Analyze logs
Analyze is structured log exploration view in SolarWinds Observability SaaS, which allows you to examine large volumes of log events over a chosen time range. Use Analyze logs to see which attributes exist in your logs, to filter and slice logs by field rather than just message, and to compare behavior across services, regions, environments, and other attributes.
Analyze logs complements the Log Viewer:
- Log Viewer: provides a live, continuously updating stream of logs. Use Log Viewer when you need a real-time, continuously updating stream of logs or you are watching a live incident as it unfolds.
- Analyze logs: focuses on structured logs based on time-range for deeper investigation. Use Analyze when you need to understand the attributes in your logs and how they are used, when you want to slice logs by structured fields, when you are investigating an incident, or when you want to build views with custom columns and filters.
Navigation
Access the Analyze logs functions based on your deployment:
| SolarWinds Observability SaaS | SolarWinds Papertrail (logs-only) |
|---|---|
| Navigate to Logs in the left-hand navigation panel. Select Analyze at the top of the Logs screen. | Analyze appears directly in the left-hand navigation panel. |
Exploring the Analyze view
The Analyze tab has four main areas:
- Field Explorer
- Search and filter toolbar
- Optional log events volume chart
- Log events table and details side sheet
Field Explorer
The Field Explorer lists the structured fields present in your logs for the currently-selected time range, including the following:
- Common metadata, such as severity or host
- OpenTelemetry attributes
- Fields parsed from JSON log messages
The field list is not narrowed by current search or filters. It always shows every field seen in the time range.
Within the Field Explorer, you can see top values for a field based on the number of events that match, select a field from the Field Explorer and add it as a column in the log events table, or add a field to the search criteria. When you expand a field, the top values shown reflect your current search and filters. A field can appear on the list with no values behind it. There may be no data for the selected filters, meaning the field exists in this time range, but no events matching your current search and filters contain it. Widen or clear your filters to see its values. Alternatively, there may be no data. The field exists but has no non-empty values in this time range. Changing the time range changes which fields are listed.
Search and filter toolbar
The Analyze toolbar allows you to search and filter logs. Common operators allow you to build precise conditions.
| Common operators | |
|---|---|
Equals (=) |
Does not equal (!=) |
Contains (~) |
Does not contain(!~) |
| Is empty | Is not empty |
The search box and filter bar are combined with AND logic.
Search box
The Analyze logs search box searches within the body of the log message.
Filter bar
Each active filter appears in the filter dropdown. You can see the field, operator, and value.
Use the following methods to add filters:
- Click Add to search criteria for the field in the Field Explorer.
- Use actions in the Event details side sheet.
- Add a filter manually from the toolbar.
For advanced users, Analyze logs also supports a query mode that lets you type the full query rather than working only with filter pills. This is useful for querying fields with numerical values, as it supports numerical operators such as > and <.
Log events volume chart
You can choose to display a bar chart of log event volume above the event list. This chart uses the current time range and search/filter context and helps you see spikes or drops in log volume at a glance. You can click and drag to narrow to a specific time window for the entire page. The Log events volume chart is shown by default but can by hidden by clicking on the button for Log events volume.
Log events table
The main panel shows a table of log events. By default, this panel displays core columns, including timestamp and log message. You can add additional columns from the Field Explorer, Event details, or Manage columns. Use Manage columns to reorder columns. You can also sort by any visible column, not only by the time stamp.
Export to CSV
From the Log events table, you can export the currently visible page, with the currently visible columns and a metadata header, to CSV. This will include the filters, time range, and export date, and will be saved as log-events-export-<timestamp>.csv.
Event details
Clicking on any row in the log events table opens the details panel on the right-hand of the screen. The details panel allows you do the following:
- See the full log message.
- View all parsed fields for the event, with important or popular fields at the top.
- Add any field as a column in the event list.
- Add a filter for a specific field value.
- Copy field values to use elsewhere.