Filter with facets
- Latest Dynatrace
- How-to guide
- 5-min read
Facets are quick filters for log data. They correspond to log attribute key-value pairs detected in your environment and are grouped by facet categories. The most important DQL field IDs are grouped by default in predefined categories. Facets also help you estimate the amount of log data corresponding to each attribute.
Filter data with facets
To query logs in your environment with facets
-
Go to
Logs. -
Expand facet groups like Core or Log source.
-
Expand the facet relevant for your query, like Status.
-
Select values relevant for your query, like Error and Warning.
-
Observe how the filters are generated in the filter field.
-
Select as many facets as needed for your query.
Within a single facet, selected values are combined using the
ORoperator. This means logs matching any of the selected values for that facet will be included. Between different facets, values are combined using theANDoperator. This means logs must match at least one value from each selected facet to be included. -
Select Run query to see logs from your environment based on your filter.
Filter with primary Grail tags
You can enrich logs at ingest with primary Grail tags and query them via primary_tags.* fields. In Logs, primary Grail tags appear as a dedicated Primary tags facet group, so you can filter logs by tag key-value pairs without writing DQL queries.
To filter logs using primary Grail tags
- Go to Logs.
- Expand the Primary tags facet group in the facet list.
- Expand the tag key by which you want to filter, for example, team.
Facets are labeled with the short key (for example,team) rather than the full field name (primary_tags.team). - Select one or more values to filter logs, and then select Run query.
For example, selecting Primary tags > team > payments generates theprimary_tags.team = "payments"query in the filter field.
Enter primary_tag in the filter field to see autosuggestions for primary Grail tag keys.
Keep the following in mind when filtering with primary Grail tags:
- The list of primary Grail tags refreshes every 24 hours. Recently configured tags may take time to appear. Dynatrace performs a short scan of the last few minutes for fresh primary Grail tags.
- If no logs in the selected time range carry a configured primary Grail tag, that tag isn't displayed.
- If no logs with any primary Grail tags are found, the entire Primary tags facet group is hidden.
- The list of primary Grail tags and their values depend on the currently set filters, timeframe, and segment.
Primary tags section in record details
When you open a single log record, primary_tags.* fields are grouped under a dedicated Primary tags section in the record details panel. This keeps primary Grail tag fields separate from core fields (Fields section) and topological context (Topology section), so you can quickly inspect which primary Grail tags a record carries without searching through all fields.
Filter with cloud and Kubernetes tags
AWS, Azure, GCP, and Kubernetes tags that haven't been promoted to primary Grail tags are hidden facets by default, grouped by cloud source. You can unhide them as needed.
To display cloud or Kubernetes tags as facets
- Go to Logs.
- Select (Facet settings) next to the Search facets field above the facet list.
- Find the relevant group (for example, AWS, GCP, or Kubernetes pod labels).
- Unhide the tags you want to use as facets.
- Select Save.
Once unhidden, these facets work the same way as primary Grail tags: expand the facet group, select values, and observe the generated filter.
The following table lists the available facet groups with their corresponding field prefixes and examples.
| Facet group | Field prefix | Example |
|---|---|---|
AWS |
|
|
Azure |
|
|
GCP |
|
|
Kubernetes namespace annotations |
|
|
Kubernetes namespace labels |
|
|
Kubernetes pod annotations |
|
|
Kubernetes pod labels |
|
|
Kubernetes workload annotations |
|
|
Kubernetes workload labels |
|
|
Estimate amount of data with facets
To get a sense of how many logs with specific attributes there are in your environment
- Go to Logs.
- Expand facet groups and facets relevant for your query.
- Look at the approximate values for each value.
The numbers displayed for each facet value represent the approximate number of logs based on your last query filters. If you see the '~' symbol, it indicates that Dynatrace is using sampling when reading log data to improve responsiveness.
Example:
- You query error logs from Kubernetes namespace "astroshop" with following filters:
k8s.namespace.name = "astroshop"status = "Error". - After executing query, look at the facet
k8s.container.name. - You will only see container names for logs coming from Kubernetes namespace "astroshop" with the status "Error".
- Number displayed next to each container name shows the approximate number of logs with Kubernetes namespace "astroshop", status "Error" and respective container name.
Manage all facets
To manage which facets of your environment are displayed
- Go to Logs.
- Select Facets edit icon next to the facets search bar.
- Select or deselect items from the predefined categories.
- Check the category box to select or deselect all facets in the category.
- Select to view the facets in a category and select or deselect them.
- Select Save.
Revert to default settings
If you have previously modified the facets, to revert to the default settings for facets in your environment
- Go to Logs.
- Select Facets edit icon next to the facets search bar.
- Select Reset to default.
- Select Save.
Logs