This topic describes the fields of access logs in Anti-DDoS Origin.

Log field Description
__topic__ The topic of a log entry. Valid value: ddosbqp_access_log.
data_type The type of a log entry.
event_type The type of an event.
ip The IP address from which the request is sent.
subnet The CIDR block of the instance that is rerouted.
event_time The date when an event occurs, for example, 2020-01-01.
qps The number of queries per second when an event occurs.
pps_in The rate of inbound traffic when an event occurs. Unit: packets per second (pps).
new_con The new connection that is established when an event occurs.
kbps_in The rate of inbound traffic when an event occurs. Unit: bit/s.
instance_id The ID of an instance.
time The time when a log is generated, for example, 2020-07-17 10:00:30.
destination_ip The IP address of a destination server.
port The destination port.
total_traffic_in_bps The rate of total inbound traffic. Unit: bit/s.
total_traffic_drop_bps The rate of total inbound traffic that is dropped. Unit: bit/s.
total_traffic_in_pps The rate of total inbound traffic. Unit: pps.
total_traffic_drop_pps The rate of total inbound traffic that is dropped. Unit: pps.
pps_types_in_tcp_pps The rate of inbound TCP traffic that is measured by protocol. Unit: pps.
pps_types_in_udp_pps The rate of inbound UDP traffic that is measured by protocol. Unit: pps.
pps_types_in_icmp_pps The rate of inbound ICMP traffic that is measured by protocol. Unit: pps.
pps_types_in_syn_pps The rate of inbound SYN traffic that is measured by protocol. Unit: pps.
pps_types_in_ack_pps The rate of inbound ACK traffic that is measured by protocol. Unit: pps
user_id The ID of an Alibaba Cloud account.