GilbN/geometrikks v0.12.0 on GitHub

What's Changed

feat: store a missing request_time as NULL and show n/a instead of 0.00s by @GilbN in #175
fix(logparser): stop treating 408, 444 and 499 as malformed requests by @GilbN in #176
fix(ui): stop prefixing calendar ranges with "Last" on stat cards by @GilbN in #177
fix(map): follow the OS colour scheme when the theme is System by @GilbN in #179
feat(analytics): latency figures skip WebSocket and unanswered connections by @GilbN in #180
Top URLs lists one row per host and path by @GilbN in #181
IP inspector: a per-IP panel from every IP in the app by @GilbN in #185
chore(deps): bump the frontend-minor-patch group with 2 updates by @dependabot[bot] in #183
fix(ui): open the IP inspector from a detail sheet by @GilbN in #186
IP inspector follow-ups: map focus readiness and feedback, link consistency, cleanups by @GilbN in #187
Map popup: wrap long IPv6 addresses in the Top IPs rows by @GilbN in #188
fix(server): close the live-events channel after ingestion stops by @GilbN in #189

Upgrade notes

Note

The first start after upgrading adds new columns to the summary and URL aggregates (measured-row counts and filtered latency figures) and refreshes those four aggregates over the raw retention window (ANALYTICS_RAW_RETENTION_DAYS, default 180 days). On a large database this takes minutes. No history is lost. Buckets older than the window keep their pre-upgrade figures, which counted every row, because the raw rows needed to recount them are gone.

Warning

The first start also drops and rebuilds the two Top URLs aggregates so they can carry one row per host and path. The rebuild covers the raw retention window and logs url_caggs_recreated when it finishes. Per-URL history older than that window cannot be rebuilt and is dropped. Every other chart and card keeps its full history.

What's in 0.12.0

Added

IP inspector. Every IP in the app (map popup and controls, top-IP lists, the log tables and their detail panels, the alerts and decisions tables) gets an inspect button that opens a side panel for that address. The panel covers the selected range: request and error counts, bytes, timing, first and last seen, busiest hour or day, the hosts and paths it hit, user agents, other locations it resolved to, its latest requests and its CrowdSec decision. Scanner tells show as chips with a hover explanation: high 4xx share, hosting ASN, wide path spread, bursts, malformed lines, traffic still arriving after a ban. Clicking a bar in the panel's chart narrows the range to that hour or day, with a way back; the panel has its own range picker. Footer links carry the IP to Analytics, Access logs and, when it produced malformed lines, Debug logs. The panel lives at ?inspect=<ip>, so it survives navigation and can be linked. Backed by a new GET /api/v1/analytics/ip-profile endpoint.
Response-time cards and the latency chart read "n/a" when the selected range has no measured requests, and "From N% of requests" when only some rows carry a timing. Top URLs and the access-log table show "n/a" for rows without one.
litestar backfill-timings clears the placeholder 0.0 response time on rows imported from combined-format nginx archives. --hostname and --before narrow which rows it touches.

Changed

Side panels darken the page behind them instead of blurring it. The map's load-failure message sits on the brand map scene, the same one the map shows while loading.
A missing request_time is now NULL instead of 0.0, so unmeasured requests stop dragging the response-time average and percentiles toward zero. The summary and URL aggregates gain a count of measured rows (see the upgrade notes).
nginx status 408, 444 and 499 no longer mark a request as malformed. A 444 is usually a block rule and a 499 is a client that hung up, so those lines now land in Access logs like any other request instead of filling the Debug page and the malformed count. Probe detection is unchanged; TLS, SSH and SMB handshakes and requests without a valid HTTP method are still flagged.
Response-time figures (average, max, percentiles, and the Top URLs average) skip WebSocket connections (status 101) and connections that ended without a response (status 0). Their logged time covers the whole connection, not the response, and one open WebSocket was enough to put the Max Request Time card at 9000 s. The rows keep their duration in Access logs. The summary and URL aggregates gain filtered latency columns (see the upgrade notes). The Top URLs column is labelled Path, which is what it shows.
Top URLs lists one row per host and path. A path that several proxied hosts share, such as /graphql or /favicon.ico, used to show as one row with every host's hits summed; now each host gets its own row, with a Host column before Path (see the upgrade notes).

Fixed

The Overview's Avg and Max Request Time cards formatted seconds as if they were milliseconds, showing a 40 ms average as 40μs.
Stat cards on the Summary, Geo logs and Debug logs pages no longer read "Last Last month" or "Last Today" for calendar presets. Calendar ranges show their own name, and trends on the Summary page read "vs previous period" instead of "vs last Yesterday".
The map basemap follows the System theme. It stayed dark while the rest of the app switched to light with the OS, and now switches with it, live.
Stopping the app while it was tailing a log logged one live event publish failed traceback per row in the final batch. The live-events channel closed before ingestion flushed that batch; it now closes after. The rows were always committed, only their live-map events went missing.

Full Changelog: v0.11.0...v0.12.0