Search: Log Messages

The Log Search page allows you to create complex queries that can help you refine your log search results to messages most relevant to your investigation. The search field allows you to type a SQL-like query statement using available fields and operators. If needed, you can use subsequent search fields to add OR statements and create a search that tests for multiple conditions. As you type a search statement, a warning icon () appears to the left of the search field until the query contains valid syntax. You cannot submit a search with invalid syntax.

The Log Search page includes the Search Assistant, which displays available options to help you create search statements and projections as you type.

Search by date and time range

The date range drop-down menu allows you to display all log messages received during a selected date range and within a time range for the selected dates. Select from the following to display incidents that occurred within the specified date and time range:

  • last hour (default)
  • last 6 hours
  • last 12 hours
  • last 24 hours
  • last 7 days
  • last 30 days

You can also click within the calendar to create a custom date and time range.

The Alert Logic console displays time in your local time zone.

Refine your search results

The Log Search feature includes the WHERE and PROJECTION fields which allow you to create SQL-like searches and aggregations, respectively, to narrow and organize the list of search results. You can use the Search Assistant to choose search and aggregation criteria and their available operators.

Use the Search Assistant

The Search Assistant, which appears by default, helps you create searches and aggregations by presenting suggestions as you type in the WHERE field. Click a value in the Namespace column, and then select an available operator for the selected namespace. The Search Assistant provides quotation marks where you must type a needed search term, or select from a list of suggested search terms. You can click additional namespaces to create AND statements, and you can use OR statements to search for multiple criteria.

The Search Assistant lists all saved searches created by users in your customer account. Select a search in the Saved Searches column, and then click ADD TO SEARCH to populate the search fields. For more information about saved and scheduled searches, see Save and schedule searches.

Add search terms from a log message

If you want perform a log search based on a specific log message in a list of search results, Alert Logic allows you to click within the log message preview to add criteria to the WHERE field and create a more detailed search.

To add search terms from a log message:

  1. In the list of search results, click a log message from which you want to create a search.
  2. Click log message object items in the message, or listed across the bottom of the message, that you want included as a search term.
Valid search term entries highlight when you hover your cursor over them.

You can add multiple search terms, and the log search automatically inserts the required AND between them.

Aggregate search results with projections

The Log Search PROJECTIONS field allows you to aggregate your search results. You can specify the columns of data to display in the list of search results, and specify how Log Search groups and orders search results.

By default, Alert Logic displays search results in descending order by time received, and displays the full content of the log message. (SELECT [Time Received], [Message] ORDER BY [Time Received] DESC). The SELECT projection allows you to specify the fields you want to display in the search results. You can add projections to customize the organization of search results.

The following projection returns a list that shows the user name, the number of log messages that include the user name, and also orders the list by the number of messages, and groups the results by host name:
SELECT [User Name], COUNT (Message) AS "MessageCount" ORDER BY "MessageCount" DESC GROUP BY [Host Name]

For more information about search projections, see Search Assistant Projections.

Search parsed JSON logs

The Log Search feature allows you to convert log messages to parsed JSON and display the parsed JSON message in the results list. You can then use a JSONPath query in the WHERE field to filter results by specified JSON objects.

List all log messages and include parsed JSON in search results

The default log search projection lists log messages and the time received, listed in descending order by time received. If you also want to display parsed JSON in the list of search results, type the following in the PROJECTION field:

SELECT [Time Received], [parsed.json], [Message] ORDER BY [Time Received] DESC

Filter log messages by a JSON object

To filter log messages by a specified JSON object, you can use information from the default search results to create a JSONPath query in the Log Search WHERE field to display only specified log messages.

To filter the aggregated list from the previous section by a specified user type, type the following in the WHERE field:

[parsed.json.userIdentity.type] = "AssumedRole"

Log Search allows you to use AND and OR statements, as seen in the example below, to include multiple JSON objects in the query and further narrow the list of search results.

[parsed.json.userIdentity.type] = "AssumedRole" AND [AWS Source] = "ssm.amazonaws.com"

Filter search results by JSON object and by log message token

If you want to filter search results by JSON object(s) and log message tokens that are not included in the parsed JSON, Log Search allows you to mix syntax in your search statement.

You can type a JSONPath query and follow the query with a log message token. If your initial search was for a specified user identity type, and you want to further filter the search results by a specified Windows event source, type the following in the WHERE field:

[parsed.json.userIdentity.type] = "AssumedRole" AND [Windows Event Src] = "Microsoft-Windows-WMI-Activity"

When you create a search by JSON object and log message token, Log Search retains the ability to click within an expanded log message to add log message objects to the query.

Save and schedule searches

You can save and schedule any search for frequent use. To ensure every saved search runs correctly, the Alert Logic console does not allow you to save a search until you enter at least one valid search statement in the search bar. The Search Assistant lists all saved searches created by users in your customer account. Scheduled searches appear with a calendar icon on the Saved Searches list.

If the Search Assistant does not display saved and scheduled searches, press ESC.

To save a search:

  1. Enter a valid search query, and then click SAVE.
  2. In the Save Search slideout panel, provide a name for the search.
  3. Click SAVE.

To save and schedule a search:

  1. Enter a valid search query, and then click SAVE.
  2. In the Save Search slideout panel, provide a name for the search.
  3. Click +ADD SCHEDULE, and then select values for the following:
    • Schedule search to run — Allows you to select the frequency for the search. The options are:
      • Once
      • Daily
      • Weekly
      • Monthly
    • Search time range — Allows you to specify a time range for which you want data
    • At time — Allows you to specify the time you want the search to run
  4. Click SAVE SCHEDULE.
If you want the saved search to follow more than one schedule, click +ADD SCHEDULE to add an additional schedule for the search. You can add multiple schedules for each saved search.
  1. Click SAVE.

To perform a saved search:

  1. In the Search Assistant, select a search from the Saved Searches column.
  2. Click + ADD TO SEARCH to populate the search fields.
  3. On the log search menu bar, click SEARCH.

Edit a saved search

Select a saved search to edit the search name and the search schedule.

View and export scheduled search results

The Search Assistant lists recently executed scheduled searches and provides the day and time the search was last run. If you click a recently executed scheduled search, you can perform the following tasks:

  • View the results of the search
  • Export the results of the search to a CSV file

Analyze log messages

After you perform a log message search, you can view the details of log messages that appear in the search results. Click a message to view a summary of the log message, view the log source properties, bookmark the message, create another log search, or export the log message summary to a CSV file.

Click Open to view the details of the selected log message in a separate browser tab.

Open a log message

The details page for a selected log message displays additional information about the log message, log source properties and message fields. You can use this information to further refine your log search, export the information about this log message to a CSV file, or create an incident.

Export log messages

Multiple views within log search allow you to export either a list of search results, or details of a specific search to a .CSV file.

  • If you select one or more search results in the list, you can click the export icon () in the blue bar on the lower right of your screen to export selected log search results to a .CSV file. The column headers and information in the .CSV file match the columns displayed in the results list on the Log Search page.
  • If you select the Select All check box, and then click the export icon (), the Alert Logic console prompts you to create a saved, scheduled search.
  • If you open a log message to view details in a separate browser tab, you can you can click the export icon () to export selected log search details to a .CSV file.

Create an incident

The Log Search page allows you to create a manual incident from log messages from either the list of search results, or from an open log message.

To create an incident from the search results:

  1. If you select one or more search results in the list, you can click the create incident icon ( ) in the blue bar on the lower right of your screen to manually create an incident from the selected log messages.
  2. In the Create Incident slideout panel, provide the requested information.
  3. Click CREATE.

To create an incident from an open log message:

  1. From the list of search results, select a log message.
  2. Click Open to open the log message in a separate tab.
  3. In the upper right of the open log message, click the create incident icon ( ).
  4. In the Create Incident slideout panel, provide the requested information.
  5. Click CREATE.

Bookmark log messages

The bookmark feature allows you to specify one or more log messages you want to investigate, and then display only those log messages in the list of search results.

Bookmarks appear only for the current session.

To bookmark a single log message entry:

  1. Click Open
  2. Click the bookmark icon ().

To bookmark multiple log message entries:

  1. Select the check box to the left of each log message you want to bookmark.
  2. In the blue bar on the lower right of your screen, click the bookmark icon ().

After you bookmark log messages, you can click the bookmark icon () above the search results to display only bookmarked log messages in the results list.