The Service Map for APM is here!

Search

All of the search parameters are contained within the URL, so you can share your view simply sharing the URL.

Search syntax

A query is composed of terms and operators.

There are two types of terms:

  • A Single Term is a single word such as “test” or “hello”.

  • A Sequence is a group of words surrounded by double quotes such as “hello dolly”.

To combine multiple terms into a complex query, you can use any of the following boolean operators:

Operator **Description ** **Example **
AND Intersection: both terms are in the selected events (if nothing is added, AND is taken by default) authentication AND failure
OR Union: either terms is contained in the selected events authentication OR password
- Exclusion: the following term is NOT in the event authentication AND -password

To search on a specific facet you need to add it as a facet first then add @ to specify you are searching on a facet.

For instance, if your facet name is url and you want to filter on the url value www.datadoghq.com just enter:

@url:www.datadoghq.com

Wildcards

To perform a multi-character wildcard search, use the * symbol as follows:

  • service:web* matches every log message that has a service starting by “web”.
  • hello* matches all log messages starting with hello
  • *hello matches all log messages that end with hello

Numerical values

Use <,>, <=, or >= to perform a search on numerical attributes. For instance, retrieve all logs that have a response time over 100ms with:

@http.response_time:>100

It is also possible to search for numerical attribute within a specific range. For instance, retrieve all your 4xx errors with:

@http.status_code:[400 TO 499]

Tags

Your logs inherit tags from hosts and integrations that generate them. They can be used in the search and as facets as well:

  • test is searching for the string “test”.
  • ("env:prod" OR test) matches all logs with the tag #env:prod or the tag #test
  • (service:srvA OR service:srvB) or (service:(srvA OR srvB)) Matches all logs that contain tags #service:srvA or #service:srvB.
  • ("env:prod" AND -"version:beta") matches all logs that contain #env:prod and that do not contain #version:beta

If your tags don’t follow tags best practices and don’t use the key:value syntax, use this search query:

  • tags:<MY_TAG>

Autocomplete

Typing a complex query can be cumbersome. Use the search bar’s autocomplete feature to complete your query using existing values:

search bar autocomplete

Escaping of special characters

The following attributes are considered as special: ?, >, <, :, =,", ~, /, and \ require escaping. For instance, to search logs that contain user=12345 the following search must be entered:

user\=JaneDoe

The same logic must be applied to spaces within log attributes. Log attributes should not contain spaces, but in such a case, spaces must be escape. If an attribute was called user.first name, perform a search on this attribute by escaping the space:

@user.first\ name:myvalue

Saved Searches

Don’t lose time building the same views everyday. Saved Views contain your search query, columns, time horizon, and facet.

Time Range

The time range allows you to display logs within a given time period. It appears directly under the search bar as a timeline. The timeline can be displayed or wrapped up with the Show timeline check box:

Timeline

Quickly change the time range by selecting a preset range from the dropdown:

Timerange

Logstream

The Logstream is the list of logs that match the selected context. A context is defined by a search bar filter and a time range. You can sort the list by clicking the date column header.

Logstream

Filtering the Logstream

If you enter a valid query into the search bar, words that match your query are highlighted, and the logs displayed match your facet criteria:

Logstream highlighted

Displaying a full log

You can click on any log line to see more details about it:

Log in Logstream

View in context

Click on View in context to see log lines dated just before and after a selected log - even if they don’t match your filter.

View in context

The context is different according to the situation as we use the Hostname, Service, filename or container_id attributes, along with tags to make sure we find the perfect context for your logs.

Columns

To add more log details to the list, click the Columns button and select any facets you want to see:

Logstream with columns

Multi-line display

Multi-line display

Choose to display one, three, or ten lines from your logs message attributes in your logstream.

  • With one line displayed:

    1 line Multi-line display

  • With three lines displayed:

    2 lines with Multi-line display

  • With ten lines displayed:

    10 lines with Multi-line display

Note: If present, error.stack attribute is displayed in priority as it should be used for stack traces. Remap any stack-trace attribute to this specific attribute with the attribute remapper Processor.

Facets

A facet displays all the distinct members of an attribute or a tag as well as provides some basic analytics such as the amount of logs represented. This is also a switch to easily filter your data.

Facets allow you to pivot or filter your datasets based on a given attribute. Examples facets may include users, services, etc…

Facets demo

Create a Facet

To start using an attribute as a Facet or in the search, click on it and add it as a Facet:

Create Facet

Once this is done, the value of this attribute is stored for all new logs and can be used in the search bar, the Facet Panel, and in the Log Analytics query.

Facet Panel

Use facets to easily filters on your logs. The search bar and url automatically reflect your selections.

Facet panel

Measures

A Measure is a attribute with numerical value contained in your logs. Think of it as a “log metric”.

Create a Measure

To start using an attribute as a measure, click on a numerical attribute of your log:

Create a measure

Once this is done, the value of this attribute is stored for all new logs and can be used in the search bar, the Facet Panel, and in the Log Analytics query.

Select the Measure Unit

All measure have their own unit that is then used for display in the Log Explorer columns, Log stream widgets in dashboards, and in the Log Analytics.

Edit a measure

Further Reading