Log Details¶

In the log list, click the expand icon on the left side of a single log to display the details page for that log. You can view detailed information, including the log timestamp, host, source, service, content, extended fields, and view the context.

View Full Log¶

When a log is reported to Guance, if a single log entry exceeds 1 MB, the system splits it into multiple entries of up to 1 MB each. For example, a 2.5 MB log is split into three entries: 1 MB, 1 MB, and 0.5 MB. You can use the following fields to check the integrity of the split log:

On the log details page, if the current log has been split into multiple entries, the View Full Log button appears in the upper-right corner. Clicking this button opens a new page listing all related log entries in split order. The log entry that was selected before navigation is color-coded for quick identification of upstream and downstream logs.

Obsy Copilot Error Analysis¶

Guance provides one-click error log analysis. It uses a large language model to automatically extract key information from logs, combined with online search engines and an operations knowledge base, to quickly analyze possible root causes and provide initial solutions.

1. Filter all logs with status error;
2. Click a single log entry to expand the details page;
3. Click the Obsy Copilot Error Analysis button in the upper-right corner;
4. The anomaly analysis begins.

Error Details¶

If the current log contains error_stack or error_message fields, the system provides error details related to that log entry.

For more log error information, see Log Error Tracking.

Attributes¶

Click on an attribute field to quickly filter and view host, process, trace, and container data related to the log.

Log Content¶

Log content automatically switches between JSON and text viewing modes based on the message type. The log details display the content according to the index mode and log fields:

• When message exists in the log, the message content is displayed first, and the view mode switches between JSON or text based on the content type.
• When message does not exist in a full-text-indexed log, the system combines the log's business fields to display the content.
• System fields are not included as part of the full-text-indexed log content.
• Log content supports expand and collapse; it is expanded by default and collapses to a single line.

Log content supports expand and collapse; it is expanded by default, collapsing to a single line height.

For logs with source:bpf_net_l4_log, the system automatically provides JSON and packet viewing modes. The packet mode displays client, server, time, and other information, and supports switching between absolute time and relative time display. The default is absolute time. The switched configuration is saved in the local browser.

JSON Search¶

In JSON-formatted logs, you can search for both key and value. Clicking adds the search term in the format @key:value to the explorer search bar.

For multi-level JSON data, use . to indicate the hierarchy. For example, @key1.key2:value searches for the value of key2 under key1.

For more details, see JSON Search.

Extended Fields¶

• In the search bar, you can enter field names or values to quickly search and locate.
• After checking a field alias, it can be viewed after the field name.

• Hover over an extended field and click the dropdown icon to perform the following operations on that field:

  • Filter by field value
  • Exclude field value
  • Add to display columns
  • Perform dimension analysis: click to navigate to the analysis mode > time series chart
  • Copy

Context Logs¶

The context query feature of the log service helps you trace records before and after an anomaly log, quickly locating the root cause.

• On the log details page, you can directly view the context logs of the current data.
• Use the dropdown on the left to select an index and filter the corresponding data.
• Sort the data.
• Jump directly from the current details page to a new Log Explorer page.
• Display configuration
• Settings

L::RE(`.*`):(`message`) { `index` = 'default' and `host` = "ip-172-31-204-89.cn-northwest-1" AND `source` = "kodo-log" AND `service` = "kodo-inner" AND `filename` = "0.log" and `log_read_lines` >= 1354140 and `log_read_lines` <= 1354200}  sorder by log_read_lines

Log Context Page¶

Click to jump to the log context page. You can manage all current data with the following actions:

• Enter text in the search box to search and locate data.
• Click the button on the side to switch from the default word wrap mode to content overflow mode, where each log entry is displayed in a single line and you can scroll horizontally as needed.
• Go to top/bottom.
• Load 100 entries upward/downward.
• Click the export icon to export the current log context data.

Related Analysis¶

The system supports related analysis of log data. In addition to error details, extended fields, and context logs, you can also get a one-stop view of the host, containers, network, and more associated with the log.

Built-in Pages¶

For built-in pages such as host, container, and Pod, you can perform the following operations:

(Using the "Host" built-in page as an example)

• Edit the display fields of the current page; the system automatically matches corresponding data based on the fields.
• Select to jump to the metric view or host details page.
• Filter the time range.

Built-in Views¶

In addition to the default views displayed by the system, you can also bind user views.

1. Navigate to the built-in view binding page.
2. View the default associated fields. You can choose to keep or delete fields, and add new key:value fields.
3. Select a view.
4. After binding, the bound built-in view can be viewed in the host object details. You can click the jump button to go to the corresponding built-in view page.