Skip to main content

Log Level Detection and Insights (Beta)

Beta

info

This beta isn't accepting any new testers right now.

When performing Log Search queries in the UI, you can visualize and filter log-level distribution in your Histogram results and Messages table view, helping you to:

  • Quickly identify anomalies
  • Drill down quickly into high severity logs
  • Navigate through a large volume of logs
  • Filter the relevant logs in their troubleshooting workflows
What are log levels?

Sumo Logic detects six log levels out of the box: FATAL, ERROR, WARN, INFO, DEBUG, and TRACE. If we're unable to find one of these log levels in a message, it is categorized under the OTHERS bucket.

Log-Level pattern detection is automatic, meaning you do not need to parse log levels manually or write specific queries to see your distribution of error logs. Just execute a log search, and you'll see:

log-level-legend
ElementDescription
AHistogram with stacked bars representing log level distribution over your search timeframe.
BInteractive Histogram legend showing the log level that each color represents. Click on any label to isolate it in the Histogram and corresponding messages beneath that. To select multiple log levels, use shift + click.
In this example, the ERROR label has been clicked, so you'll see only error logs reflected.
log-level-error-filter.png
CField Browser _loglevel filter. You can use this reserved field in your queries to perform advanced operations. 1
DLog level for this log message. Quickly identify the log level of each log message using the color-coded Histogram legend for each message.
EDistribution of log levels under _loglevel field in the field browser.
FHide Log Levels. Click this to hide log levels from the Histogram chart, however, the _loglevel field will still show in the Messages table, however, log level color coding from individual messages will be removed. To enable it again, just click Show Log Levels.
1 The _loglevel field value for log messages with the log level "" in the Histogram is null. To query these messages, you can run:
| where isNull(_loglevel)

The log level of a log line is stored under the _loglevel field. You can override its value using a field extraction rule (FER). For example:

Add field extraction rule
Legal
Privacy Statement
Terms of Use

Copyright © 2023 by Sumo Logic, Inc.