Ingestion metrics field reference for dashboards

This document describes the fields that you can use as measures when you create a new dashboard by using the Ingestion metrics Explore interface.

Dimensions and measures are building blocks of a dashboard. A dimension is a groupable field, which you can use to filter query results. A measure is a field that uses a SQL aggregate function, such as COUNT, SUM, AVG, MIN, or MAX. Any field computed based on the values of other measure values is also a measure.

For information about the dimension fields in the Ingestion metrics schema and example values, see Ingestion metrics schema.

The following table describes the additional fields that you can use as dimensions, filters, or measures:

Explore field Type Description
timestamp time The Unix epoch time that represents the start time of the aggregated time interval associated with the log entry in microseconds.
total_entry_number sum The number of logs ingested during the interval.
total_entry_number_in_million sum The number of logs ingested in millions.
total_error_count_in_million sum The count of the number of failed validation and parser errors in millions.
total_size_bytes sum The log volume.
total_size_bytes_GB sum The log volume in GB.
total_size_bytes_GiB sum The log volume in GiB.
total_events sum The count of validated events during normalization.
total_error_events sum The count of events that failed validation or failed parsing during normalization.
total_normalized_events sum The count of events that passed validation during normalization.
total_validation_error_events sum The count of events that failed during normalization.
total_parsing_error_events sum The count of events that failed to parse during normalization.
period string The reporting period as selected by the Period Filter. Values include `This Period` and `Previous Period`.
period_filter date The reporting period before the specified date or after the specified date.