Why did my hit ratio drop?
proxy_cache_status = MISSrequest_uri
One path stopped being cacheable - rarely the one you would guess.
[
Edgesight · Instant Logs]
Find any requestwithin seconds.
Medianova, Cloudflare and Akamai logs in one live view, on one timeline. Filter by any value, chart the volume, export the result. No query language.
Last 15 minutes
Filters
Log Volume
Available Fields
200
304
404
502
500
HIT
MISS
BYPASS
EXPIRED
TR
DE
US
FR
NL
GET
POST
PUT
HEAD
20:14:32.441200GET/api/checkoutTR
20:14:32.218502POST/api/checkoutDE20:14:31.904200GET/static/app.cssTR
20:14:31.650502POST/api/checkoutTR20:14:31.512304GET/static/app.jsUS20:14:30.880200GET/cdn/video.mp4DE20:14:30.402502POST/api/checkoutTR20:14:30.221404GET/api/v1/userFR20:14:29.713200GET/healthTR20:14:29.102500PUT/api/orders/9921NL20:14:28.660200GET/img/hero.avifTR20:14:28.215200HEAD/index.htmlUSNo results
Instant Logs in numbers
- Fields captured per request, every one of them on Medianova traffic
- 47
- CDNs on one timeline: Medianova, Cloudflare and Akamai
- 3
- Filter operators, from equality to LIKE and numeric comparisons
- 10
- Fastest auto refresh, so a live query keeps up
- 5 s
INVESTIGATE
Start with everything. Finish with the cause.
Start from every request you have, then narrow it one click at a time until only the problem is left. No query to write.
Filters Add filter
Available Fields
statustop 520094.8%45,693,600
3043.1%1,494,200
4041.2%578,400
3010.8%385,600
5020.03%12,417
Nothing looks wrong. The 12,417 failures are 0.03% of the hour - the line is flat because they are buried, not because they are absent.
Available Fields
server_nametop 5shop.example.com96.5%11,980
api.example.com1.9%240
cdn.example.com0.8%105
www.example.com0.5%62
static.example.com0.2%30
One property owns 96.5% of the failures. The shape of a problem is already visible in the chart.
Available Fields
request_uritop 5/api/checkout76.8%9,204
/api/cart12.4%1,485
/api/session6.3%755
/assets/app.js3.1%371
/health1.4%165
Three quarters of them land on one endpoint - and it is the one that takes money.
Available Fields
upstream_addrtop 510.0.4.1294.6%8,707
10.0.4.93.1%285
10.0.4.71.8%166
10.0.4.110.4%34
10.0.4.80.1%12
One origin holds 94.6% of what is left, and the noise around it is gone. There is the cause, and there is when it started.
Press + on the top value, or wait.
Log Volume · 48.2M events · 5m buckets
14:0014:0514:1014:1514:2014:2514:3014:3514:4014:4514:5014:55
akamaidatacloudflaredataMedianova Data
What the chart is telling you
14:30Last clean bucketTwo matching requests in the previous half hour. Noise, not a pattern.
14:35It starts502s on /api/checkout begin - all three sources report them in the same bucket.
14:40It more than doublesupstream_addr 10.0.4.12 now holds 94.6% of everything that matches.
14:55Still goingNo recovery. One origin, one endpoint, one start time - and 9,204 requests.
All three CDNs saw the 502s in the same bucket, so it is not one edge. upstream_addr, which Medianova and Cloudflare report, puts every one of them on 10.0.4.12. Four filters, no query language.
ANY QUESTION
Your question will be a different one. The motion is the same.
Narrow, open a field, read the distribution, narrow again. The same four moves answer questions that have nothing to do with errors.
What is eating my bandwidth?
bytes_sent > 1000000request_uri
A handful of large objects on a handful of paths.
Who is hammering my origin?
proxy_cache_status ≠ HITremote_addr
One client pulling more than everyone else combined.
Which bot is crawling me?
http_user_agent ~ botcountry_code
Where it comes from, what it asks for, and what it costs your origin.
The 35 fields you can filter on and the 32 you can break down are the same in every one of these.See every field
SOURCES
Three CDNs, one schema, two ways in
Medianova, Cloudflare and Akamai are all supported. Medianova logs flow on their own; Cloudflare and Akamai send theirs to an endpoint of your own.
We pullMedianova
Your own CDN. Nothing to configure anywhere else.
- 1Choose an organizationLogs from the organization you pick are ingested.
- 2Name the instanceIt defaults to the organization name. That is the whole setup.
- 3Logs start flowingAs soon as the pipeline is active, in about a minute.
Nothing to paste, nothing to configure on your side.
You pushCloudflare & Akamai
The CDN you already run, pointed at an endpoint that is only yours.
- 1Name your endpointInstant Logs shows its ingest URL as you type.
- 2We provision itAn isolated ingest endpoint, its own stream and an API token.
- 3Point your provider at itLogpush or DataStream with your token as an apikey header.
Setup confirms by itself the moment your first events land.
Medianova
We pull it from your organizations47 of 47 fields
The reference schema, every field populated.
Cloudflare
Logpush, into your endpoint32 of 48 fields
Brings content_type, which no other source has.
Akamai
DataStream, into your endpoint21 of 47 fields
Fewer fields in the shared schema, origin-side timings among them.
A field a provider does not send stays in the table, empty, so records from every source line up. With several sources selected, filters offer the fields they share.Field reference
You keep the CDN you have: no agent to install, nothing to migrate.
YOUR DATA
Where it lands, and who can open it
Request logs are sensitive operational data. Here is where they are stored and how they reach you.
Your region is settled when you subscribe
You choose a storage region with your plan. It applies to the whole organization: every source you add stores its logs there.
An endpoint of your own
Cloudflare and Akamai each send to a dedicated ingest endpoint and stream, authenticated by an API token that is shown once, at setup.
Your logs, kept apart
Your organization's logs are stored in a logically isolated database with dedicated credentials.
How long logs stay queryable depends on your plan. To keep every record for longer, Logpush delivers them to your own storage.
FEATURES
Everything you need to read your traffic
Built for teams running on a CDN who need answers in seconds, not dashboards to babysit.
200/api/checkout
502/api/checkout
502/api/checkout
status502
upstream_addr10.0.4.12
+45 more fieldsJSON
EXPLORE
The whole request, not a summary
Every request that hit your edge, one row each. Pick a window from fifteen minutes to seven days; status and cache results are colour-coded, and clicking any row opens all 47 fields.
proxy_cache_statusMISS64.2%+−
status = 502country_code = TRproxy_cache_status ≠ HITbytes_sent > 1000000
FILTER
Filter without a query language
No query language to write. Every value carries a plus and a minus - filter for it, or filter it out. Ten operators across 35 filterable fields.
30s buckets · 48.2M events
no filtersVISUALIZE
Volume at a glance, drill in with a click
Request volume, bucketed for your window. Bars or line; stack sources, separate them, or total them. Click a bucket and the chart and table zoom in together.
country_code18 unique · 48,200,000 eventsTR62.4%
DE18.1%
US9.3%
FR4.2%
NL2.6%
13 more values not shown
ANALYZE
See what is actually in your traffic
Open a field and read its distribution: the top values with their share, the unique count and the total. 32 of the 47 fields break down this way.
ExportCSVNDJSON
continuous? Edgesight Logpush
EXPORT
Take it with you, up to a point
Export the complete result set for your filters and time range as CSV or NDJSON, not just the rows on screen. Up to 200,000 rows per export; for continuous delivery, Logpush streams your logs to your own storage.
COMING FROM RAW LOGS
Raw Logs is now Instant Logs
Instant Logs replaces Raw Logs. What you did there still works here, with more ways to find the request you are after.
| Capability | Raw Logs | Instant Logs |
|---|---|---|
| Volume over time | Not available | Log Volume chart, zoom into any bucket |
| Filtering | A form applied to the table | Filters apply to the chart, the table and field statistics together |
| Operators | Equality | Ten, including contains, LIKE and numeric comparisons |
| Request detail | Not available | Every captured field, raw JSON and copy |
| Sources | Medianova only | Medianova, Cloudflare and Akamai on one timeline |
| Export | CSV of the visible rows | CSV or NDJSON of the complete filtered result set, in parts, per source |
Edit Columns is now Available Fields: it picks your columns and shows each field’s distribution.
HOW IT WORKS
From edge to insight in four steps
Pick a CDN source and Instant Logs builds the pipeline for you, in about a minute. Nothing to run yourself.
Pick a source
Medianova, Cloudflare or Akamai
Configure
Name it, or get your ingest URL
Deploy
Your pipeline, in about a minute
First logs
Setup confirms the first events
Start reading your CDN traffic today
Start with a free trial on your own traffic. Your pipeline deploys in about a minute.
Start free trial