Ingestion metrics field reference for dashboards
This document describes the fields that you can use as measures when you create a new dashboard by using the Ingestion metrics Explore interface.
Dimensions and measures are building blocks of a dashboard. A dimension is a groupable field, which you can use to filter query results. A measure is a field that uses a SQL aggregate function, such as COUNT, SUM, AVG, MIN, or MAX. Any field computed based on the values of other measure values is also a measure.
For information about the dimension fields in the Ingestion metrics schema and example values, see Ingestion metrics schema.
The following table describes the additional fields that you can use as dimensions, filters, or measures:
Explore field | Type | Description |
timestamp | time | The Unix epoch time that represents the start time of the aggregated time interval associated with the log entry in microseconds. |
total_entry_number | sum | The number of logs ingested during the interval. |
total_entry_number_in_million | sum | The number of logs ingested in millions. |
total_error_count_in_million | sum | The count of the number of failed validation and parser errors in millions. |
total_size_bytes | sum | The log volume. |
total_size_bytes_GB | sum | The log volume in GB. |
total_size_bytes_GiB | sum | The log volume in GiB. |
total_events | sum | The count of validated events during normalization. |
total_error_events | sum | The count of events that failed validation or failed parsing during normalization. |
total_normalized_events | sum | The count of events that passed validation during normalization. |
total_validation_error_events | sum | The count of events that failed during normalization. |
total_parsing_error_events | sum | The count of events that failed to parse during normalization. |
period | string | The reporting period as selected by the Period Filter. Values include `This Period` and `Previous Period`. |
period_filter | date | The reporting period before the specified date or after the specified date. |