Log query – simply retrieve your data
- January , 2016,01
Coralogix brings a whole new approach to machine data analytics with its Loggregation and anomaly detection capabilities, but sometimes all you need is to query your data and get fast reliable results.
Coralogix’s Log query brings an intuitive interface with a flexible query and Grid layout options to allow you to query any data in seconds. In addition, Coralogix’s log query uses the unique capabilities of log template identification to enable you to query a log template regardless of its parameters without using any query language or defining regular expressions.
1 – Click the Logs icon on your dashboard to open the log query interface
2 – Select your query type: Free text search or template search. Free text search will allow you to query your logs with any text or metadata. Template search will enable you to query a log record regardless of its variables and get all the results for that log event without using query language or regular expressions.
3 – Define the query text and time window (default is last 15 min), note that you can also run queries based on Elastic ‘simple query’, just hover the test tube icon (on the top left to the query space) for instructions. Click ‘GO’ to get results in seconds, or ‘Clear’ to reset the query back to default. Once you get the query results you can see that the occurrences graph, above the retrieved log records, was changed as we filtered out log entries that didn’t answer our search criteria.
Coralogix supports 3 types of queries:
1) Google search query – match any log with the combination of words queried on the entire log payload: so querying ‘Coralogix is’ will return both the log ‘Coralogix is the best’ and the log ‘Coralogix query is flexible’
2) Elastic simple query – with word tokenizing according to Elasticsearch default tokens. So querying /Key:first-name/ will return both the log ‘first-name: John’ and ‘The first participant’s name is John’. Note that you use forward slash before and after your query string.
3) Keyword search – use ‘Key.keyword’ to query data without tokenization so that /Key.keyword:first-name/ will return the log ‘first-name: John’ and also ‘first-name: Bob’ but won’t return ‘The first participant’s name is John’ as it looks to match the exact phrase ‘first-name’. Note that you use forward slash before and after your query string. You can add a regex to the keyword query with the following convention /Key.keyword:/.*first.*John.*//, which will return only the logs ‘first-name: John’ and ‘The first participant’s name is John’
4 – To query the surroundings of a log on your results simply mark that log, click the ‘Query selected log before & After’ button, and select the desired timeframe. This will retrieve all logs prior and after the selected log from the same application and subsystem.
5 – To view long text logs, mark a text for querying/alerting, or to visualize JSON fields, simply mark a log and click the 3 dots that will appear or press the ‘space’ button.
6 – Use Loggregation to view the unique appearances of your logs and their variable models (Note it takes 24H for Loggregation to become active)
Start using Coralogix now and enjoy a whole new world of simple and flexible ways to retrieve your data.Signup to Coralogix