Using the Console

You can perform log searches by using either the Basic mode filter controls in the interface, or the Advanced mode custom query language interface. See Basic Search Queries and Advanced Search Queries for more information.

Note

Only a 14-day range is available when performing log search queries.

Basic Search Queries

To search and filter logs:

  1. Open the navigation menu and click Observability & Management. Under Logging, click Search.
  2. In Custom filters, you can start typing to automatically display filter settings, along with operators. For example, entering d displays filters starting with that letter. Use the up or down arrow keys to select from the list, or continue typing to enter what you want to filter on. For example, data.compartmentName='<tenancy_name>'.
  3. In Select logs to search, the root compartment is already selected by default for filtering. Click this field to open the Select logs to search panel, where you can filter by compartments you have permission to work in, in addition to filtering by Log Groups and Logs. You can filter by multiple compartments and log groups. For any filters you create in this panel that you want to remove, click the filter X icon in the Select logs to search field.
  4. The log data in the Explore and Visualize tabs is reloaded according to your filter settings, or you can click Search to apply the filter.
Note

Since the Search page automatically refreshes after applying filters and selecting logs, you do not need to click the Search button as you select different filters. You will, however, need to click Search again after some time has passed and new logs have appeared. When performing Advanced Mode queries however, you do need to always click this button to submit a query.
Note

Filter settings are maintained when switching to Advanced Mode.

To remove a filter(s) from the Search page, under Filters, click the X icon next to the filter.

To search with Quick Start Queries

You can quickly search according to several predetermined queries. From Quick Start Queries, select a query from the list. The Search page displays the results for the chosen query.

To limit results to a specific time range

In Filter by time, select a time range from the list, or select Custom to specify a date range in the calendar Start Date and End Date. You can also specify a time value in the box next to the calendar. Use an end time to refine the time window.

Didn't get the result you expected?

Try specifying a time range:

  • Under Filter by time, select a predetermined time range or specify a custom date range. Use an end time to refine the time window.

Advanced Search Queries

When performing a search on the Logging Search page, you can click Show Advanced Mode to enter your own custom log search queries. In addition, Advanced Mode searching provides more comprehensive search options that are not available in Basic Mode.

Be default, the following is displayed in the Query field after clicking Show Advanced Mode:

search "ocid1.tenancy.oc1..<unique_id>" | sort by datetime desc

For example, you can modify this default search by entering:

search "ocid1.tenancy.oc1..<unique_id>" | sort by datetime desc
| summarize count() as cnt by rounddown(datetime,  '15m') as interval

This returns {"interval": 1600364700000,"cnt": 31} and {"interval": 1600365600000,"cnt": 220} under Log Data in the Explore tab.

When entering search queries, auto-complete hints are providing as you type (which you can select from a pop-up menu as you type), and syntax validation is performed in real time in the background as you type a query.

Note

When you switch from Advanced Mode to Basic Mode, the query is lost and is not available in Basic Mode. A warning is displayed for this scenario to confirm your preference.

The Advanced Mode search uses a specific syntax, using the Logging query language, which is described in Logging Query Language Specification .

To search with Quick Start Queries

You can quickly search according to several predetermined queries. From Quick Start Queries, select a query from the list. The Search page displays the results for the chosen query.

Saved Searches

You can save the search parameters that you use for any searches performed in both Basic Mode and Advanced Mode.

To save a search:

  1. Open the navigation menu and click Observability & Management. Under Logging, click Saved Searches.
  2. Under List Scope, Compartment, choose a compartment you have permission to work in. The Saved Searches page is displayed.
  3. You can start the save operation using one of these two methods:
    • From the Saved Searches page, click New Search, which opens the Logging Search page, where you can begin a search.
    • From the Search page directly, whether in Basic Mode and Advanced Mode.
  4. Apply filter and search settings as described in Basic Search Queries and Advanced Search Queries.
  5. Click Save search. The New Saved Search panel is displayed.
  6. In Search Name, enter a name to associate with your saved search. Avoid entering confidential information.
  7. In Compartment, select a compartment you have permissions to work in.
  8. In Description, enter a description for the saved search.
  9. Click Save Search to save your search.
    Note

    The Search Query field cannot be edited and is view-only. It only displays the contents of your search parameters.
  10. The search is saved and a message appears with the linked name of your saved search. Clicking the linked saved search name opens the details page for the saved search, where you can view more information about it. This page displays the following on the Saved Search Information tab:
    • OCID
    • Region
    • Compartment
    • Description
    • Created date and time in UTC format.
    • Last Modified date and time in UTC format.
    • Search Query view-only description of the search parameters in the saved search.
    • The Tags tab shows associated tags for this log.
    • Under Latest Results, log data is displayed under Saved Search Data, in a similar manner as the Log Data on the Search page. You can apply some simple filters, such as sorting by newest or oldest from the Sort field, or filtering by time from the corresponding Filter by time field.
  11. Click Explore with Log Search, which allows you to view this saved search on the Search page directly. After clicking this link, the Search page opens with the saved search loaded, whether it is a basic or advanced mode search. At this point, you can perform more analysis and investigation related to this search directly on the Search page. For more information, see Searching Logs.

While on the Search page, you can also switch between any of the saved searches by selecting them from the Saved Searches list.

Note

When editing a saved search from the Saved Searches page, you can only change the Search Name, Compartment, and Description fields in the Edit Saved Search panel. If you need to change the search parameters, create a new saved search.

Viewing and Working with Search Results

After you get an initial set of results, you can view more details, whether in terms of the log fields, JSON, or before and after states, and visually as a chart. On the Explore tab under Log Data, a Number of Log Events Per Minute bar graph displays the number of log events, according to your filter settings.

Note

You will need to click Search after time has passed to see the latest logs.
Note

For any actions taken on the Explore and Visualize tabs, you can define how often to refresh the data on the Search page by selecting a value from the Autorefresh list (choose from OFF, 5 Minutes, or 15 Minutes). The default is OFF.
To examine a single log entry
  • In the Explore tab under Log Data, click the down arrow (Logging down arrow) to expand the log entry in JSON view.

    The JSON view is displayed. In JSON view you can view the log data fields and values, collapse and expand nodes, or click the copy icon to copy the log entry to the clipboard.

To switch between JSON and Before & After view
  • In the Explore tab under Log Data, click the down arrow (Logging down arrow) to expand the log entry and click JSON.

    The JSON view is displayed. Click the Before & After tab to switch to its view.

To examine Before & After view
  • In the Explore tab under Log Data, click the down arrow (Logging down arrow) to expand the log entry and click Before & After.

    The Before & After view is displayed. In contrast to the entry labeled as Current, this view displays the exact preceding and successive logging lines in the log object.

Click to view more log options
  • In the Explore tab, each entry has three interactive header columns, which correspond to: the log time stamp, the plugin where the log occurred, and the log message.

    Click one of the log entry columns to open a context-sensitive menu for that entry and the column header. These options are available whether the log entry is collapsed or expanded. The following options are available:

    • Copy value
    • Filter matching
    • Filter not matching
    • Remove from summary view
To export log data

At the top-right corner of the Explore tab, click Export Log Data (JSON). This feature allows you to export the log data to a JSON file that you can save to your system.

To visualize log data as a chart

You can view log data graphically as a chart, along with accompanying tabular data.

Select from the following chart settings:
  • Visualization Type: Select Stacked Bar. The Bar charts are organized in terms of time (UTC) on the X-axis, with time on the Y-axis. You can hover the mouse over bars when stacked bars appear, which displays the number of log records in a tool tip.
  • Interval: Select from 1 minute (the default), 5 minutes, 15 minutes, 30 minutes, or 1 hour.
  • Group By: Select a logging field to group the results by.
For any chart type being viewed, you can click to expand the <number of> records found list below the chart, which lists the total record sum, and the number of records at each time interval.