Log Details¶

In the log list, click the expand icon on the left of a single log to open the details page of the current log. View detailed information about the log, including the time when the log was generated, the host, source, service, content, extended fields, and view context.

View Full Logs¶

When logs are reported to TrueWatch, if a single log exceeds 1 MB, the system splits it into multiple logs of 1 MB each. For example, a 2.5 MB log is split into 3 logs of 1 MB, 1 MB, and 0.5 MB respectively. The integrity of the split logs can be viewed through the following fields:

In the log details page, if the current log is split into multiple logs, the View Full Logs button is displayed in the top-right corner. Click this button to open a new page listing all related logs in the order of split. At the same time, the page highlights the log selected before the jump with color for quick location of upstream and downstream logs.

Toby AI TruePilot Error Analysis¶

TrueWatch provides the ability to analyze error logs with one click. It uses a large model to automatically extract key information from logs, combined with online search engines and operations knowledge bases, to quickly analyze possible causes of faults and provide preliminary solutions.

1. Filter all logs with status error.
2. Click a single log to expand the details page.
3. Click Toby AI TruePilot Error Analysis in the top-right corner.
4. The anomaly analysis begins.

Error Details¶

If the current log contains error_stack or error_message fields, the system provides error details related to this log.

To view more log error information, go to Log Error Tracing.

Attribute Fields¶

Click attribute fields for quick filtering and viewing. You can view host, process, trace, and container data related to the log.

Log Content¶

• Log content automatically switches between JSON and text viewing modes based on the message type. If the log does not contain a message field, the log content section is not displayed. Log content supports expanding and collapsing. It is expanded by default, and collapsed to show only one line height.
• For logs with source:bpf_net_l4_log, JSON and packet viewing modes are automatically provided. The packet mode displays client, server, time, and other information, and supports switching between absolute time and relative time display. The default is absolute time. The switched configuration is saved in the local browser.

JSON Search¶

In JSON-formatted logs, JSON search can be performed on both key and value. After clicking, the explorer search bar adds @key:value format for searching.

For multi-level JSON data, use . to represent the hierarchical relationship. For example, @key1.key2:value indicates searching for the value corresponding to key2 under key1.

For more details, refer to JSON Search.

Extended Fields¶

• In the search bar, you can enter the field name or value for quick search and location.
• After checking the field alias, it can be viewed after the field name.

• Hover over an extended field and click the dropdown icon to select the following operations for this field:
  • Filter Field Value
  • Exclude Field Value
  • Add to Display Columns
  • Perform Dimension Analysis: Click to jump to Analysis Mode > Time Series Chart
  • Copy

Context Logs¶

The context query function of the log service helps you trace the related records before and after the anomaly log occurs based on time clues, quickly locating the root cause of the problem.

• In the log details page, you can directly view the context logs of the current data.
• The left dropdown box can select the index to filter the corresponding data.
• Sort data.
• Directly jump from the current details page to a new page in the log explorer.
• Display Configuration.
• Settings.

L::RE(`.*`):(`message`) { `index` = 'default' and `host` = "ip-172-31-204-89.cn-northwest-1" AND `source` = "kodo-log" AND `service` = "kodo-inner" AND `filename` = "0.log" and `log_read_lines` >= 1354140 and `log_read_lines` <= 1354200}  sorder by log_read_lines

Log Context Page¶

Click to jump to the log context page. You can manage all current data through the following operations:

• Enter text in the search box to search and locate data.
• Click the button on the side to switch from the default word wrap to content overflow mode. In this mode, each log is displayed as a single line, and you can scroll left or right as needed.
• Directly locate the current log.
• Go to the top/bottom.
• Load 100 logs up/down.

Correlation Analysis¶

The system supports correlation analysis of log data. In addition to error details, extended fields, and context logs, you can also understand the host, container, network, etc. corresponding to the log in one stop.

Built-in Pages¶

For built-in pages such as hosts, containers, and Pods, the following operations are available:

(Take the "Host" built-in page as an example)

• Edit the display fields of the current page. The system automatically matches corresponding data based on the fields.
• Choose to jump to the metric view or host details page.
• Filter the time range.

Built-in Views¶

In addition to the default views displayed by the system, user views can also be bound.

1. Enter the built-in view binding page.
2. View the default associated fields. You can choose to keep or delete fields, and you can also add new key:value fields.
3. Select a view.
4. After binding, the bound built-in view can be viewed in the host object details. You can click the jump button to go to the corresponding built-in view page.