Log Attributes

The best kinds of logs are descriptive, contextual, and concise. Attributes allow you to quickly store, query, and filter key contextual information from your application's logs.

Attributes are supported with the Logfmt, JSON, and NDJSON log formats.

Formatting

AppSignal will parse logs received from your source based on key-value pairs, storing each key and value as attributes on the log line, allowing you to filter log lines on these attributes.

Formatting attributes with:

• Logfmt
• JSON and NDJSON

Logfmt

In Logfmt, attributes can be added to log lines:

this is foo=bar a duration=10 message message="I am a message"

For example, the above log line will be parsed to a log line with the message "I am a message", and the following attributes:

{ "foo": "bar", "duration": 10 }

Read more about Logfmt log formatting.

JSON and NDSON

In JSON, attributes can be added in a hash under the key attributes:

{
  "timestamp": "2022-06-02T04:17:25.783Z",
  "group": "organisations",
  "severity": "warn",
  "message": "This is a test message",
  "hostname": "frontend1",
  "attributes": {
    "org": "appsignal",
    "step": 1,
    "seen_terms": true,
    "entries": 10.01
  }
}

For example, the above log line will be parsed to a log line with the message "I am a message", and the following attributes:

{ "foo": "bar", "duration": 10 }

Read more about JSON/NDJSON log formatting.

Querying Attributes in AppSignal

In AppSignal, you can search for logs that match specific attribute conditions.

For example, the following query would return all logs with an article_id attribute that contains the value 7:

attributes.article_id=7

Read our log management documentation for a full explanation of our logging search syntax.

When a log is expanded, attributes will be listed under the log message:

Formatting Rules

Attribute values can be any of the following types:

• string
• integer (e.g. 10)
• double (e.g. 10.01)
• boolean (true/false)

Attribute keys must follow the following rules:

• Keys must be alphanumeric.
• Keys cannot contain spaces but may contain full stops (.), underscores (_), and hyphens (-).
• Keys may not contain more than 50 characters
• Values must not be longer than 255 characters
• No more than 25 attributes per log message.

In the event attribute keys and values do not follow the above rules, the following behavior can be expected:

• If a key does not have a value, it will be appended to the message field.
• If a key-value pair has a key with the name of msg or message, the value of this key will be parsed as the log message.
• If no message/msg key is available, the entire log line will be considered the message.