All of the search parameters are contained within the URL, so you can share your view simply sharing the URL.
A query is composed of terms and operators.
There are two types of terms:
A Single Term is a single word such as “test” or “hello”.
A Sequence is a group of words surrounded by double quotes such as “hello dolly”.
To combine multiple terms into a complex query, you can use any of the following boolean operators:
|Operator||**Description **||**Example **|
||Intersection: both terms are in the selected events (if nothing is added, AND is taken by default)||authentication AND failure|
||Union: either terms is contained in the selected events||authentication OR password|
||Exclusion: the following term is NOT in the event||authentication AND -password|
For instance, if your facet name is url and you want to filter on the url value www.datadoghq.com just enter:
To perform a multi-character wildcard search, use the
* symbol as follows:
service:web*matches every log message that has a service starting by “web”.
hello*matches all log messages starting with hello
*hellomatches all log messages that end with hello
>= to perform a search on numerical attributes. For instance, retrieve all logs that have a response time over 100ms with:
It is also possible to search for numerical attribute within a specific range. For instance, retrieve all your 4xx errors with:
@http.status_code:[400 TO 499]
testis searching for the string “test”.
("env:prod" OR test)matches all logs with the tag
#env:prodor the tag
(service:srvA OR service:srvB)or
(service:(srvA OR srvB))Matches all logs that contain tags
("env:prod" AND -"version:beta")matches all logs that contain
#env:prodand that do not contain
If your tags don’t follow tags best practices and don’t use the
key:value syntax, use this search query:
Typing a complex query can be cumbersome. Use the search bar’s autocomplete feature to complete your query using existing values:
The following attributes are considered as special:
\ require escaping.
For instance, to search logs that contain
user=12345 the following search must be entered:
The same logic must be applied to spaces within log attributes. Log attributes should not contain spaces, but in such a case, spaces must be escape.
If an attribute was called
user.first name, perform a search on this attribute by escaping the space:
Don’t lose time building the same views everyday. Saved Views contain your search query, columns, time horizon, and facet.
The time range allows you to display logs within a given time period. It appears directly under the search bar as a timeline. The timeline can be displayed or wrapped up with the Show timeline check box:
Quickly change the time range by selecting a preset range from the dropdown:
If you enter a valid query into the search bar, words that match your query are highlighted, and the logs displayed match your facet criteria:
You can click on any log line to see more details about it:
View in context to see log lines dated just before and after a selected log - even if they don’t match your filter.
The context is different according to the situation as we use the
container_id attributes, along with tags to make sure we find the perfect context for your logs.
To add more log details to the list, click the Columns button and select any facets you want to see:
Choose to display one, three, or ten lines from your logs
message attributes in your logstream.
With one line displayed:
With three lines displayed:
With ten lines displayed:
Note: If present,
error.stack attribute is displayed in priority as it should be used for stack traces.
Remap any stack-trace attribute to this specific attribute with the attribute remapper Processor.
A facet displays all the distinct members of an attribute or a tag as well as provides some basic analytics such as the amount of logs represented. This is also a switch to easily filter your data.
Facets allow you to pivot or filter your datasets based on a given attribute. Examples facets may include users, services, etc…
To start using an attribute as a Facet or in the search, click on it and add it as a Facet:
Use facets to easily filters on your logs. The search bar and url automatically reflect your selections.
A Measure is a attribute with numerical value contained in your logs. Think of it as a “log metric”.
To start using an attribute as a measure, click on a numerical attribute of your log:
All measure have their own unit that is then used for display in the Log Explorer columns, Log stream widgets in dashboards, and in the Log Analytics.
Additional helpful documentation, links, and articles: