Your First Batch

The ingest pipeline

When a Logpush batch hits your Edge ingest URL:

1. Authentication — Edge verifies the batch against your source's secret
2. Parsing — each record is validated; malformed lines are dropped and counted
3. Aggregation — the batch is collapsed into time-series metrics across every dimension that matters (network, country, status, cache outcome, browser, path, data centre)
4. Archiving — the original compressed batch is retained for 30 days as forensic evidence
5. Response — Logpush gets back accepted count, rejected count, and the compression ratio

What you'll see

After the first batch:

• Overview populates with real numbers
• Offenders shows the networks in your traffic
• Alerts stays empty (a single batch usually doesn't trip any detector — you need sustained traffic)

After a few minutes of continuous Logpush delivery:

• The Sources list shows a green Live freshness pill
• The detectors start comparing current windows against baselines
• If anything anomalous is present, alerts open automatically

Warmup period

New sources have a warmup window during which detectors do not evaluate:

• Fast detectors (spikes, ratios, abuse signatures): suppressed for 60 minutes
• Hourly detectors (slow burn, bot analysis, crawling, scanners): suppressed for 6 hours

This warmup prevents the initial Logpush backfill from triggering false-positive alerts. When a Logpush job is first enabled, it sends a burst of historical data that can look like a traffic spike to detectors that have no prior baseline.

After the warmup window passes, baseline auto-calibration runs within about 4 hours. Detectors then compare your traffic against your own site's normal, and their volume floors scale to your site's size.