General FAQs

• If you are collecting application logs from file, ensure you emit the trace_id and span_id to those logs.
• Once you have trace_id and span_id in your logs, parse them using the pipelines trace parser. See documentation here.

The best way to do this is using Logs Pipeline. Refer to:

• Logs Pipeline Introduction
• Parse JSON logs with Pipelines

If you have a application/service which is emitting similar kind of logs but there are multiple instances of it running on different hosts you can identify them by adding a resource attribute.

There are different ways to add a resource attribute.

1. By passing it as an environment variable if you are using the opentelemetry SDK or auto-instrumentation

   OTEL_RESOURCE_ATTRIBUTES=service.name=<service_name>,host.name=<host_name>
   

   Replace the value of <service_name> with the actual service name and <host_name> with the actual hostname
2. If you have a otel collector running on each host you can add a processor to add the hostname.

   processors:
       resource/add_hostname:
           attributes:
               - key: host.name
                 value: <host_name>
                 action: upsert
   ...
   service:
       logs:
           processors: [resource/add_hostname, batch]
   

   replace the value of <host_name> with the actual hostname

• Add a console exporter at the application level (if using SDK) or at the local collector level.
• If the issue persists, reach out to us via chatbox at the bottom right corner of your SigNoz Cloud interface.

1. Navigate to the Logs tab in the side navigation bar to open the Logs Explorer.
2. In the query input area, click inside the text box that says "Enter your filter query".
3. Type your query using the autocomplete suggestions (e.g., severity_text = 'ERROR').
4. Alternatively, use the Filters for sidebar on the left to select quick filters like Severity Text or Service Name.
5. Click the blue Run Query button (or press Cmd+Enter / Ctrl+Enter) at the top right to refresh the results.

1. Ensure your layout view is set to List View or Table.
2. Click the Settings icon (slider icon) located at the top right of the logs area.
3. In the popover that appears, locate the COLUMNS section.
4. To remove a column, click the 'x' next to the field name.
5. To add a new column, click the '+' button next to the COLUMNS label.
6. Search for a field in the search box and click on the desired attribute to add it as a column in your view.

1. Use Resource Attributes in Filters

Moving commonly used attributes from regular attributes to resource attributes can drastically improve search performance. For example, if you're filtering by app, move it from attributes.app to resource.app using the move operator in log pipelines.

2. Enable Data Flattening and Indexing

For nested attributes like body.step.<any attribute>, you'll need to:

• Enable data flattening first
• Request indexing of commonly used attributes by reaching out to SigNoz Cloud Support
• This allows nested fields to exist as their own attributes outside of the body, making queries more performant

3. Reduce Query Time Range

Limiting the time range of your query can significantly improve performance by reducing the amount of data that needs to be searched.

Implementation Steps

To optimize your log queries:

1. Identify commonly used filter attributes in your queries
2. Use log pipelines to move these attributes to resource attributes using the move operator (only when the attribute should be a resource attribute)
3. If you need to query nested attributes, enable flattening and request indexing for those specific fields
4. Adjust your query time ranges to be as narrow as possible while still capturing the data you need

These optimizations work together to reduce query execution time from minutes to seconds, making your log analysis much more efficient.

1. Click on any log line in the result list.
2. A Log details drawer will open on the right side of the screen.
3. Use the Overview tab to see a readable list of all Attributes.
4. Switch to the JSON tab to see the raw log structure.
5. Click the Context tab to view logs that occurred immediately before and after the selected log line, which is highly useful for debugging sequential events.

1. Once you have configured your query, filters, and columns, find the Views section or Save View functionality.
2. Provide a descriptive name to save your configuration.
3. You can access saved views from the Views tab or from the Explorer sidebar to quickly switch between different commonly used configurations.

1. In the Logs Explorer, click on any log line that has a trace_id to open the Log details drawer on the right side of the screen.
2. In the Overview tab of the log details drawer, locate the trace_id field under the Attributes section.
3. Click the link icon (which looks like a small chain link) immediately to the right of the trace_id label.
4. Clicking this icon will navigate you directly to the corresponding Trace Details page.