Learn about Tanzu Observability metrics, logs, and traces.
Tanzu Observability helps you monitor your application using metrics, traces, and logs. For example, you can:
  • Use metrics to get the numerical data and identify and alert on the performance issues in a system.
  • Use traces for an overview of all application services and to find bottlenecks.
  • Use logs to find the root cause of issues.
shows that Tanzu Observability supports all three pillars : metrics, traces, and logs.

What’s a Tanzu Observability Log?

Logs are structured or unstructured text records of events that took place at a given time. Tanzu Observability ingests logs in JSON format.

Log Attributes

Each log has required attributes, standard attributes, and custom tags. We tokenize the values of these attributes and tags, so that you can filter and search logs.

Required attributes
  • timestamp or log_timestamp: The time when the log was created. The value must be in Epoch milliseconds.

    If your log shipper sends this attribute with a different name, use the customTimestampTags proxy configuration property to establish the mapping.

    If you don't send or map this attribute, we set the value by using our system time.

  • message or text: The body of the log entry. Can be up to 20k characters.

    If your log shipper sends this attribute with a different name, use the customMessageTag proxy configuration property to establish the mapping.

Standard attributes These attributes are required if you want to drill into logs from charts and traces.
  • source: A unique platform that emits the log, such as an AWS EC2 instance or a node in Kubernetes. To ensure that you can drill into logs from charts, use matching source values for logs and metrics. To ensure that you can drill into logs from traces, use matching source values for logs and traces.
  • application: Name of the application that emits the log. To ensure that you can drill into logs from traces, use matching application values for logs and traces.

    If your log shipper sends this attribute with a different name, use the customApplicationTags proxy configuration property to establish the mapping.

  • service: Name of the service that emits the log. To ensure that you can drill into logs from traces, use matching service values for logs and traces.

    If your log shipper sends this attribute with a different name, use the customServiceTags proxy configuration property to establish the mapping.

Custom Tags You can send logs with additional custom tag key-value pairs of your choice. Follow these guidelines:

See Limits for Logs for details.

Log Data Format Example

Image giving an overview of the attributes in a log. They are listed in the table above.

 click for top of page

Send Logs to Tanzu Observability

You can send your logs using a log shipper, such as Fluentd, that sends logs as a JSON array over HTTP. See Send logs to Tanzu Observability.

A diagram shows how logs are sent from a log shipper to the Tanzu Observability components

 click for top of page

View Logs and Troubleshoot

When logs have started flowing into your Wavefront instance, as a user with the Logs permission, you can:

  • Go to the Logs Browser directly to view and explore logs.
  • Drill into the Logs Browser from charts, alerts, application map, and the Traces Browser.

A diagram that shows all the UI pages that link to logs (charts, alerts, application map and Traces Browser). How to navigate from each one of them to the Logs Browser is explained in the sections below.

Examine Logs in the Logs Browser

You can examine logs that were sent to Tanzu Observability on the Logs Browser:

  • See logs for a specific the time range within the logs retention period for your Wavefront instance (7, 15, or 30 days).
  • Filter logs using application, service, source or other tags.
  • Search for logs that have a messages that contain a specific word, for example, error.
  • In the histogram chart at the top of the Logs Browser, see the number of logs for each time bucket, zoom in, and identify hotspots. Group the number of logs by the values of a specific tag.
  • Share the Logs Browser data you see with other users that have the Logs permission.

a screenshot of the Logs Browser

 click for top of page

Drill into Logs from Charts

If you have the Logs permission, you can drill into logs from charts, for example, if you notice data anomalies on a chart and want to debug the issue.

To drill into the related logs from a chart:

  1. Position your pointer over the metric for the source of concern, on the location of the anomaly.
  2. Right-click that point on the chart and select Logs (Beta).

A screenshot of a chart with the right-click menu that includes the Logs option. In this example, you right-click the metric chart for source db-5 at 01:25 PM.

The Logs Browser opens in a new tab with the following configuration:

  • The search time window is a 10-minute period, starting 5 minutes before and ending 5 minutes after the time of the point that you right-clicked on the chart.
  • The search query contains the include source tag filter for the source that you right-clicked.

A screenshot of a search query and selected time window in the Logs Browser. In this example, the Logs Browser opens with the filter source = db-5 and the time window 01:20 PM to 01:30 PM (starting 5 minutes before and ending 5 minutes after 01:25 PM).

 click for top of page

Drill into Logs from an Alert

If you have the Logs permission, to investigate a firing alert, you can drill into logs from the Alert Viewer. For optimal logs search results, you can configure related logs for an alert.

When you create or edit an alert, in the Related Logs panel, you can add multiple tag filters. This way, you can prepare the logs search query that you can run when the alert fires.

The Related Logs panel with a drop-down menu for selecting include and exclude tag filters.

To drill into the related logs of a firing alert:

  1. Go to the Alert Viewer for the alert. You have these options:

    • Click the link in the alert notification.
    • In the Alerts Browser, locate the firing alert and click View firing details.

    In the Related Logs panel, the time range filter is populated with the trigger window during which the alert condition was met and the alert transitioned to firing state.

  2. Optionally, in the Related Logs panel, adjust the filters for the logs search query.

    1. Click Edit related Logs, add and remove filters, and save the alert.
    2. Click the eye icons of the related logs filters that you want to hide from the logs search query. To unhide a filter, you must click the eye-hide icon.

    You cannot remove or hide the time range filter.

  3. In the Related Logs panel, click Go to Logs (Beta). The related Logs panel populated with time range filter and other custom filters with eye and eye-hide icons.

The Logs Browser opens in a new tab with the configurations from the Related Logs panel:

  • The search time window corresponds to time range value.
  • The search query contains the unhidden filters (with the eye icons). The search query and the selected time window in the Logs Browser.
 click for top of page

Drill into Logs from Traces

If you have the Logs permission, you can drill into logs from the application status page and the Traces Browser.

Application Status

If you notice that a service on the application map, table view, or grid view of the Application Status page has a high error percentage, you can drill down into the related logs.

  • From the Map View
    1. Select the time window of interest.
    2. Click the service on the application map.
    3. Select View Logs (Beta). A screenshot of a the UI once you click on a service with the view logs link highlighted.
  • From the Table View
    1. Select the time window of interest.
    2. Click the ellipsis for the service.
    3. Select View Logs (Beta). A screenshot of a the UI once you click vertical ellipsis on the table view
  • From the Grid View
    1. Select the time window of interest.
    2. In a service tile, click Actions.
    3. Select View Logs (Beta). A screenshot of a the UI once you click vertical ellipsis on the grid view

The Logs Browser opens in a new tab with the following configurations:

  • The search time window corresponds to the time window on the Application Status page.
  • The search query contains the corresponding include service and application tag filters. The search query and the selected time window in the Logs Browser.

Traces Browser

If you notice a critical path through a trace in the Traces Browser, you can drill down into the related logs.

To see the logs for a trace:

  1. Click the trace that you want to examine.
  2. In the Trace Details section, click the service on which you want to focus.
  3. Expand the IDs section.
  4. Click Search Logs (Beta) with traceId. screenshot of the traces browser with the search logs with traceId highlighted

The Logs Browser opens in a new tab with the following configurations:

  • The search time window corresponds to the trace duration.
  • The search query contains the corresponding include traceId, source, application, and service tag filters. screenshot of the traces browser with the search logs with traceId highlighted


To learn more about exploring traces and about finding hot spots at a glance, see Traces Browser.

 click for top of page

Create a Logs Chart

If you have the Logs and Dashboards permissions, in the Chart Builder you can create logs charts. A logs chart shows the number of logs by certain criteria. For example, see the logs chart in the Logs Browser.

1. From the Data drop-down menu, select Logs (Beta).

The Data drop-down menu.

2. From the Filters drop-down menu, add one or more tag filters.

You can add include and exclude tag filters. See Filter Types and Logical Operators for details.

The Filters drop-down menu.

3. Optionally, next to the Functions drop-down menu, click Count, select one or more tags by which you want to group the number of logs, and click Apply.

The Count drop-down menu.

The resulting chart shows the number of logs matching the selected filters distributed over the selected time window. The logs are grouped by the values of the selected grouping tags. You can zoom in on smaller time windows. Logs histogram chart

Learn More!