Facet search for logs

Facet searches enable you to filter logs based on specific key-value pairs (facets) present in your logs.

Use both facets and labels

Kloudface leverages two data sources to provide comprehensive filtering capabilities: facets and labels.

The distinction between automatically extracted facets and predefined environment labels enables you to filter logs based on both the inherent content of the message and the broader environment where it originates. This two-pronged approach offers a powerful and flexible way to pinpoint the specific logs necessary for troubleshooting and analysis.

Automatically-extracted facets

When Kloudfuse parses the log message content using predefined heuristics, it dynamically generates facets. This approach identifies key-value pairs inherent to the log data itself.

Extracting facets automatically

Consider the following log line:

User=Sherlock logged into an EC2 machine with e2_instance_id=0xABCD at time=10am

Kloudfuse automatically extracts these facets:

User=Sherlock
e2_instance_id=0xABCD
time=10am

Predefined environment labels

Similar to Automatically-extracted facets, you can search labels using the same search heuristics.

The labels are pre-configured key-value pairs associated with each log line, and provide contextual details about the environment where the log originated. This information typically includes data like pod name, Kubernetes namespace, cloud region, or any other relevant metadata attached to the log during ingestion.

Common examples of environment labels include:

• pod_name: Identifies the specific pod that generated the log message, such as pod_name=request_handler.
• cloud_region: Indicates the cloud region where the log originated, such as cloud_region=us-west-2c.
• kube_namespace: Specifies the Kubernetes namespace associated with the log, such as kube_namespace=kloudfuse.

Search facets

There are several approaches to searching facets:

• Start by typing symbol @, and continue typing the search terms.
• Pick the detailed view of a log line, and select the facet name or value.
• From the sidebar, select any of the existing labels.

Supported data types

Each Facet is associated with a data type.

Facet search supports all data types; see Search data types.

Supported operators

Facet search supports all operators; see Search operators.

Supported set combinations

AND

Facet search fully supports the intersection operator.

OR

Facet search supports the union operator only on the same facet, not across two or more facets.

Examples of facet search

Here are some examples of facet search:

• Simple facet search illustrates how to use simple operator search.
• Facet combinations and unions lists all possible union combinations with Facet Search.

Kloudfuse does not support OR-based search of two or more facet searches, such as Facet1-Value OR Facet2-Value.

• Facet Key Existence shows how to determine the existence of specific facets (keys) within the logs.

Kloudfuse does not support union (OR) existence checks, such as key exists="Facet1 OR Facet2".

Simple facet search

Facet combinations and unions