- Log Stream Overview
- Parser Manager
- Parsers Overview
- View Parser Details
- Create a Custom Parser
- Import Sample Logs
- Define a Subset of the Sample Logs
- Add Conditions
- Add Basic Parser Information
- Extract Event Fields
- Extract Mapped JSON Fields
- Select JSON Fields from a List of Key/Value Pairs
- Select Tokenized JSON Fields from the Values in the Sample Log
- Manually Enter JSON Path Expressions
- Reorder Mapped JSON Fields
- Review the Matching JSON Fields and Values
- Add Logic to JSON Field Extraction
- Expressions for Extraction Conditions
- Array Log Sample
- Extract Fields Using Regular Expressions
- Extract Mapped JSON Fields
- Add Event Builder Rules
- Review and Save Parser
- Manage Existing Custom Parsers
- Tokenize Non-Standard Log Files
- Customize a Default Parser
- Duplicate a Parser
- Enable or Disable Parsers
- Live Tail
- Enrichments
- Event Filtering
View and Filter Data
Live Tail provides the capability to filter your view of log data being ingested and processed. Depending on what you want to focus on, you can filter on specific types of logs (parsed and unparsed) or filter by a specific parser or collector source. You can also enter search text to look for something specific.
 |
To filter the Live Stream data, use the following options from the tool bar at the top of the page:
What type of logs do you want to tail? – Use this first drop-down menu to select one or more types of logs you want to view. Options include the following:
Events — Parsed log lines that created an event.
Parsed — Parsed log lines that did not create an event.
Error — A log line that had errors during parsing.
Note
There might have been partial parsing, which could still be useful.
Unparsed — Raw log lines that were not parsed.
Filter by – Use this drop down menu and the next field to filter the logs. Options include the following: Parser Name or by Collector Name.
Parser Name – Enter a parser name in the next field to search for logs parsed by that specific parser.
Collector Name – Enter a collector name in the next field to search for logs parsed from a specific source collector.
Parser or Collector Name field – Depending on your selection in the Filter by menu, enter a parser name or a collector name you want to filter logs on.
Search field – Use the search field to enter text or a regular expression to filter the logs.
Note
Live Tail supports JavaScript Regex.