Oracle Cloud Infrastructure Documentation

Log Explorer URL Parameters

Log Explorer supports several URL parameters that allow context to be passed to the application. In Log Explorer, click Actions and select Copy query URL to get a link that reloads the page exactly as it is currently displayed.

Visualization and Query Parameters

Visualization and query parameters allow integrators to communicate to the Log Explorer what default visualization and query filters must be used when the page loads.

Parameter Description Supported Values Example
viz Sets the visualization
  • pie
  • bar - vertical bar
  • hbar - horizontal bar
  • line
  • sunburst
  • treemap
  • cloud
  • map
  • records
  • table
  • records_histogram
  • table_histogram
  • distinct
  • cluster
  • link
  • tile

  • summary_table

Url: loganalytics/explorer?viz=records_histogram

Result: Logging Analytics loads with the Records with Histogram chart and the default query which is appropriate for this visualization.

search Updates the search clause of the query -

  • Test for a group of words:

    Url: loganalytics/explorer?search='Failed to start'

    Resulting Query: 'Failed to start' | stats count as logrecords by 'Log Source' | sort -logrecords

  • Test for each word:

    Url: loganalytics/explorer?search=Failed start

    Resulting Query: Failed and start | stats count as logrecords by 'Log Source' | sort -logrecords

  • Test for one word or another:

    Url: loganalytics/explorer?search=Failed or start

    Resulting Query: Failed or start | stats count as logrecords by 'Log Source' | sort -logrecords
filters Updates the query with the field/value checks specified. Filters are specified with field name, value and an optional comparator. By default, the EQUALS comparator is used.

The delimiters for filters are __:__ __,__ __;__

Supported Comparators:

  • EQUALS (default value)
  • NOT_EQUALS
  • STARTS_WITH
  • DOES_NOT_START_WITH
  • ENDS_WITH
  • DOES_NOT_END_WITH
  • CONTAINS
  • DOES_NOT_CONTAIN
  • IS_LESS_THAN
  • IS_LESS_THAN_OR_EQUAL_TO
  • IS_GREATER_THAN
  • IS_GREATER_THAN_OR_EQUAL_TO
  • IS_BETWEEN
  • IS_NOT_BETWEEN

  • Just a field will test if the field is set to null:

    Url: loganalytics/explorer?filters=ospid

    Alternate Urls:

    loganalytics/explorer?filters=OS Process ID

    loganalytics/explorer?filters='OS Process ID'

    Resulting Query: 'OS Process ID' = null | stats count as logrecords by 'Log Source' | sort -logrecords

  • A field and value will test if the field is equal to the value:

    Url: loganalytics/explorer?filters=ospid__:__889

    Resulting Query: 'OS Process ID' = 889 | stats count as logrecords by 'Log Source' | sort -logrecords

  • A field, value and comparator will test for field comparator value:

    Url: loganalytics/explorer?filters=ospid__:__889__:__NOT_EQUALS

    Resulting Query: 'OS Process ID' != 889 | stats count as logrecords by 'Log Source' | sort -logrecords

  • Multiple filters (for complex comparisons):

    Url: loganalytics/explorer?filters=ospid__:__889__:__NOT_EQUALS__;__ospid__:__3000__:__IS_LESS_THAN

    Resulting Query: 'OS Process ID' != 889 and 'OS Process ID' < 3000 | stats count as logrecords by 'Log Source' | sort -logrecords

  • Multiple Values:

    Url (High and Med problems for the last 14 days): loganalytics/explorer?filters=Problem Priority__:__High__,__Medium__:__equals&timeNum=14&timeUnit=days

    Resulting Query: 'Problem Priority' in (High, Medium) | stats count as logrecords by 'Log Source' | sort -logrecords

    Resulting GC Settings: Because the time parameters are also set in this case, the Time is set to the Last 14 Days.

  • Error Cases:

    If the field/value combinations do not match, an error is displayed. For example filters=ospid:abc would yield an error, because ospid is a Long and abc is a String.

encodedQuery

Decodes the base64 encoded query from the URL and updates the query in the Log Explorer.

In javascript, you can build the encodedQuery using window.btoa(query). Decode using window.atob(encodedQuery).

This prevents the firewall from flagging certain characters in the query. For example, this query will get flagged by the firewall using the unencoded query parameters: 'Previous State' != 'Current State' | eval z = substr(a, 0, 1).

-

URL With encoded query:

Url: loganalytics/explorer?viz=pie&viz=pie&encodedQuery=KiB8IHN0YXRzIGNvdW50IGFzIGxvZ3JlY29yZHMgYnkgJ0xvZyBTb3VyY2Un

Example: loganalytics/explorer?viz=summary_table&filters=Problem Priority__:__High__,__Medium__:__equals&timeNum=14&timeUnit=days&encodedQuery=KiB8IHN0YXRzIGNvdW50IGFzIGxvZ3MgYnkgJ0xvZyBTb3VyY2Un

Decoded query is * | stats count as logs by 'Log Source'

Then the Problem Priority parameter is added to the search resulting in: 'Problem Priority' in (High, Medium) | stats count as logs by 'Log Source'

Global Context Parameters

When Logging Analytics runs a query, only a subset of log records are considered. The set of log records is determined by taking into account the global context. This includes settings such as compartment and time.

Parameter Description Supported Values Example
startTime The start time, UTC in Milliseconds, is used in conjunction with endTime. If both are provided on the URL, a custom time frame is set in the console. Date in UTC Milliseconds

For example, if you run the following in the console, you will get two numbers - start time and end time. You can plug them into the URL and see data for the last 30 minutes:

var now = new Date();

var startTime = now.getTime() - (1000*60) *30;

var endTime = now.getTime();

Sample URL with Start and End Time: /loganalytics/explorer?startTime=1603735757388&endTime=1603737557388

The result is custom time in Log Explorer with these values set as the start and end time.

Time is also supported in the following format:

/loganalytics/explorer?startTime=Mon Oct 26 2019 16:38:12 GMT-0400&endTime=Mon Oct 26 2020 16:38:12 GMT-0400
endTime The end time, UTC in Milliseconds, is used in conjunction with startTime. If both are provided on the URL, a custom time frame is set in the console. Date in UTC Milliseconds See startTime.
timeNum Log Explorer supports relative times, like Last 7 days. To specify a relative time set timeNum to a number and timeUnit to the required time frame. A number greater than 0 /loganalytics/explorer?timeNum=42&timeUnit=minutesor/loganalytics/explorer?timeNum=1&timeUnit=day
timeUnit Log Explorer supports relative times, like Last 7 days. To specify a relative time, set timeNum to a number and timeUnit to the required time frame.
  • SECONDS
  • MINUTES
  • HOURS
  • DAYS
  • WEEKS
  • MONTHS
  • YEARS
 See timeNum.
scopeFilters This parameter allows scope filters like log group compartment, entity, and log set to be passed.

scopeFilters=lg:<logGroupFilter>;en:<entityFilter>;lgste:<logSetFilter>;rg:<regionFilter>;lfe:<logFieldFilter>;mc:<metricCompartmentFilter>;rs:<resourceCompartmentFilter>

where:

  • logGroupFilter = <logCompartmentOcid>,<includeSubComponents(true/false)>

  • entityFilter = <entityCompartmentOcid>,<includeDependents(true/false)>,<entityOcid>,<entityOcid>,...

  • logSetFilter (encoded)= <logSetNameEncoded>,<logSetNameEncoded>....

  • regionFilter = <region> (For example, us-phoenix-1)

  • logFieldFilter (encoded) = <fieldName>:<fieldValueEncoded>

  • resourceCompartmentFilter = <resourceCompartmentOcid>,<includeSubComponents(true/false)>

  • metricCompartmentFilter = <metricCompartmentOcid>,<includeSubComponents(true/false)>

 /loganalytics/explorer?&scopeFilters=lg:root,true;en:root,true,ocid1...;rs:root,true;lfe:Severity,ZXJyb3I=;rg:us-phoenix-1