Dynatrace version 1.206+
The Log viewer enables you to browse logs within provided time frame using detected aspects of the log content. You can use automatically generated facets to narrow down your log view and to focus on a specific aspect of the log content.
To access the log viewer, sign in to Dynatrace and navigate to Log Monitoring. The Log viewer screen consists of the following 4 sections:
You can input a query or filters to narrow down the log events that are displayed in the results table. You can use the query in the auto-complete or in the advanced mode.
In the auto-complete mode, you can select from a set of detected log data fields to filter the results. For filters with the same attributes, only one statement needs to be true. For filters with different attributes, all statements need to be true. While in the auto-complete mode, selected filters and facets are synchronized automatically.
In the advanced mode, you can specify more complex criteria for log events by using combinations of keywords, phrases, logical operators, and parentheses, the Dynatrace search query language provides you with complete flexibility over searches through log content. You can use the query entry to quickly text search the content of the log data. Any string entered in the query text box without specifying the log data attribute will be treated as a simple text search on the log data content.
Hint: In the advanced mode, you can run an empty query to return unfiltered log data.
|Text search||Text searches help you find individual word occurrences. You can search text without any syntax. (As long as no special characters or keywords are present, like:
Spaces are interpreted as AND operators:
Also, this mode allows you to use double quotes:
Searches are case-insensitive for both attribute names and values.
|Attributes||Search for records that have specified attribute with specified value.
Search for records that do not have a specified attribute with specified value.
Search for records that do not contain a specified phrase in the content field.
You can write numbers without quotes: positive and negative decimals. (e.g. -123.34)
|Phrases||A phrase is a group of words surrounded by double quotes. Phrases are treated just like single-word terms in queries. This allows you to search for log data with a specified phrase in the content field. It will return only those records in which the entire phrase matches. In this example, the word
|Boolean operators||Operators can be written in either uppercase or lowercase:
|Wildcards||Wildcards can be used to represent a variable or unknown alphanumeric characters in search terms. An asterisk
|Special characters||Escaping special characters in attribute names or attribute values:
For attribute names:
An attribute can contain any chars but
For attribute values:
Special chars: `"=!?.<>()\ must be escaped with
For free text search mode:
Wrap keywords with double quotes.
Values that contain special characters must be wrapped with double quotes and special characters must be escaped with
You can switch between the auto-complete and advanced modes. Dynatrace will transform the auto-complete filters to a query and vice versa provided that the query in the advanced mode can be transformed. Some complex queries with logical operators cannot be converted to auto-complete filters, in which case switching to auto-complete mode becomes unavailable.
The results table displays the log events that match provided query and filter within selected time frame.
Hint: By default, the Log viewer displays a maximum of 1,000 log events. If you don't see expected results, run a more exact query or narrow down the timeframe to see better focused log data.
100 matching records are displayed, but you can view more results by selecting Show 100 more. You can show or hide specific columns in the result table using Table options. Each row in the table represents a log event and can be expanded for detailed log data.
The log chart is a histogram of log events over period of time that gives you a quick overview of logs and their severity within the selected time frame.
Facets provide you with an overview and the ability to filter the log data. Facets are automatically detected attributes of the data presented in the table. You can use them to quickly filter the result table data for a specific log data attribute. The facets display
10 most popular values for that attribute. To filter all values for a particular attribute (facet), create and run a query in the log viewer search.