Page tree
Skip to end of metadata
Go to start of metadata

This page lists the examples of valid filter expressions used for defining the traffic segment that is monitored by the child Watchpoint.

Examples of valid filter expressions

Filter expressionFilter criteria
browser_id contains "chrome"The name of the browser that the client is using
client_ip match 192.10.2.12IP address of the client that generated the request
client_port > 0TCP port of the client from which the request was generated

collector_feed_names contains "abc"

Real User Collector feed name

conditions = 1
condition_count = 12
condition_nw_count > 0
condition_client_count < 10
condition_server_count != 10
condition_app_count >= 10
condition_content_count = null
condition_custom_count between 5 10

Number of informational conditions for this session, page, or object for the specific category:

  • Total
  • Network
  • Client
  • Server
  • Application
  • Content
  • Custom
cookie_param("jid") contains "abc" ignorecase any

Cookies sent from the client to the server

credentials is "QWxhZGRpbjpvcGVuIHNlc2FtZQ=="

Basic authentication (credentials)
The authentication string sent in the request. This is a standard method of passing authentication credentials defined by the HTTP RFCs and supported by most browsers.

err_count = 100
err_nw_count > 0
err_client_count < 10
err_count != 10
err_app_count >= 10
err_content_count = null
err_custom_count between 5 10

Number of error conditions for this session, page, or object for the specific category:

  • Total
  • Network
  • Client
  • Server
  • Application
  • Content
  • Custom
falseRefuses all traffic
first_public_ip = 102.2.2.3

First public IP found in x-forwarded-for (or client IP)
The public IP address closest to the browser and the one used to look up geographic information

first_public_geo.city contains "mtl"
first_public_geo.country is "ca"
first_public_geo.dns_name is null
first_public_geo.isp contains "abc" ignorecase
first_public_geo.latitude = 1200
first_public_geo.longitude = 1200
first_public_geo.metro_area contains "abc" ignorecase
first_public_geo.organization contains "abc"
first_public_geo.region is "001"

Geolocation criteria:

  • City
  • Country code
  • Domain name
  • Internet service provider (ISP) name
  • Latitude
  • Longitude
  • Metropolitan area
  • Organization name
  • Region code
group_id is "Shoppers"

A group token extracted from traffic
Can be used to associate a session with a specific group of users

http_method is "GET"The HTTP action (GET, POST, or HEAD) for this request
http_status = 200The HTTP status code provided by the server
http_version is "HTTP/1.1"The version of HTTP used by this client and the server
info_count = 100
info_nw_count > 0
info_client_count < 10
info_count != 10
info_app_count >= 10
info_content_count = null
info_custom_count between 5 10

Number of informational conditions for this session, page, or object for the specific category:

  • Total
  • Network
  • Client
  • Server
  • Application
  • Content
  • Custom
is_container = TrueIndicates whether this object is a container, such as an HTML page, that can “contain” other objects (for example, CSS, images, and so on)
is_component = True

Indicates whether this object represents a page component (for example, an image, a stylesheet, or a script file)

is_document = TrueIndicates whether this object is a document
is_ipv4 = TrueIndicates whether this is the IPv4 traffic
is_ipv6 = TrueIndicates whether this is the IPv6 traffic
is_aborted = TrueIndicates whether this request was aborted
is_expired = TrueIndicates whether this page or object has expired
is_akamai_mixed_page = TrueIndicates whether this page or object is served by both Akamai and the origin server
is_full_akamai_cache_miss_page = TrueContent is served by the origin server through Akamai
is_full_origin_page = TrueIndicates whether this page or object is served by the origin server
is_ghost_page = TrueIndicates whether this page is composed of only Akamai receipts
is_prm_instrumented = TrueIndicates whether this page or object is instrumented (with page-render beacon)
is_promoted_document = True

Indicates whether this item was involved in the creation of a promoted document

During Object-type detection, when a hit (HTTP request and response pair) is classified as a Component and no associated parent Container is detected, it is determined to be orphaned. This parameter can be used to identify a page component orphan that results from misconfiguration or traffic patterns. For example, if a user clicks a thumbnail link on a web page to view the full image, it is classified as a Component. However, if the full image is displayed long after a page timeout, it is promoted and classified as a Document because the user clicked and received a new page without children components.

is_secure = TrueIndicates whether this page or object was transferred securely
is_server_aborted = TrueIndicates whether this object was aborted by the server
is_no_response = TrueIndicates whether this object was aborted after the request was completed but before the server could start sending the response
is_mid_request = TrueIndicates whether this object was aborted while the request was still being sent
is_mid_response = TrueIndicates whether this object was aborted while the response was being sent
is_timed_out = TrueIndicates whether this object timed out before the request or response was completed
is_client_timed_out = TrueIndicates whether this object timed out while waiting for the client
is_server_timed_out = TrueIndicates whether this object timed out while waiting for the server

time_host > 200
time_network > 200
time_primary_redirect < 100
time_redirect < 12
time_ssl > 300
time_e2e = 500

Latency time, ms:

  • Host latency — Time spent on the servers to process the request
  • Network latency — Time spent transferring data back and forth over the network when transmitting the request and the response
  • Primary redirects latency — Time spent on primary redirects
  • Redirects latency — Time spent on redirecting the client to get to this object or page
  • SSL latency — Latency introduced from negotiation of SSL connections
  • Total latency — End-to-end latency of the entire object, including HTTP redirects
mime_type is "text / html" ignorecase

The MIME type of content contained in the response
This directly controls how clients interpret the content.

os contains "win"The common name of the client's operating system
time_idle < 10

Time the browser took to request more objects during the loading of a page, ms

page_name contains "login"Name of the page as defined by the user
count_object > 12Number of objects in the session
count_primary_redirect > 1Number of primary redirects
page_referrer contains "index"Name of the referring page
time_page_render > 10Page-render time, ms
count_secure > 10Number of secure pages in this session
slt_brokenIndicates whether the page violates the service-level threshold (SLT)
count_redirect > 1Number of redirects for this session

post_param("parameter") between "foo" "bar"

POST parameter passed from the client to the server

post_param_string contains "username=bill&language=english" ignorecaseZero or more parameters passed from the client to the server as the name/value pairs when completing a form
url_redirect.path[2] startswith "abc" ignorecase all
url_redirect.path_param[last -1]("id") is "abc" occurs 5
url_redirect.query_string contains "abc"
url_redirect.query_param("jesson") is "abc" occurs 5-
url_redirect.stem_string contains "abc"
url_redirect contains "abc"
url_redirect.extension endswith "txt"
url_redirect.host contains "abc"
url_redirect.port = 123
url_redirect.protocol contains "http"

Redirect URL:

  • URL redirect path element — A list of elements that make up the path on the first redirect to this page
  • URL redirect path parameter — A list of key-value pairs found within the path on the first redirect to this page
  • URL redirect query string — Query portion of the first redirect to this page
  • URL redirect query parameter — A list of the key-value pairs found within the query string on the first redirect to this page
  • URL redirect stem — Full path of the first redirect to this page up to (but not including) the query string
  • URL redirect — Complete URI of the “initial redirect that leads to the page,” including protocol, server host, port, path + parameters, and query parameters. If there is no redirect leading to that page, this field is null.
  • URL redirect extension — File extension contained within the URI Redirect field
  • URL host — Domain of the first redirect to this page
  • URL redirect port — Target server port for the first redirect to this page
  • URL redirect protocol — Protocol of the first redirect to this page
url_referrer.path[2] startswith "abc" ignorecase all
url_referrer.path_param[3]("sid") is "123"
url_referrer.query_string contains "abc"
url_referrer.query_param("jesson") is "abc" occurs 5-
url_referrer.stem_string contains "abc"
url_referrer contains "abc"
url_referrer.extension endswith "txt"
url_referrer.host contains "abc"
url_referrer.port = 123
url_referrer.protocol contains "http"

Referrer URL:

  • Path element — A list of elements that make up the path on the previous request
  • Path parameter — A list of key-value pairs found within the path on the previous request
  • Query string — The query portion of the previous request
  • Query parameter — A list of the key-value pairs found within the query string on the previous request
  • Stem — The full path of the previous request up to (but not including) the query string
  • Referrer — URL of the site or page, or both, that referred the client to this site
  • File extension — File extension of the previous request
  • Host — ID of the server that handled the previous request
  • Port — Target server port for the previous request
  • Protocol — Protocol of the previous request

server_id contains "abc"
server_ip match 2.2.2.2 mask 255.255.255.192
server_port = 80

Server parameters:

  • Server ID — Name or identifier of the server or network infrastructure component that serviced this request
  • Server IP — IP address of the server that responded to the request
  • Server port — TCP port of the server that responded to the request
setcookie_param("sid") contains "abc"

Server cookie parameter

setcookie_string startswith "SESSIONID=1232897"

The cookie header passed from the client to the server

size > 2000Size of the object or page (request + response), bytes
size_kb > 20Size of the object or page (request + response), kilobytes
tcp_ooo > 2
tcp_packet_count > 10
tcp_rtx > 20
tcp_rtt < 300
tcp_rtt_tap2server > 100
tcp_rtt_tap2client >= 20

TCP-related filters:

  • TCP out-of-order — Number of out-of-order TCP segments in the transmission. This usually indicates route flapping or poor link load balancing.
  • TCP packets count — Number of TCP packets for this object, error, page, or session
  • TCP retransmits — Number of TCP segments retransmitted. A high number of retransmissions may indicate traffic shaping or packet loss.
  • TCP round-trip time, ms — Total TCP round-trip time of all objects or pages between the client and the server
  • TCP round-trip time tap-to-server, ms
  • TCP round-trip time tap-to-client, ms
throughput < 200

Effective throughput in bits per second. May be blank if the request was too small to accurately measure throughput

trueAccept all traffic
url.path[1] startswith "abc"
url.path_param[2]("sid") is "abc
url.query_string contains "action=search&type=byarea" ignorecase
url.query_param("ssid") is "abc"
url.stem_string contains "/home/search.jsp"
url contains "abc"
url.extension endswith "html"
url.host contains "abc"
url.port = 622
url.protocol contains "https"

URL-related filters:

  • URL path element — A list of the key-value pairs found within the path of the main URL
  • URL path parameter — A list of the main elements that make up the path on the main URL
  • URL query string — The query portion of the request URL
  • URL query parameter — A list of the key-value pairs found within the query string on the main URL
  • URL stem — The full path of the request up to (but not including) the query string
  • URL — The full URL of the item
  • URL file extension — The file extension contained within the URL for this request

  • URL host — Host that handled the request

  • URL port — URL's port
  • URL protocol — The protocol used by this request
ssl_cert_common_name contains "dsl"SSL certificate common name
user_agent contains "fire"

The user-agent string contained in the header of the request. This string contains information concerning the user's environment, for example, browser type, OS, and so on.

vm_display_name contains "abc"Virtual machine (VM) display name
vmm_dns_name contains "abc"VM manager domain name service (DNS) name
ph_dns_name contains "abc"VM physical host
application_name is "abc"

The name of the application invoked by the client

trace is "abc"

The header, inserted by application-monitoring solutions to enable drill-downs extracted from the HTTP response

Related topics

Defining and managing Watchpoints to group web traffic

Configuring object-type detection