observability/grafana/environments/prod/dashboards/http-traffic-dashboard.yaml
Rama main · réplica de lectura del repositorio original.
# Query types and raw-log frame fields match the installed VictoriaLogs plugin:
# https://github.com/VictoriaMetrics/victorialogs-datasource/blob/v0.33.1/src/types.ts
# https://github.com/VictoriaMetrics/victorialogs-datasource/blob/v0.33.1/pkg/plugin/response_logs.go
# Client breakdowns use numeric stats and rowsToFields to name each category.
# Bar gauges need a nonempty default displayName to keep single-category labels;
# the empty displayName override lets each generated field supply its own name.
apiVersion: grafana.integreatly.org/v1beta1
kind: GrafanaDashboard
metadata:
name: http-traffic-dashboard
spec:
folderRef: networking
datasources:
- inputName: DS_VICTORIALOGS
datasourceName: victorialogs-default
json: |
{
"__inputs": [
{
"name": "DS_VICTORIALOGS",
"label": "VictoriaLogs",
"description": "Gateway access logs",
"type": "datasource",
"pluginId": "victoriametrics-logs-datasource",
"pluginName": "VictoriaLogs"
}
],
"uid": "http-traffic",
"title": "HTTP Traffic",
"description": "Detailed HTTP traffic, reported visitors, endpoints and gateway/backend diagnostics from completed access logs. New metadata appears after Envoy configuration sync. Cloudflare cache hits and requests blocked before the gateways are not captured. Browser/OS/device breakdowns are inferred from reported User-Agent; the map uses reported country codes, not precise IP locations. No Cloudflare Analytics API collection is required.",
"schemaVersion": 39,
"version": 4,
"editable": true,
"graphTooltip": 1,
"tags": [
"http",
"gateways",
"victorialogs"
],
"timezone": "browser",
"refresh": "30s",
"time": {
"from": "now-1h",
"to": "now"
},
"templating": {
"list": [
{
"name": "gateway",
"label": "Gateway",
"type": "query",
"datasource": {
"type": "victoriametrics-logs-datasource",
"uid": "${DS_VICTORIALOGS}"
},
"query": {
"type": "fieldValue",
"field": "gateway_name",
"query": "log_type:=\"gateway-access\"",
"limit": 1000
},
"refresh": 2,
"sort": 1,
"multi": true,
"includeAll": true,
"allValue": "*",
"current": {
"text": [
"All"
],
"value": [
"$__all"
]
},
"options": []
},
{
"name": "hostname",
"label": "Hostname",
"type": "query",
"datasource": {
"type": "victoriametrics-logs-datasource",
"uid": "${DS_VICTORIALOGS}"
},
"query": {
"type": "fieldValue",
"field": "authority",
"query": "log_type:=\"gateway-access\" gateway_name:in($gateway)",
"limit": 1000
},
"refresh": 2,
"sort": 1,
"multi": true,
"includeAll": true,
"allValue": "*",
"current": {
"text": [
"All"
],
"value": [
"$__all"
]
},
"options": []
},
{
"name": "path",
"label": "Path",
"type": "query",
"datasource": {
"type": "victoriametrics-logs-datasource",
"uid": "${DS_VICTORIALOGS}"
},
"query": {
"type": "fieldValue",
"field": "path",
"query": "log_type:=\"gateway-access\" gateway_name:in($gateway) authority:in($hostname)",
"limit": 1000
},
"refresh": 2,
"sort": 1,
"multi": true,
"includeAll": true,
"allValue": "*",
"current": {
"text": [
"All"
],
"value": [
"$__all"
]
},
"options": []
},
{
"name": "method",
"label": "Method",
"type": "query",
"datasource": {
"type": "victoriametrics-logs-datasource",
"uid": "${DS_VICTORIALOGS}"
},
"query": {
"type": "fieldValue",
"field": "method",
"query": "log_type:=\"gateway-access\" gateway_name:in($gateway) authority:in($hostname)",
"limit": 1000
},
"refresh": 2,
"sort": 1,
"multi": true,
"includeAll": true,
"allValue": "*",
"current": {
"text": [
"All"
],
"value": [
"$__all"
]
},
"options": []
},
{
"name": "status",
"label": "Status",
"type": "query",
"datasource": {
"type": "victoriametrics-logs-datasource",
"uid": "${DS_VICTORIALOGS}"
},
"query": {
"type": "fieldValue",
"field": "response_code",
"query": "log_type:=\"gateway-access\" gateway_name:in($gateway) authority:in($hostname)",
"limit": 1000
},
"refresh": 2,
"sort": 1,
"multi": true,
"includeAll": true,
"allValue": "*",
"current": {
"text": [
"All"
],
"value": [
"$__all"
]
},
"options": []
},
{
"name": "visitor",
"label": "Reported visitor IP",
"type": "query",
"datasource": {
"type": "victoriametrics-logs-datasource",
"uid": "${DS_VICTORIALOGS}"
},
"query": {
"type": "fieldValue",
"field": "cf_connecting_ip_reported",
"query": "log_type:=\"gateway-access\" gateway_name:in($gateway) authority:in($hostname)",
"limit": 1000
},
"refresh": 2,
"sort": 1,
"multi": true,
"includeAll": true,
"allValue": "*",
"current": {
"text": [
"All"
],
"value": [
"$__all"
]
},
"options": []
},
{
"name": "peer",
"label": "Network peer IP",
"type": "query",
"datasource": {
"type": "victoriametrics-logs-datasource",
"uid": "${DS_VICTORIALOGS}"
},
"query": {
"type": "fieldValue",
"field": "peer_address",
"query": "log_type:=\"gateway-access\" gateway_name:in($gateway) authority:in($hostname) | copy downstream_remote_address as peer_address | replace_regexp (\":([0-9]+)$\", \"\") at peer_address | replace_regexp (\"^\\\\[(.*)\\\\]$\", \"${1}\") at peer_address | format if (cf_country_reported:in(\"\", \"-\")) \"Unknown\" as cf_country_reported | format if (user_agent:in(\"\", \"-\")) \"Unknown\" as user_agent | format if (upstream_cluster:in(\"\", \"-\")) \"Unknown\" as upstream_cluster | format if (response_code_details:in(\"\", \"-\")) \"Unknown\" as response_code_details | format if (upstream_transport_failure_reason:in(\"\", \"-\")) \"Unknown\" as upstream_transport_failure_reason",
"limit": 1000
},
"refresh": 2,
"sort": 1,
"multi": true,
"includeAll": true,
"allValue": "*",
"current": {
"text": [
"All"
],
"value": [
"$__all"
]
},
"options": []
},
{
"name": "country",
"label": "Reported country",
"type": "query",
"datasource": {
"type": "victoriametrics-logs-datasource",
"uid": "${DS_VICTORIALOGS}"
},
"query": {
"type": "fieldValue",
"field": "cf_country_reported",
"query": "log_type:=\"gateway-access\" gateway_name:in($gateway) authority:in($hostname) | copy downstream_remote_address as peer_address | replace_regexp (\":([0-9]+)$\", \"\") at peer_address | replace_regexp (\"^\\\\[(.*)\\\\]$\", \"${1}\") at peer_address | format if (cf_country_reported:in(\"\", \"-\")) \"Unknown\" as cf_country_reported | format if (user_agent:in(\"\", \"-\")) \"Unknown\" as user_agent | format if (upstream_cluster:in(\"\", \"-\")) \"Unknown\" as upstream_cluster | format if (response_code_details:in(\"\", \"-\")) \"Unknown\" as response_code_details | format if (upstream_transport_failure_reason:in(\"\", \"-\")) \"Unknown\" as upstream_transport_failure_reason",
"limit": 1000
},
"refresh": 2,
"sort": 1,
"multi": true,
"includeAll": true,
"allValue": "*",
"current": {
"text": [
"All"
],
"value": [
"$__all"
]
},
"options": []
},
{
"name": "agent",
"label": "User agent",
"type": "query",
"datasource": {
"type": "victoriametrics-logs-datasource",
"uid": "${DS_VICTORIALOGS}"
},
"query": {
"type": "fieldValue",
"field": "user_agent",
"query": "log_type:=\"gateway-access\" gateway_name:in($gateway) authority:in($hostname) | copy downstream_remote_address as peer_address | replace_regexp (\":([0-9]+)$\", \"\") at peer_address | replace_regexp (\"^\\\\[(.*)\\\\]$\", \"${1}\") at peer_address | format if (cf_country_reported:in(\"\", \"-\")) \"Unknown\" as cf_country_reported | format if (user_agent:in(\"\", \"-\")) \"Unknown\" as user_agent | format if (upstream_cluster:in(\"\", \"-\")) \"Unknown\" as upstream_cluster | format if (response_code_details:in(\"\", \"-\")) \"Unknown\" as response_code_details | format if (upstream_transport_failure_reason:in(\"\", \"-\")) \"Unknown\" as upstream_transport_failure_reason",
"limit": 1000
},
"refresh": 2,
"sort": 1,
"multi": true,
"includeAll": true,
"allValue": "*",
"current": {
"text": [
"All"
],
"value": [
"$__all"
]
},
"options": []
},
{
"name": "backend",
"label": "Backend",
"type": "query",
"datasource": {
"type": "victoriametrics-logs-datasource",
"uid": "${DS_VICTORIALOGS}"
},
"query": {
"type": "fieldValue",
"field": "upstream_cluster",
"query": "log_type:=\"gateway-access\" gateway_name:in($gateway) authority:in($hostname) | copy downstream_remote_address as peer_address | replace_regexp (\":([0-9]+)$\", \"\") at peer_address | replace_regexp (\"^\\\\[(.*)\\\\]$\", \"${1}\") at peer_address | format if (cf_country_reported:in(\"\", \"-\")) \"Unknown\" as cf_country_reported | format if (user_agent:in(\"\", \"-\")) \"Unknown\" as user_agent | format if (upstream_cluster:in(\"\", \"-\")) \"Unknown\" as upstream_cluster | format if (response_code_details:in(\"\", \"-\")) \"Unknown\" as response_code_details | format if (upstream_transport_failure_reason:in(\"\", \"-\")) \"Unknown\" as upstream_transport_failure_reason",
"limit": 1000
},
"refresh": 2,
"sort": 1,
"multi": true,
"includeAll": true,
"allValue": "*",
"current": {
"text": [
"All"
],
"value": [
"$__all"
]
},
"options": []
},
{
"name": "flags",
"label": "Response flag",
"type": "query",
"datasource": {
"type": "victoriametrics-logs-datasource",
"uid": "${DS_VICTORIALOGS}"
},
"query": {
"type": "fieldValue",
"field": "response_flags",
"query": "log_type:=\"gateway-access\" gateway_name:in($gateway) authority:in($hostname)",
"limit": 1000
},
"refresh": 2,
"sort": 1,
"multi": true,
"includeAll": true,
"allValue": "*",
"current": {
"text": [
"All"
],
"value": [
"$__all"
]
},
"options": []
},
{
"name": "request_id",
"label": "Request ID lookup",
"type": "textbox",
"description": "Exact match; * means all. Values are escaped as JSON strings.",
"query": "*",
"current": {
"text": "*",
"value": "*"
},
"options": []
},
{
"name": "ray_id",
"label": "Ray ID lookup",
"type": "textbox",
"description": "Exact match; * means all. Values are escaped as JSON strings.",
"query": "*",
"current": {
"text": "*",
"value": "*"
},
"options": []
}
]
},
"annotations": {
"list": []
},
"panels": [
{
"id": 1,
"type": "row",
"title": "Overview",
"collapsed": false,
"gridPos": {
"x": 0,
"y": 0,
"w": 24,
"h": 1
},
"panels": []
},
{
"id": 2,
"title": "Requests",
"type": "stat",
"datasource": {
"type": "victoriametrics-logs-datasource",
"uid": "${DS_VICTORIALOGS}"
},
"description": "All matching completed access-log records, including requests with no HTTP response.",
"gridPos": {
"x": 0,
"y": 1,
"w": 6,
"h": 4
},
"fieldConfig": {
"defaults": {
"unit": "short",
"noValue": "\u2014",
"color": {
"mode": "palette-classic"
}
},
"overrides": []
},
"targets": [
{
"refId": "A",
"datasource": {
"type": "victoriametrics-logs-datasource",
"uid": "${DS_VICTORIALOGS}"
},
"expr": "log_type:=\"gateway-access\" gateway_name:in($gateway) authority:in($hostname) path:in($path) method:in($method) response_code:in($status) cf_connecting_ip_reported:in($visitor) | copy downstream_remote_address as peer_address | replace_regexp (\":([0-9]+)$\", \"\") at peer_address | replace_regexp (\"^\\\\[(.*)\\\\]$\", \"${1}\") at peer_address | format if (cf_country_reported:in(\"\", \"-\")) \"Unknown\" as cf_country_reported | format if (user_agent:in(\"\", \"-\")) \"Unknown\" as user_agent | format if (upstream_cluster:in(\"\", \"-\")) \"Unknown\" as upstream_cluster | format if (response_code_details:in(\"\", \"-\")) \"Unknown\" as response_code_details | format if (upstream_transport_failure_reason:in(\"\", \"-\")) \"Unknown\" as upstream_transport_failure_reason | filter peer_address:in($peer) cf_country_reported:in($country) user_agent:in($agent) upstream_cluster:in($backend) response_flags:in($flags) request_id:in(${request_id:json}) cf_ray:in(${ray_id:json}) | stats count() as requests",
"queryType": "stats",
"editorMode": "code",
"legendFormat": "{{__name__}}",
"maxLines": 1000,
"direction": "desc"
}
],
"options": {
"reduceOptions": {
"calcs": [
"lastNotNull"
],
"fields": "",
"values": false
},
"orientation": "auto",
"textMode": "auto",
"colorMode": "value",
"graphMode": "none",
"justifyMode": "auto"
}
},
{
"id": 3,
"title": "Requests / second",
"type": "stat",
"datasource": {
"type": "victoriametrics-logs-datasource",
"uid": "${DS_VICTORIALOGS}"
},
"description": "Average rate over the selected time range.",
"gridPos": {
"x": 6,
"y": 1,
"w": 6,
"h": 4
},
"fieldConfig": {
"defaults": {
"unit": "reqps",
"noValue": "\u2014",
"color": {
"mode": "palette-classic"
}
},
"overrides": []
},
"targets": [
{
"refId": "A",
"datasource": {
"type": "victoriametrics-logs-datasource",
"uid": "${DS_VICTORIALOGS}"
},
"expr": "log_type:=\"gateway-access\" gateway_name:in($gateway) authority:in($hostname) path:in($path) method:in($method) response_code:in($status) cf_connecting_ip_reported:in($visitor) | copy downstream_remote_address as peer_address | replace_regexp (\":([0-9]+)$\", \"\") at peer_address | replace_regexp (\"^\\\\[(.*)\\\\]$\", \"${1}\") at peer_address | format if (cf_country_reported:in(\"\", \"-\")) \"Unknown\" as cf_country_reported | format if (user_agent:in(\"\", \"-\")) \"Unknown\" as user_agent | format if (upstream_cluster:in(\"\", \"-\")) \"Unknown\" as upstream_cluster | format if (response_code_details:in(\"\", \"-\")) \"Unknown\" as response_code_details | format if (upstream_transport_failure_reason:in(\"\", \"-\")) \"Unknown\" as upstream_transport_failure_reason | filter peer_address:in($peer) cf_country_reported:in($country) user_agent:in($agent) upstream_cluster:in($backend) response_flags:in($flags) request_id:in(${request_id:json}) cf_ray:in(${ray_id:json}) | stats rate() as requests_per_second",
"queryType": "stats",
"editorMode": "code",
"legendFormat": "{{__name__}}",
"maxLines": 1000,
"direction": "desc"
}
],
"options": {
"reduceOptions": {
"calcs": [
"lastNotNull"
],
"fields": "",
"values": false
},
"orientation": "auto",
"textMode": "auto",
"colorMode": "value",
"graphMode": "none",
"justifyMode": "auto"
}
},
{
"id": 4,
"title": "Reported public IPs",
"type": "stat",
"datasource": {
"type": "victoriametrics-logs-datasource",
"uid": "${DS_VICTORIALOGS}"
},
"description": "Distinct reported CF-Connecting-IP values on public traffic. Addresses are not unique people or authenticated identities.",
"gridPos": {
"x": 12,
"y": 1,
"w": 6,
"h": 4
},
"fieldConfig": {
"defaults": {
"unit": "short",
"noValue": "\u2014",
"color": {
"mode": "palette-classic"
}
},
"overrides": []
},
"targets": [
{
"refId": "A",
"datasource": {
"type": "victoriametrics-logs-datasource",
"uid": "${DS_VICTORIALOGS}"
},
"expr": "log_type:=\"gateway-access\" gateway_name:in($gateway) authority:in($hostname) path:in($path) method:in($method) response_code:in($status) cf_connecting_ip_reported:in($visitor) | copy downstream_remote_address as peer_address | replace_regexp (\":([0-9]+)$\", \"\") at peer_address | replace_regexp (\"^\\\\[(.*)\\\\]$\", \"${1}\") at peer_address | format if (cf_country_reported:in(\"\", \"-\")) \"Unknown\" as cf_country_reported | format if (user_agent:in(\"\", \"-\")) \"Unknown\" as user_agent | format if (upstream_cluster:in(\"\", \"-\")) \"Unknown\" as upstream_cluster | format if (response_code_details:in(\"\", \"-\")) \"Unknown\" as response_code_details | format if (upstream_transport_failure_reason:in(\"\", \"-\")) \"Unknown\" as upstream_transport_failure_reason | filter peer_address:in($peer) cf_country_reported:in($country) user_agent:in($agent) upstream_cluster:in($backend) response_flags:in($flags) request_id:in(${request_id:json}) cf_ray:in(${ray_id:json}) | stats count_uniq(cf_connecting_ip_reported) if (gateway_name:=\"cloudflare-gateway\" cf_connecting_ip_reported:!=\"\" cf_connecting_ip_reported:!=\"-\") as addresses",
"queryType": "stats",
"editorMode": "code",
"legendFormat": "{{__name__}}",
"maxLines": 1000,
"direction": "desc"
}
],
"options": {
"reduceOptions": {
"calcs": [
"lastNotNull"
],
"fields": "",
"values": false
},
"orientation": "auto",
"textMode": "auto",
"colorMode": "value",
"graphMode": "none",
"justifyMode": "auto"
}
},
{
"id": 5,
"title": "Active hostnames",
"type": "stat",
"datasource": {
"type": "victoriametrics-logs-datasource",
"uid": "${DS_VICTORIALOGS}"
},
"description": "Distinct HTTP hostnames in the selected records.",
"gridPos": {
"x": 18,
"y": 1,
"w": 6,
"h": 4
},
"fieldConfig": {
"defaults": {
"unit": "short",
"noValue": "\u2014",
"color": {
"mode": "palette-classic"
}
},
"overrides": []
},
"targets": [
{
"refId": "A",
"datasource": {
"type": "victoriametrics-logs-datasource",
"uid": "${DS_VICTORIALOGS}"
},
"expr": "log_type:=\"gateway-access\" gateway_name:in($gateway) authority:in($hostname) path:in($path) method:in($method) response_code:in($status) cf_connecting_ip_reported:in($visitor) | copy downstream_remote_address as peer_address | replace_regexp (\":([0-9]+)$\", \"\") at peer_address | replace_regexp (\"^\\\\[(.*)\\\\]$\", \"${1}\") at peer_address | format if (cf_country_reported:in(\"\", \"-\")) \"Unknown\" as cf_country_reported | format if (user_agent:in(\"\", \"-\")) \"Unknown\" as user_agent | format if (upstream_cluster:in(\"\", \"-\")) \"Unknown\" as upstream_cluster | format if (response_code_details:in(\"\", \"-\")) \"Unknown\" as response_code_details | format if (upstream_transport_failure_reason:in(\"\", \"-\")) \"Unknown\" as upstream_transport_failure_reason | filter peer_address:in($peer) cf_country_reported:in($country) user_agent:in($agent) upstream_cluster:in($backend) response_flags:in($flags) request_id:in(${request_id:json}) cf_ray:in(${ray_id:json}) | stats count_uniq(authority) as hostnames",
"queryType": "stats",
"editorMode": "code",
"legendFormat": "{{__name__}}",
"maxLines": 1000,
"direction": "desc"
}
],
"options": {
"reduceOptions": {
"calcs": [
"lastNotNull"
],
"fields": "",
"values": false
},
"orientation": "auto",
"textMode": "auto",
"colorMode": "value",
"graphMode": "none",
"justifyMode": "auto"
}
},
{
"id": 6,
"title": "Response body bytes",
"type": "stat",
"datasource": {
"type": "victoriametrics-logs-datasource",
"uid": "${DS_VICTORIALOGS}"
},
"description": "Total logged HTTP response body bytes. This is not tunnel or wire bandwidth; for WebSockets Envoy can include handshake headers.",
"gridPos": {
"x": 0,
"y": 5,
"w": 6,
"h": 4
},
"fieldConfig": {
"defaults": {
"unit": "bytes",
"noValue": "\u2014",
"color": {
"mode": "palette-classic"
}
},
"overrides": []
},
"targets": [
{
"refId": "A",
"datasource": {
"type": "victoriametrics-logs-datasource",
"uid": "${DS_VICTORIALOGS}"
},
"expr": "log_type:=\"gateway-access\" gateway_name:in($gateway) authority:in($hostname) path:in($path) method:in($method) response_code:in($status) cf_connecting_ip_reported:in($visitor) | copy downstream_remote_address as peer_address | replace_regexp (\":([0-9]+)$\", \"\") at peer_address | replace_regexp (\"^\\\\[(.*)\\\\]$\", \"${1}\") at peer_address | format if (cf_country_reported:in(\"\", \"-\")) \"Unknown\" as cf_country_reported | format if (user_agent:in(\"\", \"-\")) \"Unknown\" as user_agent | format if (upstream_cluster:in(\"\", \"-\")) \"Unknown\" as upstream_cluster | format if (response_code_details:in(\"\", \"-\")) \"Unknown\" as response_code_details | format if (upstream_transport_failure_reason:in(\"\", \"-\")) \"Unknown\" as upstream_transport_failure_reason | filter peer_address:in($peer) cf_country_reported:in($country) user_agent:in($agent) upstream_cluster:in($backend) response_flags:in($flags) request_id:in(${request_id:json}) cf_ray:in(${ray_id:json}) | stats sum(bytes_sent) as response_bytes | math max(0, response_bytes) as response_bytes",
"queryType": "stats",
"editorMode": "code",
"legendFormat": "{{__name__}}",
"maxLines": 1000,
"direction": "desc"
}
],
"options": {
"reduceOptions": {
"calcs": [
"lastNotNull"
],
"fields": "",
"values": false
},
"orientation": "auto",
"textMode": "auto",
"colorMode": "value",
"graphMode": "none",
"justifyMode": "auto"
}
},
{
"id": 7,
"title": "HTTP 4xx",
"type": "stat",
"datasource": {
"type": "victoriametrics-logs-datasource",
"uid": "${DS_VICTORIALOGS}"
},
"description": "4xx as a percentage of HTTP responses (100\u2013599); excludes code 0. No responses yields 0%.",
"gridPos": {
"x": 6,
"y": 5,
"w": 6,
"h": 4
},
"fieldConfig": {
"defaults": {
"unit": "percent",
"noValue": "\u2014",
"color": {
"mode": "palette-classic"
}
},
"overrides": []
},
"targets": [
{
"refId": "A",
"datasource": {
"type": "victoriametrics-logs-datasource",
"uid": "${DS_VICTORIALOGS}"
},
"expr": "log_type:=\"gateway-access\" gateway_name:in($gateway) authority:in($hostname) path:in($path) method:in($method) response_code:in($status) cf_connecting_ip_reported:in($visitor) | copy downstream_remote_address as peer_address | replace_regexp (\":([0-9]+)$\", \"\") at peer_address | replace_regexp (\"^\\\\[(.*)\\\\]$\", \"${1}\") at peer_address | format if (cf_country_reported:in(\"\", \"-\")) \"Unknown\" as cf_country_reported | format if (user_agent:in(\"\", \"-\")) \"Unknown\" as user_agent | format if (upstream_cluster:in(\"\", \"-\")) \"Unknown\" as upstream_cluster | format if (response_code_details:in(\"\", \"-\")) \"Unknown\" as response_code_details | format if (upstream_transport_failure_reason:in(\"\", \"-\")) \"Unknown\" as upstream_transport_failure_reason | filter peer_address:in($peer) cf_country_reported:in($country) user_agent:in($agent) upstream_cluster:in($backend) response_flags:in($flags) request_id:in(${request_id:json}) cf_ray:in(${ray_id:json}) | stats count() if (response_code:>=100 response_code:<600) as responses, count() if (response_code:>=400 response_code:<500) as errors | math 100 * errors / max(responses, 1) as error_percent | fields error_percent",
"queryType": "stats",
"editorMode": "code",
"legendFormat": "{{__name__}}",
"maxLines": 1000,
"direction": "desc"
}
],
"options": {
"reduceOptions": {
"calcs": [
"lastNotNull"
],
"fields": "",
"values": false
},
"orientation": "auto",
"textMode": "auto",
"colorMode": "value",
"graphMode": "none",
"justifyMode": "auto"
}
},
{
"id": 8,
"title": "HTTP 5xx",
"type": "stat",
"datasource": {
"type": "victoriametrics-logs-datasource",
"uid": "${DS_VICTORIALOGS}"
},
"description": "5xx as a percentage of HTTP responses (100\u2013599); excludes code 0. No responses yields 0%.",
"gridPos": {
"x": 12,
"y": 5,
"w": 6,
"h": 4
},
"fieldConfig": {
"defaults": {
"unit": "percent",
"noValue": "\u2014",
"color": {
"mode": "palette-classic"
}
},
"overrides": []
},
"targets": [
{
"refId": "A",
"datasource": {
"type": "victoriametrics-logs-datasource",
"uid": "${DS_VICTORIALOGS}"
},
"expr": "log_type:=\"gateway-access\" gateway_name:in($gateway) authority:in($hostname) path:in($path) method:in($method) response_code:in($status) cf_connecting_ip_reported:in($visitor) | copy downstream_remote_address as peer_address | replace_regexp (\":([0-9]+)$\", \"\") at peer_address | replace_regexp (\"^\\\\[(.*)\\\\]$\", \"${1}\") at peer_address | format if (cf_country_reported:in(\"\", \"-\")) \"Unknown\" as cf_country_reported | format if (user_agent:in(\"\", \"-\")) \"Unknown\" as user_agent | format if (upstream_cluster:in(\"\", \"-\")) \"Unknown\" as upstream_cluster | format if (response_code_details:in(\"\", \"-\")) \"Unknown\" as response_code_details | format if (upstream_transport_failure_reason:in(\"\", \"-\")) \"Unknown\" as upstream_transport_failure_reason | filter peer_address:in($peer) cf_country_reported:in($country) user_agent:in($agent) upstream_cluster:in($backend) response_flags:in($flags) request_id:in(${request_id:json}) cf_ray:in(${ray_id:json}) | stats count() if (response_code:>=100 response_code:<600) as responses, count() if (response_code:>=500 response_code:<600) as errors | math 100 * errors / max(responses, 1) as error_percent | fields error_percent",
"queryType": "stats",
"editorMode": "code",
"legendFormat": "{{__name__}}",
"maxLines": 1000,
"direction": "desc"
}
],
"options": {
"reduceOptions": {
"calcs": [
"lastNotNull"
],
"fields": "",
"values": false
},
"orientation": "auto",
"textMode": "auto",
"colorMode": "value",
"graphMode": "none",
"justifyMode": "auto"
}
},
{
"id": 9,
"title": "p95 duration",
"type": "stat",
"datasource": {
"type": "victoriametrics-logs-datasource",
"uid": "${DS_VICTORIALOGS}"
},
"description": "95th percentile completed-request duration. Includes long-lived requests. No samples shows no value.",
"gridPos": {
"x": 18,
"y": 5,
"w": 6,
"h": 4
},
"fieldConfig": {
"defaults": {
"unit": "ms",
"noValue": "\u2014",
"color": {
"mode": "palette-classic"
}
},
"overrides": []
},
"targets": [
{
"refId": "A",
"datasource": {
"type": "victoriametrics-logs-datasource",
"uid": "${DS_VICTORIALOGS}"
},
"expr": "log_type:=\"gateway-access\" gateway_name:in($gateway) authority:in($hostname) path:in($path) method:in($method) response_code:in($status) cf_connecting_ip_reported:in($visitor) | copy downstream_remote_address as peer_address | replace_regexp (\":([0-9]+)$\", \"\") at peer_address | replace_regexp (\"^\\\\[(.*)\\\\]$\", \"${1}\") at peer_address | format if (cf_country_reported:in(\"\", \"-\")) \"Unknown\" as cf_country_reported | format if (user_agent:in(\"\", \"-\")) \"Unknown\" as user_agent | format if (upstream_cluster:in(\"\", \"-\")) \"Unknown\" as upstream_cluster | format if (response_code_details:in(\"\", \"-\")) \"Unknown\" as response_code_details | format if (upstream_transport_failure_reason:in(\"\", \"-\")) \"Unknown\" as upstream_transport_failure_reason | filter peer_address:in($peer) cf_country_reported:in($country) user_agent:in($agent) upstream_cluster:in($backend) response_flags:in($flags) request_id:in(${request_id:json}) cf_ray:in(${ray_id:json}) | filter response_code:>=100 response_code:<600 | stats quantile(0.95, duration_ms) as p95_ms | filter p95_ms:!=\"\"",
"queryType": "stats",
"editorMode": "code",
"legendFormat": "{{__name__}}",
"maxLines": 1000,
"direction": "desc"
}
],
"options": {
"reduceOptions": {
"calcs": [
"lastNotNull"
],
"fields": "",
"values": false
},
"orientation": "auto",
"textMode": "auto",
"colorMode": "value",
"graphMode": "none",
"justifyMode": "auto"
}
},
{
"id": 52,
"title": "Geography",
"type": "row",
"collapsed": false,
"gridPos": {
"x": 0,
"y": 9,
"w": 24,
"h": 1
},
"panels": []
},
{
"id": 50,
"title": "Public requests by reported country",
"type": "geomap",
"datasource": {
"type": "victoriametrics-logs-datasource",
"uid": "${DS_VICTORIALOGS}"
},
"description": "Country-level request counts from the reported CF-IPCountry header, placed at country centroids. Not precise visitor locations. Missing/XX/T1 country values remain in the country ranking and coverage panels but cannot be mapped. Country data needs Cloudflare visitor-location headers; no IP geolocation service is used. OpenStreetMap provides the basemap without an API key; country markers still need reported country data.",
"gridPos": {
"x": 0,
"y": 10,
"w": 12,
"h": 10
},
"fieldConfig": {
"defaults": {
"unit": "short",
"color": {
"mode": "continuous-BlYlRd"
},
"noValue": "\u2014"
},
"overrides": []
},
"targets": [
{
"refId": "A",
"datasource": {
"type": "victoriametrics-logs-datasource",
"uid": "${DS_VICTORIALOGS}"
},
"expr": "log_type:=\"gateway-access\" gateway_name:in($gateway) authority:in($hostname) path:in($path) method:in($method) response_code:in($status) cf_connecting_ip_reported:in($visitor) | copy downstream_remote_address as peer_address | replace_regexp (\":([0-9]+)$\", \"\") at peer_address | replace_regexp (\"^\\\\[(.*)\\\\]$\", \"${1}\") at peer_address | format if (cf_country_reported:in(\"\", \"-\")) \"Unknown\" as cf_country_reported | format if (user_agent:in(\"\", \"-\")) \"Unknown\" as user_agent | format if (upstream_cluster:in(\"\", \"-\")) \"Unknown\" as upstream_cluster | format if (response_code_details:in(\"\", \"-\")) \"Unknown\" as response_code_details | format if (upstream_transport_failure_reason:in(\"\", \"-\")) \"Unknown\" as upstream_transport_failure_reason | filter peer_address:in($peer) cf_country_reported:in($country) user_agent:in($agent) upstream_cluster:in($backend) response_flags:in($flags) request_id:in(${request_id:json}) cf_ray:in(${ray_id:json}) | filter gateway_name:=\"cloudflare-gateway\" cf_country_reported:~\"^[A-Z]{2}$\" cf_country_reported:!=\"XX\" | stats by (cf_country_reported) count() as requests",
"queryType": "instant",
"editorMode": "code",
"legendFormat": "{{__name__}}",
"maxLines": 300,
"direction": "desc"
}
],
"options": {
"view": {
"id": "zero",
"lat": 20,
"lon": 0,
"zoom": 1,
"allLayers": true
},
"controls": {
"showZoom": true,
"mouseWheelZoom": false,
"showAttribution": true,
"showScale": false
},
"tooltip": {
"mode": "details"
},
"basemap": {
"name": "OpenStreetMap",
"type": "osm-standard",
"config": {},
"opacity": 1
},
"layers": [
{
"name": "Requests",
"type": "markers",
"location": {
"mode": "lookup",
"lookup": "Reported country",
"gazetteer": "public/gazetteer/countries.json"
},
"config": {
"showLegend": true,
"style": {
"color": {
"field": "Requests",
"fixed": "blue"
},
"size": {
"field": "Requests",
"fixed": 6,
"min": 5,
"max": 28
},
"opacity": 0.8,
"symbol": {
"mode": "fixed",
"fixed": "img/icons/marker/circle.svg"
},
"text": {
"mode": "field",
"field": "Reported country",
"fixed": ""
}
}
},
"opacity": 1,
"tooltip": true
}
]
},
"transformations": [
{
"id": "extractFields",
"options": {
"source": "labels",
"format": "json",
"replace": true,
"keepTime": false
}
},
{
"id": "convertFieldType",
"options": {
"conversions": [
{
"targetField": "requests",
"destinationType": "number"
}
],
"fields": {}
}
},
{
"id": "organize",
"options": {
"includeByName": {
"cf_country_reported": true,
"requests": true
},
"indexByName": {
"cf_country_reported": 0,
"requests": 1
},
"renameByName": {
"cf_country_reported": "Reported country",
"requests": "Requests"
}
}
}
]
},
{
"id": 22,
"title": "Reported country ranking",
"type": "table",
"datasource": {
"type": "victoriametrics-logs-datasource",
"uid": "${DS_VICTORIALOGS}"
},
"description": "Public requests by CF-IPCountry. Requires Cloudflare visitor-location headers. Codes XX and T1 are preserved; missing values are Unknown.",
"gridPos": {
"x": 12,
"y": 10,
"w": 12,
"h": 10
},
"fieldConfig": {
"defaults": {
"unit": "none",
"noValue": "\u2014",
"color": {
"mode": "palette-classic"
}
},
"overrides": [
{
"matcher": {
"id": "byName",
"options": "Reported country"
},
"properties": []
},
{
"matcher": {
"id": "byName",
"options": "Requests"
},
"properties": [
{
"id": "unit",
"value": "short"
},
{
"id": "decimals",
"value": 0
}
]
}
]
},
"targets": [
{
"refId": "A",
"datasource": {
"type": "victoriametrics-logs-datasource",
"uid": "${DS_VICTORIALOGS}"
},
"expr": "log_type:=\"gateway-access\" gateway_name:in($gateway) authority:in($hostname) path:in($path) method:in($method) response_code:in($status) cf_connecting_ip_reported:in($visitor) | copy downstream_remote_address as peer_address | replace_regexp (\":([0-9]+)$\", \"\") at peer_address | replace_regexp (\"^\\\\[(.*)\\\\]$\", \"${1}\") at peer_address | format if (cf_country_reported:in(\"\", \"-\")) \"Unknown\" as cf_country_reported | format if (user_agent:in(\"\", \"-\")) \"Unknown\" as user_agent | format if (upstream_cluster:in(\"\", \"-\")) \"Unknown\" as upstream_cluster | format if (response_code_details:in(\"\", \"-\")) \"Unknown\" as response_code_details | format if (upstream_transport_failure_reason:in(\"\", \"-\")) \"Unknown\" as upstream_transport_failure_reason | filter peer_address:in($peer) cf_country_reported:in($country) user_agent:in($agent) upstream_cluster:in($backend) response_flags:in($flags) request_id:in(${request_id:json}) cf_ray:in(${ray_id:json}) | filter gateway_name:=\"cloudflare-gateway\" | stats by (cf_country_reported) count() as requests | sort by (requests) desc | limit 20",
"queryType": "instant",
"editorMode": "code",
"legendFormat": "{{__name__}}",
"maxLines": 20,
"direction": "desc"
}
],
"options": {
"showHeader": true,
"cellHeight": "sm",
"footer": {
"show": false
},
"sortBy": [
{
"displayName": "Requests",
"desc": true
}
]
},
"transformations": [
{
"id": "extractFields",
"options": {
"source": "labels",
"format": "json",
"replace": true,
"keepTime": false
}
},
{
"id": "convertFieldType",
"options": {
"conversions": [
{
"targetField": "requests",
"destinationType": "number"
}
],
"fields": {}
}
},
{
"id": "organize",
"options": {
"excludeByName": {},
"includeByName": {
"cf_country_reported": true,
"requests": true
},
"indexByName": {
"cf_country_reported": 0,
"requests": 1
},
"renameByName": {
"cf_country_reported": "Reported country",
"requests": "Requests"
}
}
}
]
},
{
"id": 53,
"title": "Client breakdowns",
"type": "row",
"collapsed": false,
"gridPos": {
"x": 0,
"y": 20,
"w": 24,
"h": 1
},
"panels": []
},
{
"id": 47,
"title": "Top browsers (inferred)",
"type": "bargauge",
"datasource": {
"type": "victoriametrics-logs-datasource",
"uid": "${DS_VICTORIALOGS}"
},
"description": "Inferred from the reported User-Agent using broad patterns. Headers can be spoofed; Unknown includes old logs, missing headers and unrecognized clients. Bot/crawler means the user agent claims to be one, not verified bot detection.",
"gridPos": {
"x": 0,
"y": 21,
"w": 8,
"h": 10
},
"fieldConfig": {
"defaults": {
"unit": "short",
"color": {
"mode": "fixed",
"fixedColor": "blue"
},
"noValue": "\u2014",
"decimals": 0,
"min": 0,
"displayName": "Category"
},
"overrides": [
{
"matcher": {
"id": "byRegexp",
"options": ".*"
},
"properties": [
{
"id": "displayName",
"value": ""
}
]
}
]
},
"targets": [
{
"refId": "A",
"datasource": {
"type": "victoriametrics-logs-datasource",
"uid": "${DS_VICTORIALOGS}"
},
"expr": "log_type:=\"gateway-access\" gateway_name:in($gateway) authority:in($hostname) path:in($path) method:in($method) response_code:in($status) cf_connecting_ip_reported:in($visitor) | copy downstream_remote_address as peer_address | replace_regexp (\":([0-9]+)$\", \"\") at peer_address | replace_regexp (\"^\\\\[(.*)\\\\]$\", \"${1}\") at peer_address | format if (cf_country_reported:in(\"\", \"-\")) \"Unknown\" as cf_country_reported | format if (user_agent:in(\"\", \"-\")) \"Unknown\" as user_agent | format if (upstream_cluster:in(\"\", \"-\")) \"Unknown\" as upstream_cluster | format if (response_code_details:in(\"\", \"-\")) \"Unknown\" as response_code_details | format if (upstream_transport_failure_reason:in(\"\", \"-\")) \"Unknown\" as upstream_transport_failure_reason | filter peer_address:in($peer) cf_country_reported:in($country) user_agent:in($agent) upstream_cluster:in($backend) response_flags:in($flags) request_id:in(${request_id:json}) cf_ray:in(${ray_id:json}) | format \"Unknown\" as browser | format if (user_agent:~\"(?i)Safari\") \"Safari\" as browser | format if (user_agent:~\"(?i)(Chrome|CriOS)\") \"Chrome\" as browser | format if (user_agent:~\"(?i)(Firefox|FxiOS)\") \"Firefox\" as browser | format if (user_agent:~\"(?i)(Edg/|EdgiOS|EdgA/)\") \"Edge\" as browser | format if (user_agent:~\"(?i)(OPR/|Opera)\") \"Opera\" as browser | format if (user_agent:~\"(?i)(curl/|Wget/)\") \"Command-line client\" as browser | format if (user_agent:~\"(?i)(bot|crawler|spider)\") \"Bot/crawler\" as browser | format if (user_agent:~\"(?i)Googlebot\") \"Googlebot\" as browser | format if (user_agent:~\"(?i)bingbot\") \"Bingbot\" as browser | format if (user_agent:~\"(?i)Applebot\") \"Applebot\" as browser | stats by (browser) count() as requests | sort by (requests) desc | limit 20",
"queryType": "stats",
"editorMode": "code",
"legendFormat": "{{browser}}",
"maxLines": 20,
"direction": "desc"
}
],
"options": {
"reduceOptions": {
"values": false,
"calcs": [
"lastNotNull"
],
"fields": "",
"limit": 20
},
"orientation": "horizontal",
"displayMode": "basic",
"showUnfilled": true,
"minVizHeight": 40,
"minVizWidth": 0,
"valueMode": "color",
"namePlacement": "top",
"maxVizHeight": 40,
"sizing": "manual",
"text": {
"titleSize": 14,
"valueSize": 14
}
},
"transformations": [
{
"id": "rowsToFields",
"options": {
"mappings": [
{
"fieldName": "browser",
"handlerKey": "field.name"
},
{
"fieldName": "Value #A",
"handlerKey": "field.value"
}
]
}
}
]
},
{
"id": 48,
"title": "Top operating systems (inferred)",
"type": "bargauge",
"datasource": {
"type": "victoriametrics-logs-datasource",
"uid": "${DS_VICTORIALOGS}"
},
"description": "Inferred from the reported User-Agent using broad patterns. Headers can be spoofed; Unknown includes old logs, missing headers and unrecognized clients. Bot/crawler means the user agent claims to be one, not verified bot detection.",
"gridPos": {
"x": 8,
"y": 21,
"w": 8,
"h": 10
},
"fieldConfig": {
"defaults": {
"unit": "short",
"color": {
"mode": "fixed",
"fixedColor": "blue"
},
"noValue": "\u2014",
"decimals": 0,
"min": 0,
"displayName": "Category"
},
"overrides": [
{
"matcher": {
"id": "byRegexp",
"options": ".*"
},
"properties": [
{
"id": "displayName",
"value": ""
}
]
}
]
},
"targets": [
{
"refId": "A",
"datasource": {
"type": "victoriametrics-logs-datasource",
"uid": "${DS_VICTORIALOGS}"
},
"expr": "log_type:=\"gateway-access\" gateway_name:in($gateway) authority:in($hostname) path:in($path) method:in($method) response_code:in($status) cf_connecting_ip_reported:in($visitor) | copy downstream_remote_address as peer_address | replace_regexp (\":([0-9]+)$\", \"\") at peer_address | replace_regexp (\"^\\\\[(.*)\\\\]$\", \"${1}\") at peer_address | format if (cf_country_reported:in(\"\", \"-\")) \"Unknown\" as cf_country_reported | format if (user_agent:in(\"\", \"-\")) \"Unknown\" as user_agent | format if (upstream_cluster:in(\"\", \"-\")) \"Unknown\" as upstream_cluster | format if (response_code_details:in(\"\", \"-\")) \"Unknown\" as response_code_details | format if (upstream_transport_failure_reason:in(\"\", \"-\")) \"Unknown\" as upstream_transport_failure_reason | filter peer_address:in($peer) cf_country_reported:in($country) user_agent:in($agent) upstream_cluster:in($backend) response_flags:in($flags) request_id:in(${request_id:json}) cf_ray:in(${ray_id:json}) | format \"Unknown\" as os | format if (user_agent:~\"(?i)(Linux|X11)\") \"Linux\" as os | format if (user_agent:~\"(?i)(Macintosh|Mac OS X)\") \"macOS\" as os | format if (user_agent:~\"(?i)Windows\") \"Windows\" as os | format if (user_agent:~\"(?i)CrOS\") \"ChromeOS\" as os | format if (user_agent:~\"(?i)Android\") \"Android\" as os | format if (user_agent:~\"(?i)(iPhone|iPad|iPod)\") \"iOS\" as os | stats by (os) count() as requests | sort by (requests) desc | limit 20",
"queryType": "stats",
"editorMode": "code",
"legendFormat": "{{os}}",
"maxLines": 20,
"direction": "desc"
}
],
"options": {
"reduceOptions": {
"values": false,
"calcs": [
"lastNotNull"
],
"fields": "",
"limit": 20
},
"orientation": "horizontal",
"displayMode": "basic",
"showUnfilled": true,
"minVizHeight": 40,
"minVizWidth": 0,
"valueMode": "color",
"namePlacement": "top",
"maxVizHeight": 40,
"sizing": "manual",
"text": {
"titleSize": 14,
"valueSize": 14
}
},
"transformations": [
{
"id": "rowsToFields",
"options": {
"mappings": [
{
"fieldName": "os",
"handlerKey": "field.name"
},
{
"fieldName": "Value #A",
"handlerKey": "field.value"
}
]
}
}
]
},
{
"id": 26,
"title": "Top user agents",
"type": "bargauge",
"datasource": {
"type": "victoriametrics-logs-datasource",
"uid": "${DS_VICTORIALOGS}"
},
"description": "Raw reported User-Agent values, not verified browser/device identities or bot detection. Older records and missing headers appear as Unknown.",
"gridPos": {
"x": 16,
"y": 21,
"w": 8,
"h": 10
},
"fieldConfig": {
"defaults": {
"unit": "short",
"noValue": "\u2014",
"color": {
"mode": "fixed",
"fixedColor": "blue"
},
"decimals": 0,
"min": 0,
"displayName": "Category"
},
"overrides": [
{
"matcher": {
"id": "byRegexp",
"options": ".*"
},
"properties": [
{
"id": "displayName",
"value": ""
}
]
}
]
},
"targets": [
{
"refId": "A",
"datasource": {
"type": "victoriametrics-logs-datasource",
"uid": "${DS_VICTORIALOGS}"
},
"expr": "log_type:=\"gateway-access\" gateway_name:in($gateway) authority:in($hostname) path:in($path) method:in($method) response_code:in($status) cf_connecting_ip_reported:in($visitor) | copy downstream_remote_address as peer_address | replace_regexp (\":([0-9]+)$\", \"\") at peer_address | replace_regexp (\"^\\\\[(.*)\\\\]$\", \"${1}\") at peer_address | format if (cf_country_reported:in(\"\", \"-\")) \"Unknown\" as cf_country_reported | format if (user_agent:in(\"\", \"-\")) \"Unknown\" as user_agent | format if (upstream_cluster:in(\"\", \"-\")) \"Unknown\" as upstream_cluster | format if (response_code_details:in(\"\", \"-\")) \"Unknown\" as response_code_details | format if (upstream_transport_failure_reason:in(\"\", \"-\")) \"Unknown\" as upstream_transport_failure_reason | filter peer_address:in($peer) cf_country_reported:in($country) user_agent:in($agent) upstream_cluster:in($backend) response_flags:in($flags) request_id:in(${request_id:json}) cf_ray:in(${ray_id:json}) | stats by (user_agent) count() as requests | sort by (requests) desc | limit 20",
"queryType": "stats",
"editorMode": "code",
"legendFormat": "{{user_agent}}",
"maxLines": 20,
"direction": "desc"
}
],
"options": {
"reduceOptions": {
"values": false,
"calcs": [
"lastNotNull"
],
"fields": "",
"limit": 20
},
"orientation": "horizontal",
"displayMode": "basic",
"showUnfilled": true,
"minVizHeight": 40,
"minVizWidth": 0,
"valueMode": "color",
"namePlacement": "top",
"maxVizHeight": 40,
"sizing": "manual",
"text": {
"titleSize": 14,
"valueSize": 14
}
},
"transformations": [
{
"id": "rowsToFields",
"options": {
"mappings": [
{
"fieldName": "user_agent",
"handlerKey": "field.name"
},
{
"fieldName": "Value #A",
"handlerKey": "field.value"
}
]
}
}
]
},
{
"id": 51,
"title": "Top HTTP versions",
"type": "bargauge",
"datasource": {
"type": "victoriametrics-logs-datasource",
"uid": "${DS_VICTORIALOGS}"
},
"description": "Top 20 HTTP versions observed on the gateway connection, not necessarily the visitor-to-Cloudflare connection.",
"gridPos": {
"x": 0,
"y": 31,
"w": 8,
"h": 10
},
"fieldConfig": {
"defaults": {
"unit": "short",
"noValue": "\u2014",
"color": {
"mode": "fixed",
"fixedColor": "blue"
},
"decimals": 0,
"min": 0,
"displayName": "Category"
},
"overrides": [
{
"matcher": {
"id": "byRegexp",
"options": ".*"
},
"properties": [
{
"id": "displayName",
"value": ""
}
]
}
]
},
"targets": [
{
"refId": "A",
"datasource": {
"type": "victoriametrics-logs-datasource",
"uid": "${DS_VICTORIALOGS}"
},
"expr": "log_type:=\"gateway-access\" gateway_name:in($gateway) authority:in($hostname) path:in($path) method:in($method) response_code:in($status) cf_connecting_ip_reported:in($visitor) | copy downstream_remote_address as peer_address | replace_regexp (\":([0-9]+)$\", \"\") at peer_address | replace_regexp (\"^\\\\[(.*)\\\\]$\", \"${1}\") at peer_address | format if (cf_country_reported:in(\"\", \"-\")) \"Unknown\" as cf_country_reported | format if (user_agent:in(\"\", \"-\")) \"Unknown\" as user_agent | format if (upstream_cluster:in(\"\", \"-\")) \"Unknown\" as upstream_cluster | format if (response_code_details:in(\"\", \"-\")) \"Unknown\" as response_code_details | format if (upstream_transport_failure_reason:in(\"\", \"-\")) \"Unknown\" as upstream_transport_failure_reason | filter peer_address:in($peer) cf_country_reported:in($country) user_agent:in($agent) upstream_cluster:in($backend) response_flags:in($flags) request_id:in(${request_id:json}) cf_ray:in(${ray_id:json}) | stats by (protocol) count() as requests | sort by (requests) desc | limit 20",
"queryType": "stats",
"editorMode": "code",
"legendFormat": "{{protocol}}",
"maxLines": 20,
"direction": "desc"
}
],
"options": {
"reduceOptions": {
"values": false,
"calcs": [
"lastNotNull"
],
"fields": "",
"limit": 20
},
"orientation": "horizontal",
"displayMode": "basic",
"showUnfilled": true,
"minVizHeight": 40,
"minVizWidth": 0,
"valueMode": "color",
"namePlacement": "top",
"maxVizHeight": 40,
"sizing": "manual",
"text": {
"titleSize": 14,
"valueSize": 14
}
},
"transformations": [
{
"id": "rowsToFields",
"options": {
"mappings": [
{
"fieldName": "protocol",
"handlerKey": "field.name"
},
{
"fieldName": "Value #A",
"handlerKey": "field.value"
}
]
}
}
]
},
{
"id": 37,
"title": "Top gateway status codes",
"type": "bargauge",
"datasource": {
"type": "victoriametrics-logs-datasource",
"uid": "${DS_VICTORIALOGS}"
},
"description": "Top 20 response codes seen at the gateway, including responses generated by Envoy. Code 0 is No HTTP response. This is not Cloudflare edge-status data.",
"gridPos": {
"x": 8,
"y": 31,
"w": 8,
"h": 10
},
"fieldConfig": {
"defaults": {
"unit": "short",
"noValue": "\u2014",
"color": {
"mode": "fixed",
"fixedColor": "blue"
},
"decimals": 0,
"min": 0,
"displayName": "Category"
},
"overrides": [
{
"matcher": {
"id": "byRegexp",
"options": ".*"
},
"properties": [
{
"id": "displayName",
"value": ""
}
]
}
]
},
"targets": [
{
"refId": "A",
"datasource": {
"type": "victoriametrics-logs-datasource",
"uid": "${DS_VICTORIALOGS}"
},
"expr": "log_type:=\"gateway-access\" gateway_name:in($gateway) authority:in($hostname) path:in($path) method:in($method) response_code:in($status) cf_connecting_ip_reported:in($visitor) | copy downstream_remote_address as peer_address | replace_regexp (\":([0-9]+)$\", \"\") at peer_address | replace_regexp (\"^\\\\[(.*)\\\\]$\", \"${1}\") at peer_address | format if (cf_country_reported:in(\"\", \"-\")) \"Unknown\" as cf_country_reported | format if (user_agent:in(\"\", \"-\")) \"Unknown\" as user_agent | format if (upstream_cluster:in(\"\", \"-\")) \"Unknown\" as upstream_cluster | format if (response_code_details:in(\"\", \"-\")) \"Unknown\" as response_code_details | format if (upstream_transport_failure_reason:in(\"\", \"-\")) \"Unknown\" as upstream_transport_failure_reason | filter peer_address:in($peer) cf_country_reported:in($country) user_agent:in($agent) upstream_cluster:in($backend) response_flags:in($flags) request_id:in(${request_id:json}) cf_ray:in(${ray_id:json}) | format \"<response_code>\" as status_label | format if (response_code:=0) \"No HTTP response\" as status_label | format if (response_code:=101) \"101 Switching Protocols\" as status_label | format if (response_code:=200) \"200 OK\" as status_label | format if (response_code:=201) \"201 Created\" as status_label | format if (response_code:=204) \"204 No Content\" as status_label | format if (response_code:=301) \"301 Moved Permanently\" as status_label | format if (response_code:=302) \"302 Found\" as status_label | format if (response_code:=304) \"304 Not Modified\" as status_label | format if (response_code:=307) \"307 Temporary Redirect\" as status_label | format if (response_code:=308) \"308 Permanent Redirect\" as status_label | format if (response_code:=400) \"400 Bad Request\" as status_label | format if (response_code:=401) \"401 Unauthorized\" as status_label | format if (response_code:=403) \"403 Forbidden\" as status_label | format if (response_code:=404) \"404 Not Found\" as status_label | format if (response_code:=405) \"405 Method Not Allowed\" as status_label | format if (response_code:=408) \"408 Request Timeout\" as status_label | format if (response_code:=429) \"429 Too Many Requests\" as status_label | format if (response_code:=500) \"500 Internal Server Error\" as status_label | format if (response_code:=502) \"502 Bad Gateway\" as status_label | format if (response_code:=503) \"503 Service Unavailable\" as status_label | format if (response_code:=504) \"504 Gateway Timeout\" as status_label | stats by (status_label) count() as requests | sort by (requests) desc | limit 20",
"queryType": "stats",
"editorMode": "code",
"legendFormat": "{{status_label}}",
"maxLines": 20,
"direction": "desc"
}
],
"options": {
"reduceOptions": {
"values": false,
"calcs": [
"lastNotNull"
],
"fields": "",
"limit": 20
},
"orientation": "horizontal",
"displayMode": "basic",
"showUnfilled": true,
"minVizHeight": 40,
"minVizWidth": 0,
"valueMode": "color",
"namePlacement": "top",
"maxVizHeight": 40,
"sizing": "manual",
"text": {
"titleSize": 14,
"valueSize": 14
}
},
"transformations": [
{
"id": "rowsToFields",
"options": {
"mappings": [
{
"fieldName": "status_label",
"handlerKey": "field.name"
},
{
"fieldName": "Value #A",
"handlerKey": "field.value"
}
]
}
}
]
},
{
"id": 49,
"title": "Requests by device type (inferred)",
"type": "piechart",
"datasource": {
"type": "victoriametrics-logs-datasource",
"uid": "${DS_VICTORIALOGS}"
},
"description": "Inferred from the reported User-Agent using broad patterns. Headers can be spoofed; Unknown includes old logs, missing headers and unrecognized clients. Bot/crawler means the user agent claims to be one, not verified bot detection.",
"gridPos": {
"x": 16,
"y": 31,
"w": 8,
"h": 10
},
"fieldConfig": {
"defaults": {
"unit": "short",
"color": {
"mode": "palette-classic"
},
"noValue": "\u2014"
},
"overrides": []
},
"targets": [
{
"refId": "A",
"datasource": {
"type": "victoriametrics-logs-datasource",
"uid": "${DS_VICTORIALOGS}"
},
"expr": "log_type:=\"gateway-access\" gateway_name:in($gateway) authority:in($hostname) path:in($path) method:in($method) response_code:in($status) cf_connecting_ip_reported:in($visitor) | copy downstream_remote_address as peer_address | replace_regexp (\":([0-9]+)$\", \"\") at peer_address | replace_regexp (\"^\\\\[(.*)\\\\]$\", \"${1}\") at peer_address | format if (cf_country_reported:in(\"\", \"-\")) \"Unknown\" as cf_country_reported | format if (user_agent:in(\"\", \"-\")) \"Unknown\" as user_agent | format if (upstream_cluster:in(\"\", \"-\")) \"Unknown\" as upstream_cluster | format if (response_code_details:in(\"\", \"-\")) \"Unknown\" as response_code_details | format if (upstream_transport_failure_reason:in(\"\", \"-\")) \"Unknown\" as upstream_transport_failure_reason | filter peer_address:in($peer) cf_country_reported:in($country) user_agent:in($agent) upstream_cluster:in($backend) response_flags:in($flags) request_id:in(${request_id:json}) cf_ray:in(${ray_id:json}) | format \"Unknown\" as device | format if (user_agent:~\"(?i)(Windows NT|Macintosh|X11|CrOS)\") \"Desktop\" as device | format if (user_agent:~\"(?i)(Mobile|Android|iPhone|iPod)\") \"Mobile\" as device | format if (user_agent:~\"(?i)(iPad|Tablet)\" OR (user_agent:~\"(?i)Android\" user_agent:!~\"(?i)Mobile\")) \"Tablet\" as device | format if (user_agent:~\"(?i)(bot|crawler|spider)\") \"Bot/crawler\" as device | format if (user_agent:~\"(?i)(curl/|Wget/|containerd/)\") \"Command-line client\" as device | stats by (device) count() as requests | sort by (requests) desc | limit 20",
"queryType": "stats",
"editorMode": "code",
"legendFormat": "{{device}}",
"maxLines": 20,
"direction": "desc"
}
],
"options": {
"reduceOptions": {
"values": false,
"calcs": [
"lastNotNull"
],
"fields": "",
"limit": 20
},
"pieType": "donut",
"displayLabels": [
"name",
"percent"
],
"legend": {
"displayMode": "table",
"placement": "right",
"showLegend": true,
"values": [
"value",
"percent"
]
},
"tooltip": {
"mode": "single",
"sort": "desc"
}
},
"transformations": [
{
"id": "rowsToFields",
"options": {
"mappings": [
{
"fieldName": "device",
"handlerKey": "field.name"
},
{
"fieldName": "Value #A",
"handlerKey": "field.value"
}
]
}
}
]
},
{
"id": 10,
"type": "row",
"title": "Traffic and endpoints",
"collapsed": true,
"gridPos": {
"x": 0,
"y": 41,
"w": 24,
"h": 1
},
"panels": [
{
"id": 11,
"title": "Request rate by gateway",
"type": "timeseries",
"datasource": {
"type": "victoriametrics-logs-datasource",
"uid": "${DS_VICTORIALOGS}"
},
"description": "Recorded request completions per second.",
"gridPos": {
"x": 0,
"y": 42,
"w": 12,
"h": 8
},
"fieldConfig": {
"defaults": {
"unit": "reqps",
"noValue": "\u2014",
"color": {
"mode": "palette-classic"
},
"custom": {
"drawStyle": "line",
"lineInterpolation": "linear",
"lineWidth": 2,
"fillOpacity": 10,
"spanNulls": false,
"showPoints": "never",
"axisCenteredZero": false
}
},
"overrides": []
},
"targets": [
{
"refId": "A",
"datasource": {
"type": "victoriametrics-logs-datasource",
"uid": "${DS_VICTORIALOGS}"
},
"expr": "log_type:=\"gateway-access\" gateway_name:in($gateway) authority:in($hostname) path:in($path) method:in($method) response_code:in($status) cf_connecting_ip_reported:in($visitor) | copy downstream_remote_address as peer_address | replace_regexp (\":([0-9]+)$\", \"\") at peer_address | replace_regexp (\"^\\\\[(.*)\\\\]$\", \"${1}\") at peer_address | format if (cf_country_reported:in(\"\", \"-\")) \"Unknown\" as cf_country_reported | format if (user_agent:in(\"\", \"-\")) \"Unknown\" as user_agent | format if (upstream_cluster:in(\"\", \"-\")) \"Unknown\" as upstream_cluster | format if (response_code_details:in(\"\", \"-\")) \"Unknown\" as response_code_details | format if (upstream_transport_failure_reason:in(\"\", \"-\")) \"Unknown\" as upstream_transport_failure_reason | filter peer_address:in($peer) cf_country_reported:in($country) user_agent:in($agent) upstream_cluster:in($backend) response_flags:in($flags) request_id:in(${request_id:json}) cf_ray:in(${ray_id:json}) | stats by (gateway_name) rate() as requests_per_second",
"queryType": "statsRange",
"editorMode": "code",
"legendFormat": "{{gateway_name}}",
"maxLines": 1000,
"direction": "desc"
}
],
"interval": "30s",
"options": {
"legend": {
"displayMode": "table",
"placement": "bottom",
"showLegend": true,
"calcs": [
"lastNotNull",
"max"
]
},
"tooltip": {
"mode": "multi",
"sort": "desc"
}
}
},
{
"id": 12,
"title": "Request rate by hostname",
"type": "timeseries",
"datasource": {
"type": "victoriametrics-logs-datasource",
"uid": "${DS_VICTORIALOGS}"
},
"description": "Top 10 hostnames by requests over the selected range.",
"gridPos": {
"x": 12,
"y": 42,
"w": 12,
"h": 8
},
"fieldConfig": {
"defaults": {
"unit": "reqps",
"noValue": "\u2014",
"color": {
"mode": "palette-classic"
},
"custom": {
"drawStyle": "line",
"lineInterpolation": "linear",
"lineWidth": 2,
"fillOpacity": 10,
"spanNulls": false,
"showPoints": "never",
"axisCenteredZero": false
}
},
"overrides": []
},
"targets": [
{
"refId": "A",
"datasource": {
"type": "victoriametrics-logs-datasource",
"uid": "${DS_VICTORIALOGS}"
},
"expr": "log_type:=\"gateway-access\" gateway_name:in($gateway) authority:in($hostname) path:in($path) method:in($method) response_code:in($status) cf_connecting_ip_reported:in($visitor) | copy downstream_remote_address as peer_address | replace_regexp (\":([0-9]+)$\", \"\") at peer_address | replace_regexp (\"^\\\\[(.*)\\\\]$\", \"${1}\") at peer_address | format if (cf_country_reported:in(\"\", \"-\")) \"Unknown\" as cf_country_reported | format if (user_agent:in(\"\", \"-\")) \"Unknown\" as user_agent | format if (upstream_cluster:in(\"\", \"-\")) \"Unknown\" as upstream_cluster | format if (response_code_details:in(\"\", \"-\")) \"Unknown\" as response_code_details | format if (upstream_transport_failure_reason:in(\"\", \"-\")) \"Unknown\" as upstream_transport_failure_reason | filter peer_address:in($peer) cf_country_reported:in($country) user_agent:in($agent) upstream_cluster:in($backend) response_flags:in($flags) request_id:in(${request_id:json}) cf_ray:in(${ray_id:json}) | filter authority:in(log_type:=\"gateway-access\" gateway_name:in($gateway) authority:in($hostname) path:in($path) method:in($method) response_code:in($status) cf_connecting_ip_reported:in($visitor) | copy downstream_remote_address as peer_address | replace_regexp (\":([0-9]+)$\", \"\") at peer_address | replace_regexp (\"^\\\\[(.*)\\\\]$\", \"${1}\") at peer_address | format if (cf_country_reported:in(\"\", \"-\")) \"Unknown\" as cf_country_reported | format if (user_agent:in(\"\", \"-\")) \"Unknown\" as user_agent | format if (upstream_cluster:in(\"\", \"-\")) \"Unknown\" as upstream_cluster | format if (response_code_details:in(\"\", \"-\")) \"Unknown\" as response_code_details | format if (upstream_transport_failure_reason:in(\"\", \"-\")) \"Unknown\" as upstream_transport_failure_reason | filter peer_address:in($peer) cf_country_reported:in($country) user_agent:in($agent) upstream_cluster:in($backend) response_flags:in($flags) request_id:in(${request_id:json}) cf_ray:in(${ray_id:json}) | stats by (authority) count() as requests | sort by (requests) desc | limit 10 | fields authority) | stats by (authority) rate() as requests_per_second",
"queryType": "statsRange",
"editorMode": "code",
"legendFormat": "{{authority}}",
"maxLines": 1000,
"direction": "desc"
}
],
"interval": "30s",
"options": {
"legend": {
"displayMode": "table",
"placement": "bottom",
"showLegend": true,
"calcs": [
"lastNotNull",
"max"
]
},
"tooltip": {
"mode": "multi",
"sort": "desc"
}
}
},
{
"id": 13,
"title": "Request rate by method",
"type": "timeseries",
"datasource": {
"type": "victoriametrics-logs-datasource",
"uid": "${DS_VICTORIALOGS}"
},
"description": "HTTP method distribution over time.",
"gridPos": {
"x": 0,
"y": 50,
"w": 12,
"h": 8
},
"fieldConfig": {
"defaults": {
"unit": "reqps",
"noValue": "\u2014",
"color": {
"mode": "palette-classic"
},
"custom": {
"drawStyle": "line",
"lineInterpolation": "linear",
"lineWidth": 2,
"fillOpacity": 10,
"spanNulls": false,
"showPoints": "never",
"axisCenteredZero": false
}
},
"overrides": []
},
"targets": [
{
"refId": "A",
"datasource": {
"type": "victoriametrics-logs-datasource",
"uid": "${DS_VICTORIALOGS}"
},
"expr": "log_type:=\"gateway-access\" gateway_name:in($gateway) authority:in($hostname) path:in($path) method:in($method) response_code:in($status) cf_connecting_ip_reported:in($visitor) | copy downstream_remote_address as peer_address | replace_regexp (\":([0-9]+)$\", \"\") at peer_address | replace_regexp (\"^\\\\[(.*)\\\\]$\", \"${1}\") at peer_address | format if (cf_country_reported:in(\"\", \"-\")) \"Unknown\" as cf_country_reported | format if (user_agent:in(\"\", \"-\")) \"Unknown\" as user_agent | format if (upstream_cluster:in(\"\", \"-\")) \"Unknown\" as upstream_cluster | format if (response_code_details:in(\"\", \"-\")) \"Unknown\" as response_code_details | format if (upstream_transport_failure_reason:in(\"\", \"-\")) \"Unknown\" as upstream_transport_failure_reason | filter peer_address:in($peer) cf_country_reported:in($country) user_agent:in($agent) upstream_cluster:in($backend) response_flags:in($flags) request_id:in(${request_id:json}) cf_ray:in(${ray_id:json}) | stats by (method) rate() as requests_per_second",
"queryType": "statsRange",
"editorMode": "code",
"legendFormat": "{{method}}",
"maxLines": 1000,
"direction": "desc"
}
],
"interval": "30s",
"options": {
"legend": {
"displayMode": "table",
"placement": "bottom",
"showLegend": true,
"calcs": [
"lastNotNull",
"max"
]
},
"tooltip": {
"mode": "multi",
"sort": "desc"
}
}
},
{
"id": 14,
"title": "Request rate by HTTP protocol",
"type": "timeseries",
"datasource": {
"type": "victoriametrics-logs-datasource",
"uid": "${DS_VICTORIALOGS}"
},
"description": "Protocol observed on the gateway connection, not necessarily the original visitor-to-Cloudflare protocol.",
"gridPos": {
"x": 12,
"y": 50,
"w": 12,
"h": 8
},
"fieldConfig": {
"defaults": {
"unit": "reqps",
"noValue": "\u2014",
"color": {
"mode": "palette-classic"
},
"custom": {
"drawStyle": "line",
"lineInterpolation": "linear",
"lineWidth": 2,
"fillOpacity": 10,
"spanNulls": false,
"showPoints": "never",
"axisCenteredZero": false
}
},
"overrides": []
},
"targets": [
{
"refId": "A",
"datasource": {
"type": "victoriametrics-logs-datasource",
"uid": "${DS_VICTORIALOGS}"
},
"expr": "log_type:=\"gateway-access\" gateway_name:in($gateway) authority:in($hostname) path:in($path) method:in($method) response_code:in($status) cf_connecting_ip_reported:in($visitor) | copy downstream_remote_address as peer_address | replace_regexp (\":([0-9]+)$\", \"\") at peer_address | replace_regexp (\"^\\\\[(.*)\\\\]$\", \"${1}\") at peer_address | format if (cf_country_reported:in(\"\", \"-\")) \"Unknown\" as cf_country_reported | format if (user_agent:in(\"\", \"-\")) \"Unknown\" as user_agent | format if (upstream_cluster:in(\"\", \"-\")) \"Unknown\" as upstream_cluster | format if (response_code_details:in(\"\", \"-\")) \"Unknown\" as response_code_details | format if (upstream_transport_failure_reason:in(\"\", \"-\")) \"Unknown\" as upstream_transport_failure_reason | filter peer_address:in($peer) cf_country_reported:in($country) user_agent:in($agent) upstream_cluster:in($backend) response_flags:in($flags) request_id:in(${request_id:json}) cf_ray:in(${ray_id:json}) | stats by (protocol) rate() as requests_per_second",
"queryType": "statsRange",
"editorMode": "code",
"legendFormat": "{{protocol}}",
"maxLines": 1000,
"direction": "desc"
}
],
"interval": "30s",
"options": {
"legend": {
"displayMode": "table",
"placement": "bottom",
"showLegend": true,
"calcs": [
"lastNotNull",
"max"
]
},
"tooltip": {
"mode": "multi",
"sort": "desc"
}
}
},
{
"id": 15,
"title": "HTTP body byte rate",
"type": "timeseries",
"datasource": {
"type": "victoriametrics-logs-datasource",
"uid": "${DS_VICTORIALOGS}"
},
"description": "Logged body-byte rates at request completion, not instantaneous wire bandwidth. Long transfers appear when their access records arrive.",
"gridPos": {
"x": 0,
"y": 58,
"w": 12,
"h": 8
},
"fieldConfig": {
"defaults": {
"unit": "Bps",
"noValue": "\u2014",
"color": {
"mode": "palette-classic"
},
"custom": {
"drawStyle": "line",
"lineInterpolation": "linear",
"lineWidth": 2,
"fillOpacity": 10,
"spanNulls": false,
"showPoints": "never",
"axisCenteredZero": false
}
},
"overrides": []
},
"targets": [
{
"refId": "A",
"datasource": {
"type": "victoriametrics-logs-datasource",
"uid": "${DS_VICTORIALOGS}"
},
"expr": "log_type:=\"gateway-access\" gateway_name:in($gateway) authority:in($hostname) path:in($path) method:in($method) response_code:in($status) cf_connecting_ip_reported:in($visitor) | copy downstream_remote_address as peer_address | replace_regexp (\":([0-9]+)$\", \"\") at peer_address | replace_regexp (\"^\\\\[(.*)\\\\]$\", \"${1}\") at peer_address | format if (cf_country_reported:in(\"\", \"-\")) \"Unknown\" as cf_country_reported | format if (user_agent:in(\"\", \"-\")) \"Unknown\" as user_agent | format if (upstream_cluster:in(\"\", \"-\")) \"Unknown\" as upstream_cluster | format if (response_code_details:in(\"\", \"-\")) \"Unknown\" as response_code_details | format if (upstream_transport_failure_reason:in(\"\", \"-\")) \"Unknown\" as upstream_transport_failure_reason | filter peer_address:in($peer) cf_country_reported:in($country) user_agent:in($agent) upstream_cluster:in($backend) response_flags:in($flags) request_id:in(${request_id:json}) cf_ray:in(${ray_id:json}) | stats rate_sum(bytes_sent) as response_bytes_per_second, rate_sum(bytes_received) as request_bytes_per_second",
"queryType": "statsRange",
"editorMode": "code",
"legendFormat": "{{__name__}}",
"maxLines": 1000,
"direction": "desc"
}
],
"interval": "30s",
"options": {
"legend": {
"displayMode": "table",
"placement": "bottom",
"showLegend": true,
"calcs": [
"lastNotNull",
"max"
]
},
"tooltip": {
"mode": "multi",
"sort": "desc"
}
}
},
{
"id": 16,
"title": "Hostname summary",
"type": "table",
"datasource": {
"type": "victoriametrics-logs-datasource",
"uid": "${DS_VICTORIALOGS}"
},
"description": "Top 20 hostnames. IP counts cover reported public addresses only; duration includes long-lived requests.",
"gridPos": {
"x": 12,
"y": 58,
"w": 12,
"h": 8
},
"fieldConfig": {
"defaults": {
"unit": "none",
"noValue": "\u2014",
"color": {
"mode": "palette-classic"
}
},
"overrides": [
{
"matcher": {
"id": "byName",
"options": "Hostname"
},
"properties": [
{
"id": "links",
"value": [
{
"title": "Filter Hostname",
"url": "/d/http-traffic/http-traffic?${__url_time_range}&${gateway:queryparam}&${path:queryparam}&${method:queryparam}&${status:queryparam}&${visitor:queryparam}&${peer:queryparam}&${country:queryparam}&${agent:queryparam}&${backend:queryparam}&${flags:queryparam}&${request_id:queryparam}&${ray_id:queryparam}&var-hostname=${__value.raw:percentencode}",
"targetBlank": false
}
]
}
]
},
{
"matcher": {
"id": "byName",
"options": "Requests"
},
"properties": [
{
"id": "unit",
"value": "short"
},
{
"id": "decimals",
"value": 0
}
]
},
{
"matcher": {
"id": "byName",
"options": "Reported IPs"
},
"properties": [
{
"id": "unit",
"value": "short"
},
{
"id": "decimals",
"value": 0
}
]
},
{
"matcher": {
"id": "byName",
"options": "Response body bytes"
},
"properties": [
{
"id": "unit",
"value": "bytes"
},
{
"id": "decimals",
"value": 0
}
]
},
{
"matcher": {
"id": "byName",
"options": "p95 duration"
},
"properties": [
{
"id": "unit",
"value": "ms"
},
{
"id": "decimals",
"value": 0
}
]
}
]
},
"targets": [
{
"refId": "A",
"datasource": {
"type": "victoriametrics-logs-datasource",
"uid": "${DS_VICTORIALOGS}"
},
"expr": "log_type:=\"gateway-access\" gateway_name:in($gateway) authority:in($hostname) path:in($path) method:in($method) response_code:in($status) cf_connecting_ip_reported:in($visitor) | copy downstream_remote_address as peer_address | replace_regexp (\":([0-9]+)$\", \"\") at peer_address | replace_regexp (\"^\\\\[(.*)\\\\]$\", \"${1}\") at peer_address | format if (cf_country_reported:in(\"\", \"-\")) \"Unknown\" as cf_country_reported | format if (user_agent:in(\"\", \"-\")) \"Unknown\" as user_agent | format if (upstream_cluster:in(\"\", \"-\")) \"Unknown\" as upstream_cluster | format if (response_code_details:in(\"\", \"-\")) \"Unknown\" as response_code_details | format if (upstream_transport_failure_reason:in(\"\", \"-\")) \"Unknown\" as upstream_transport_failure_reason | filter peer_address:in($peer) cf_country_reported:in($country) user_agent:in($agent) upstream_cluster:in($backend) response_flags:in($flags) request_id:in(${request_id:json}) cf_ray:in(${ray_id:json}) | stats by (authority) count() as requests, count_uniq(cf_connecting_ip_reported) if (gateway_name:=\"cloudflare-gateway\" cf_connecting_ip_reported:!=\"\" cf_connecting_ip_reported:!=\"-\") as addresses, sum(bytes_sent) as response_bytes, quantile(0.95, duration_ms) as p95_ms | sort by (requests) desc | limit 20",
"queryType": "instant",
"editorMode": "code",
"legendFormat": "{{__name__}}",
"maxLines": 20,
"direction": "desc"
}
],
"options": {
"showHeader": true,
"cellHeight": "sm",
"footer": {
"show": false
},
"sortBy": [
{
"displayName": "Requests",
"desc": true
}
]
},
"transformations": [
{
"id": "extractFields",
"options": {
"source": "labels",
"format": "json",
"replace": true,
"keepTime": false
}
},
{
"id": "convertFieldType",
"options": {
"conversions": [
{
"targetField": "requests",
"destinationType": "number"
},
{
"targetField": "addresses",
"destinationType": "number"
},
{
"targetField": "response_bytes",
"destinationType": "number"
},
{
"targetField": "p95_ms",
"destinationType": "number"
}
],
"fields": {}
}
},
{
"id": "organize",
"options": {
"excludeByName": {},
"includeByName": {
"authority": true,
"requests": true,
"addresses": true,
"response_bytes": true,
"p95_ms": true
},
"indexByName": {
"authority": 0,
"requests": 1,
"addresses": 2,
"response_bytes": 3,
"p95_ms": 4
},
"renameByName": {
"authority": "Hostname",
"requests": "Requests",
"addresses": "Reported IPs",
"response_bytes": "Response body bytes",
"p95_ms": "p95 duration"
}
}
}
]
},
{
"id": 17,
"title": "Busiest endpoints",
"type": "table",
"datasource": {
"type": "victoriametrics-logs-datasource",
"uid": "${DS_VICTORIALOGS}"
},
"description": "Top 20 hostname/path combinations. Click a hostname or path to filter this dashboard.",
"gridPos": {
"x": 0,
"y": 66,
"w": 12,
"h": 8
},
"fieldConfig": {
"defaults": {
"unit": "none",
"noValue": "\u2014",
"color": {
"mode": "palette-classic"
}
},
"overrides": [
{
"matcher": {
"id": "byName",
"options": "Hostname"
},
"properties": [
{
"id": "links",
"value": [
{
"title": "Filter Hostname",
"url": "/d/http-traffic/http-traffic?${__url_time_range}&${gateway:queryparam}&${path:queryparam}&${method:queryparam}&${status:queryparam}&${visitor:queryparam}&${peer:queryparam}&${country:queryparam}&${agent:queryparam}&${backend:queryparam}&${flags:queryparam}&${request_id:queryparam}&${ray_id:queryparam}&var-hostname=${__value.raw:percentencode}",
"targetBlank": false
}
]
}
]
},
{
"matcher": {
"id": "byName",
"options": "Path"
},
"properties": [
{
"id": "links",
"value": [
{
"title": "Filter Path",
"url": "/d/http-traffic/http-traffic?${__url_time_range}&${gateway:queryparam}&${hostname:queryparam}&${method:queryparam}&${status:queryparam}&${visitor:queryparam}&${peer:queryparam}&${country:queryparam}&${agent:queryparam}&${backend:queryparam}&${flags:queryparam}&${request_id:queryparam}&${ray_id:queryparam}&var-path=${__value.raw:percentencode}",
"targetBlank": false
}
]
}
]
},
{
"matcher": {
"id": "byName",
"options": "Requests"
},
"properties": [
{
"id": "unit",
"value": "short"
},
{
"id": "decimals",
"value": 0
}
]
}
]
},
"targets": [
{
"refId": "A",
"datasource": {
"type": "victoriametrics-logs-datasource",
"uid": "${DS_VICTORIALOGS}"
},
"expr": "log_type:=\"gateway-access\" gateway_name:in($gateway) authority:in($hostname) path:in($path) method:in($method) response_code:in($status) cf_connecting_ip_reported:in($visitor) | copy downstream_remote_address as peer_address | replace_regexp (\":([0-9]+)$\", \"\") at peer_address | replace_regexp (\"^\\\\[(.*)\\\\]$\", \"${1}\") at peer_address | format if (cf_country_reported:in(\"\", \"-\")) \"Unknown\" as cf_country_reported | format if (user_agent:in(\"\", \"-\")) \"Unknown\" as user_agent | format if (upstream_cluster:in(\"\", \"-\")) \"Unknown\" as upstream_cluster | format if (response_code_details:in(\"\", \"-\")) \"Unknown\" as response_code_details | format if (upstream_transport_failure_reason:in(\"\", \"-\")) \"Unknown\" as upstream_transport_failure_reason | filter peer_address:in($peer) cf_country_reported:in($country) user_agent:in($agent) upstream_cluster:in($backend) response_flags:in($flags) request_id:in(${request_id:json}) cf_ray:in(${ray_id:json}) | stats by (authority, path) count() as requests | sort by (requests) desc | limit 20",
"queryType": "instant",
"editorMode": "code",
"legendFormat": "{{__name__}}",
"maxLines": 20,
"direction": "desc"
}
],
"options": {
"showHeader": true,
"cellHeight": "sm",
"footer": {
"show": false
},
"sortBy": [
{
"displayName": "Requests",
"desc": true
}
]
},
"transformations": [
{
"id": "extractFields",
"options": {
"source": "labels",
"format": "json",
"replace": true,
"keepTime": false
}
},
{
"id": "convertFieldType",
"options": {
"conversions": [
{
"targetField": "requests",
"destinationType": "number"
}
],
"fields": {}
}
},
{
"id": "organize",
"options": {
"excludeByName": {},
"includeByName": {
"authority": true,
"path": true,
"requests": true
},
"indexByName": {
"authority": 0,
"path": 1,
"requests": 2
},
"renameByName": {
"authority": "Hostname",
"path": "Path",
"requests": "Requests"
}
}
}
]
},
{
"id": 18,
"title": "Endpoints by response body bytes",
"type": "table",
"datasource": {
"type": "victoriametrics-logs-datasource",
"uid": "${DS_VICTORIALOGS}"
},
"description": "Top 20 endpoints by logged response body bytes.",
"gridPos": {
"x": 12,
"y": 66,
"w": 12,
"h": 8
},
"fieldConfig": {
"defaults": {
"unit": "none",
"noValue": "\u2014",
"color": {
"mode": "palette-classic"
}
},
"overrides": [
{
"matcher": {
"id": "byName",
"options": "Hostname"
},
"properties": [
{
"id": "links",
"value": [
{
"title": "Filter Hostname",
"url": "/d/http-traffic/http-traffic?${__url_time_range}&${gateway:queryparam}&${path:queryparam}&${method:queryparam}&${status:queryparam}&${visitor:queryparam}&${peer:queryparam}&${country:queryparam}&${agent:queryparam}&${backend:queryparam}&${flags:queryparam}&${request_id:queryparam}&${ray_id:queryparam}&var-hostname=${__value.raw:percentencode}",
"targetBlank": false
}
]
}
]
},
{
"matcher": {
"id": "byName",
"options": "Path"
},
"properties": [
{
"id": "links",
"value": [
{
"title": "Filter Path",
"url": "/d/http-traffic/http-traffic?${__url_time_range}&${gateway:queryparam}&${hostname:queryparam}&${method:queryparam}&${status:queryparam}&${visitor:queryparam}&${peer:queryparam}&${country:queryparam}&${agent:queryparam}&${backend:queryparam}&${flags:queryparam}&${request_id:queryparam}&${ray_id:queryparam}&var-path=${__value.raw:percentencode}",
"targetBlank": false
}
]
}
]
},
{
"matcher": {
"id": "byName",
"options": "Requests"
},
"properties": [
{
"id": "unit",
"value": "short"
},
{
"id": "decimals",
"value": 0
}
]
},
{
"matcher": {
"id": "byName",
"options": "Response body bytes"
},
"properties": [
{
"id": "unit",
"value": "bytes"
},
{
"id": "decimals",
"value": 0
}
]
}
]
},
"targets": [
{
"refId": "A",
"datasource": {
"type": "victoriametrics-logs-datasource",
"uid": "${DS_VICTORIALOGS}"
},
"expr": "log_type:=\"gateway-access\" gateway_name:in($gateway) authority:in($hostname) path:in($path) method:in($method) response_code:in($status) cf_connecting_ip_reported:in($visitor) | copy downstream_remote_address as peer_address | replace_regexp (\":([0-9]+)$\", \"\") at peer_address | replace_regexp (\"^\\\\[(.*)\\\\]$\", \"${1}\") at peer_address | format if (cf_country_reported:in(\"\", \"-\")) \"Unknown\" as cf_country_reported | format if (user_agent:in(\"\", \"-\")) \"Unknown\" as user_agent | format if (upstream_cluster:in(\"\", \"-\")) \"Unknown\" as upstream_cluster | format if (response_code_details:in(\"\", \"-\")) \"Unknown\" as response_code_details | format if (upstream_transport_failure_reason:in(\"\", \"-\")) \"Unknown\" as upstream_transport_failure_reason | filter peer_address:in($peer) cf_country_reported:in($country) user_agent:in($agent) upstream_cluster:in($backend) response_flags:in($flags) request_id:in(${request_id:json}) cf_ray:in(${ray_id:json}) | stats by (authority, path) count() as requests, sum(bytes_sent) as response_bytes | sort by (response_bytes) desc | limit 20",
"queryType": "instant",
"editorMode": "code",
"legendFormat": "{{__name__}}",
"maxLines": 20,
"direction": "desc"
}
],
"options": {
"showHeader": true,
"cellHeight": "sm",
"footer": {
"show": false
},
"sortBy": [
{
"displayName": "Response body bytes",
"desc": true
}
]
},
"transformations": [
{
"id": "extractFields",
"options": {
"source": "labels",
"format": "json",
"replace": true,
"keepTime": false
}
},
{
"id": "convertFieldType",
"options": {
"conversions": [
{
"targetField": "requests",
"destinationType": "number"
},
{
"targetField": "response_bytes",
"destinationType": "number"
}
],
"fields": {}
}
},
{
"id": "organize",
"options": {
"excludeByName": {},
"includeByName": {
"authority": true,
"path": true,
"requests": true,
"response_bytes": true
},
"indexByName": {
"authority": 0,
"path": 1,
"requests": 2,
"response_bytes": 3
},
"renameByName": {
"authority": "Hostname",
"path": "Path",
"requests": "Requests",
"response_bytes": "Response body bytes"
}
}
}
]
}
]
},
{
"id": 19,
"type": "row",
"title": "Visitors",
"collapsed": true,
"gridPos": {
"x": 0,
"y": 42,
"w": 24,
"h": 1
},
"panels": [
{
"id": 20,
"title": "Distinct reported public IPs",
"type": "timeseries",
"datasource": {
"type": "victoriametrics-logs-datasource",
"uid": "${DS_VICTORIALOGS}"
},
"description": "Distinct reported public addresses per time bucket; the same address may appear in several buckets.",
"gridPos": {
"x": 0,
"y": 43,
"w": 12,
"h": 8
},
"fieldConfig": {
"defaults": {
"unit": "short",
"noValue": "\u2014",
"color": {
"mode": "palette-classic"
},
"custom": {
"drawStyle": "line",
"lineInterpolation": "linear",
"lineWidth": 2,
"fillOpacity": 10,
"spanNulls": false,
"showPoints": "never",
"axisCenteredZero": false
}
},
"overrides": []
},
"targets": [
{
"refId": "A",
"datasource": {
"type": "victoriametrics-logs-datasource",
"uid": "${DS_VICTORIALOGS}"
},
"expr": "log_type:=\"gateway-access\" gateway_name:in($gateway) authority:in($hostname) path:in($path) method:in($method) response_code:in($status) cf_connecting_ip_reported:in($visitor) | copy downstream_remote_address as peer_address | replace_regexp (\":([0-9]+)$\", \"\") at peer_address | replace_regexp (\"^\\\\[(.*)\\\\]$\", \"${1}\") at peer_address | format if (cf_country_reported:in(\"\", \"-\")) \"Unknown\" as cf_country_reported | format if (user_agent:in(\"\", \"-\")) \"Unknown\" as user_agent | format if (upstream_cluster:in(\"\", \"-\")) \"Unknown\" as upstream_cluster | format if (response_code_details:in(\"\", \"-\")) \"Unknown\" as response_code_details | format if (upstream_transport_failure_reason:in(\"\", \"-\")) \"Unknown\" as upstream_transport_failure_reason | filter peer_address:in($peer) cf_country_reported:in($country) user_agent:in($agent) upstream_cluster:in($backend) response_flags:in($flags) request_id:in(${request_id:json}) cf_ray:in(${ray_id:json}) | filter gateway_name:=\"cloudflare-gateway\" cf_connecting_ip_reported:!=\"\" cf_connecting_ip_reported:!=\"-\" | stats count_uniq(cf_connecting_ip_reported) as addresses",
"queryType": "statsRange",
"editorMode": "code",
"legendFormat": "{{__name__}}",
"maxLines": 1000,
"direction": "desc"
}
],
"interval": "30s",
"options": {
"legend": {
"displayMode": "table",
"placement": "bottom",
"showLegend": true,
"calcs": [
"lastNotNull",
"max"
]
},
"tooltip": {
"mode": "multi",
"sort": "desc"
}
}
},
{
"id": 21,
"title": "Public request rate by reported country",
"type": "timeseries",
"datasource": {
"type": "victoriametrics-logs-datasource",
"uid": "${DS_VICTORIALOGS}"
},
"description": "Top 10 reported countries over the selected range. Unknown means the header was absent; XX means unknown country and T1 means Tor.",
"gridPos": {
"x": 12,
"y": 43,
"w": 12,
"h": 8
},
"fieldConfig": {
"defaults": {
"unit": "reqps",
"noValue": "\u2014",
"color": {
"mode": "palette-classic"
},
"custom": {
"drawStyle": "line",
"lineInterpolation": "linear",
"lineWidth": 2,
"fillOpacity": 10,
"spanNulls": false,
"showPoints": "never",
"axisCenteredZero": false
}
},
"overrides": []
},
"targets": [
{
"refId": "A",
"datasource": {
"type": "victoriametrics-logs-datasource",
"uid": "${DS_VICTORIALOGS}"
},
"expr": "log_type:=\"gateway-access\" gateway_name:in($gateway) authority:in($hostname) path:in($path) method:in($method) response_code:in($status) cf_connecting_ip_reported:in($visitor) | copy downstream_remote_address as peer_address | replace_regexp (\":([0-9]+)$\", \"\") at peer_address | replace_regexp (\"^\\\\[(.*)\\\\]$\", \"${1}\") at peer_address | format if (cf_country_reported:in(\"\", \"-\")) \"Unknown\" as cf_country_reported | format if (user_agent:in(\"\", \"-\")) \"Unknown\" as user_agent | format if (upstream_cluster:in(\"\", \"-\")) \"Unknown\" as upstream_cluster | format if (response_code_details:in(\"\", \"-\")) \"Unknown\" as response_code_details | format if (upstream_transport_failure_reason:in(\"\", \"-\")) \"Unknown\" as upstream_transport_failure_reason | filter peer_address:in($peer) cf_country_reported:in($country) user_agent:in($agent) upstream_cluster:in($backend) response_flags:in($flags) request_id:in(${request_id:json}) cf_ray:in(${ray_id:json}) | filter gateway_name:=\"cloudflare-gateway\" | filter cf_country_reported:in(log_type:=\"gateway-access\" gateway_name:in($gateway) authority:in($hostname) path:in($path) method:in($method) response_code:in($status) cf_connecting_ip_reported:in($visitor) | copy downstream_remote_address as peer_address | replace_regexp (\":([0-9]+)$\", \"\") at peer_address | replace_regexp (\"^\\\\[(.*)\\\\]$\", \"${1}\") at peer_address | format if (cf_country_reported:in(\"\", \"-\")) \"Unknown\" as cf_country_reported | format if (user_agent:in(\"\", \"-\")) \"Unknown\" as user_agent | format if (upstream_cluster:in(\"\", \"-\")) \"Unknown\" as upstream_cluster | format if (response_code_details:in(\"\", \"-\")) \"Unknown\" as response_code_details | format if (upstream_transport_failure_reason:in(\"\", \"-\")) \"Unknown\" as upstream_transport_failure_reason | filter peer_address:in($peer) cf_country_reported:in($country) user_agent:in($agent) upstream_cluster:in($backend) response_flags:in($flags) request_id:in(${request_id:json}) cf_ray:in(${ray_id:json}) | filter gateway_name:=\"cloudflare-gateway\" | stats by (cf_country_reported) count() as requests | sort by (requests) desc | limit 10 | fields cf_country_reported) | stats by (cf_country_reported) rate() as requests_per_second",
"queryType": "statsRange",
"editorMode": "code",
"legendFormat": "{{cf_country_reported}}",
"maxLines": 1000,
"direction": "desc"
}
],
"interval": "30s",
"options": {
"legend": {
"displayMode": "table",
"placement": "bottom",
"showLegend": true,
"calcs": [
"lastNotNull",
"max"
]
},
"tooltip": {
"mode": "multi",
"sort": "desc"
}
}
},
{
"id": 23,
"title": "Reported public visitor IPs",
"type": "table",
"datasource": {
"type": "victoriametrics-logs-datasource",
"uid": "${DS_VICTORIALOGS}"
},
"description": "Top 20 reported public IPs; these are not authenticated visitor identities or unique people.",
"gridPos": {
"x": 0,
"y": 51,
"w": 12,
"h": 8
},
"fieldConfig": {
"defaults": {
"unit": "none",
"noValue": "\u2014",
"color": {
"mode": "palette-classic"
}
},
"overrides": [
{
"matcher": {
"id": "byName",
"options": "Reported visitor IP"
},
"properties": [
{
"id": "links",
"value": [
{
"title": "Filter Reported visitor IP",
"url": "/d/http-traffic/http-traffic?${__url_time_range}&${gateway:queryparam}&${hostname:queryparam}&${path:queryparam}&${method:queryparam}&${status:queryparam}&${peer:queryparam}&${country:queryparam}&${agent:queryparam}&${backend:queryparam}&${flags:queryparam}&${request_id:queryparam}&${ray_id:queryparam}&var-visitor=${__value.raw:percentencode}",
"targetBlank": false
}
]
}
]
},
{
"matcher": {
"id": "byName",
"options": "Requests"
},
"properties": [
{
"id": "unit",
"value": "short"
},
{
"id": "decimals",
"value": 0
}
]
}
]
},
"targets": [
{
"refId": "A",
"datasource": {
"type": "victoriametrics-logs-datasource",
"uid": "${DS_VICTORIALOGS}"
},
"expr": "log_type:=\"gateway-access\" gateway_name:in($gateway) authority:in($hostname) path:in($path) method:in($method) response_code:in($status) cf_connecting_ip_reported:in($visitor) | copy downstream_remote_address as peer_address | replace_regexp (\":([0-9]+)$\", \"\") at peer_address | replace_regexp (\"^\\\\[(.*)\\\\]$\", \"${1}\") at peer_address | format if (cf_country_reported:in(\"\", \"-\")) \"Unknown\" as cf_country_reported | format if (user_agent:in(\"\", \"-\")) \"Unknown\" as user_agent | format if (upstream_cluster:in(\"\", \"-\")) \"Unknown\" as upstream_cluster | format if (response_code_details:in(\"\", \"-\")) \"Unknown\" as response_code_details | format if (upstream_transport_failure_reason:in(\"\", \"-\")) \"Unknown\" as upstream_transport_failure_reason | filter peer_address:in($peer) cf_country_reported:in($country) user_agent:in($agent) upstream_cluster:in($backend) response_flags:in($flags) request_id:in(${request_id:json}) cf_ray:in(${ray_id:json}) | filter gateway_name:=\"cloudflare-gateway\" cf_connecting_ip_reported:!=\"\" cf_connecting_ip_reported:!=\"-\" | stats by (cf_connecting_ip_reported) count() as requests | sort by (requests) desc | limit 20",
"queryType": "instant",
"editorMode": "code",
"legendFormat": "{{__name__}}",
"maxLines": 20,
"direction": "desc"
}
],
"options": {
"showHeader": true,
"cellHeight": "sm",
"footer": {
"show": false
},
"sortBy": [
{
"displayName": "Requests",
"desc": true
}
]
},
"transformations": [
{
"id": "extractFields",
"options": {
"source": "labels",
"format": "json",
"replace": true,
"keepTime": false
}
},
{
"id": "convertFieldType",
"options": {
"conversions": [
{
"targetField": "requests",
"destinationType": "number"
}
],
"fields": {}
}
},
{
"id": "organize",
"options": {
"excludeByName": {},
"includeByName": {
"cf_connecting_ip_reported": true,
"requests": true
},
"indexByName": {
"cf_connecting_ip_reported": 0,
"requests": 1
},
"renameByName": {
"cf_connecting_ip_reported": "Reported visitor IP",
"requests": "Requests"
}
}
}
]
},
{
"id": 24,
"title": "Reported IPs by hostname",
"type": "table",
"datasource": {
"type": "victoriametrics-logs-datasource",
"uid": "${DS_VICTORIALOGS}"
},
"description": "Which hostnames each reported public address requested.",
"gridPos": {
"x": 12,
"y": 51,
"w": 12,
"h": 8
},
"fieldConfig": {
"defaults": {
"unit": "none",
"noValue": "\u2014",
"color": {
"mode": "palette-classic"
}
},
"overrides": [
{
"matcher": {
"id": "byName",
"options": "Reported visitor IP"
},
"properties": [
{
"id": "links",
"value": [
{
"title": "Filter Reported visitor IP",
"url": "/d/http-traffic/http-traffic?${__url_time_range}&${gateway:queryparam}&${hostname:queryparam}&${path:queryparam}&${method:queryparam}&${status:queryparam}&${peer:queryparam}&${country:queryparam}&${agent:queryparam}&${backend:queryparam}&${flags:queryparam}&${request_id:queryparam}&${ray_id:queryparam}&var-visitor=${__value.raw:percentencode}",
"targetBlank": false
}
]
}
]
},
{
"matcher": {
"id": "byName",
"options": "Hostname"
},
"properties": [
{
"id": "links",
"value": [
{
"title": "Filter Hostname",
"url": "/d/http-traffic/http-traffic?${__url_time_range}&${gateway:queryparam}&${path:queryparam}&${method:queryparam}&${status:queryparam}&${visitor:queryparam}&${peer:queryparam}&${country:queryparam}&${agent:queryparam}&${backend:queryparam}&${flags:queryparam}&${request_id:queryparam}&${ray_id:queryparam}&var-hostname=${__value.raw:percentencode}",
"targetBlank": false
}
]
}
]
},
{
"matcher": {
"id": "byName",
"options": "Requests"
},
"properties": [
{
"id": "unit",
"value": "short"
},
{
"id": "decimals",
"value": 0
}
]
}
]
},
"targets": [
{
"refId": "A",
"datasource": {
"type": "victoriametrics-logs-datasource",
"uid": "${DS_VICTORIALOGS}"
},
"expr": "log_type:=\"gateway-access\" gateway_name:in($gateway) authority:in($hostname) path:in($path) method:in($method) response_code:in($status) cf_connecting_ip_reported:in($visitor) | copy downstream_remote_address as peer_address | replace_regexp (\":([0-9]+)$\", \"\") at peer_address | replace_regexp (\"^\\\\[(.*)\\\\]$\", \"${1}\") at peer_address | format if (cf_country_reported:in(\"\", \"-\")) \"Unknown\" as cf_country_reported | format if (user_agent:in(\"\", \"-\")) \"Unknown\" as user_agent | format if (upstream_cluster:in(\"\", \"-\")) \"Unknown\" as upstream_cluster | format if (response_code_details:in(\"\", \"-\")) \"Unknown\" as response_code_details | format if (upstream_transport_failure_reason:in(\"\", \"-\")) \"Unknown\" as upstream_transport_failure_reason | filter peer_address:in($peer) cf_country_reported:in($country) user_agent:in($agent) upstream_cluster:in($backend) response_flags:in($flags) request_id:in(${request_id:json}) cf_ray:in(${ray_id:json}) | filter gateway_name:=\"cloudflare-gateway\" cf_connecting_ip_reported:!=\"\" cf_connecting_ip_reported:!=\"-\" | stats by (cf_connecting_ip_reported, authority) count() as requests | sort by (requests) desc | limit 20",
"queryType": "instant",
"editorMode": "code",
"legendFormat": "{{__name__}}",
"maxLines": 20,
"direction": "desc"
}
],
"options": {
"showHeader": true,
"cellHeight": "sm",
"footer": {
"show": false
},
"sortBy": [
{
"displayName": "Requests",
"desc": true
}
]
},
"transformations": [
{
"id": "extractFields",
"options": {
"source": "labels",
"format": "json",
"replace": true,
"keepTime": false
}
},
{
"id": "convertFieldType",
"options": {
"conversions": [
{
"targetField": "requests",
"destinationType": "number"
}
],
"fields": {}
}
},
{
"id": "organize",
"options": {
"excludeByName": {},
"includeByName": {
"cf_connecting_ip_reported": true,
"authority": true,
"requests": true
},
"indexByName": {
"cf_connecting_ip_reported": 0,
"authority": 1,
"requests": 2
},
"renameByName": {
"cf_connecting_ip_reported": "Reported visitor IP",
"authority": "Hostname",
"requests": "Requests"
}
}
}
]
},
{
"id": 25,
"title": "Reported IPs by endpoint",
"type": "table",
"datasource": {
"type": "victoriametrics-logs-datasource",
"uid": "${DS_VICTORIALOGS}"
},
"description": "Top 20 public IP/hostname/path combinations.",
"gridPos": {
"x": 0,
"y": 59,
"w": 12,
"h": 8
},
"fieldConfig": {
"defaults": {
"unit": "none",
"noValue": "\u2014",
"color": {
"mode": "palette-classic"
}
},
"overrides": [
{
"matcher": {
"id": "byName",
"options": "Reported visitor IP"
},
"properties": [
{
"id": "links",
"value": [
{
"title": "Filter Reported visitor IP",
"url": "/d/http-traffic/http-traffic?${__url_time_range}&${gateway:queryparam}&${hostname:queryparam}&${path:queryparam}&${method:queryparam}&${status:queryparam}&${peer:queryparam}&${country:queryparam}&${agent:queryparam}&${backend:queryparam}&${flags:queryparam}&${request_id:queryparam}&${ray_id:queryparam}&var-visitor=${__value.raw:percentencode}",
"targetBlank": false
}
]
}
]
},
{
"matcher": {
"id": "byName",
"options": "Hostname"
},
"properties": [
{
"id": "links",
"value": [
{
"title": "Filter Hostname",
"url": "/d/http-traffic/http-traffic?${__url_time_range}&${gateway:queryparam}&${path:queryparam}&${method:queryparam}&${status:queryparam}&${visitor:queryparam}&${peer:queryparam}&${country:queryparam}&${agent:queryparam}&${backend:queryparam}&${flags:queryparam}&${request_id:queryparam}&${ray_id:queryparam}&var-hostname=${__value.raw:percentencode}",
"targetBlank": false
}
]
}
]
},
{
"matcher": {
"id": "byName",
"options": "Path"
},
"properties": [
{
"id": "links",
"value": [
{
"title": "Filter Path",
"url": "/d/http-traffic/http-traffic?${__url_time_range}&${gateway:queryparam}&${hostname:queryparam}&${method:queryparam}&${status:queryparam}&${visitor:queryparam}&${peer:queryparam}&${country:queryparam}&${agent:queryparam}&${backend:queryparam}&${flags:queryparam}&${request_id:queryparam}&${ray_id:queryparam}&var-path=${__value.raw:percentencode}",
"targetBlank": false
}
]
}
]
},
{
"matcher": {
"id": "byName",
"options": "Requests"
},
"properties": [
{
"id": "unit",
"value": "short"
},
{
"id": "decimals",
"value": 0
}
]
}
]
},
"targets": [
{
"refId": "A",
"datasource": {
"type": "victoriametrics-logs-datasource",
"uid": "${DS_VICTORIALOGS}"
},
"expr": "log_type:=\"gateway-access\" gateway_name:in($gateway) authority:in($hostname) path:in($path) method:in($method) response_code:in($status) cf_connecting_ip_reported:in($visitor) | copy downstream_remote_address as peer_address | replace_regexp (\":([0-9]+)$\", \"\") at peer_address | replace_regexp (\"^\\\\[(.*)\\\\]$\", \"${1}\") at peer_address | format if (cf_country_reported:in(\"\", \"-\")) \"Unknown\" as cf_country_reported | format if (user_agent:in(\"\", \"-\")) \"Unknown\" as user_agent | format if (upstream_cluster:in(\"\", \"-\")) \"Unknown\" as upstream_cluster | format if (response_code_details:in(\"\", \"-\")) \"Unknown\" as response_code_details | format if (upstream_transport_failure_reason:in(\"\", \"-\")) \"Unknown\" as upstream_transport_failure_reason | filter peer_address:in($peer) cf_country_reported:in($country) user_agent:in($agent) upstream_cluster:in($backend) response_flags:in($flags) request_id:in(${request_id:json}) cf_ray:in(${ray_id:json}) | filter gateway_name:=\"cloudflare-gateway\" cf_connecting_ip_reported:!=\"\" cf_connecting_ip_reported:!=\"-\" | stats by (cf_connecting_ip_reported, authority, path) count() as requests | sort by (requests) desc | limit 20",
"queryType": "instant",
"editorMode": "code",
"legendFormat": "{{__name__}}",
"maxLines": 20,
"direction": "desc"
}
],
"options": {
"showHeader": true,
"cellHeight": "sm",
"footer": {
"show": false
},
"sortBy": [
{
"displayName": "Requests",
"desc": true
}
]
},
"transformations": [
{
"id": "extractFields",
"options": {
"source": "labels",
"format": "json",
"replace": true,
"keepTime": false
}
},
{
"id": "convertFieldType",
"options": {
"conversions": [
{
"targetField": "requests",
"destinationType": "number"
}
],
"fields": {}
}
},
{
"id": "organize",
"options": {
"excludeByName": {},
"includeByName": {
"cf_connecting_ip_reported": true,
"authority": true,
"path": true,
"requests": true
},
"indexByName": {
"cf_connecting_ip_reported": 0,
"authority": 1,
"path": 2,
"requests": 3
},
"renameByName": {
"cf_connecting_ip_reported": "Reported visitor IP",
"authority": "Hostname",
"path": "Path",
"requests": "Requests"
}
}
}
]
},
{
"id": 27,
"title": "LAN network peers",
"type": "table",
"datasource": {
"type": "victoriametrics-logs-datasource",
"uid": "${DS_VICTORIALOGS}"
},
"description": "Network peer IPs on LAN requests, with source ports and IPv6 brackets removed. A peer may be a proxy rather than a visitor.",
"gridPos": {
"x": 12,
"y": 59,
"w": 12,
"h": 8
},
"fieldConfig": {
"defaults": {
"unit": "none",
"noValue": "\u2014",
"color": {
"mode": "palette-classic"
}
},
"overrides": [
{
"matcher": {
"id": "byName",
"options": "Network peer IP"
},
"properties": [
{
"id": "links",
"value": [
{
"title": "Filter Network peer IP",
"url": "/d/http-traffic/http-traffic?${__url_time_range}&${gateway:queryparam}&${hostname:queryparam}&${path:queryparam}&${method:queryparam}&${status:queryparam}&${visitor:queryparam}&${country:queryparam}&${agent:queryparam}&${backend:queryparam}&${flags:queryparam}&${request_id:queryparam}&${ray_id:queryparam}&var-peer=${__value.raw:percentencode}",
"targetBlank": false
}
]
}
]
},
{
"matcher": {
"id": "byName",
"options": "Requests"
},
"properties": [
{
"id": "unit",
"value": "short"
},
{
"id": "decimals",
"value": 0
}
]
}
]
},
"targets": [
{
"refId": "A",
"datasource": {
"type": "victoriametrics-logs-datasource",
"uid": "${DS_VICTORIALOGS}"
},
"expr": "log_type:=\"gateway-access\" gateway_name:in($gateway) authority:in($hostname) path:in($path) method:in($method) response_code:in($status) cf_connecting_ip_reported:in($visitor) | copy downstream_remote_address as peer_address | replace_regexp (\":([0-9]+)$\", \"\") at peer_address | replace_regexp (\"^\\\\[(.*)\\\\]$\", \"${1}\") at peer_address | format if (cf_country_reported:in(\"\", \"-\")) \"Unknown\" as cf_country_reported | format if (user_agent:in(\"\", \"-\")) \"Unknown\" as user_agent | format if (upstream_cluster:in(\"\", \"-\")) \"Unknown\" as upstream_cluster | format if (response_code_details:in(\"\", \"-\")) \"Unknown\" as response_code_details | format if (upstream_transport_failure_reason:in(\"\", \"-\")) \"Unknown\" as upstream_transport_failure_reason | filter peer_address:in($peer) cf_country_reported:in($country) user_agent:in($agent) upstream_cluster:in($backend) response_flags:in($flags) request_id:in(${request_id:json}) cf_ray:in(${ray_id:json}) | filter gateway_name:=\"default-gateway\" peer_address:!=\"\" peer_address:!=\"-\" | stats by (peer_address) count() as requests | sort by (requests) desc | limit 20",
"queryType": "instant",
"editorMode": "code",
"legendFormat": "{{__name__}}",
"maxLines": 20,
"direction": "desc"
}
],
"options": {
"showHeader": true,
"cellHeight": "sm",
"footer": {
"show": false
},
"sortBy": [
{
"displayName": "Requests",
"desc": true
}
]
},
"transformations": [
{
"id": "extractFields",
"options": {
"source": "labels",
"format": "json",
"replace": true,
"keepTime": false
}
},
{
"id": "convertFieldType",
"options": {
"conversions": [
{
"targetField": "requests",
"destinationType": "number"
}
],
"fields": {}
}
},
{
"id": "organize",
"options": {
"excludeByName": {},
"includeByName": {
"peer_address": true,
"requests": true
},
"indexByName": {
"peer_address": 0,
"requests": 1
},
"renameByName": {
"peer_address": "Network peer IP",
"requests": "Requests"
}
}
}
]
}
]
},
{
"id": 28,
"type": "row",
"title": "Performance and backends",
"collapsed": true,
"gridPos": {
"x": 0,
"y": 43,
"w": 24,
"h": 1
},
"panels": [
{
"id": 29,
"title": "Request duration",
"type": "timeseries",
"datasource": {
"type": "victoriametrics-logs-datasource",
"uid": "${DS_VICTORIALOGS}"
},
"description": "p50/p95/p99 per time bucket, including long-lived requests with an HTTP response.",
"gridPos": {
"x": 0,
"y": 44,
"w": 12,
"h": 8
},
"fieldConfig": {
"defaults": {
"unit": "ms",
"noValue": "\u2014",
"color": {
"mode": "palette-classic"
},
"custom": {
"drawStyle": "line",
"lineInterpolation": "linear",
"lineWidth": 2,
"fillOpacity": 10,
"spanNulls": false,
"showPoints": "never",
"axisCenteredZero": false
}
},
"overrides": []
},
"targets": [
{
"refId": "A",
"datasource": {
"type": "victoriametrics-logs-datasource",
"uid": "${DS_VICTORIALOGS}"
},
"expr": "log_type:=\"gateway-access\" gateway_name:in($gateway) authority:in($hostname) path:in($path) method:in($method) response_code:in($status) cf_connecting_ip_reported:in($visitor) | copy downstream_remote_address as peer_address | replace_regexp (\":([0-9]+)$\", \"\") at peer_address | replace_regexp (\"^\\\\[(.*)\\\\]$\", \"${1}\") at peer_address | format if (cf_country_reported:in(\"\", \"-\")) \"Unknown\" as cf_country_reported | format if (user_agent:in(\"\", \"-\")) \"Unknown\" as user_agent | format if (upstream_cluster:in(\"\", \"-\")) \"Unknown\" as upstream_cluster | format if (response_code_details:in(\"\", \"-\")) \"Unknown\" as response_code_details | format if (upstream_transport_failure_reason:in(\"\", \"-\")) \"Unknown\" as upstream_transport_failure_reason | filter peer_address:in($peer) cf_country_reported:in($country) user_agent:in($agent) upstream_cluster:in($backend) response_flags:in($flags) request_id:in(${request_id:json}) cf_ray:in(${ray_id:json}) | filter response_code:>=100 response_code:<600 | stats quantile(0.50, duration_ms) as p50, quantile(0.95, duration_ms) as p95, quantile(0.99, duration_ms) as p99 | filter p95:!=\"\"",
"queryType": "statsRange",
"editorMode": "code",
"legendFormat": "{{__name__}}",
"maxLines": 1000,
"direction": "desc"
}
],
"interval": "30s",
"options": {
"legend": {
"displayMode": "table",
"placement": "bottom",
"showLegend": true,
"calcs": [
"lastNotNull",
"max"
]
},
"tooltip": {
"mode": "multi",
"sort": "desc"
}
}
},
{
"id": 30,
"title": "p95 duration by hostname",
"type": "timeseries",
"datasource": {
"type": "victoriametrics-logs-datasource",
"uid": "${DS_VICTORIALOGS}"
},
"description": "p95 for the top 10 hostnames by request volume over the selected range.",
"gridPos": {
"x": 12,
"y": 44,
"w": 12,
"h": 8
},
"fieldConfig": {
"defaults": {
"unit": "ms",
"noValue": "\u2014",
"color": {
"mode": "palette-classic"
},
"custom": {
"drawStyle": "line",
"lineInterpolation": "linear",
"lineWidth": 2,
"fillOpacity": 10,
"spanNulls": false,
"showPoints": "never",
"axisCenteredZero": false
}
},
"overrides": []
},
"targets": [
{
"refId": "A",
"datasource": {
"type": "victoriametrics-logs-datasource",
"uid": "${DS_VICTORIALOGS}"
},
"expr": "log_type:=\"gateway-access\" gateway_name:in($gateway) authority:in($hostname) path:in($path) method:in($method) response_code:in($status) cf_connecting_ip_reported:in($visitor) | copy downstream_remote_address as peer_address | replace_regexp (\":([0-9]+)$\", \"\") at peer_address | replace_regexp (\"^\\\\[(.*)\\\\]$\", \"${1}\") at peer_address | format if (cf_country_reported:in(\"\", \"-\")) \"Unknown\" as cf_country_reported | format if (user_agent:in(\"\", \"-\")) \"Unknown\" as user_agent | format if (upstream_cluster:in(\"\", \"-\")) \"Unknown\" as upstream_cluster | format if (response_code_details:in(\"\", \"-\")) \"Unknown\" as response_code_details | format if (upstream_transport_failure_reason:in(\"\", \"-\")) \"Unknown\" as upstream_transport_failure_reason | filter peer_address:in($peer) cf_country_reported:in($country) user_agent:in($agent) upstream_cluster:in($backend) response_flags:in($flags) request_id:in(${request_id:json}) cf_ray:in(${ray_id:json}) | filter authority:in(log_type:=\"gateway-access\" gateway_name:in($gateway) authority:in($hostname) path:in($path) method:in($method) response_code:in($status) cf_connecting_ip_reported:in($visitor) | copy downstream_remote_address as peer_address | replace_regexp (\":([0-9]+)$\", \"\") at peer_address | replace_regexp (\"^\\\\[(.*)\\\\]$\", \"${1}\") at peer_address | format if (cf_country_reported:in(\"\", \"-\")) \"Unknown\" as cf_country_reported | format if (user_agent:in(\"\", \"-\")) \"Unknown\" as user_agent | format if (upstream_cluster:in(\"\", \"-\")) \"Unknown\" as upstream_cluster | format if (response_code_details:in(\"\", \"-\")) \"Unknown\" as response_code_details | format if (upstream_transport_failure_reason:in(\"\", \"-\")) \"Unknown\" as upstream_transport_failure_reason | filter peer_address:in($peer) cf_country_reported:in($country) user_agent:in($agent) upstream_cluster:in($backend) response_flags:in($flags) request_id:in(${request_id:json}) cf_ray:in(${ray_id:json}) | stats by (authority) count() as requests | sort by (requests) desc | limit 10 | fields authority) | filter response_code:>=100 response_code:<600 | stats by (authority) quantile(0.95, duration_ms) as p95_ms | filter p95_ms:!=\"\"",
"queryType": "statsRange",
"editorMode": "code",
"legendFormat": "{{authority}}",
"maxLines": 1000,
"direction": "desc"
}
],
"interval": "30s",
"options": {
"legend": {
"displayMode": "table",
"placement": "bottom",
"showLegend": true,
"calcs": [
"lastNotNull",
"max"
]
},
"tooltip": {
"mode": "multi",
"sort": "desc"
}
}
},
{
"id": 31,
"title": "Slow endpoints",
"type": "table",
"datasource": {
"type": "victoriametrics-logs-datasource",
"uid": "${DS_VICTORIALOGS}"
},
"description": "Top 20 endpoints by p95 duration; low-volume endpoints can have unstable percentiles.",
"gridPos": {
"x": 0,
"y": 52,
"w": 12,
"h": 8
},
"fieldConfig": {
"defaults": {
"unit": "none",
"noValue": "\u2014",
"color": {
"mode": "palette-classic"
}
},
"overrides": [
{
"matcher": {
"id": "byName",
"options": "Hostname"
},
"properties": [
{
"id": "links",
"value": [
{
"title": "Filter Hostname",
"url": "/d/http-traffic/http-traffic?${__url_time_range}&${gateway:queryparam}&${path:queryparam}&${method:queryparam}&${status:queryparam}&${visitor:queryparam}&${peer:queryparam}&${country:queryparam}&${agent:queryparam}&${backend:queryparam}&${flags:queryparam}&${request_id:queryparam}&${ray_id:queryparam}&var-hostname=${__value.raw:percentencode}",
"targetBlank": false
}
]
}
]
},
{
"matcher": {
"id": "byName",
"options": "Path"
},
"properties": [
{
"id": "links",
"value": [
{
"title": "Filter Path",
"url": "/d/http-traffic/http-traffic?${__url_time_range}&${gateway:queryparam}&${hostname:queryparam}&${method:queryparam}&${status:queryparam}&${visitor:queryparam}&${peer:queryparam}&${country:queryparam}&${agent:queryparam}&${backend:queryparam}&${flags:queryparam}&${request_id:queryparam}&${ray_id:queryparam}&var-path=${__value.raw:percentencode}",
"targetBlank": false
}
]
}
]
},
{
"matcher": {
"id": "byName",
"options": "Requests"
},
"properties": [
{
"id": "unit",
"value": "short"
},
{
"id": "decimals",
"value": 0
}
]
},
{
"matcher": {
"id": "byName",
"options": "p95 duration"
},
"properties": [
{
"id": "unit",
"value": "ms"
},
{
"id": "decimals",
"value": 0
}
]
}
]
},
"targets": [
{
"refId": "A",
"datasource": {
"type": "victoriametrics-logs-datasource",
"uid": "${DS_VICTORIALOGS}"
},
"expr": "log_type:=\"gateway-access\" gateway_name:in($gateway) authority:in($hostname) path:in($path) method:in($method) response_code:in($status) cf_connecting_ip_reported:in($visitor) | copy downstream_remote_address as peer_address | replace_regexp (\":([0-9]+)$\", \"\") at peer_address | replace_regexp (\"^\\\\[(.*)\\\\]$\", \"${1}\") at peer_address | format if (cf_country_reported:in(\"\", \"-\")) \"Unknown\" as cf_country_reported | format if (user_agent:in(\"\", \"-\")) \"Unknown\" as user_agent | format if (upstream_cluster:in(\"\", \"-\")) \"Unknown\" as upstream_cluster | format if (response_code_details:in(\"\", \"-\")) \"Unknown\" as response_code_details | format if (upstream_transport_failure_reason:in(\"\", \"-\")) \"Unknown\" as upstream_transport_failure_reason | filter peer_address:in($peer) cf_country_reported:in($country) user_agent:in($agent) upstream_cluster:in($backend) response_flags:in($flags) request_id:in(${request_id:json}) cf_ray:in(${ray_id:json}) | filter response_code:>=100 response_code:<600 | stats by (authority, path) count() as requests, quantile(0.95, duration_ms) as p95_ms | sort by (p95_ms) desc | limit 20",
"queryType": "instant",
"editorMode": "code",
"legendFormat": "{{__name__}}",
"maxLines": 20,
"direction": "desc"
}
],
"options": {
"showHeader": true,
"cellHeight": "sm",
"footer": {
"show": false
},
"sortBy": [
{
"displayName": "p95 duration",
"desc": true
}
]
},
"transformations": [
{
"id": "extractFields",
"options": {
"source": "labels",
"format": "json",
"replace": true,
"keepTime": false
}
},
{
"id": "convertFieldType",
"options": {
"conversions": [
{
"targetField": "requests",
"destinationType": "number"
},
{
"targetField": "p95_ms",
"destinationType": "number"
}
],
"fields": {}
}
},
{
"id": "organize",
"options": {
"excludeByName": {},
"includeByName": {
"authority": true,
"path": true,
"requests": true,
"p95_ms": true
},
"indexByName": {
"authority": 0,
"path": 1,
"requests": 2,
"p95_ms": 3
},
"renameByName": {
"authority": "Hostname",
"path": "Path",
"requests": "Requests",
"p95_ms": "p95 duration"
}
}
}
]
},
{
"id": 32,
"title": "Slowest requests",
"type": "table",
"datasource": {
"type": "victoriametrics-logs-datasource",
"uid": "${DS_VICTORIALOGS}"
},
"description": "Slowest 200 matching completed requests, including long-lived streams. Request IDs can be copied into the lookup control.",
"gridPos": {
"x": 12,
"y": 52,
"w": 12,
"h": 8
},
"fieldConfig": {
"defaults": {
"unit": "none",
"noValue": "\u2014",
"color": {
"mode": "palette-classic"
}
},
"overrides": [
{
"matcher": {
"id": "byName",
"options": "Hostname"
},
"properties": [
{
"id": "links",
"value": [
{
"title": "Filter Hostname",
"url": "/d/http-traffic/http-traffic?${__url_time_range}&${gateway:queryparam}&${path:queryparam}&${method:queryparam}&${status:queryparam}&${visitor:queryparam}&${peer:queryparam}&${country:queryparam}&${agent:queryparam}&${backend:queryparam}&${flags:queryparam}&${request_id:queryparam}&${ray_id:queryparam}&var-hostname=${__value.raw:percentencode}",
"targetBlank": false
}
]
}
]
},
{
"matcher": {
"id": "byName",
"options": "Method"
},
"properties": []
},
{
"matcher": {
"id": "byName",
"options": "Path"
},
"properties": [
{
"id": "links",
"value": [
{
"title": "Filter Path",
"url": "/d/http-traffic/http-traffic?${__url_time_range}&${gateway:queryparam}&${hostname:queryparam}&${method:queryparam}&${status:queryparam}&${visitor:queryparam}&${peer:queryparam}&${country:queryparam}&${agent:queryparam}&${backend:queryparam}&${flags:queryparam}&${request_id:queryparam}&${ray_id:queryparam}&var-path=${__value.raw:percentencode}",
"targetBlank": false
}
]
}
]
},
{
"matcher": {
"id": "byName",
"options": "Status"
},
"properties": [
{
"id": "unit",
"value": "none"
},
{
"id": "decimals",
"value": 0
},
{
"id": "mappings",
"value": [
{
"type": "value",
"options": {
"0": {
"text": "No HTTP response"
}
}
}
]
}
]
},
{
"matcher": {
"id": "byName",
"options": "Duration"
},
"properties": [
{
"id": "unit",
"value": "ms"
},
{
"id": "decimals",
"value": 0
}
]
},
{
"matcher": {
"id": "byName",
"options": "Backend"
},
"properties": []
}
]
},
"targets": [
{
"refId": "A",
"datasource": {
"type": "victoriametrics-logs-datasource",
"uid": "${DS_VICTORIALOGS}"
},
"expr": "log_type:=\"gateway-access\" gateway_name:in($gateway) authority:in($hostname) path:in($path) method:in($method) response_code:in($status) cf_connecting_ip_reported:in($visitor) | copy downstream_remote_address as peer_address | replace_regexp (\":([0-9]+)$\", \"\") at peer_address | replace_regexp (\"^\\\\[(.*)\\\\]$\", \"${1}\") at peer_address | format if (cf_country_reported:in(\"\", \"-\")) \"Unknown\" as cf_country_reported | format if (user_agent:in(\"\", \"-\")) \"Unknown\" as user_agent | format if (upstream_cluster:in(\"\", \"-\")) \"Unknown\" as upstream_cluster | format if (response_code_details:in(\"\", \"-\")) \"Unknown\" as response_code_details | format if (upstream_transport_failure_reason:in(\"\", \"-\")) \"Unknown\" as upstream_transport_failure_reason | filter peer_address:in($peer) cf_country_reported:in($country) user_agent:in($agent) upstream_cluster:in($backend) response_flags:in($flags) request_id:in(${request_id:json}) cf_ray:in(${ray_id:json}) | sort by (duration_ms) desc | limit 200 | fields _time, gateway_name, authority, method, path, response_code, duration_ms, cf_connecting_ip_reported, peer_address, downstream_remote_address, cf_country_reported, user_agent, upstream_cluster, upstream_host, response_flags, response_code_details, upstream_transport_failure_reason, request_id, cf_ray",
"queryType": "instant",
"editorMode": "code",
"legendFormat": "{{__name__}}",
"maxLines": 200,
"direction": "desc"
}
],
"options": {
"showHeader": true,
"cellHeight": "sm",
"footer": {
"show": false
},
"sortBy": [
{
"displayName": "Duration",
"desc": true
}
]
},
"transformations": [
{
"id": "extractFields",
"options": {
"source": "labels",
"format": "json",
"replace": true,
"keepTime": true
}
},
{
"id": "convertFieldType",
"options": {
"conversions": [
{
"targetField": "response_code",
"destinationType": "number"
},
{
"targetField": "duration_ms",
"destinationType": "number"
}
],
"fields": {}
}
},
{
"id": "organize",
"options": {
"excludeByName": {},
"includeByName": {
"Time": true,
"authority": true,
"method": true,
"path": true,
"response_code": true,
"duration_ms": true,
"upstream_cluster": true,
"request_id": true
},
"indexByName": {
"Time": 0,
"authority": 1,
"method": 2,
"path": 3,
"response_code": 4,
"duration_ms": 5,
"upstream_cluster": 6,
"request_id": 7
},
"renameByName": {
"Time": "Time",
"authority": "Hostname",
"method": "Method",
"path": "Path",
"response_code": "Status",
"duration_ms": "Duration",
"upstream_cluster": "Backend",
"request_id": "Request ID"
}
}
}
]
},
{
"id": 33,
"title": "Response body size",
"type": "timeseries",
"datasource": {
"type": "victoriametrics-logs-datasource",
"uid": "${DS_VICTORIALOGS}"
},
"description": "Response body-size percentiles per bucket; not compressed network transfer size.",
"gridPos": {
"x": 0,
"y": 60,
"w": 12,
"h": 8
},
"fieldConfig": {
"defaults": {
"unit": "bytes",
"noValue": "\u2014",
"color": {
"mode": "palette-classic"
},
"custom": {
"drawStyle": "line",
"lineInterpolation": "linear",
"lineWidth": 2,
"fillOpacity": 10,
"spanNulls": false,
"showPoints": "never",
"axisCenteredZero": false
}
},
"overrides": []
},
"targets": [
{
"refId": "A",
"datasource": {
"type": "victoriametrics-logs-datasource",
"uid": "${DS_VICTORIALOGS}"
},
"expr": "log_type:=\"gateway-access\" gateway_name:in($gateway) authority:in($hostname) path:in($path) method:in($method) response_code:in($status) cf_connecting_ip_reported:in($visitor) | copy downstream_remote_address as peer_address | replace_regexp (\":([0-9]+)$\", \"\") at peer_address | replace_regexp (\"^\\\\[(.*)\\\\]$\", \"${1}\") at peer_address | format if (cf_country_reported:in(\"\", \"-\")) \"Unknown\" as cf_country_reported | format if (user_agent:in(\"\", \"-\")) \"Unknown\" as user_agent | format if (upstream_cluster:in(\"\", \"-\")) \"Unknown\" as upstream_cluster | format if (response_code_details:in(\"\", \"-\")) \"Unknown\" as response_code_details | format if (upstream_transport_failure_reason:in(\"\", \"-\")) \"Unknown\" as upstream_transport_failure_reason | filter peer_address:in($peer) cf_country_reported:in($country) user_agent:in($agent) upstream_cluster:in($backend) response_flags:in($flags) request_id:in(${request_id:json}) cf_ray:in(${ray_id:json}) | stats quantile(0.50, bytes_sent) as p50, quantile(0.95, bytes_sent) as p95, quantile(0.99, bytes_sent) as p99 | filter p95:!=\"\"",
"queryType": "statsRange",
"editorMode": "code",
"legendFormat": "{{__name__}}",
"maxLines": 1000,
"direction": "desc"
}
],
"interval": "30s",
"options": {
"legend": {
"displayMode": "table",
"placement": "bottom",
"showLegend": true,
"calcs": [
"lastNotNull",
"max"
]
},
"tooltip": {
"mode": "multi",
"sort": "desc"
}
}
},
{
"id": 34,
"title": "Backend summary",
"type": "table",
"datasource": {
"type": "victoriametrics-logs-datasource",
"uid": "${DS_VICTORIALOGS}"
},
"description": "Backend cluster and address breakdown. Old records have Unknown cluster but retain their upstream address.",
"gridPos": {
"x": 12,
"y": 60,
"w": 12,
"h": 8
},
"fieldConfig": {
"defaults": {
"unit": "none",
"noValue": "\u2014",
"color": {
"mode": "palette-classic"
}
},
"overrides": [
{
"matcher": {
"id": "byName",
"options": "Backend"
},
"properties": []
},
{
"matcher": {
"id": "byName",
"options": "Requests"
},
"properties": [
{
"id": "unit",
"value": "short"
},
{
"id": "decimals",
"value": 0
}
]
},
{
"matcher": {
"id": "byName",
"options": "errors"
},
"properties": [
{
"id": "unit",
"value": "short"
},
{
"id": "decimals",
"value": 0
}
]
},
{
"matcher": {
"id": "byName",
"options": "Response body bytes"
},
"properties": [
{
"id": "unit",
"value": "bytes"
},
{
"id": "decimals",
"value": 0
}
]
},
{
"matcher": {
"id": "byName",
"options": "p95 duration"
},
"properties": [
{
"id": "unit",
"value": "ms"
},
{
"id": "decimals",
"value": 0
}
]
}
]
},
"targets": [
{
"refId": "A",
"datasource": {
"type": "victoriametrics-logs-datasource",
"uid": "${DS_VICTORIALOGS}"
},
"expr": "log_type:=\"gateway-access\" gateway_name:in($gateway) authority:in($hostname) path:in($path) method:in($method) response_code:in($status) cf_connecting_ip_reported:in($visitor) | copy downstream_remote_address as peer_address | replace_regexp (\":([0-9]+)$\", \"\") at peer_address | replace_regexp (\"^\\\\[(.*)\\\\]$\", \"${1}\") at peer_address | format if (cf_country_reported:in(\"\", \"-\")) \"Unknown\" as cf_country_reported | format if (user_agent:in(\"\", \"-\")) \"Unknown\" as user_agent | format if (upstream_cluster:in(\"\", \"-\")) \"Unknown\" as upstream_cluster | format if (response_code_details:in(\"\", \"-\")) \"Unknown\" as response_code_details | format if (upstream_transport_failure_reason:in(\"\", \"-\")) \"Unknown\" as upstream_transport_failure_reason | filter peer_address:in($peer) cf_country_reported:in($country) user_agent:in($agent) upstream_cluster:in($backend) response_flags:in($flags) request_id:in(${request_id:json}) cf_ray:in(${ray_id:json}) | stats by (upstream_cluster, upstream_host) count() as requests, count() if (response_code:>=400 response_code:<600) as errors, sum(bytes_sent) as response_bytes, quantile(0.95, duration_ms) as p95_ms | sort by (requests) desc | limit 20",
"queryType": "instant",
"editorMode": "code",
"legendFormat": "{{__name__}}",
"maxLines": 20,
"direction": "desc"
}
],
"options": {
"showHeader": true,
"cellHeight": "sm",
"footer": {
"show": false
},
"sortBy": [
{
"displayName": "Requests",
"desc": true
}
]
},
"transformations": [
{
"id": "extractFields",
"options": {
"source": "labels",
"format": "json",
"replace": true,
"keepTime": false
}
},
{
"id": "convertFieldType",
"options": {
"conversions": [
{
"targetField": "requests",
"destinationType": "number"
},
{
"targetField": "errors",
"destinationType": "number"
},
{
"targetField": "response_bytes",
"destinationType": "number"
},
{
"targetField": "p95_ms",
"destinationType": "number"
}
],
"fields": {}
}
},
{
"id": "organize",
"options": {
"excludeByName": {},
"includeByName": {
"upstream_cluster": true,
"upstream_host": true,
"requests": true,
"errors": true,
"response_bytes": true,
"p95_ms": true
},
"indexByName": {
"upstream_cluster": 0,
"upstream_host": 1,
"requests": 2,
"errors": 3,
"response_bytes": 4,
"p95_ms": 5
},
"renameByName": {
"upstream_cluster": "Backend",
"upstream_host": "Upstream address",
"requests": "Requests",
"errors": "errors",
"response_bytes": "Response body bytes",
"p95_ms": "p95 duration"
}
}
}
]
}
]
},
{
"id": 35,
"type": "row",
"title": "Responses and failures",
"collapsed": true,
"gridPos": {
"x": 0,
"y": 44,
"w": 24,
"h": 1
},
"panels": [
{
"id": 36,
"title": "Response classes",
"type": "timeseries",
"datasource": {
"type": "victoriametrics-logs-datasource",
"uid": "${DS_VICTORIALOGS}"
},
"description": "HTTP status classes; code 0 means no HTTP response, often a disconnected client.",
"gridPos": {
"x": 0,
"y": 45,
"w": 12,
"h": 8
},
"fieldConfig": {
"defaults": {
"unit": "reqps",
"noValue": "\u2014",
"color": {
"mode": "palette-classic"
},
"custom": {
"drawStyle": "line",
"lineInterpolation": "linear",
"lineWidth": 2,
"fillOpacity": 10,
"spanNulls": false,
"showPoints": "never",
"axisCenteredZero": false
}
},
"overrides": []
},
"targets": [
{
"refId": "A",
"datasource": {
"type": "victoriametrics-logs-datasource",
"uid": "${DS_VICTORIALOGS}"
},
"expr": "log_type:=\"gateway-access\" gateway_name:in($gateway) authority:in($hostname) path:in($path) method:in($method) response_code:in($status) cf_connecting_ip_reported:in($visitor) | copy downstream_remote_address as peer_address | replace_regexp (\":([0-9]+)$\", \"\") at peer_address | replace_regexp (\"^\\\\[(.*)\\\\]$\", \"${1}\") at peer_address | format if (cf_country_reported:in(\"\", \"-\")) \"Unknown\" as cf_country_reported | format if (user_agent:in(\"\", \"-\")) \"Unknown\" as user_agent | format if (upstream_cluster:in(\"\", \"-\")) \"Unknown\" as upstream_cluster | format if (response_code_details:in(\"\", \"-\")) \"Unknown\" as response_code_details | format if (upstream_transport_failure_reason:in(\"\", \"-\")) \"Unknown\" as upstream_transport_failure_reason | filter peer_address:in($peer) cf_country_reported:in($country) user_agent:in($agent) upstream_cluster:in($backend) response_flags:in($flags) request_id:in(${request_id:json}) cf_ray:in(${ray_id:json}) | format \"<response_code>\" as status_class | replace_regexp (\"^([1-5])[0-9][0-9]$\", \"${1}xx\") at status_class | replace (\"0\", \"No HTTP response\") at status_class | stats by (status_class) rate() as requests_per_second",
"queryType": "statsRange",
"editorMode": "code",
"legendFormat": "{{status_class}}",
"maxLines": 1000,
"direction": "desc"
}
],
"interval": "30s",
"options": {
"legend": {
"displayMode": "table",
"placement": "bottom",
"showLegend": true,
"calcs": [
"lastNotNull",
"max"
]
},
"tooltip": {
"mode": "multi",
"sort": "desc"
}
}
},
{
"id": 38,
"title": "HTTP errors by endpoint",
"type": "table",
"datasource": {
"type": "victoriametrics-logs-datasource",
"uid": "${DS_VICTORIALOGS}"
},
"description": "Top 20 endpoint/status combinations returning 4xx or 5xx.",
"gridPos": {
"x": 12,
"y": 45,
"w": 12,
"h": 8
},
"fieldConfig": {
"defaults": {
"unit": "none",
"noValue": "\u2014",
"color": {
"mode": "palette-classic"
}
},
"overrides": [
{
"matcher": {
"id": "byName",
"options": "Hostname"
},
"properties": [
{
"id": "links",
"value": [
{
"title": "Filter Hostname",
"url": "/d/http-traffic/http-traffic?${__url_time_range}&${gateway:queryparam}&${path:queryparam}&${method:queryparam}&${status:queryparam}&${visitor:queryparam}&${peer:queryparam}&${country:queryparam}&${agent:queryparam}&${backend:queryparam}&${flags:queryparam}&${request_id:queryparam}&${ray_id:queryparam}&var-hostname=${__value.raw:percentencode}",
"targetBlank": false
}
]
}
]
},
{
"matcher": {
"id": "byName",
"options": "Path"
},
"properties": [
{
"id": "links",
"value": [
{
"title": "Filter Path",
"url": "/d/http-traffic/http-traffic?${__url_time_range}&${gateway:queryparam}&${hostname:queryparam}&${method:queryparam}&${status:queryparam}&${visitor:queryparam}&${peer:queryparam}&${country:queryparam}&${agent:queryparam}&${backend:queryparam}&${flags:queryparam}&${request_id:queryparam}&${ray_id:queryparam}&var-path=${__value.raw:percentencode}",
"targetBlank": false
}
]
}
]
},
{
"matcher": {
"id": "byName",
"options": "Status"
},
"properties": [
{
"id": "unit",
"value": "none"
},
{
"id": "decimals",
"value": 0
},
{
"id": "mappings",
"value": [
{
"type": "value",
"options": {
"0": {
"text": "No HTTP response"
}
}
}
]
}
]
},
{
"matcher": {
"id": "byName",
"options": "Requests"
},
"properties": [
{
"id": "unit",
"value": "short"
},
{
"id": "decimals",
"value": 0
}
]
}
]
},
"targets": [
{
"refId": "A",
"datasource": {
"type": "victoriametrics-logs-datasource",
"uid": "${DS_VICTORIALOGS}"
},
"expr": "log_type:=\"gateway-access\" gateway_name:in($gateway) authority:in($hostname) path:in($path) method:in($method) response_code:in($status) cf_connecting_ip_reported:in($visitor) | copy downstream_remote_address as peer_address | replace_regexp (\":([0-9]+)$\", \"\") at peer_address | replace_regexp (\"^\\\\[(.*)\\\\]$\", \"${1}\") at peer_address | format if (cf_country_reported:in(\"\", \"-\")) \"Unknown\" as cf_country_reported | format if (user_agent:in(\"\", \"-\")) \"Unknown\" as user_agent | format if (upstream_cluster:in(\"\", \"-\")) \"Unknown\" as upstream_cluster | format if (response_code_details:in(\"\", \"-\")) \"Unknown\" as response_code_details | format if (upstream_transport_failure_reason:in(\"\", \"-\")) \"Unknown\" as upstream_transport_failure_reason | filter peer_address:in($peer) cf_country_reported:in($country) user_agent:in($agent) upstream_cluster:in($backend) response_flags:in($flags) request_id:in(${request_id:json}) cf_ray:in(${ray_id:json}) | filter response_code:>=400 response_code:<600 | stats by (authority, path, response_code) count() as requests | sort by (requests) desc | limit 20",
"queryType": "instant",
"editorMode": "code",
"legendFormat": "{{__name__}}",
"maxLines": 20,
"direction": "desc"
}
],
"options": {
"showHeader": true,
"cellHeight": "sm",
"footer": {
"show": false
},
"sortBy": [
{
"displayName": "Requests",
"desc": true
}
]
},
"transformations": [
{
"id": "extractFields",
"options": {
"source": "labels",
"format": "json",
"replace": true,
"keepTime": false
}
},
{
"id": "convertFieldType",
"options": {
"conversions": [
{
"targetField": "response_code",
"destinationType": "number"
},
{
"targetField": "requests",
"destinationType": "number"
}
],
"fields": {}
}
},
{
"id": "organize",
"options": {
"excludeByName": {},
"includeByName": {
"authority": true,
"path": true,
"response_code": true,
"requests": true
},
"indexByName": {
"authority": 0,
"path": 1,
"response_code": 2,
"requests": 3
},
"renameByName": {
"authority": "Hostname",
"path": "Path",
"response_code": "Status",
"requests": "Requests"
}
}
}
]
},
{
"id": 39,
"title": "Envoy response flags",
"type": "table",
"datasource": {
"type": "victoriametrics-logs-datasource",
"uid": "${DS_VICTORIALOGS}"
},
"description": "Envoy transport/response flags. A dash means no flags; flags are not themselves HTTP status codes.",
"gridPos": {
"x": 0,
"y": 53,
"w": 12,
"h": 8
},
"fieldConfig": {
"defaults": {
"unit": "none",
"noValue": "\u2014",
"color": {
"mode": "palette-classic"
}
},
"overrides": [
{
"matcher": {
"id": "byName",
"options": "Response flags"
},
"properties": [
{
"id": "mappings",
"value": [
{
"type": "value",
"options": {
"-": {
"text": "No flags"
}
}
}
]
}
]
},
{
"matcher": {
"id": "byName",
"options": "Requests"
},
"properties": [
{
"id": "unit",
"value": "short"
},
{
"id": "decimals",
"value": 0
}
]
}
]
},
"targets": [
{
"refId": "A",
"datasource": {
"type": "victoriametrics-logs-datasource",
"uid": "${DS_VICTORIALOGS}"
},
"expr": "log_type:=\"gateway-access\" gateway_name:in($gateway) authority:in($hostname) path:in($path) method:in($method) response_code:in($status) cf_connecting_ip_reported:in($visitor) | copy downstream_remote_address as peer_address | replace_regexp (\":([0-9]+)$\", \"\") at peer_address | replace_regexp (\"^\\\\[(.*)\\\\]$\", \"${1}\") at peer_address | format if (cf_country_reported:in(\"\", \"-\")) \"Unknown\" as cf_country_reported | format if (user_agent:in(\"\", \"-\")) \"Unknown\" as user_agent | format if (upstream_cluster:in(\"\", \"-\")) \"Unknown\" as upstream_cluster | format if (response_code_details:in(\"\", \"-\")) \"Unknown\" as response_code_details | format if (upstream_transport_failure_reason:in(\"\", \"-\")) \"Unknown\" as upstream_transport_failure_reason | filter peer_address:in($peer) cf_country_reported:in($country) user_agent:in($agent) upstream_cluster:in($backend) response_flags:in($flags) request_id:in(${request_id:json}) cf_ray:in(${ray_id:json}) | stats by (response_flags) count() as requests | sort by (requests) desc | limit 20",
"queryType": "instant",
"editorMode": "code",
"legendFormat": "{{__name__}}",
"maxLines": 20,
"direction": "desc"
}
],
"options": {
"showHeader": true,
"cellHeight": "sm",
"footer": {
"show": false
},
"sortBy": [
{
"displayName": "Requests",
"desc": true
}
]
},
"transformations": [
{
"id": "extractFields",
"options": {
"source": "labels",
"format": "json",
"replace": true,
"keepTime": false
}
},
{
"id": "convertFieldType",
"options": {
"conversions": [
{
"targetField": "requests",
"destinationType": "number"
}
],
"fields": {}
}
},
{
"id": "organize",
"options": {
"excludeByName": {},
"includeByName": {
"response_flags": true,
"requests": true
},
"indexByName": {
"response_flags": 0,
"requests": 1
},
"renameByName": {
"response_flags": "Response flags",
"requests": "Requests"
}
}
}
]
},
{
"id": 40,
"title": "Response-code details",
"type": "table",
"datasource": {
"type": "victoriametrics-logs-datasource",
"uid": "${DS_VICTORIALOGS}"
},
"description": "Envoy explanations of response origin and outcome. Unknown covers old records and absent details.",
"gridPos": {
"x": 12,
"y": 53,
"w": 12,
"h": 8
},
"fieldConfig": {
"defaults": {
"unit": "none",
"noValue": "\u2014",
"color": {
"mode": "palette-classic"
}
},
"overrides": [
{
"matcher": {
"id": "byName",
"options": "Status"
},
"properties": [
{
"id": "unit",
"value": "none"
},
{
"id": "decimals",
"value": 0
},
{
"id": "mappings",
"value": [
{
"type": "value",
"options": {
"0": {
"text": "No HTTP response"
}
}
}
]
}
]
},
{
"matcher": {
"id": "byName",
"options": "Requests"
},
"properties": [
{
"id": "unit",
"value": "short"
},
{
"id": "decimals",
"value": 0
}
]
}
]
},
"targets": [
{
"refId": "A",
"datasource": {
"type": "victoriametrics-logs-datasource",
"uid": "${DS_VICTORIALOGS}"
},
"expr": "log_type:=\"gateway-access\" gateway_name:in($gateway) authority:in($hostname) path:in($path) method:in($method) response_code:in($status) cf_connecting_ip_reported:in($visitor) | copy downstream_remote_address as peer_address | replace_regexp (\":([0-9]+)$\", \"\") at peer_address | replace_regexp (\"^\\\\[(.*)\\\\]$\", \"${1}\") at peer_address | format if (cf_country_reported:in(\"\", \"-\")) \"Unknown\" as cf_country_reported | format if (user_agent:in(\"\", \"-\")) \"Unknown\" as user_agent | format if (upstream_cluster:in(\"\", \"-\")) \"Unknown\" as upstream_cluster | format if (response_code_details:in(\"\", \"-\")) \"Unknown\" as response_code_details | format if (upstream_transport_failure_reason:in(\"\", \"-\")) \"Unknown\" as upstream_transport_failure_reason | filter peer_address:in($peer) cf_country_reported:in($country) user_agent:in($agent) upstream_cluster:in($backend) response_flags:in($flags) request_id:in(${request_id:json}) cf_ray:in(${ray_id:json}) | stats by (response_code_details, response_code) count() as requests | sort by (requests) desc | limit 20",
"queryType": "instant",
"editorMode": "code",
"legendFormat": "{{__name__}}",
"maxLines": 20,
"direction": "desc"
}
],
"options": {
"showHeader": true,
"cellHeight": "sm",
"footer": {
"show": false
},
"sortBy": [
{
"displayName": "Requests",
"desc": true
}
]
},
"transformations": [
{
"id": "extractFields",
"options": {
"source": "labels",
"format": "json",
"replace": true,
"keepTime": false
}
},
{
"id": "convertFieldType",
"options": {
"conversions": [
{
"targetField": "response_code",
"destinationType": "number"
},
{
"targetField": "requests",
"destinationType": "number"
}
],
"fields": {}
}
},
{
"id": "organize",
"options": {
"excludeByName": {},
"includeByName": {
"response_code_details": true,
"response_code": true,
"requests": true
},
"indexByName": {
"response_code_details": 0,
"response_code": 1,
"requests": 2
},
"renameByName": {
"response_code_details": "Response details",
"response_code": "Status",
"requests": "Requests"
}
}
}
]
},
{
"id": 41,
"title": "Upstream transport failures",
"type": "table",
"datasource": {
"type": "victoriametrics-logs-datasource",
"uid": "${DS_VICTORIALOGS}"
},
"description": "Explicit upstream transport failures. Missing fields are excluded rather than counted as failures.",
"gridPos": {
"x": 0,
"y": 61,
"w": 12,
"h": 8
},
"fieldConfig": {
"defaults": {
"unit": "none",
"noValue": "\u2014",
"color": {
"mode": "palette-classic"
}
},
"overrides": [
{
"matcher": {
"id": "byName",
"options": "Backend"
},
"properties": []
},
{
"matcher": {
"id": "byName",
"options": "Requests"
},
"properties": [
{
"id": "unit",
"value": "short"
},
{
"id": "decimals",
"value": 0
}
]
}
]
},
"targets": [
{
"refId": "A",
"datasource": {
"type": "victoriametrics-logs-datasource",
"uid": "${DS_VICTORIALOGS}"
},
"expr": "log_type:=\"gateway-access\" gateway_name:in($gateway) authority:in($hostname) path:in($path) method:in($method) response_code:in($status) cf_connecting_ip_reported:in($visitor) | copy downstream_remote_address as peer_address | replace_regexp (\":([0-9]+)$\", \"\") at peer_address | replace_regexp (\"^\\\\[(.*)\\\\]$\", \"${1}\") at peer_address | format if (cf_country_reported:in(\"\", \"-\")) \"Unknown\" as cf_country_reported | format if (user_agent:in(\"\", \"-\")) \"Unknown\" as user_agent | format if (upstream_cluster:in(\"\", \"-\")) \"Unknown\" as upstream_cluster | format if (response_code_details:in(\"\", \"-\")) \"Unknown\" as response_code_details | format if (upstream_transport_failure_reason:in(\"\", \"-\")) \"Unknown\" as upstream_transport_failure_reason | filter peer_address:in($peer) cf_country_reported:in($country) user_agent:in($agent) upstream_cluster:in($backend) response_flags:in($flags) request_id:in(${request_id:json}) cf_ray:in(${ray_id:json}) | filter upstream_transport_failure_reason:!=\"Unknown\" | stats by (upstream_cluster, upstream_transport_failure_reason) count() as requests | sort by (requests) desc | limit 20",
"queryType": "instant",
"editorMode": "code",
"legendFormat": "{{__name__}}",
"maxLines": 20,
"direction": "desc"
}
],
"options": {
"showHeader": true,
"cellHeight": "sm",
"footer": {
"show": false
},
"sortBy": [
{
"displayName": "Requests",
"desc": true
}
]
},
"transformations": [
{
"id": "extractFields",
"options": {
"source": "labels",
"format": "json",
"replace": true,
"keepTime": false
}
},
{
"id": "convertFieldType",
"options": {
"conversions": [
{
"targetField": "requests",
"destinationType": "number"
}
],
"fields": {}
}
},
{
"id": "organize",
"options": {
"excludeByName": {},
"includeByName": {
"upstream_cluster": true,
"upstream_transport_failure_reason": true,
"requests": true
},
"indexByName": {
"upstream_cluster": 0,
"upstream_transport_failure_reason": 1,
"requests": 2
},
"renameByName": {
"upstream_cluster": "Backend",
"upstream_transport_failure_reason": "Transport failure",
"requests": "Requests"
}
}
}
]
}
]
},
{
"id": 42,
"type": "row",
"title": "Request inspection",
"collapsed": true,
"gridPos": {
"x": 0,
"y": 45,
"w": 24,
"h": 1
},
"panels": [
{
"id": 43,
"title": "Recent requests",
"type": "table",
"datasource": {
"type": "victoriametrics-logs-datasource",
"uid": "${DS_VICTORIALOGS}"
},
"description": "Latest 200 matching records. Time is access-log emission/collection time; logs normally arrive after completion. Reported headers are distinct from network peers.",
"gridPos": {
"x": 0,
"y": 46,
"w": 24,
"h": 8
},
"fieldConfig": {
"defaults": {
"unit": "none",
"noValue": "\u2014",
"color": {
"mode": "palette-classic"
}
},
"overrides": [
{
"matcher": {
"id": "byName",
"options": "Gateway"
},
"properties": []
},
{
"matcher": {
"id": "byName",
"options": "Hostname"
},
"properties": [
{
"id": "links",
"value": [
{
"title": "Filter Hostname",
"url": "/d/http-traffic/http-traffic?${__url_time_range}&${gateway:queryparam}&${path:queryparam}&${method:queryparam}&${status:queryparam}&${visitor:queryparam}&${peer:queryparam}&${country:queryparam}&${agent:queryparam}&${backend:queryparam}&${flags:queryparam}&${request_id:queryparam}&${ray_id:queryparam}&var-hostname=${__value.raw:percentencode}",
"targetBlank": false
}
]
}
]
},
{
"matcher": {
"id": "byName",
"options": "Method"
},
"properties": []
},
{
"matcher": {
"id": "byName",
"options": "Path"
},
"properties": [
{
"id": "links",
"value": [
{
"title": "Filter Path",
"url": "/d/http-traffic/http-traffic?${__url_time_range}&${gateway:queryparam}&${hostname:queryparam}&${method:queryparam}&${status:queryparam}&${visitor:queryparam}&${peer:queryparam}&${country:queryparam}&${agent:queryparam}&${backend:queryparam}&${flags:queryparam}&${request_id:queryparam}&${ray_id:queryparam}&var-path=${__value.raw:percentencode}",
"targetBlank": false
}
]
}
]
},
{
"matcher": {
"id": "byName",
"options": "Status"
},
"properties": [
{
"id": "unit",
"value": "none"
},
{
"id": "decimals",
"value": 0
},
{
"id": "mappings",
"value": [
{
"type": "value",
"options": {
"0": {
"text": "No HTTP response"
}
}
}
]
}
]
},
{
"matcher": {
"id": "byName",
"options": "Duration"
},
"properties": [
{
"id": "unit",
"value": "ms"
},
{
"id": "decimals",
"value": 0
}
]
},
{
"matcher": {
"id": "byName",
"options": "Reported visitor IP"
},
"properties": [
{
"id": "links",
"value": [
{
"title": "Filter Reported visitor IP",
"url": "/d/http-traffic/http-traffic?${__url_time_range}&${gateway:queryparam}&${hostname:queryparam}&${path:queryparam}&${method:queryparam}&${status:queryparam}&${peer:queryparam}&${country:queryparam}&${agent:queryparam}&${backend:queryparam}&${flags:queryparam}&${request_id:queryparam}&${ray_id:queryparam}&var-visitor=${__value.raw:percentencode}",
"targetBlank": false
}
]
}
]
},
{
"matcher": {
"id": "byName",
"options": "Network peer IP"
},
"properties": [
{
"id": "links",
"value": [
{
"title": "Filter Network peer IP",
"url": "/d/http-traffic/http-traffic?${__url_time_range}&${gateway:queryparam}&${hostname:queryparam}&${path:queryparam}&${method:queryparam}&${status:queryparam}&${visitor:queryparam}&${country:queryparam}&${agent:queryparam}&${backend:queryparam}&${flags:queryparam}&${request_id:queryparam}&${ray_id:queryparam}&var-peer=${__value.raw:percentencode}",
"targetBlank": false
}
]
}
]
},
{
"matcher": {
"id": "byName",
"options": "Reported country"
},
"properties": []
},
{
"matcher": {
"id": "byName",
"options": "User agent"
},
"properties": []
},
{
"matcher": {
"id": "byName",
"options": "Backend"
},
"properties": []
},
{
"matcher": {
"id": "byName",
"options": "Response flags"
},
"properties": [
{
"id": "mappings",
"value": [
{
"type": "value",
"options": {
"-": {
"text": "No flags"
}
}
}
]
}
]
}
]
},
"targets": [
{
"refId": "A",
"datasource": {
"type": "victoriametrics-logs-datasource",
"uid": "${DS_VICTORIALOGS}"
},
"expr": "log_type:=\"gateway-access\" gateway_name:in($gateway) authority:in($hostname) path:in($path) method:in($method) response_code:in($status) cf_connecting_ip_reported:in($visitor) | copy downstream_remote_address as peer_address | replace_regexp (\":([0-9]+)$\", \"\") at peer_address | replace_regexp (\"^\\\\[(.*)\\\\]$\", \"${1}\") at peer_address | format if (cf_country_reported:in(\"\", \"-\")) \"Unknown\" as cf_country_reported | format if (user_agent:in(\"\", \"-\")) \"Unknown\" as user_agent | format if (upstream_cluster:in(\"\", \"-\")) \"Unknown\" as upstream_cluster | format if (response_code_details:in(\"\", \"-\")) \"Unknown\" as response_code_details | format if (upstream_transport_failure_reason:in(\"\", \"-\")) \"Unknown\" as upstream_transport_failure_reason | filter peer_address:in($peer) cf_country_reported:in($country) user_agent:in($agent) upstream_cluster:in($backend) response_flags:in($flags) request_id:in(${request_id:json}) cf_ray:in(${ray_id:json}) | sort by (_time) desc | limit 200 | fields _time, gateway_name, authority, method, path, response_code, duration_ms, cf_connecting_ip_reported, peer_address, downstream_remote_address, cf_country_reported, user_agent, upstream_cluster, upstream_host, response_flags, response_code_details, upstream_transport_failure_reason, request_id, cf_ray",
"queryType": "instant",
"editorMode": "code",
"legendFormat": "{{__name__}}",
"maxLines": 200,
"direction": "desc"
}
],
"options": {
"showHeader": true,
"cellHeight": "sm",
"footer": {
"show": false
},
"sortBy": [
{
"displayName": "Time",
"desc": true
}
]
},
"transformations": [
{
"id": "extractFields",
"options": {
"source": "labels",
"format": "json",
"replace": true,
"keepTime": true
}
},
{
"id": "convertFieldType",
"options": {
"conversions": [
{
"targetField": "response_code",
"destinationType": "number"
},
{
"targetField": "duration_ms",
"destinationType": "number"
}
],
"fields": {}
}
},
{
"id": "organize",
"options": {
"excludeByName": {},
"includeByName": {
"Time": true,
"gateway_name": true,
"authority": true,
"method": true,
"path": true,
"response_code": true,
"duration_ms": true,
"cf_connecting_ip_reported": true,
"peer_address": true,
"downstream_remote_address": true,
"cf_country_reported": true,
"user_agent": true,
"upstream_cluster": true,
"upstream_host": true,
"response_flags": true,
"response_code_details": true,
"upstream_transport_failure_reason": true,
"request_id": true,
"cf_ray": true
},
"indexByName": {
"Time": 0,
"gateway_name": 1,
"authority": 2,
"method": 3,
"path": 4,
"response_code": 5,
"duration_ms": 6,
"cf_connecting_ip_reported": 7,
"peer_address": 8,
"downstream_remote_address": 9,
"cf_country_reported": 10,
"user_agent": 11,
"upstream_cluster": 12,
"upstream_host": 13,
"response_flags": 14,
"response_code_details": 15,
"upstream_transport_failure_reason": 16,
"request_id": 17,
"cf_ray": 18
},
"renameByName": {
"Time": "Time",
"gateway_name": "Gateway",
"authority": "Hostname",
"method": "Method",
"path": "Path",
"response_code": "Status",
"duration_ms": "Duration",
"cf_connecting_ip_reported": "Reported visitor IP",
"peer_address": "Network peer IP",
"downstream_remote_address": "Network peer (with port)",
"cf_country_reported": "Reported country",
"user_agent": "User agent",
"upstream_cluster": "Backend",
"upstream_host": "Upstream address",
"response_flags": "Response flags",
"response_code_details": "Response details",
"upstream_transport_failure_reason": "Transport failure",
"request_id": "Request ID",
"cf_ray": "Cloudflare Ray ID"
}
}
}
]
},
{
"id": 44,
"title": "Recent HTTP errors and incomplete responses",
"type": "table",
"datasource": {
"type": "victoriametrics-logs-datasource",
"uid": "${DS_VICTORIALOGS}"
},
"description": "Latest 200 matching 4xx/5xx records or requests with code 0. Use request/Ray ID lookup controls for correlation.",
"gridPos": {
"x": 0,
"y": 54,
"w": 24,
"h": 8
},
"fieldConfig": {
"defaults": {
"unit": "none",
"noValue": "\u2014",
"color": {
"mode": "palette-classic"
}
},
"overrides": [
{
"matcher": {
"id": "byName",
"options": "Gateway"
},
"properties": []
},
{
"matcher": {
"id": "byName",
"options": "Hostname"
},
"properties": [
{
"id": "links",
"value": [
{
"title": "Filter Hostname",
"url": "/d/http-traffic/http-traffic?${__url_time_range}&${gateway:queryparam}&${path:queryparam}&${method:queryparam}&${status:queryparam}&${visitor:queryparam}&${peer:queryparam}&${country:queryparam}&${agent:queryparam}&${backend:queryparam}&${flags:queryparam}&${request_id:queryparam}&${ray_id:queryparam}&var-hostname=${__value.raw:percentencode}",
"targetBlank": false
}
]
}
]
},
{
"matcher": {
"id": "byName",
"options": "Method"
},
"properties": []
},
{
"matcher": {
"id": "byName",
"options": "Path"
},
"properties": [
{
"id": "links",
"value": [
{
"title": "Filter Path",
"url": "/d/http-traffic/http-traffic?${__url_time_range}&${gateway:queryparam}&${hostname:queryparam}&${method:queryparam}&${status:queryparam}&${visitor:queryparam}&${peer:queryparam}&${country:queryparam}&${agent:queryparam}&${backend:queryparam}&${flags:queryparam}&${request_id:queryparam}&${ray_id:queryparam}&var-path=${__value.raw:percentencode}",
"targetBlank": false
}
]
}
]
},
{
"matcher": {
"id": "byName",
"options": "Status"
},
"properties": [
{
"id": "unit",
"value": "none"
},
{
"id": "decimals",
"value": 0
},
{
"id": "mappings",
"value": [
{
"type": "value",
"options": {
"0": {
"text": "No HTTP response"
}
}
}
]
}
]
},
{
"matcher": {
"id": "byName",
"options": "Duration"
},
"properties": [
{
"id": "unit",
"value": "ms"
},
{
"id": "decimals",
"value": 0
}
]
},
{
"matcher": {
"id": "byName",
"options": "Reported visitor IP"
},
"properties": [
{
"id": "links",
"value": [
{
"title": "Filter Reported visitor IP",
"url": "/d/http-traffic/http-traffic?${__url_time_range}&${gateway:queryparam}&${hostname:queryparam}&${path:queryparam}&${method:queryparam}&${status:queryparam}&${peer:queryparam}&${country:queryparam}&${agent:queryparam}&${backend:queryparam}&${flags:queryparam}&${request_id:queryparam}&${ray_id:queryparam}&var-visitor=${__value.raw:percentencode}",
"targetBlank": false
}
]
}
]
},
{
"matcher": {
"id": "byName",
"options": "Network peer IP"
},
"properties": [
{
"id": "links",
"value": [
{
"title": "Filter Network peer IP",
"url": "/d/http-traffic/http-traffic?${__url_time_range}&${gateway:queryparam}&${hostname:queryparam}&${path:queryparam}&${method:queryparam}&${status:queryparam}&${visitor:queryparam}&${country:queryparam}&${agent:queryparam}&${backend:queryparam}&${flags:queryparam}&${request_id:queryparam}&${ray_id:queryparam}&var-peer=${__value.raw:percentencode}",
"targetBlank": false
}
]
}
]
},
{
"matcher": {
"id": "byName",
"options": "Reported country"
},
"properties": []
},
{
"matcher": {
"id": "byName",
"options": "User agent"
},
"properties": []
},
{
"matcher": {
"id": "byName",
"options": "Backend"
},
"properties": []
},
{
"matcher": {
"id": "byName",
"options": "Response flags"
},
"properties": [
{
"id": "mappings",
"value": [
{
"type": "value",
"options": {
"-": {
"text": "No flags"
}
}
}
]
}
]
}
]
},
"targets": [
{
"refId": "A",
"datasource": {
"type": "victoriametrics-logs-datasource",
"uid": "${DS_VICTORIALOGS}"
},
"expr": "log_type:=\"gateway-access\" gateway_name:in($gateway) authority:in($hostname) path:in($path) method:in($method) response_code:in($status) cf_connecting_ip_reported:in($visitor) | copy downstream_remote_address as peer_address | replace_regexp (\":([0-9]+)$\", \"\") at peer_address | replace_regexp (\"^\\\\[(.*)\\\\]$\", \"${1}\") at peer_address | format if (cf_country_reported:in(\"\", \"-\")) \"Unknown\" as cf_country_reported | format if (user_agent:in(\"\", \"-\")) \"Unknown\" as user_agent | format if (upstream_cluster:in(\"\", \"-\")) \"Unknown\" as upstream_cluster | format if (response_code_details:in(\"\", \"-\")) \"Unknown\" as response_code_details | format if (upstream_transport_failure_reason:in(\"\", \"-\")) \"Unknown\" as upstream_transport_failure_reason | filter peer_address:in($peer) cf_country_reported:in($country) user_agent:in($agent) upstream_cluster:in($backend) response_flags:in($flags) request_id:in(${request_id:json}) cf_ray:in(${ray_id:json}) | filter (response_code:>=400 response_code:<600 OR response_code:=0) | sort by (_time) desc | limit 200 | fields _time, gateway_name, authority, method, path, response_code, duration_ms, cf_connecting_ip_reported, peer_address, downstream_remote_address, cf_country_reported, user_agent, upstream_cluster, upstream_host, response_flags, response_code_details, upstream_transport_failure_reason, request_id, cf_ray",
"queryType": "instant",
"editorMode": "code",
"legendFormat": "{{__name__}}",
"maxLines": 200,
"direction": "desc"
}
],
"options": {
"showHeader": true,
"cellHeight": "sm",
"footer": {
"show": false
},
"sortBy": [
{
"displayName": "Time",
"desc": true
}
]
},
"transformations": [
{
"id": "extractFields",
"options": {
"source": "labels",
"format": "json",
"replace": true,
"keepTime": true
}
},
{
"id": "convertFieldType",
"options": {
"conversions": [
{
"targetField": "response_code",
"destinationType": "number"
},
{
"targetField": "duration_ms",
"destinationType": "number"
}
],
"fields": {}
}
},
{
"id": "organize",
"options": {
"excludeByName": {},
"includeByName": {
"Time": true,
"gateway_name": true,
"authority": true,
"method": true,
"path": true,
"response_code": true,
"duration_ms": true,
"cf_connecting_ip_reported": true,
"peer_address": true,
"downstream_remote_address": true,
"cf_country_reported": true,
"user_agent": true,
"upstream_cluster": true,
"upstream_host": true,
"response_flags": true,
"response_code_details": true,
"upstream_transport_failure_reason": true,
"request_id": true,
"cf_ray": true
},
"indexByName": {
"Time": 0,
"gateway_name": 1,
"authority": 2,
"method": 3,
"path": 4,
"response_code": 5,
"duration_ms": 6,
"cf_connecting_ip_reported": 7,
"peer_address": 8,
"downstream_remote_address": 9,
"cf_country_reported": 10,
"user_agent": 11,
"upstream_cluster": 12,
"upstream_host": 13,
"response_flags": 14,
"response_code_details": 15,
"upstream_transport_failure_reason": 16,
"request_id": 17,
"cf_ray": 18
},
"renameByName": {
"Time": "Time",
"gateway_name": "Gateway",
"authority": "Hostname",
"method": "Method",
"path": "Path",
"response_code": "Status",
"duration_ms": "Duration",
"cf_connecting_ip_reported": "Reported visitor IP",
"peer_address": "Network peer IP",
"downstream_remote_address": "Network peer (with port)",
"cf_country_reported": "Reported country",
"user_agent": "User agent",
"upstream_cluster": "Backend",
"upstream_host": "Upstream address",
"response_flags": "Response flags",
"response_code_details": "Response details",
"upstream_transport_failure_reason": "Transport failure",
"request_id": "Request ID",
"cf_ray": "Cloudflare Ray ID"
}
}
}
]
},
{
"id": 45,
"title": "Largest responses",
"type": "table",
"datasource": {
"type": "victoriametrics-logs-datasource",
"uid": "${DS_VICTORIALOGS}"
},
"description": "Largest 200 responses by logged body bytes.",
"gridPos": {
"x": 0,
"y": 62,
"w": 24,
"h": 8
},
"fieldConfig": {
"defaults": {
"unit": "none",
"noValue": "\u2014",
"color": {
"mode": "palette-classic"
}
},
"overrides": [
{
"matcher": {
"id": "byName",
"options": "Hostname"
},
"properties": [
{
"id": "links",
"value": [
{
"title": "Filter Hostname",
"url": "/d/http-traffic/http-traffic?${__url_time_range}&${gateway:queryparam}&${path:queryparam}&${method:queryparam}&${status:queryparam}&${visitor:queryparam}&${peer:queryparam}&${country:queryparam}&${agent:queryparam}&${backend:queryparam}&${flags:queryparam}&${request_id:queryparam}&${ray_id:queryparam}&var-hostname=${__value.raw:percentencode}",
"targetBlank": false
}
]
}
]
},
{
"matcher": {
"id": "byName",
"options": "Method"
},
"properties": []
},
{
"matcher": {
"id": "byName",
"options": "Path"
},
"properties": [
{
"id": "links",
"value": [
{
"title": "Filter Path",
"url": "/d/http-traffic/http-traffic?${__url_time_range}&${gateway:queryparam}&${hostname:queryparam}&${method:queryparam}&${status:queryparam}&${visitor:queryparam}&${peer:queryparam}&${country:queryparam}&${agent:queryparam}&${backend:queryparam}&${flags:queryparam}&${request_id:queryparam}&${ray_id:queryparam}&var-path=${__value.raw:percentencode}",
"targetBlank": false
}
]
}
]
},
{
"matcher": {
"id": "byName",
"options": "Status"
},
"properties": [
{
"id": "unit",
"value": "none"
},
{
"id": "decimals",
"value": 0
},
{
"id": "mappings",
"value": [
{
"type": "value",
"options": {
"0": {
"text": "No HTTP response"
}
}
}
]
}
]
},
{
"matcher": {
"id": "byName",
"options": "Response body bytes"
},
"properties": [
{
"id": "unit",
"value": "bytes"
},
{
"id": "decimals",
"value": 0
}
]
},
{
"matcher": {
"id": "byName",
"options": "Request body bytes"
},
"properties": [
{
"id": "unit",
"value": "bytes"
},
{
"id": "decimals",
"value": 0
}
]
},
{
"matcher": {
"id": "byName",
"options": "Duration"
},
"properties": [
{
"id": "unit",
"value": "ms"
},
{
"id": "decimals",
"value": 0
}
]
},
{
"matcher": {
"id": "byName",
"options": "Reported visitor IP"
},
"properties": [
{
"id": "links",
"value": [
{
"title": "Filter Reported visitor IP",
"url": "/d/http-traffic/http-traffic?${__url_time_range}&${gateway:queryparam}&${hostname:queryparam}&${path:queryparam}&${method:queryparam}&${status:queryparam}&${peer:queryparam}&${country:queryparam}&${agent:queryparam}&${backend:queryparam}&${flags:queryparam}&${request_id:queryparam}&${ray_id:queryparam}&var-visitor=${__value.raw:percentencode}",
"targetBlank": false
}
]
}
]
},
{
"matcher": {
"id": "byName",
"options": "Network peer IP"
},
"properties": [
{
"id": "links",
"value": [
{
"title": "Filter Network peer IP",
"url": "/d/http-traffic/http-traffic?${__url_time_range}&${gateway:queryparam}&${hostname:queryparam}&${path:queryparam}&${method:queryparam}&${status:queryparam}&${visitor:queryparam}&${country:queryparam}&${agent:queryparam}&${backend:queryparam}&${flags:queryparam}&${request_id:queryparam}&${ray_id:queryparam}&var-peer=${__value.raw:percentencode}",
"targetBlank": false
}
]
}
]
}
]
},
"targets": [
{
"refId": "A",
"datasource": {
"type": "victoriametrics-logs-datasource",
"uid": "${DS_VICTORIALOGS}"
},
"expr": "log_type:=\"gateway-access\" gateway_name:in($gateway) authority:in($hostname) path:in($path) method:in($method) response_code:in($status) cf_connecting_ip_reported:in($visitor) | copy downstream_remote_address as peer_address | replace_regexp (\":([0-9]+)$\", \"\") at peer_address | replace_regexp (\"^\\\\[(.*)\\\\]$\", \"${1}\") at peer_address | format if (cf_country_reported:in(\"\", \"-\")) \"Unknown\" as cf_country_reported | format if (user_agent:in(\"\", \"-\")) \"Unknown\" as user_agent | format if (upstream_cluster:in(\"\", \"-\")) \"Unknown\" as upstream_cluster | format if (response_code_details:in(\"\", \"-\")) \"Unknown\" as response_code_details | format if (upstream_transport_failure_reason:in(\"\", \"-\")) \"Unknown\" as upstream_transport_failure_reason | filter peer_address:in($peer) cf_country_reported:in($country) user_agent:in($agent) upstream_cluster:in($backend) response_flags:in($flags) request_id:in(${request_id:json}) cf_ray:in(${ray_id:json}) | sort by (bytes_sent) desc | limit 200 | fields _time, authority, method, path, response_code, bytes_sent, bytes_received, duration_ms, cf_connecting_ip_reported, peer_address, request_id",
"queryType": "instant",
"editorMode": "code",
"legendFormat": "{{__name__}}",
"maxLines": 200,
"direction": "desc"
}
],
"options": {
"showHeader": true,
"cellHeight": "sm",
"footer": {
"show": false
},
"sortBy": [
{
"displayName": "Response body bytes",
"desc": true
}
]
},
"transformations": [
{
"id": "extractFields",
"options": {
"source": "labels",
"format": "json",
"replace": true,
"keepTime": true
}
},
{
"id": "convertFieldType",
"options": {
"conversions": [
{
"targetField": "response_code",
"destinationType": "number"
},
{
"targetField": "bytes_sent",
"destinationType": "number"
},
{
"targetField": "bytes_received",
"destinationType": "number"
},
{
"targetField": "duration_ms",
"destinationType": "number"
}
],
"fields": {}
}
},
{
"id": "organize",
"options": {
"excludeByName": {},
"includeByName": {
"Time": true,
"authority": true,
"method": true,
"path": true,
"response_code": true,
"bytes_sent": true,
"bytes_received": true,
"duration_ms": true,
"cf_connecting_ip_reported": true,
"peer_address": true,
"request_id": true
},
"indexByName": {
"Time": 0,
"authority": 1,
"method": 2,
"path": 3,
"response_code": 4,
"bytes_sent": 5,
"bytes_received": 6,
"duration_ms": 7,
"cf_connecting_ip_reported": 8,
"peer_address": 9,
"request_id": 10
},
"renameByName": {
"Time": "Time",
"authority": "Hostname",
"method": "Method",
"path": "Path",
"response_code": "Status",
"bytes_sent": "Response body bytes",
"bytes_received": "Request body bytes",
"duration_ms": "Duration",
"cf_connecting_ip_reported": "Reported visitor IP",
"peer_address": "Network peer IP",
"request_id": "Request ID"
}
}
}
]
},
{
"id": 46,
"title": "Public request metadata coverage",
"type": "table",
"datasource": {
"type": "victoriametrics-logs-datasource",
"uid": "${DS_VICTORIALOGS}"
},
"description": "Presence of metadata on filtered public requests. Zero public requests yields 0%. New metadata only exists after logging deployment; country needs Cloudflare visitor-location headers. XX/T1 count as present headers.",
"gridPos": {
"x": 0,
"y": 70,
"w": 24,
"h": 8
},
"fieldConfig": {
"defaults": {
"unit": "none",
"noValue": "\u2014",
"color": {
"mode": "palette-classic"
}
},
"overrides": [
{
"matcher": {
"id": "byName",
"options": "Public requests"
},
"properties": [
{
"id": "unit",
"value": "short"
},
{
"id": "decimals",
"value": 0
}
]
},
{
"matcher": {
"id": "byName",
"options": "IP coverage"
},
"properties": [
{
"id": "unit",
"value": "percent"
},
{
"id": "decimals",
"value": 1
}
]
},
{
"matcher": {
"id": "byName",
"options": "Country coverage"
},
"properties": [
{
"id": "unit",
"value": "percent"
},
{
"id": "decimals",
"value": 1
}
]
},
{
"matcher": {
"id": "byName",
"options": "User-agent coverage"
},
"properties": [
{
"id": "unit",
"value": "percent"
},
{
"id": "decimals",
"value": 1
}
]
},
{
"matcher": {
"id": "byName",
"options": "Ray ID coverage"
},
"properties": [
{
"id": "unit",
"value": "percent"
},
{
"id": "decimals",
"value": 1
}
]
}
]
},
"targets": [
{
"refId": "A",
"datasource": {
"type": "victoriametrics-logs-datasource",
"uid": "${DS_VICTORIALOGS}"
},
"expr": "log_type:=\"gateway-access\" gateway_name:in($gateway) authority:in($hostname) path:in($path) method:in($method) response_code:in($status) cf_connecting_ip_reported:in($visitor) | copy downstream_remote_address as peer_address | replace_regexp (\":([0-9]+)$\", \"\") at peer_address | replace_regexp (\"^\\\\[(.*)\\\\]$\", \"${1}\") at peer_address | format if (cf_country_reported:in(\"\", \"-\")) \"Unknown\" as cf_country_reported | format if (user_agent:in(\"\", \"-\")) \"Unknown\" as user_agent | format if (upstream_cluster:in(\"\", \"-\")) \"Unknown\" as upstream_cluster | format if (response_code_details:in(\"\", \"-\")) \"Unknown\" as response_code_details | format if (upstream_transport_failure_reason:in(\"\", \"-\")) \"Unknown\" as upstream_transport_failure_reason | filter peer_address:in($peer) cf_country_reported:in($country) user_agent:in($agent) upstream_cluster:in($backend) response_flags:in($flags) request_id:in(${request_id:json}) cf_ray:in(${ray_id:json}) | filter gateway_name:=\"cloudflare-gateway\" | stats count() as public_requests, count() if (cf_connecting_ip_reported:!=\"\" cf_connecting_ip_reported:!=\"-\") as with_ip, count() if (cf_country_reported:!=\"Unknown\") as with_country, count() if (user_agent:!=\"Unknown\") as with_agent, count() if (cf_ray:!=\"\" cf_ray:!=\"-\") as with_ray | math 100 * with_ip / max(public_requests, 1) as ip_percent, 100 * with_country / max(public_requests, 1) as country_percent, 100 * with_agent / max(public_requests, 1) as agent_percent, 100 * with_ray / max(public_requests, 1) as ray_percent | fields public_requests, ip_percent, country_percent, agent_percent, ray_percent",
"queryType": "instant",
"editorMode": "code",
"legendFormat": "{{__name__}}",
"maxLines": 20,
"direction": "desc"
}
],
"options": {
"showHeader": true,
"cellHeight": "sm",
"footer": {
"show": false
},
"sortBy": [
{
"displayName": "Public requests",
"desc": true
}
]
},
"transformations": [
{
"id": "extractFields",
"options": {
"source": "labels",
"format": "json",
"replace": true,
"keepTime": false
}
},
{
"id": "convertFieldType",
"options": {
"conversions": [
{
"targetField": "public_requests",
"destinationType": "number"
},
{
"targetField": "ip_percent",
"destinationType": "number"
},
{
"targetField": "country_percent",
"destinationType": "number"
},
{
"targetField": "agent_percent",
"destinationType": "number"
},
{
"targetField": "ray_percent",
"destinationType": "number"
}
],
"fields": {}
}
},
{
"id": "organize",
"options": {
"excludeByName": {},
"includeByName": {
"public_requests": true,
"ip_percent": true,
"country_percent": true,
"agent_percent": true,
"ray_percent": true
},
"indexByName": {
"public_requests": 0,
"ip_percent": 1,
"country_percent": 2,
"agent_percent": 3,
"ray_percent": 4
},
"renameByName": {
"public_requests": "Public requests",
"ip_percent": "IP coverage",
"country_percent": "Country coverage",
"agent_percent": "User-agent coverage",
"ray_percent": "Ray ID coverage"
}
}
}
]
}
]
}
]
}