Log Details¶

In the log list, click the expand icon on the left side of a single log to slide out the detail page for that log. Here, you can view detailed information about the log, including the time it was generated, host, source, service, content, extended fields, context, and more.

View Complete Log¶

When logs are reported to Guance, if a single log entry exceeds 1M in size, the system will split it into multiple entries based on a 1M standard. For example, a 2.5M log will be split into 3 entries: 1M, 1M, and 0.5M. The completeness of split logs can be checked using the following fields:

On the log detail page, if the current log has been split into multiple pieces, a View Complete Log button will appear in the upper right corner. Clicking this button opens a new page listing all related logs in their split order. The page will also highlight the log selected before the jump with color for quick positioning of upstream and downstream logs.

Obsy AI Error Analysis¶

Guance provides the capability to analyze error logs with one click. It utilizes large language models to automatically extract key information from logs, combines online search engines and an operations knowledge base, quickly analyzes potential fault causes, and offers preliminary solutions.

1. Filter all logs with a status of error;
2. Click on a single data entry to expand its detail page;
3. Click Obsy AI Error Analysis in the upper right corner;
4. Begin the anomaly analysis.

Error Details¶

If the current log contains error_stack or error_message field information, the system will provide error details related to this log entry.

To view more log error information, go to Log Error Tracing.

Attribute Fields¶

Click on attribute fields for quick filtering and viewing. You can view host, process, trace, and container data related to the log.

Log Content¶

• The log content automatically switches between JSON and text viewing modes based on the message type. If the message field does not exist in the log, the log content section is not displayed. Log content supports expanding and collapsing; it is expanded by default and collapses to show only one line height.
• For logs with source:bpf_net_l4_log, both JSON and packet viewing modes are automatically provided. The packet mode displays client, server, time information, and supports switching between absolute and relative time display (absolute time is default). The switched configuration is saved in the local browser.

JSON Search¶

In JSON-formatted logs, you can search within both the key and value. After clicking, the explorer search bar will add the format @key:value for searching.

For multi-level JSON data, use . to represent the hierarchical relationship. For example, @key1.key2:value means searching for the value corresponding to key2 under key1.

For more details, refer to JSON Search.

Extended Fields¶

• In the search bar, you can enter a field name or value to quickly search and locate fields.
• After checking the field alias, you can view it next to the field name.

• Hover over an extended field and click the dropdown icon to perform the following operations on that field:
  • Filter Field Value
  • Exclude Field Value
  • Add to Display Columns
  • Perform Dimensional Analysis: Click to jump to Analysis Mode > Time Series Chart
  • Copy

Context Logs¶

The log service's context query function helps you trace related records before and after an abnormal log occurrence through time clues, quickly locating the root cause of the problem.

• On the log detail page, you can directly view the context logs of the current data content.
• The dropdown on the left allows you to select an index to filter the corresponding data.
• Sort data.
• Directly jump to a new page of the log explorer from the current detail page.
• Display Item Configuration
• Settings

L::RE(`.*`):(`message`) { `index` = 'default' and `host` = "ip-172-31-204-89.cn-northwest-1" AND `source` = "kodo-log" AND `service` = "kodo-inner" AND `filename` = "0.log" and `log_read_lines` >= 1354140 and `log_read_lines` <= 1354200}  sorder by log_read_lines

Log Context Page¶

Click to jump to the log context page. You can manage all current data through the following operations:

• Enter text in the search box to search and locate data.
• Click the button on the side to switch the system's default word wrap to content overflow mode. In this mode, each log is displayed as a single line, and you can scroll left and right as needed.
• Directly locate the current log.
• Go to Top/Bottom.
• Load 100 entries Up/Down.

Correlation Analysis¶

The system supports correlation analysis of log data. In addition to error details, extended fields, and context logs, you can also get a one-stop understanding of the hosts, containers, networks, etc., corresponding to the log.

Built-in Pages¶

For built-in pages like Host, Container, Pod, etc., you can perform the following operations:

(Using the "Host" built-in page as an example)

• Edit the fields displayed on the current page. The system will automatically match corresponding data based on the fields.
• Choose to jump to the Metric View or Host Details page.
• Filter the time range.

Built-in Views¶

In addition to the views displayed by the system by default here, you can also bind user views.

1. Go to the built-in view binding page.
2. View the default associated fields. You can choose to keep or delete fields, and also add new key:value fields.
3. Select a view.
4. After binding is complete, the bound built-in view can be viewed in the host object details. You can click the jump button to go to the corresponding built-in view page.