Indications of a Blocked Query
Queries are the primary interface to data in LogScale and so it is important that you are not confused when a query you submit happens to be blocked.
Within the Search
interface, a warning
message is shown, as shown in
Figure 18, “Query Administration Blocked Query”.
Figure 18. Query Administration Blocked Query
Say for instance that we added the pattern
/admin-[0-9]?/
to the global blocklist and then you
submit a query for admin-1. We present a very
detailed message in place of event data:
Failed to execute the query
There was an error while trying to start the query:
The query has been blocked in LogScale by an administrator.
The matched blocklist entry is: /admin-[0-9]/
This helps you know what has happened and how future queries my be impacted. If you are concerned with this blocklist entry, you may pass along the pattern to an administrator, making it easy to locate in the blocklist.