Viewing logs

Step 1. Grant IAM policies to a user to view logs

You must grant permissions to users in your account to be able to launch the web UI and view logs.

You must be an administrator of the IBM Log Analysis service, an administrator of the IBM Log Analysis instance, or have account IAM permissions to grant other users policies.

The following table lists the minimum policies that a user must have to be able to launch the IBM Log Analysis Web UI, and view logs:

For more information on how to configure these policies for a user, see Granting permissions to a user to view logs.

Step 2. Navigate to the web UI through the IBM Cloud UI

To launch the IBM Log Analysis UI through the IBM Cloud UI, complete the following steps:

1. Log in to your IBM Cloud account.

   After you log in, the IBM Cloud Dashboard opens.

2. Click the Menu icon > Observability.

3. Click Logging.

   The list of IBM Log Analysis instances that are available on IBM Cloud is displayed.

4. Select one instance. Then, click Open dashboard.

The IBM Log Analysis web UI opens and displays logs forwarded to that instance.

Step 3. Customize your default view

In the User preferrences section, you can modify the order of the data fields that are displayed per line.

Complete the following steps to modify the format of a log line:

1. Click the User preferences icon.
2. Select User preferences. A new window opens.
3. Select Log Format.
4. Modify the Line Format section to match your requirements. Drag boxes.

Step 4. Look into a log line

At any time, you can view each log line in context.

Complete the following steps:

1. Click the Views icon .

2. Select EVERYTHING or a view.

3. Identify a line in the log that you want to explore.

4. Expand the log line.

   Information about line identifiers, tags, and labels is displayed.

5. Click View in Context to see the log line in context of other log lines from that host, app, or both.

6. Click Copy to clipboard to copy the message field to the clipboard.

When you are finished, close the line.

Step 5. Filter logs

You can filter logs by log source, application, and log level.

• A source can be a host, a computer, a virtual machine, or a Heroku app.
• An application represents a log file, a program, or a container.
• Examples of log levels are: INFO, DEBUG, ERROR.

Complete the following steps to filter logs:

1. Click the Views icon .
2. Select EVERYTHING or a view.
3. Expand Tags to see the list of tags that are identified in the logs. Then, choose the ones that you want.
4. Expand Sources to see the list of log sources that are identified in the logs. Then, choose the ones that you want.
5. Expand Apps to see the list of apps that are identified in the logs. Then, choose the ones that you want.
6. Expand Levels to see the list of log levels that are identified in the logs. Then, choose the ones that you want.

In each section, you can group multiple options into a group. Group tags, log sources, apps, and log levels to reuse these groupings when you filter log data in other custom views.

To create a group, select multiple values. Then, click Save as group. Enter a name for the group, and save it.

Step 6. Search logs

When you search log data, the search applies any log filters and time queries configured in that view.

You can do simple searches (single term string search), compound search (multiple search terms and operators), field searches if the log line can be parsed, and others. For more information, see How to Search Logs.

Note: AND and OR operators are case-sensitive and must be capitalized.

Step 7. Create views

Complete the following steps to create a view:

1. Click the Views icon .

2. Select EVERYTHING or a view.

3. Filter log data then click Save as new view.

   The Create new view page opens.

4. Enter a name for the view in the Name field.

5. Optionally, add a category. Enter a name and then click Add this as new view category.

6. Optionally, attach an alert. A new section is displayed for you to configure the alert.

7. Click Save View

Step 8. Customize how event lines are displayed through a view

There are different options to customize how you see data in a view:

• You can modify the properties of a view.
• You can rename a view, add or modify its description, and apply a specific line format.
• You can change the log format in the User preferences section.
• You can apply a line template from the Tools section. Notice that this overrides any other line configuration. If you select Persist these settings, all views in the UI will show data per the line format that is specified in this section.
• You can apply color to terms or strings by setting Highlight Terms in the Tools section.

Guidelines defining line templates

Consider the following guidelines that you must apply when you define a line template:

• Use mustache style {{field.name}} or bash style ${field.name} variables to construct your template.
• Use {{line}} or $@ to reference the original line.
• All other characters or strings are interpreted as a text literal.

For example, you can define a line template as {{initiator.id}} -- {{action}} -- {{message}} to see these fields for each event in a view.

Change the name and description of a custom view

You can rename a view. You can add or modify the description of a view.

Complete the following steps:

1. In your view, select Edit View Properties. The Edit View Properties page opens.

   You can rename the view, add or modify the description of the view, and apply a custom line format.

2. Enter a new name in the Rename View section to rename the view.

3. Enter or modify the description in the Description section.

4. Click Save properties.