Calculate HTTP Error Percentages

Compute the percentage of client and server errors in HTTP traffic using the percentage() function

Query

flowchart LR; %%{init: {"flowchart": {"defaultRenderer": "elk"}} }%% repo{{Events}} 1["Expression"] result{{Result Set}} repo --> 1 1 --> result
logscale
[
        percentage({status=4*}, as=clientErrorPct),
        percentage({status=5*}, as=serverErrorPct)
]

Introduction

The percentage() function can be used to calculate what percentage of events match specific criteria compared to the total number of events in the result set.

In this example, the percentage() function is used to calculate both client-side (4xx) and server-side (5xx) error rates from HTTP status codes simultaneously using an array (multiple percentage() calculations).

@timestampstatuspathresponse_time
2023-06-15T10:00:00Z200/api/users0.123
2023-06-15T10:00:01Z404/api/missing0.045
2023-06-15T10:00:02Z500/api/error2.345
2023-06-15T10:00:03Z200/api/products0.167
2023-06-15T10:00:04Z403/api/restricted0.078
2023-06-15T10:00:05Z502/api/gateway1.234
2023-06-15T10:00:06Z200/api/orders0.189
2023-06-15T10:00:07Z429/api/ratelimit0.056
2023-06-15T10:00:08Z503/api/unavailable3.456
2023-06-15T10:00:09Z200/api/cart0.145

Step-by-Step

  1. Starting with the source repository events.

  2. flowchart LR; %%{init: {"flowchart": {"defaultRenderer": "elk"}} }%% repo{{Events}} 1["Expression"] result{{Result Set}} repo --> 1 1 --> result style 1 fill:#ff0000,stroke-width:4px,stroke:#000;
    logscale
    [
        percentage({status=4*}, as=clientErrorPct),
        percentage({status=5*}, as=serverErrorPct)
]

    Creates an array of two percentage() calculations:

    • The first percentage() calculates the percentage of events where status starts with 4 (client errors) and returns the result in a new field named clientErrorPct

    • The second percentage() calculates the percentage of events where status starts with 5 (server errors) and returns the result in a new field named serverErrorPct

    The wildcard * is used to match any digits after 4 or 5 in the status code.

  3. Event Result set.

Summary and Results

The query is used to calculate two different error rates simultaneously from HTTP status codes, providing insights into both client-side and server-side errors as percentages of total requests.

Note how the query uses multiple percentage() calculations within an array to simultaneously compute the percentage of 4xx (client) and 5xx (server) errors in HTTP traffic.

This query is useful, for example, to monitor the health of a web application by tracking error rates, setting up alerts when error percentages exceed certain thresholds, or creating dashboards showing error trends over time.

Sample output from the incoming example data:

clientErrorPctserverErrorPct
3030

The percentages are calculated as decimal numbers between 0 and 100. In this example, 3 out of 10 events are 4xx errors (30%) and 3 out of 10 are 5xx errors (30%).

The results can be used directly in visualizations or for further calculations. Use the format() function to control decimal precision in the output.