This topic describes the key fields in Anti-DDoS Origin.

Log field Description
__topic__ The topic of a log entry. Valid value: ddos_access_log.
data_type Log type
event_type The type of an event.
ip The IP address from which the request is sent.
subnet The CIDR block of the instance that you want to reroute.
event_time The date when an event occurs, for example, 2020-01-01.
qps The number of queries per second when the event occurred.
pps_in The inbound traffic when the event occurred. Unit: pps.
new_con The new connection that is established when an event occurs.
kbps_in The inbound traffic when an event occurs. Unit: bit/s.
instance_id The ID of an instance.
time The time when a log is generated, for example, 2020-07-17 10:00:30.
destination_ip The IP address of a destination server.
port The destination port.
total_traffic_in_bps The total amount of inbound traffic. Unit: bit/s.
total_traffic_drop_bps The amount of inbound traffic that is dropped. Unit: bit/s.
total_traffic_in_pps The total amount of inbound traffic. Unit: pps.
total_traffic_drop_pps The amount of inbound traffic that is dropped. Unit: pps.
pps_types_in_tcp_pps The inbound TCP traffic that is measured by protocol. Unit: pps.
pps_types_in_udp_pps The inbound UDP traffic that is measured by protocol. Unit: pps.
pps_types_in_icmp_pps The inbound ICMP traffic that is measured by protocol. Unit: pps.
pps_types_in_syn_pps The inbound SYN traffic that is measured by protocol. Unit: pps.
pps_types_in_ack_pps The inbound ACK traffic that is measured by protocol. Unit: pps.
user_id The ID of an Alibaba Cloud account.