Skip to main content
Gå til innhold

Logs

Logs are timestamped records of events in your application, and they give the most detailed account of what happened and when.

On Platon, logs are stored in Loki, and you read them in your team's Grafana organization.

When to use logs​

Logs are well suited to debugging individual errors and to audit trails. In an investigation after the fact, they let you reconstruct what happened on a specific request. They are not the right tool for counting events, computing rates or driving alerts at scale, so emit a metric for those instead. See Metrics and, if you are considering OpenTelemetry, Choosing your signals.

How logs reach Loki​

How logs are collected depends on your setup:

SetupHow logs are collected
PaaS Logging (stdout)Vector automatically collects container logs
PaaS Full Observability (OTLP)Your app sends logs via OpenTelemetry (requires onboarding)
Puppet-managed VMspmodule_vector ships logs from files
External ServicesYour collector sends logs with authentication

Logs are retained for 180 days by default. See Tenants — Data retention for details.

Viewing logs in Grafana​

  1. Go to Grafana.
  2. Open Explore.
  3. Select your Loki data source.
  4. Write a LogQL query.

Basic queries​

Find logs from a specific namespace:

{k8s_namespace_name="my-namespace"}

For stdout logs collected by PaaS Logging, write {namespace="my-namespace"} instead. On those logs, the service_name label usually holds the container name.

Find error logs:

{k8s_namespace_name="my-namespace"} |= "error"

Filter by multiple conditions:

{k8s_namespace_name="my-namespace", service_name="my-service"} |= "error" != "expected"

Parse a JSON line from stdout and filter on a field:

{namespace="my-namespace"} | json | status_code >= 500

OTLP logs need no | json, because their attributes are already structured metadata you can filter on. On both kinds of log, | detected_level="error" keeps only the error lines.

Query language​

Loki uses LogQL. Its key concepts are:

  • Stream selectors ({label="value"}) filter by labels.
  • Line filters (|= "text") filter log content.
  • Parsers (| json, | logfmt) parse structured logs.
  • Aggregations (count_over_time(), rate()) compute statistics.

See LogQL best practices for writing efficient queries.

Correlation between logs and traces​

On a logs-only setup, this section does not apply. Log lines sent over OTLP while a span is active carry trace_id and span_id. To open the trace for such a line in Tempo, expand it in Grafana's Loki view and click View trace under Links in the log details.

Choosing your signals — Correlating the three signals shows every link between the signals, and When a link is missing covers the usual causes when one doesn't show up.

Next steps​