CSE Dashboard Templates

Prerequisites

• CSE logs have been collected to LTS.
• Logs have been structured. For details, see Setting Cloud Structuring Parsing.

Viewing CSE Layer Access Center

1. Log in to the LTS console. In the navigation pane, choose Dashboards.
2. Choose CSE dashboard templates under Dashboard Templates and click CSE Layer Access Center to view the chart details.
   • upstream_host allows you to filter upstream IP addresses. The associated query and analysis statement is:

     select distinct(upstream_host)
   • trace_id allows you to filter traces. The associated query and analysis statement is:

     select distinct(trace_id)
   • Day-over-day PV Change. The associated query and analysis statement is:

     select diff[1] as "total", round((diff[1] - diff[2]) / diff[2] * 100, 2) as inc from(select compare( "pv" , 86400) as diff from (select count(1) as "pv" from log))
   • Week-on-week PV Change. The associated query and analysis statement is:

     select diff[1] as "total", round((diff[1] - diff[2]) / diff[2] * 100, 2) as inc from(select compare( "pv" , 604800) as diff from (select count(1) as "pv" from log))
   • Day-over-day UV Change. The associated query and analysis statement is:

     select diff[1] as "total", round((diff[1] - diff[2]) / diff[2] * 100, 2) as inc from(select compare( "uv" , 86400) as diff from (select APPROX_COUNT_DISTINCT(authority) as "uv" from log))
   • Week-on-week UV Change. The associated query and analysis statement is:

     select diff[1] as "total", round((diff[1] - diff[2]) / diff[2] * 100, 2) as inc from(select compare( "uv" , 604800) as diff from (select APPROX_COUNT_DISTINCT(authority) as "uv" from log))
   • PV Distribution (China). The associated query and analysis statement is:

     select ip_to_province(authority) as province, sum(ori_pv) as pv from (select authority, count(1) as ori_pv   group by authority   ORDER BY ori_pv desc  LIMIT 10000)  where IP_TO_COUNTRY (authority) = 'China'  group by province HAVING province not in ('','Reserved address','*')
   • PV Distribution (Global). The associated query and analysis statement is:

     SELECT ip_to_country(authority) as country,sum(ori_pv) as PV from (select authority, count(1) as ori_pv  group by authority   ORDER BY ori_pv desc  LIMIT 10000) GROUP BY country HAVING country not in ('','Reserved address','*')
   • Average Latency Distribution (China). The associated query and analysis statement is:

     SELECT province,round( CASE WHEN "Average latency (ms)" > 0 THEN "Average latency (ms)" ELSE 0 END, 3 ) AS "Average latency (ms)" FROM (SELECT ip_to_province(authority) as province,sum(rt)/sum(ori_pv) * 1000 AS "Average latency (ms)" from (select authority, sum(duration) as rt,count(1) as ori_pv  group by authority   ORDER BY ori_pv desc   LIMIT 10000) WHERE  IP_TO_COUNTRY (authority) = 'China' GROUP BY province )  where province not in ('','Reserved address','*')
   • Average Latency Distribution (Global). The associated query and analysis statement is:

     SELECT country,round( CASE WHEN "Average latency (ms)" > 0 THEN "Average latency (ms)" ELSE 0 END, 2 ) AS "Average latency (ms)" FROM (SELECT ip_to_country(authority) as country,sum(rt)/sum(ori_pv)  * 1000 AS "Average latency (ms)" from (select authority, sum(duration) as rt,count(1) as ori_pv   group by authority   ORDER BY ori_pv desc LIMIT 10000) GROUP BY country ) where  country not in ('','Reserved address','*')
   • PV/UV Today. The associated query and analysis statement is:

     SELECT TIME_FORMAT( _time_, 'yyyy-MM-dd HH:mm:ss') as _time_,PV,UV FROM (select TIME_CEIL(TIME_PARSE(start_time),'PT600S') AS _time_ , count(1) as PV,  APPROX_COUNT_DISTINCT(authority) as UV from log WHERE __time <= CURRENT_TIMESTAMP  and __time >= DATE_TRUNC( 'DAY',(CURRENT_TIMESTAMP + INTERVAL '8' HOUR)) - INTERVAL '8' HOUR group by _time_ order by _time_)
   • Top 10 Provinces by Visits. The associated query and analysis statement is:

     select ip_to_province(authority) as "province", sum(ori_pv) as "Visits" from (select authority, count(1) as ori_pv  group by authority  ORDER BY ori_pv desc  LIMIT 10000) group by "province" HAVING "province" <> '-1' order by "Visits" desc limit 10
   • Top 10 Cities by Visits. The associated query and analysis statement is:

     select ip_to_city(authority) as "city", sum(ori_pv) as "Visits" from (select authority, count(1) as ori_pv  group by authority ORDER BY ori_pv desc LIMIT 10000) group by "city" HAVING  "city" <> '-1' order by "Visits" desc  limit 10
   • Top 10 Hosts by Visits. The associated query and analysis statement is:

     select  upstream_host as "Host", count(1) as "PV" group by "Host" order by "PV" desc limit 10
   • Top 10 UserAgents by Visits. The associated query and analysis statement is:

     select user_agent as "UserAgent", count(1) as "PV" group by "UserAgent" order by "PV" desc limit 10
   • Device Distribution by Type. The associated query and analysis statement is:

     select case when regexp_like(lower(user_agent), 'iphone|ipod|android|ios') then 'Mobile' else 'PC' end as type , count(1) as total group by  type
   • Device Distribution by System. The associated query and analysis statement is:

     select case when regexp_like(lower(user_agent), 'iphone|ipod|ios') then 'IOS' when regexp_like(lower(user_agent), 'android') then 'Android' else 'other' end as type , count(1) as total group by  type HAVING type != 'other'
   • TOP URL. The associated query and analysis statement is:

     select path , count(1) as pv, APPROX_COUNT_DISTINCT(authority) as UV, round(sum( case when response_code < 400 then 1 else 0 end   )  * 100.0 / count(1), 2) as "Access Success Rate" group by path ORDER by pv desc
   • Top IP Addresses by Visits. The associated query and analysis statement is:

     select authority as "Source IP Address",ip_to_country(authority) as "Country/Region",ip_to_province(authority) as "Province",ip_to_city(authority) as "City",ip_to_provider(authority) as "Carrier",count(1) as "PV" group by authority ORDER by "PV" desc limit 100

Viewing CSE Layer Monitoring Center

1. Log in to the LTS console. In the navigation pane, choose Dashboards.
2. Choose CSE dashboard templates under Dashboard Templates and click CSE Layer Monitoring Center to view the chart details.
   • upstream_host allows you to filter upstream IP addresses. The associated query and analysis statement is:

     select distinct(upstream_host)
   • trace_id allows you to filter traces. The associated query and analysis statement is:

     select distinct(trace_id)
   • PV. The associated query and analysis statement is:

     SELECT TIME_FORMAT( _time_, 'yyyy-MM-dd HH:mm:ss') as _time_,PV FROM ( SELECT TIME_CEIL ( TIME_PARSE(start_time), 'PT300S' ) AS _time_, count( 1 ) AS PV FROM log GROUP BY _time_ )
   • Request Success Rate. The associated query and analysis statement is:

     select ROUND(sum(case when response_code < 400 then 1 else 0 end) * 100.0 / count(1),2) as cnt
   • Average Latency. The associated query and analysis statement is:

     select round(avg(duration) * 1000, 3) as cnt
   • 4xx Requests. The associated query and analysis statement is:

     SELECT COUNT(1) as cnt WHERE "response_code" >= 400 and "response_code" < 500
   • 404 Requests. The associated query and analysis statement is:

     SELECT COUNT(1) as cnt WHERE "response_code" = 404
   • 429 Requests. The associated query and analysis statement is:

     SELECT COUNT(1) as cnt WHERE "response_code" = 429
   • 504 Requests. The associated query and analysis statement is:

     SELECT COUNT(1) as cnt WHERE "response_code" = 504
   • 5xx Requests. The associated query and analysis statement is:

     SELECT TIME_FORMAT( _time_, 'yyyy-MM-dd HH:mm:ss') as _time_,cnt FROM ( SELECT TIME_CEIL ( TIME_PARSE(start_time), 'PT300S' ) AS _time_, count( 1 ) AS cnt FROM log where "response_code" >= 500 GROUP BY _time_ )
   • Status Code Distribution. The associated query and analysis statement is:

     SELECT response_code, COUNT(1) AS rm GROUP BY response_code
   • UV. The associated query and analysis statement is:

     SELECT TIME_FORMAT( _time_, 'yyyy-MM-dd HH:mm:ss') as _time_,UV FROM (select TIME_CEIL(TIME_PARSE(start_time),'PT600S') AS _time_ , APPROX_COUNT_DISTINCT(authority) as UV  from log group by _time_)
   • Traffic. The associated query and analysis statement is:

     select TIME_FORMAT(_time_,'yyyy-MM-dd HH:mm:ss') AS _time_,round( CASE WHEN "Inbound" > 0 THEN "Inbound" ELSE 0 END, 2 ) AS "Inbound",round( CASE WHEN "Outbound" > 0 THEN "Outbound" ELSE 0 END, 2 ) AS "Outbound" FROM (SELECT TIME_CEIL(TIME_PARSE(start_time),'PT600S') AS _time_,sum(bytes_received) / 1024.0 AS "Inbound",sum(bytes_sent) / 1024.0 AS "Outbound" group by  _time_)
   • Access Failure Rate. The associated query and analysis statement is:

     SELECT TIME_FORMAT( _time_, 'yyyy-MM-dd HH:mm:ss') as _time_,round( CASE WHEN "Failure rate" > 0 THEN "Failure rate" ELSE 0 END, 2 ) AS "Failure rate",round( CASE WHEN "5xx ratio" > 0 THEN "5xx ratio" ELSE 0 END, 2 ) AS "5xx ratio" from (select TIME_CEIL(TIME_PARSE(start_time),'PT600S') AS _time_,sum(case when response_code >= 400 then 1 else 0 end) * 100.0 / count(1) as 'Failure rate' , sum(case when response_code >=500 THEN 1 ELSE 0 END)*100.0/COUNT(1) as '5xx ratio' group by  _time_)
   • Latency. The associated query and analysis statement is:

     select TIME_FORMAT( _time_, 'yyyy-MM-dd HH:mm:ss') as _time_,round( CASE WHEN "Avg" > 0 THEN "Avg" ELSE 0 END, 2 ) AS "Avg",round( CASE WHEN "P50" > 0 THEN "P50" ELSE 0 END, 2 ) AS "P50",round( CASE WHEN "P90" > 0 THEN "P90" ELSE 0 END, 2 ) AS "P90",round( CASE WHEN "P99" > 0 THEN "P99" ELSE 0 END, 2 ) AS "P99",round( CASE WHEN "P9999" > 0 THEN "P9999" ELSE 0 END, 2 ) AS "P9999" from (select TIME_CEIL(TIME_PARSE(start_time),'PT600S') as _time_,avg(duration) * 1000 as "Avg", APPROX_QUANTILE_DS("duration", 0.50)*1000 as "P50", APPROX_QUANTILE_DS("duration", 0.90)*1000 as "P90" ,APPROX_QUANTILE_DS("duration", 0.99)*1000 as 'P99',APPROX_QUANTILE_DS("duration", 0.9999)*1000 as 'P9999' group by  _time_)
   • Top Host Requests. The associated query and analysis statement is:

     SELECT "host", pv, uv, round( CASE WHEN "Access Success Rate (%)" > 0 THEN "Access Success Rate (%)" ELSE 0 END, 2 ) AS "Access Success Rate (%)", round( CASE WHEN "Average Latency (ms)" > 0 THEN "Average Latency (ms)" ELSE 0 END, 3 ) AS "Average Latency (ms)", round( CASE WHEN "Inbound (KB)" > 0 THEN "Inbound (KB)" ELSE 0 END, 3 ) AS "Inbound (KB)", round( CASE WHEN "Outbound (KB)" > 0 THEN "Outbound (KB)" ELSE 0 END, 3 ) AS "Outbound (KB)"  FROM ( SELECT "host", count( 1 ) AS pv, APPROX_COUNT_DISTINCT ( my_remote_addr ) AS uv, sum( CASE WHEN "status" < 400 THEN 1 ELSE 0 END ) * 100.0 / count( 1 ) AS "Access Success Rate (%)", avg( request_time ) * 1000 AS "Average Latency (ms)", sum( request_length ) / 1024.0 AS "Inbound (KB)", sum( bytes_sent ) / 1024.0 AS "Outbound (KB)"  WHERE "host" != ''  GROUP BY "host" ) ORDER BY pv DESC
   • Top Host Latencies. The associated query and analysis statement is:

     SELECT "upstream_host", pv, round( CASE WHEN "Access Success Rate (%)" > 0 THEN "Access Success Rate (%)" ELSE 0 END, 2 ) AS "Access Success Rate (%)", round( CASE WHEN "Average Latency (ms)" > 0 THEN "Average Latency (ms)" ELSE 0 END, 3 ) AS "Average Latency (ms)", round( CASE WHEN "P90 Latency (ms)" > 0 THEN "P90 Latency (ms)" ELSE 0 END, 3 ) AS "P90 Latency (ms)", round( CASE WHEN "P99 Latency (ms)" > 0 THEN "P99 Latency (ms)" ELSE 0 END, 3 ) AS "P99 Latency (ms)" FROM ( SELECT "upstream_host", count( 1 ) AS pv, sum( CASE WHEN "response_code" < 400 THEN 1 ELSE 0 END ) * 100.0 / count( 1 ) AS "Access Success Rate (%)", avg( duration ) * 1000 AS "Average Latency (ms)",APPROX_QUANTILE_DS(duration, 0.9) * 1000 AS "P90 Latency (ms)", APPROX_QUANTILE_DS(duration, 0.99) * 1000 AS "P99 Latency (ms)" WHERE "upstream_host" != ''  GROUP BY "upstream_host" ) ORDER BY "Average Latency (ms)" desc
   • Top Host Failure Rates. The associated query and analysis statement is:

     SELECT "upstream_host", pv,round( CASE WHEN "Access Failure Rate (%)" > 0 THEN "Access Failure Rate (%)" ELSE 0 END, 2 ) AS "Access Failure Rate (%)", round( CASE WHEN "Average Latency (ms)" > 0 THEN "Average Latency (ms)" ELSE 0 END, 3 ) AS "Average Latency (ms)", round( CASE WHEN "P90 Latency (ms)" > 0 THEN "P90 Latency (ms)" ELSE 0 END, 3 ) AS "P90 Latency (ms)", round( CASE WHEN "P99 Latency (ms)" > 0 THEN "P99 Latency (ms)" ELSE 0 END, 3 ) AS "P99 Latency (ms)"  FROM ( SELECT "upstream_host", count( 1 ) AS pv, sum( CASE WHEN "response_code" >= 400 THEN 1 ELSE 0 END ) * 100.0 / count( 1 ) AS "Access Failure Rate (%)", avg( duration ) * 1000 AS "Average Latency (ms)", APPROX_QUANTILE_DS(duration, 0.9) * 1000 AS "P90 Latency (ms)", APPROX_QUANTILE_DS(duration, 0.99) * 1000 AS "P99 Latency (ms)" WHERE "upstream_host" != ''  GROUP BY "upstream_host") ORDER BY "Access Failure Rate (%)" desc
   • Top URL Requests. The associated query and analysis statement is:

     SELECT path, pv,uv, round( CASE WHEN "Access Success Rate (%)" > 0 THEN "Access Success Rate (%)" ELSE 0 END, 2 ) AS "Access Success Rate (%)", round( CASE WHEN "Average Latency (ms)" > 0 THEN "Average Latency (ms)" ELSE 0 END, 3 ) AS "Average Latency (ms)", round( CASE WHEN "Inbound (KB)" > 0 THEN "Inbound (KB)" ELSE 0 END, 3 ) AS "Inbound (KB)", round( CASE WHEN "Outbound (KB)" > 0 THEN "Outbound (KB)" ELSE 0 END, 3 ) AS "Outbound (KB)"  FROM ( SELECT path, count( 1 ) AS pv, APPROX_COUNT_DISTINCT ( authority ) AS uv, sum( CASE WHEN "response_code" < 400 THEN 1 ELSE 0 END ) * 100.0 / count( 1 ) AS "Access Success Rate (%)", avg( duration ) * 1000 AS "Average Latency (ms)", sum( bytes_received ) / 1024.0 AS "Inbound (KB)", sum( bytes_sent ) / 1024.0 AS "Outbound (KB)"  WHERE "upstream_host" != ''  GROUP BY path  ) ORDER BY pv desc
   • Top URL Failure Rates. The associated query and analysis statement is:

     SELECT path, pv, round( CASE WHEN "Access Failure Rate (%)" > 0 THEN "Access Failure Rate (%)" ELSE 0 END, 2 ) AS "Access Failure Rate (%)", round( CASE WHEN "Average Latency (ms)" > 0 THEN "Average Latency (ms)" ELSE 0 END, 3 ) AS "Average Latency (ms)", round( CASE WHEN "P90 Latency (ms)" > 0 THEN "P90 Latency (ms)" ELSE 0 END, 3 ) AS "P90 Latency (ms)", round( CASE WHEN "P99 Latency (ms)" > 0 THEN "P99 Latency (ms)" ELSE 0 END, 3 ) AS "P99 Latency (ms)" FROM( SELECT path, count( 1 ) AS pv, sum( CASE WHEN "response_code" >= 400 THEN 1 ELSE 0 END ) * 100.0 / count( 1 ) AS "Access Failure Rate (%)", avg( duration ) * 1000 AS "Average Latency (ms)", APPROX_QUANTILE_DS(duration, 0.9) * 1000 AS "P90 Latency (ms)", APPROX_QUANTILE_DS(duration, 0.99) * 1000 AS "P99 Latency (ms)" WHERE "upstream_host" != '' GROUP BY path  ) ORDER BY "Access Failure Rate (%)" desc
   • Top Backend Requests. The associated query and analysis statement is:

     SELECT addr, pv, uv, round( CASE WHEN "Access Success Rate (%)" > 0 THEN "Access Success Rate (%)" ELSE 0 END, 2 ) AS "Access Success Rate (%)", round( CASE WHEN "Average Latency (ms)" > 0 THEN "Average Latency (ms)" ELSE 0 END, 3 ) AS "Average Latency (ms)", round( CASE WHEN "Inbound (KB)" > 0 THEN "Inbound (KB)" ELSE 0 END, 3 ) AS "Inbound (KB)", round( CASE WHEN "Outbound (KB)" > 0 THEN "Outbound (KB)" ELSE 0 END, 3 ) AS "Outbound (KB)"  FROM ( SELECT authority as addr, count( 1 ) AS pv, APPROX_COUNT_DISTINCT ( authority ) AS uv, sum( CASE WHEN "response_code" < 400 THEN 1 ELSE 0 END ) * 100.0 / count( 1 ) AS "Access Success Rate (%)", avg( duration ) * 1000 AS "Average Latency (ms)", sum( bytes_received ) / 1024.0 AS "Inbound (KB)", sum( bytes_sent ) / 1024.0 AS "Outbound (KB)"  WHERE "upstream_host" != ''  GROUP BY addr  having length(authority) > 2) ORDER BY "pv" desc
   • Top Backend Latencies. The associated query and analysis statement is:

     SELECT addr,pv,round( CASE WHEN "Access Success Rate (%)" > 0 THEN "Access Success Rate (%)" ELSE 0 END, 2 ) AS "Access Success Rate (%)",round( CASE WHEN "Average Latency (ms)" > 0 THEN "Average Latency (ms)" ELSE 0 END, 3 ) AS "Average Latency (ms)",round( CASE WHEN "P90 Latency (ms)" > 0 THEN "P90 Latency (ms)" ELSE 0 END, 3 ) AS "P90 Latency (ms)",round( CASE WHEN "P99 Latency (ms)" > 0 THEN "P99 Latency (ms)" ELSE 0 END, 3 ) AS "P99 Latency (ms)" FROM (SELECT authority as addr,count( 1 ) AS pv,sum( CASE WHEN "response_code" < 400 THEN 1 ELSE 0 END ) * 100.0 / count( 1 ) AS "Access Success Rate (%)",avg( duration ) * 1000 AS "Average Latency (ms)",APPROX_QUANTILE_DS(duration, 0.9) * 1000 AS "P90 Latency (ms)",APPROX_QUANTILE_DS(duration, 0.99) * 1000 AS "P99 Latency (ms)" WHERE "upstream_host" != '' and "authority" != '-' GROUP BY addr ) ORDER BY "Average Latency (ms)" desc
   • Top Backend Failure Rates. The associated query and analysis statement is:

     SELECT addr, pv, round( CASE WHEN "Access Failure Rate (%)" > 0 THEN "Access Failure Rate (%)" ELSE 0 END, 2 ) AS "Access Failure Rate (%)", round( CASE WHEN "Average Latency (ms)" > 0 THEN "Average Latency (ms)" ELSE 0 END, 3 ) AS "Average Latency (ms)", round( CASE WHEN "P90 Latency (ms)" > 0 THEN "P90 Latency (ms)" ELSE 0 END, 3 ) AS "P90 Latency (ms)", round( CASE WHEN "P99 Latency (ms)" > 0 THEN "P99 Latency (ms)" ELSE 0 END, 3 ) AS "P99 Latency (ms)"  FROM ( SELECT authority as addr, count( 1 ) AS pv, sum( CASE WHEN "response_code" >= 400 THEN 1 ELSE 0 END ) * 100.0 / count( 1 ) AS "Access Failure Rate (%)", avg( duration ) * 1000 AS "Average Latency (ms)", APPROX_QUANTILE_DS(duration, 0.9) * 1000 AS "P90 Latency (ms)", APPROX_QUANTILE_DS(duration, 0.99) * 1000 AS "P99 Latency (ms)" WHERE "upstream_host" != '' and "authority" != '-' GROUP BY addr) ORDER BY "Access Failure Rate (%)" desc
   • Top URL Latencies. The associated query and analysis statement is:

     SELECT path, pv,round( CASE WHEN "Access Success Rate (%)" > 0 THEN "Access Success Rate (%)" ELSE 0 END, 2 ) AS "Access Success Rate (%)",round( CASE WHEN "Average Latency (ms)" > 0 THEN "Average Latency (ms)" ELSE 0 END, 3 ) AS "Average Latency (ms)",round( CASE WHEN "P90 Latency (ms)" > 0 THEN "P90 Latency (ms)" ELSE 0 END, 3 ) AS "P90 Latency (ms)",round( CASE WHEN "P99 Latency (ms)" > 0 THEN "P99 Latency (ms)" ELSE 0 END, 3 ) AS "P99 Latency (ms)" FROM (SELECT path, count( 1 ) AS pv, sum( CASE WHEN "response_code" < 400 THEN 1 ELSE 0 END ) * 100.0 / count( 1 ) AS "Access Success Rate (%)", avg( duration ) * 1000 AS "Average Latency (ms)", APPROX_QUANTILE_DS(duration, 0.9) * 1000 AS "P90 Latency (ms)", APPROX_QUANTILE_DS(duration, 0.99) * 1000 AS "P99 Latency (ms)" WHERE "upstream_host" != ''  GROUP BY path  ) ORDER BY "Average Latency (ms)" desc

Viewing CSE Layer Monitoring in Seconds

1. Log in to the LTS console. In the navigation pane, choose Dashboards.
2. Choose CSE dashboard templates under Dashboard Templates and click CSE Layer Monitoring in Seconds to view the chart details.
   • upstream_host allows you to filter upstream IP addresses. The associated query and analysis statement is:

     select distinct(upstream_host)
   • trace_id allows you to filter traces. The associated query and analysis statement is:

     select distinct(trace_id)
   • QPS. The associated query and analysis statement is:

     SELECT TIME_FORMAT(TIME_CEIL(TIME_PARSE(start_time),'PT5S'),'yyyy-MM-dd HH:mm:ss') AS _time_ , COUNT(*) as QPS from log group by _time_
   • Success Rate. The associated query and analysis statement is:

     select __time,round(CASE WHEN "Success rate" > 0 THEN "Success rate" else 0 end,2) as "Success rate" from (select TIME_FORMAT(TIME_CEIL(TIME_PARSE(start_time),'PT5S'),'yyyy-MM-dd HH:mm:ss') as __time, sum(case when response_code < 400 then 1 else 0 end) * 100.0 / count(1) as 'Success rate' from log group by __time)
   • Latency. The associated query and analysis statement is:

     select __time,round(CASE WHEN "Access latency" > 0 THEN "Access latency" else 0 end,2) as "Access latency",round(CASE WHEN "Upstream latency" > 0 THEN "Upstream latency" else 0 end,2) as "Upstream latency" from (select TIME_FORMAT(TIME_CEIL(TIME_PARSE(start_time),'PT5S'),'yyyy-MM-dd HH:mm:ss') as __time, avg(duration)* 1000 as 'Access latency',avg(upstream_service_time)* 1000 as 'Upstream latency' from log group by __time)
   • Traffic. The associated query and analysis statement is:

     select __time,round( CASE WHEN "Incoming" > 0 THEN "Incoming" ELSE 0 END, 3 ) AS "Incoming",round( CASE WHEN "Outgoing body" > 0 THEN "Outgoing body" ELSE 0 END, 3 ) AS "Outgoing body" from (select TIME_FORMAT(TIME_CEIL(TIME_PARSE(start_time),'PT5S'),'yyyy-MM-dd HH:mm:ss') as __time , sum("bytes_received") / 1024.0 as "Incoming", sum("bytes_sent") / 1024.0 as "Outgoing body" group by __time)
   • Status Codes. The associated query and analysis statement is:

     SELECT TIME_CEIL ( TIME_PARSE ( start_time ), 'PT5S' ) AS "time", SUM( CASE WHEN "response_code" >= 200 AND "response_code" < 300 THEN 1 ELSE 0 END ) AS "2XX", SUM( CASE WHEN "response_code" >= 300 AND "response_code" < 400 THEN 1 ELSE 0 END ) AS "3XX", SUM( CASE WHEN "response_code" >= 400 AND "response_code" < 500 THEN 1 ELSE 0 END ) AS "4XX", SUM( CASE WHEN "response_code" >= 500 AND "response_code" < 600 THEN 1 ELSE 0 END ) AS "5XX", SUM( CASE WHEN "response_code" < 200 OR "response_code" >= 600 THEN 1 ELSE 0 END ) AS "Other" FROM log  WHERE TIME_PARSE ( start_time ) IS NOT NULL GROUP BY "time"  ORDER BY "time" ASC LIMIT 100000