- name: hits
  label: Hits
  icon: pulse
  chart: line
  bucket: time_bucket
  bucket_label: Time
  query: |
    SELECT {bucket} AS time_bucket,
           COUNT(*) AS value
    FROM logs
    GROUP BY time_bucket
    ORDER BY time_bucket

- name: error_rate
  label: Error Rate (%)
  icon: file-alert
  chart: line
  bucket: time_bucket
  bucket_label: Time
  query: |
    SELECT {bucket} AS time_bucket,
           SUM(CASE WHEN status BETWEEN 400 AND 599 THEN 1 ELSE 0 END) * 100.0 / COUNT(*) AS value
    FROM logs
    GROUP BY time_bucket
    ORDER BY time_bucket

- name: cache_status_breakdown
  label: Cache Status
  icon: archive
  chart: polarArea
  bucket: cache_status
  bucket_label: Cache Status
  query: |
    SELECT cache_status AS cache_status,
           COUNT(*) AS value
    FROM logs
    GROUP BY cache_status
    ORDER BY value DESC
  colors:
    - "#3273dc"
    - "#23d160"
    - "#ffdd57"
    - "#ff3860"
    - "#7957d5"
    - "#363636"

- name: domain_traffic
  label: Top Domains
  icon: globe
  chart: table
  top_n: 50
  per_domain: false
  bucket: domain
  bucket_label: Domain
  query: |
    SELECT host AS domain,
           COUNT(*) AS value
    FROM logs
    GROUP BY domain
    ORDER BY value DESC

- name: bytes_sent
  label: Bytes Sent
  icon: upload
  chart: line
  bucket: time_bucket
  bucket_label: Time
  query: |
    SELECT {bucket} AS time_bucket,
           SUM(bytes_sent) AS value
    FROM logs
    GROUP BY time_bucket
    ORDER BY time_bucket

- name: top_paths
  label: Top Paths
  icon: map
  chart: table
  top_n: 50
  buckets:
    - domain
    - path
  bucket_label:
    - Domain
    - Path
  query: |
    WITH paths AS (
        SELECT host AS domain,
               substr(substr(request, instr(request, ' ') + 1), 1,
                      instr(substr(request, instr(request, ' ') + 1), ' ') - 1) AS path
        FROM logs
    ), ranked AS (
        SELECT domain, path, COUNT(*) AS value,
               ROW_NUMBER() OVER (PARTITION BY domain ORDER BY COUNT(*) DESC) AS rn
        FROM paths
        GROUP BY domain, path
    )
    SELECT domain, path, value
    FROM ranked
    WHERE rn <= 20
    ORDER BY domain, value DESC

- name: user_agents
  label: User Agents
  icon: user
  chart: table
  top_n: 50
  buckets:
    - domain
    - user_agent
  bucket_label:
    - Domain
    - User Agent
  query: |
    WITH ua AS (
        SELECT host AS domain, user_agent
        FROM logs
    ), ranked AS (
        SELECT domain, user_agent, COUNT(*) AS value,
               ROW_NUMBER() OVER (PARTITION BY domain ORDER BY COUNT(*) DESC) AS rn
        FROM ua
        GROUP BY domain, user_agent
    )
    SELECT domain, user_agent, value
    FROM ranked
    WHERE rn <= 20
    ORDER BY domain, value DESC

- name: referrers
  label: Referrers
  icon: link
  chart: table
  top_n: 50
  buckets:
    - domain
    - referrer
  bucket_label:
    - Domain
    - Referrer
  query: |
    WITH ref AS (
        SELECT host AS domain, referer AS referrer
        FROM logs
    ), ranked AS (
        SELECT domain, referrer, COUNT(*) AS value,
               ROW_NUMBER() OVER (PARTITION BY domain ORDER BY COUNT(*) DESC) AS rn
        FROM ref
        GROUP BY domain, referrer
    )
    SELECT domain, referrer, value
    FROM ranked
    WHERE rn <= 20
    ORDER BY domain, value DESC

- name: status_distribution
  label: HTTP Statuses
  icon: server
  chart: pie
  bucket: status_group
  bucket_label: Status
  query: |
    SELECT CASE
             WHEN status BETWEEN 200 AND 299 THEN '2xx'
             WHEN status BETWEEN 300 AND 399 THEN '3xx'
             WHEN status BETWEEN 400 AND 499 THEN '4xx'
             ELSE '5xx'
           END AS status_group,
           COUNT(*) AS value
    FROM logs
    GROUP BY status_group
    ORDER BY status_group
  colors:
    - "#48c78e"
    - "#209cee"
    - "#ffdd57"
    - "#f14668"

# New time-series: status classes over time (stacked)
- name: status_classes_timeseries
  label: Status Classes Over Time
  icon: server
  chart: stackedBar
  bucket: time_bucket
  bucket_label: Time
  stacked: true
  query: |
    SELECT {bucket} AS time_bucket,
           SUM(CASE WHEN status BETWEEN 200 AND 299 THEN 1 ELSE 0 END) AS "2xx",
           SUM(CASE WHEN status BETWEEN 300 AND 399 THEN 1 ELSE 0 END) AS "3xx",
           SUM(CASE WHEN status BETWEEN 400 AND 499 THEN 1 ELSE 0 END) AS "4xx",
           SUM(CASE WHEN status BETWEEN 500 AND 599 THEN 1 ELSE 0 END) AS "5xx",
           COUNT(*) AS total
    FROM logs
    GROUP BY time_bucket
    ORDER BY time_bucket

# New time-series: cache status over time (compact Hit/Miss; exclude '-' by default)
- name: cache_status_timeseries
  label: Cache Status Over Time
  icon: archive
  chart: stackedBar
  bucket: time_bucket
  bucket_label: Time
  stacked: true
  exclude_values: ["-"]
  query: |
    SELECT {bucket} AS time_bucket,
           SUM(CASE WHEN cache_status = 'HIT' THEN 1 ELSE 0 END) AS hit,
           SUM(CASE WHEN cache_status = 'MISS' THEN 1 ELSE 0 END) AS miss,
           COUNT(*) AS total
    FROM logs
    GROUP BY time_bucket
    ORDER BY time_bucket