Log Query Library Management

After you create a log query filter, you can manage and reuse it to streamline troubleshooting, analysis, and reporting in LM Logs. A filter defines how log data is grouped, visualized, and shared across your environment.

Updating a Saved Log Query Filter

1. In LogicMonitor, navigate to the Logs page.
2. From the Views dropdown, select the saved view you want to update.
   The query of the selected view displays in the query bar.
3. Modify the query in the query bar and select Run Query.
   Ensure the query runs successfully before saving.
4. Select Save view….
5. In the Save View modal, confirm the Name, Group Type, and Group Name.
6. Select Update.
   

7. To create a new view instead of updating the existing one, rename the view before saving and select Save as new view.
   
   

Managing Saved Log Queries

1. In LogicMonitor, navigate to Logs.
2. Select the Views dropdown, then select Manage Saved Views.

1. In the panel, locate the view to manage and select the More options.
2. Choose one of the following actions:
   • Select Copy Link URL to copy a shareable link to the view.
   • Select Rename to update the saved view name.
   • Select Duplicate to clone the view and assign it to another group.
   • Select Copy to shared to make a query available to other users or teams within the same LogicMonitor portal who share a common role or resource scope.
   • Select Copy to Public to publish a query to the Public query library, making it visible to all LM Logs users across the portal.
   • Select Track Query to convert the view into a tracked query.
   • Select Move to assign the view to a different query group.
   • Select Export to download the configuration as a JSON file.
   • Select Delete to delete the saved view.
     

Importing Saved Views in Query Library

Import query packs into the Log Query Library to quickly add multiple saved queries from a JSON file.

1. In LogicMonitor, navigate to Logs.
2. Select the Views dropdown menu and then Manage Saved Views.
3. In the panel, select Import saved views.
4. Select the JSON file that contains your query pack.
5. Review the detected query groups and imported queries.
6. If duplicate query names are detected, resolve the conflicts before continuing.
7. Select Import.

The saved views are imported into the selected section of the Log Query Library.

Import Behavior for Saved View Imports

The following table describes how LM Logs processes imported queries.

Creating a Log Query Group

Log query groups organize saved views into logical folders.

1. In LogicMonitor, navigate to Logs.
2. Select the Views dropdown and then Manage saved views.
3. In the panel, select Add new Group.
   
4. In the dialog box, enter a Group Name and optional Description.

5. Select Save.

Managing a Log Query Group

1. In LogicMonitor, navigate to Logs.
2. Select the Views dropdown and then select Manage saved views.
3. Locate the group to manage and select More options.

4. From the menu, select one of the following actions:
   • Select Favorite all to mark favorites in bulk.
   • Select Unfavorite all to clear favorites in bulk.
   • Select Edit group to update the group name or description.
   • Select Delete group to remove the group after all views are moved or deleted.
   • Select Duplicate group to create an exact copy of an existing log query group, including all saved views within it.
   • Select Export group to export saved views to a JSON file.
   • Select Import to import saved views from a JSON file.

Editing a Group

You can edit an existing log query group to update its name or description.

1. In the panel, locate the group you want to update.
2. Select More options next to the group name.
3. From the menu, select Edit group.
4. In the Edit Group modal, do the following:
   • Enter a new Group Name if you want to rename the group.
   • Enter or update the Description to clarify the group’s purpose or scope.
5. Select Save to apply your changes.

The group is updated with the new name and description.

Deleting a Group

You can delete a log query group that is no longer needed. Before deleting, ensure that all saved views within the group are either moved to another group or deleted.

1. In the panel, locate the group you want to remove.
2. Select More options next to the group name.
3. From the menu, select Delete group.
   

4. A confirmation dialog displays. Review the warning message.
5. Select Delete.
   The group is permanently removed from the Manage saved views panel.

Duplicating a Group

You can duplicate an existing log query group to create a copy of its structure and contents. This is useful when you want to reuse a group of saved queries in a different environment, share them with another team, or create a test version without altering the original group.

1. In the panel, locate the group you want to duplicate.
2. Select More options next to the group name.
3. From the menu, select Duplicate group.
4. In the Duplicate Group modal, review or update the suggested group name. A numerical suffix, such as _1, is automatically added.
5. (Optional) Update the Description to reflect the purpose of the new group.
6. (Optional) Update the Group type as needed.
   

7. Select Save.

The duplicated group displays in the Manage saved views panel with all the saved queries, filters, and configurations from the original group.