Help Center/ Cloud Firewall/ API Reference/ API/ Log Analysis/ Querying Traffic Log Statistics Details
Updated on 2025-08-12 GMT+08:00

Querying Traffic Log Statistics Details

Function

This API is used to query traffic log statistics, for example, the access details of a source IP address.

Calling Method

For details, see Calling APIs.

URI

GET /v1/{project_id}/cfw/logs/flow-detail

Table 1 Path Parameters

Parameter

Mandatory

Type

Description

project_id

Yes

String

Definition

Project ID, which is used to specify the project that an asset belongs to. You can query the assets of a project by project ID. You can obtain the project ID from the API or console. For details, see Obtaining a Project ID.

Constraints

N/A

Range

32-bit UUID.

Default Value

N/A

Table 2 Query Parameters

Parameter

Mandatory

Type

Description

fw_instance_id

Yes

String

Definition

Firewall ID. It is a unique ID generated after a firewall instance is created. You can obtain the firewall ID by referring to Obtaining a Firewall ID.

Constraints

N/A

Range

32-bit UUID.

Default Value

N/A

range

No

Integer

Definition

Time range.

Constraints

N/A

Range

0 (last hour), 1 (last day), or 2 (last seven days)

Default Value

N/A

log_type

Yes

String

Definition

Log type.

Constraints

N/A

Range

internet (north-south logs), nat (NAT logs), vpc (east-west logs), or vgw (VGW logs)

Default Value

N/A

direction

No

String

Definition

Session direction.

Constraints

N/A

Range

in2out (outbound) or out2in (inbound)

Default Value

N/A

start_time

No

Long

Definition

Start time.

Constraints

N/A

Range

Milliseconds-level timestamp.

Default Value

N/A

end_time

No

Long

Definition

End time.

Constraints

N/A

Range

Milliseconds-level timestamp.

Default Value

N/A

vgw_id

No

Array of strings

Definition

VGW ID

Constraints

N/A

Range

32-bit UUID.

Default Value

N/A

asset_type

No

String

Definition

IP type.

Constraints

N/A

Range

public: EIP

private: private IP address

open_port

Default Value

N/A

item

Yes

String

Definition

Aggregation type.

Constraints

N/A

Range

src_ip: source IP address

dst_ip: destination IP address

dst_port: destination port

protocol: protocol

dst_host: destination domain name

app: application

dst_region_name: destination region

src_region_name: source region

Default Value

N/A

value

Yes

String

Definition

Statistical object.

Constraints

N/A

Range

N/A

Default Value

N/A

Request Parameters

None

Response Parameters

Status code: 200

Table 3 Response body parameters

Parameter

Type

Description

data

FlowAnalysisVO object

Table 4 FlowAnalysisVO

Parameter

Type

Description

app_count

Long

Definition

Application statistics.

Range

N/A

bytes

Double

Definition

Number of bytes.

Range

N/A

dst_ip_count

Long

Definition

Number of destination IP addresses.

Range

N/A

dst_port_count

Long

Definition

Number of destination ports.

Range

N/A

end_time

Long

Definition

End time.

Range

N/A

records

Array of SessionVO objects

Definition

Top session details.

Range

N/A

request_byte

Double

Definition

Number of bytes in a request.

Range

N/A

response_byte

Double

Definition

Number of bytes in the response.

Range

N/A

sessions

Long

Definition

Number of sessions.

Range

N/A

src_ip_count

Long

Definition

Number of source IP addresses.

Range

N/A

start_time

Long

Definition

Start time.

Range

N/A

Table 5 SessionVO

Parameter

Type

Description

app

String

Definition

Application.

Range

N/A

bytes

Double

Definition

Number of bytes.

Range

N/A

dst_associate_instance_type

String

Definition

Asset type associated with the destination IP address.

Range

N/A

dst_device_name

String

Definition

Asset name associated with the destination IP address.

Range

N/A

dst_ip

String

Definition

Destination IP address.

Range

N/A

dst_port

String

Definition

Destination port.

Range

N/A

dst_host

String

Definition

Destination domain name.

Range

N/A

dst_region_id

String

Definition

Destination region ID.

Range

N/A

dst_region_name

String

Definition

Destination region.

Range

N/A

end_time

Long

Definition

End time.

Range

N/A

protocol

String

Definition

Protocol.

Range

N/A

request_byte

Double

Definition

Number of bytes in a request.

Range

N/A

response_byte

Double

Definition

Number of bytes in the response.

Range

N/A

sessions

Long

Definition

Number of sessions.

Range

N/A

src_associate_instance_type

String

Definition

Asset type associated with the source IP address.

Range

N/A

src_device_name

String

Definition

Asset name associated with the source IP address.

Range

N/A

src_ip

String

Definition

Source IP address.

Range

N/A

src_region_id

String

Definition

Source region ID.

Range

N/A

src_region_name

String

Definition

Source region.

Range

N/A

start_time

Long

Definition

Session start time.

Range

N/A

Status code: 400

Table 6 Response body parameters

Parameter

Type

Description

error_code

String

Definition

Error code.

Range

N/A

error_msg

String

Definition

Error message.

Range

N/A

Example Requests

Query detailed traffic log statistics. The project ID is a16df7cf1d094befa6bbc72cbf51e93a, the firewall ID is c598d612-8112-465c-bffd-863d4ce85a50, the time range is seven days, the direction is outbound, and the destination IP address is 100.93.4.158.

https://{Endpoint}/v1/a16df7cf1d094befa6bbc72cbf51e93a/cfw/logs/flow-detail?fw_instance_id=c598d612-8112-465c-bffd-863d4ce85a50&log_type=internet&direction=in2out&item=dst_ip&range=2&value=100.93.4.158

Example Responses

Status code: 200

OK

{
  "data" : {
    "app_count" : 1,
    "bytes" : 10219,
    "dst_port_count" : 1,
    "end_time" : 1751355533000,
    "records" : [ {
      "app" : "HTTP",
      "bytes" : 10219,
      "dst_ip" : "100.93.12.160",
      "dst_port" : "8080",
      "end_time" : 1751355533000,
      "protocol" : "TCP",
      "request_byte" : 5357,
      "response_byte" : 4862,
      "sessions" : 11,
      "src_associate_instance_type" : "PORT",
      "src_device_name" : "ecs_172",
      "src_ip" : "100.93.2.30",
      "start_time" : 1751355362000
    } ],
    "request_byte" : 5357,
    "response_byte" : 4862,
    "sessions" : 11,
    "src_ip_count" : 1,
    "start_time" : 1751355362000
  }
}

Status code: 400

Bad Request

{
  "error_code" : "CFW.00200007",
  "error_msg" : "Incorrect time range."
}

Status Codes

Status Code

Description

200

OK

400

Bad Request

Error Codes

See Error Codes.