Observability
  • Log Service
    • Overview
    • Real-time Logs
      • Real-time Logs Overview
      • Push to EdgeOne Log Analysis
      • Push to Tencent Cloud CLS
      • Push to AWS S3-Compatible COS
      • Push to HTTP Server
    • Log Analysis (Beta)
      • Log Analysis(Beta) Overview
      • How to use Log Analysis filter condition
      • How to Modify Log Analysis Query Time Range
    • Offline Logs
    • Related References
      • Field description
        • L7 Access Logs
        • L4 Proxy Logs
        • Edge Function Running Logs
        • Managed Rule Logs
      • Real-Time Log Push Filter Conditions
      • Custom Log Push Fields
      • Customizing Log Output Formats
  • Data Analysis
    • Overview
    • Analytics
    • Web Security Analysis
    • Data Report
    • Related References
      • Sampling Statistics
      • How to use filter condition
      • How to Modify Query Time Range
      • How to Export Statistical Data and Reports
      • How to Use API to Implement Grouping Aggregation in a Single Call
  • AlarmService
    • Custom Statistical Metrics
Docs Overview/
Observability/
Data Analysis/
Related References/
How to use filter condition/

How to use filter condition

The filtering criteria supported by EdgeOne data analytics are categorized into two types:
1. Time filter (required): View data within the selected time range. For details, see How to Modify Query Time Range.
2. Other filter criteria: Customize the data you need based on the filter options supported by each page. The following section provides a detailed explanation of this part.

Supported filter options

Analytics

Filter Option Name
API parameter name
Description
Example value/Enum value
Can be used for metrics list
Site
ZoneId
EdgeOne site.
zone-3eoo0chifzcs
All metrics
Content identifier
ZoneId
Content identifier. This feature is currently in beta. If you need to use it, please contact us.
eocontent-3edho0x9tmea
L7 client traffic, L7 client bandwidth, L7 client requests, L7 client request rate
​​Host​​
domain
The Host requested by the client. If the website is onboarded to EdgeOne via a wildcard domain, the data will be recorded under the wildcard domain rather than the specific domain.
www.example.com or *.example.com
Country/Region
country
The country or region of the source of client requests. Country/Region follows the ISO 3166-1 alpha-2 standard.
CN
L7 client traffic, L7 client bandwidth, L7 client requests, L7 client request rate, L7 edge response time, TCP/UDP Application Metrics
Edge response status code
statusCode
The status code returned by EdgeOne to clients. Data from the last 30 days can be queried.
1XX: Status codes of the 1xx type.
2XX: Status codes of the 2xx type.
3XX: Status codes of the 3xx type.
4XX: Status codes of the 4xx type.
5XX: Status codes of the 5xx type.
An integer in the range [0,600).
L7 client traffic, L7 client bandwidth, L7 client requests, L7 client request rate
HTTP Protocol
protocol
The HTTP version used by client requests.
HTTP/1.0
HTTP/1.1
HTTP/2.0
HTTP/3: HTTP/3.0 (QUIC protocol)
WebSocket: WebSocket over HTTP/1.1
L7 client traffic, L7 client bandwidth, L7 client requests, L7 client request rate
ISP
isp
The ISP of the client IP. Only supports when client IPs are within Chinese mainland. Data from the last 30 days can be queried.
2: China Telecom;
26: China Unicom;
1046: China Mobile;
3947: China Tietong;
38: Education Network;
43: Great Wall Broadband;
0: Other ISPs.
L7 client traffic, L7 client bandwidth, L7 client requests, L7 client request rate, L7 edge response time
Province
province
The province of the client request source. Only supports when client IPs are within Chinese mainland. Data from the last 30 days can be queried.
Province codes refer to the province mapping table for mainland China, example value: 22.
L7 client traffic, L7 client bandwidth, L7 client requests, L7 client request rate, L7 edge response time
TLS version
tlsVersion
The TLS protocol version used by client requests. Data from the last 30 days can be queried.
TLS1.0
TLS1.1
TLS1.2
TLS1.3
L7 client traffic, L7 client bandwidth, L7 client requests, L7 client request rate
​​URL Path​​
url
The URL path of client requests, excluding query parameters. Data from the last 30 days can be queried.
/content or /content/test.jpg
L7 client traffic, L7 client bandwidth, L7 client requests, L7 client request rate
​​Referer​​
referer
The Referer header value of client requests, excluding query parameters. Data from the last 30 days can be queried.
http://www.example.com/
L7 client traffic, L7 client bandwidth, L7 client requests, L7 client request rate
Resource type
resourceType
The resource type of client requests, that is, the file extension of the requested resources. Data from the last 30 days can be queried.
.txt or .jpg
L7 client traffic, L7 client bandwidth, L7 client requests, L7 client request rate
Device type
deviceType
The device type of client requests, extracted from the User-Agent header. Data from the last 30 days can be queried.
TV: Television
Tablet: Tablet computer
Mobile: Mobile phone
Desktop: Computer
Other: Other
L7 client traffic, L7 client bandwidth, L7 client requests, L7 client request rate
Browser type
browserType
The browser type used in client requests, extracted and categorized from the User-Agent header. Data from the last 30 days can be queried.
Firefox: Firefox browser;
Chrome: Chrome browser;
Safari: Safari browser;
Other: Other browser types;
Bot: Search engine crawler;
MicrosoftEdge: Microsoft Edge browser;
IE: IE browser;
Opera: Opera browser;
QQBrowser: QQ Browser;
LBBrowser: LB Browser;
MaxthonBrowser: Maxthon browser;
SogouBrowser: Sogou Browser;
BIDUBrowser: Baidu Browser;
TaoBrowser: Tao Browser;
UBrowser: UC Browser;
L7 client traffic, L7 client bandwidth, L7 client requests, L7 client request rate
Client operating system
operatingSystemType
The operating system type used in client requests, extracted and categorized from the User-Agent header. Data from the last 30 days can be queried.
Linux
MacOS
Android
IOS
Windows
NetBSD
ChromiumOS
Bot: Search engine crawler
Other: Other operating systems
L7 client traffic, L7 client bandwidth, L7 client requests, L7 client request rate
Client IP version
ipVersion
The IP address version used by client requests. Data from the last 30 days can be queried.
4: IPv4;
6: IPv6.
L7 client traffic, L7 client bandwidth, L7 client requests, L7 client request rate, L7 edge response time
​​Request protocol
socket
The HTTP protocol type used by client requests.
HTTP
HTTPS
L7 client traffic, L7 client bandwidth, L7 client requests, L7 client request rate, L7 edge response time
Cache status
cacheType
Cache status of client requests.
hit: The request hits the EdgeOne node cache, and resources are served from the node cache. Partial cache hits are also recorded as hit.
miss: The request misses the EdgeOne node cache, and resources are provided by the origin server.
dynamic: The requested resources cannot be cached or are not configured to be cached at the node, and resources are provided by the origin server.
other: Unrecognized cache status. Requests responded to by edge functions are recorded as other.
L7 client traffic, L7 client bandwidth, L7 client requests, L7 client request rate
Whether the request has been mitigated by the Web Security module
mitigatedByWebSecurity
Indicates whether the request has been mitigated by the EdgeOne Web Security module. Interceptive or challenge actions are considered mitigated.
yes: Requests intercepted or challenged by the EdgeOne Web Security module. Excludes requests that didn't trigger security rules and requests with final actions of Monitor or Allow.
no: Requests responded by EdgeOne or the origin server after passing through EdgeOne Web Security module.
L7 client traffic, L7 client bandwidth, L7 client requests, L7 client request rate
Client IP
clientIp
The client IP address. Data from the last 30 days can be queried. Multiple values are supported when the operator is in/not in.
​​1.1.1.1
L7 client traffic, L7 client bandwidth, L7 client requests, L7 client request rate, L7 security policy hits
​​User-Agent​​
userAgent
The User-Agent header value of client requests. Data from the last 30 days can be queried.
Mozilla/5.0 (Windows; U; Windows NT 5.2; sk; rv:1.8.1.15) Gecko/20080623 Firefox/2.0.0.15
L7 client traffic, L7 client bandwidth, L7 client requests, L7 client request rate
L4 proxy forwarding rules
ruleId
Specific forwarding rules for L4 proxy instances.
rule-3ddvs7nn3xap
L4 proxy instance
proxyId
L4 proxy instance.
sid-3ddun6tk0l9k
Edge Function name
-
The unique identifier of an EdgeOne edge function instance.
test1-zone-3e25s02xxbxe-1257620286
Edge Function execution result
-
Edge function execution result.
Successful
Failed
DNS response code
-
DNS resolution response status code.
NOError: no error, successful response.
NXDomain: non-existent record.
NotImp: not implemented, DNS server does not support the requested query type; for implemented query types, refer to Record Type Introduction.
Refused: refused, the DNS server declined to perform the specified operation due to policy.
DNS queries
DNS record
-
DNS record type.
DNS queries
DNS region
-
Continent of client request source.
Asia
Europe
Africa
Oceania
America
DNS queries
Request handling result
-
Web Security rules' handling action.
Monitor
L7 security policy hits
Web Security rule ID
-
The ID of the Web Security rule that the request matched.
2186065971
L7 security policy hits
DDoS mitigation instance
-
DDoS mitigation instance.

EdgeOne Shield space
-
EdgeOne Shield space.


Web Security Analysis

Filtering is supported based on request characteristics, rule characteristics, and detailed features of Web Security rules and Bot management policies. Descriptions of specific filter options are as follows:
Site: EdgeOne site.
Client IP: View request data only from specified client IP addresses. Multiple values are supported, separated by line breaks.
Client IP region: The specified country or region from which the client IP originates.
Client IP (preferentially match XFF header): Only view request data from specified client IP addresses (preferentially match XFF header). Multiple values are supported, separated by line breaks.
Client IP region (preferentially match XFF header): The specified country or region from which the client IP (preferentially match XFF header) originates.
User-Agent: The User-Agent header information carried in client requests. Multiple values are supported, separated by line breaks.
Request URL: The URL of the client request (excluding the Host, only including the request path and query parameters). Multiple values are supported, separated by line breaks.
Domain name host: The Host of the client request. Multiple values are supported, separated by line breaks.
Source Referer: The Referer carried in client requests. Multiple values are supported, separated by line breaks.
Handling result: The final handling result of the request by the Web Security module. For detailed descriptions, see Handling Methods. The "Unknown" result indicates that no other defined method was executed, serving only as a fallback category for data statistics and this option can be ignored in routine analysis.
Request path: The URL Path of the client request (HTTP request path, excluding Host and query parameters). Multiple values are supported, separated by line breaks.
Request JA3 fingerprint: The JA3 fingerprint calculated based on parameters from the client's TLS handshake. Only supports domain data with Bot Management enabled.
Request JA4 fingerprint: The JA4 fingerprint calculated based on parameters from the client's TLS handshake. Only supports domain data with Bot Management enabled.
Request method: The HTTP Method of the client request.
Request ID: Used to uniquely identify a request. This refers to the Request ID on the default block page, the {{ EO_REQ_ID }} in a custom response page, the EO-LOG-UUID in the EdgeOne default response headers, and the RequestID in layer 7 access logs.
Rule category: Only view request data that triggers specified categories of Web Security rules.
Rule ID: Only view request data that triggers specified Web Security rule IDs.

Relationship between multiple filters

The relationship between multiple filter conditions is an "and" relationship, while the relationship between multiple values within the same filter condition is an "or" relationship.
For example, if the following filters are added at the same time: Client Region is in Singapore;Thailand and Edge Response Status Code is in 404, the query returns requests from clients in Singapore or Thailand and an edge response status code of 404.

Supported operators

Operator
Description
In
Data where the filter item equals any specified value.
Not in
Data where the filter item is not equal to any specified value.
Contain
Query data where fields such as URL, Referer, and resource type contain a specified string (for example, query data where the URL contains /example).
Not contain
Query data where fields such as URL, Referer, and resource type do not contain a specified string (for example, query data where the URL does not contain /example).
Start with
Query data where fields such as URL, Referer, and resource type prefix match a specified string.
Not start with
Query data where fields such as URL, Referer, and resource type do not prefix match a specified string.
End with
Query data where fields such as URL, Referer, and resource type suffix match a specified string.
Not end with
Query data where fields such as URL, Referer, and resource type do not suffix match a specified string.