Coralogix brings a whole new approach to machine data analytics with its Loggregation and anomaly detection capabilities, but sometimes all you need is to query your data and get fast reliable results.
Coralogix’s Log query brings an intuitive interface with a flexible query and Grid layout options to allow you to query any data in seconds. In addition, Coralogix’s log query uses the unique capabilities of log template identification to enable you to query a log template regardless of its parameters using any query language or defining regular expressions.
First, click the Logs icon on your dashboard to open the log query interface.
Define the query text and time window (default is last 15 min), note that you can run queries based on Elastic ‘simple query’ or run a free-text query, just hover the test tube icon (on the top left to the query space) for instructions. Click ‘GO’ to get results in seconds, or ‘Clear’ to reset the query back to default. Once you get the query results, you can see that the occurrences graph above the retrieved log records was changed as we filtered out log entries that didn’t answer our search criteria.
Coralogix supports the following query types:
Note:
Our log:
{
"user" : "John",
"post" : "Going for cookies cream is a real treat"
}
The field ‘post’ has the following tokens: going, for, cookies, cream, is, a, real, treat
The query: post:cook – no match as it isn’t matching any token
The query: post:cream – fully matches the token cream
The query: post:cook* – fully matches the token cookies
The query (using double quotes to capture a phrase): post:”real treat” – fully matches the exact combination, ‘real treat’, hence we have a match.
Our log:
{
"aircraft" : "Boeing",
"message" : "flight number fly1234paris has been delayed"
}
The field ‘message’ has the following tokens: flight, number, fly1234paris, has, been, delayed
When performing a keyword search (by adding the suffix .keyword to the Elastic field’s name as described in #2), no tokenization is performed and the ‘key.keyword’ field populates the entire string (with one limitation – if its string is longer than 256 characters no results are returned as the keyword only holds the first 256 characters.).
Our log:
{
"aircraft" : "Boeing",
"message" : "flight number fly1234paris has been delayed"
}
message.keyword token is the entire string: flight number fly1234paris has been delayed.
Now you see that the word you searched for is being highlighted for better visibility.
Coralogix stores fields with values that could be interpreted as numeric such as “123”, “0″, etc., in a field called fieldname.numeric.
For example: duration.numeric. In such cases, when doing a range query we use the following syntax:
fieldname.numeric:[lowerValue TO higherValue], or fieldname.numeric:{lowerValue TO higherValue},
or a combination of [ or { at the beginning, or ] or } at the end of the range.
The differences are as follows:
a. fieldname.numeric:[1 TO 7] –> 1 =< x = < 7; ie: The value of x is greater or equal to 1, and less or equal to 7.
b. fieldname.numeric:{1 TO 7} –> 1 < x < 7; ie: The value of x is greater than 1, and less than 7.
c. fieldname.numeric:[1 TO 7} –> 1 =< x < 7; ie: The value of x is greater or equal to 1, and less than 7.
a. duration.numeric:[2 TO 8] will return 3 logs
(Match is greater or equal to 2, and less or equal to 8).
To query the surroundings of a log on your results simply mark that log, click the ‘Query selected log before & After’ button, and select the desired timeframe. This will retrieve all logs prior to and after the selected log from the same application and subsystem.
To view raw log simply mark a log and click the 3 dots that will appear or press the ‘space’ button.
Use Templates to view the unique appearances of your logs and their variable models (Note it takes 24H for Loggregation to become active)
You can retrieve your data by performing queries and opening public saved views within the URL address.
Examples:
https://YOUR_TEAM_NAME.coralogix.com/#/query-new/logs?query=YOUR_QUERY.
https://YOUR_TEAM_NAME.coralogix.com/#/query-new/logs?query=Field_Name_1:Value_1%20AND%20Field_Name_2:Value_2&startTime=1591740610000&endTime=1591741210000.
https://YOUR_TEAM_NAME.coralogix.com/#/query-new/logs?viewName=YOUR_VIEW
Notes:
Start using Coralogix now and enjoy a whole new world of simple and flexible ways to retrieve your data.