文档首页/ 云日志服务 LTS/ 用户指南/ 日志可视化/ 使用仪表盘将日志可视化/ 日志仪表盘模板/ ELB仪表盘模板（独享型）

更新时间：2024-09-25 GMT+08:00

ELB仪表盘模板（独享型）

弹性负载均衡（Elastic Load Balance，简称ELB）是将访问流量根据分配策略分发到后端多台服务器的流量分发控制服务。弹性负载均衡可以通过流量分发扩展应用系统对外的服务能力，同时通过消除单点故障提升应用系统的可用性，支持查看和分析对七层负载均衡HTTP和HTTPS进行请求的详细访问日志记录，包括请求时间、客户端IP地址、请求路径和服务器响应等。

ELB仪表盘模板支持查看ELB7层访问中心、查看ELB7层监控中心和查看ELB7层秒级监控。

upstream_addr_priv（该参数适用于共享型负载均衡）：后端主机的IP地址和端口号。可能有多个值，每个值都是ip:port或者-，用逗号空格隔开。
upstream_addr（该参数适用于独享型负载均衡）：后端主机的IP地址和端口号。可能有多个值，每个值都是ip:port或者-，用逗号空格隔开。

更多信息请参考独享型负载均衡与共享型弹性负载均衡的区别。

前提条件

已采集ELB日志，详情请参见弹性负载均衡 ELB接入LTS。
日志配置结构化，详情请参见设置云端结构化解析日志。

查看ELB7层访问中心

登录云日志服务控制台，在左侧导航栏中选择“日志管理”。
在“日志应用”模块中，单击“ELB日志中心”，选择“进入仪表盘”。

在仪表盘模板下方，选择“ELB仪表盘模板 > ELB7层访问中心”，查看图表详情。

过滤所有负载均衡器，所关联的查询分析语句如下所示：
```
select distinct(lb_name)
```
过滤所有客户端IP，所关联的查询分析语句如下所示：
```
select distinct(remote_addr)
```
过滤所有后端服务器IP，所关联的查询分析语句如下所示：
```
select distinct(upstream_addr)
```
过滤所有弹性IP地址，所关联的查询分析语句如下所示：
```
select distinct(eip_address) 
```

在搜索框上方选择时间范围，建议选择相对时间30分钟以上的查询时间（即日志上报时间）。由于日志的业务时间（字段名称为time_iso8601）和日志上报时间的差异，在查询时间范围限制下根据业务时间排序的折线图两端的数据不具有参考性。

相对时间：表示查询距离当前时间1分钟、5分钟、15分钟等时间区间的日志数据。例如当前时间为19:20:31，设置相对时间1小时，表示查询18:20:31~19:20:31的日志数据。
整点时间：表示查询最近整点1分钟、15分钟等时间区间的日志数据。例如当前时间为19:20:31，设置整点时间1小时，表示查询18:00:00~19:00:00的日志数据。
自定义：表示查询指定时间范围的日志数据。

PV对比昨日图表所关联的查询分析语句如下所示：

select diff[1] as "total", round((diff[1] - diff[2]) / diff[2] * 100, 2) as inc from(select compare( "pv" , 86400) as diff from (select count(1) as "pv" from log))

PV对比上周图表所关联的查询分析语句如下所示：

select diff[1] as "total", round((diff[1] - diff[2]) / diff[2] * 100, 2) as inc from(select compare( "pv" , 604800) as diff from (select count(1) as "pv" from log))

UV对比昨日图表所关联的查询分析语句如下所示：

select diff[1] as "total", round((diff[1] - diff[2]) / diff[2] * 100, 2) as inc from(select compare( "uv" , 86400) as diff from (select APPROX_COUNT_DISTINCT(remote_addr) as "uv" from log))

UV对比上周图表所关联的查询分析语句如下所示：

select diff[1] as "total", round((diff[1] - diff[2]) / diff[2] * 100, 2) as inc from(select compare( "uv" , 604800) as diff from (select APPROX_COUNT_DISTINCT(remote_addr) as "uv" from log))

访问量PV分布(中国)图表所关联的查询分析语句如下所示：

select ip_to_province(remote_addr) as province, count(1) as pv where IP_TO_COUNTRY (remote_addr) = '中国'  group by province HAVING province not in ('','保留地址','*')

访问量PV分布(世界)图表所关联的查询分析语句如下所示：

SELECT ip_to_country(remote_addr) as country,COUNT(1) as PV GROUP BY country HAVING country not in ('','保留地址','*')

访问量UV分布(中国)图表所关联的查询分析语句如下所示：

select ip_to_province(remote_addr) as province, APPROX_COUNT_DISTINCT(remote_addr) as uv where IP_TO_COUNTRY (remote_addr) = '中国' group by province HAVING province not in ('','保留地址','*')

访问量UV分布(世界)图表所关联的查询分析语句如下所示：

select ip_to_country(remote_addr) as country, APPROX_COUNT_DISTINCT(remote_addr) as uv group by country HAVING country not in ('','保留地址','*')

平均时延分布（中国）图表所关联的查询分析语句如下所示：

SELECT province,round( CASE WHEN "平均延迟(ms)" > 0 THEN "平均延迟(ms)" ELSE 0 END, 3 ) AS "平均延迟(ms)"FROM (SELECT ip_to_province(remote_addr) as province,avg(request_time) * 1000 AS "平均延迟(ms)"WHERE  IP_TO_COUNTRY (remote_addr) = '中国'GROUP BY province HAVING province not in ('','保留地址','*'))

平均时延分布（世界）图表所关联的查询分析语句如下所示：

SELECT country,round( CASE WHEN "平均延迟(ms)" > 0 THEN "平均延迟(ms)" ELSE 0 END, 2 ) AS "平均延迟(ms)"FROM (SELECT ip_to_country(remote_addr) as country,avg(request_time) * 1000 AS "平均延迟(ms)" GROUP BY country HAVING country not in ('','保留地址','*'))

今日PV/UV图表所关联的查询分析语句如下所示：

SELECT TIME_FORMAT( _time_, 'yyyy-MM-dd HH:mm:ss', '+08:00' ) as _time_,PV,UV FROM (select TIME_CEIL(TIME_PARSE(SUBSTRING(time_iso8601, 2, 25) ,'yyyy-MM-dd''T''HH:mm:ssZZ'),'PT600S') AS _time_ , count(1) as PV,  APPROX_COUNT_DISTINCT(remote_addr) as UV from log WHERE TIME_PARSE(SUBSTRING(time_iso8601, 2, 25) ,'yyyy-MM-dd''T''HH:mm:ssZZ') <= CURRENT_TIMESTAMP  and TIME_PARSE(SUBSTRING(time_iso8601, 2, 25) ,'yyyy-MM-dd''T''HH:mm:ssZZ') >= DATE_TRUNC( 'DAY',(CURRENT_TIMESTAMP + INTERVAL '8' HOUR)) - INTERVAL '8' HOUR group by _time_ order by _time_)

7日PV/UV图表所关联的查询分析语句如下所示：

SELECT TIME_FORMAT( _time_, 'yyyy-MM-dd HH:mm:ss', '+08:00' ) as _time_,PV,UV FROM (select  TIME_CEIL(TIME_PARSE(SUBSTRING(time_iso8601, 2, 25) ,'yyyy-MM-dd''T''HH:mm:ssZZ'),'PT600S') AS _time_ , count(1) as PV,  APPROX_COUNT_DISTINCT(remote_addr) as UV from log WHERE TIME_PARSE(SUBSTRING(time_iso8601, 2, 25) ,'yyyy-MM-dd''T''HH:mm:ssZZ') <= CURRENT_TIMESTAMP  and TIME_PARSE(SUBSTRING(time_iso8601, 2, 25) ,'yyyy-MM-dd''T''HH:mm:ssZZ') >= DATE_TRUNC( 'DAY',(CURRENT_TIMESTAMP + INTERVAL '8' HOUR)) - INTERVAL '8' HOUR - INTERVAL '7' DAY group by _time_ order by _time_ )

区域访问TOP10(省份)图表所关联的查询分析语句如下所示：

select ip_to_province(remote_addr) as "province", count(1) as "访问次数" group by "province" HAVING "province" <> '-1' order by "访问次数" desc limit 10

区域访问TOP10(城市)图表所关联的查询分析语句如下所示：

select ip_to_city(remote_addr) as "city", count(1) as "访问次数" group by "city" HAVING  "city" <> '-1' order by "访问次数" desc  limit 10

Host访问TOP10图表所关联的查询分析语句如下所示：

select  host as "Host", count(1) as "PV" group by "Host" order by "PV" desc limit 10

UserAgent访问TOP10图表所关联的查询分析语句如下所示：

select http_user_agent as "UserAgent", count(1) as "PV" group by "UserAgent" order by "PV" desc limit 10

设备占比(终端)图表所关联的查询分析语句如下所示：

select case when regexp_like(lower(http_user_agent), 'iphone|ipod|android|ios') then '移动端' else 'PC端' end as type , count(1) as total group by  type

设备占比(系统)图表所关联的查询分析语句如下所示：

select case when regexp_like(lower(http_user_agent), 'iphone|ipod|ios') then 'IOS' when regexp_like(lower(http_user_agent), 'android') then 'Android' else 'other' end as type , count(1) as total group by  type HAVING type != 'other'

TOP URL图表所关联的查询分析语句如下所示：

select router_request_uri , count(1) as pv, APPROX_COUNT_DISTINCT(remote_addr)  as uv, round(sum( case when status < 400 then 1 else 0 end   )  * 100.0 / count(1), 2) as "访问成功率" group by router_request_uri ORDER by pv desc

TOP 访问IP图表所关联的查询分析语句如下所示：

select remote_addr as "来源IP",ip_to_country(remote_addr) as "国家",ip_to_province(remote_addr) as "省份",ip_to_city(remote_addr) as "城市",ip_to_provider(remote_addr) as "运营商",count(1) as "PV",http_user_agent as "UserAgent采样",router_request_uri as "URL采样" group by remote_addr,http_user_agent,router_request_uri ORDER by "PV" desc

查看ELB7层监控中心

登录云日志服务控制台，在左侧导航栏中选择“日志管理”。
在“日志应用”模块中，单击“ELB日志中心”，选择“进入仪表盘”。

在仪表盘模板下方，选择“ELB仪表盘模板 > ELB7层监控中心”，查看图表详情。

过滤所有负载均衡器，所关联的查询分析语句如下所示：
```
select distinct(lb_name)
```
过滤所有客户端IP，所关联的查询分析语句如下所示：
```
select distinct(remote_addr)
```
过滤所有后端服务器IP，所关联的查询分析语句如下所示：
```
select distinct(upstream_addr)
```
过滤所有弹性IP地址，所关联的查询分析语句如下所示：
```
select distinct(eip_address) 
```

相对时间：表示查询距离当前时间1分钟、5分钟、15分钟等时间区间的日志数据。例如当前时间为19:20:31，设置相对时间1小时，表示查询18:20:31~19:20:31的日志数据。
整点时间：表示查询最近整点1分钟、15分钟等时间区间的日志数据。例如当前时间为19:20:31，设置整点时间1小时，表示查询18:00:00~19:00:00的日志数据。
自定义：表示查询指定时间范围的日志数据。

访问量PV图表所关联的查询分析语句如下所示：

SELECT TIME_FORMAT( _time_, 'yyyy-MM-dd HH:mm:ss', '+08:00' ) as _time_,PV FROM (select  TIME_CEIL(TIME_PARSE(SUBSTRING(time_iso8601, 2, 25) ,'yyyy-MM-dd''T''HH:mm:ssZZ'),'PT600S') AS _time_ , count(1) as PV from log group by _time_ order by _time_ )

请求成功率图表所关联的查询分析语句如下所示：

select ROUND(sum(case when status < 400 then 1 else 0 end) * 100.0 / count(1),2) as cnt

4XX请求数图表所关联的查询分析语句如下所示：

SELECT COUNT(1) as cnt WHERE "status" >= 400 and "status" < 500

499请求数图表所关联的查询分析语句如下所示：
```
SELECT COUNT(1) as cnt WHERE "status" = 499
```
平均延迟图表所关联的查询分析语句如下所示：
```
select round(avg(request_time) * 1000, 3) as cnt
```
404请求数图表所关联的查询分析语句如下所示：
```
SELECT COUNT(1) as cnt WHERE "status" = 404
```
504请求数图表所关联的查询分析语句如下所示：
```
SELECT COUNT(1) as cnt WHERE "status" = 504
```

5XX请求数图表所关联的查询分析语句如下所示：

SELECT TIME_FORMAT( _time_, 'yyyy-MM-dd HH:mm:ss', '+08:00' ) as _time_,cnt FROM ( SELECT TIME_CEIL ( TIME_PARSE(SUBSTRING(time_iso8601, 2, 25) ,'yyyy-MM-dd''T''HH:mm:ssZZ'), 'PT300S' ) AS _time_, count( 1 ) AS cnt FROM log where "status" >= 500 GROUP BY _time_ )

状态码分布图表所关联的查询分析语句如下所示：
```
SELECT status, COUNT(1) AS rm GROUP BY status
```

访问量UV图表所关联的查询分析语句如下所示：

SELECT TIME_FORMAT( _time_, 'yyyy-MM-dd HH:mm:ss', '+08:00' ) as _time_,UV FROM (select TIME_CEIL(TIME_PARSE(SUBSTRING(time_iso8601, 2, 25) ,'yyyy-MM-dd''T''HH:mm:ssZZ'),'PT600S') AS _time_ , APPROX_COUNT_DISTINCT(remote_addr) as UV  from log group by _time_)

流量图表所关联的查询分析语句如下所示：

select TIME_FORMAT(_time_,'yyyy-MM-dd HH:mm:ss','+08:00') AS _time_,round( CASE WHEN "入流量" > 0 THEN "入流量" ELSE 0 END, 2 ) AS "入流量",round( CASE WHEN "出流量" > 0 THEN "出流量" ELSE 0 END, 2 ) AS "出流量" FROM (SELECT TIME_CEIL(TIME_PARSE(SUBSTRING(time_iso8601, 2, 25) ,'yyyy-MM-dd''T''HH:mm:ssZZ'),'PT600S') AS _time_,sum(request_length) / 1024.0 AS "入流量",sum(bytes_sent) / 1024.0 AS "出流量" group by  _time_)

访问失败率图表所关联的查询分析语句如下所示：

SELECT TIME_FORMAT( _time_, 'yyyy-MM-dd HH:mm:ss', '+08:00' ) as _time_,round( CASE WHEN "失败率" > 0 THEN "失败率" ELSE 0 END, 2 ) AS "失败率",round( CASE WHEN "5XX比例" > 0 THEN "5XX比例" ELSE 0 END, 2 ) AS "5XX比例" from (select TIME_CEIL(TIME_PARSE(SUBSTRING(time_iso8601, 2, 25) ,'yyyy-MM-dd''T''HH:mm:ssZZ'),'PT600S') AS _time_,sum(case when status >= 400 then 1 else 0 end) * 100.0 / count(1) as '失败率' , sum(case when status >=500 THEN 1 ELSE 0 END)*100.0/COUNT(1) as '5XX比例' group by  _time_)

延迟图表所关联的查询分析语句如下所示：

select TIME_FORMAT( _time_, 'yyyy-MM-dd HH:mm:ss', '+08:00' ) as _time_,round( CASE WHEN "平均" > 0 THEN "平均" ELSE 0 END, 2 ) AS "平均",round( CASE WHEN "P50" > 0 THEN "P50" ELSE 0 END, 2 ) AS "P50",round( CASE WHEN "P90" > 0 THEN "P90" ELSE 0 END, 2 ) AS "P90",round( CASE WHEN "P99" > 0 THEN "P99" ELSE 0 END, 2 ) AS "P99",round( CASE WHEN "P9999" > 0 THEN "P9999" ELSE 0 END, 2 ) AS "P9999" from (select TIME_CEIL(TIME_PARSE(SUBSTRING(time_iso8601, 2, 25) ,'yyyy-MM-dd''T''HH:mm:ssZZ'),'PT600S') as _time_,avg(request_time) * 1000 as "平均", APPROX_QUANTILE_DS("request_time", 0.50)*1000 as "P50", APPROX_QUANTILE_DS("request_time", 0.90)*1000 as "P90" ,APPROX_QUANTILE_DS("request_time", 0.99)*1000 as 'P99',APPROX_QUANTILE_DS("request_time", 0.9999)*1000 as 'P9999' group by  _time_)

Host请求TOP图表所关联的查询分析语句如下所示：

SELECT host, pv, uv, round( CASE WHEN "访问成功率(%)" > 0 THEN "访问成功率(%)" ELSE 0 END, 2 ) AS "访问成功率(%)", round( CASE WHEN "平均延迟(ms)" > 0 THEN "平均延迟(ms)" ELSE 0 END, 3 ) AS "平均延迟(ms)", round( CASE WHEN "入流量(KB)" > 0 THEN "入流量(KB)" ELSE 0 END, 3 ) AS "入流量(KB)", round( CASE WHEN "出流量(KB)" > 0 THEN "出流量(KB)" ELSE 0 END, 3 ) AS "出流量(KB)"  FROM ( SELECT "host", count( 1 ) AS pv, APPROX_COUNT_DISTINCT ( http_x_forwarded_for ) AS uv, sum( CASE WHEN "status" < 400 THEN 1 ELSE 0 END ) * 100.0 / count( 1 ) AS "访问成功率(%)", avg( request_time ) * 1000 AS "平均延迟(ms)", sum( request_length ) / 1024.0 AS "入流量(KB)", sum( body_bytes_sent ) / 1024.0 AS "出流量(KB)"  WHERE "host" != ''  GROUP BY "host" ) ORDER BY pv DESC

Host延迟TOP图表所关联的查询分析语句如下所示：

SELECT "host", pv, round( CASE WHEN "访问成功率(%)" > 0 THEN "访问成功率(%)" ELSE 0 END, 2 ) AS "访问成功率(%)", round( CASE WHEN "平均延迟(ms)" > 0 THEN "平均延迟(ms)" ELSE 0 END, 3 ) AS "平均延迟(ms)", round( CASE WHEN "P90延迟(ms)" > 0 THEN "P90延迟(ms)" ELSE 0 END, 3 ) AS "P90延迟(ms)", round( CASE WHEN "P99延迟(ms)" > 0 THEN "P99延迟(ms)" ELSE 0 END, 3 ) AS "P99延迟(ms)" FROM ( SELECT "host", count( 1 ) AS pv, sum( CASE WHEN "status" < 400 THEN 1 ELSE 0 END ) * 100.0 / count( 1 ) AS "访问成功率(%)", avg( request_time ) * 1000 AS "平均延迟(ms)",APPROX_QUANTILE_DS(request_time, 0.9) * 1000 AS "P90延迟(ms)", APPROX_QUANTILE_DS(request_time, 0.99) * 1000 AS "P99延迟(ms)" WHERE "host" != ''  GROUP BY "host" ) ORDER BY "平均延迟(ms)" desc

Host失败率TOP图表所关联的查询分析语句如下所示：

SELECT "host", pv,round( CASE WHEN "访问失败率(%)" > 0 THEN "访问失败率(%)" ELSE 0 END, 2 ) AS "访问失败率(%)", round( CASE WHEN "平均延迟(ms)" > 0 THEN "平均延迟(ms)" ELSE 0 END, 3 ) AS "平均延迟(ms)", round( CASE WHEN "P90延迟(ms)" > 0 THEN "P90延迟(ms)" ELSE 0 END, 3 ) AS "P90延迟(ms)", round( CASE WHEN "P99延迟(ms)" > 0 THEN "P99延迟(ms)" ELSE 0 END, 3 ) AS "P99延迟(ms)"  FROM ( SELECT "host", count( 1 ) AS pv, sum( CASE WHEN "status" >= 400 THEN 1 ELSE 0 END ) * 100.0 / count( 1 ) AS "访问失败率(%)", avg( request_time ) * 1000 AS "平均延迟(ms)", APPROX_QUANTILE_DS(request_time, 0.9) * 1000 AS "P90延迟(ms)", APPROX_QUANTILE_DS(request_time, 0.99) * 1000 AS "P99延迟(ms)" WHERE "host" != ''  GROUP BY "host"  ) ORDER BY "访问失败率(%)" desc

URL请求TOP图表所关联的查询分析语句如下所示：

SELECT router_request_uri, pv,uv, round( CASE WHEN "访问成功率(%)" > 0 THEN "访问成功率(%)" ELSE 0 END, 2 ) AS "访问成功率(%)", round( CASE WHEN "平均延迟(ms)" > 0 THEN "平均延迟(ms)" ELSE 0 END, 3 ) AS "平均延迟(ms)", round( CASE WHEN "入流量(KB)" > 0 THEN "入流量(KB)" ELSE 0 END, 3 ) AS "入流量(KB)", round( CASE WHEN "出流量(KB)" > 0 THEN "出流量(KB)" ELSE 0 END, 3 ) AS "出流量(KB)"  FROM ( SELECT router_request_uri, count( 1 ) AS pv, APPROX_COUNT_DISTINCT ( http_x_forwarded_for ) AS uv, sum( CASE WHEN "status" < 400 THEN 1 ELSE 0 END ) * 100.0 / count( 1 ) AS "访问成功率(%)", avg( request_time ) * 1000 AS "平均延迟(ms)", sum( request_length ) / 1024.0 AS "入流量(KB)", sum( body_bytes_sent ) / 1024.0 AS "出流量(KB)"  WHERE "host" != ''  GROUP BY router_request_uri  ) ORDER BY pv desc

URL延迟TOP图表所关联的查询分析语句如下所示：

SELECT router_request_uri, pv,round( CASE WHEN "访问成功率(%)" > 0 THEN "访问成功率(%)" ELSE 0 END, 2 ) AS "访问成功率(%)",round( CASE WHEN "平均延迟(ms)" > 0 THEN "平均延迟(ms)" ELSE 0 END, 3 ) AS "平均延迟(ms)",round( CASE WHEN "P90延迟(ms)" > 0 THEN "P90延迟(ms)" ELSE 0 END, 3 ) AS "P90延迟(ms)",round( CASE WHEN "P99延迟(ms)" > 0 THEN "P99延迟(ms)" ELSE 0 END, 3 ) AS "P99延迟(ms)" FROM (SELECT router_request_uri, count( 1 ) AS pv, sum( CASE WHEN "status" < 400 THEN 1 ELSE 0 END ) * 100.0 / count( 1 ) AS "访问成功率(%)", avg( request_time ) * 1000 AS "平均延迟(ms)", APPROX_QUANTILE_DS(request_time, 0.9) * 1000 AS "P90延迟(ms)", APPROX_QUANTILE_DS(request_time, 0.99) * 1000 AS "P99延迟(ms)" WHERE "host" != ''  GROUP BY router_request_uri  ) ORDER BY "平均延迟(ms)" desc

URL失败率TOP图表所关联的查询分析语句如下所示：

SELECT router_request_uri, pv, round( CASE WHEN "访问失败率(%)" > 0 THEN "访问失败率(%)" ELSE 0 END, 2 ) AS "访问失败率(%)", round( CASE WHEN "平均延迟(ms)" > 0 THEN "平均延迟(ms)" ELSE 0 END, 3 ) AS "平均延迟(ms)", round( CASE WHEN "P90延迟(ms)" > 0 THEN "P90延迟(ms)" ELSE 0 END, 3 ) AS "P90延迟(ms)", round( CASE WHEN "P99延迟(ms)" > 0 THEN "P99延迟(ms)" ELSE 0 END, 3 ) AS "P99延迟(ms)" FROM( SELECT router_request_uri, count( 1 ) AS pv, sum( CASE WHEN "status" >= 400 THEN 1 ELSE 0 END ) * 100.0 / count( 1 ) AS "访问失败率(%)", avg( request_time ) * 1000 AS "平均延迟(ms)", APPROX_QUANTILE_DS(request_time, 0.9) * 1000 AS "P90延迟(ms)", APPROX_QUANTILE_DS(request_time, 0.99) * 1000 AS "P99延迟(ms)" WHERE "host" != '' GROUP BY router_request_uri) ORDER BY "访问失败率(%)" desc

后端请求TOP图表所关联的查询分析语句如下所示：

SELECT addr, pv, uv, round( CASE WHEN "访问成功率(%)" > 0 THEN "访问成功率(%)" ELSE 0 END, 2 ) AS "访问成功率(%)", round( CASE WHEN "平均延迟(ms)" > 0 THEN "平均延迟(ms)" ELSE 0 END, 3 ) AS "平均延迟(ms)", round( CASE WHEN "入流量(KB)" > 0 THEN "入流量(KB)" ELSE 0 END, 3 ) AS "入流量(KB)", round( CASE WHEN "出流量(KB)" > 0 THEN "出流量(KB)" ELSE 0 END, 3 ) AS "出流量(KB)"  FROM ( SELECT upstream_addr as addr, count( 1 ) AS pv, APPROX_COUNT_DISTINCT ( http_x_forwarded_for ) AS uv, sum( CASE WHEN "status" < 400 THEN 1 ELSE 0 END ) * 100.0 / count( 1 ) AS "访问成功率(%)", avg( request_time ) * 1000 AS "平均延迟(ms)", sum( request_length ) / 1024.0 AS "入流量(KB)", sum( body_bytes_sent ) / 1024.0 AS "出流量(KB)"  WHERE "host" != ''  GROUP BY addr  having length(upstream_addr) > 2) ORDER BY "pv" desc

后端延迟TOP图表所关联的查询分析语句如下所示：

SELECT addr,pv,round( CASE WHEN "访问成功率(%)" > 0 THEN "访问成功率(%)" ELSE 0 END, 2 ) AS "访问成功率(%)",round( CASE WHEN "平均延迟(ms)" > 0 THEN "平均延迟(ms)" ELSE 0 END, 3 ) AS "平均延迟(ms)",round( CASE WHEN "P90延迟(ms)" > 0 THEN "P90延迟(ms)" ELSE 0 END, 3 ) AS "P90延迟(ms)",round( CASE WHEN "P99延迟(ms)" > 0 THEN "P99延迟(ms)" ELSE 0 END, 3 ) AS "P99延迟(ms)" FROM (SELECT upstream_addr as addr,count( 1 ) AS pv,sum( CASE WHEN "status" < 400 THEN 1 ELSE 0 END ) * 100.0 / count( 1 ) AS "访问成功率(%)",avg( request_time ) * 1000 AS "平均延迟(ms)",APPROX_QUANTILE_DS(request_time, 0.9) * 1000 AS "P90延迟(ms)",APPROX_QUANTILE_DS(request_time, 0.99) * 1000 AS "P99延迟(ms)" WHERE "host" != '' GROUP BY addr having length(upstream_addr) > 2) ORDER BY "平均延迟(ms)" desc

后端失败率TOP图表所关联的查询分析语句如下所示：

SELECT addr, pv, round( CASE WHEN "访问失败率(%)" > 0 THEN "访问失败率(%)" ELSE 0 END, 2 ) AS "访问失败率(%)", round( CASE WHEN "平均延迟(ms)" > 0 THEN "平均延迟(ms)" ELSE 0 END, 3 ) AS "平均延迟(ms)", round( CASE WHEN "P90延迟(ms)" > 0 THEN "P90延迟(ms)" ELSE 0 END, 3 ) AS "P90延迟(ms)", round( CASE WHEN "P99延迟(ms)" > 0 THEN "P99延迟(ms)" ELSE 0 END, 3 ) AS "P99延迟(ms)"  FROM ( SELECT upstream_addr as addr, count( 1 ) AS pv, sum( CASE WHEN "status" >= 400 THEN 1 ELSE 0 END ) * 100.0 / count( 1 ) AS "访问失败率(%)", avg( request_time ) * 1000 AS "平均延迟(ms)", APPROX_QUANTILE_DS(request_time, 0.9) * 1000 AS "P90延迟(ms)", APPROX_QUANTILE_DS(request_time, 0.99) * 1000 AS "P99延迟(ms)" WHERE "host" != ''  GROUP BY addr having length(upstream_addr) > 2) ORDER BY "访问失败率(%)" desc

查看ELB7层秒级监控

登录云日志服务控制台，在左侧导航栏中选择“日志管理”。
在“日志应用”模块中，单击“ELB日志中心”，选择“进入仪表盘”。

在仪表盘模板下方，选择“ELB仪表盘模板 > ELB7层秒级监控”，查看图表详情。

过滤所有负载均衡器，所关联的查询分析语句如下所示：
```
select distinct(lb_name)
```
过滤所有客户端IP，所关联的查询分析语句如下所示：
```
select distinct(remote_addr)
```
过滤所有后端服务器IP，所关联的查询分析语句如下所示：
```
select distinct(upstream_addr)
```
过滤所有弹性IP地址，所关联的查询分析语句如下所示：
```
select distinct(eip_address) 
```

相对时间：表示查询距离当前时间1分钟、5分钟、15分钟等时间区间的日志数据。例如当前时间为19:20:31，设置相对时间1小时，表示查询18:20:31~19:20:31的日志数据。
整点时间：表示查询最近整点1分钟、15分钟等时间区间的日志数据。例如当前时间为19:20:31，设置整点时间1小时，表示查询18:00:00~19:00:00的日志数据。
自定义：表示查询指定时间范围的日志数据。

QPS图展示QPS的变化情况，所关联的查询分析语句如下所示：

select TIME_FORMAT(TIME_CEIL(TIME_PARSE(SUBSTRING(time_iso8601, 2, 25) ,'yyyy-MM-dd''T''HH:mm:ssZZ'),'PT1S'),'yyyy-MM-dd HH:mm:ss','+08:00') AS _time_ , COUNT(*) as QPS from log group by _time_

成功率图展示成功率的变化情况，所关联的查询分析语句如下所示：

select __time,round(CASE WHEN "成功率" > 0 THEN "成功率" else 0 end,2) as "成功率" from (select TIME_FORMAT(TIME_CEIL(TIME_PARSE(SUBSTRING(time_iso8601, 2, 25) ,'yyyy-MM-dd''T''HH:mm:ssZZ'),'PT5S'),'yyyy-MM-dd HH:mm:ss','+08:00') as __time, sum(case when status < 400 then 1 else 0 end) * 100.0 / count(1) as '成功率' from log group by __time)

延迟图展示延迟的变化情况，所关联的查询分析语句如下所示：

select __time,round(CASE WHEN "访问延迟" > 0 THEN "访问延迟" else 0 end,2) as "访问延迟",round(CASE WHEN "Upstream延迟" > 0 THEN "Upstream延迟" else 0 end,2) as "Upstream延迟" from (select TIME_FORMAT(TIME_CEIL(TIME_PARSE(SUBSTRING(time_iso8601, 2, 25) ,'yyyy-MM-dd''T''HH:mm:ssZZ'),'PT5S'),'yyyy-MM-dd HH:mm:ss','+08:00') as __time, avg(request_time)* 1000 as '访问延迟',avg(upstream_response_time)* 1000 as 'Upstream延迟' from log group by __time)

流量图展示流量的变化情况，所关联的查询分析语句如下所示：

select TIME_FORMAT(__time, 'yyyy-MM-dd HH:mm:ss', '+08:00') AS __time, round(CASE WHEN "请求流量" > 0 THEN "请求流量" ELSE 0 END, 2) AS "请求流量",round(CASE WHEN "返回body流量" > 0 THEN "返回body流量" ELSE 0 END, 2) AS "返回body流量" from (select TIME_CEIL(TIME_PARSE(SUBSTRING(time_iso8601, 2, 25) ,'yyyy-MM-dd''T''HH:mm:ssZZ'), 'PT5S') as __time,          sum("request_length") / 1024.0 as "请求流量",          sum("body_bytes_sent") / 1024.0 as "返回body流量"        group by          __time      )

状态码图展示状态码的变化情况，所关联的查询分析语句如下所示：

select      TIME_FORMAT(t.t, 'yyyy-MM-dd HH:mm:ss', '+08:00') as "time",      CASE WHEN a."2XX" IS NOT NULL THEN CAST(a."2XX" AS BIGINT)        ELSE 0      END as "2XX",      CASE        WHEN b."3XX" IS NOT NULL THEN CAST(b."3XX" AS BIGINT)        ELSE 0      END as "3XX",      CASE        WHEN c."4XX" IS NOT NULL THEN CAST(c."4XX" AS BIGINT)        ELSE 0      END as "4XX",      CASE        WHEN d."5XX" IS NOT NULL THEN CAST(d."5XX" AS BIGINT)        ELSE 0      END as "5XX",      CASE        WHEN e."其他" IS NOT NULL THEN CAST(e."其他" AS BIGINT)        ELSE 0      END as "其他"    from      (        select          TIME_CEIL(TIME_PARSE(SUBSTRING(time_iso8601, 2, 25) ,'yyyy-MM-dd''T''HH:mm:ssZZ'),            'PT5S'          ) as t        from          log        group by          t        order by          t asc      ) t      left join (        select          TIME_CEIL(TIME_PARSE(SUBSTRING(time_iso8601, 2, 25) ,'yyyy-MM-dd''T''HH:mm:ssZZ'),            'PT5S'          ) as t,          CAST(COUNT(1) as VARCHAR) as "2XX"        from          log        WHERE          "status" >= 200          and "status" < 300        group by          t        order by          t asc      ) a on t.t = a.t      left join (        select          TIME_CEIL(TIME_PARSE(SUBSTRING(time_iso8601, 2, 25) ,'yyyy-MM-dd''T''HH:mm:ssZZ'),            'PT5S'          ) as t,          CAST(COUNT(1) as VARCHAR) as "3XX"        from          log        WHERE          "status" >= 300          and "status" < 400        group by          t        order by          t asc      ) b on t.t = b.t      left join (        select          TIME_CEIL(TIME_PARSE(SUBSTRING(time_iso8601, 2, 25) ,'yyyy-MM-dd''T''HH:mm:ssZZ'),            'PT5S'          ) as t,          CAST(COUNT(1) as VARCHAR) as "4XX"        from          log        WHERE          "status" >= 400          and "status" < 500        group by          t        order by          t asc      ) c on t.t = c.t      left join (        select          TIME_CEIL(TIME_PARSE(SUBSTRING(time_iso8601, 2, 25) ,'yyyy-MM-dd''T''HH:mm:ssZZ'),            'PT5S'          ) as t,          CAST(COUNT(1) as VARCHAR) as "5XX"        from          log        WHERE          "status" >= 500          and "status" < 600        group by          t        order by          t asc      ) d on t.t = d.t      left join (        select          TIME_CEIL(TIME_PARSE(SUBSTRING(time_iso8601, 2, 25) ,'yyyy-MM-dd''T''HH:mm:ssZZ'),            'PT5S'          ) as t,          CAST(COUNT(1) as VARCHAR) as "其他"        from          log        WHERE          "status" < 200          or "status" >= 600        group by          t        order by          t asc      ) e on t.t = e.t

后端响应码图展示后端响应码的变化情况，所关联的查询分析语句如下所示：

select TIME_FORMAT(t.t, 'yyyy-MM-dd HH:mm:ss', '+08:00') as "time",CASE WHEN a."2XX" IS NOT NULL THEN  CAST(a."2XX" AS BIGINT) ELSE 0 END as "2XX",CASE WHEN b."3XX" IS NOT NULL THEN  CAST(b."3XX" AS BIGINT) ELSE 0 END as "3XX",CASE WHEN c."4XX" IS NOT NULL THEN  CAST(c."4XX" AS BIGINT) ELSE 0 END as "4XX",CASE WHEN d."5XX" IS NOT NULL THEN  CAST(d."5XX" AS BIGINT) ELSE 0 END as "5XX",CASE WHEN e."其他" IS NOT NULL THEN  e."其他"  ELSE 0 END as "其他" from (select TIME_CEIL(TIME_PARSE(SUBSTRING(time_iso8601, 2, 25) ,'yyyy-MM-dd''T''HH:mm:ssZZ'),'PT5S') as t from log group by t order by t asc) t left join(select TIME_CEIL(TIME_PARSE(SUBSTRING(time_iso8601, 2, 25) ,'yyyy-MM-dd''T''HH:mm:ssZZ'),'PT5S') as t , CAST(COUNT(1) as VARCHAR) as "2XX" from log WHERE "upstream_status" >= 200 and "upstream_status" < 300 group by t order by t asc) a on t.t = a.t left join (select TIME_CEIL(TIME_PARSE(SUBSTRING(time_iso8601, 2, 25) ,'yyyy-MM-dd''T''HH:mm:ssZZ'),'PT5S') as t , CAST(COUNT(1) as VARCHAR) as "3XX" from log WHERE "upstream_status" >= 300 and "upstream_status" < 400 group by t order by t asc) b on t.t =b.t left join (select TIME_CEIL(TIME_PARSE(SUBSTRING(time_iso8601, 2, 25) ,'yyyy-MM-dd''T''HH:mm:ssZZ'),'PT5S') as t , CAST(COUNT(1) as VARCHAR) as "4XX" from log WHERE "upstream_status" >= 400 and "upstream_status" < 500 group by t order by t asc) c on t.t =c.t left join (select TIME_CEIL(TIME_PARSE(SUBSTRING(time_iso8601, 2, 25) ,'yyyy-MM-dd''T''HH:mm:ssZZ'),'PT5S') as t , CAST(COUNT(1) as VARCHAR) as "5XX" from log WHERE "upstream_status" >= 500 and "upstream_status" < 600 group by t order by t asc) d on t.t =d.t left join (select TIME_CEIL(TIME_PARSE(SUBSTRING(time_iso8601, 2, 25) ,'yyyy-MM-dd''T''HH:mm:ssZZ'),'PT5S') as t , CAST(COUNT(1) as VARCHAR) as "其他" from log WHERE "upstream_status" < 200 or "upstream_status" >= 600 group by t order by t asc) e on t.t =e.t

父主题： 日志仪表盘模板

上一篇：ELB仪表盘模板

下一篇：ER仪表盘模板

意见反馈

文档内容是否对您有帮助？

有帮助没帮助

提供反馈

提交成功！非常感谢您的反馈，我们会继续努力做到更好！您可在我的云声建议查看反馈及问题处理状态。

系统繁忙，请稍后重试

在使用文档中是否遇到以下问题

内容与产品页面不一致

内容不易理解

缺失示例代码

步骤不可操作

搜不到想要的内容

缺少最佳实践

意见反馈（选填）

0/500

请至少选择一项反馈信息并填写问题反馈

字符长度不能超过500

直接提交取消

如您有其它疑问，您也可以通过华为云社区问答频道来与我们联系探讨

智能客服提问云社区提问

ELB仪表盘模板（独享型）

前提条件

查看ELB7层访问中心

查看ELB7层监控中心

查看ELB7层秒级监控

相关文档

意见反馈

文档内容是否对您有帮助？

7*24

备案

专业服务

退订

建议反馈

售前咨询热线