Ingestion metrics field reference for dashboards

The Ingestion metrics Explore interface provides a variety of measure fields that you can use to create new dashboards. Dimensions and measures are the fundamental components of a dashboard. A dimension is a field that can be used to filter query results by grouping data. A measure is a field that calculates a value using a SQL aggregate function, such as COUNT, SUM, AVG, MIN, or MAX. Any field derived from other measure values is also considered a measure.

For information about the dimension fields and ingestion metrics schemas, see Ingestion metrics schema.

Ingestion metrics fields

The following table describes the additional fields that you can use as dimensions, filters, and measures:

Use case: Sample query

The following table contains values for a sample query:

The table has 4 components:

1. Forward
2. Ingestion API
3. Normalizer
4. Out Of Band (OOB)

Logs can be ingested to Google SecOps by OOB, the Forwarder, direct customer calls to Ingestion API, or internal service calls to the Ingestion API (for example, ETD, HTTPS Push webhooks, or Azure event hub integration).

All logs ingested into Google Security Operations flow through the Ingestion API. After that, the logs are normalized by the Normalizer component.

Log count

• Number of ingested logs:

SELECT
  *
FROM
  `chronicle-catfood.datalake.ingestion_metrics`
WHERE
  log_count IS NOT NULL
  AND component = 'Ingestion API'
LIMIT
  2 ;

• Volume of ingested logs:

SELECT
  *
FROM
  `chronicle-catfood.datalake.ingestion_metrics`
WHERE
  log_volume IS NOT NULL
  AND component = 'Ingestion API'
LIMIT
  2 ;

1. Apply the logtype or collectorID filter, and in the WHERE clause, add log_type = <LOGTYPE> or collector_id = <COLLECTOR_ID>.
2. Select Add GROUP BY in the query with the appropriate field to perform a group query.

The Normalizer component handles parsing errors, which occur when events are generated. These errors are recorded in the drop_reason_code and state columns.