​
Overview

The logs UI displays the logs for your running workloads. No matter which combination of cloud providers or regions your workload is running at, the logs will be aggregated and displayed as if they were running at one provider/region. Filters can be applied to pinpoint any issues that might be occurring at a specific workload. The Grafana explorer is available to query and visualize your log data.

​
Sample Log UI

Below is a sample of the Log UI after executing a query:

​
LogQL

The Control Plane logs use the LogQL query language to query your log data. The documentation for LogQL is available here. The available labels that can be used to create a query are:
  • container
  • gvc
  • location
  • replica
  • stream
  • workload

​
Log Filters

The results of a query can be filtered by the following:
  • Location
  • Container
  • Start date and optional end date
    • The date/time selector includes helper buttons ranging from the Last 5 minutes to the Last 30 days
Selecting a location or container will automatically add the value to the LogQL query.

​
Live Logs

The results of the given query can be streamed in real-time using the Live button. After entering the desired query, click the Live button. To end the live streaming, click the Stop button.

​
Grafana

Clicking on the Explore on Grafana link will launch the Grafana UI in a new tab. When clicking the button from a specific workload, the query will be prefilled with the GVC and workload. Grafana gives you the ability to “Explore your data through ad-hoc queries and dynamic drill-down. Split view and compare different time ranges, queries, and data sources side by side.” View the documentation for Grafana here. Below is a sample of the Grafana UI after executing a query:

​
Example LogQL Queries

Query
{gvc="GVC_NAME", workload="WORKLOAD_NAME"}
  • Access logs with error
Query
{gvc="GVC_NAME", workload="WORKLOAD_NAME", container="_accesslog"}  |= "\" 50"
  • Graph of access logs with error by replica
Query
sum(count_over_time({gvc="GVC_NAME", workload="WORKLOAD_NAME", container="_accesslog"}  |= "\" 50"[1m])) by (replica)
  • Graph of access logs with error by workload
Query
sum(count_over_time({gvc="GVC_NAME", container="_accesslog"}  |= "\" 50"[1m])) by (workload)
  • View the logs for a GVC, workload, location, and container
Query
{gvc="GVC_NAME", workload="WORKLOAD_NAME", location="aws-eu-central-1", container="CONTAINER_NAME"}
  • View all logs (will contain all workloads logs across all gvcs)
Query
{gvc=~".+"}
  • Count of inbound requests by ip
This query will produce a count of inbound requests by source ip address for the last 10 minutes. You must set the grafana query options to type Instant so that a list is produced and can be sorted.
Query
sum(count_over_time({gvc="GVC_NAME", workload="WORKLOAD_NAME", container="_accesslog"} | logfmt | regexp "(?P<ip>\\d+\\.\\d+\\.\\d+\\.\\d+)"[10m])) by (ip)
  • Count of inbound requests by path
This query will produce a count of inbound requests by request path for the last 10 minutes with a latency greater than 100ms. You must set the grafana query options to type Instant so that a list is produced and can be sorted.
Query
sum(count_over_time({gvc="GVC_NAME", workload="WORKLOAD_NAME", container="_accesslog"} | logfmt | regexp "(?P<path>\\/[^\"]*\\s).+\\d+ \\d+ \\d+ (?P<latency>\\d+) " | latency > 100 [10m])) by (workload, path)

​
Log Retention Policy

The log retention period for logs stored at Control Plane is 30 days by default and can be adjusted for each Org. Click here to learn how to configure log shipping to an external provider.

​
CLI

To view the CLI documentation for logs, click here.