Log metrics

Dynatrace version 1.206+

Dynatrace log monitoring gives you the ability not only to view and analyze logs, but also to create metrics based on log data and use them throughout Dynatrace like any other metric. You can add them to your dashboard, include them in an analysis, and even create custom alerts.

When Dynatrace receives logs, it applies a specified query to them and writes the number of matches (occurrences of log lines that match the query) as a metrics value.

Creating log metric

All metrics based on a log monitoring query have a metric key with the log. prefix. There are two ways to create a metric based on log data:

Create metric using settings

  1. Go to Settings > Log monitoring > Log metrics and select Add log metric.
  2. Enter the log monitoring query to filter the log data for your metric. For details, see Log viewer.
  3. Optionally, add dimensions for your query result.
    Adding dimensions allows you to split the log metric occurrences according to a specific log data attribute. For details, see Log viewer.
  4. Append the metric name to the metric key log. and save changes to create the log metric.

Create metric using log viewer

  1. Go to Logs.
  2. Create a log viewer query or use log viewer facets to extract the log data that interests you. For details, see Log viewer.
Advanced query

In the advanced mode, you can specify more complex criteria for log events by using combinations of keywords, phrases, logical operators, and parentheses. If you use an advanced query and manually modify the query, select Run query to update the results table.

  1. Select Create metric. Your log viewer query is now displayed on the Log metrics page.

  2. Optionally, add dimensions for your query result.
    Adding dimensions allows you to split the log metric occurrences according to specific log data attribute.

    For details, see Log viewer.

  3. Append the metric name to the metric key log. and save changes to create the log metric.

Editing log metric

To list, enable, disable, delete, or modify metrics created from log data, go to Settings > Log monitoring > Log metrics.

Editing a metric key will generate a new metric. As a result, historical data will be accessible only with the old metric key.

Example

In this example, we create and chart a log metric, save it to a dashboard, and create an alert.

  1. Go to Logs to display the log viewer.
  2. Create a query that filters the data that you are interested in. For this example, to filter all log entries for error, enter this query: status="error"
  3. Select Create metric.
    The Log metrics page is displayed with Query set to your query.
  4. Type in the metric key (a unique name for the metric). By default, each metric key begins with log. prefix. All log metrics based on logs must have a key starting with this prefix.
    For this example, set key to: log.error_PGI
  5. Select Add dimension and then select the dt.entityprocess_group_instance dimension from the list.
    Note: If you saved the metric without adding a dimension, Dynatrace would count errors globally. But in this example, we want to see how the error status is distributed across process group instances. Adding the dt.entityprocess_group_instance dimension will make Dynatrace count the number of error statuses for each process group instance. This allows you to view precisely where the error status occurred and to create an alert for a particular dimension.
  6. Save changes.

Now that you have defined the metric, you can chart it, pin it to a dashboard, and even create an alert based on it.

  • Chart: Go to Data Explorer, set Filter metrics by… to log.error_PGI, and select Run query.
  • Dashboard: After you create a chart, select Pin to dashboard to add the chart to one of your dashboards.
  • Alert: Go to Settings > Anomaly detection > Custom events for alerting, select Create custom event for alerting, and create a custom event based on log.error_PGI.