# Real-Time Events GraphQL API Fields

Each [GraphQL API dataset](/en/documentation/devtools/graphql-api/features/#datasets) has specific fields that can be used when querying for data from that dataset.

See each available field and their descriptions below.

---

## activityHistoryEvents (Activity History)

| Field | Description |
| ----- | ----------- |
| accountId | Account's identifier on Azion. Example: `8437` |
| authorEmail | Email address of the Azion Console user who performed the action. Example: `myemail@gmail.com` |
| authorName | Name of the Azion Console user who performed the action. Example: `Hannah` |
| clientId | Unique Azion client identifier. Example: `8437r` |
| comment | Editable space available for users to add comments when performing changes. Example: `Action performed during investigation` |
| parentResourceId | Unique identifier of the parent resource, if it exists. Example: `8190` |
| parentResourceType | Identifier of the parent resource type, if it exists. Example: `Application` |
| parentResourceName | Identifier of the parent resource name, if it exists. Example: `Application for domain xxx` |
| refererHeader | Header `Referer` from the page from which the API was called. Returns when the API call is made from an UI. Example: `Test 123` |
| remotePort | Port of the origin that generated the request. Example: `80` |
| resourceId | Unique identifier of the resource that was created or modified. Example: `1234` |
| resourceType | Identifier of the resource type that was created or modified. Example: `Application Request Rule` |
| resourceName | Identifier of the resource name that was created or modified. Example: `Rule abc` |
| requestData | Data received on the payload of the request generated by the user. Example: `{"test": 123}` |
| title | Title of the activity, composed of: model name, name, and type of activity. Example: `Pathorigin Default Origin was changed` |
| ts | Timestamp of when the event was created. Example: `2022-10-20T10:10:10` |
| type | Type of performed action on Azion Console: `CREATED`, `CHANGED`, `DELETED`, or `SIGNED UP` |
| userAgent | Header `User-Agent` sent in the request. Example: `curl 1.2.6` |
| userId | Unique identifier of the user that executed the action. Example: `999` |
| userIp | IP address of the user/origin that generated the request. Example: `127.0.0.1` |
| uuid | Unique request identifier. Example: `c09k4385-o8f4-9fb9-8088-238555dd` |

---

## functionConsoleEvents (previous cellsConsoleEvents) (Azion Runtime)

| Field | Description |
| ----- | ----------- |
| configurationId | Unique Azion configuration identifier set on virtual host configuration file. Example: `1595368520` |
| functionId | Unique Azion function identifier number. Can be found on Azion Console's function URL path or via API request. Example: `1111` |
| id | Request identifier. Aggregates multiple messages from a single request. Example: `240g95f04832f2872dd6e8ae308e8a73` |
| level | Message with the level type for the function. Can be `MDN`, `DEBUG`, `INFO`, `ERROR`, `LOG`, or `WARN` |
| line | Log message generated by the Cells platform. Example: `at async mainFetch (ext:deno_fetch/26_fetch.js:266:12)` |
| lineSource | Log message category. Example: `CONSOLE`, `RUNTIME` |
| solutionId | Unique Azion ID set on virtual host configuration file for the solution. Example: `1441740010` |
| ts | Timestamp of when the event was created. Example: `2022-10-20T10:10:10` |

---

## dataStreamedEvents (Data Stream)

| Field | Description |
| ----- | ----------- |
| configurationId | Unique Azion configuration identifier set on virtual host configuration file. Example: `1595368520` |
| dataStreamed | Total amount of data streamed, in bytes, to the configured endpoint. This field is the result of a sum. Example: `1270` |
| endpointType | Type of endpoint used in the configured Data Stream. Can be: `HTTP_POST`, `S3`, `ELASTICSEARCH`, `QRADAR`, `AWS_KINESIS_FIREHOSE`, `KAFKA`, `DATADOG`, `BIG_QUERY`, `SPLUNK`, `AZURE_MONITOR`, `AZURE_BLOB_STORAGE` |
| jobName | Unique Azion identifier for the type of stream created. Example: `Data Stream HTTP`, `Data Stream WAF` |
| statusCode | HTTP status code of the request. Example: `200` |
| streamedLines | Total amount of lines streamed to the configured endpoint. Maximum value of `2000`. This field is the result of a sum. Example: `837` |
| ts | Timestamp of when the event was created. Example: `2022-10-20T10:10:10` |
| url | The URL to which the client data was sent/sink. Example for a **HTTP POST** endpoint: `https://log-receiver.com:3000` |

---

## functionEvents (previous edgeFunctionsEvents) (Functions)

| Field | Description |
| ----- | ----------- |
| configurationId | Unique Azion configuration identifier set on virtual host configuration file. Example: `1595368520` |
| functionsInstanceIdList (previous edgeFunctionsInstanceIdList) | List of functions instances that were invoked during the request. Example: `10728` |
| functionsInitiatorTypeList (previous edgeFunctionsInitiatorTypeList) | List of initiators used in the function separated by `;`. Can be `1` (Applications) or `2` (Firewall). |
| functionsList (previous edgeFunctionsList) | List of functions that were invocated during the request, in order. The order begins from left to right, meaning functions on the left were invocated first. Example: `3324;43` |
| functionsSolutionId (previous edgeFunctionsSolutionId) | Identifier of your function. Example: `1321` |
| functionsTime (previous edgeFunctionsTime) | Total execution time, in seconds, for the function during its processing. This field is the result of a sum. Example: `0.021` |
| functionLanguage | Language used in the function. Example: `javascript` |
| ts | Timestamp of when the event was created. Example: `2022-10-20T10:10:10` |
| virtualHostId | Unique ID available on Azion Console. Set on virtual host configuration file. Example: `2410001a` |

---

## workloadEvents (previous httpEvents) (Applications, WAF)

| Field | Description |
| ----- | ----------- |
| bytesSent | Number of bytes sent to a client. This field is the result of a sum. Example: `191` |
| configurationId | Unique Azion configuration identifier. Set on virtual host configuration file. Example: `1595368520` |
| debugLog | Value of any variable from the request set through a new Rules Engine behavior. Example: `{\\\"idHash\\\":\\\"pQ04xXYD4JSYyOERu3mcwA==\\\",\\\"type\\\":\\\"product_screen_element_element_action\\\",\\\"message\\\":{\\\"event\\\":\\\"product_screen_element_element_action\\\",\\\"action\\\":\\\"value\\\",\\\"product\\\":\\\"value\\\",\\\"screen\\\":\\\"value\\\",\\\"element\\\":\\\"value\\\"},\\\"date\\\":\\\"2023-10-27T19:44:57.251Z\\\"}"` |
| geolocAsn | Autonomous System Number (ASN) Allocation queried from the MaxMind table. Example: `AS52580 Azion Technologies Ltda.` |
| geolocCountryName | Remote client’s country detected via IP address geolocation. Example: `United States`, `Russian Federation` |
| geolocRegionName | Remote client’s region detected via IP address geolocation. Example: `California`, `Rio Grande do Sul` |
| host | Host information sent on the request line. Stores: host name from the request line, or host name from the `Host` request header field, or the server name matching a request. Example: `hello.myhost.net` |
| httpReferer | Address of the page the user made the request from. Example: `https://example.com` |
| httpUserAgent | End user’s application, operating system, vendor, and/or version. Value of the `User-Agent` header. Example: `Mozilla/5.0 (Windows NT 10.0; Win64; x64)` |
| proxyStatus | HTTP error status code or origin when no response is obtained from the upstream. Example: `520`. **In case of cache, the response is `-`.** |
| requestId | Unique request identifier. Example: `5f222ae5938482c32a822dbf15e19f0f` |
| requestLength | Request length in bytes, including request line, headers, and body. This field is the result of a sum. Example: `167` |
| requestMethod | HTTP request method. Example: `GET` or `POST` |
| requestTime | Request processing time, in seconds, since the first bytes were read from the client. This field is the result of a sum. Example: `0.234` |
| requestUri | URI of the request made by the end user, without the host and protocol information and with arguments. Example: `/v1?v=bo%20dim` |
| remoteAddress | IP address of the origin that generated the request. Example: `127.0.0.1` |
| remotePort | Port of the origin that generated the request. Example: `8080` |
| scheme | Request scheme. Example: `HTTP` or `HTTPS` |
| serverProtocol | Version of the request protocol. Example: `HTTP/1.1`, `HTTP/2.0`, `HTTP/3.0` |
| sentHttpContentType | `Content-Type` header sent in the origin’s response. Example: `text/html; charset=UTF-8` |
| sentHttpXOriginalImageSize | `X-Original-Image-Size` header sent in the origin’s response. Used by IMS to inform original image size in bytes. Example: `987390` |
| sessionId | ID of the session set through virtual host configuration file based on location directive. Example: `f41eabd4-c172-43e4-ac21-d9f5fc427128` |
| serverAddr | IP address of the server that received the request. Example: `192.158.1.38`  |
| serverPort | Remote port of the server that received the request. Example: `443` |
| solutionId | Unique Azion ID set on virtual host configuration file for the solution. Example: `1441740010` |
| sslCipher | Cipher string used to establish TLS connection. Example: `TLS_AES_256_GCM_SHA384` |
| sslProtocol | Protocol for an established TLS connection. Example: `TLS v1.2` |
| sslServerName | Returns the session identifier of an established SSL connection. Example: `mywebsite.com` |
| sslSessionReused | Returns `r` if an SSL session was reused or `.` if it wasn't. |
| stacktrace | Provides the names of the Rules Engine from your application or your firewall that are run by the request. Example: `{\\\"edge_firewall\\\":[\\\"Global - Set WAF\\\"]}` |
| status | HTTP status code of the request. Example: `200` |
| streamName | ID set through virtual host configuration based on location directive. Set on virtual host configuration file. Example: `company_sector.sdp` |
| tcpinfoRtt | Round-Trip Time (RTT) in microseconds measured by the edge for the user. Available on systems that support the TCP_INFO socket option. Example: `72052` |
| ts | Timestamp of when the event was created. Example: `2022-10-20T10:10:10` |
| upstreamAddr | Client's IP address and port. Can also store multiple servers or server groups. Example: `192.168.1.1:80`. When the response is `127.0.0.1:1666`, the upstream is [Azion Cells Runtime](/en/documentation/runtime/overview/). |
| upstreamAddrStr | List with all `upstreamAddr` responses. |
| upstreamLocalAddr | Local IP address used by the edge to establish the connection with the origin server. It represents the outgoing (source) IP used when communicating with the upstream. Example: `10.0.12.34` |
| upstreamBytesReceived | Number of bytes received by the origin’s edge if the content isn’t cached. Example: `8304` |
| upstreamBytesReceivedStr | List with all `upstreamBytesReceived` responses. |
| upstreamBytesSent | Number of bytes sent to the origin. Example: `2733` |
| upstreamBytesSentStr | List with all `upstreamBytesSent` responses. |
| upstreamCacheStatus | Status of the local cache. Can be: `MISS`, `BYPASS`, `EXPIRED`, `STALE`, `UPDATING`, `REVALIDATED`, `HIT`, or `-` |
| upstreamConnectTime | Time it takes for the edge to establish a connection with the origin, in seconds. In the case of TLS, it includes time spent on handshake. Example: `0.123`. **Returns `0` for KeepAlive and `-` for cache** |
| upstreamConnectTimeStr | List with all `upstreamConnectTime` responses. |
| upstreamHeaderTime | Time it takes for the edge to receive the response header from the origin, in seconds. Example: `0.345`. **In case of cache, the response is `-`** |
| upstreamHeaderTimeStr | List with all `upstreamHeaderTime` responses. |
| upstreamResponseTime | Time it takes for the edge to receive a default response from the origin, in seconds, including headers and body. Example: `0.876`. **In case of cache, the response is `-`** |
| upstreamResponseTimeStr | List with all `upstreamResponseTime` responses. |
| upstreamStatus | HTTP status code of the origin. If a server can't be selected, the variable keeps the 502 (Bad Gateway) status code. Example: `200`. **In case of cache, the response is `-`**. |
| upstreamStatusStr | List with all `upstreamStatus` responses. |
| virtualhostId | Unique ID available on Azion Console set on virtual host configuration file. Example: `2410001a` |
| wafAttackFamily | Category or type of attack detected by the Web Application Firewall (WAF), based on their characteristics. Example: `$SQL`, `$RFI`, `$SQL`, `$XSS`, `$OTHERS` |
| wafBlock | Informs whether WAF blocked the action or not. `0` when action wasn’t blocked; `1` when action was blocked. When in *Learning Mode*, it won’t be blocked regardless of the return. |
| wafEvheaders | When the request headers sent by the user are analyzed by the WAF module and tagged as **blocked** with `$waf_block = 1`, it contains a base64 encoded string. Otherwise, it contains a dash character `-`. It applies to both WAF *Learning* or *Blocking* modes. |
| wafLearning | Informs if WAF is in Learning mode. Returns `0` if it isn't and `1` if it's. |
| wafMatch | List of infractions found in the end user’s request. It’s formed by key-value elements: the *key* refers to the type of violation detected; the *value* shows the string that generated the infraction. Example: `0:1402:HEADERS:cookie` |
| wafScore | Reports the score that will be increased in case of a match with the rules set for the WAF. Can be `SQL`, `XSS`, `TRAVERSAL`, `RFI`, or `-` |
| wafTotalBlocked | Total number of blocked requests. Example: `2` |
| wafTotalProcessed | Total number of processed requests. Example: `5` |

---

## edgeDnsQueriesEvents (Edge DNS)

| Field | Description |
| ----- | ----------- |
| level | Level of the log generator: `ERROR`, `WARN`, `INFO`, `DEBUG`, or `TRACE` |
| qtype | Definition of the [type of record](/en/documentation/products/secure/edge-dns/#types-of-supported-entries-and-the-respective-recommendations-of-edge-dns) that'll be used. Example: `PTR`, `A`, `AAAA`, `HTTPS`, `NS`, `SRV` |
| resolutionType | Method types used to resolve hosts. Example: `standard` |
| statusCode | HTTP status code of the request. Example: `200` |
| solutionId | Identifier of your Edge DNS instance. Example: `1321` |
| ts | Timestamp of when the event was created. Example: `2022-10-20T10:10:10` |
| uuid | Unique request identifier. Example: `b204b8c3-e463-4c3d-af3d-025703a4` |
| zoneID | Unique identifier of the Edge DNS zone. Example: `1340` |

---

## imageProcessedEvents (Image Processor)

| Field | Description |
| ----- | ----------- |
| bytesSent | Number of bytes sent to a client. This field is the result of a sum. Example: `191` |
| configurationId | Unique Azion configuration identifier set on virtual host configuration file. Example: `1595368520` |
| host | Host information sent on the request line. Stores: host name from the request line, or host name from the `Host` request header field, or the server name matching a request. Example: `hello.myhost.net` |
| httpReferer | Address of the page the user made the request from. Example: `https://example.com` |
| httpUserAgent | End user’s application, operating system, vendor, and/or version. Value of the `User-Agent` header. Example: `Mozilla/5.0 (Windows NT 10.0; Win64; x64)` |
| referenceError | Reference ID of the request. Generated when the status code is bigger than 400. Example: `#AECFE66100000000C947B9B3B3BFBE46FFFFFFFF9401`. Can also be `-` |
| remoteAddr | IP address of the origin that generated the request. Example: `127.0.0.1` |
| remotePort | Port of the origin that generated the request. Example: `8080` |
| requestMethod | HTTP request method. Example: `GET` or `POST` |
| requestTime | Request processing time, in seconds, since the first bytes were read from the client. This field is the result of a sum. Example: `0.234` |
| requestUri | URI of the request made by the end user, without the host and protocol information and with arguments. Example: `/v1?v=bo%20dim` |
| scheme | Request scheme. Example: `HTTP` or `HTTPS` |
| sentHttpContentType | `Content-Type` header sent in the origin’s response. Example: `text/html; charset=UTF-8` |
| serverProtocol | Version of the request protocol. Example: `HTTP/1.1`, `HTTP/2.0`, `HTTP/3.0` |
| solution | Identifier of your application. Example: `1321` |
| sslCipher | Cipher string used to establish TLS connection. Example: `TLS_AES_256_GCM_SHA384` |
| sslProtocol | Protocol for an established TLS connection. Example: `TLS v1.2` |
| sslSessionReused | Returns `r` if an SSL session was reused or `.` if it wasn't. |
| status | HTTP status code of the request. Example: `200` |
| tcpInfoRtt | Round-Trip Time (RTT) in microseconds measured by the edge for the user. Available on systems that support the TCP_INFO socket option. Example: `72052` |
| ts | Timestamp of when the event was created. Example: `2022-10-20T10:10:10` |
| upstreamCacheStatus | Status of the local cache. Can be: `MISS`, `BYPASS`, `EXPIRED`, `STALE`, `UPDATING`, `REVALIDATED`, `HIT`, or `-` |
| upstreamResponseTime | Time it takes for the edge to receive a default response from the origin, in seconds, including headers and body. This field is the result of a sum. Example: `0.876`. **In case of cache, the response is `-`** |
| upstreamResponseTimeStr | List with all `upstreamResponseTime` responses. |
| upstreamStatus | HTTP status code of the origin. If a server can't be selected, the variable keeps the 502 (Bad Gateway) status code. Example: `200`. **In case of cache, the response is `-`.** |
| upstreamStatusStr | List with all `upstreamStatus` responses. |

---

## tieredCacheEvents (Tiered Cache)

| Field | Description |
| ----- | ----------- |
| bytesSent | Number of bytes sent to a client. This field is the result of a sum. Example: `191` |
| cacheKey | The stored object cache identification key for the content requested by a client. Example: `/index.html` |
| cacheTtl | Time, in seconds, the cached object is considered valid (not expired). After the time expiration, when a new request occurs, Tiered Cache queries the data on the origin (upstream). Example: `31536000` |
| configurationId | Unique Azion configuration identifier set on virtual host configuration file. Example: `1595368520` |
| host | Host information sent on the request line. Stores: host name from the request line, or host name from the `Host` request header field, or the server name matching a request. Example: `hello.myhost.net` |
| proxyHost | Hostname being proxied. Example: `storage.googleapis.com:443` |
| proxyStatus | HTTP error status code or origin when no response is obtained from the upstream. Example: `520`. **In case of cache, the response is `-`.** |
| proxyUpstream | Origin (upstream) address. In some cases, the second origin can be Image Processor (IMS) to process the image and then cache it. Example: `ims_http` |
| referenceError | Reference ID of the request. Generated when the status code is `4xx` or `5xx`. Example: `#AECFE66100000000C947B9B3B3BFBE46FFFFFFFF9401`. Can also be `-` |
| remoteAddr | IP address of the origin that generated the request. Example: `127.0.0.1` |
| remotePort | Port of the origin that generated the request. Example: `8080` |
| requestLength | Request length, including request line, headers, and body. This field is the result of a sum. Example: `167` |
| requestMethod | HTTP request method. Example: `GET` or `POST` |
| requestTime | Request processing time, in seconds, since the first bytes were read from the client. This field is the result of a sum. Example: `0.234` |
| requestUri | URI of the request made by the end user, without the host and protocol information and with arguments. Example: `/v1?v=bo%20dim` |
| scheme | Request scheme. Example: `HTTP` or `HTTPS` |
| sentHttpContentType | `Content-Type` header sent in the origin’s response. Example: `text/html; charset=UTF-8` |
| serverProtocol | Version of the request protocol. Example: `HTTP/1.1`, `HTTP/2.0`, `HTTP/3.0` |
| solution | Identifier of your application. Example: `1321` |
| status | HTTP status code of the request. Example: `200` |
| tcpinfoRtt | Round-Trip Time (RTT) in microseconds measured by the edge for the user. Available on systems that support the TCP_INFO socket option. Example: `72052` |
| ts | Timestamp of when the event was created. Example: `2022-10-20T10:10:10` |
| upstreamBytesReceived | Number of bytes received by the origin’s edge if the content isn’t cached. Example: `8304` |
| upstreamBytesReceivedStr | List with all `upstreamBytesReceived` responses. |
| upstreamCacheStatus | Status of the local cache. Can be: `MISS`, `BYPASS`, `EXPIRED`, `STALE`, `UPDATING`, `REVALIDATED`, `HIT`, or `-` |
| upstreamConnectTime | Time it takes for the edge to establish a connection with the origin, in seconds. In the case of TLS, it includes time spent on handshake. Example: `0.123`. **Returns `0` for KeepAlive and `-` for cache** |
| upstreamHeaderTime | Time it takes for the edge to receive the response header from the origin, in seconds. Example: `0.345`. **In case of cache, the response is `-`** |
| upstreamResponseTime | Time it takes for the edge to receive a default response from the origin, in seconds, including headers and body. Example: `0.876`. **In case of cache, the response is `-`** |
| upstreamStatus | HTTP status code of the origin. If a server can't be selected, the variable keeps the 502 (Bad Gateway) status code. Example: `200`. **In case of cache, the response is `-`**. |

---

## telemetryDeviceInfoEvents (Azion Mobile SDK)

| Field | Description |
| ----- | ----------- |
| agent | Identifier of the Azion SDK version. Example: `AzionSDK-Android-v0.0.1` |
| azionFingerprint | Fingerprint generated by the SDK. Example: `1cc48e375c84610c1d90d93f80c03` |
| board | Name of the development board. Example: `goldfish_arm64` |
| bootloader | The version of the system's bootloader. Example: `unknown` |
| clientId | Unique Azion client identifier. Example: `8437r` |
| device | Name of the device, such as the codename or model name. Example: `emu64a` |
| deviceId | Device ID to identify an Android device. Example: `c2e38e0eb35a62f1` |
| displayResolution | For iOS devices, returns the screen size in [H]x[W] format. Example: `1179.0x2556.0` |
| fingerprint | Unique identifier of the build, usually including information about the device and system version. Example: `google/sdk_gphone64_arm64/emu64a:14/UE1A.230829.030/10921827:userdebug/dev-keys"` |
| hardware | Information about the device's hardware. Example: `ranch` |
| kernelVersion | Kernel version. Example: `6.1.23-android14-4-00257-g7e35917775b8-ab9964412` |
| manufacturer | Name of the device manufacturer. Example: `Google` |
| model | Device model name. Example: `sdk_gphone64_arm64` |
| osRelease | Operating system release version. Example: `15` |
| osType | Operating system type. Example: `16` |
| osVersion | Operating system version. Example: `18` |
| sdkVersion | Android SDK version number used to compile the application. Example: `34` |
| tags | Tags associated with the Android system build. Example: `dev-keys` |
| ts | Date and time of the request. Example: `2022-10-20T10:10:10` |
| user | User name performing the build. Example: `android-build` |
| version | Version of the Azion Cells log used. Example: `v2` |

---

## telemetrySensorsEvents (Azion Mobile SDK)

| Field | Description |
| ----- | ----------- |
| accelTs | List of timestamps at the moment of accelerometer sensor data collection. Example: `2023-12-14-T00:00:00` |
| accelX | List of values for the X-axis reading of the accelerometer. Example: `0.1` |
| accelY | List of values for the Y-axis reading of the accelerometer. Example: `0.343` |
| accelZ | List of values for the Z-axis reading of the accelerometer. Example: `0.243` |
| azionFingerprint | Fingerprint generated by the SDK. Example: `1cc48e375c84610c1d90d93f80c03` |
| clientId | Unique Azion client identifier. Example: `8437r` |
| gyroTs | List of timestamps at the moment of gyroscope sensor data collection. Example: `2023-12-14-T00:00:00` |
| gyroX | List of values for the X-axis reading of the gyroscope. Example: `0.1` |
| gyroY | List of values for the Y-axis reading of the gyroscope. Example: `0.343` |
| gyroZ | List of values for the Z-axis reading of the gyroscope. Example: `0.243` |
| touchTs | List of timestamps at the moment of touch screen events collection. Example: `2023-12-14-T00:00:00` |
| touchX | List of values for the X-axis reading of the touch screen. Example: `0.343` |
| touchY | List of values for the Y-axis reading of the touch screen. Example: `0.243` |
| ts | Date and time of the request. Example: `2022-10-20T10:10:10` |
| version | Version of the Azion Cells log used. Example: `v2` |

---

## Deprecated datasets

The following datasets were discontinued. It's recommended to use the [new datasets which replaced them](/en/documentation/devtools/graphql-api/features/#datasets).

### l2CacheEvents (Tiered Cache)

| Field | Description |
| ----- | ----------- |
| bytesSent | Number of bytes sent to a client. This field is the result of a sum. Example: `191` |
| cacheKey | The stored object cache identification key for the content requested by a client. Example: `/index.html` |
| cacheTtl | Time, in seconds, the cached object is considered valid (not expired). After the time expiration, when a new request occurs, L2 Caching queries the data on the origin (upstream). Example: `31536000` |
| configurationId | Unique Azion configuration identifier set on virtual host configuration file. Example: `1595368520` |
| host | Host information sent on the request line. Stores: host name from the request line, or host name from the `Host` request header field, or the server name matching a request. Example: `hello.myhost.net` |
| proxyHost | Hostname being proxied. Example: `storage.googleapis.com:443` |
| proxyStatus | HTTP error status code or origin when no response is obtained from the upstream. Example: `520`. **In case of cache, the response is `-`.** |
| proxyUpstream | Origin (upstream) address. In some cases, the L2 origin can be Image Processor (IMS) to process the image and then cache it. Example: `ims_http` |
| referenceError | Reference ID of the request. Generated when the status code is `4xx` or `5xx`. Example: `#AECFE66100000000C947B9B3B3BFBE46FFFFFFFF9401`. Can also be `-` |
| remoteAddr | IP address of the origin that generated the request. Example: `127.0.0.1` |
| remotePort | Port of the origin that generated the request. Example: `8080` |
| requestLength | Request length, including request line, headers, and body. This field is the result of a sum. Example: `167` |
| requestMethod | HTTP request method. Example: `GET` or `POST` |
| requestTime | Request processing time, in seconds, since the first bytes were read from the client. This field is the result of a sum. Example: `0.234` |
| requestUri | URI of the request made by the end user, without the host and protocol information and with arguments. Example: `/v1?v=bo%20dim` |
| scheme | Request scheme. Example: `HTTP` or `HTTPS` |
| sentHttpContentType | `Content-Type` header sent in the origin’s response. Example: `text/html; charset=UTF-8` |
| serverProtocol | Request protocol. Example: `HTTP/1.1`, `HTTP/2.0`, `HTTP/3.0` |
| solution | Identifier of your application. Example: `1321` |
| status | HTTP status code of the request. Example: `200` |
| tcpinfoRtt | Round-Trip Time (RTT) measured by the edge for the user. Available on systems that support the TCP_INFO socket option. Example: `72052` |
| ts | Timestamp of when the event was created. Example: `2022-10-20T10:10:10` |
| upstreamBytesReceived | Number of bytes received by the origin’s edge if the content isn’t cached. Example: `8304` |
| upstreamBytesReceivedStr | List with all `upstreamBytesReceived` responses. |
| upstreamCacheStatus | Status of the local cache. Can be: `MISS`, `BYPASS`, `EXPIRED`, `STALE`, `UPDATING`, `REVALIDATED`, `HIT`, or `-` |
| upstreamConnectTime | Time it takes for the edge to establish a connection with the origin, in seconds. In the case of TLS, it includes time spent on handshake. Example: `0.123`. **Returns `0` for KeepAlive and `-` for cache** |
| upstreamHeaderTime | Time it takes for the edge to receive the response header from the origin, in seconds. Example: `0.345`. **In case of cache, the response is `-`** |
| upstreamResponseTime | Time it takes for the edge to receive a default response from the origin, in seconds, including headers and body. Example: `0.876`. **In case of cache, the response is `-`** |
| upstreamStatus | HTTP status code of the origin. If a server can't be selected, the variable keeps the 502 (Bad Gateway) status code. Example: `200`. **In case of cache, the response is `-`**. |

---

### idnsQueriesEvents (Edge DNS)

| Field | Description |
| ----- | ----------- |
| level | Level of the log generator: `ERROR`, `WARN`, `INFO`, `DEBUG`, or `TRACE` |
| qtype | Definition of the [type of record](/en/documentation/products/secure/edge-dns/#types-of-supported-entries-and-the-respective-recommendations-of-edge-dns) that'll be used. Example: `PTR`, `A`, `AAAA`, `HTTPS`, `NS`, `SRV` |
| resolutionType | Method types used to resolve hosts. Example: `standard` |
| statusCode | HTTP status code of the request. Example: `200` |
| solutionId | Identifier of your Edge DNS instance. Example: `1321` |
| ts | Timestamp of when the event was created. Example: `2022-10-20T10:10:10` |
| uuid | Unique request identifier. Example: `b204b8c3-e463-4c3d-af3d-025703a4` |
| zoneID | Unique identifier of the Edge DNS zone. Example: `1340` |