Try it free

Log events

  • Latest Dynatrace
  • How-to guide
  • 5-min read

Dynatrace Log Management and Analytics gives you the ability to create log events based on log data and use them in problem detection.

Log event pricing is based on the Dynatrace Platform Subscription (DPS) model. For details, see Events powered by Grail overview (DPS).

When Dynatrace ingests log data, it applies the query specified in the log event definition. Every matched occurrence triggers a log event that can be configured to individually create a problem for each triggered log event or can be merged into one problem.

Create a log event

  1. Go to Settings Settings > Process and contextualize > OpenPipeline > Logs.

  2. Select the Pipelines tab.

  3. Find or create the pipeline you want to modify, and select Edit.

  4. Select the Davis tab and add a Davis event processor.

  5. Enter the Name.
    The name is a required field that identifies the Davis event processor.

  6. In Matching condition, enter a DQL matcher to filter the log data for your log event.
    For details, see DQL matcher in OpenPipeline.

  7. Configure the Event template.

    • Enter the Event name. If this log event triggers a problem, this name will also be the title of the problem.
    • Enter the Event description. You can include one or more placeholders in the description.
      For details, see Placeholders.

  8. Add Event properties. Set the required event.type property (for example, CUSTOM_ALERT) and add any other event properties you need. A property is a key/value pair that is set on every triggered event. You can have one or more placeholders as a value that will be extracted from the log data. For example, a property with Key set to dt.smartscape.source_id and a Value of placeholder {dt.smartscape.source_id} will extract the source ID value from log data once the event is triggered. If the placeholder substitution fails, both the key and the value will not be available.

    The dt.event.allow_davis_merge property does not split problems for the same log event configuration. It only prevents merging with problems from other log event configurations or other problem domains (such as custom alerts).
    If you want to split problems for the same log event configuration, the event.unique_identifier property must be present in the actual log data. You can then use a placeholder in your log event configuration to reference this property.
    For example, to create a separate problem for each log line message, use event.unique_identifier={content}.

For details on the Davis event processor parameters, see Davis stage in OpenPipeline. For a guided walkthrough, see Set up alerts based on events extracted from logs.

Set a timeout for a log event

Log events have a default timeout of 15 minutes. The timeout defines how frequently the event source must refresh the log event to keep it active. The maximum time allowed for a log event is six hours.

  • A log event is kept active if the event source sends a refresh before the event times out (default: 15 minutes).
  • An event automatically closes if no refresh is sent within the timeout period.
  • You can customize the timeout.

To set a custom timeout:

  1. When you create or edit a log event, select Add property.
  2. Set Key to dt.event.timeout.
  3. Set Value to the number of minutes (for example, 12).

To verify that a custom timeout was added for an event triggered on the host level:

  1. Go to Infrastructure & Operations Infrastructure & Operations > Compute > Hosts, and select the host name.
  2. Select Events and view the details.

Placeholders

Placeholders are log entry attributes that can be used to extract the actual value from the log data.

  • You can use any attribute listed in Logs Logs for a given log entry as a placeholder to extract that attribute value.
  • You can use additional log entry attributes in Logs Logs as placeholders for the values they represent in the log data. Enclose placeholder values in brackets (for example, {dt.process.name}).
Related tags
Log Analytics