New Logs Search

Overview

LogicMonitor v.161 introduces a new query language for searching logs. This article will give you a brief overview of the enhancements. and changes we’ve made to the search functionality on the Logs page.

What’s new?

• You can use logical operators (AND, OR, NOT) to combine filters.
• You can use glob expressions for fuzzy match on fields and values.
• You can use regular expressions to match fields and values.
• Build queries with help from autocomplete based on the information in your logs.
• Access recent searches to see the last 10 searches in your history.

What’s changed?

• Filtering for Resources and Groups is now done from the query bar. Autocomplete will help you find the field names and values to run the query.
• Clicking the Search icon to run your query — Searches do not execute automatically!

Old Search and Filter

Previously, to filter logs for Resources, Groups, and Subgroups, you had to select the values from different lists that were above the graph.

New Search and Filter

Now, you can use the query bar to search and filter your logs. When you type in the query bar, the autocomplete menu will open and provide a list of all possible options based on what you’ve entered.

If you don’t know where to start, type an underscore to see a list of the LogicMonitor reserved fields, which include resource names, resource groups, log alert severities, and anomaly type.

Select or type “_resource.name” into the query bar and you can start typing the name of the resource you want to filter on. Autocomplete will provide suggestions as you type.

When you’re done typing your query, click the search icon to the right of the query bar to run the search.

Logical Operators

You can use logical operators to combine multiple expressions. After you enter a field=value expression, autocomplete will suggest Operators. You can then select an operator from the list or type it in before you enter another field=value expression.

Search History

You can also view your recent search history by clicking the clock icon on the left of the query bar. Your recent searches will display the last 10 searches. You can remove individual or all searches from this list.

You can also save a search by clicking the star icon to the right of the query bar.