The Alibaba Cloud Logstash logging feature lets you search log content by keyword and time range, helping you quickly locate cluster issues and perform daily maintenance.
Procedure
Go to the Logstash Clusters page.
Navigate to the target cluster.
In the top navigation bar, select the region where the cluster resides.
On the Logstash Clusters page, find the cluster and click its ID.
-
In the left-side navigation pane, click Logs to view the runtime logs of the cluster.
Alibaba Cloud Logstash supports four log types: cluster logs, slow logs, GC logs, and debug logs. The following table describes each type and its use cases. For more information, see Log details.
Log type
Description
Use case
cluster log
Records the operational status of the cluster.
Check cluster logs to monitor node health and pipeline status, troubleshoot connectivity issues between sources and destinations, verify pipeline configuration changes, and identify runtime errors.
ImportantIf your application experiences issues, check the cluster log and cluster monitoring data first to rule out performance bottlenecks or pipeline configuration issues.
slow log
Records pipeline events that exceed a specified time threshold.
ImportantTo aid in troubleshooting, slow logs are enabled by default in the YML file. Do not remove this slow log configuration. For more information, see Configure a YML file.
If you experience slow write operations, check the slow log. Common causes include:
-
The source or destination in the pipeline configuration has reached a resource bottleneck. We recommend that you scale up the resources for the source or destination.
-
The Pipeline Workers setting for Logstash is too small. Increase the Pipeline Batch Size and Pipeline Workers. For more information, see Manage pipelines by using configuration files.
gc log
Records garbage collection (GC) events from the Java Virtual Machine (JVM) heap, including details on Old GC, CMS GC, Full GC, and Minor GC mechanisms.
If a cluster experiences a performance bottleneck, check GC logs for time-consuming or frequent garbage collection events.
debug log
Shows the output data after a pipeline processes it. This feature is disabled by default. To enable it, you must install the logstash-output-file_extend plug-in and configure the file_extend parameter in the output section.
Use debug logs to view pipeline output directly in the console for debugging.
-
-
In the search box on the Logs page, enter a search query, select a start and end time, and then click Search.
You can query logs from the last seven days. By default, logs are displayed in reverse chronological order. Alibaba Cloud Logstash supports Lucene-based query syntax. For more information, see Query string syntax.
For example, to query a cluster log where the content field contains the keyword running, the level is info, and the host is 172.16.xx.xx, use the following query:
host:172.16.xx.xx AND level:info AND content:running.The search results are displayed on the Logs page.
Log details
Cluster log
A cluster log shows the runtime logs of a cluster, including the generation time, the source node's IP address, and log details.
|
Parameter |
Description |
|
Time |
The time when the log was generated. |
|
Node IP Address |
The IP address of the node that generated the log. |
|
Content |
The log details, which primarily consist of level, host, time, and content:
|
GC log
gc logs are enabled by default. They share the same structure as the cluster log.
The log viewer displays GC log entries with three fields: host (node IP), time (timestamp, e.g. 2021-10-11T16:21:19.589Z), and content (log body). Example GC log content: [GC (Allocation Failure) ... ParNew: 481493K->4666K(536384K) ... 606013K->129187K(2324288K), Times: user=0.02 sys=0.00, real=0.02 secs], indicating ParNew collected from 481493K to 4666K, total heap from 606013K to 129187K.
Slow log
Slow logs are enabled by default. You can view or modify the slow log configuration in the YML file of your Logstash instance. For more information, see Configure a YML file.
To facilitate troubleshooting, do not remove this slow log configuration.
slowlog:
threshold:
warn: 2s
info: 1s
debug: 500ms
trace: 100ms
Debug log
When pipeline output does not match expectations, Alibaba Cloud Logstash provides a pipeline debugging feature to help. For more information, see Use the pipeline configuration debugging feature.
Debug logs are disabled by default. To enable them, perform the following steps:
-
Install the logstash-output-file_extend plug-in. For more information, see Install or remove a plug-in.
-
In the output section of the pipeline configuration, configure the file_extend parameter. For more information, see Manage pipelines by using configuration files.
After you enable debug logs, you can view Logstash pipeline output in the Simple Log Service console. Each log entry contains time, node IP, and content fields. The content shows pipeline-processed data in key-value format (such as geolocation parsing results and timestamps), along with metadata like pipelineId and sls_log_time.