01
Edge Log Analytics
Normalize request, cache, routing, timing, and policy fields into a model that answers operational questions.
Analyze the edge
CDN logging knowledge base
See what happened at the edge. Explain what happens next.
CDNLog.com is a practical reference for edge log analytics, CDN monitoring, real-time log delivery, HTTP performance analysis, retention design, and security investigations—without vendor-specific guesswork.
- Vendor-neutral schemas
- Clean implementation patterns
- Operationally useful metrics
Core topics
From event to decision
A complete map of edge visibility
Use request-level evidence to understand performance, reliability, security, cost, and user-facing outcomes across the delivery path.
02
CDN Monitoring
Derive stable metrics, SLIs, dashboards, and alerts without turning every high-cardinality event into a time series.
Build useful monitoring03
Log Streaming API
Design ingestion, retries, redaction, schema evolution, backpressure, replay, and dual real-time/archive paths.
Design the pipeline04
HTTP Performance
Separate cache, connection, first-byte, transfer, route, region, and origin effects to locate where time changed.
Trace latency05
Security Log Analysis
Detect material changes in behavior, correlate policy outcomes, protect sensitive fields, and control alert noise.
Investigate securely06
Retention & Governance
Balance hot search, warm analytics, raw replay, long-term aggregates, deletion, access control, and total cost.
Plan retentionReference architecture
One event model. Two delivery paths. Many decisions.
Keep the fast path small and actionable. Send the complete source to durable storage. Tie both to the same request identity, schema version, and data-quality signals.
- Receive and validate: authenticate delivery, decompress safely, enforce limits, and reject malformed records visibly.
- Redact and normalize: remove sensitive values before fan-out and map provider fields into a canonical envelope.
- Stream and archive: deliver a compact operational event quickly while retaining replayable source records.
- Measure the pipeline: monitor lag, coverage, duplicates, parse failures, schema drift, and consumer health.
Operational signal set
Metrics that keep their meaning
A strong dashboard separates user outcomes, delivery behavior, and data-pipeline health instead of mixing them into one generic traffic chart.
Delivery freshnessobserved − eventKnow whether the data is current enough to act on.
Eligible cache ratiohits / eligibleKeep bypasses and uncacheable traffic out of the denominator.
Origin latencyp50 · p95 · p99Segment by route, cache state, region, and origin pool.
Coveragereceived / expectedDo not interpret a missing stream as a healthy service.
Field design
Capture evidence, not noise
Start with a governed field contract that supports request tracing, HTTP analysis, cache decisions, origin performance, routing, and security context.
| Field family | What it explains | Core examples | Common mistake |
|---|---|---|---|
| Identity | Which request and schema produced the record | event time, observed time, request ID, provider, schema version | Using export time as event time |
| HTTP | What the client requested and received | method, host, route, status, protocol, bytes | Indexing raw query strings by default |
| Cache | Why the edge did or did not contact origin | hit, miss, bypass, revalidated, age, TTL, key version | Combining every non-hit outcome |
| Timing | Where time entered the delivery path | connect, first byte, origin, transfer, total edge duration | Comparing different timing boundaries |
| Policy | Which control acted and how | action, rule ID, rate limit, bot signal, result source | Treating a score as a verdict |
| Pipeline health | Whether the observability data is trustworthy | delivery lag, duplicates, parse failures, coverage | Alerting on service data while logs are incomplete |
Edge Signal Journal
Recent field guides
Deep, implementation-focused articles for platform engineers, SRE teams, security analysts, and developers working with CDN request data.
From CDN Logs to SRE Alerts: Practical Metrics, SLIs, and SLOs
Convert request-level CDN logs into stable service indicators, error-budget alerts, and incident context without paging on noisy raw events or high-cardinality dimensions.
Read the guide
Multi-CDN Observability: Normalizing Edge Logs Across Providers
Create comparable multi-CDN metrics without erasing provider differences by using a canonical schema, capability metadata, explicit cache semantics, and rigorous data-quality checks.
Read the guide
Troubleshooting Origin Latency with HTTP and Edge Timing Fields
A practical workflow for separating edge, network, origin-connect, time-to-first-byte, and transfer delays using CDN log fields and matched request cohorts.
Read the guideFrequently asked
CDN logging fundamentals
Clear answers to the questions that shape schemas, pipelines, monitoring, and investigations.
CDN logging records request and response activity at edge locations, including HTTP outcomes, cache decisions, routing, timing, bytes, and optional security signals.
Origin logs see only traffic that reaches the origin. CDN logs can also describe cache hits, edge-generated responses, blocked requests, edge functions, and regional delivery behavior.
Usually not. Real-time streams are useful for monitoring and fast response, while batch exports provide efficient retention, replay, and historical analysis. Many teams use both.
A strong starter schema covers event time, request ID, host, normalized route, status, cache outcome, edge location, origin identity, bytes, timing, provider, and schema version.
Yes, when they include controlled policy, network, route, and outcome context. Sensitive values should be minimized, redacted, access-controlled, and retained only for an approved purpose.
No. CDNLog.com is an independent technical reference site focused on architecture, field design, monitoring, and analysis patterns for CDN and edge logs.
Build an edge logging model your teams can trust.
Start with the developer reference, then connect fields to dashboards, investigations, and SLOs.