Real-Time Events quickstart
Open Real-Time Events, read the records of one data source, narrow them to a single request, and run the same query against the GraphQL API.
This guide instructs you through reading your first event record in Real-Time Events.
- Open Real-Time Events and identify the controls a search is built from.
- Read the records of the HTTP Requests data source over a period you set.
- Narrow the result to the records that carry one value.
- Open one record and read the fields the request wrote.
A search creates nothing. It is three choices, and every result comes from the combination of them:
- The data source is the index the records are read from. It decides which product’s records a search can return at all, and a search always names one.
- The Time Filter bounds the period. A record outside that period is not read, whatever else matches it.
- Filter by narrows what the first two selected. It never widens them.
The Real-Time Events GraphQL API makes the same three choices with a dataset name, a tsRange argument, and the other filter arguments on that dataset.
Prerequisites
Console
- An Azion account. To create one, refer to How to create an account on Azion.
- An application or a firewall already serving traffic, so the HTTP Requests data source holds records to read.
- Access to Azion Console. To sign in, refer to How to access Azion Console.
Open Real-Time Events
The records are reached two ways, and both read the same store.
Console
To open the page, access Azion Console > Products menu > Observe > Real-Time Events.
The page presents four controls:
- Data Sources selects the product whose records the search reads.
- Time Filter bounds the period the search covers.
- Filter by narrows the result to the records that match a value.
- Refresh, which reruns the search with the data source and period currently selected.
Those four controls are the whole search surface, and a search is one combination of them.
Search the records of one data source
HTTP Requests carries one record per request an application or a firewall received. The period a search can ask for is bounded by how long an event record is kept. For that bound and the others a query carries, refer to Limits.
Console
To read the records of one data source in Azion Console:
In Data Sources, select HTTP Requests.
In Time Filter, select Last 15 minutes, which is the period the filter opens on.
The records of that period appear in a table, one row per request.
Data Sources offers one entry per product that writes records. For each one and the variables it carries, refer to Data sources.
Narrow the search
A search over a period with no other condition returns every record in it. One value cuts that down to the records worth reading, and it is also what keeps a search inside the bounds the log database enforces.
Console
To narrow the result in Azion Console:
In Filter by, enter the following:
The table now holds only the records whose Status is 400.
Filter by reads SQL. key='value' matches a value exactly, key like '%value%' matches a similar one, and AND, OR, and NOT combine terms. For the full syntax and more examples, refer to Filter events.
Read one event record
A record carries far more than the few values a result list shows. Reading all of it is what the search was for.
Console
To open the whole record in Azion Console, select a row in the results table.
The More details view opens, carrying every variable of the selected data source for that one record. You now have the values a single request wrote, variable by variable.
For what each variable means, data source by data source, refer to Data sources. For how to read the values of one record, refer to Read an event record.