Complete Winston Logger Guide With Hands-on Examples

Logging is critical for monitoring and troubleshooting your Node.js project. The open-source Winston logger helps take a load off our shoulders by making it easier to centralize, format, enrich, and distribute the logs to fit a particular need.

Winston creates custom logger instances which can be configured to act as centralized logging entities. Essentially, the internal architecture of the module decouples the actual event logging from the implementation of the storage logic.

A simple console.log sends everything to the default standard output (i.e. to your console screen), and redirecting that flow into a centralized, managed location is not a simple task. An external plugin such as Winston conditionally redirects your logging activities’ destination. This gives developers great flexibility when it comes to choosing, and even switching between different storage options.

Why do we need a logger like Winston?

A logger offers many benefits over any type of manual logging techniques, such as the good old console.log. Winston offers:

1. Centralized control over how and when to log

With Winston, you can change your code in a single place and customize the format of your logs (e.g., logging in JSON format, or adding a timestamp). These are far superior options compared to those available when you use a console.log command, which requires logging code to be spread across your entire code base, breaking DRY principles.

2. Control where your logs are sent

Controlling where logs are saved is crucial for organizing the data and making it easier to query. Although console.log allows the redirection of logs via command line redirections, there are limitations (such as not being able to send them to a 3rd party system). With Winston, you can save your logs to multiple destinations (such as Elasticsearch, MongoDB, etc.). You can conditionally select the output destination and more.

3. Custom logging formats

When logging into a standard output, such as your terminal window, you can control the format for your logs. This enables you to improve readability by choosing the color of your text and format of your logging messages such as pre-fixing with a timestamp, or the logging level.

4. Extra context

This is particularly useful when the output arises from a distributed architecture. When you’re sending logs from different places into a single platform, you may add context to your log messages to identify their origin. For example, the source IP, or the server’s ID; anything that identifies where the data is coming from.

I’m sure you can think of specific benefits for your particular use case given a centralized logging library as powerful as Winston is.

Winston vs. Morgan vs. Bunyan

Although Winston logger is definitely one of the most powerful and flexible options out there, there are others that might better fit your needs depending on your particular use case.

Morgan

Morgan works with frameworks that are compatible with modules such as Express.js. As opposed to Winston, which is a general-purpose logger capable of great flexibility and customization, Morgan is intended to be used as middleware to customize the format of the HTTP-request event logline (and any associated errors during the processing of such requests).

As mentioned before, by default, all logs are written to the standard output, as with console.log, but Morgan allows you to override that and provide a custom stream and storage destination. If you’re looking for a basic logger for your web server, this might be a good choice.

Bunyan

Bunyan is very similar to the Winston logger from a feature set point of view. This is not a simple logger. On the contrary, it provides fine-tuned control over both the data being logged and its output destination.

Bunyan’s output is in JSON format. A downside is this makes visual inspection a bit difficult, however, it does simplify the automated interpretation of the loglines.

Human vs. Machine Destined Logs

Here is a comparison of a human-destined log (free text, with minimum formatting) vs. a machine-destined log (JSON):

Human Destined Message

info: [2020-03-10 13:03:23hs] Hello there, this is an info message! error: [2020-03-12 02:20:32hs] There was an error on line 26 of file index.js please review!

Machine Destined Message

{"message":"Info message easy to parse","level":"info"}

{"message":"There was an error, please review the details","level":"error", "details": { "file": "index.js", "line": 12, "error_msg": "Parse error"}

If you’re looking for a flexible logger that works well with other systems (as opposed to people) then Bunyan might be a good option for you.

Winston & Morgan Make a Great Partnership

Morgan and Winston are highly compatible, and leveraging both modules provides the best of both worlds. Morgan provides the middleware for Express.js (and similar frameworks), capable of logging HTTP requests–with outputs directed to the standard terminal window. Whereas, the Winston logger allows you to overwrite, and customize, the output channel/s.

So, if you currently do something like this:

const morgan = require('morgan')

//...

app.use(morgan('tiny'))

Now, you can change it to something like:

//defining a custom logger
let logger = new (winston.Logger)({
    exitOnError: false,
    level: 'info',
    transports: [
        new (winston.transports.Console)(),
        new (winston.transports.File)({ filename: 'app.log'})
    ]
})

//using the logger and its configured transports, to save the logs created by Morgan
const myStream = {
    write: (text: string) => {
        logger.info(text)
    }
}

app.use(morgan('combined', { stream: myStream }));

Every single HTTP Request received, and any subsequent error response is logged. Then, with a custom logger defined (more on this in a second), and configured to save loglines to both the console and a file, you can output logs to several places simultaneously.

How to Use The Winston Logger

Winston is a highly intuitive tool that is easy to customize. Next, we will dive a little deeper into some commands to perform functions that you may find useful.

How to Define a Custom Logger

We will create a custom instance of Winston–which gives us the ability to customize its properties (e.g., the colors used, the logging levels, the storage device for logs, etc.).

In this example, to create a custom logger, we’ll use the createLogger method provided by Winston:

const config = require("config")

const { createLogger, format, transports } = require('winston');
const { combine, splat, timestamp, printf } = format;

const myFormat = printf( ({ level, message, timestamp , ...metadata}) => {
  let msg = `${timestamp} [${level}] : ${message} `  
  if(metadata) {
	msg += JSON.stringify(metadata)
  }
  return msg
});

const logger = createLogger({
  level: 'debug',
  format: combine(
	format.colorize(),
	splat(),
	timestamp(),
	myFormat
  ),
  transports: [
	new transports.Console({ level: 'info' }),
	new transports.File({ filename: config.get("app.logging.outputfile"), level: 'debug' }),
  ]
});
module.exports = logger

More on the details down below, but first, let’s break down the code provided. The formatter function myFormat ensures that the logline has the required information and format. While the createLogger function defines parameters such as the maximum level to take into consideration and the list of storage devices to use for different log levels.

Levels, and Custom levels

The level defines the severity of a logged incident. There are many reasons why you might add logs to your code at any given point. These reasons are usually tied to a particular level. For example,the Debug level is usually applied when adding logging lines to understand a particular behavior. While adding a logging line to record when an error occurs is usually associated with the Error level.

The full list of default levels that come out-of-the-box with Winston are:

error: 0, 
warn: 1, 
info: 2, 
http: 3,
verbose: 4, 
debug: 5, 
silly: 6

Notice the values; these signify the severity associated with the level; the lower the severity of the logged event, the higher the value. So, a debug message is considerably less important than a warning message.

With Winston, you can customize the levels if the default offerings don’t suit. That means that you can do the following:

const myLevels = {
	superImportant: 0,
	mediocre: 1,
	whoCares: 2
}

const logger = createLogger({
  levels: myLevels
});

Now, for the icing on this level-flavored cake, you can then reference the level you want directly by using its name as a method from the custom logger you just created:

logger.superImportant(“This message needs to be seen, something happened!”)
logger.whoCares(“Blah!”)

The same call can be done with the default levels; they are available as methods for you to use.

Formats and Custom Formats

When it comes to defining how your log messages look, the Winston logger provides flexibility. By default, the log message is not formatted and is printed as a JSON string with two parameters, message and level (where the message contains the actual text you’re logging and level a string with the name of the log level, such as ‘info’). However, overwriting that and adding parameters such as predefined tokens, timestamps, etc. is straightforward.

Winston uses logform to handle the log-formatting aspects. If you want to read the full list of predefined formats follow the link to their full documentation.

For example, let’s say you wanted to format your logs, so you get a timestamp and a custom label, and everything turned into a single string (instead of the default JSON). You can do something like:

const { createLogger, format, transports } = require('winston');
const { splat, combine, timestamp, label, printf, simple } = format;

const logger = createLogger({
  format: combine(
	label({ label: 'CUSTOM', message: true }),
	timestamp(),
    	simple()
  ),
  transports: [new transports.Console()]
});


logger.info("Hello there!")
logger.error("Testing errors too!")
info: [CUSTOM] Hello there! {"timestamp":"2020-03-13T05:37:32.071Z"}
error: [CUSTOM] Testing errors too! {"timestamp":"2020-03-13T05:37:32.074Z"}

As you can see, the level and the actual message are correctly formatted. However, we’re still getting an object-like structure at the end. That is because the timestamp format function adds that property to the log object (which by default only has message and level properties).

To solve that issue, you can create a custom formatter function, such as:

const myFormat = printf( ({ level, message, timestamp }) => {
  return `${timestamp} ${level}: ${message}`;
});

And then, instead of calling the simple formatter, we use myFormat, like so:

const logger = createLogger({
  format: combine(
	label({ label: 'CUSTOM', message: true }),
	timestamp(),
    	myFormat()
  ),
  transports: [new transports.Console()]
});

The output now becomes reader-friendly:

2020-03-13T07:02:26.607Z info: [CUSTOM] Hello there!
2020-03-13T07:02:26.609Z error: [CUSTOM] Testing errors too!

Filtering

You can even use the format configuration to filter out log messages you don’t wish to save. This works by adding a specific property to the logged object. For instance, the following logger will ignore any log that has an “ignore” property set to true:

const ignoreWhenTrue = format((info, opts) => {
  if (info.ignore) { return false; }
  return info;
});

const logger = createLogger({
  format: format.combine(
    ignoreWhenTrue(),
    format.json()
  ),
  transports: [new transports.Console()]
});

Now, you can temporarily add the attribute to silence one particular log message that’s not important, like so:

logger.log({
  private: true,
  level: 'error',
  message: 'This is top secret - hide it.'
});

Notice how this is accomplished with the log method, instead of using the custom methods added dynamically based on the level.

Transporters

Personally, transporters are my favorite feature from Winston because they allow you to switch between storage destinations for logs with ease. You can even have transporters directing logs to several storage devices simultaneously; either sending all logs or sending logs conditionally to various targets.

The internal architecture enables users of the module to create and publish their own independent transports. There are over 30 transports options, which include logging out into a single file, the console, or to 3rd party systems, such as AWS’s S3, Elasticsearch, MySQL, MongoDB, and many more.

You may have noticed that the code samples from before all contained at least one transport. To define them, you can add a transports array (which can contain as many transports as you’d like), when you configure the createLogger function.

Each transport sends data to storage devices that will have their own custom properties, depending on what they do with the data (you’ll need to read through their docs to get those details). But, there are two parameters that all transports implement:

  • Level: This attribute sets the specific level for this transport to take into consideration. Any message that has a different level will be ignored. So although it’s optional, if you use it, ensure you don’t accidentally leave log levels without a transport assigned.
  • Format: Just like the general format from above, you can also customize the format of specific transporters, giving you further control over the way you output data.

For example, this logger will only save logs to files, however, which file is conditional upon on the log level:

const logger = winston.createLogger({
transports: [
new winston.transports.File({
filename: 'error.log',
level: 'error',
format: winston.format.json()
}),
new transports.Http({
level: 'warn',
format: winston.format.json()
}),
new transports.Console({
level: 'info',
format: winston.format.combine(
winston.format.colorize(),
winston.format.simple()
)
})
]
});

Streaming

One particular transport that you can use is the stream transport, which allows you to open up any Node.js stream and send logs into it.

This particular transport supports the following configuration properties:

  • Stream: The Node.js stream to add logs to. If objectMode is set to true, then the entire log object will be logged (including the message, the level, and any other extra attributes added by the formatters). Otherwise, only the message attribute will be sent
  • Level: This defines which level/s the transport should log. If you don’t set it, then the logger object will use it’s own configuration to decide which to log and which to ignore
  • Silent: If set to true, it suppresses output. By default it’s set to false
  • EOL: The end-of-line character to use. By default, it applies os.EOL

Profile Messages

Another interesting feature that Winston brings to the table is the ability to profile and debug your code. This module has the required methods to simplify that task for you.

If you’re looking to profile a piece of code, then you want to measure the time a piece of code takes to execute. Without a built in function, you would normally do something like:

let start = Date.now()

setTimeout(_ => {
    	let end = Date.now()
    	console.log("This took: ", (end - start) / 1000, " seconds to execute")
}, 1000)

With an output like the following:

This took: 1.003 seconds to execute

Of course, the example is over simplified, but you get the point. With Winston, however, we can do the following:

logger.profile("testing")
setTimeout(_ => {
    	logger.profile("testing")
}, 1000)

Assuming your logger was already created, you can use the profile method, which automatically starts and ends the timer for you and logs the message, as you can see below, with an INFO level message.

 {"level":"info","durationMs":1007,"message":"testing"}

You can read here about other ways you can profile your code with Winston, but remember that, by customizing the format and other properties of the custom logger, you can affect the output from this method.

The Winston Logger as an Overall Logging Solution

If you are choosing an overall logging solution for your application, be it centralized or distributed, Winston is your bread and butter. Everything should go through your custom loggers and you can tweak the logic behind it by changing just a few lines of code.

Taking it a step further, you might find the need to add more enterprise-level capabilities like ML-powered alerts and hosted, scaled secured ELK stack. Coralogix can help get you there faster. Our integration for Winston makes it a painless process.

Sumo Logic vs Splunk vs ELK: Which is Best?

From production monitoring to security concerns, it’s critical for businesses to analyze and review their log data. This is particularly true for large and enterprise companies, where the sheer amount of data makes log analysis the most efficient way to track key indicators. CTOs, in particular, are dealing with the challenges of this massive amount of data flowing through their organization, including how to harness it, gather insights from it, and secure it.

When it comes to the best platforms for log analysis and security information and event management (SIEM) solutions, 3 trivial Elk Stack alternatives come up: Splunk, Sumo Logic, and ELK.

Choosing which of these big guns to go with is no easy task. We’ll look at these top three platforms, including their advantages and disadvantages, and see who comes out the winner.

What is Splunk?

Splunk Enterprise is a platform to aggregate and analyze data. With Splunk, you can automate the collection, indexing, monitoring, and alerting functions when it comes to your data to control and leverage the information flowing into your business.

Scheduled searches let you create real-time dashboards and visualizations (offering both XML and drag-and-drop style customization options for visualization), while scheduled reports enable you to run and share reports at various intervals. In terms of support and community, Splunk hosts Splunkbase, which has thousands of apps and add-ons.

 

Splunk

The platform has the functionality to be used by experts as well less technically-inclined users. It scales well – with the ability to scale up to unlimited amounts of data per day – and has built-in failover and disaster recovery capabilities.

In addition to the self-hosted Splunk Enterprise, there is also the Splunk Cloud option, where Splunk is deployed and managed as a service.

Splunk dashbaord

 

The pros of Splunk

Splunk is good at what it does, which is primarily fast consolidation of logs to be able to search data and find insights.

The cons of Splunk

The biggest concern with Splunk is the complexity of setting it up and maintaining it. It has a relatively steep learning curve and can take time to get going properly and manage on an ongoing basis. The other major issue to be aware of is pricing, which can be quite high.

Understanding Splunk’s pricing 

Splunk Enterprise starts at $173 per ingested GB, is quoted per month. It is billed annually, and includes standard (not premium, though this is available) support.

What is Sumo Logic?

Sumo Logic is a cloud-native, machine data analytics service for log management and time series metrics. With the service, you can build, run and secure your AWS, Azure, Google Cloud Platform, or hybrid applications. 

How does Sumo Logic compare with Splunk?

The biggest difference when compared with Splunk is that Sumo Logic is built for the cloud; even though Splunk now offers its Splunk cloud option, Sumo Logic’s architecture is built around cloud usage. 

This means integrations are smoother, particularly when it comes to platforms such as AWS; scalability is built-in, there is no need for constant updates, and getting started is quicker and easier than with Splunk.

SumoLogic visualization

 

The pros of Sumo Logic 

Sumo Logic is easy to use and has all the advantages of being a SaaS solution, such as scalability, getting up and running quickly, and so on. Some people like the UI, while others prefer the other offerings’ look and feel.

The cons of Sumo Logic

Sumo Logic lacks some of the extended features of Splunk, particularly when it comes to the Splunk Enterprise offering. There have been complaints about Sumo Logic’s speeds when searching older data, its customer service, and its pricing being on the expensive side. Sumo Logic also lacks some of the community support of Splunk and particularly ELK.

 

Sumologic dashboard

 

Understanding Sumo Logic pricing

The Sumo Logic Enterprise platform starts at $150 per GB per month, with an annual commitment required. If you want the full support package, it’s an optional add-on to this package.

What is ELK?

ELK is the world’s most popular log management platform. The ELK Stack is made up of three different solutions, all of them open-source: Elasticsearch, Logstash, and Kibana.

Elasticsearch is a search engine based on Lucene that provides a distributed, multitenant-capable full-text search engine with an HTTP web interface and schema-free JSON documents. Logstash collects, parses, and stores logs, and Kibana is a data visualization tool. Also included as part of the stack is Beats, a platform for lightweight shippers that sends data from edge machines to Logstash and Elasticsearch. With the addition of Beats, ELK Stack became known as the Elastic Stack.

 

Kibana visualizations

 

With ELK, you can reliably and securely ingest data from any source, in any format and search, analyze, and visualize it in real-time. Being open source, it’s been rigorously tested by the large ELK community and is trusted by companies such as Sprint, Microsoft, eBay, and Facebook.

The pros of ELK 

ELK consolidates three mature components to form one powerful solution. Being an open source tool, there are numerous benefits that come with the adoption of ELK. In general, there has been a tremendous movement towards open source, particularly for enterprises. 

Open source solutions come with a lot of control, where you aren’t tied to a rigid way of doing things, and open source tools, especially ones like ELK/Elastic Stack, bring with them a vibrant community of contributors, testers, and fellow users who can contribute to your success.

The cons of ELK

If you are setting up yourself, it can be challenging to set up and maintain. Most users go with a solution that handles the setup for them.

Understanding ELK’s pricing

ELK is free (if you are using the open source version without X-pack).

Which platform is the best?

Given our significant combined experience with all of these platforms, deciding which one to pick had to be carefully weighed up. The functionality and feature set of Splunk, the simplicity and cloud-native advantages of Sumo Logic, and the open source design and robust nature of ELK.

A winner had to be chosen, and based on all of our research and experience, it had to be ELK – thanks to its vibrant community, the fact that it’s constantly improving and evolving faster than its competitors, has better JSON format support, is easier to use and get started with, and of course, comes in at a much lower price.

This is despite its drawbacks – the standard versions of it lack alerting, anomaly detection, and integrations into the development lifecycle – overall, however, it stands above the others as an all-round tool.

Being on top of your logs is critical, whether it’s for production monitoring and debugging, security purposes, resource usage, or any other of the multitude of key business functions log analysis supports.

With Coralogix’s platform, you can know when your flows break, automatically cluster your log data back into its original patterns so you can view hours of data in seconds, see all of your organization’s key indicators at a glance, and a whole lot more. 

Interested in finding out more about how your organization can benefit? Check out Coralogix to see how we can help.

(This article was updated in August 2023)

What DevOps Look for When Choosing a Logging and Monitoring Tool

By now DevOps are hopefully aware that among the multitude of modern analytics methods available to them, an advanced log monitoring tool provides the most complete view into how a product is functioning. Cases of log files among DevOps are broad, ranging from the expected, like production monitoring and development debugging, to the less obvious, like business analytics.

But when faced with the dizzying list of third-party logging tools on the market, what key features should DevOps look for before making a choice? And is it possible to find a single platform that combines all the essential features for today’s SDLC?

The Must-Haves When Choosing a Logging and Monitoring Tool

Functionalities you might assume as standard among logging tools may not be universally offered, and the most recent developments in log management — particularly via machine learning — might pleasantly surprise you. This list of features is a good starting point for narrowing down the large market selection and choosing the best logging and enterprise monitoring tools for your needs:

Range and Scalability – As a product’s user base expands, the range of log sources that DevOps need to monitor grows as well. A logging tool should collect logs from each system component, application-side or server-side, and provide access to them in one centralized location. Not all logging platforms are capable of maintaining speed as the number of logs they process grows. Therefore, you should keep a critical eye on the process when trying out different solutions.

Advanced Aggregation – It’s easy to be overwhelmed by all the data that a logging tool collects. Good aggregation features should allow DevOps to group their logs together according to a variety of shared characteristics, including log origin (devices, servers, databases, applications), feature usage, user action, error type, etc. As logs are generated they can be automatically analyzed to determine which of the existing groups they fit into, and then categorized accordingly.

Intelligent Pattern Recognition – Advancements in machine learning allow contemporary logging and monitoring tools to quickly (within two weeks, in Coralogix’s case) learn the standard log syntaxes within a given system. This gives the platform a sense of what the logs look like when components of the system are running optimally, and saves DevOps time that would be spent programming the platform with standard log patterns.

Automatic Anomaly Flagging The days of static reporting are over. Once a platform has learned log patterns, it can generate DevOps alerts notifying DevOps of deviations in those patterns, including possible bugs, security vulnerabilities, sudden changes in user behavior, and more.

Deep Storage – In order to discover the history behind certain product behaviors, or to really get a clear sense of evolving trends in your business, you’ll need to dig deep. Extended storage times for old log files may also be necessary for terms of compliance, be it with externally-mandated laws and practices or for your specific organization’s internal standards.

Search Functionality – In the event that a bug is reported by users, rather than automatically identified by your logging tool, you need a high-performing search function to track the issue down among the heap of log files. Note that it’s not a given for all logging platforms to provide code context (what occurred before and after the issue) for a search result, or extensive filtering options to narrow down returns of false leads.

Minimal Footprint – What’s the point of using logs to monitor signs of potential resource abuse within your environment if the log management platform you’re using contributes to that abuse? When you test run a logging tool, it’s crucial to be mindful of the impact it has on your system’s overall performance.

Keep It Consolidated

There’s nothing cohesive, practical, or fiscally sound about using a conveyor belt of different enterprise tools. Time is wasted by constantly readjusting to the workflow of each, and money is wasted by virtue of adding 5-10 line items to a budget rather than one.

The checklist in this article is lengthy, but surprisingly attainable within a single logging platform. If a DevOps team finds itself piecing together multiple logging and monitoring tools in order to satisfy its full range of needs across development, testing, and production, it might be time to move to a more holistic solution.

Why Are we Analyzing Only 1% of Our Logs?

Here at Coralogix, one of the main goals we have is what we call “Make Big Data small” the idea is to allow our users to view a narrow set log patterns instead of just indexing terabytes of data and providing textual search capabilities.

Why?

Because as cloud computing and open source lowered the bar for companies to create distributed systems at high scale, the amount of data they have to deal with are overwhelming to them.

What most companies do is to collect all their log data and index it, but they have no idea of what to search, where to search and most of all, when to search.

To examine our assumption we did a little research on the data we have from 50 customers who are generating over 2TB of log data on a daily basis. The disturbing lessons we’ve learned are below.  

One definition I have to make before we start is “Log Template”.

What we call a log template is basically similar to the printf you have in your code, which means it contains the log words split to constants and variables.

For instance if I have these 3 log entries:

  • User Ariel logged in at 13:24:45 from IP 1.1.1.1
  • User James logged in at 12:44:12 from IP 2.2.2.2
  • User John logged in at 09:55:27 from IP 3.3.3.3

Then the template for these entries would be:

  • User * logged in at * from *

And I can say that this template arrived 3 times.

Now that we are on the same page, here’s what we’ve learned from clustering daily Terabytes of log data for over 50 customers :

1) 70% of the log data is generated by just 5 different log templates. This demonstrates how our software usually has one main flow which is frequently used while other features and capabilities are rarely in use. So we kept going and found out that 95%(!) of your log data is generated by 10 templates, meaning you are basically analyzing the same log records over and over not even knowing 99% of your log data.

2) To support fact #1, we found out that over 90% of the queries ran by users are on the top 5 templates. These statistics show us how we are so blinded by these templates dominance we simply ignore other events.

3) 97% of your exceptions are generated by less than 3% of the exceptions you have in your code. You know these “known errors” that always arrive? they are creating so much noise that we fail to see the real errors in our systems.

4) 0.7% of your templates are of level Error and Critical, and they generate 0.025% of your traffic. This demonstrates just how easy it is to miss these errors, not to mention that most of them are generated by the same exceptions.

5) Templates that arrive less than 10 times a day are almost never queried (1 query every 20 days in average by all 50 customers together!). This is an amazing detail that shows how companies keep missing those rare events and only encounter them once they become a widespread problem.

Conclusions

The facts above show how our current approach towards logging is very much affected by the log variance and not from our perspective. We react to our data instead of proactively analyzing it according to our needs because the masses of data are so overwhelming we can’t see past them.

By automatically clustering log data back to its original structure, we allow our users to view all of their log data in a fast and simple way and quickly identify suspicious events that they might ignore otherwise.

Learn more about Coralogix Loggregation & Flow anomaly detection and how it can help you detect and solve your production problems faster.

How to Leverage Your Log Analytics

Here at Coralogix, we’ve mentioned before how log analytics has increasingly been gaining attention and is creating a way to cut back on software maintenance costs. In this post, we want to expand on the ways that Log Analytics can benefit the developers.

Let’s look at three facts about the growing trends of general Big Data Analytics for 2015:

1) Analytics and Business Intelligence Standardization is declining
Companies using Big Data Analytics tools are straying away from the known management tools, from a standardization of 35% in 2014 to 28% in 2015

2) Cloud-based data warehousing is on the rise
Cloud-based data warehousing services showed the biggest increase jumping to 34% in 2015 from 24% in 2014

3) Real-time technology is seeing real gains
With the development of complex event processing (CEP), mainly in the realms of financial services, security, telco, and intelligence agencies

Taking these factors into consideration, it is evident that log analytics is going places this year, and developers can benefit greatly from it. Not only will these tools and services help enrich the platform for logging, but they also can benefit in identifying bugs quicker. Saying that, we’ve come up with eight ways the developers can have greater insights and advantages from using log analytics.

1) Log Trigger Events: Log critical actions, such as user activity. This data can later be related to user cohorts for marketing, product management, and growth activity purposes. But also for the developers to optimize user flow.

2) Run Duration for Bigger Processes: For larger processes, intensive or lengthy application processes, log start and stop times. It can be correlated to pegged servers outages or load issue if they arise. This data can help to identify areas where the product is slow to respond or issues of application processes affecting infrastructure.

3) Log Deprecated Functionality: When a deprecated functionality is called, log it so the team can be alerted. This will help QA and Development know when other team members are using outdated classes by accidents.

4) Log Flag Changes: Some developers like to use flags in their code to indicate different states. Create a function for changing flags so that it is logged and clear when flags are off or on. This allows the response or alerting of when a particular flag that should have been renamed on in production.

5) Log Component Usage: Applications are a treasure pile of 3rd party component libraries. These libraries pose a risk when they are not monitored. For all the components used, it’s nice to log their usage – components name and version. There is a downside as this can be very chatty if not designed well. And it has to be by some real component tracking process outside of the collection, and from the insights.

The last three benefit the developers and their teams:

1) Standardize your log severity: an organization needs to have a standard for log severity. So that when a log is “Critical”/“Error” it is clear to the developer that there is a problem and on the other hand if you decide to log everything above information level you’d want information not to contain Debug level logs.

2) Aggregate your log data: each log resembles an action on your system, but the same log that is created by the same line of code can be generated millions of times a day with different variables (e.g., ‘User ID xxxxxxx logged in’). To see the logs that matter to you and not get lost in millions of identical logs, you need to have an easy option to aggregate logs by their log templates.

3) Decide on an alert policy: What events should be alerted, who should be notified, what alerts require an Email/SMS notifications. All these will make your life much more easy and clear with a focal point to each issue that is brought up.

Coralogix brings a new actionable approach to the Log Analytics & Management. By analyzing every log that is generated by the software, Coralogix learns the system’s flow, automatically detects broken Log patterns, and provides their root cause in a single click. Coralogix finds the patterns of broken vs. correct behavior and returns a few log entries, which is a lot more manageable than the millions of log entries that Log Analytics users have to deal with today.

The 5 quality pillars any R&D must own

In today’s competitive world of software development, one of the key factors for a company’s success is the R&D capability of releasing and monitoring multiple high quality versions in order to provide top notch services to their customers.

With software systems becoming more complex and distributed, the need for version delivery and software monitoring grew. This caused an explosion of new startup companies targeting these markets. With these new companies, came various solutions for the different stages of the development and delivery process of software systems. These solutions attempt to enhance and make these stages more efficient.

Roughly, this quality cycle can be divided into 5 main sections. Below, we’ll walk you through the essence of each stage and share a few tools that stand out.

  1. Static code analysis: A static code analysis tool checks the source code in order to verify compliance with the predefined rules and best practices set by the tool provider per coding language. Static code analysis is great for preemptively detecting code defects and inconsistencies especially in large code bases with newly created and legacy code.

Code analysis tools worth mentioning:

  • Klockwork Insight: a thorough static code analysis solution for various purposes that detects vulnerabilities and defects on the fly while you code.
  • Checkmarx: A security oriented code analysis tool that helps identifying, tracking and fixing technical and logical security flaws from the root. Checkmarx provides a broad support for various coding languages
  • Parasoft: A strong rule based code analysis, with integrations to automation and load testing, which allows the building of an E2E flow – supports C#, Java, C++.
  1. QA automation: QA automation is a powerful supplement to manual QA testing. It ensures a thorough test procedure and verifies behavioral consistencies. QA automation tools are able to playback pre-recorded actions, compare the results to the defined expected behavior and report success or failure to the QA engineer. After a small investment of creating these automated tests, they can be easily repeated and perform testing tasks that are impossible for manual testers.

QA automation tools worth mentioning:

  • Ranorex: A testing platform for Web, Desktop and mobile applications, capable of testing UI, Data driven tests, and functional tests.  Provides a unified dashboard with the test results.
  • LoadRunnerOne of the firsts in the market – a performance oriented automation tool that detects bottlenecks across the E2E flow.
  • Selenium: An open source project for browser automation, which provides various adjustable tools for recording and executing test on web platforms.

As selenium alone is not considered to be very intuitive, we recommend trying browser automation tools that rely on selenium engine, for example: the great https://www.testim.io solution.

 

  1. Continuous delivery: Continuous delivery is a novel approach that is aimed to help large organizations become as lean and agile as startups and be able to adapt their software in line with user feedback. By releasing multiple small versions, companies can improve their quality and customer satisfaction dramatically and in case of need even shift business focus.

Continuous delivery tools worth mentioning:

  • Jenkins: a continuous delivery enabler that provides both a continuous integration system, which allows developers to easily integrate changes into their project, and monitoring capabilities for externally running jobs (even on remote machines)
  • Travis: A Github oriented solution, although not as flexible as Jenkins, relies on common practices to enable a very simple integration (1 file in the root of your code), which makes the continuous integration and delivery almost seamless. If you are not using Github, Travis is probably not the tool for you.
  • Bamboo: a paid service (unlike the other tools listed in this category), which provides a very simple integration and user interface, but lacks the flexibility and plug-in variety of Jenkins.

 

  1. APM – Application performance monitoring: 2 critical parts of the quality chain are the application performance and the application availability. APM tools integrate with software systems and understand the system’s infrastructure to detect availability issues, slow response times and other performance oriented problems.

APM tools worth mentioning:

  • New Relic: New relic provides a deep view into the system, with real time performance and availability overview, real time alerting mechanism, and an API for personal custom performance monitoring apps
  • Datadog: DataDog provides a search and visualization mechanism that allows the user to drill into the heaps of data collected by DataDog. In addition, DataDog also offer a way to overlay data of different sources in order to find correlations between separate components (e.g web server & web application)
  • Raygun: Raygun is a more disaster-oriented tool. Once an application crashes, Raygun collects the exceptions and crash reports and alerts its users.
  1. Log Analytics & Management : This is an emerging market with huge demand. Log Analytics & Log Management tools enable the development, QA, and operations to get a hold of their log data and understand the system that flows from it. Moreover, Log Analytics & Management tools are crucial for monitoring production systems and understanding the root cause of software problems.

Log Analytics & Management tools worth mentioning:

  • Splunk: Splunk is a powerful tool that can index and visualize an entire organization, from various IT services to any machine data, which is being emitted from its customer’s servers. Splunk works in an unstructured manner and is agnostic to the data that is being sent to it. Splunk offer both SaaS (Splunk Storm) and on premise services.
  • Sumo Logic: SumoLogic offers a Log Analytics solution that is in many ways very close to Splunk. On top of the log collection and indexing capabilities, SumoLogic offers its “LogReduce” feature to aggregate log query results, and transactions tracking capabilities
  • Logentries: Logentries is a relatively new player in the market of Log Analytics & Management, which brings a fresh approach towards the integration process with simple plug-ins. In terms of Analytic capabilities, it does not bring too many new capabilities to the table besides the log tagging mechanism that can be helpful if you have a small defined set of logs generated from your software.

Coralogix brings a new actionable approach to the Log Analytics & Management. By analyzing every log that is generated by the software, Coralogix learns the system’s flow, automatically detects broken Log patterns, and provides their root cause in a single click. Coralogix finds the patterns of broken vs. correct behavior and returns a few log entries, which is a lot more manageable than the millions of log entries that Log Analytics users have to deal with today.

To get a 1/1 online demo of Coralogix and join the growing movement of companies that are shifting towards meaningful results in the world of Log Analytics & Management, simply  “Book a demo” .

These 4 parameters will make or break your E-commerce

During our research here at Coralogix, we discovered the growing need and awareness of Log Analytics as companies strive to control their log data and monitor their application and server logs.

One of the markets which made the most out of Log Analytics is the E-commerce application market. E-commerce is extremely dependent on the completeness of their transactions. They must analyze data from various sources to optimize their user experience, understand their customer behavior, and most importantly, make sure their stores are functioning at 100% as each and every broken transaction or link can result in immediate money loss.

Each user action needs to be monitored at several levels in order to achieve the required coverage.

  • Web server logs: The requests and responses from/to web servers (Apache etc.). Monitoring the web server logs allows the ability to understand the latency of the responses to the client requests, as long latencies are a known cause of user bounce. This monitoring can be achieved by creating statistic models on the response times the web server returns to understand their patterns and identifying abnormal behavior or poor performance of servers.
  • Performance logs: These logs can provide a sense of the application’s efficiency and performance. By monitoring the machine CPU, thread count, handle count, and memory usage, one can evaluate whether the system is suffering from low performance which might require a hardware upgrade or a software performance enhancement. These parameters are very easy to monitor and comprehend, we found them extremely valuable in identifying problems before they take place and preventing them.
  • HTTP errors: There are many possible HTTP errors. The first thing to be done is to aggregate these errors and find out how many types of different error there are (and how many times each type appear). The second step would be to drill deeper into the errors and determine what requests cause them.

A few common HTTP error types:

  1. 400 Bad Request – usually returned by the web server after it receives an invalid request – can indicate problems with the links on your website
  2. 404 Not Found – Returned by the web server in case it got a request for a non-existing URL, 404 does not necessarily mean you have a problem because there is a possibility the user actually browsed to a non-existing URL. To understand If there is a real problem you can either compare the request itself to similar requests on this URL or try browsing that URL yourself and verify if it exists
  3. 408 Request Timeout – Returned by the server in case the client did not produce the request in the defined timeframe, aggregate these errors and verify how many of them you have, too many might indicate a problem on your web server
  4. 500 Internal server error – The Web server encountered an unexpected condition that prevented it from fulfilling the request by the client. This is a ‘catch-all’ error generated by the Web server. Basically, something has gone wrong, but the server can not be more specific about the error condition in its response to the client.
  5. Application logs: The logs that were inserted by the developer in order to track the software behavior. The more detailed these logs are the more value they produce. Application logs can reflect the actual patterns of your system and analyze them can help identify software problems that cause major money losses you are not even aware of.

Via the above information, one could measure the key parameters of an e-commerce application

  1. Your download timing: how much time it takes your web server to download a web page to your client. This is extremely important as customers these         days tend to be very impatient to loading times and bounce very fast
  2. Application response time: how much time does it take your server to respond to user actions, once again, high response time results in customer attrition and high bounce rates.
  3. Last visited pages: What are the pages that are often the last visited before users leave your store? This can be a good indication that these pages need to be optimized.
  4. Your peak times: Know what are the days and hours in which your store is most active. This can assist you in scheduling promotions, preparing to handle a large amount of traffic or managing your support center.

There are many Log Analytics solutions out there that can handle such data sources and offer parsing and graphic tools, however, the problem with these tools is that they require the e-commerce owner to invest a lot of his valuable time in investigations and analysis instead of focusing on his main business which is selling and supplying.

Coralogix combines methods from the worlds of cyber and intelligence to create the world’s first Actionable Log Analytics solution, with a unique algorithm that automatically detects problems on any software, presents them in one simple view, and offers their root cause in a single click. Hit the “Request a demo” button above and join a global movement that is shifting towards actionable and meaningful results in the world of Log Analytics.