Essential pages for LogScale analysts. Navigate the interface, search and investigate data, build dashboards, configure automated alerts, and understand event fields.
Essential starting point that guides you through navigating the Search UI interface. Learn the layout, components, and features that power LogScale's search capabilities.
Complete workflow for searching data in LogScale. Step-by-step sequence from basic search through results refinement to data export. Core skill for every analyst.
The Query Editor enables performing searches with advanced syntax features: query auto-completion, code folding, bracket matching, syntax highlighting, and more.
Learn to select fields for display, hide unnecessary fields, and manage field visibility during investigations. Essential for focusing on relevant data.
Drill into individual events to examine all fields and values. Critical for incident investigation and forensic analysis. Learn to expand events and explore their complete structure.
Advanced search techniques: use contextual menus to filter/aggregate on field values, expand time windows, and interactively refine searches. Accelerates investigation workflows.
Export query results in various formats (CSV, JSON, plain text). Essential for evidence collection, reporting, and sharing investigation findings with stakeholders.
Save searches and preserve query results for compliance, auditing, or reporting. Enable collaboration by sharing saved searches with team members.
Core organizational structure: how repositories store logs and metrics, how views provide filtered or combined perspectives. Configure retention policies, access control, and ingest tokens. Critical for understanding where data is stored and how to access it.
Upload and manage lookup files to enrich log data with additional context. Map IP addresses to locations, user IDs to names, asset IDs to details. Essential for contextual investigations.
Complete guide to dashboard capabilities and creation. Learn what you can do with dashboards, how to create custom dashboards, organize widgets, configure refresh intervals, and share dashboards with team members.
Explore all available widget types: time charts, pie charts, tables, world maps, gauges, and more. Learn to select appropriate visualizations, configure them for real-time monitoring, and customize display options.
Create a widget by saving a search query and adding it to a dashboard for ongoing monitoring. Step-by-step guide covering widget creation from search, visualization type selection, and layout placement.
Use parameter panels and variable-driven filtering to make dashboards interactive. Drill into data without leaving the dashboard view, and let users refine what they see without editing queries.
Manage time ranges across dashboard widgets. Understand how dashboard time settings differ from per-widget time ranges, and configure live refresh for real-time monitoring views.
Covers three trigger types: Scheduled Searches (periodic queries), Aggregate Alerts (continuous monitoring with aggregation), and Filter Alerts (instant notification). Learn when to use each type and how to configure throttling to prevent alert fatigue.
Connect alert triggers to automated response actions. Supported action types include email, Slack, PagerDuty, OpsGenie, VictorOps, webhooks, S3 export, and message templates for custom notification formatting.
Schedule dashboards to be exported as PDF reports and delivered automatically by email. Use for recurring operational summaries, compliance reporting, and executive briefings.
Deep dive into LogScale's field system: metadata fields (@timestamp, @rawstring, @id), tag fields (#datasource) controlling physical storage, and user-defined fields extracted during parsing. Understand field types, naming conventions, and how fields affect query performance. Fundamental to writing effective queries and understanding data structure.
Comprehensive guide to LogScale's special metadata fields: @timestamp (event time), @rawstring (original log line), @id (unique event identifier), @timezone (event timezone), and more. Learn how to use these built-in fields in queries and understand their role in event processing and storage.
Pre-aggregate query results on a schedule to power dashboards and reports over large data volumes without re-running expensive queries. Understand when to use persisted aggregations and how they differ from live searches.
Create, configure, edit, and monitor persisted aggregations. Set scheduling intervals, review aggregation results, and manage the lifecycle of aggregations across repositories.
Interactive paths that guide you through searching data in LogScale. Choose from five structured paths: Search Data basics, Change Results Display, Refine Search Results, Search Deeper, and Save and Export.
Interactive paths for building dashboards and widgets. Choose from four paths: New to Data Visualization, Create Dashboards and Widgets, Widgets by Data Format, and Widgets by Use Case.
Interactive paths for setting up alerts and actions. Choose from paths covering automation fundamentals, creating triggers, configuring actions, scheduling reports, and persisted aggregations.
