Log Management
Your log data must not contain any personal data, such as names, email addresses, etc. It is your responsibility to ensure this data is filtered out before being sent to AppSignal, and when identifying a person is necessary that your application uses alternative forms of identification such as a user ID, hash, or pseudonym.
Once AppSignal Logging is successfully configured, you'll be able to see logs for all of your sources from within the AppSignal application. You can filter and query logs and expand specific logs for their trace data. When viewing your logs you can:
- Filter and Query Logs
- Copy Log Meta Data as JSON
- Share Log
- View What Happened Here
- Jump to Date
- View Live Trail
Filter and Query Logs
Use the "Source" drop down to filter which sources you see the logs for. Use the "Severity" drop down to filter the severity of logs
Filtering and querying are further explained in the Filtering and Querying section of this guide.
Copy Log Meta Data As JSON
Expand a log by pressing the "+" button, click "Copy as JSON". Meta data will automatically be copied to your clipboard as a valid JSON object.
Share Log
Click "Copy link to log line" and a link to this log line will automatically be copied to your clipboard.
Only users within your AppSignal Organisation will be able to access the logs via this link
What Happened Here
Want to see a snapshot of your application's metric at the exact time the logline was made? Click "What Happened Here"
Jump to Date
Something happened while you were having coffee? No problem. Use the "Jump to date" button to navigate to the date and time you want to investigate.
Live Trail
Clicking "Go to live" will take you to a live trail of your logs.
Filtering and Querying
AppSignal supports log filtering by:
| Filter Field | Description |
|---|---|
source | A Log Source from your application, eg MongoDB or Sidekiq |
severity | Log severity level. Accepted values are: error, warning, info, debug and trace |
hostname | Application Host (via search) |
group | Namespaces defined for your application (via search) |
message | Log message contents (via search) |
attribute | Attributes defined in your logs (via search) |
Search Syntax Explained
The below table explains the current AppSignal Logs search query syntax.
Queries can be combined with a space between them (see Combined Queries in Search Query Overview).
Search Query Overview
| Query Name | AppSignal Syntax | Description |
|---|---|---|
| Wildcard | Foo | Returns all logs that contain a value like Foo |
| Multiple Wildcards | Foo Bar | Returns all logs that contain a value like Foo and a value like Bar |
| Wildcard For Words With Spaces | "Foo Bar" | Returns all logs that contain a value like "Foo Bar" |
| Field Search | hostname:foo | Returns all logs where field hostname is like Foo |
| Multiple Word Field Search | hostname:"foo bar" | Returns all logs where field hostname is like "Foo Bar" |
| Exact Match | hostname=foo | Returns all logs where field hostname is Foo |
| Exact Query Negation | hostname!=foo | Returns all logs where field hostname is not Foo |
| Wildcard Query Negation | hostname!:foo | Returns all logs where field hostname is not like Foo |
| Attribute Specific Query | attributes.attribute_name | Queries log attributes. Replace attribute_name with the attribute you are querying. You can use any legal AppSignal operator in this table to complete your query. |
| Greater Than | attributes.duration > 100 | Returns all logs where duration is greater than 100 |
| Less Than | attributes.duration < 100 | Returns all logs where duration is less than 100 |
| Combined Queries | banana group="slow queries" "not found" message!:segfault group!=frontend | Returns all logs where logs contain a value like Banana from the group slow queries where log is like not found and where log is not like segfault and group is not frontend. |
Managing Sources
To modify a source go to AppSignal > Logging > Sources and click "Manage source"
When managing a source, you can:
Edit Source
To edit the source click "Edit source" in the top right corner of the screen. You can edit the following source attributes:
- Name
- Platform (currently limited to syslog)
- Format
Changing the log format only applies to new log lines. The attributes and message of existing log lines will not change.
Remove Source
Deletion is permanent and will revoke the API key used for that source.
Before removing a log source, we recommend ensuring that the source is no longer sending logs to AppSignal so that your application is not making unnecessary calls to third parties. Before removing the log source in AppSignal, remove the rsyslog configuration file for this log source (located in etc/rsyslog.d) and restart rsyslog with the below command.
/etc/rc.d/init.d/systemctl restart rsyslogd
To remove a source click "Remove source" from the Source Management page. When prompted to confirm removal read the dialogue box carefully and click "Yes, delete this". The source will be deleted.