- name: hits
  label: Hits
  chart: bar
  query: |
    SELECT {bucket} AS bucket,
           COUNT(*) AS value
    FROM logs
    GROUP BY bucket
    ORDER BY bucket

- name: error_rate
  label: Error Rate (%)
  chart: line
  query: |
    SELECT {bucket} AS bucket,
           SUM(CASE WHEN status BETWEEN 400 AND 599 THEN 1 ELSE 0 END) * 100.0 / COUNT(*) AS value
    FROM logs
    GROUP BY bucket
    ORDER BY bucket

- name: cache_status_breakdown
  label: Cache Status
  chart: bar
  query: |
    SELECT cache_status AS bucket,
           COUNT(*) AS value
    FROM logs
    GROUP BY cache_status
    ORDER BY value DESC

- name: domain_traffic
  label: Top Domains
  chart: bar
  query: |
    SELECT host AS bucket,
           COUNT(*) AS value
    FROM logs
    GROUP BY host
    ORDER BY value DESC

- name: bytes_sent
  label: Bytes Sent
  chart: line
  query: |
    SELECT {bucket} AS bucket,
           SUM(bytes_sent) AS value
    FROM logs
    GROUP BY bucket
    ORDER BY bucket

- name: top_paths
  label: Top Paths
  chart: bar
  query: |
    SELECT path AS bucket,
           COUNT(*) AS value
    FROM (
        SELECT substr(substr(request, instr(request, ' ') + 1), 1,
                      instr(substr(request, instr(request, ' ') + 1), ' ') - 1) AS path
        FROM logs
    )
    GROUP BY path
    ORDER BY value DESC
    LIMIT 20

- name: user_agents
  label: User Agents
  chart: bar
  query: |
    SELECT user_agent AS bucket,
           COUNT(*) AS value
    FROM logs
    GROUP BY user_agent
    ORDER BY value DESC
    LIMIT 20

- name: referrers
  label: Referrers
  chart: bar
  query: |
    SELECT referer AS bucket,
           COUNT(*) AS value
    FROM logs
    GROUP BY referer
    ORDER BY value DESC
    LIMIT 20

- name: status_distribution
  label: HTTP Statuses
  chart: bar
  query: |
    SELECT CASE
             WHEN status BETWEEN 200 AND 299 THEN '2xx'
             WHEN status BETWEEN 300 AND 399 THEN '3xx'
             WHEN status BETWEEN 400 AND 499 THEN '4xx'
             ELSE '5xx'
           END AS bucket,
           COUNT(*) AS value
    FROM logs
    GROUP BY bucket
    ORDER BY bucket