Log dashboards strategies
powered by Grail
You can visualize data from your logs using dashboards. You can adjust dashboards to your observability needs, performance and consumption, by selecting one of the two strategies described below. See the Strategy comparison section to help you choose a strategy.
Pinning DQL queries
After selecting Advanced mode in Log and events viewer, you can use DQL queries to retrieve, explore, and analyze data, including patterns and trends over time. After running a query, you can pin the result to a dashboard as a data table, single value, bar chart, or other visualization.
You do not pin the static result of your query to a dashboard. Instead, your query fetches fresh results from Grail every time your dashboard is viewed or refreshed. This guarantees precise and up-to-date data in your dashboards.
Don't turn on autorefresh if you don't need it. Each time a dashboard with DQL query tiles is refreshed manually or automatically, each of those tiles triggers a billed DQL query.
Queries pinned to a dashboard are stopped after 10 seconds to prevent generating excessive costs. If there are partial results within the first 10 seconds, they are displayed in the tile. Otherwise, the tile displays the message "Query exceeded maximum execution time."
To reduce query execution time, try changing the timeframe or adjusting the query.
See below for more about managing dashboard performance and consumption.
When you use dashboards with pinned DQL queries, the following factors can impact your dashboard performance and consumption:
The number of DQL queries pinned to a dashboard
The number of users loading the dashboard
Timeframe selected in the web UI or defined in your pinned DQL query (for example, 30 days)1fetch logs, from:-30d
Sampling ratio specified in your pinned DQL query (for example, 1000)1fetch logs, samplingRatio:1000
Scanlimit parameter in Gigabytes in your pinned DQL query (for example, 10,000)1fetch logs, scanLimitGBytes:10000
See DQL Best practices for optimizing your queries.
Pinning log metrics
You can create metrics based on log data and use them in your analyzes. For example, you can create a dashboard that combines log metrics with the chosen visualizations. See dashboards to learn more.
Metrics extraction from logs takes place during ingest. This means your log metrics are populated when new logs are ingested, and you are not able to use historical logs stored in Dynatrace to create your metrics. After metrics are extracted from logs, the original raw log data can be dropped. For details, see log buckets.
|Action||DQL query result||Log metric|
Show charts and pin to dashboard
Includes historical data
Yes, any timeframe
No, only after the metric is captured
Works without predefined schema
No, you have to set up a new metric
With log events, based on occurrences
Based on occurrences or attribute value
Works without retaining full log data
Yes, original logs can be dropped