Log metrics

Dynatrace Log Management and Analytics gives you the ability not only to view and analyze logs, but also to create metrics based on log data and use them throughout Dynatrace like any other metric. Log metrics are stored in Grail and can be accessed and queried with Dynatrace Query Language. You can add them to your dashboard, include them in an analysis, and even create custom alerts.

Log metric pricing is based on the Davis data units (DDUs) model. Check DDUs for metrics to find out how you can estimate and track DDU consumption for log metrics.

Depending on the options you select during log metric creation, the new metric value can represent:

Occurrence of log records Dynatrace version 1.206+
The metric value will represent a count of occurrences of log records that match the query.
Attribute value Dynatrace version 1.229+
The metric value can represent one of the aggregations that you can specify in Data Explorer.

When Dynatrace ingests log data, it applies the defined query to the log data and, based on your log metric Measure selection, the metric value will therefore represent either a count of the log records that match the query or one of the following values for the specified attribute: Average, Count, Maximum, Minimum, Sum, Median, Percentile 10th, Percentile 75th, or Percentile 90th. The specified attribute must be of numeric type. Dynatrace will attempt to convert string type attributes to numbers as long as they match the following pattern:
123
123.
123.456
.456
-.456
+.456
+123.456
-123.456
123.4e+5
-123.4E-5
1234e+5
1234e5

Attributes holding more than one value are not converted to attribute-based metrics.

Creating log metric

All metrics based on a log monitoring query have a metric key with the log. prefix.

Log metric availability in Dynatrace

A created log metric is available only when new log data is ingested and it matches the log query defined during log metric creation. Ensure that new log data has been ingested before utilizing the log metric in other areas of Dynatrace.

The range of a timestamp for accepting data that is used in metric creation is between 1 hour in the past and 10 minutes in the future. If no timestamp is provided, the current timestamp of the server is used.

There are two ways to create a metric based on log data:

Create metric using settings

Go to Settings > Log Monitoring > Metrics extraction and select Add log metric.
In Key, append the metric name to the log. metric key.
In Matcher, use DQL to enter the log monitoring query and filter the log data for your metric. Learn more about DQL matcher in logs. For more details, see Logs and events viewer.
Select a Measure:
- Occurrence of log records - a count of occurrences of log records that match the query.
- Attribute value - the collection of measures for the attribute value of log records that match the query. If you select this option, you need to also set Attribute to the attribute whose values will be gauged.
optional Select Add dimension one or more times to add dimensions for your query result.
Adding dimensions allows you to split the log metric occurrences by a specific log data attribute. If the attribute contains more than one value, the first attribute value will act as the metric dimension. For details, see Logs and events viewer.
Select Save changes to create the log metric.

Create metric using log viewer

Advanced query

You can only create metrics in the simple query mode.

Go to Logs or Logs & Events (latest Dynatrace).
Create a log viewer query or use log viewer Available attributes to extract the log data that interests you.
For details, see Logs and events viewer.
Select Create metric.
Your log viewer query is now displayed on the Log metrics page.
optional Add dimensions for your query result.
Adding dimensions allows you to split the log metric occurrences according to the specific log data attribute. For details, see Logs and events viewer.
Append the metric name to the metric key log. and save changes to create the log metric.

Create metrics from dropped logs

Logs often contain valuable metric data, but you may not want to store the original log data. To get the metric data from logs and discard the original log data, you can create a metric from dropped logs. For example, consider the following log content:

2023-06-15T13:02:56Z localhost haproxy[12528]: 10.10.10.10:48064 http-in~ local/local0 3605/0/0/61/3666 HTTP_STATUS 200 138 - - ---- 7416/7413/400/401/0 0/0 {574|||domain.com} {|} "POST /communication HTTP/1.1"

You may be interested only in the active session total time from HAPproxy and you would like to discard the rest of the log data.

To do that

Ingest the log data via OneAgent and API.
- Log ingestion via OneAgent
- Generic log ingestion
Extract the metric from the ingested log data.
- Log processing
Create the log metric.
- Log metrics
Drop the original log data using the Don't store in a bucket option in the bucket configuration.
- Bucket assignment

Editing log metric

To list, enable, disable, delete, or modify metrics created from log data, go to Settings > Log Monitoring > Metrics extraction.

Editing a metric key will generate a new metric. As a result, historical data will be accessible only with the old metric key.

Example

In this example, we create and chart a log metric, save it to a dashboard, and create an alert.

Go to Logs or Logs & Events (latest Dynatrace) to display the log viewer.
Create a query that filters the data that you are interested in. For this example, to filter all log entries for error, enter this query: status="error"
Select Create metric.
The Log metrics page is displayed with Query set to your query.
Type in the metric key (a unique name for the metric). By default, each metric key begins with log. prefix. All log metrics based on logs must have a key starting with this prefix.
For this example, set key to: log.error_PGI
Select Add dimension and then select the dt.entityprocess_group_instance dimension from the list.

If you saved the metric without adding a dimension, Dynatrace would count errors globally. But in this example, we want to see how the error status is distributed across process group instances. Adding the dt.entityprocess_group_instance dimension will make Dynatrace count the number of error statuses for each process group instance. This allows you to view precisely where the error status occurred and to create an alert for a particular dimension.
Save changes.

Now that you have defined the metric, you can chart it, pin it to a classic dashboard, and even create an alert based on it.

Chart: Go to Data Explorer, set Select metric… to log.error_PGI, and select Run query.
Dashboard: After you create a chart, select Pin to dashboard to add the chart to one of your classic dashboards. For details, see Pin tiles to your dashboard.
Alert: Go to Settings > Anomaly detection > Metric events, select Add metric event, and create a custom event based on log.error_PGI.