Logs and alerting

Log collection does not require an application log format change. The agent reads files, container logs and system logs; the platform parses, searches and alerts.

Sources

Files
Docker container logs
Kubernetes container logs
journald
syslog
Windows event log

Parsing and masking

Multiple encodings recognized
Include and exclude rules for files
Field-level masking
Throttling and sampling so a log storm does not take down the pipeline

Search

Full-text search
Filter by host, service and time range
Jump from a trace or error to the matching log window
Saved searches

Alerts

Rules can be based on logs, metrics or traces. Firing creates a history record and can notify channels.

Retention

Retention follows the storage plan. Hot data is searchable quickly; cold data is kept for review.

Advice

Start with a few critical services and confirm parsing and masking
Widen file coverage
Add alert rules last, so noise does not arrive before signal