• Home
  • Observe and explore
  • Logs
  • Log Management and Analytics
  • Log content analysis
  • Log dashboards strategies

Log dashboards strategies

powered by Grail

You can visualize data from your logs using dashboards. You can adjust dashboards to your observability needs, performance and consumption, by selecting one of the two strategies described below.

Pinning DQL queries

After selecting Advanced mode in Log and events viewer, you can use DQL queries to retrieve, explore, and analyze data, including patterns and trends over time. After running a query, you can pin the result to a dashboard as a data table, single value, bar chart or other visualization.
Note: You do not pin the static result of your query to a dashboard. Instead, your query fetches fresh results from Grail every time your dashboard is viewed or refreshed. This guarantees precise and up-to-date data in your dashboards.

When you use dashboards with pinned DQL queries, the following factors can impact your dashboard performance and consumption:

  • The number of DQL queries pinned to a dashboard
  • The number of users loading the dashboard
  • Dashboard autorefresh
  • Timeframe selected in the UI or defined in your pinned DQL query, for example 30 days
dql
fetch logs, from:-30d
  • Sampling ratio specified in your pinned DQL query, for example 1000
dql
fetch logs, samplingRatio:1000
  • Scanlimit parameter in Gigabytes in your pinned DQL query, for example 10,000
dql
fetch logs, scanLimitGBytes:10000

See DQL Best practices for optimizing your queries.

Pinning log metrics

You have the possibility to create metrics based on log data and use them in your analyzes. For example, you can create a dashboard that combines log metrics with the chosen visualizations. See dashboards to learn more.
Metrics extraction from logs takes place during ingest. This means your log metrics are populated when new logs are ingested, and you are not able to use historical logs stored in Dynatrace to create your metrics. After metrics are extracted from logs, the original raw log data can be dropped. For details, see log buckets.
Note: In this scenario, the DDU consumption for log metrics is based on ingested log data and custom metrics. Viewing or analyzing metrics does not affect your consumption.

Strategy comparison

ActionDQL query resultLog metric

Show charts and pin to dashboard

Yes

Yes

Includes historical data

Yes, any timeframe

No, only after the metric is captured

Works without predefined schema

Yes

No

Easily modifiable

Yes

No, you have to set up a new metric

Alerting

With log events, based on occurrences

Based on occurrences or attribute value

Works without retaining full log data

No

Yes, original logs can be dropped

Consumption

DDUs for log ingest and processing,
DDUs for log query, for example when a dashboard is refreshed

DDUs for log ingest and processing, DDUs for custom metrics