Overview 

This topic describes how to troubleshoot the issue when you fail to query log data in the log service console.

Description

Perform the following steps for troubleshooting.

Log collection failure

If log data fails to be collected by log service, the target log cannot be queried. Check whether log data is available on the consumption preview page of the target Logstore. If data is available, log data is collected by Log Service. If no log data is found, the possible causes are as follows:

  • No log data is generated in the log source.

    Log source no logs are generated, these logs cannot be sent to log service. Check your log source.

  • Logtail has no heartbeat.

    On the Server Group Settings page, check whether the relevant server has a heartbeat in the Server Group Status section. If Logtail has no heartbeat, see the Logtail machine has no heartbeat.

  • Monitoring files are not written in real time.

    If the monitoring file is not written in real time, log on to the server and open /usr/local/ilogtail/ilogtail.L O G log file to view the error message. Common error messages are as follows:

    • parse delimiter log fail: delimiter log collection error.
    • parse regex log fail: Regular expression collection log error.

Delimiter setting errors

Check whether a keyword is generated after the log content is split based on the configured delimiter. For example, the default delimiters , ; = ( ) [ ] { } ? &&#>/:' if there is a abc”defg,hij will be divided abc”defg and hij two parts, use ABC this log cannot be found. Log service supports fuzzy match. For more information, see query Syntax.

 
Note:
  • To save your indexing cost, log service has optimized the indexing feature. If you create an index on a field, no full-text index is performed on the Key. For example, an index is created on the field whose key is message in a log, and a space is used as a delimiter. To use a space as a delimiter, enclose it in a word-breaking string. message: this is a test message you can use key:value format message:this query, but directly this no field can be queried. The key of the field index is configured and no full-text index is performed.
  • You can create indexes or modify existing indexes. However, new or modified indexes take effect only for new data. You can view the index attributes and check whether the configured delimiters meet the requirements.

Other reasons

If log data is generated, query and modify the query time range. Log service allows you to preview log data in real time, but the query feature has a delay of about 1 minute. You can wait 1 minute before querying log data.

Application scope

  • Log Service