&${backend:queryparam}&${flags:queryparam}&${request_id:queryparam}&${ray_id:queryparam}&var-path=${__value.raw:percentencode}", "targetBlank": false } ] } ] }, { "matcher": { "id": "byName", "options": "Requests" }, "properties": [ { "id": "unit", "value": "short" }, { "id": "decimals", "value": 0 } ] } ] }, "targets": [ { "refId": "A", "datasource": { "type": "victoriametrics-logs-datasource", "uid": "${DS_VICTORIALOGS}" }, "expr": "log_type:=\"gateway-access\" gateway_name:in($gateway) authority:in($hostname) path:in($path) method:in($method) response_code:in($status) cf_connecting_ip_reported:in($visitor) | copy downstream_remote_address as peer_address | replace_regexp (\":([0-9]+)$\", \"\") at peer_address | replace_regexp (\"^\\\\[(.*)\\\\]$\", \"${1}\") at peer_address | format if (cf_country_reported:in(\"\", \"-\")) \"Unknown\" as cf_country_reported | format if (user_agent:in(\"\", \"-\")) \"Unknown\" as user_agent | format if (upstream_cluster:in(\"\", \"-\")) \"Unknown\" as upstream_cluster | format if (response_code_details:in(\"\", \"-\")) \"Unknown\" as response_code_details | format if (upstream_transport_failure_reason:in(\"\", \"-\")) \"Unknown\" as upstream_transport_failure_reason | filter peer_address:in($peer) cf_country_reported:in($country) user_agent:in($agent) upstream_cluster:in($backend) response_flags:in($flags) request_id:in(${request_id:json}) cf_ray:in(${ray_id:json}) | stats by (authority, path) count() as requests | sort by (requests) desc | limit 20", "queryType": "instant", "editorMode": "code", "legendFormat": "{{__name__}}", "maxLines": 20, "direction": "desc" } ], "options": { "showHeader": true, "cellHeight": "sm", "footer": { "show": false }, "sortBy": [ { "displayName": "Requests", "desc": true } ] }, "transformations": [ { "id": "extractFields", "options": { "source": "labels", "format": "json", "replace": true, "keepTime": false } }, { "id": "convertFieldType", "options": { "conversions": [ { "targetField": "requests", "destinationType": "number" } ], "fields": {} } }, { "id": "organize", "options": { "excludeByName": {}, "includeByName": { "authority": true, "path": true, "requests": true }, "indexByName": { "authority": 0, "path": 1, "requests": 2 }, "renameByName": { "authority": "Hostname", "path": "Path", "requests": "Requests" } } } ] }, { "id": 18, "title": "Endpoints by response body bytes", "type": "table", "datasource": { "type": "victoriametrics-logs-datasource", "uid": "${DS_VICTORIALOGS}" }, "description": "Top 20 endpoints by logged response body bytes.", "gridPos": { "x": 12, "y": 66, "w": 12, "h": 8 }, "fieldConfig": { "defaults": { "unit": "none", "noValue": "\u2014", "color": { "mode": "palette-classic" } }, "overrides": [ { "matcher": { "id": "byName", "options": "Hostname" }, "properties": [ { "id": "links", "value": [ { "title": "Filter Hostname", "url": "/d/http-traffic/http-traffic?${__url_time_range}&${gateway:queryparam}&${path:queryparam}&${method:queryparam}&${status:queryparam}&${visitor:queryparam}&${peer:queryparam}&${country:queryparam}&${agent:queryparam}&${backend:queryparam}&${flags:queryparam}&${request_id:queryparam}&${ray_id:queryparam}&var-hostname=${__value.raw:percentencode}", "targetBlank": false } ] } ] }, { "matcher": { "id": "byName", "options": "Path" }, "properties": [ { "id": "links", "value": [ { "title": "Filter Path", "url": "/d/http-traffic/http-traffic?${__url_time_range}&${gateway:queryparam}&${hostname:queryparam}&${method:queryparam}&${status:queryparam}&${visitor:queryparam}&${peer:queryparam}&${country:queryparam}&${agent:queryparam}&${backend:queryparam}&${flags:queryparam}&${request_id:queryparam}&${ray_id:queryparam}&var-path=${__value.raw:percentencode}", "targetBlank": false } ] } ] }, { "matcher": { "id": "byName", "options": "Requests" }, "properties": [ { "id": "unit", "value": "short" }, { "id": "decimals", "value": 0 } ] }, { "matcher": { "id": "byName", "options": "Response body bytes" }, "properties": [ { "id": "unit", "value": "bytes" }, { "id": "decimals", "value": 0 } ] } ] }, "targets": [ { "refId": "A", "datasource": { "type": "victoriametrics-logs-datasource", "uid": "${DS_VICTORIALOGS}" }, "expr": "log_type:=\"gateway-access\" gateway_name:in($gateway) authority:in($hostname) path:in($path) method:in($method) response_code:in($status) cf_connecting_ip_reported:in($visitor) | copy downstream_remote_address as peer_address | replace_regexp (\":([0-9]+)$\", \"\") at peer_address | replace_regexp (\"^\\\\[(.*)\\\\]$\", \"${1}\") at peer_address | format if (cf_country_reported:in(\"\", \"-\")) \"Unknown\" as cf_country_reported | format if (user_agent:in(\"\", \"-\")) \"Unknown\" as user_agent | format if (upstream_cluster:in(\"\", \"-\")) \"Unknown\" as upstream_cluster | format if (response_code_details:in(\"\", \"-\")) \"Unknown\" as response_code_details | format if (upstream_transport_failure_reason:in(\"\", \"-\")) \"Unknown\" as upstream_transport_failure_reason | filter peer_address:in($peer) cf_country_reported:in($country) user_agent:in($agent) upstream_cluster:in($backend) response_flags:in($flags) request_id:in(${request_id:json}) cf_ray:in(${ray_id:json}) | stats by (authority, path) count() as requests, sum(bytes_sent) as response_bytes | sort by (response_bytes) desc | limit 20", "queryType": "instant", "editorMode": "code", "legendFormat": "{{__name__}}", "maxLines": 20, "direction": "desc" } ], "options": { "showHeader": true, "cellHeight": "sm", "footer": { "show": false }, "sortBy": [ { "displayName": "Response body bytes", "desc": true } ] }, "transformations": [ { "id": "extractFields", "options": { "source": "labels", "format": "json", "replace": true, "keepTime": false } }, { "id": "convertFieldType", "options": { "conversions": [ { "targetField": "requests", "destinationType": "number" }, { "targetField": "response_bytes", "destinationType": "number" } ], "fields": {} } }, { "id": "organize", "options": { "excludeByName": {}, "includeByName": { "authority": true, "path": true, "requests": true, "response_bytes": true }, "indexByName": { "authority": 0, "path": 1, "requests": 2, "response_bytes": 3 }, "renameByName": { "authority": "Hostname", "path": "Path", "requests": "Requests", "response_bytes": "Response body bytes" } } } ] } ] }, { "id": 19, "type": "row", "title": "Visitors", "collapsed": true, "gridPos": { "x": 0, "y": 42, "w": 24, "h": 1 }, "panels": [ { "id": 20, "title": "Distinct reported public IPs", "type": "timeseries", "datasource": { "type": "victoriametrics-logs-datasource", "uid": "${DS_VICTORIALOGS}" }, "description": "Distinct reported public addresses per time bucket; the same address may appear in several buckets.", "gridPos": { "x": 0, "y": 43, "w": 12, "h": 8 }, "fieldConfig": { "defaults": { "unit": "short", "noValue": "\u2014", "color": { "mode": "palette-classic" }, "custom": { "drawStyle": "line", "lineInterpolation": "linear", "lineWidth": 2, "fillOpacity": 10, "spanNulls": false, "showPoints": "never", "axisCenteredZero": false } }, "overrides": [] }, "targets": [ { "refId": "A", "datasource": { "type": "victoriametrics-logs-datasource", "uid": "${DS_VICTORIALOGS}" }, "expr": "log_type:=\"gateway-access\" gateway_name:in($gateway) authority:in($hostname) path:in($path) method:in($method) response_code:in($status) cf_connecting_ip_reported:in($visitor) | copy downstream_remote_address as peer_address | replace_regexp (\":([0-9]+)$\", \"\") at peer_address | replace_regexp (\"^\\\\[(.*)\\\\]$\", \"${1}\") at peer_address | format if (cf_country_reported:in(\"\", \"-\")) \"Unknown\" as cf_country_reported | format if (user_agent:in(\"\", \"-\")) \"Unknown\" as user_agent | format if (upstream_cluster:in(\"\", \"-\")) \"Unknown\" as upstream_cluster | format if (response_code_details:in(\"\", \"-\")) \"Unknown\" as response_code_details | format if (upstream_transport_failure_reason:in(\"\", \"-\")) \"Unknown\" as upstream_transport_failure_reason | filter peer_address:in($peer) cf_country_reported:in($country) user_agent:in($agent) upstream_cluster:in($backend) response_flags:in($flags) request_id:in(${request_id:json}) cf_ray:in(${ray_id:json}) | filter gateway_name:=\"cloudflare-gateway\" cf_connecting_ip_reported:!=\"\" cf_connecting_ip_reported:!=\"-\" | stats count_uniq(cf_connecting_ip_reported) as addresses", "queryType": "statsRange", "editorMode": "code", "legendFormat": "{{__name__}}", "maxLines": 1000, "direction": "desc" } ], "interval": "30s", "options": { "legend": { "displayMode": "table", "placement": "bottom", "showLegend": true, "calcs": [ "lastNotNull", "max" ] }, "tooltip": { "mode": "multi", "sort": "desc" } } }, { "id": 21, "title": "Public request rate by reported country", "type": "timeseries", "datasource": { "type": "victoriametrics-logs-datasource", "uid": "${DS_VICTORIALOGS}" }, "description": "Top 10 reported countries over the selected range. Unknown means the header was absent; XX means unknown country and T1 means Tor.", "gridPos": { "x": 12, "y": 43, "w": 12, "h": 8 }, "fieldConfig": { "defaults": { "unit": "reqps", "noValue": "\u2014", "color": { "mode": "palette-classic" }, "custom": { "drawStyle": "line", "lineInterpolation": "linear", "lineWidth": 2, "fillOpacity": 10, "spanNulls": false, "showPoints": "never", "axisCenteredZero": false } }, "overrides": [] }, "targets": [ { "refId": "A", "datasource": { "type": "victoriametrics-logs-datasource", "uid": "${DS_VICTORIALOGS}" }, "expr": "log_type:=\"gateway-access\" gateway_name:in($gateway) authority:in($hostname) path:in($path) method:in($method) response_code:in($status) cf_connecting_ip_reported:in($visitor) | copy downstream_remote_address as peer_address | replace_regexp (\":([0-9]+)$\", \"\") at peer_address | replace_regexp (\"^\\\\[(.*)\\\\]$\", \"${1}\") at peer_address | format if (cf_country_reported:in(\"\", \"-\")) \"Unknown\" as cf_country_reported | format if (user_agent:in(\"\", \"-\")) \"Unknown\" as user_agent | format if (upstream_cluster:in(\"\", \"-\")) \"Unknown\" as upstream_cluster | format if (response_code_details:in(\"\", \"-\")) \"Unknown\" as response_code_details | format if (upstream_transport_failure_reason:in(\"\", \"-\")) \"Unknown\" as upstream_transport_failure_reason | filter peer_address:in($peer) cf_country_reported:in($country) user_agent:in($agent) upstream_cluster:in($backend) response_flags:in($flags) request_id:in(${request_id:json}) cf_ray:in(${ray_id:json}) | filter gateway_name:=\"cloudflare-gateway\" | filter cf_country_reported:in(log_type:=\"gateway-access\" gateway_name:in($gateway) authority:in($hostname) path:in($path) method:in($method) response_code:in($status) cf_connecting_ip_reported:in($visitor) | copy downstream_remote_address as peer_address | replace_regexp (\":([0-9]+)$\", \"\") at peer_address | replace_regexp (\"^\\\\[(.*)\\\\]$\", \"${1}\") at peer_address | format if (cf_country_reported:in(\"\", \"-\")) \"Unknown\" as cf_country_reported | format if (user_agent:in(\"\", \"-\")) \"Unknown\" as user_agent | format if (upstream_cluster:in(\"\", \"-\")) \"Unknown\" as upstream_cluster | format if (response_code_details:in(\"\", \"-\")) \"Unknown\" as response_code_details | format if (upstream_transport_failure_reason:in(\"\", \"-\")) \"Unknown\" as upstream_transport_failure_reason | filter peer_address:in($peer) cf_country_reported:in($country) user_agent:in($agent) upstream_cluster:in($backend) response_flags:in($flags) request_id:in(${request_id:json}) cf_ray:in(${ray_id:json}) | filter gateway_name:=\"cloudflare-gateway\" | stats by (cf_country_reported) count() as requests | sort by (requests) desc | limit 10 | fields cf_country_reported) | stats by (cf_country_reported) rate() as requests_per_second", "queryType": "statsRange", "editorMode": "code", "legendFormat": "{{cf_country_reported}}", "maxLines": 1000, "direction": "desc" } ], "interval": "30s", "options": { "legend": { "displayMode": "table", "placement": "bottom", "showLegend": true, "calcs": [ "lastNotNull", "max" ] }, "tooltip": { "mode": "multi", "sort": "desc" } } }, { "id": 23, "title": "Reported public visitor IPs", "type": "table", "datasource": { "type": "victoriametrics-logs-datasource", "uid": "${DS_VICTORIALOGS}" }, "description": "Top 20 reported public IPs; these are not authenticated visitor identities or unique people.", "gridPos": { "x": 0, "y": 51, "w": 12, "h": 8 }, "fieldConfig": { "defaults": { "unit": "none", "noValue": "\u2014", "color": { "mode": "palette-classic" } }, "overrides": [ { "matcher": { "id": "byName", "options": "Reported visitor IP" }, "properties": [ { "id": "links", "value": [ { "title": "Filter Reported visitor IP", "url": "/d/http-traffic/http-traffic?${__url_time_range}&${gateway:queryparam}&${hostname:queryparam}&${path:queryparam}&${method:queryparam}&${status:queryparam}&${peer:queryparam}&${country:queryparam}&${agent:queryparam}&${backend:queryparam}&${flags:queryparam}&${request_id:queryparam}&${ray_id:queryparam}&var-visitor=${__value.raw:percentencode}", "targetBlank": false } ] } ] }, { "matcher": { "id": "byName", "options": "Requests" }, "properties": [ { "id": "unit", "value": "short" }, { "id": "decimals", "value": 0 } ] } ] }, "targets": [ { "refId": "A", "datasource": { "type": "victoriametrics-logs-datasource", "uid": "${DS_VICTORIALOGS}" }, "expr": "log_type:=\"gateway-access\" gateway_name:in($gateway) authority:in($hostname) path:in($path) method:in($method) response_code:in($status) cf_connecting_ip_reported:in($visitor) | copy downstream_remote_address as peer_address | replace_regexp (\":([0-9]+)$\", \"\") at peer_address | replace_regexp (\"^\\\\[(.*)\\\\]$\", \"${1}\") at peer_address | format if (cf_country_reported:in(\"\", \"-\")) \"Unknown\" as cf_country_reported | format if (user_agent:in(\"\", \"-\")) \"Unknown\" as user_agent | format if (upstream_cluster:in(\"\", \"-\")) \"Unknown\" as upstream_cluster | format if (response_code_details:in(\"\", \"-\")) \"Unknown\" as response_code_details | format if (upstream_transport_failure_reason:in(\"\", \"-\")) \"Unknown\" as upstream_transport_failure_reason | filter peer_address:in($peer) cf_country_reported:in($country) user_agent:in($agent) upstream_cluster:in($backend) response_flags:in($flags) request_id:in(${request_id:json}) cf_ray:in(${ray_id:json}) | filter gateway_name:=\"cloudflare-gateway\" cf_connecting_ip_reported:!=\"\" cf_connecting_ip_reported:!=\"-\" | stats by (cf_connecting_ip_reported) count() as requests | sort by (requests) desc | limit 20", "queryType": "instant", "editorMode": "code", "legendFormat": "{{__name__}}", "maxLines": 20, "direction": "desc" } ], "options": { "showHeader": true, "cellHeight": "sm", "footer": { "show": false }, "sortBy": [ { "displayName": "Requests", "desc": true } ] }, "transformations": [ { "id": "extractFields", "options": { "source": "labels", "format": "json", "replace": true, "keepTime": false } }, { "id": "convertFieldType", "options": { "conversions": [ { "targetField": "requests", "destinationType": "number" } ], "fields": {} } }, { "id": "organize", "options": { "excludeByName": {}, "includeByName": { "cf_connecting_ip_reported": true, "requests": true }, "indexByName": { "cf_connecting_ip_reported": 0, "requests": 1 }, "renameByName": { "cf_connecting_ip_reported": "Reported visitor IP", "requests": "Requests" } } } ] }, { "id": 24, "title": "Reported IPs by hostname", "type": "table", "datasource": { "type": "victoriametrics-logs-datasource", "uid": "${DS_VICTORIALOGS}" }, "description": "Which hostnames each reported public address requested.", "gridPos": { "x": 12, "y": 51, "w": 12, "h": 8 }, "fieldConfig": { "defaults": { "unit": "none", "noValue": "\u2014", "color": { "mode": "palette-classic" } }, "overrides": [ { "matcher": { "id": "byName", "options": "Reported visitor IP" }, "properties": [ { "id": "links", "value": [ { "title": "Filter Reported visitor IP", "url": "/d/http-traffic/http-traffic?${__url_time_range}&${gateway:queryparam}&${hostname:queryparam}&${path:queryparam}&${method:queryparam}&${status:queryparam}&${peer:queryparam}&${country:queryparam}&${agent:queryparam}&${backend:queryparam}&${flags:queryparam}&${request_id:queryparam}&${ray_id:queryparam}&var-visitor=${__value.raw:percentencode}", "targetBlank": false } ] } ] }, { "matcher": { "id": "byName", "options": "Hostname" }, "properties": [ { "id": "links", "value": [ { "title": "Filter Hostname", "url": "/d/http-traffic/http-traffic?${__url_time_range}&${gateway:queryparam}&${path:queryparam}&${method:queryparam}&${status:queryparam}&${visitor:queryparam}&${peer:queryparam}&${country:queryparam}&${agent:queryparam}&${backend:queryparam}&${flags:queryparam}&${request_id:queryparam}&${ray_id:queryparam}&var-hostname=${__value.raw:percentencode}", "targetBlank": false } ] } ] }, { "matcher": { "id": "byName", "options": "Requests" }, "properties": [ { "id": "unit", "value": "short" }, { "id": "decimals", "value": 0 } ] } ] }, "targets": [ { "refId": "A", "datasource": { "type": "victoriametrics-logs-datasource", "uid": "${DS_VICTORIALOGS}" }, "expr": "log_type:=\"gateway-access\" gateway_name:in($gateway) authority:in($hostname) path:in($path) method:in($method) response_code:in($status) cf_connecting_ip_reported:in($visitor) | copy downstream_remote_address as peer_address | replace_regexp (\":([0-9]+)$\", \"\") at peer_address | replace_regexp (\"^\\\\[(.*)\\\\]$\", \"${1}\") at peer_address | format if (cf_country_reported:in(\"\", \"-\")) \"Unknown\" as cf_country_reported | format if (user_agent:in(\"\", \"-\")) \"Unknown\" as user_agent | format if (upstream_cluster:in(\"\", \"-\")) \"Unknown\" as upstream_cluster | format if (response_code_details:in(\"\", \"-\")) \"Unknown\" as response_code_details | format if (upstream_transport_failure_reason:in(\"\", \"-\")) \"Unknown\" as upstream_transport_failure_reason | filter peer_address:in($peer) cf_country_reported:in($country) user_agent:in($agent) upstream_cluster:in($backend) response_flags:in($flags) request_id:in(${request_id:json}) cf_ray:in(${ray_id:json}) | filter gateway_name:=\"cloudflare-gateway\" cf_connecting_ip_reported:!=\"\" cf_connecting_ip_reported:!=\"-\" | stats by (cf_connecting_ip_reported, authority) count() as requests | sort by (requests) desc | limit 20", "queryType": "instant", "editorMode": "code", "legendFormat": "{{__name__}}", "maxLines": 20, "direction": "desc" } ], "options": { "showHeader": true, "cellHeight": "sm", "footer": { "show": false }, "sortBy": [ { "displayName": "Requests", "desc": true } ] }, "transformations": [ { "id": "extractFields", "options": { "source": "labels", "format": "json", "replace": true, "keepTime": false } }, { "id": "convertFieldType", "options": { "conversions": [ { "targetField": "requests", "destinationType": "number" } ], "fields": {} } }, { "id": "organize", "options": { "excludeByName": {}, "includeByName": { "cf_connecting_ip_reported": true, "authority": true, "requests": true }, "indexByName": { "cf_connecting_ip_reported": 0, "authority": 1, "requests": 2 }, "renameByName": { "cf_connecting_ip_reported": "Reported visitor IP", "authority": "Hostname", "requests": "Requests" } } } ] }, { "id": 25, "title": "Reported IPs by endpoint", "type": "table", "datasource": { "type": "victoriametrics-logs-datasource", "uid": "${DS_VICTORIALOGS}" }, "description": "Top 20 public IP/hostname/path combinations.", "gridPos": { "x": 0, "y": 59, "w": 12, "h": 8 }, "fieldConfig": { "defaults": { "unit": "none", "noValue": "\u2014", "color": { "mode": "palette-classic" } }, "overrides": [ { "matcher": { "id": "byName", "options": "Reported visitor IP" }, "properties": [ { "id": "links", "value": [ { "title": "Filter Reported visitor IP", "url": "/d/http-traffic/http-traffic?${__url_time_range}&${gateway:queryparam}&${hostname:queryparam}&${path:queryparam}&${method:queryparam}&${status:queryparam}&${peer:queryparam}&${country:queryparam}&${agent:queryparam}&${backend:queryparam}&${flags:queryparam}&${request_id:queryparam}&${ray_id:queryparam}&var-visitor=${__value.raw:percentencode}", "targetBlank": false } ] } ] }, { "matcher": { "id": "byName", "options": "Hostname" }, "properties": [ { "id": "links", "value": [ { "title": "Filter Hostname", "url": "/d/http-traffic/http-traffic?${__url_time_range}&${gateway:queryparam}&${path:queryparam}&${method:queryparam}&${status:queryparam}&${visitor:queryparam}&${peer:queryparam}&${country:queryparam}&${agent:queryparam}&${backend:queryparam}&${flags:queryparam}&${request_id:queryparam}&${ray_id:queryparam}&var-hostname=${__value.raw:percentencode}", "targetBlank": false } ] } ] }, { "matcher": { "id": "byName", "options": "Path" }, "properties": [ { "id": "links", "value": [ { "title": "Filter Path", "url": "/d/http-traffic/http-traffic?${__url_time_range}&${gateway:queryparam}&${hostname:queryparam}&${method:queryparam}&${status:queryparam}&${visitor:queryparam}&${peer:queryparam}&${country:queryparam}&${agent:queryparam}&${backend:queryparam}&${flags:queryparam}&${request_id:queryparam}&${ray_id:queryparam}&var-path=${__value.raw:percentencode}", "targetBlank": false } ] } ] }, { "matcher": { "id": "byName", "options": "Requests" }, "properties": [ { "id": "unit", "value": "short" }, { "id": "decimals", "value": 0 } ] } ] }, "targets": [ { "refId": "A", "datasource": { "type": "victoriametrics-logs-datasource", "uid": "${DS_VICTORIALOGS}" }, "expr": "log_type:=\"gateway-access\" gateway_name:in($gateway) authority:in($hostname) path:in($path) method:in($method) response_code:in($status) cf_connecting_ip_reported:in($visitor) | copy downstream_remote_address as peer_address | replace_regexp (\":([0-9]+)$\", \"\") at peer_address | replace_regexp (\"^\\\\[(.*)\\\\]$\", \"${1}\") at peer_address | format if (cf_country_reported:in(\"\", \"-\")) \"Unknown\" as cf_country_reported | format if (user_agent:in(\"\", \"-\")) \"Unknown\" as user_agent | format if (upstream_cluster:in(\"\", \"-\")) \"Unknown\" as upstream_cluster | format if (response_code_details:in(\"\", \"-\")) \"Unknown\" as response_code_details | format if (upstream_transport_failure_reason:in(\"\", \"-\")) \"Unknown\" as upstream_transport_failure_reason | filter peer_address:in($peer) cf_country_reported:in($country) user_agent:in($agent) upstream_cluster:in($backend) response_flags:in($flags) request_id:in(${request_id:json}) cf_ray:in(${ray_id:json}) | filter gateway_name:=\"cloudflare-gateway\" cf_connecting_ip_reported:!=\"\" cf_connecting_ip_reported:!=\"-\" | stats by (cf_connecting_ip_reported, authority, path) count() as requests | sort by (requests) desc | limit 20", "queryType": "instant", "editorMode": "code", "legendFormat": "{{__name__}}", "maxLines": 20, "direction": "desc" } ], "options": { "showHeader": true, "cellHeight": "sm", "footer": { "show": false }, "sortBy": [ { "displayName": "Requests", "desc": true } ] }, "transformations": [ { "id": "extractFields", "options": { "source": "labels", "format": "json", "replace": true, "keepTime": false } }, { "id": "convertFieldType", "options": { "conversions": [ { "targetField": "requests", "destinationType": "number" } ], "fields": {} } }, { "id": "organize", "options": { "excludeByName": {}, "includeByName": { "cf_connecting_ip_reported": true, "authority": true, "path": true, "requests": true }, "indexByName": { "cf_connecting_ip_reported": 0, "authority": 1, "path": 2, "requests": 3 }, "renameByName": { "cf_connecting_ip_reported": "Reported visitor IP", "authority": "Hostname", "path": "Path", "requests": "Requests" } } } ] }, { "id": 27, "title": "LAN network peers", "type": "table", "datasource": { "type": "victoriametrics-logs-datasource", "uid": "${DS_VICTORIALOGS}" }, "description": "Network peer IPs on LAN requests, with source ports and IPv6 brackets removed. A peer may be a proxy rather than a visitor.", "gridPos": { "x": 12, "y": 59, "w": 12, "h": 8 }, "fieldConfig": { "defaults": { "unit": "none", "noValue": "\u2014", "color": { "mode": "palette-classic" } }, "overrides": [ { "matcher": { "id": "byName", "options": "Network peer IP" }, "properties": [ { "id": "links", "value": [ { "title": "Filter Network peer IP", "url": "/d/http-traffic/http-traffic?${__url_time_range}&${gateway:queryparam}&${hostname:queryparam}&${path:queryparam}&${method:queryparam}&${status:queryparam}&${visitor:queryparam}&${country:queryparam}&${agent:queryparam}&${backend:queryparam}&${flags:queryparam}&${request_id:queryparam}&${ray_id:queryparam}&var-peer=${__value.raw:percentencode}", "targetBlank": false } ] } ] }, { "matcher": { "id": "byName", "options": "Requests" }, "properties": [ { "id": "unit", "value": "short" }, { "id": "decimals", "value": 0 } ] } ] }, "targets": [ { "refId": "A", "datasource": { "type": "victoriametrics-logs-datasource", "uid": "${DS_VICTORIALOGS}" }, "expr": "log_type:=\"gateway-access\" gateway_name:in($gateway) authority:in($hostname) path:in($path) method:in($method) response_code:in($status) cf_connecting_ip_reported:in($visitor) | copy downstream_remote_address as peer_address | replace_regexp (\":([0-9]+)$\", \"\") at peer_address | replace_regexp (\"^\\\\[(.*)\\\\]$\", \"${1}\") at peer_address | format if (cf_country_reported:in(\"\", \"-\")) \"Unknown\" as cf_country_reported | format if (user_agent:in(\"\", \"-\")) \"Unknown\" as user_agent | format if (upstream_cluster:in(\"\", \"-\")) \"Unknown\" as upstream_cluster | format if (response_code_details:in(\"\", \"-\")) \"Unknown\" as response_code_details | format if (upstream_transport_failure_reason:in(\"\", \"-\")) \"Unknown\" as upstream_transport_failure_reason | filter peer_address:in($peer) cf_country_reported:in($country) user_agent:in($agent) upstream_cluster:in($backend) response_flags:in($flags) request_id:in(${request_id:json}) cf_ray:in(${ray_id:json}) | filter gateway_name:=\"default-gateway\" peer_address:!=\"\" peer_address:!=\"-\" | stats by (peer_address) count() as requests | sort by (requests) desc | limit 20", "queryType": "instant", "editorMode": "code", "legendFormat": "{{__name__}}", "maxLines": 20, "direction": "desc" } ], "options": { "showHeader": true, "cellHeight": "sm", "footer": { "show": false }, "sortBy": [ { "displayName": "Requests", "desc": true } ] }, "transformations": [ { "id": "extractFields", "options": { "source": "labels", "format": "json", "replace": true, "keepTime": false } }, { "id": "convertFieldType", "options": { "conversions": [ { "targetField": "requests", "destinationType": "number" } ], "fields": {} } }, { "id": "organize", "options": { "excludeByName": {}, "includeByName": { "peer_address": true, "requests": true }, "indexByName": { "peer_address": 0, "requests": 1 }, "renameByName": { "peer_address": "Network peer IP", "requests": "Requests" } } } ] } ] }, { "id": 28, "type": "row", "title": "Performance and backends", "collapsed": true, "gridPos": { "x": 0, "y": 43, "w": 24, "h": 1 }, "panels": [ { "id": 29, "title": "Request duration", "type": "timeseries", "datasource": { "type": "victoriametrics-logs-datasource", "uid": "${DS_VICTORIALOGS}" }, "description": "p50/p95/p99 per time bucket, including long-lived requests with an HTTP response.", "gridPos": { "x": 0, "y": 44, "w": 12, "h": 8 }, "fieldConfig": { "defaults": { "unit": "ms", "noValue": "\u2014", "color": { "mode": "palette-classic" }, "custom": { "drawStyle": "line", "lineInterpolation": "linear", "lineWidth": 2, "fillOpacity": 10, "spanNulls": false, "showPoints": "never", "axisCenteredZero": false } }, "overrides": [] }, "targets": [ { "refId": "A", "datasource": { "type": "victoriametrics-logs-datasource", "uid": "${DS_VICTORIALOGS}" }, "expr": "log_type:=\"gateway-access\" gateway_name:in($gateway) authority:in($hostname) path:in($path) method:in($method) response_code:in($status) cf_connecting_ip_reported:in($visitor) | copy downstream_remote_address as peer_address | replace_regexp (\":([0-9]+)$\", \"\") at peer_address | replace_regexp (\"^\\\\[(.*)\\\\]$\", \"${1}\") at peer_address | format if (cf_country_reported:in(\"\", \"-\")) \"Unknown\" as cf_country_reported | format if (user_agent:in(\"\", \"-\")) \"Unknown\" as user_agent | format if (upstream_cluster:in(\"\", \"-\")) \"Unknown\" as upstream_cluster | format if (response_code_details:in(\"\", \"-\")) \"Unknown\" as response_code_details | format if (upstream_transport_failure_reason:in(\"\", \"-\")) \"Unknown\" as upstream_transport_failure_reason | filter peer_address:in($peer) cf_country_reported:in($country) user_agent:in($agent) upstream_cluster:in($backend) response_flags:in($flags) request_id:in(${request_id:json}) cf_ray:in(${ray_id:json}) | filter response_code:>=100 response_code:<600 | stats quantile(0.50, duration_ms) as p50, quantile(0.95, duration_ms) as p95, quantile(0.99, duration_ms) as p99 | filter p95:!=\"\"", "queryType": "statsRange", "editorMode": "code", "legendFormat": "{{__name__}}", "maxLines": 1000, "direction": "desc" } ], "interval": "30s", "options": { "legend": { "displayMode": "table", "placement": "bottom", "showLegend": true, "calcs": [ "lastNotNull", "max" ] }, "tooltip": { "mode": "multi", "sort": "desc" } } }, { "id": 30, "title": "p95 duration by hostname", "type": "timeseries", "datasource": { "type": "victoriametrics-logs-datasource", "uid": "${DS_VICTORIALOGS}" }, "description": "p95 for the top 10 hostnames by request volume over the selected range.", "gridPos": { "x": 12, "y": 44, "w": 12, "h": 8 }, "fieldConfig": { "defaults": { "unit": "ms", "noValue": "\u2014", "color": { "mode": "palette-classic" }, "custom": { "drawStyle": "line", "lineInterpolation": "linear", "lineWidth": 2, "fillOpacity": 10, "spanNulls": false, "showPoints": "never", "axisCenteredZero": false } }, "overrides": [] }, "targets": [ { "refId": "A", "datasource": { "type": "victoriametrics-logs-datasource", "uid": "${DS_VICTORIALOGS}" }, "expr": "log_type:=\"gateway-access\" gateway_name:in($gateway) authority:in($hostname) path:in($path) method:in($method) response_code:in($status) cf_connecting_ip_reported:in($visitor) | copy downstream_remote_address as peer_address | replace_regexp (\":([0-9]+)$\", \"\") at peer_address | replace_regexp (\"^\\\\[(.*)\\\\]$\", \"${1}\") at peer_address | format if (cf_country_reported:in(\"\", \"-\")) \"Unknown\" as cf_country_reported | format if (user_agent:in(\"\", \"-\")) \"Unknown\" as user_agent | format if (upstream_cluster:in(\"\", \"-\")) \"Unknown\" as upstream_cluster | format if (response_code_details:in(\"\", \"-\")) \"Unknown\" as response_code_details | format if (upstream_transport_failure_reason:in(\"\", \"-\")) \"Unknown\" as upstream_transport_failure_reason | filter peer_address:in($peer) cf_country_reported:in($country) user_agent:in($agent) upstream_cluster:in($backend) response_flags:in($flags) request_id:in(${request_id:json}) cf_ray:in(${ray_id:json}) | filter authority:in(log_type:=\"gateway-access\" gateway_name:in($gateway) authority:in($hostname) path:in($path) method:in($method) response_code:in($status) cf_connecting_ip_reported:in($visitor) | copy downstream_remote_address as peer_address | replace_regexp (\":([0-9]+)$\", \"\") at peer_address | replace_regexp (\"^\\\\[(.*)\\\\]$\", \"${1}\") at peer_address | format if (cf_country_reported:in(\"\", \"-\")) \"Unknown\" as cf_country_reported | format if (user_agent:in(\"\", \"-\")) \"Unknown\" as user_agent | format if (upstream_cluster:in(\"\", \"-\")) \"Unknown\" as upstream_cluster | format if (response_code_details:in(\"\", \"-\")) \"Unknown\" as response_code_details | format if (upstream_transport_failure_reason:in(\"\", \"-\")) \"Unknown\" as upstream_transport_failure_reason | filter peer_address:in($peer) cf_country_reported:in($country) user_agent:in($agent) upstream_cluster:in($backend) response_flags:in($flags) request_id:in(${request_id:json}) cf_ray:in(${ray_id:json}) | stats by (authority) count() as requests | sort by (requests) desc | limit 10 | fields authority) | filter response_code:>=100 response_code:<600 | stats by (authority) quantile(0.95, duration_ms) as p95_ms | filter p95_ms:!=\"\"", "queryType": "statsRange", "editorMode": "code", "legendFormat": "{{authority}}", "maxLines": 1000, "direction": "desc" } ], "interval": "30s", "options": { "legend": { "displayMode": "table", "placement": "bottom", "showLegend": true, "calcs": [ "lastNotNull", "max" ] }, "tooltip": { "mode": "multi", "sort": "desc" } } }, { "id": 31, "title": "Slow endpoints", "type": "table", "datasource": { "type": "victoriametrics-logs-datasource", "uid": "${DS_VICTORIALOGS}" }, "description": "Top 20 endpoints by p95 duration; low-volume endpoints can have unstable percentiles.", "gridPos": { "x": 0, "y": 52, "w": 12, "h": 8 }, "fieldConfig": { "defaults": { "unit": "none", "noValue": "\u2014", "color": { "mode": "palette-classic" } }, "overrides": [ { "matcher": { "id": "byName", "options": "Hostname" }, "properties": [ { "id": "links", "value": [ { "title": "Filter Hostname", "url": "/d/http-traffic/http-traffic?${__url_time_range}&${gateway:queryparam}&${path:queryparam}&${method:queryparam}&${status:queryparam}&${visitor:queryparam}&${peer:queryparam}&${country:queryparam}&${agent:queryparam}&${backend:queryparam}&${flags:queryparam}&${request_id:queryparam}&${ray_id:queryparam}&var-hostname=${__value.raw:percentencode}", "targetBlank": false } ] } ] }, { "matcher": { "id": "byName", "options": "Path" }, "properties": [ { "id": "links", "value": [ { "title": "Filter Path", "url": "/d/http-traffic/http-traffic?${__url_time_range}&${gateway:queryparam}&${hostname:queryparam}&${method:queryparam}&${status:queryparam}&${visitor:queryparam}&${peer:queryparam}&${country:queryparam}&${agent:queryparam}&${backend:queryparam}&${flags:queryparam}&${request_id:queryparam}&${ray_id:queryparam}&var-path=${__value.raw:percentencode}", "targetBlank": false } ] } ] }, { "matcher": { "id": "byName", "options": "Requests" }, "properties": [ { "id": "unit", "value": "short" }, { "id": "decimals", "value": 0 } ] }, { "matcher": { "id": "byName", "options": "p95 duration" }, "properties": [ { "id": "unit", "value": "ms" }, { "id": "decimals", "value": 0 } ] } ] }, "targets": [ { "refId": "A", "datasource": { "type": "victoriametrics-logs-datasource", "uid": "${DS_VICTORIALOGS}" }, "expr": "log_type:=\"gateway-access\" gateway_name:in($gateway) authority:in($hostname) path:in($path) method:in($method) response_code:in($status) cf_connecting_ip_reported:in($visitor) | copy downstream_remote_address as peer_address | replace_regexp (\":([0-9]+)$\", \"\") at peer_address | replace_regexp (\"^\\\\[(.*)\\\\]$\", \"${1}\") at peer_address | format if (cf_country_reported:in(\"\", \"-\")) \"Unknown\" as cf_country_reported | format if (user_agent:in(\"\", \"-\")) \"Unknown\" as user_agent | format if (upstream_cluster:in(\"\", \"-\")) \"Unknown\" as upstream_cluster | format if (response_code_details:in(\"\", \"-\")) \"Unknown\" as response_code_details | format if (upstream_transport_failure_reason:in(\"\", \"-\")) \"Unknown\" as upstream_transport_failure_reason | filter peer_address:in($peer) cf_country_reported:in($country) user_agent:in($agent) upstream_cluster:in($backend) response_flags:in($flags) request_id:in(${request_id:json}) cf_ray:in(${ray_id:json}) | filter response_code:>=100 response_code:<600 | stats by (authority, path) count() as requests, quantile(0.95, duration_ms) as p95_ms | sort by (p95_ms) desc | limit 20", "queryType": "instant", "editorMode": "code", "legendFormat": "{{__name__}}", "maxLines": 20, "direction": "desc" } ], "options": { "showHeader": true, "cellHeight": "sm", "footer": { "show": false }, "sortBy": [ { "displayName": "p95 duration", "desc": true } ] }, "transformations": [ { "id": "extractFields", "options": { "source": "labels", "format": "json", "replace": true, "keepTime": false } }, { "id": "convertFieldType", "options": { "conversions": [ { "targetField": "requests", "destinationType": "number" }, { "targetField": "p95_ms", "destinationType": "number" } ], "fields": {} } }, { "id": "organize", "options": { "excludeByName": {}, "includeByName": { "authority": true, "path": true, "requests": true, "p95_ms": true }, "indexByName": { "authority": 0, "path": 1, "requests": 2, "p95_ms": 3 }, "renameByName": { "authority": "Hostname", "path": "Path", "requests": "Requests", "p95_ms": "p95 duration" } } } ] }, { "id": 32, "title": "Slowest requests", "type": "table", "datasource": { "type": "victoriametrics-logs-datasource", "uid": "${DS_VICTORIALOGS}" }, "description": "Slowest 200 matching completed requests, including long-lived streams. Request IDs can be copied into the lookup control.", "gridPos": { "x": 12, "y": 52, "w": 12, "h": 8 }, "fieldConfig": { "defaults": { "unit": "none", "noValue": "\u2014", "color": { "mode": "palette-classic" } }, "overrides": [ { "matcher": { "id": "byName", "options": "Hostname" }, "properties": [ { "id": "links", "value": [ { "title": "Filter Hostname", "url": "/d/http-traffic/http-traffic?${__url_time_range}&${gateway:queryparam}&${path:queryparam}&${method:queryparam}&${status:queryparam}&${visitor:queryparam}&${peer:queryparam}&${country:queryparam}&${agent:queryparam}&${backend:queryparam}&${flags:queryparam}&${request_id:queryparam}&${ray_id:queryparam}&var-hostname=${__value.raw:percentencode}", "targetBlank": false } ] } ] }, { "matcher": { "id": "byName", "options": "Method" }, "properties": [] }, { "matcher": { "id": "byName", "options": "Path" }, "properties": [ { "id": "links", "value": [ { "title": "Filter Path", "url": "/d/http-traffic/http-traffic?${__url_time_range}&${gateway:queryparam}&${hostname:queryparam}&${method:queryparam}&${status:queryparam}&${visitor:queryparam}&${peer:queryparam}&${country:queryparam}&${agent:queryparam}&${backend:queryparam}&${flags:queryparam}&${request_id:queryparam}&${ray_id:queryparam}&var-path=${__value.raw:percentencode}", "targetBlank": false } ] } ] }, { "matcher": { "id": "byName", "options": "Status" }, "properties": [ { "id": "unit", "value": "none" }, { "id": "decimals", "value": 0 }, { "id": "mappings", "value": [ { "type": "value", "options": { "0": { "text": "No HTTP response" } } } ] } ] }, { "matcher": { "id": "byName", "options": "Duration" }, "properties": [ { "id": "unit", "value": "ms" }, { "id": "decimals", "value": 0 } ] }, { "matcher": { "id": "byName", "options": "Backend" }, "properties": [] } ] }, "targets": [ { "refId": "A", "datasource": { "type": "victoriametrics-logs-datasource", "uid": "${DS_VICTORIALOGS}" }, "expr": "log_type:=\"gateway-access\" gateway_name:in($gateway) authority:in($hostname) path:in($path) method:in($method) response_code:in($status) cf_connecting_ip_reported:in($visitor) | copy downstream_remote_address as peer_address | replace_regexp (\":([0-9]+)$\", \"\") at peer_address | replace_regexp (\"^\\\\[(.*)\\\\]$\", \"${1}\") at peer_address | format if (cf_country_reported:in(\"\", \"-\")) \"Unknown\" as cf_country_reported | format if (user_agent:in(\"\", \"-\")) \"Unknown\" as user_agent | format if (upstream_cluster:in(\"\", \"-\")) \"Unknown\" as upstream_cluster | format if (response_code_details:in(\"\", \"-\")) \"Unknown\" as response_code_details | format if (upstream_transport_failure_reason:in(\"\", \"-\")) \"Unknown\" as upstream_transport_failure_reason | filter peer_address:in($peer) cf_country_reported:in($country) user_agent:in($agent) upstream_cluster:in($backend) response_flags:in($flags) request_id:in(${request_id:json}) cf_ray:in(${ray_id:json}) | sort by (duration_ms) desc | limit 200 | fields _time, gateway_name, authority, method, path, response_code, duration_ms, cf_connecting_ip_reported, peer_address, downstream_remote_address, cf_country_reported, user_agent, upstream_cluster, upstream_host, response_flags, response_code_details, upstream_transport_failure_reason, request_id, cf_ray", "queryType": "instant", "editorMode": "code", "legendFormat": "{{__name__}}", "maxLines": 200, "direction": "desc" } ], "options": { "showHeader": true, "cellHeight": "sm", "footer": { "show": false }, "sortBy": [ { "displayName": "Duration", "desc": true } ] }, "transformations": [ { "id": "extractFields", "options": { "source": "labels", "format": "json", "replace": true, "keepTime": true } }, { "id": "convertFieldType", "options": { "conversions": [ { "targetField": "response_code", "destinationType": "number" }, { "targetField": "duration_ms", "destinationType": "number" } ], "fields": {} } }, { "id": "organize", "options": { "excludeByName": {}, "includeByName": { "Time": true, "authority": true, "method": true, "path": true, "response_code": true, "duration_ms": true, "upstream_cluster": true, "request_id": true }, "indexByName": { "Time": 0, "authority": 1, "method": 2, "path": 3, "response_code": 4, "duration_ms": 5, "upstream_cluster": 6, "request_id": 7 }, "renameByName": { "Time": "Time", "authority": "Hostname", "method": "Method", "path": "Path", "response_code": "Status", "duration_ms": "Duration", "upstream_cluster": "Backend", "request_id": "Request ID" } } } ] }, { "id": 33, "title": "Response body size", "type": "timeseries", "datasource": { "type": "victoriametrics-logs-datasource", "uid": "${DS_VICTORIALOGS}" }, "description": "Response body-size percentiles per bucket; not compressed network transfer size.", "gridPos": { "x": 0, "y": 60, "w": 12, "h": 8 }, "fieldConfig": { "defaults": { "unit": "bytes", "noValue": "\u2014", "color": { "mode": "palette-classic" }, "custom": { "drawStyle": "line", "lineInterpolation": "linear", "lineWidth": 2, "fillOpacity": 10, "spanNulls": false, "showPoints": "never", "axisCenteredZero": false } }, "overrides": [] }, "targets": [ { "refId": "A", "datasource": { "type": "victoriametrics-logs-datasource", "uid": "${DS_VICTORIALOGS}" }, "expr": "log_type:=\"gateway-access\" gateway_name:in($gateway) authority:in($hostname) path:in($path) method:in($method) response_code:in($status) cf_connecting_ip_reported:in($visitor) | copy downstream_remote_address as peer_address | replace_regexp (\":([0-9]+)$\", \"\") at peer_address | replace_regexp (\"^\\\\[(.*)\\\\]$\", \"${1}\") at peer_address | format if (cf_country_reported:in(\"\", \"-\")) \"Unknown\" as cf_country_reported | format if (user_agent:in(\"\", \"-\")) \"Unknown\" as user_agent | format if (upstream_cluster:in(\"\", \"-\")) \"Unknown\" as upstream_cluster | format if (response_code_details:in(\"\", \"-\")) \"Unknown\" as response_code_details | format if (upstream_transport_failure_reason:in(\"\", \"-\")) \"Unknown\" as upstream_transport_failure_reason | filter peer_address:in($peer) cf_country_reported:in($country) user_agent:in($agent) upstream_cluster:in($backend) response_flags:in($flags) request_id:in(${request_id:json}) cf_ray:in(${ray_id:json}) | stats quantile(0.50, bytes_sent) as p50, quantile(0.95, bytes_sent) as p95, quantile(0.99, bytes_sent) as p99 | filter p95:!=\"\"", "queryType": "statsRange", "editorMode": "code", "legendFormat": "{{__name__}}", "maxLines": 1000, "direction": "desc" } ], "interval": "30s", "options": { "legend": { "displayMode": "table", "placement": "bottom", "showLegend": true, "calcs": [ "lastNotNull", "max" ] }, "tooltip": { "mode": "multi", "sort": "desc" } } }, { "id": 34, "title": "Backend summary", "type": "table", "datasource": { "type": "victoriametrics-logs-datasource", "uid": "${DS_VICTORIALOGS}" }, "description": "Backend cluster and address breakdown. Old records have Unknown cluster but retain their upstream address.", "gridPos": { "x": 12, "y": 60, "w": 12, "h": 8 }, "fieldConfig": { "defaults": { "unit": "none", "noValue": "\u2014", "color": { "mode": "palette-classic" } }, "overrides": [ { "matcher": { "id": "byName", "options": "Backend" }, "properties": [] }, { "matcher": { "id": "byName", "options": "Requests" }, "properties": [ { "id": "unit", "value": "short" }, { "id": "decimals", "value": 0 } ] }, { "matcher": { "id": "byName", "options": "errors" }, "properties": [ { "id": "unit", "value": "short" }, { "id": "decimals", "value": 0 } ] }, { "matcher": { "id": "byName", "options": "Response body bytes" }, "properties": [ { "id": "unit", "value": "bytes" }, { "id": "decimals", "value": 0 } ] }, { "matcher": { "id": "byName", "options": "p95 duration" }, "properties": [ { "id": "unit", "value": "ms" }, { "id": "decimals", "value": 0 } ] } ] }, "targets": [ { "refId": "A", "datasource": { "type": "victoriametrics-logs-datasource", "uid": "${DS_VICTORIALOGS}" }, "expr": "log_type:=\"gateway-access\" gateway_name:in($gateway) authority:in($hostname) path:in($path) method:in($method) response_code:in($status) cf_connecting_ip_reported:in($visitor) | copy downstream_remote_address as peer_address | replace_regexp (\":([0-9]+)$\", \"\") at peer_address | replace_regexp (\"^\\\\[(.*)\\\\]$\", \"${1}\") at peer_address | format if (cf_country_reported:in(\"\", \"-\")) \"Unknown\" as cf_country_reported | format if (user_agent:in(\"\", \"-\")) \"Unknown\" as user_agent | format if (upstream_cluster:in(\"\", \"-\")) \"Unknown\" as upstream_cluster | format if (response_code_details:in(\"\", \"-\")) \"Unknown\" as response_code_details | format if (upstream_transport_failure_reason:in(\"\", \"-\")) \"Unknown\" as upstream_transport_failure_reason | filter peer_address:in($peer) cf_country_reported:in($country) user_agent:in($agent) upstream_cluster:in($backend) response_flags:in($flags) request_id:in(${request_id:json}) cf_ray:in(${ray_id:json}) | stats by (upstream_cluster, upstream_host) count() as requests, count() if (response_code:>=400 response_code:<600) as errors, sum(bytes_sent) as response_bytes, quantile(0.95, duration_ms) as p95_ms | sort by (requests) desc | limit 20", "queryType": "instant", "editorMode": "code", "legendFormat": "{{__name__}}", "maxLines": 20, "direction": "desc" } ], "options": { "showHeader": true, "cellHeight": "sm", "footer": { "show": false }, "sortBy": [ { "displayName": "Requests", "desc": true } ] }, "transformations": [ { "id": "extractFields", "options": { "source": "labels", "format": "json", "replace": true, "keepTime": false } }, { "id": "convertFieldType", "options": { "conversions": [ { "targetField": "requests", "destinationType": "number" }, { "targetField": "errors", "destinationType": "number" }, { "targetField": "response_bytes", "destinationType": "number" }, { "targetField": "p95_ms", "destinationType": "number" } ], "fields": {} } }, { "id": "organize", "options": { "excludeByName": {}, "includeByName": { "upstream_cluster": true, "upstream_host": true, "requests": true, "errors": true, "response_bytes": true, "p95_ms": true }, "indexByName": { "upstream_cluster": 0, "upstream_host": 1, "requests": 2, "errors": 3, "response_bytes": 4, "p95_ms": 5 }, "renameByName": { "upstream_cluster": "Backend", "upstream_host": "Upstream address", "requests": "Requests", "errors": "errors", "response_bytes": "Response body bytes", "p95_ms": "p95 duration" } } } ] } ] }, { "id": 35, "type": "row", "title": "Responses and failures", "collapsed": true, "gridPos": { "x": 0, "y": 44, "w": 24, "h": 1 }, "panels": [ { "id": 36, "title": "Response classes", "type": "timeseries", "datasource": { "type": "victoriametrics-logs-datasource", "uid": "${DS_VICTORIALOGS}" }, "description": "HTTP status classes; code 0 means no HTTP response, often a disconnected client.", "gridPos": { "x": 0, "y": 45, "w": 12, "h": 8 }, "fieldConfig": { "defaults": { "unit": "reqps", "noValue": "\u2014", "color": { "mode": "palette-classic" }, "custom": { "drawStyle": "line", "lineInterpolation": "linear", "lineWidth": 2, "fillOpacity": 10, "spanNulls": false, "showPoints": "never", "axisCenteredZero": false } }, "overrides": [] }, "targets": [ { "refId": "A", "datasource": { "type": "victoriametrics-logs-datasource", "uid": "${DS_VICTORIALOGS}" }, "expr": "log_type:=\"gateway-access\" gateway_name:in($gateway) authority:in($hostname) path:in($path) method:in($method) response_code:in($status) cf_connecting_ip_reported:in($visitor) | copy downstream_remote_address as peer_address | replace_regexp (\":([0-9]+)$\", \"\") at peer_address | replace_regexp (\"^\\\\[(.*)\\\\]$\", \"${1}\") at peer_address | format if (cf_country_reported:in(\"\", \"-\")) \"Unknown\" as cf_country_reported | format if (user_agent:in(\"\", \"-\")) \"Unknown\" as user_agent | format if (upstream_cluster:in(\"\", \"-\")) \"Unknown\" as upstream_cluster | format if (response_code_details:in(\"\", \"-\")) \"Unknown\" as response_code_details | format if (upstream_transport_failure_reason:in(\"\", \"-\")) \"Unknown\" as upstream_transport_failure_reason | filter peer_address:in($peer) cf_country_reported:in($country) user_agent:in($agent) upstream_cluster:in($backend) response_flags:in($flags) request_id:in(${request_id:json}) cf_ray:in(${ray_id:json}) | format \"\" as status_class | replace_regexp (\"^([1-5])[0-9][0-9]$\", \"${1}xx\") at status_class | replace (\"0\", \"No HTTP response\") at status_class | stats by (status_class) rate() as requests_per_second", "queryType": "statsRange", "editorMode": "code", "legendFormat": "{{status_class}}", "maxLines": 1000, "direction": "desc" } ], "interval": "30s", "options": { "legend": { "displayMode": "table", "placement": "bottom", "showLegend": true, "calcs": [ "lastNotNull", "max" ] }, "tooltip": { "mode": "multi", "sort": "desc" } } }, { "id": 38, "title": "HTTP errors by endpoint", "type": "table", "datasource": { "type": "victoriametrics-logs-datasource", "uid": "${DS_VICTORIALOGS}" }, "description": "Top 20 endpoint/status combinations returning 4xx or 5xx.", "gridPos": { "x": 12, "y": 45, "w": 12, "h": 8 }, "fieldConfig": { "defaults": { "unit": "none", "noValue": "\u2014", "color": { "mode": "palette-classic" } }, "overrides": [ { "matcher": { "id": "byName", "options": "Hostname" }, "properties": [ { "id": "links", "value": [ { "title": "Filter Hostname", "url": "/d/http-traffic/http-traffic?${__url_time_range}&${gateway:queryparam}&${path:queryparam}&${method:queryparam}&${status:queryparam}&${visitor:queryparam}&${peer:queryparam}&${country:queryparam}&${agent:queryparam}&${backend:queryparam}&${flags:queryparam}&${request_id:queryparam}&${ray_id:queryparam}&var-hostname=${__value.raw:percentencode}", "targetBlank": false } ] } ] }, { "matcher": { "id": "byName", "options": "Path" }, "properties": [ { "id": "links", "value": [ { "title": "Filter Path", "url": "/d/http-traffic/http-traffic?${__url_time_range}&${gateway:queryparam}&${hostname:queryparam}&${method:queryparam}&${status:queryparam}&${visitor:queryparam}&${peer:queryparam}&${country:queryparam}&${agent:queryparam}&${backend:queryparam}&${flags:queryparam}&${request_id:queryparam}&${ray_id:queryparam}&var-path=${__value.raw:percentencode}", "targetBlank": false } ] } ] }, { "matcher": { "id": "byName", "options": "Status" }, "properties": [ { "id": "unit", "value": "none" }, { "id": "decimals", "value": 0 }, { "id": "mappings", "value": [ { "type": "value", "options": { "0": { "text": "No HTTP response" } } } ] } ] }, { "matcher": { "id": "byName", "options": "Requests" }, "properties": [ { "id": "unit", "value": "short" }, { "id": "decimals", "value": 0 } ] } ] }, "targets": [ { "refId": "A", "datasource": { "type": "victoriametrics-logs-datasource", "uid": "${DS_VICTORIALOGS}" }, "expr": "log_type:=\"gateway-access\" gateway_name:in($gateway) authority:in($hostname) path:in($path) method:in($method) response_code:in($status) cf_connecting_ip_reported:in($visitor) | copy downstream_remote_address as peer_address | replace_regexp (\":([0-9]+)$\", \"\") at peer_address | replace_regexp (\"^\\\\[(.*)\\\\]$\", \"${1}\") at peer_address | format if (cf_country_reported:in(\"\", \"-\")) \"Unknown\" as cf_country_reported | format if (user_agent:in(\"\", \"-\")) \"Unknown\" as user_agent | format if (upstream_cluster:in(\"\", \"-\")) \"Unknown\" as upstream_cluster | format if (response_code_details:in(\"\", \"-\")) \"Unknown\" as response_code_details | format if (upstream_transport_failure_reason:in(\"\", \"-\")) \"Unknown\" as upstream_transport_failure_reason | filter peer_address:in($peer) cf_country_reported:in($country) user_agent:in($agent) upstream_cluster:in($backend) response_flags:in($flags) request_id:in(${request_id:json}) cf_ray:in(${ray_id:json}) | filter response_code:>=400 response_code:<600 | stats by (authority, path, response_code) count() as requests | sort by (requests) desc | limit 20", "queryType": "instant", "editorMode": "code", "legendFormat": "{{__name__}}", "maxLines": 20, "direction": "desc" } ], "options": { "showHeader": true, "cellHeight": "sm", "footer": { "show": false }, "sortBy": [ { "displayName": "Requests", "desc": true } ] }, "transformations": [ { "id": "extractFields", "options": { "source": "labels", "format": "json", "replace": true, "keepTime": false } }, { "id": "convertFieldType", "options": { "conversions": [ { "targetField": "response_code", "destinationType": "number" }, { "targetField": "requests", "destinationType": "number" } ], "fields": {} } }, { "id": "organize", "options": { "excludeByName": {}, "includeByName": { "authority": true, "path": true, "response_code": true, "requests": true }, "indexByName": { "authority": 0, "path": 1, "response_code": 2, "requests": 3 }, "renameByName": { "authority": "Hostname", "path": "Path", "response_code": "Status", "requests": "Requests" } } } ] }, { "id": 39, "title": "Envoy response flags", "type": "table", "datasource": { "type": "victoriametrics-logs-datasource", "uid": "${DS_VICTORIALOGS}" }, "description": "Envoy transport/response flags. A dash means no flags; flags are not themselves HTTP status codes.", "gridPos": { "x": 0, "y": 53, "w": 12, "h": 8 }, "fieldConfig": { "defaults": { "unit": "none", "noValue": "\u2014", "color": { "mode": "palette-classic" } }, "overrides": [ { "matcher": { "id": "byName", "options": "Response flags" }, "properties": [ { "id": "mappings", "value": [ { "type": "value", "options": { "-": { "text": "No flags" } } } ] } ] }, { "matcher": { "id": "byName", "options": "Requests" }, "properties": [ { "id": "unit", "value": "short" }, { "id": "decimals", "value": 0 } ] } ] }, "targets": [ { "refId": "A", "datasource": { "type": "victoriametrics-logs-datasource", "uid": "${DS_VICTORIALOGS}" }, "expr": "log_type:=\"gateway-access\" gateway_name:in($gateway) authority:in($hostname) path:in($path) method:in($method) response_code:in($status) cf_connecting_ip_reported:in($visitor) | copy downstream_remote_address as peer_address | replace_regexp (\":([0-9]+)$\", \"\") at peer_address | replace_regexp (\"^\\\\[(.*)\\\\]$\", \"${1}\") at peer_address | format if (cf_country_reported:in(\"\", \"-\")) \"Unknown\" as cf_country_reported | format if (user_agent:in(\"\", \"-\")) \"Unknown\" as user_agent | format if (upstream_cluster:in(\"\", \"-\")) \"Unknown\" as upstream_cluster | format if (response_code_details:in(\"\", \"-\")) \"Unknown\" as response_code_details | format if (upstream_transport_failure_reason:in(\"\", \"-\")) \"Unknown\" as upstream_transport_failure_reason | filter peer_address:in($peer) cf_country_reported:in($country) user_agent:in($agent) upstream_cluster:in($backend) response_flags:in($flags) request_id:in(${request_id:json}) cf_ray:in(${ray_id:json}) | stats by (response_flags) count() as requests | sort by (requests) desc | limit 20", "queryType": "instant", "editorMode": "code", "legendFormat": "{{__name__}}", "maxLines": 20, "direction": "desc" } ], "options": { "showHeader": true, "cellHeight": "sm", "footer": { "show": false }, "sortBy": [ { "displayName": "Requests", "desc": true } ] }, "transformations": [ { "id": "extractFields", "options": { "source": "labels", "format": "json", "replace": true, "keepTime": false } }, { "id": "convertFieldType", "options": { "conversions": [ { "targetField": "requests", "destinationType": "number" } ], "fields": {} } }, { "id": "organize", "options": { "excludeByName": {}, "includeByName": { "response_flags": true, "requests": true }, "indexByName": { "response_flags": 0, "requests": 1 }, "renameByName": { "response_flags": "Response flags", "requests": "Requests" } } } ] }, { "id": 40, "title": "Response-code details", "type": "table", "datasource": { "type": "victoriametrics-logs-datasource", "uid": "${DS_VICTORIALOGS}" }, "description": "Envoy explanations of response origin and outcome. Unknown covers old records and absent details.", "gridPos": { "x": 12, "y": 53, "w": 12, "h": 8 }, "fieldConfig": { "defaults": { "unit": "none", "noValue": "\u2014", "color": { "mode": "palette-classic" } }, "overrides": [ { "matcher": { "id": "byName", "options": "Status" }, "properties": [ { "id": "unit", "value": "none" }, { "id": "decimals", "value": 0 }, { "id": "mappings", "value": [ { "type": "value", "options": { "0": { "text": "No HTTP response" } } } ] } ] }, { "matcher": { "id": "byName", "options": "Requests" }, "properties": [ { "id": "unit", "value": "short" }, { "id": "decimals", "value": 0 } ] } ] }, "targets": [ { "refId": "A", "datasource": { "type": "victoriametrics-logs-datasource", "uid": "${DS_VICTORIALOGS}" }, "expr": "log_type:=\"gateway-access\" gateway_name:in($gateway) authority:in($hostname) path:in($path) method:in($method) response_code:in($status) cf_connecting_ip_reported:in($visitor) | copy downstream_remote_address as peer_address | replace_regexp (\":([0-9]+)$\", \"\") at peer_address | replace_regexp (\"^\\\\[(.*)\\\\]$\", \"${1}\") at peer_address | format if (cf_country_reported:in(\"\", \"-\")) \"Unknown\" as cf_country_reported | format if (user_agent:in(\"\", \"-\")) \"Unknown\" as user_agent | format if (upstream_cluster:in(\"\", \"-\")) \"Unknown\" as upstream_cluster | format if (response_code_details:in(\"\", \"-\")) \"Unknown\" as response_code_details | format if (upstream_transport_failure_reason:in(\"\", \"-\")) \"Unknown\" as upstream_transport_failure_reason | filter peer_address:in($peer) cf_country_reported:in($country) user_agent:in($agent) upstream_cluster:in($backend) response_flags:in($flags) request_id:in(${request_id:json}) cf_ray:in(${ray_id:json}) | stats by (response_code_details, response_code) count() as requests | sort by (requests) desc | limit 20", "queryType": "instant", "editorMode": "code", "legendFormat": "{{__name__}}", "maxLines": 20, "direction": "desc" } ], "options": { "showHeader": true, "cellHeight": "sm", "footer": { "show": false }, "sortBy": [ { "displayName": "Requests", "desc": true } ] }, "transformations": [ { "id": "extractFields", "options": { "source": "labels", "format": "json", "replace": true, "keepTime": false } }, { "id": "convertFieldType", "options": { "conversions": [ { "targetField": "response_code", "destinationType": "number" }, { "targetField": "requests", "destinationType": "number" } ], "fields": {} } }, { "id": "organize", "options": { "excludeByName": {}, "includeByName": { "response_code_details": true, "response_code": true, "requests": true }, "indexByName": { "response_code_details": 0, "response_code": 1, "requests": 2 }, "renameByName": { "response_code_details": "Response details", "response_code": "Status", "requests": "Requests" } } } ] }, { "id": 41, "title": "Upstream transport failures", "type": "table", "datasource": { "type": "victoriametrics-logs-datasource", "uid": "${DS_VICTORIALOGS}" }, "description": "Explicit upstream transport failures. Missing fields are excluded rather than counted as failures.", "gridPos": { "x": 0, "y": 61, "w": 12, "h": 8 }, "fieldConfig": { "defaults": { "unit": "none", "noValue": "\u2014", "color": { "mode": "palette-classic" } }, "overrides": [ { "matcher": { "id": "byName", "options": "Backend" }, "properties": [] }, { "matcher": { "id": "byName", "options": "Requests" }, "properties": [ { "id": "unit", "value": "short" }, { "id": "decimals", "value": 0 } ] } ] }, "targets": [ { "refId": "A", "datasource": { "type": "victoriametrics-logs-datasource", "uid": "${DS_VICTORIALOGS}" }, "expr": "log_type:=\"gateway-access\" gateway_name:in($gateway) authority:in($hostname) path:in($path) method:in($method) response_code:in($status) cf_connecting_ip_reported:in($visitor) | copy downstream_remote_address as peer_address | replace_regexp (\":([0-9]+)$\", \"\") at peer_address | replace_regexp (\"^\\\\[(.*)\\\\]$\", \"${1}\") at peer_address | format if (cf_country_reported:in(\"\", \"-\")) \"Unknown\" as cf_country_reported | format if (user_agent:in(\"\", \"-\")) \"Unknown\" as user_agent | format if (upstream_cluster:in(\"\", \"-\")) \"Unknown\" as upstream_cluster | format if (response_code_details:in(\"\", \"-\")) \"Unknown\" as response_code_details | format if (upstream_transport_failure_reason:in(\"\", \"-\")) \"Unknown\" as upstream_transport_failure_reason | filter peer_address:in($peer) cf_country_reported:in($country) user_agent:in($agent) upstream_cluster:in($backend) response_flags:in($flags) request_id:in(${request_id:json}) cf_ray:in(${ray_id:json}) | filter upstream_transport_failure_reason:!=\"Unknown\" | stats by (upstream_cluster, upstream_transport_failure_reason) count() as requests | sort by (requests) desc | limit 20", "queryType": "instant", "editorMode": "code", "legendFormat": "{{__name__}}", "maxLines": 20, "direction": "desc" } ], "options": { "showHeader": true, "cellHeight": "sm", "footer": { "show": false }, "sortBy": [ { "displayName": "Requests", "desc": true } ] }, "transformations": [ { "id": "extractFields", "options": { "source": "labels", "format": "json", "replace": true, "keepTime": false } }, { "id": "convertFieldType", "options": { "conversions": [ { "targetField": "requests", "destinationType": "number" } ], "fields": {} } }, { "id": "organize", "options": { "excludeByName": {}, "includeByName": { "upstream_cluster": true, "upstream_transport_failure_reason": true, "requests": true }, "indexByName": { "upstream_cluster": 0, "upstream_transport_failure_reason": 1, "requests": 2 }, "renameByName": { "upstream_cluster": "Backend", "upstream_transport_failure_reason": "Transport failure", "requests": "Requests" } } } ] } ] }, { "id": 42, "type": "row", "title": "Request inspection", "collapsed": true, "gridPos": { "x": 0, "y": 45, "w": 24, "h": 1 }, "panels": [ { "id": 43, "title": "Recent requests", "type": "table", "datasource": { "type": "victoriametrics-logs-datasource", "uid": "${DS_VICTORIALOGS}" }, "description": "Latest 200 matching records. Time is access-log emission/collection time; logs normally arrive after completion. Reported headers are distinct from network peers.", "gridPos": { "x": 0, "y": 46, "w": 24, "h": 8 }, "fieldConfig": { "defaults": { "unit": "none", "noValue": "\u2014", "color": { "mode": "palette-classic" } }, "overrides": [ { "matcher": { "id": "byName", "options": "Gateway" }, "properties": [] }, { "matcher": { "id": "byName", "options": "Hostname" }, "properties": [ { "id": "links", "value": [ { "title": "Filter Hostname", "url": "/d/http-traffic/http-traffic?${__url_time_range}&${gateway:queryparam}&${path:queryparam}&${method:queryparam}&${status:queryparam}&${visitor:queryparam}&${peer:queryparam}&${country:queryparam}&${agent:queryparam}&${backend:queryparam}&${flags:queryparam}&${request_id:queryparam}&${ray_id:queryparam}&var-hostname=${__value.raw:percentencode}", "targetBlank": false } ] } ] }, { "matcher": { "id": "byName", "options": "Method" }, "properties": [] }, { "matcher": { "id": "byName", "options": "Path" }, "properties": [ { "id": "links", "value": [ { "title": "Filter Path", "url": "/d/http-traffic/http-traffic?${__url_time_range}&${gateway:queryparam}&${hostname:queryparam}&${method:queryparam}&${status:queryparam}&${visitor:queryparam}&${peer:queryparam}&${country:queryparam}&${agent:queryparam}&${backend:queryparam}&${flags:queryparam}&${request_id:queryparam}&${ray_id:queryparam}&var-path=${__value.raw:percentencode}", "targetBlank": false } ] } ] }, { "matcher": { "id": "byName", "options": "Status" }, "properties": [ { "id": "unit", "value": "none" }, { "id": "decimals", "value": 0 }, { "id": "mappings", "value": [ { "type": "value", "options": { "0": { "text": "No HTTP response" } } } ] } ] }, { "matcher": { "id": "byName", "options": "Duration" }, "properties": [ { "id": "unit", "value": "ms" }, { "id": "decimals", "value": 0 } ] }, { "matcher": { "id": "byName", "options": "Reported visitor IP" }, "properties": [ { "id": "links", "value": [ { "title": "Filter Reported visitor IP", "url": "/d/http-traffic/http-traffic?${__url_time_range}&${gateway:queryparam}&${hostname:queryparam}&${path:queryparam}&${method:queryparam}&${status:queryparam}&${peer:queryparam}&${country:queryparam}&${agent:queryparam}&${backend:queryparam}&${flags:queryparam}&${request_id:queryparam}&${ray_id:queryparam}&var-visitor=${__value.raw:percentencode}", "targetBlank": false } ] } ] }, { "matcher": { "id": "byName", "options": "Network peer IP" }, "properties": [ { "id": "links", "value": [ { "title": "Filter Network peer IP", "url": "/d/http-traffic/http-traffic?${__url_time_range}&${gateway:queryparam}&${hostname:queryparam}&${path:queryparam}&${method:queryparam}&${status:queryparam}&${visitor:queryparam}&${country:queryparam}&${agent:queryparam}&${backend:queryparam}&${flags:queryparam}&${request_id:queryparam}&${ray_id:queryparam}&var-peer=${__value.raw:percentencode}", "targetBlank": false } ] } ] }, { "matcher": { "id": "byName", "options": "Reported country" }, "properties": [] }, { "matcher": { "id": "byName", "options": "User agent" }, "properties": [] }, { "matcher": { "id": "byName", "options": "Backend" }, "properties": [] }, { "matcher": { "id": "byName", "options": "Response flags" }, "properties": [ { "id": "mappings", "value": [ { "type": "value", "options": { "-": { "text": "No flags" } } } ] } ] } ] }, "targets": [ { "refId": "A", "datasource": { "type": "victoriametrics-logs-datasource", "uid": "${DS_VICTORIALOGS}" }, "expr": "log_type:=\"gateway-access\" gateway_name:in($gateway) authority:in($hostname) path:in($path) method:in($method) response_code:in($status) cf_connecting_ip_reported:in($visitor) | copy downstream_remote_address as peer_address | replace_regexp (\":([0-9]+)$\", \"\") at peer_address | replace_regexp (\"^\\\\[(.*)\\\\]$\", \"${1}\") at peer_address | format if (cf_country_reported:in(\"\", \"-\")) \"Unknown\" as cf_country_reported | format if (user_agent:in(\"\", \"-\")) \"Unknown\" as user_agent | format if (upstream_cluster:in(\"\", \"-\")) \"Unknown\" as upstream_cluster | format if (response_code_details:in(\"\", \"-\")) \"Unknown\" as response_code_details | format if (upstream_transport_failure_reason:in(\"\", \"-\")) \"Unknown\" as upstream_transport_failure_reason | filter peer_address:in($peer) cf_country_reported:in($country) user_agent:in($agent) upstream_cluster:in($backend) response_flags:in($flags) request_id:in(${request_id:json}) cf_ray:in(${ray_id:json}) | sort by (_time) desc | limit 200 | fields _time, gateway_name, authority, method, path, response_code, duration_ms, cf_connecting_ip_reported, peer_address, downstream_remote_address, cf_country_reported, user_agent, upstream_cluster, upstream_host, response_flags, response_code_details, upstream_transport_failure_reason, request_id, cf_ray", "queryType": "instant", "editorMode": "code", "legendFormat": "{{__name__}}", "maxLines": 200, "direction": "desc" } ], "options": { "showHeader": true, "cellHeight": "sm", "footer": { "show": false }, "sortBy": [ { "displayName": "Time", "desc": true } ] }, "transformations": [ { "id": "extractFields", "options": { "source": "labels", "format": "json", "replace": true, "keepTime": true } }, { "id": "convertFieldType", "options": { "conversions": [ { "targetField": "response_code", "destinationType": "number" }, { "targetField": "duration_ms", "destinationType": "number" } ], "fields": {} } }, { "id": "organize", "options": { "excludeByName": {}, "includeByName": { "Time": true, "gateway_name": true, "authority": true, "method": true, "path": true, "response_code": true, "duration_ms": true, "cf_connecting_ip_reported": true, "peer_address": true, "downstream_remote_address": true, "cf_country_reported": true, "user_agent": true, "upstream_cluster": true, "upstream_host": true, "response_flags": true, "response_code_details": true, "upstream_transport_failure_reason": true, "request_id": true, "cf_ray": true }, "indexByName": { "Time": 0, "gateway_name": 1, "authority": 2, "method": 3, "path": 4, "response_code": 5, "duration_ms": 6, "cf_connecting_ip_reported": 7, "peer_address": 8, "downstream_remote_address": 9, "cf_country_reported": 10, "user_agent": 11, "upstream_cluster": 12, "upstream_host": 13, "response_flags": 14, "response_code_details": 15, "upstream_transport_failure_reason": 16, "request_id": 17, "cf_ray": 18 }, "renameByName": { "Time": "Time", "gateway_name": "Gateway", "authority": "Hostname", "method": "Method", "path": "Path", "response_code": "Status", "duration_ms": "Duration", "cf_connecting_ip_reported": "Reported visitor IP", "peer_address": "Network peer IP", "downstream_remote_address": "Network peer (with port)", "cf_country_reported": "Reported country", "user_agent": "User agent", "upstream_cluster": "Backend", "upstream_host": "Upstream address", "response_flags": "Response flags", "response_code_details": "Response details", "upstream_transport_failure_reason": "Transport failure", "request_id": "Request ID", "cf_ray": "Cloudflare Ray ID" } } } ] }, { "id": 44, "title": "Recent HTTP errors and incomplete responses", "type": "table", "datasource": { "type": "victoriametrics-logs-datasource", "uid": "${DS_VICTORIALOGS}" }, "description": "Latest 200 matching 4xx/5xx records or requests with code 0. Use request/Ray ID lookup controls for correlation.", "gridPos": { "x": 0, "y": 54, "w": 24, "h": 8 }, "fieldConfig": { "defaults": { "unit": "none", "noValue": "\u2014", "color": { "mode": "palette-classic" } }, "overrides": [ { "matcher": { "id": "byName", "options": "Gateway" }, "properties": [] }, { "matcher": { "id": "byName", "options": "Hostname" }, "properties": [ { "id": "links", "value": [ { "title": "Filter Hostname", "url": "/d/http-traffic/http-traffic?${__url_time_range}&${gateway:queryparam}&${path:queryparam}&${method:queryparam}&${status:queryparam}&${visitor:queryparam}&${peer:queryparam}&${country:queryparam}&${agent:queryparam}&${backend:queryparam}&${flags:queryparam}&${request_id:queryparam}&${ray_id:queryparam}&var-hostname=${__value.raw:percentencode}", "targetBlank": false } ] } ] }, { "matcher": { "id": "byName", "options": "Method" }, "properties": [] }, { "matcher": { "id": "byName", "options": "Path" }, "properties": [ { "id": "links", "value": [ { "title": "Filter Path", "url": "/d/http-traffic/http-traffic?${__url_time_range}&${gateway:queryparam}&${hostname:queryparam}&${method:queryparam}&${status:queryparam}&${visitor:queryparam}&${peer:queryparam}&${country:queryparam}&${agent:queryparam}&${backend:queryparam}&${flags:queryparam}&${request_id:queryparam}&${ray_id:queryparam}&var-path=${__value.raw:percentencode}", "targetBlank": false } ] } ] }, { "matcher": { "id": "byName", "options": "Status" }, "properties": [ { "id": "unit", "value": "none" }, { "id": "decimals", "value": 0 }, { "id": "mappings", "value": [ { "type": "value", "options": { "0": { "text": "No HTTP response" } } } ] } ] }, { "matcher": { "id": "byName", "options": "Duration" }, "properties": [ { "id": "unit", "value": "ms" }, { "id": "decimals", "value": 0 } ] }, { "matcher": { "id": "byName", "options": "Reported visitor IP" }, "properties": [ { "id": "links", "value": [ { "title": "Filter Reported visitor IP", "url": "/d/http-traffic/http-traffic?${__url_time_range}&${gateway:queryparam}&${hostname:queryparam}&${path:queryparam}&${method:queryparam}&${status:queryparam}&${peer:queryparam}&${country:queryparam}&${agent:queryparam}&${backend:queryparam}&${flags:queryparam}&${request_id:queryparam}&${ray_id:queryparam}&var-visitor=${__value.raw:percentencode}", "targetBlank": false } ] } ] }, { "matcher": { "id": "byName", "options": "Network peer IP" }, "properties": [ { "id": "links", "value": [ { "title": "Filter Network peer IP", "url": "/d/http-traffic/http-traffic?${__url_time_range}&${gateway:queryparam}&${hostname:queryparam}&${path:queryparam}&${method:queryparam}&${status:queryparam}&${visitor:queryparam}&${country:queryparam}&${agent:queryparam}&${backend:queryparam}&${flags:queryparam}&${request_id:queryparam}&${ray_id:queryparam}&var-peer=${__value.raw:percentencode}", "targetBlank": false } ] } ] }, { "matcher": { "id": "byName", "options": "Reported country" }, "properties": [] }, { "matcher": { "id": "byName", "options": "User agent" }, "properties": [] }, { "matcher": { "id": "byName", "options": "Backend" }, "properties": [] }, { "matcher": { "id": "byName", "options": "Response flags" }, "properties": [ { "id": "mappings", "value": [ { "type": "value", "options": { "-": { "text": "No flags" } } } ] } ] } ] }, "targets": [ { "refId": "A", "datasource": { "type": "victoriametrics-logs-datasource", "uid": "${DS_VICTORIALOGS}" }, "expr": "log_type:=\"gateway-access\" gateway_name:in($gateway) authority:in($hostname) path:in($path) method:in($method) response_code:in($status) cf_connecting_ip_reported:in($visitor) | copy downstream_remote_address as peer_address | replace_regexp (\":([0-9]+)$\", \"\") at peer_address | replace_regexp (\"^\\\\[(.*)\\\\]$\", \"${1}\") at peer_address | format if (cf_country_reported:in(\"\", \"-\")) \"Unknown\" as cf_country_reported | format if (user_agent:in(\"\", \"-\")) \"Unknown\" as user_agent | format if (upstream_cluster:in(\"\", \"-\")) \"Unknown\" as upstream_cluster | format if (response_code_details:in(\"\", \"-\")) \"Unknown\" as response_code_details | format if (upstream_transport_failure_reason:in(\"\", \"-\")) \"Unknown\" as upstream_transport_failure_reason | filter peer_address:in($peer) cf_country_reported:in($country) user_agent:in($agent) upstream_cluster:in($backend) response_flags:in($flags) request_id:in(${request_id:json}) cf_ray:in(${ray_id:json}) | filter (response_code:>=400 response_code:<600 OR response_code:=0) | sort by (_time) desc | limit 200 | fields _time, gateway_name, authority, method, path, response_code, duration_ms, cf_connecting_ip_reported, peer_address, downstream_remote_address, cf_country_reported, user_agent, upstream_cluster, upstream_host, response_flags, response_code_details, upstream_transport_failure_reason, request_id, cf_ray", "queryType": "instant", "editorMode": "code", "legendFormat": "{{__name__}}", "maxLines": 200, "direction": "desc" } ], "options": { "showHeader": true, "cellHeight": "sm", "footer": { "show": false }, "sortBy": [ { "displayName": "Time", "desc": true } ] }, "transformations": [ { "id": "extractFields", "options": { "source": "labels", "format": "json", "replace": true, "keepTime": true } }, { "id": "convertFieldType", "options": { "conversions": [ { "targetField": "response_code", "destinationType": "number" }, { "targetField": "duration_ms", "destinationType": "number" } ], "fields": {} } }, { "id": "organize", "options": { "excludeByName": {}, "includeByName": { "Time": true, "gateway_name": true, "authority": true, "method": true, "path": true, "response_code": true, "duration_ms": true, "cf_connecting_ip_reported": true, "peer_address": true, "downstream_remote_address": true, "cf_country_reported": true, "user_agent": true, "upstream_cluster": true, "upstream_host": true, "response_flags": true, "response_code_details": true, "upstream_transport_failure_reason": true, "request_id": true, "cf_ray": true }, "indexByName": { "Time": 0, "gateway_name": 1, "authority": 2, "method": 3, "path": 4, "response_code": 5, "duration_ms": 6, "cf_connecting_ip_reported": 7, "peer_address": 8, "downstream_remote_address": 9, "cf_country_reported": 10, "user_agent": 11, "upstream_cluster": 12, "upstream_host": 13, "response_flags": 14, "response_code_details": 15, "upstream_transport_failure_reason": 16, "request_id": 17, "cf_ray": 18 }, "renameByName": { "Time": "Time", "gateway_name": "Gateway", "authority": "Hostname", "method": "Method", "path": "Path", "response_code": "Status", "duration_ms": "Duration", "cf_connecting_ip_reported": "Reported visitor IP", "peer_address": "Network peer IP", "downstream_remote_address": "Network peer (with port)", "cf_country_reported": "Reported country", "user_agent": "User agent", "upstream_cluster": "Backend", "upstream_host": "Upstream address", "response_flags": "Response flags", "response_code_details": "Response details", "upstream_transport_failure_reason": "Transport failure", "request_id": "Request ID", "cf_ray": "Cloudflare Ray ID" } } } ] }, { "id": 45, "title": "Largest responses", "type": "table", "datasource": { "type": "victoriametrics-logs-datasource", "uid": "${DS_VICTORIALOGS}" }, "description": "Largest 200 responses by logged body bytes.", "gridPos": { "x": 0, "y": 62, "w": 24, "h": 8 }, "fieldConfig": { "defaults": { "unit": "none", "noValue": "\u2014", "color": { "mode": "palette-classic" } }, "overrides": [ { "matcher": { "id": "byName", "options": "Hostname" }, "properties": [ { "id": "links", "value": [ { "title": "Filter Hostname", "url": "/d/http-traffic/http-traffic?${__url_time_range}&${gateway:queryparam}&${path:queryparam}&${method:queryparam}&${status:queryparam}&${visitor:queryparam}&${peer:queryparam}&${country:queryparam}&${agent:queryparam}&${backend:queryparam}&${flags:queryparam}&${request_id:queryparam}&${ray_id:queryparam}&var-hostname=${__value.raw:percentencode}", "targetBlank": false } ] } ] }, { "matcher": { "id": "byName", "options": "Method" }, "properties": [] }, { "matcher": { "id": "byName", "options": "Path" }, "properties": [ { "id": "links", "value": [ { "title": "Filter Path", "url": "/d/http-traffic/http-traffic?${__url_time_range}&${gateway:queryparam}&${hostname:queryparam}&${method:queryparam}&${status:queryparam}&${visitor:queryparam}&${peer:queryparam}&${country:queryparam}&${agent:queryparam}&${backend:queryparam}&${flags:queryparam}&${request_id:queryparam}&${ray_id:queryparam}&var-path=${__value.raw:percentencode}", "targetBlank": false } ] } ] }, { "matcher": { "id": "byName", "options": "Status" }, "properties": [ { "id": "unit", "value": "none" }, { "id": "decimals", "value": 0 }, { "id": "mappings", "value": [ { "type": "value", "options": { "0": { "text": "No HTTP response" } } } ] } ] }, { "matcher": { "id": "byName", "options": "Response body bytes" }, "properties": [ { "id": "unit", "value": "bytes" }, { "id": "decimals", "value": 0 } ] }, { "matcher": { "id": "byName", "options": "Request body bytes" }, "properties": [ { "id": "unit", "value": "bytes" }, { "id": "decimals", "value": 0 } ] }, { "matcher": { "id": "byName", "options": "Duration" }, "properties": [ { "id": "unit", "value": "ms" }, { "id": "decimals", "value": 0 } ] }, { "matcher": { "id": "byName", "options": "Reported visitor IP" }, "properties": [ { "id": "links", "value": [ { "title": "Filter Reported visitor IP", "url": "/d/http-traffic/http-traffic?${__url_time_range}&${gateway:queryparam}&${hostname:queryparam}&${path:queryparam}&${method:queryparam}&${status:queryparam}&${peer:queryparam}&${country:queryparam}&${agent:queryparam}&${backend:queryparam}&${flags:queryparam}&${request_id:queryparam}&${ray_id:queryparam}&var-visitor=${__value.raw:percentencode}", "targetBlank": false } ] } ] }, { "matcher": { "id": "byName", "options": "Network peer IP" }, "properties": [ { "id": "links", "value": [ { "title": "Filter Network peer IP", "url": "/d/http-traffic/http-traffic?${__url_time_range}&${gateway:queryparam}&${hostname:queryparam}&${path:queryparam}&${method:queryparam}&${status:queryparam}&${visitor:queryparam}&${country:queryparam}&${agent:queryparam}&${backend:queryparam}&${flags:queryparam}&${request_id:queryparam}&${ray_id:queryparam}&var-peer=${__value.raw:percentencode}", "targetBlank": false } ] } ] } ] }, "targets": [ { "refId": "A", "datasource": { "type": "victoriametrics-logs-datasource", "uid": "${DS_VICTORIALOGS}" }, "expr": "log_type:=\"gateway-access\" gateway_name:in($gateway) authority:in($hostname) path:in($path) method:in($method) response_code:in($status) cf_connecting_ip_reported:in($visitor) | copy downstream_remote_address as peer_address | replace_regexp (\":([0-9]+)$\", \"\") at peer_address | replace_regexp (\"^\\\\[(.*)\\\\]$\", \"${1}\") at peer_address | format if (cf_country_reported:in(\"\", \"-\")) \"Unknown\" as cf_country_reported | format if (user_agent:in(\"\", \"-\")) \"Unknown\" as user_agent | format if (upstream_cluster:in(\"\", \"-\")) \"Unknown\" as upstream_cluster | format if (response_code_details:in(\"\", \"-\")) \"Unknown\" as response_code_details | format if (upstream_transport_failure_reason:in(\"\", \"-\")) \"Unknown\" as upstream_transport_failure_reason | filter peer_address:in($peer) cf_country_reported:in($country) user_agent:in($agent) upstream_cluster:in($backend) response_flags:in($flags) request_id:in(${request_id:json}) cf_ray:in(${ray_id:json}) | sort by (bytes_sent) desc | limit 200 | fields _time, authority, method, path, response_code, bytes_sent, bytes_received, duration_ms, cf_connecting_ip_reported, peer_address, request_id", "queryType": "instant", "editorMode": "code", "legendFormat": "{{__name__}}", "maxLines": 200, "direction": "desc" } ], "options": { "showHeader": true, "cellHeight": "sm", "footer": { "show": false }, "sortBy": [ { "displayName": "Response body bytes", "desc": true } ] }, "transformations": [ { "id": "extractFields", "options": { "source": "labels", "format": "json", "replace": true, "keepTime": true } }, { "id": "convertFieldType", "options": { "conversions": [ { "targetField": "response_code", "destinationType": "number" }, { "targetField": "bytes_sent", "destinationType": "number" }, { "targetField": "bytes_received", "destinationType": "number" }, { "targetField": "duration_ms", "destinationType": "number" } ], "fields": {} } }, { "id": "organize", "options": { "excludeByName": {}, "includeByName": { "Time": true, "authority": true, "method": true, "path": true, "response_code": true, "bytes_sent": true, "bytes_received": true, "duration_ms": true, "cf_connecting_ip_reported": true, "peer_address": true, "request_id": true }, "indexByName": { "Time": 0, "authority": 1, "method": 2, "path": 3, "response_code": 4, "bytes_sent": 5, "bytes_received": 6, "duration_ms": 7, "cf_connecting_ip_reported": 8, "peer_address": 9, "request_id": 10 }, "renameByName": { "Time": "Time", "authority": "Hostname", "method": "Method", "path": "Path", "response_code": "Status", "bytes_sent": "Response body bytes", "bytes_received": "Request body bytes", "duration_ms": "Duration", "cf_connecting_ip_reported": "Reported visitor IP", "peer_address": "Network peer IP", "request_id": "Request ID" } } } ] }, { "id": 46, "title": "Public request metadata coverage", "type": "table", "datasource": { "type": "victoriametrics-logs-datasource", "uid": "${DS_VICTORIALOGS}" }, "description": "Presence of metadata on filtered public requests. Zero public requests yields 0%. New metadata only exists after logging deployment; country needs Cloudflare visitor-location headers. XX/T1 count as present headers.", "gridPos": { "x": 0, "y": 70, "w": 24, "h": 8 }, "fieldConfig": { "defaults": { "unit": "none", "noValue": "\u2014", "color": { "mode": "palette-classic" } }, "overrides": [ { "matcher": { "id": "byName", "options": "Public requests" }, "properties": [ { "id": "unit", "value": "short" }, { "id": "decimals", "value": 0 } ] }, { "matcher": { "id": "byName", "options": "IP coverage" }, "properties": [ { "id": "unit", "value": "percent" }, { "id": "decimals", "value": 1 } ] }, { "matcher": { "id": "byName", "options": "Country coverage" }, "properties": [ { "id": "unit", "value": "percent" }, { "id": "decimals", "value": 1 } ] }, { "matcher": { "id": "byName", "options": "User-agent coverage" }, "properties": [ { "id": "unit", "value": "percent" }, { "id": "decimals", "value": 1 } ] }, { "matcher": { "id": "byName", "options": "Ray ID coverage" }, "properties": [ { "id": "unit", "value": "percent" }, { "id": "decimals", "value": 1 } ] } ] }, "targets": [ { "refId": "A", "datasource": { "type": "victoriametrics-logs-datasource", "uid": "${DS_VICTORIALOGS}" }, "expr": "log_type:=\"gateway-access\" gateway_name:in($gateway) authority:in($hostname) path:in($path) method:in($method) response_code:in($status) cf_connecting_ip_reported:in($visitor) | copy downstream_remote_address as peer_address | replace_regexp (\":([0-9]+)$\", \"\") at peer_address | replace_regexp (\"^\\\\[(.*)\\\\]$\", \"${1}\") at peer_address | format if (cf_country_reported:in(\"\", \"-\")) \"Unknown\" as cf_country_reported | format if (user_agent:in(\"\", \"-\")) \"Unknown\" as user_agent | format if (upstream_cluster:in(\"\", \"-\")) \"Unknown\" as upstream_cluster | format if (response_code_details:in(\"\", \"-\")) \"Unknown\" as response_code_details | format if (upstream_transport_failure_reason:in(\"\", \"-\")) \"Unknown\" as upstream_transport_failure_reason | filter peer_address:in($peer) cf_country_reported:in($country) user_agent:in($agent) upstream_cluster:in($backend) response_flags:in($flags) request_id:in(${request_id:json}) cf_ray:in(${ray_id:json}) | filter gateway_name:=\"cloudflare-gateway\" | stats count() as public_requests, count() if (cf_connecting_ip_reported:!=\"\" cf_connecting_ip_reported:!=\"-\") as with_ip, count() if (cf_country_reported:!=\"Unknown\") as with_country, count() if (user_agent:!=\"Unknown\") as with_agent, count() if (cf_ray:!=\"\" cf_ray:!=\"-\") as with_ray | math 100 * with_ip / max(public_requests, 1) as ip_percent, 100 * with_country / max(public_requests, 1) as country_percent, 100 * with_agent / max(public_requests, 1) as agent_percent, 100 * with_ray / max(public_requests, 1) as ray_percent | fields public_requests, ip_percent, country_percent, agent_percent, ray_percent", "queryType": "instant", "editorMode": "code", "legendFormat": "{{__name__}}", "maxLines": 20, "direction": "desc" } ], "options": { "showHeader": true, "cellHeight": "sm", "footer": { "show": false }, "sortBy": [ { "displayName": "Public requests", "desc": true } ] }, "transformations": [ { "id": "extractFields", "options": { "source": "labels", "format": "json", "replace": true, "keepTime": false } }, { "id": "convertFieldType", "options": { "conversions": [ { "targetField": "public_requests", "destinationType": "number" }, { "targetField": "ip_percent", "destinationType": "number" }, { "targetField": "country_percent", "destinationType": "number" }, { "targetField": "agent_percent", "destinationType": "number" }, { "targetField": "ray_percent", "destinationType": "number" } ], "fields": {} } }, { "id": "organize", "options": { "excludeByName": {}, "includeByName": { "public_requests": true, "ip_percent": true, "country_percent": true, "agent_percent": true, "ray_percent": true }, "indexByName": { "public_requests": 0, "ip_percent": 1, "country_percent": 2, "agent_percent": 3, "ray_percent": 4 }, "renameByName": { "public_requests": "Public requests", "ip_percent": "IP coverage", "country_percent": "Country coverage", "agent_percent": "User-agent coverage", "ray_percent": "Ray ID coverage" } } } ] } ] } ] }