Log Management and Analytics
Logs
This section contains general log information. There can be additional records added both resource attributes describing source as well as log record attributes to add structured log record data.
Query
Logs can be queried in Grail with the following query:
fetch logs
Attribute
Type
Description
Examples
content
string
experimental
Unstructured content of the record. It should contain human readable message. Often it is raw version of record read from a source.
Unstructured content of the record. It should contain human readable message. Often it is raw version of record read from a source.
No keepalive from datasource statsd. Restarting
event.type
string
stable
The unique type identifier of a given event.
Tags:
The unique type identifier of a given event.
Tags:
permission
LOG
log.iostream
string
stable
The I/O stream to which the log was emitted.
The I/O stream to which the log was emitted.
stdout
; stderr
log.source
string
/var/log/messages
; Windows Event Log
; Docker Container Output
; stdout
loglevel
string
stable
The log event severity level.
The log event severity level.
ERROR
; INFO
; TRACE
process.technology
string[]
experimental
Technologies detected for the process.
Technologies detected for the process.
[['Java', 'Tomcat'], ['Go', 'Envoy']]
status
string
experimental
Overall significance of log event, derived from log level. Only INFO, WARN, ERROR and NONE values are allowed.
Overall significance of log event, derived from log level. Only INFO, WARN, ERROR and NONE values are allowed.
ERROR
; WARN
; INFO
; NONE
timestamp
timestamp
stable
The time (UNIX Epoch time in nanoseconds) when the event originated, typically when it was created by the source. If no original timestamp is available, it will be populated at ingest time. Required for all events. In case of a correlated event (e.g. ITIL events) this time could be different from the event.start time, as this time represents the actual timestamp when the "update" for the event was created.
The time (UNIX Epoch time in nanoseconds) when the event originated, typically when it was created by the source. If no original timestamp is available, it will be populated at ingest time. Required for all events. In case of a correlated event (e.g. ITIL events) this time could be different from the event.start time, as this time represents the actual timestamp when the "update" for the event was created.
1649822520123123123
1
Can contain e.g. a file path, standard output, an URI etc., depending on log stream type. The value should be stable for one logical source, so e.g. not affected by log file rotation digits.