The Service Map for APM is here!

Log Explorer

The Logs Explorer is your home base for troubleshooting and exploration:

Explore view with comments

In this view you can:

Context

Build up a context to explore your logs in your log explorer view first by selecting the proper time range then by using the search bar to filter your Logstream and Log Analytics.

Time Range

The time range feature allows you to display logs in the Logstream or Log Analytics within a given time period. It appears directly under the search bar as a timeline. The timeline can be displayed or wrapped up with the Show timeline check box in the Logstream option panel.

Quickly change the time range by selecting a preset range from the dropdown:

Timerange

Use facets, measures, tags, or even free text search to filter your Logstream and Log Analytics with dedicated context. The search bar and url automatically reflect your selections.

Follow the guide to search your logs for a detailed explanation of all the Log Explorer search features, including use of wildcards and queries of numerical values.

Search your logs

Saved views

Use Saved Views to automatically configure your Log Explorer with a preselected set of facets, measures, searches, time ranges, and visualizations.

Check the dedicated saved views documentation to learn more.

Visualization

Switch between the Logstream and the Log Analytics modes by clicking on the Log Mode button:

Log Analytics switch

The Logstream is the list of logs that match the selected context. A context is defined by a search bar filter and a time range.

Logstream

If you enter a valid query into the search bar, words that match your query are highlighted, and the logs displayed match your facet criteria.

Sort the list by clicking the date column header.

Click on any log line to see more details about it:

Log in Logstream

Click on View in context to see log lines dated just before and after a selected log—even if they don’t match your filter.

View in context

The context is different according to the situation as we use the Hostname, Service, filename, or container_id attributes, along with tags, to make sure we find the perfect context for your logs.

Click the Columns button and select any facets you want to see to add more log details to your Logstream:

Logstream with columns

Choose to display one, three, or ten lines from your logs message attributes in your Logstream:

Multi-line display

Note: If present, the error.stack attribute is displayed in priority as it should be used for stack traces. Remap any stack trace attribute to this specific attribute with the attribute remapper Processor.

After having gone through Datadog processing, log parsing, having facets and measures over the important attributes, you can graph log queries and see maximums, averages, percentiles, unique counts, and more.

Follow the log graphing guide to learn more about all the graphing options.

Log Analytics

Investigating large volumes of log data can be time consuming: you can spend hours on them and still understand only a fraction of them. However, applicative logs often look the same with some fraction of them varying. These what we call patterns.

In the Log Explorer, patterns can be surfaced automatically to bring structure to the problem and help you quickly see what matters—exclude what’s irrelevant.

Find out more in the Log Patterns section

Log Patterns

Setup

After being processed with the help of pipelines and processors, your logs attributes can be indexed as facets or measures in order to be accessible for your context creation and Log Analytics.

Note: To leverage the most out of your Log explorer view, make sure your logs attributes follow Datadog attribute naming convention.

A facet displays all the distinct members of an attribute or a tag as well as provides some basic analytics, such as the number of logs represented. This is also a switch to easily filter your data.

Facets allow you to pivot or filter your datasets based on a given attribute. Examples facets may include users, services, etc…

Facets demo

Create a Facet:

To start using an attribute as a facet or in the search, click on it and add it as a facet:

Create Facet

Once this is done, the value of this attribute is stored for all new logs and can be used in the search bar, the Facet Panel, and in the Log Analytics query.

A measure is a attribute with a numerical value contained in your logs. Think of it as a “log metric”.

Create a Measure:

To start using an attribute as a measure, click on a numerical attribute of your log:

Create a measure

Once this is done, the value of this attribute is stored for all new logs and can be used in the search bar, the Facet Panel, and in the Log Analytics query.

Select the Measure Unit:

Each measure has its own unit that is then used for display in the Log Explorer columns, Log stream widgets in dashboards, and Log Analytics.

Edit a measure

Export

Export your current Log Visualization with the Export functionality:

view logs button

Button Description
Export to Monitor Export the query applied to your Logstream in order to create the log monitor query for a new log monitor
Export to CSV Export your current Logstream view with its selected column into a CSV file. You can export up to 5000 logs at once.

view logs button

Button Description
Export to Monitor Export the query applied to your Log Analytics in order to create the log monitor query for a new log monitor This functionality is not available yet.
Export to Timeboard Export your Logstream as a widget to a Timeboard. This functionality is still in beta, contact the Datadog support team to activate it for your organization.

Further Reading