Log Details¶

In the log list, click the expand icon on the left side of a single log to slide out the details page of the current log and view detailed log information, including the log generation time, host, source, service, content, extended fields, context view, and more.

View Full Log¶

When logs are reported to TrueWatch, if a single log entry exceeds 1M, the system splits it into multiple entries according to the 1M standard. For example, a 2.5M log is split into 3 entries: 1M, 1M, and 0.5M. You can view the completeness of the split log through the following fields:

On the log details page, if the current log has been split into multiple entries, a View Full Log button appears in the upper right corner of the page. Clicking this button opens a new page that lists all related logs in split order. At the same time, the page highlights the log selected before the jump with color, so you can quickly locate upstream and downstream logs.

TOBY AI TruePilot Error Analysis¶

TrueWatch provides one-click parsing for error logs. It uses a large model to automatically extract key information from logs and, combined with online search engines and operational knowledge bases, quickly analyzes possible causes of failures and provides preliminary solutions.

1. Filter all logs with status error;
2. Click a single record to expand the details page;
3. Click TOBY AI TruePilot Error Analysis in the upper right corner;
4. Anomaly analysis then begins.

Error Details¶

If the current log contains error_stack or error_message field information, the system provides the error details related to this log.

To view more log error information, see Log Error Tracking.

Attribute Fields¶

Click an attribute field to quickly filter and view host, process, trace, and container data related to the log.

Log Content¶

Log content automatically switches between JSON and text view modes based on the message type. The log details display log content according to the index mode and log fields:

• When message exists in the log, the message content is displayed first, and the view switches between JSON and text mode based on the content type;
• When full-text index logs have no message, the system displays the log content using a combination of the current log's business fields;
• System fields are not part of the full-text index log content;
• Log content supports expansion and collapse. It is expanded by default, and collapses to a single line when collapsed.

Log content supports expansion and collapse. It is expanded by default; when collapsed, only one line height is displayed.

For logs with source:bpf_net_l4_log, JSON and packet view modes are automatically provided. Packet mode displays the client, server, time, and other information, and supports switching between absolute time and relative time display, with absolute time as the default. The switched configuration is saved in the local browser.

Selecting Log Segments¶

In log content that supports segment operations, you can click a Chinese or mixed Chinese-English segment and use the menu to filter, exclude, or copy. Clicking a segment only opens the menu; the query is updated only after a filter operation is selected.

The selection scope depends on the text format and display position:

For example, in the plain text 用户登录失败，请重试。 ("User login failed, please try again."), you can select "用户登录失败" ("User login failed") or "请重试" ("Please try again"); in 调用API失败 请稍后重试 ("API call failed, please try again later"), you can select the two space-separated segments "调用API失败" ("API call failed") and "请稍后重试" ("Please try again later"). The URL https://example.com/search?q=日志&limit=10#result is recognized as a whole and is not split due to internal query parameters or fragment identifiers.

When filtering, the system appends the selected segment to the current query while preserving the existing index, time range, workspace, and other filter conditions. If part of the text matches the search highlight, clicking still selects the complete segment.

When filtering via a JSON field, the corresponding actual field path is still used. Modes such as DQL and SLS continue to follow the operation restrictions and conversion confirmation rules of the current entry.

JSON Search¶

In JSON-format logs, JSON search can be performed on both key and value. After clicking, the explorer search bar adds the @key:value format for searching.

For multi-level JSON data, . is used to represent the hierarchical relationship. For example, @key1.key2:value searches for the value corresponding to key2 under key1.

For more details, see JSON Search.

Extended Fields¶

• In the search bar, you can enter a field name or value to quickly search and locate;

• After selecting a field alias, it can be viewed after the field name;

• Hover over an extended field and click the dropdown icon to choose the following operations for that field:

  • Filter Field Value

  • Exclude Field Value

  • Add to Display Columns

  • Dimension Analysis: click to jump to Analysis mode > Time Series Chart

  • Copy

Context Logs¶

The context query feature of the log service uses time clues to help you trace the records around an anomalous log and quickly locate the root cause of the problem.

• On the log details page, you can directly view the context logs of this record;

• Use the dropdown on the left to select an index and filter the corresponding data;

• Sort the data;

• Jump directly from the current details page to a new log explorer page;

• Display Configuration;

• Settings.

L::RE(`.*`):(`message`) { `index` = 'default' and `host` = "ip-172-31-204-89.cn-northwest-1" AND `source` = "kodo-log" AND `service` = "kodo-inner" AND `filename` = "0.log" and `log_read_lines` >= 1354140 and `log_read_lines` <= 1354200}  sorder by log_read_lines

Log Context Page¶

Click to jump to the log context page. You can manage all current data through the following operations:

• Enter text in the search box to search and locate data;

• Click the button on the side to switch the system default automatic line wrapping to content overflow mode, where each log is displayed as a single line and you can scroll left or right as needed;

• Return to top/bottom;

• Load 100 records upward/downward;

• Click the export icon to export the current log context data.

Related Analysis¶

The system supports related analysis of log data. In addition to error details, extended fields, and context logs, you can also understand at a glance the host, containers, network, and other resources corresponding to the log.

Built-in Pages¶

For built-in pages such as Host, Containers, and Pods, you can perform the following operations:

(Using the "Host" built-in page as an example)

• Edit the display fields of the current page, and the system automatically matches the corresponding data based on the fields;

• Choose to jump to the metrics view or host details page;

• Filter the time range.

Built-in Views¶

In addition to the views displayed by default here, you can also bind custom views.

1. Go to the built-in view binding page;

2. View the default associated fields. You can choose to keep or delete fields, and add new key:value fields;

3. Select a view;

4. After binding is complete, you can view the bound built-in view in the host object details. Click the jump button to go to the corresponding built-in view page.