LogScale users can identify when their queries have been blocked through clear warning messages in the Search interface and detailed error notifications that specify the matching blocklist pattern. When queries are blocked, users receive explicit feedback about the restriction, including the specific blocklist entry for reference when discussing with administrators, while also being aware that query blocks may occur during LogScale SaaS upgrades.

Queries are the primary interface to data in LogScale so it is important that you're aware of the limitations set by an administrator.

Within the Search interface, a warning message is shown, as shown in Figure 32, “Query Administration Blocked Query”.

Figure 32. Query Administration Blocked Query

Say for instance that we added the pattern /admin-[0-9]?/ to the global blocklist and then you submit a query for admin-1. We present a very detailed message in place of event data:

Failed to execute the query
There was an error while trying to start the query:
The query has been blocked in LogScale by an administrator.
The matched blocklist entry is: /admin-[0-9]/

This helps you know what has happened and how future queries my be impacted. If you are concerned with this blocklist entry, you may pass along the pattern to an administrator, making it easy to locate in the blocklist.