Log analysis (old)

Version description

The log analysis feature of the current version can no longer be enabled. If you have already enabled the current version, you can still use it.

You can enable the new log analysis feature based on your business requirements.

The new log analysis feature supports logs that are collected by Log Service or ARMS.

• Analyze logs collected by ARMS: You can use the ARMS agent to collect the output of the log framework and push the collected logs to the log analysis center of ARMS. After you enable the log analysis feature, you can query and analyze the logs of your application in the ARMS console without the need to perform other operations. For more information, see Analyze logs collected by ARMS.
  Note If you analyze logs collected by ARMS, you must upgrade the ARMS agent to V2.7.1.4 or later.
• Analyze logs collected by Log Service:

  You must make sure that the logs of your application are collected to Log Service. Then, you must specify the project and Logstore that store the logs on the Application Settings page of the ARMS console. To help you analyze logs, the console pages of Log Service are embedded in ARMS. For more information, see Analyze logs collected by Log Service.

How log collection works

1. After you enable the log collection feature, the collected business logs are saved to your computer.
2. After the log collection agent is installed, the log collection agent reads local business logs and sends them to the ARMS console.
   Note You can install the log collection agent only once for an ACK cluster.
3. On the Log Analysis page of the ARMS console, you can query, filter, and analyze business logs by keyword. For example, you can filter exception logs by keywords such as order ID, trace ID, and application name.

Query logs

Basic query

The base query supports the following filter operations:

• In the upper-right corner of the Basic Query page (①), set the time range for logs.
• Click the arms_app drop-down list (②) to select other applications that have the log collection feature enabled.
• Enter a keyword in the search box (③). Press Enter or click search to search for logs that contain the keyword. For example, if you enter WARN, you can view all Warn-level logs.
  Note Keywords are case-sensitive.

Advanced query

Click Advanced Query in the upper-right corner of the Log Analysis page. On the Advanced Query page, you can query logs by using LogQL statements.

The advanced query supports the following filter operations:

• In the upper-right corner of the Advanced Query page (①), set the time range for logs.
• Enter a LogQL statement in the field (②) and click Run Query in the upper-right corner to filter business logs.
  LogQL statements allow you to filter logs by log labels and keywords. LogQL statements must contain log labels.

  • Log labels are in the following format: {Label key-value pair}. You can also click the Log labels drop-down list and select a key-value pair.

    The following operators are supported for label key-value pairs:

    • =: equal to
    • !=: not equal to
    • =~: regular expression match
    • !~: regular expression mismatch
    For example, you can use the {arms_app="productservice"} key-value pair to query the business logs of the application named productservice.
  • Keywords: You can add a keyword after the log label to further filter business logs.
    The following operators are supported for keywords:

    • |=: contain
    • !=: not contain
    • |~: regular expression match
    • !~: regular expression mismatch

    Note Keywords are case-sensitive.

    For example, you can use {arms_app="productservice"}|="WARN" to query business logs at the Warn level of the application named productservice.

View logs

In the business log list section, you can perform the following operations:

View log details

Click the row for a log entry to view the labels and keywords contained in the log entry.

In the Log Labels section, you can perform the following operations:

• Click the icon before a label to filter the logs that contain the current label key-value pair.
• Click the icon before a label to filter the logs that do not contain the current label key-value pair.
• Click the console link next to the trace ID to view the trace information and business information.

View log context

To view the context of a log entry, move the pointer over the row for the log entry and click Show context.

By default, five log entries are displayed before and after each selected log entry. To view more, click Load 10 more in the upper and lower sections.