Log Details¶

Click on the log list to slide out the details page of the current log, where you can view detailed information including the time the log was generated, the host, source, service, content, extended fields, and context.

View Full Log¶

When logs are reported to TrueWatch, if the data exceeds 1M in size, it will be split according to the 1M standard. For example, a log of 2.5M will be split into 3 logs (1M/1M/0.5M). The completeness of the split logs can be checked through the following fields:

On the log details page, if the current log is split into multiple logs, a View Full Log button will appear in the upper right corner. Clicking this button will open a new page and list all related logs in the order of the split, with the log selected before the jump highlighted in color to help locate the upstream and downstream logs.

Obsy AI Error Analysis¶

TrueWatch provides the ability to parse error logs with one click. It uses a large model to automatically extract key information from the logs, combined with online search engines and operation knowledge bases, to quickly analyze possible fault causes and provide preliminary solutions.

1. Filter all logs with the status error;
2. Click on a single data entry to expand the details page;
3. Click Obsy AI Error Analysis in the upper right corner;
4. Start the anomaly analysis.

Error Details¶

If the current log contains error_stack or error_message field information, the system will provide you with error details related to this log.

To view more log error information, go to Log Error Tracing.

Attribute Fields¶

Click on attribute fields to quickly filter and view host, process, trace, and container data related to the log.

Log Content¶

• The log content automatically switches between JSON and text viewing modes based on the message type. If the message field does not exist in the log, the log content section will not be displayed. The log content supports expanding and collapsing, with the default being expanded. When collapsed, only one line of height is displayed.

• For logs with source:bpf_net_l4_log, both JSON and packet viewing modes are automatically provided. The packet mode displays client, server, time, and other information, and supports switching between absolute and relative time display, with the default being absolute time. The switched configuration is saved in the local browser.

JSON Search¶

In JSON format logs, both key and value can be searched. After clicking, the explorer search bar will add the format @key:value for searching.

For multi-level JSON data, use . to represent the hierarchical relationship. For example, @key1.key2:value indicates searching for the value corresponding to key2 under key1.

For more details, refer to JSON Search.

Extended Fields¶

• In the search bar, you can enter the field name or value to quickly search and locate;

• After checking the field alias, you can view it after the field name;

• Hover over an extended field, click the dropdown icon, and choose to perform the following operations on this field:

  • Filter Field Value
  • Reverse Filter Field Value
  • Add to Display Column
  • Perform Dimension Analysis: Click to jump to Analysis Mode > Time Series Chart
  • Copy

View Context Logs¶

The context query function of the log service helps you trace related records before and after the occurrence of an abnormal log through a time clue, quickly locating the root cause of the problem.

• On the log details page, you can directly view the context logs of the current data content;
• You can sort the data by clicking the "Time" list;
• The left dropdown box allows you to select an index to filter out the corresponding data;
• Jump to open a new page for context logs.

L::RE(`.*`):(`message`) { `index` = 'default' and `host` = "ip-172-31-204-89.cn-northwest-1" AND `source` = "kodo-log" AND `service` = "kodo-inner" AND `filename` = "0.log" and `log_read_lines` >= 1354140 and `log_read_lines` <= 1354200}  sorder by log_read_lines

Context Log Details Page¶

Click to jump to the details page. You can manage all current data through the following operations:

• Enter text in the search box to search and locate data;
• Click the button on the side to switch the system's default automatic line wrapping to content overflow mode. In this mode, each log is displayed as one line, and you can scroll left and right to view as needed.

Correlation Analysis¶

The system supports correlation analysis of log data. In addition to error details, extended fields, and context logs, you can also get a one-stop understanding of the host, container, network, etc., corresponding to the log.

Built-in Pages¶

For built-in pages such as Host, Container, Pod, etc., you can perform the following operations:

(Take the "Host" built-in page as an example)

• Edit the current page display fields, and the system will automatically match the corresponding data based on the fields;
• Choose to jump to the metric view or host details page;
• Filter the time range.

Built-in Views¶

In addition to the views displayed by default in the system, you can also bind user views.

1. Enter the built-in view binding page;
2. View the default associated fields. You can choose to keep or delete fields, and also add new key:value fields;
3. Select the view;
4. After completing the binding, you can view the bound built-in views in the host object details. You can click the jump button to go to the corresponding built-in view page.