Built-in dynamic metrics for OpenResty Edge

# Standard Metrics

# Request Count per Second

select count(*) /60.0 as qps
from http;

Name: qps_connections

Description: Statistics QPS(Queries Per Second), the number of request per second of the servers.

# Request Count per Minute

select count(*) as qpm
from http;

Name: qpm_connections

Description: Statistics on the number of request per minute of the servers.

# Status Code Distribution

select status, count(*)
from reqs
group by status;

Name: status_code_count

Description: Count the number of HTTP response status codes.

# Total Concurrent Connections

select sum(writing_conns), sum(reading_conns), sum(waiting_conns), sum(active_conns)
from http;

Name: connections

Description: Statistics of connections, including writing connections, reading connections, waiting connections and active connections.

# Top 10 URIs by Traffic Data Size

select uri, sum(total_size) as size
from reqs
group by uri
order by size desc
limit 10;

Name: uri_traffic_top_10

Description: Statistics of the top 10 request URIs by traffic data size.

# Top 10 URIs by Request Counts

select uri, count(*) as count
from reqs
group by uri
order by count desc
limit 10;

Name: uri_accesses_top_10

Description: Statistics of the top 10 URIs by request counts.

# Top 10 URIs by Average Latency

select uri, avg(latency_ms) as latency
from reqs
group by uri
order by latency desc
limit 10;

Name: average_latency_uri

Description: Statistics of the top 10 URIs in terms of average latency.

# HTTP Proxy Cache Hits & Misses

select sum(total_size) as bytes_total, upstream_cache_status, count(*)
from reqs
where upstream_cache_status != ''
group by upstream_cache_status;

Name: cache_hit_ratio

Description: Statistics HTTP proxy cache hits & misses, such as the count of hit, miss, bypass, updating, revalidated, stale, expired, etc.

# Response Compressed

select resp_is_compressed, count(*)
from reqs
group by resp_is_compressed;

Name: response_compressed

Description: Statistics on the number of responses compressed, we can see the number of compressed and the number of uncompressed.

# HTTP Versions

select http_ver, count(*)
from reqs
group by http_ver;

Name: http_version

Description: HTTP versions distribution statistics, such as the number of HTTP/1.0, HTTP/1.1, HTTP/2, HTTP/3, etc.

# SSL Encrypted Connections

select is_ssl, count(*)
from reqs
group by is_ssl;

Name: ssl_encrypted_connections

Description: Statistics on the distribution of SSL encrypted connections.

# Keepalive Connections

select keepalive, count(*)
from reqs
group by keepalive;

Name: keepalive_distribution

Description: Statistics on the distribution of keepalive connections.

# Top 10 Client Cities by Traffic Data Size

select client_city, count(*) as count
from reqs
group by client_city
order by count desc
limit 10;

Name: client_city_traffic_top_10

Description: Statistics of the top 10 client cities by traffic data size.

# Top 10 Client IPs by Traffic Data Size

select client_ip, sum(total_size) as size
from reqs
group by client_ip
order by size desc
limit 10;

Name: client_ip_traffic_top_10

Description: Statistics of the top 10 client IPs by traffic data size.

# Top 10 Client IPs by Request Counts

select client_ip, count(*) as count
from reqs
group by client_ip
order by count desc
limit 10;

Name: client_ip_accesses_top_10

Description: Statistics of the top 10 client IPs by request counts.

# Top 10 Client IPs by Average Latency

select client_ip, avg(latency_ms) as latency
from reqs
group by client_ip
order by latency desc
limit 10;

Name: average_latency_client_ip

Description: Statistics of the top 10 client IPs in terms of average latency.

# Traffic Map of Request Count

select count(*), client_city, client_latitude, client_longtitude, server_city, server_latitude, server_longtitude
from reqs
group by client_city, client_latitude, client_longtitude, server_city, server_latitude, server_longtitude;

Name: req_cnt_traffic

Description: Display global request traffic as a map.

# Traffic Map of Request Total Size

select sum(total_size), client_city, client_latitude, client_longtitude, server_city, server_latitude, server_longtitude
from reqs
group by client_city, client_latitude, client_longtitude, server_city, server_latitude, server_longtitude;

Name: total_sz_traffic

Description: Display global request total size as a map.

# Traffic Map of Response Total Size

select sum(resp_size), client_city, client_latitude, client_longtitude, server_city, server_latitude, server_longtitude
from reqs
group by client_city, client_latitude, client_longtitude, server_city, server_latitude, server_longtitude;

Name: total_resp_sz_traffic

Description: Display global response total size as a map.

# Top 10 Upstream Addresses by Average Latency

select upstream_addr, avg(upstream_total_time_ms) as latency
from reqs
group by upstream_addr
order by latency desc
limit 10;

Name: average_latency_upstream_addr

Description: Statistics of the top 10 upstream addresses in terms of average latency.

# WAF Metrics

# Top 10 Attack Types

select unnest(hit_types) as hit_type, count(*) as count
from waf_hits
where hit_status is true
group by hit_type order by count desc limit 10;

Name: waf_attack_types_top_10

Description: Statistics of the top 10 attack types.

# Top 10 Client IPs by Attack Sources

select client_ip, count(*) as count
from reqs left join waf_hits
where hit_status is true
group by client_ip order by count desc limit 10;

Name: waf_client_ips_attack_source_top_10

Description: Statistics of the top 10 client IPs by attack sources.

# Top 10 Client ISPs by Attack Sources

select client_isp, count(*) as count
from reqs left join waf_hits
where hit_status is true
group by client_isp order by count desc limit 10;

Name: waf_client_isps_attack_source_top_10

Description: Statistics of the top 10 client ISPs(Internet service providers) by attack sources.

# Top 10 URIs by Attack Requests

select ngx_var('orig_uri') as uri, count(*) as count
from reqs left join waf_hits
where hit_status is true
group by uri order by count desc limit 10;

Name: waf_attack_requests_top_10

Description: Statistics of the top 10 URIs by attack requests.

# Top 10 Hosts by Attack Requests

select host, count(*) as count
from reqs left join waf_hits
where hit_status is true
group by host order by count desc limit 10;

Name: waf_attack_hosts_top_10

Description: Statistics of the top 10 hosts by attack requests.

# Dos Metrics

# Delay and Block Requests

select limit_traffic_status, count(*) as count
from reqs
where limit_traffic_status != ''
group by limit_traffic_status;

Name: cc_delayed_and_blocked_requests

Description: Statistics of delay and block requests.

# Top 10 URIs by Delayed or Blocked Requests

select ngx_var('orig_uri') as uri, count(*) as count
from reqs
where limit_traffic_status != ''
group by uri order by count desc limit 10;

Name: cc_top_10_uri_delayed_and_blocked_requests

Description: Statistics of the top 10 URIs by delayed or blocked requests.

# Top 10 URIs by Delayed Requests

select ngx_var('orig_uri') as uri, count(*) as count
from reqs
where limit_traffic_status = 'delay'
group by uri order by count desc limit 10;

Name: cc_top_10_uri_delayed_requests

Description: Statistics of the top 10 URIs by delayed requests.

# Top 10 URIs by Blocked Requests

select ngx_var('orig_uri') as uri, count(*) as count
from reqs
where limit_traffic_status = 'block'
group by uri order by count desc limit 10;

Name: cc_top_10_uri_blocked_requests

Description: Statistics of the top 10 URIs by blocked requests.

# Top 10 Hosts by Delayed or Blocked Requests

select host, count(*) as count
from reqs
where limit_traffic_status != ''
group by host order by count desc limit 10;

Name: cc_top_10_host_delayed_and_blocked_requests

Description: Statistics of the top 10 hosts by delayed or blocked requests.

# Top 10 Hosts by Delayed Requests

select host, count(*) as count
from reqs
where limit_traffic_status = 'delay'
group by host order by count desc limit 10;

Name: cc_top_10_host_delayed_requests

Description: Statistics of the top 10 hosts by delayed requests.

# Top 10 Hosts by Blocked Requests

select host, count(*) as count
from reqs
where limit_traffic_status = 'block'
group by host order by count desc limit 10;

Name: cc_top_10_host_blocked_requests

Description: Statistics of the top 10 hosts by blocked requests.

# Top 10 Client IPs by Delayed or Blocked Requests

select client_ip, count(*) as count
from reqs
where limit_traffic_status != ''
group by client_ip order by count desc limit 10;

Name: cc_top_10_client_ips_delayed_and_blocked_requests

Description: Statistics of the top 10 client IPs by delayed or blocked requests.

# Top 10 Client IPs by Delayed Requests

select client_ip, count(*) as count
from reqs
where limit_traffic_status = 'delay'
group by client_ip order by count desc limit 10;

Name: cc_top_10_client_ips_delayed_requests

Description: Statistics of the top 10 client IPs by delayed requests.

# Top 10 Client IPs by Blocked Requests

select client_ip, count(*) as count
from reqs
where limit_traffic_status = 'block'
group by client_ip order by count desc limit 10;

Name: cc_top_10_client_ips_blocked_requests

Description: Statistics of the top 10 client IPs by blocked requests.

# Top 10 Delayed URIs by Average Latency

select ngx_var('orig_uri') as uri, avg(latency_ms) as count
from reqs
where limit_traffic_status = 'delay'
group by uri order by count desc limit 10;

Name: cc_top_10_delayed_uris_by_average_latency

Description: Statistics of the top 10 delayed URIs by average latency.