Ingestion metrics field reference for dashboards

This document describes the fields that you can use as measures when you create a new dashboard by using the Ingestion metrics Explore interface.

Dimensions and measures are building blocks of a dashboard. A dimension is a groupable field, which you can use to filter query results. A measure is a field that uses a SQL aggregate function, such as COUNT, SUM, AVG, MIN, or MAX. Any field computed based on the values of other measure values is also a measure.

For information about the dimension fields in the Ingestion metrics schema and example values, see Ingestion metrics schema.

The following table describes the additional fields that you can use as dimensions, filters, or measures:

Explore field	Type	Description
timestamp	time	The Unix epoch time that represents the start time of the aggregated time interval associated with the log entry in microseconds.
total_entry_number	sum	The number of logs ingested during the interval.
total_entry_number_in_million	sum	The number of logs ingested in millions.
total_error_count_in_million	sum	The count of the number of failed validation and parser errors in millions.
total_size_bytes	sum	The log volume.
total_size_bytes_GB	sum	The log volume in GB.
total_size_bytes_GiB	sum	The log volume in GiB.
total_events	sum	The count of validated events during normalization.
total_error_events	sum	The count of events that failed validation or failed parsing during normalization.
total_normalized_events	sum	The count of events that passed validation during normalization.
total_validation_error_events	sum	The count of events that failed during normalization.
total_parsing_error_events	sum	The count of events that failed to parse during normalization.
period	string	The reporting period as selected by the Period Filter. Values include `This Period` and `Previous Period`.
period_filter	date	The reporting period before the specified date or after the specified date.