--- title: Watchdog Insights for Logs description: Get Insights on where to Start or Follow-Up your Investigations breadcrumbs: Docs > Log Management > Log Explorer > Watchdog Insights for Logs --- # Watchdog Insights for Logs ## Overview{% #overview %} Datadog Log Management offers Watchdog Insights to help you resolve incidents faster with contextual insights in the Log Explorer. Watchdog Insights complement your expertise and instincts by surfacing suspect anomalies, outliers, and potential performance bottlenecks impacting a subset of users. {% image source="https://docs.dd-static.net/images/logs/explorer/watchdog_insights/insights-for-log-explorer.aea00acf4cce10aaacc1f780dceae245.png?auto=format&fit=max&w=850 1x, https://docs.dd-static.net/images/logs/explorer/watchdog_insights/insights-for-log-explorer.aea00acf4cce10aaacc1f780dceae245.png?auto=format&fit=max&w=850&dpr=2 2x" alt="The log explorer showing the Watchdog Insights banner with five log anomalies" /%} ## Navigation{% #navigation %} The Watchdog Insights banner appears in the [Log Explorer](https://app.datadoghq.com/logs) and displays insights about the current query: {% image source="https://docs.dd-static.net/images/logs/explorer/watchdog_insights/banner_collapsed.2e92a79543cfdbb406c184e2f3fdc700.png?auto=format&fit=max&w=850 1x, https://docs.dd-static.net/images/logs/explorer/watchdog_insights/banner_collapsed.2e92a79543cfdbb406c184e2f3fdc700.png?auto=format&fit=max&w=850&dpr=2 2x" alt="The Watchdog Insights banner in the collapsed view" /%} To see an overview of all insights, expand the Watchdog Insight banner: {% image source="https://docs.dd-static.net/images/logs/explorer/watchdog_insights/banner_expanded.2aa5b09856bec287d0b87cc426765dfe.png?auto=format&fit=max&w=850 1x, https://docs.dd-static.net/images/logs/explorer/watchdog_insights/banner_expanded.2aa5b09856bec287d0b87cc426765dfe.png?auto=format&fit=max&w=850&dpr=2 2x" alt="The Watchdog Insights banner showing three error outliers" /%} To access the full Watchdog Insights side panel, click **View all**: {% image source="https://docs.dd-static.net/images/logs/explorer/watchdog_insights/side_panel.5e761a6b692644c05d42ba5f38a35545.png?auto=format&fit=max&w=850 1x, https://docs.dd-static.net/images/logs/explorer/watchdog_insights/side_panel.5e761a6b692644c05d42ba5f38a35545.png?auto=format&fit=max&w=850&dpr=2 2x" alt="The Watchdog Insights side panel showing more details about the error outliers" /%} Every insight comes with embedded interactions and a side panel with troubleshooting information. The insight interactions and side panel vary based on the Watchdog Insight type. ## Insight Types{% #insight-types %} [Watchdog Insights](https://docs.datadoghq.com/watchdog.md) surfaces anomalies and outliers detected on specific tags, enabling you to investigate the root cause of an issue. [Insights](https://docs.datadoghq.com/watchdog/insights.md?tab=logmanagement#outlier-types) are discovered from APM, Continuous Profiler, Log Management, and infrastructure data that include the `service` tag. The two types of insights specific to Log Management are: - Log Anomaly Detection - Error Outliers ### Log Anomaly Detection{% #log-anomaly-detection %} Ingested logs are analyzed at the intake level where Watchdog performs aggregations on detected patterns as well as `environment`, `service`, `source` and `status` tags. These aggregated logs are scanned for anomalous behaviors, such as the following: - An emergence of logs with a warning or error status. - A sudden increase of logs with a warning or error status. The logs surface as Insights in the Log Explorer, matching the search context and any restrictions applied to your role. {% video url="https://docs.dd-static.net/images/logs/explorer/watchdog_insights/log-anomalies-light-cropped.mp4" /%} Click on a specific insight to see the full description of the detected anomaly as well as the list of patterns contributing to it. Anomalies that Watchdog determines to be particularly severe are also surfaced in the [Watchdog alerts feed](https://app.datadoghq.com/watchdog) and can be alerted on by setting up a [Watchdog logs monitor](https://docs.datadoghq.com/monitors/types/watchdog.md). A severe anomaly is defined as: - containing error logs - lasting at least 10 minutes (to avoid transient errors) - having a significant increase (to avoid small increases) For more information about searching logs in the Log Explorer, see [Log Search Syntax](https://docs.datadoghq.com/logs/search-syntax.md) and [Custom Time Frames](https://docs.datadoghq.com/dashboards/guide/custom_time_frames.md). ### Error Outliers{% #error-outliers %} Error outliers display fields such as [faceted tags or attributes](https://docs.datadoghq.com/logs/explorer/facets.md) containing characteristics of errors that match the current query. Statistically overrepresented `key:value` pairs among errors provide hints into the root cause of problems. Typical examples of error outliers include `env:staging`, `docker_image:acme:3.1`, and `http.useragent_details.browser.family:curl`. In the **banner card** view, you can see: - The field name. - The proportion of errors and overall logs that the field contributes to. {% image source="https://docs.dd-static.net/images/logs/explorer/watchdog_insights/error_outlier_s_card.2d48225813493400ae713155c4e3a992.png?auto=format&fit=max&w=850 1x, https://docs.dd-static.net/images/logs/explorer/watchdog_insights/error_outlier_s_card.2d48225813493400ae713155c4e3a992.png?auto=format&fit=max&w=850&dpr=2 2x" alt="The error outlier card showing a red bar with 73.3% of total errors and a blue bar with 8.31% of total errors" /%} In the **side panel card** view, you can see the main [log pattern](https://docs.datadoghq.com/logs/explorer/analytics/patterns.md) of error logs with the field. {% image source="https://docs.dd-static.net/images/logs/explorer/watchdog_insights/error_outlier_l_card.257e62d2cd10710691b019e15960ba7f.png?auto=format&fit=max&w=850 1x, https://docs.dd-static.net/images/logs/explorer/watchdog_insights/error_outlier_l_card.257e62d2cd10710691b019e15960ba7f.png?auto=format&fit=max&w=850&dpr=2 2x" alt="Error Outlier card (L)" /%} In the **full side panel** view, you can see: - The timeseries of error logs that contain the field. - Tags that are often associated with the error logs. - A comprehensive list of [log patterns](https://docs.datadoghq.com/logs/explorer/analytics/patterns.md). {% image source="https://docs.dd-static.net/images/logs/explorer/watchdog_insights/error_outlier_side_panel.aff0751da0bbf40eb477f3e732bb09b1.png?auto=format&fit=max&w=850 1x, https://docs.dd-static.net/images/logs/explorer/watchdog_insights/error_outlier_side_panel.aff0751da0bbf40eb477f3e732bb09b1.png?auto=format&fit=max&w=850&dpr=2 2x" alt="Error Outlier side panel" /%} ## Further Reading{% #further-reading %} - [Accelerate your logs investigations with Watchdog Insights](https://www.datadoghq.com/blog/datadog-watchdog-insights-log-management/) - [More information on the log side panel](https://docs.datadoghq.com/logs/explorer/side_panel.md) - [Learn more about Log Explorer](https://docs.datadoghq.com/logs/explorer.md#list-of-logs)