Alibaba Cloud Logstash allows you to query and view Logstash logs. The logs include cluster logs, slow logs, garbage collection (GC) logs, and debug logs. You can enter a keyword and specify a time range to search for specific log entries. You can query only the logs that are generated in a maximum of seven consecutive days. By default, the logs are displayed in descending order of time. This topic describes how to query the logs of a Logstash cluster.
In this example, a cluster log entry of Logstash is searched. The log entry meets the following conditions:
content contains the
- Log on to the Alibaba Cloud Elasticsearch console.
- In the top navigation bar, select the region where your cluster resides.
- In the left-side navigation pane, click Logstash Clusters. On the page that appears, find the target cluster and click its ID in the Cluster ID/Name column.
- In the left-side navigation pane, click Logs.
The Cluster Log tab appears.
- Enter the query string in the search bar.
In this example, the query string is
host:172.16.xx.xx AND level:info AND content:running.Notice
ANDin the query string must be uppercase.
- Specify a start time and an end time, and click Search.
After the search is successful, Logstash returns the query result based on your query string. The returned result contains the following information: Time, Node IP, and Content.
- If you do not specify an end time, the current system time is used as the end time.
- If you do not specify a start time, the start time is one hour earlier than the end time.
- Time: the time when the log entry was generated.
- Node IP: the IP address of the Logstash node.
- Content: contains the
The level of the log entry. Log levels include trace, debug, info, warn, and error. GC log entries do not contain the
The IP address of the Logstash node. You can obtain the IP address on the Basic Information page of the Logstash cluster.
The time when the log entry was generated.
The content of the log entry.