Alibaba Cloud Logstash allows you to specify a keyword and a time range in the Elasticsearch console to query specific logs of your Logstash cluster. You can use the logs to identify cluster issues and perform cluster O&M in an efficient manner. This topic describes how to query logs and describes common types of logs.
- Log on to the Elasticsearch console.
- Navigate to the desired cluster.
- In the top navigation bar, select the region where the cluster resides.
- In the left-side navigation pane, click Logstash Clusters. On the Logstash Clusters page, find the cluster and click its ID.
- In the left-side navigation pane of the page that appears, click Logs. Then, you can view the logs of the cluster. The Logs page contains the following tabs: Cluster Log, Slow Log, GC Log, Debug Log, and Asynchronous Write Log.
- On a tab of the Logs page, enter a query string, select the start time and end time,
and then click Search. You can query logs that are generated within the last seven days. By default, the logs are displayed by time in descending order. The Lucene query syntax is supported. For more information, see Query string syntax.In this example, the logs that meet the following conditions are queried on the Cluster Log tab: The value of the level field is info, the value of the host field is 172.16.xx.xx, and the value of the content field contains the running keyword. In this case, the query string is
host:172.16.xx.xx AND level:info AND content:running.Notice
After you click Search, the logs that match your query string are displayed.
ANDin the query string must be uppercase.
- If you do not specify an end time, the current system time is used as the end time. If you do not specify a start time, the start time is one hour earlier than the end time.
Common types of logs
- Time: the time when the log is generated.
- Node IP: the IP address of the node that generates the log.
- Content: consists of the level, host, time, and content fields.
Field Description level The level of the log. Log levels include trace, debug, info, warn, and error.Note Garbage collection (GC) logs do not contain the level field. host The IP address of the node that generates the log. time The time when the log is generated. content The content of the log.
If a Logstash pipeline is incorrectly configured, the output data of the pipeline may not meet your requirements. In this case, you must repeatedly check the format of the data in the destination and modify the pipeline configuration in the console. This increases time and labor costs. To address this issue, you can use the pipeline configuration debugging feature provided by Logstash. This feature allows you to view the output data of your Logstash pipeline in debug logs in the console after you create and deploy the pipeline. This reduces your debugging costs. For more information, see Use the pipeline configuration debugging feature.