Deriving insights from logs
Get to the root cause of an issue by using out-of-the-box options such as queries, time range, fields, and so on. For example, you observed multiple log entries with 401 status in your Apache logs. A few of such entries might mean that users forgot their passwords. However, multiple entries from same IP address in a short time span might mean a security threat. Use the search options and narrow down the results to find the root cause. For quick references, add the filtered logs to dashboards.
The following video (2:53) illustrates how to analyze and visualize logs:
Search and analyze logs on the Explorer > Discover tab. The following figure highlights the important features of the page that help you in getting to the root cause of an issue.
Let's explore these features in detail.
Index patterns
By default, an index pattern is created for your tennant. All the logs are collected under this index pattern. You can neither delete this index pattern nor create a new one.
To search for specific information in the logs
Use the Search field and search for a specific value in a field present in the logs, like an error in the status field.
If you know only a part of the string that you are looking for, use the filters. Filters will help you further refine the search results. Add filters on the basis of field values.
You can use the search field and filters both at the same time.
To filter search results by time range and date
The following options are available to set the date to narrow down your search results:
Specify days or hours since when you want to search results. For example, search results for last 15 minutes or last 7 days.
Set specific date and time (absolute or specific). For example, search results for Jul 18, 2022 18:00 hours till Jul 19, 2022 18:00 hours.
As an administrator or operator, analyze logs and keep your systems (or environments) healthy:
| Action | Details | Steps |
|---|---|---|
| Search logs | Narrow down the search results by using a combination of queries, time range, and fields. For example, by searching logs you found that the 401 status code was returned only a few times in a particular time period, say an hour. The following image shows the options that will help you search logs and narrow down results to the actual issue:
|
|
| Save search | Save the search that you might need in the future. Share the saved searches with other users in your organization.
| To save the filter criteria for later use as a saved search, click Save. |
| Add visualizations and dashboards | View log data in the form of charts and other graphical representations (tables, region map, heat map, and so on) by creating visualizations and adding them to dashboards. You can monitor log entries through these dashboards. Filter data by using the filtering options, such as query and time range. For example, add a visualization for all 401 status codes where count is more than 5 in one hour to a dashboard.
|
|
Comments
Is there an image missing for the following paragraphs?
To search for a specific information in the logs Use the Search field and search for a specific value in a field present in the logs, like error in the status field. If you know only a part of the string that you are looking for, use the filters. Filters will help you further refine the search results. Add filters on the basis of field values.
You can use the search field and filters both at the same time.
To filter search results by time range and date The following options are available to set the date to narrow down your search results:
Specify days or hours since when you want to search results. For example, search results for last 15 minutes or last 7 days.
Set specific date and time (absolute or specific). For example, search results for Jul 18, 2022 18:00 hours till Jul 19, 2022 18:00 hours.
Thanks for bringing it to our notice! We have corrected the page.
I request you to visit the latest space for Log Analytics. This space is not current.
Thanks and regards,
Swati
Log in or register to comment.