More use of tags - drop add_header action -> allow + headers+tags

app/controllers/analytics_controller.rb

@@ -7,6 +7,9 @@ class AnalyticsController < ApplicationController
   def index
     authorize :analytics, :index?
 
+    # Track overall request time
+    request_start = Time.current
+
     # Time period selector (default: last 24 hours)
     @time_period = params[:period]&.to_sym || :day
     @start_time = calculate_start_time(@time_period)
@@ -24,10 +27,12 @@ class AnalyticsController < ApplicationController
     cache_key_base = "analytics/#{@time_period}/#{@start_time.to_i}"
 
     # Core statistics - cached (uses DuckDB if available)
+    stat_start = Time.current
     @total_events = Rails.cache.fetch("#{cache_key_base}/total_events", expires_in: cache_ttl) do
       with_duckdb_fallback { EventDdb.count_since(@start_time) } ||
         Event.where("timestamp >= ?", @start_time).count
     end
+    Rails.logger.info "[Analytics Perf] Total events: #{((Time.current - stat_start) * 1000).round(1)}ms"
 
     @total_rules = Rails.cache.fetch("analytics/total_rules", expires_in: 5.minutes) do
       Rule.enabled.count
@@ -42,14 +47,17 @@ class AnalyticsController < ApplicationController
     end
 
     # Event breakdown by action - cached (uses DuckDB if available)
+    stat_start = Time.current
     @event_breakdown = Rails.cache.fetch("#{cache_key_base}/event_breakdown", expires_in: cache_ttl) do
       with_duckdb_fallback { EventDdb.breakdown_by_action(@start_time) } ||
         Event.where("timestamp >= ?", @start_time)
              .group(:waf_action)
              .count
     end
+    Rails.logger.info "[Analytics Perf] Event breakdown: #{((Time.current - stat_start) * 1000).round(1)}ms"
 
     # Top countries by event count - cached (uses DuckDB if available)
+    stat_start = Time.current
     @top_countries = Rails.cache.fetch("#{cache_key_base}/top_countries", expires_in: cache_ttl) do
       with_duckdb_fallback { EventDdb.top_countries(@start_time, 10) } ||
         Event.where("timestamp >= ? AND country IS NOT NULL", @start_time)
@@ -58,8 +66,10 @@ class AnalyticsController < ApplicationController
               .sort_by { |_, count| -count }
               .first(10)
     end
+    Rails.logger.info "[Analytics Perf] Top countries: #{((Time.current - stat_start) * 1000).round(1)}ms"
 
     # Top blocked IPs - cached (uses DuckDB if available)
+    stat_start = Time.current
     @top_blocked_ips = Rails.cache.fetch("#{cache_key_base}/top_blocked_ips", expires_in: cache_ttl) do
       with_duckdb_fallback { EventDdb.top_blocked_ips(@start_time, 10) } ||
         Event.where("timestamp >= ?", @start_time)
@@ -69,6 +79,7 @@ class AnalyticsController < ApplicationController
              .sort_by { |_, count| -count }
              .first(10)
     end
+    Rails.logger.info "[Analytics Perf] Top blocked IPs: #{((Time.current - stat_start) * 1000).round(1)}ms"
 
     # Network range intelligence breakdown - cached
     @network_intelligence = Rails.cache.fetch("analytics/network_intelligence", expires_in: 10.minutes) do
@@ -105,7 +116,11 @@ class AnalyticsController < ApplicationController
     end
 
     # Prepare data for charts - split caching for current vs historical data
+    stat_start = Time.current
     @chart_data = prepare_chart_data_with_split_cache(cache_key_base, cache_ttl)
+    Rails.logger.info "[Analytics Perf] Chart data: #{((Time.current - stat_start) * 1000).round(1)}ms"
+
+    Rails.logger.info "[Analytics Perf] TOTAL REQUEST: #{((Time.current - request_start) * 1000).round(1)}ms"
 
     respond_to do |format|
       format.html

app/controllers/events_controller.rb

@@ -36,6 +36,9 @@ class EventsController < ApplicationController
     @events = @events.by_asn(params[:asn]) if params[:asn].present?
     @events = @events.by_network_cidr(params[:network_cidr]) if params[:network_cidr].present?
 
+    # Bot filtering
+    @events = @events.exclude_bots if params[:exclude_bots] == "true"
+
     Rails.logger.debug "Events count after filtering: #{@events.count}"
 
     # Debug info