Log Management

Your log data must not contain any personal data, such as names, email addresses, etc. It is your responsibility to ensure this data is filtered out before being sent to AppSignal, and when identifying a person is necessary that your application uses alternative forms of identification such as a user ID, hash, or pseudonym.

Screenshot of expanded log

Once AppSignal Logging is successfully configured, you'll be able to see logs for all of your sources from within the AppSignal application. You can filter and query logs and expand specific logs for their trace data. When viewing your logs you can:

Filter and Query Logs

Use the "Source" drop down to filter which sources you see the logs for. Use the "Severity" drop down to filter the severity of logs

Filtering and querying are further explained in the Filtering and Querying section of this guide.

Copy Log Meta Data As JSON

Expand a log by pressing the "+" button, click "Copy as JSON". Meta data will automatically be copied to your clipboard as a valid JSON object.

Share Log

Click "Copy link to log line" and a link to this log line will automatically be copied to your clipboard.

Only users within your AppSignal Organisation will be able to access the logs via this link

What Happened Here

Want to see a snapshot of your application's metric at the exact time the logline was made? Click "What Happened Here"

Jump to Date

Something happened while you were having coffee? No problem. Use the "Jump to date" button to navigate to the date and time you want to investigate.

Live Trail

Clicking "Go to live" will take you to a live trail of your logs.

Filtering and Querying

AppSignal supports log filtering by:

Filter FieldDescription
sourceA Log Source from your application, eg MongoDB or Sidekiq
severityLog severity level. Accepted values are: error, warning, info, debug and trace
hostnameApplication Host (via search)
groupNamespaces defined for your application (via search)
messageLog message contents (via search)
attributeAttributes defined in your logs (via search)

Search Syntax Explained

The below table explains the current AppSignal Logs search query syntax.

Queries can be combined with a space between them (see Combined Queries in Search Query Overview).

Search Query Overview

Query NameAppSignal SyntaxDescription
WildcardFooReturns all logs that contain a value like Foo
Multiple WildcardsFoo BarReturns all logs that contain a value like Foo and a value like Bar
Wildcard For Words With Spaces"Foo Bar"Returns all logs that contain a value like "Foo Bar"
Field Searchhostname:fooReturns all logs where field hostname is like Foo
Multiple Word Field Searchhostname:"foo bar"Returns all logs where field hostname is like "Foo Bar"
Exact Matchhostname=fooReturns all logs where field hostname is Foo
Exact Query Negationhostname!=fooReturns all logs where field hostname is not Foo
Wildcard Query Negationhostname!:fooReturns all logs where field hostname is not like Foo
Attribute Specific Queryattributes.attribute_nameQueries log attributes. Replace attribute_name with the attribute you are querying. You can use any legal AppSignal operator in this table to complete your query.
Greater Thanattributes.duration > 100Returns all logs where duration is greater than 100
Less Thanattributes.duration < 100Returns all logs where duration is less than 100
Combined Queriesbanana group="slow queries" "not found" message!:segfault group!=frontendReturns all logs where logs contain a value like Banana from the group slow queries where log is like not found and where log is not like segfault and group is not frontend.

Managing Sources

To modify a source go to AppSignal > Logging > Sources and click "Manage source"

Screenshot of Source Management

When managing a source, you can:

Edit Source

To edit the source click "Edit source" in the top right corner of the screen. You can edit the following source attributes:

  • Name
  • Platform (currently limited to syslog)
  • Format

Changing the log format only applies to new log lines. The attributes and message of existing log lines will not change.

Remove Source

Deletion is permanent and will revoke the API key used for that source.

Before removing a log source, we recommend ensuring that the source is no longer sending logs to AppSignal so that your application is not making unnecessary calls to third parties. Before removing the log source in AppSignal, remove the rsyslog configuration file for this log source (located in etc/rsyslog.d) and restart rsyslog with the below command.

shell
/etc/rc.d/init.d/systemctl restart rsyslogd
Screenshot of confirm deletion alert

To remove a source click "Remove source" from the Source Management page. When prompted to confirm removal read the dialogue box carefully and click "Yes, delete this". The source will be deleted.