Identifiers & labels

The panel shows words; filters, stored records and your own queries carry identifiers. This is the mapping.

The panel speaks in words. A filter URL, a stored record and any query you write yourself speak in identifiers. These pages are the mapping between the two, and the only place it is written down.

Why both

An identifier is the right thing to store: it never changes, it is what a filter carries in a URL and what a query has to name. It is the wrong thing to show a person. So the panel shows a label, and an identifier it does not recognise is shown as itself, never as a wrong but plausible label and never as blank.

01 · Which planes a visit was seen on
IdentifierLabelMeaning
log_onlyServer log onlySeen in the web server log, never by the beacon: no script ran, or the visitor left before it reported.
log_beaconLog and beaconSeen on both planes, so the log counts and the measured times describe the same visit.
beacon_onlyBeacon onlyReported by the beacon with no log line: a site on another server, or one whose log has not been read yet.
Ask for “none of beacon only”, not “log only”

Visits recorded before this field existed carry none of the three values, and every one of them came from a log. Excluding beacon_only keeps that history; asking for log_only would silently drop it. The None of operator does it, and the panel shows the remainder as “Not reported”.

02 · Signed in

Two stored values: true (Signed in), when your site sent a valid email address through the beacon, and false (Anonymous), when it reported a visitor who was not signed in. No value means your site did not say, which is never the same as anonymous. Identity & signed-in.

03 · Status classes
IdentifierLabelMeaning
1xx1xx InformationalA provisional response, rare in an access log.
2xx2xx AnsweredThe server returned a body. It does not prove the body was what was asked for: an error page served with a 200 looks the same.
3xx3xx RedirectedThe client was sent elsewhere. A probe redirected to a login page got no content, but learned the page exists.
4xx4xx RefusedNot found, forbidden, unauthorised: what a server is supposed to do to a probe.
5xx5xx Server errorThe server broke trying to answer. On a hostile request, a finding in itself.
04 · Fields with no vocabulary, on purpose

Dimensions that already hold words people use (a browser name, an operating system, a city, a network operator, a website, a path) have no mapping at all. There is nothing to translate. Field names and what each one is stored for are on The Solr schema.

Reference

Loghound is open source and MIT licensed. Questions about the Opensolr half — the account, the indexes, the plan — go to opensolr.com/contact; questions about the software itself belong on GitHub.

Loghound Documentation