Try it free

Filter with facets

  • Latest Dynatrace
  • How-to guide
  • 5-min read

Facets are quick filters for log data. They correspond to log attribute key-value pairs detected in your environment and are grouped by facet categories. The most important DQL field IDs are grouped by default in predefined categories. Facets also help you estimate the amount of log data corresponding to each attribute.

Filter data with facets

To query logs in your environment with facets

  1. Go to Logs Logs.

  2. Expand facet groups like “Core” or “Log source”.

  3. Expand the facet relevant for your query, like “Status”.

  4. Select values relevant for your query, like “Error” and “Warning”.

  5. Observe how the filters are generated in the filter field.

  6. Select as many facets as needed for your query.

    Within a single facet, selected values are combined using the OR operator. This means logs matching any of the selected values for that facet will be included. Between different facets, values are combined using the AND operator. This means logs must match at least one value from each selected facet to be included.

  7. Press Run query to see logs from your environment based on your filter.

Filter with primary tags

You can enrich logs at ingest with primary tags and query them via primary_tags.* fields.

To filter logs using primary tags

  1. Go to Logs Logs.
  2. Expand the Primary tags facet group.
  3. Expand the tag you want to filter by. Facets are labeled with the short key (for example, team) rather than the full field name (primary_tags.team).
  4. Select one or more values to filter logs. Selecting Primary tags > team > payments produces primary_tags.team = "payments" in the filter field.
  5. Select Run query.

Type tag in the filter field to see autosuggestions for primary tag keys.

Behavior notes:

  • The list of primary tags refreshes once every 24 hours. Recently configured tags may take time to appear.
  • If no logs in the selected time range carry a configured primary tag, it isn't displayed.
  • If no logs with any primary tags are found, the entire Primary tags facet group is hidden.
  • The shown values depend on the current query filters, timeframe, and segment.

When you open a single log record, primary_tags.* fields are grouped under a dedicated Primary tags section, separate from core fields and cloud/Kubernetes metadata.

Filter with cloud and Kubernetes tags

AWS, Azure, GCP, and Kubernetes tags that aren't promoted to primary tags are hidden facets by default, grouped by source.

To display cloud or Kubernetes tags as facets

  1. Go to Logs Logs.
  2. Select Facets edit icon next to the facets search bar.
  3. Find the relevant group (for example, AWS, Azure, GCP, Kubernetes namespace labels, Kubernetes namespace annotations, Kubernetes pod labels, Kubernetes pod annotations, Kubernetes workload labels, or Kubernetes workload annotations).
  4. Unhide the tags you want to use as facets.
  5. Select Save.

Once visible, these facets work the same way as primary tags: expand the group, select values, and observe the Filter field.

Facet groupField prefixExample

AWS

aws.tags.*

aws.tags.owner

Azure

azure.tags.*

azure.tags.costcenter

GCP

gcp.labels.*, gcp.tags.*

gcp.labels.team, gcp.tags.payroll.app

Kubernetes namespace annotations

k8s.namespace.annotation.*

k8s.namespace.annotation.env

Kubernetes namespace labels

k8s.namespace.label.*

k8s.namespace.label.app

Kubernetes pod annotations

k8s.pod.annotation.*

k8s.pod.annotation.env

Kubernetes pod labels

k8s.pod.label.*

k8s.pod.label.app

Kubernetes workload annotations

k8s.workload.annotation.*

k8s.workload.annotation.env

Kubernetes workload labels

k8s.workload.label.*

k8s.workload.label.app

Estimate amount of data with facets

To get a sense of how many logs with specific attributes there are in your environment

  1. Go to Logs Logs.
  2. Expand facet groups and facets relevant for your query.
  3. Look at the approximate values for each value.

The numbers displayed for each facet value represent the approximate number of logs based on your last query filters. If you see the '~' symbol, it indicates that Dynatrace is using sampling when reading log data to improve responsiveness.

Example:

  • You query error logs from Kubernetes namespace “astroshop” with following filters: k8s.namespace.name = "astroshop" status = "Error"
  • After executing query, look at the facet k8s.container.name
  • You will only see container names for logs coming from Kubernetes namespace “astroshop” with the status “Error”
  • Number displayed next to each container name shows the approximate number of logs with Kubernetes namespace “astroshop”, status “Error” and respective container name

Manage all facets

To manage which facets of your environment are displayed

  1. Go to Logs Logs.
  2. Select Facets edit icon next to the facets search bar.
  3. Select or deselect items from the predefined categories.
    • Check the category box to select or deselect all facets in the category.
    • Select to view the facets in a category and select or deselect them.
  4. Select Save.

Revert to default settings

If you have previously modified the facets, to revert to the default settings for facets in your environment

  1. Go to Logs Logs.
  2. Select Facets edit icon next to the facets search bar.
  3. Select Reset to default.
  4. Select Save.
Related tags
Log AnalyticsLogsLogs