Viewing logs

Step 1. Grant IAM policies to a user to view logs

You must grant permissions to users in your account to be able to launch the web UI and view logs.

You must be an administrator of the IBM Log Analysis service, an administrator of the IBM Log Analysis instance, or have account IAM permissions to grant other users policies.

The following table lists the minimum policies that a user must have to be able to launch the IBM Log Analysis Web UI, and view logs:

For more information on how to configure these policies for a user, see Granting permissions to a user to view logs.

Step 2. Navigate to the web UI through the IBM Cloud UI

To launch the IBM Log Analysis UI through the IBM Cloud UI, complete the following steps:

1. Log in to your IBM Cloud account.

   After you log in, the IBM Cloud Dashboard opens.

2. Click the Menu icon > Observability.

3. Click Logging.

   The list of IBM Log Analysis instances that are available on IBM Cloud is displayed.

4. Select one instance. Then, click Open dashboard.

The IBM Log Analysis web UI opens and displays logs forwarded to that instance.

Step 3. Customize your default view

In the USER PREFERENCES section, you can modify the order of the data fields that are displayed per line.

Complete the following steps to modify the format of a log line:

1. Click the Settings icon .
2. Select USER PREFERENCES. A new window opens.
3. Select Log Format.
4. Modify the Line Format section to match your requirements. Drag boxes.

Step 4. Look into a log line

At any time, you can view each log line in context.

Complete the following steps:

1. Click the Views icon .

2. Select EVERYTHING or a view.

3. Identify a line in the log that you want to explore.

4. Expand the log line.

   Information about line identifiers, tags, and labels is displayed.

5. Click View in Context to see the log line in context of other log lines from that host, app, or both.

6. Click Copy to clipboard to copy the message field to the clipboard.

When you are finished, close the line.

Step 5. Filter logs

You can filter logs by log source, application, and log level.

• A source can be a host, a computer, a virtual machine, or a Heroku app.
• An application represents a log file, a program, or a container.
• Examples of log levels are: INFO, DEBUG, ERROR.

Complete the following steps to filter logs:

1. Click the Views icon .
2. Select EVERYTHING or a view.
3. Expand Tags to see the list of tags that are identified in the logs. Then, choose the ones that you want.
4. Expand Sources to see the list of log sources that are identified in the logs. Then, choose the ones that you want.
5. Expand Apps to see the list of apps that are identified in the logs. Then, choose the ones that you want.
6. Expand Levels to see the list of log levels that are identified in the logs. Then, choose the ones that you want.

In each section, you can group multiple options into a group. Group tags, log sources, apps, and log levels to reuse these groupings when you filter log data in other custom views.

To create a group, select multiple values. Then, click Save as group. Enter a name for the group, and save it.

Step 6. Search logs

When you search log data, the search applies any log filters and time queries configured in that view.

You can do simple searches (single term string search), compound search (multiple search terms and operators), field searches if the log line can be parsed, and others. For more information, see How to Search Logs.

Note: AND and OR operators are case-sensitive and must be capitalized.

Step 7. Create views

Complete the following steps to create a view:

1. Click the Views icon .

2. Select EVERYTHING or a view.

3. Filter log data then click Save as new view.

   The Create new view page opens.

4. Enter a name for the view in the Name field.

5. Optionally, add a category. Enter a name and then click Add this as new view category.

6. Optionally, attach an alert. A new section is displayed for you to configure the alert.

7. Click Save View