Contact Us 1-800-596-4880
  1. Homepage
  2. Monitoring

  3. Using Logs

Using Logs in Anypoint Monitoring

In addition to logging through Runtime Manager, Anypoint Monitoring aggregates log files so you can manage, search for, filter, and analyze your logs. You can use aggregated logs in conjunction with monitoring to help identify issues and investigate failures quickly. These features support:

  • Comparative analysis and identification of event and information patterns based on searches across selected Mule apps and environments.

  • Searches within the logs of a specific worker (or set of workers) for a Mule app so that you can narrow scope of issues to check.

  • Sharing a snapshot of important logs with developers who can work on the source of the issue.

This feature is available only if your organization has the Anypoint Integration Advanced package or a Titanium subscription to Anypoint Platform. For more information, see the Pricing and Packaging documentation.

For on-premises servers with customized logging:

Logs produced by apps with customized logging (by changing the pattern layout in the log4j2.xml file) might not get indexed correctly into Anypoint Monitoring. To ensure correct indexing, use the Mule default pattern layout, which is one of the following:

  • <PatternLayout pattern="%-5p %d [%t] [event: %X{correlationId}] %c: %m%n" />, or

  • <PatternLayout pattern="%d [%t] %-5p %c - %m%n" />

For applications deployed to CloudHub and Anypoint Runtime Fabric with customized time zones:

Do not override the default JVM timezone for applications deployed to CloudHub and Anypoint Runtime Fabric with customized time zones. The timezone must be UTC. Changing the timezone to a local timezone causes logs to be indexed in Anypoint Monitoring with incorrect timestamps.

Search Logs

In Anypoint Monitoring, click Log Search in the menu on the left. On the log search page, you can search for text in logs in a few different ways. You can type your search query into the search field, you can use the UI to add a filter, and you can create a query.

When you search for logs for APIs deployed through Flex Gateway, use the Application filter. Use the App ID field to identify the instance.

Log Search Query

To search the logs, type your search query into the log search field and press Enter.

Provide the exact term you’re looking for, such as "code 400" to find bad requests. For exact matches of more than one word, surround the search term with quotation marks.

Example results from a "code 400" search:

Log Search

Use the asterisk wildcard in a search if you don’t know the exact term.

Example results from the wildcard search payload=org.glassfish.grizzly*:

Log Search Using a Wildcard

Add a Filter

You can create a filter to search logs using predefined fields, operators, and values.

  1. Click +Add a filter.

  2. Select the predefined field from the drop-down list.

    • application

    • class

    • environment

    • environment type

    • log level

    • logger

    • message

    • thread

    • timestamp

    • worker

  3. Select the operator from the drop-down list.
    The available operators change according to the field you select.
    When you select the operator, if a value is required, a Value box appears on the right.

  4. If applicable, enter a value.
    The following image shows an example of using a search filter to search for all logs that have a timestamp that falls between the given dates.

    Using a Filter Query

    See Search Filters and Operators.

  5. (Optional) Enter a value in Label.

  6. Click Save.
    The filter appears to the right of +Add a filter.

NOTE: When you use the Application filter, the results include APIs deployed through Flex Gateway.

Search Query

To convert a search query into a Query DSL:

  1. Click +Add a filter.

  2. Click Edit Query DSL.

  3. Enter your query, and click Save.
    This example shows a query for log-level INFO:

    {
  "query": {
    "match": {
      "log-level": {
        "query": "INFO",
        "type": "phrase"
      }
    }
  }
}

    The search query UI provides a link to the query documentation so that you can perform more complex queries than otherwise available.

    This example shows a complex query.

{
  "query": {
    "range": {
      "workerId": {
        "gte": 0,
        "lte": 20
      }
    }
  }
}
Some complex search queries do not have an equivalent in the search filter values UI, so you can only create and view such queries in the query UI.

View Log Data

By default, the log entries in your log search results are abbreviated. You can expand and view the log message and details as a table or in JSON format.

To Expand a Log Message

Tabular Logs

This example shows an expanded log entry as a table. The table contains log filter fields that you see in the Quick Filter list.

application	      test40x.us-e1.qax.cloudhub.io
class	            qtp437897409-31
environment	      Sandbox
environment type	%{[fields][env_type]}
log level	        ERROR
logger            DefaultMessagingExceptionStrategy
message
                  ****************************************************
                  Message               : No record could be found in payload or in flow variable BATCH_RECORD (java.lang.IllegalStateException).
                  Element               : null
                  ----------------------------------------------------
                  Exception stack is:
                  No record could be found in payload or in flow variable BATCH_RECORD (java.lang.IllegalStateException). (org.mule.api.transformer....
                  (72 more...)

                  (set debug level logging or '-Dmule.verbose.exceptions=true' for everything)
                  ****************************************************
timestamp         April 25th 2018, 17:09:53.517
worker            0

JSON-Formatted Logs

This example shows an expanded log entry in JSON format.

{
  "_version": 1,
  "_source": {
    "class": "qtp437897409-31",
    "logger": "DefaultMessagingExceptionStrategy",
    "_ending": 0,
    "timestamp": "2018-04-26T00:09:53.517Z",
    "message": ".Example***
    .ExampleMessage: No record could be found in payload or in flow variable
    BATCH_RECORD (java.lang.IllegalStateException)..ExampleElement...",
    "log level": "ERROR",
    "worker": "0",
    "environment": "Sandbox",
    "environment type": "sandbox",
    "application": "test40x.us-e1.qax.cloudhub.io"
  },
  "fields": {
    "timestamp": [
      "2018-04-26T00:09:53.517Z"
    ]
  },
  "highlight": {
    "orgId": [
      "@kibana-highlighted-field@6046b96d@/..."
    ]
  },
  "sort": [
    1524701393517
  ]
}

View Full Logs on a Dedicated Page

After finding a log on a particular issue, you can view the complete log on a dedicated page (without the quick filters, search field, and filter tags). You can view the log detail in tabular or JSON format.

  1. From the selected log, click View This Log.

    View This Log

  2. View the extended log in tabular or JSON format.

    Viewing Extended Logs

View Surrounding Logs

After finding a log for a particular issue, you might want to know what other log reports preceded or followed it.

  1. From the selected log, click View Surrounding Logs.

    View Surrounding Logs tab

  2. Load the number of logs that you want to see before and after the selected log, or use the default.

    View Surrounding Logs

The default settings are:

  • Load 5 more newer logs

  • Load 5 more older logs

Working with Predefined Filters

When the Quick Filters list is open, you can select and use predefined log filters.

For every result group, the Quick Filters list displays the first five results of the most recent 500 log entries. When there are more than 500 entries or the top five values do not represent 100% of total values, a See More link for each result group appears. You can click See More to open the Add a Filter box and set parameters to further filter your results.

This example of a predefined filter selects the ERROR log level.

Predefined Log Filter

After you select a predefined filter from the Quick Filter list, you see it near the top of the page, next to Add a Filter.

Filter Actions

When you hover over a filter, you can select from the following actions:

  • Enable/Disable - Enables or disables the filter. When the filter is disabled, it is grayed out.

  • Pin/Unpin - Pin or unpin the filter.

  • Invert - Change the operation of the search filter. For example, if the search is log level IS ERROR, the inversion is log level IS NOT ERROR.

  • Remove - Delete the filter.

  • Edit - Change the filter configuration.

Adding Filter Columns to Logs

From the Quick Filters list, you can add and remove columns to or from log results. For example, you might add the Log Level, Timestamp, or Environment field.

Click the column icon for a filter field, for example:

To Add a Filter Column to the Logs

The resulting log-level column looks like this in the logs:

Filter Column in the Logs

To remove the filter column, click the column icon for the filter field, for example:

To Remove a Filter Column from the Logs

You can also remove it with the X icon that appears when you scroll over the column.

Moving Filter Columns

To move filter columns in your log results to the left or right, you simply scroll over the column heading and use the arrow icons.

To Remove a Filter Column from the Logs

Search Filters

Use predefined filters or filters that you create.

Filter Description Examples

application

Full domain of the Mule app in CloudHub.

am-flights.us-e2.stgx.cloudhub.io

class

Java class that generates the log.

[am-flights].am-flights-api-httpListenerConfig.worker.34

environment

CloudHub environment name.

myEnv

environment type

CloudHub environment type

Sandbox, Design, Production

log level

ALL, DEBUG, ERROR, FATAL, INFO, OFF, TRACE, WARN

INFO

logger

Log4J Logger class

HttpListenerRegistry

message

Log4J message

No listener found for request: (POST)/zaraza

timestamp

Timestamp on the log. Accepted formats: MMM dd yyyy, HH:mm:ss.SSS

Supported time settings are s for seconds, m for minutes, h for hours, d for days, w for weeks, M for months, y for years, with now for relative times, for example:

  • Last 5 minutes: now-5m

  • The day so far: now/d

  • This week: now/w

  • Week to date: now/w

  • Previous Month: now-1M/M

worker

CloudHub worker ID.

0, 1

Operators

You can use these operators when creating a search filter. For example log-level IS

is

Available to all filters.

is not

Available to all filters.

is between

Available to timestamp.

is not between

Available to timestamp.

exists

Available to all filters.

does not exist

Available to all filters.

Filtering Based on the Entire Log Field Value

You can use the funnel-shaped icons on any log in your results to create and remove a filter for the entire log field value.

Creating a Log Message Filter

The filter you create is visible as a filter tag in the Filters area at the top of the page, for example:

Log Message Filter Tag

You can edit and use that filter like any other filter. See Search Filters.

Sharing Logs

You can share the URL to your logs.

  1. From Logs, click the three vertical dots on the top-right of the screen.

    Sharing Logs

  2. Select Share to load the URL of your log page to a Share Logs Search Link field.

    Sharing Logs Link

  3. Click Copy.

Save and View Saved Log Searches

Save and view log searches.

  1. Click Save Search.

  2. Select View saved searches.

  3. Click View Saved Searches again to return to the main Logs page.

Save Log Search Menu
View Saved Log Search

You can clear the current search from the same menu shown in Save and View Saved Log Searches:

  1. Click Save Search.

  2. Select Clear Current Search.

See also

Search Query Syntax