ecd9f335cb
* [Logs UI] Change 'View monitor status' to 'View status in Uptime' * Update docs with text change * Remove docs comment
80 lines
4.1 KiB
Plaintext
80 lines
4.1 KiB
Plaintext
[role="xpack"]
|
|
[[xpack-logs-using]]
|
|
== Using the Logs app
|
|
Use the Logs app in {kib} to explore and filter your logs in real time.
|
|
|
|
You can customize the output to focus on the data you want to see and to control how you see it.
|
|
You can also view related application traces or uptime information where available.
|
|
|
|
[role="screenshot"]
|
|
image::logs/images/logs-console.png[Logs Console in Kibana]
|
|
// ++ Update this
|
|
|
|
[float]
|
|
[[logs-search]]
|
|
=== Use the power of search
|
|
|
|
Use the search bar to perform ad hoc searches for specific text.
|
|
You can also create structured queries using {kibana-ref}/kuery-query.html[Kibana Query Language].
|
|
For example, enter `host.hostname : "host1"` to see only the information for `host1`.
|
|
// ++ this isn't quite the same as the corresponding infrastructure description now.
|
|
|
|
[float]
|
|
[[logs-configure-source]]
|
|
=== Configure the data to use for your logs
|
|
Are you using a custom index pattern to store the log entries?
|
|
Do you want to limit the entries shown or change the fields displayed in the columns?
|
|
If so, <<xpack-logs-configuring, configure the logs source data>> to change the index pattern and other settings.
|
|
|
|
[float]
|
|
[[logs-time]]
|
|
=== Specify the time and date
|
|
|
|
Click the time selector image:logs/images/logs-time-selector.png[time selector icon] to choose the timeframe for the logs.
|
|
Log entries for the time you specify appear in the middle of the page, with the earlier entries above and the later entries below.
|
|
|
|
To quickly jump to a nearby point in time, click the minimap timeline to the right.
|
|
// ++ what's this thing called? It's minimap in the UI. Would timeline be better?
|
|
|
|
[float]
|
|
[[logs-customize]]
|
|
=== Customize your view
|
|
Click *Customize* to customize the view.
|
|
Here, you can set the scale to use for the minimap timeline, choose whether to wrap long lines, and choose your preferred text size.
|
|
|
|
[float]
|
|
[[logs-stream]]
|
|
=== Stream or pause logs
|
|
Click *Stream live* to start streaming live log data, or click *Stop streaming* to focus on historical data.
|
|
|
|
When you are viewing historical data, you can scroll back through the entries as far as there is data available.
|
|
|
|
When you are streaming live data, the most recent log appears at the bottom of the page.
|
|
In live streaming mode, you are not able to choose a different time in the time selector or use the minimap timeline.
|
|
To do either of these things, you need to stop live streaming first.
|
|
// ++ Not sure whether this is correct or not. And what about just scrolling through the display?
|
|
// ++ There may be a bug here, (I managed to get future logs) see https://github.com/elastic/kibana/issues/43361
|
|
|
|
[float]
|
|
[[logs-highlight]]
|
|
=== Highlight a phrase in the logs stream
|
|
To highlight a word or phrase in the logs stream, click *Highlights* and enter your search phrase.
|
|
// ++ Is search case sensitive?
|
|
// ++ Can you search for multiple phrases together, if so, what's the separator?
|
|
// ++ What about special characters? For example, I notice that when searching for "Mozilla/4.0" which appears as written in my logs, "Mozilla" is highlighted, as is "4.0" but "/" isn't. The string "-" (which appears in the logs as written, quotes and all, isn't found at all. Any significance?
|
|
|
|
[float]
|
|
[[logs-event-inspector]]
|
|
=== Inspect a log event
|
|
To inspect a log event, hover over it, then click the *View details* icon image:logs/images/logs-view-event.png[View event icon] beside the event.
|
|
This opens the *Log event document details* fly-out that shows the fields associated with the log event.
|
|
|
|
To quickly filter the logs stream by one of the field values, click the *View event with filter* icon image:logs/images/logs-view-event-with-filter.png[View event icon] beside the field.
|
|
This automatically adds a search filter to the logs stream to filter the entries by this field and value.
|
|
|
|
In the log event details, click *Actions* to see the other actions related to the event.
|
|
Depending on the event and the features you have installed and configured, you may also be able to:
|
|
|
|
* Select *View status in Uptime* to <<uptime-overview, view related uptime information>> in the *Uptime* app.
|
|
* Select *View in APM* to <<traces, view related APM traces>> in the *APM* app.
|