Using Logs in Anypoint Monitoring | MuleSoft Documentation
# Using Logs in Anypoint Monitoring
Availability: Usage-based and Titanium tiers only  
---  
In addition to logging through Runtime Manager, Anypoint Monitoring aggregates log files so you can manage, search for, filter, and analyze your logs. You can use aggregated logs in conjunction with monitoring to help identify issues and investigate failures quickly. These features support:
  * Comparative analysis and identification of event and information patterns based on searches across selected Mule apps and environments.
  * Searches within the logs of a specific worker (or set of workers) for a Mule app so that you can narrow scope of issues to check.
  * Sharing a snapshot of important logs with developers who can work on the source of the issue.


**For on-premises servers with customized logging:** Logs produced by apps with customized logging (by changing the pattern layout in the `log4j2.xml` file) might not get indexed correctly into Anypoint Monitoring. To ensure correct indexing, use the Mule default pattern layout, which is one of the following:
  * `<PatternLayout pattern="%-5p %d [%t] [event: %X{correlationId}] %c: %m%n" />`, or
  * `<PatternLayout pattern="%d [%t] %-5p %c - %m%n" />`

**For applications deployed to CloudHub and Anypoint Runtime Fabric with customized time zones:** Do not override the default JVM timezone for applications deployed to CloudHub and Anypoint Runtime Fabric with customized time zones. The timezone must be UTC. Changing the timezone to a local timezone causes logs to be indexed in Anypoint Monitoring with incorrect timestamps.  
---  
## Search Logs
From Anypoint Monitoring, click **Log Search** to search for text in logs from the search field, through a filter, or with a DSL query.
  * Search from the Log Search Field
  * Search with a Filter
  * Search with the Query DSL


When you search for logs for APIs deployed through Flex Gateway, use the **Application** filter. Use the **App ID** field to identify the instance.
### Search from the Log Search Field
To search the logs, type your search query into the log search field and press **Enter**.
  * Search for a term, such as `"Info Dynamic Logging"`.
Without quotes, the query returns results for matches to each term.
  * Use a wildcard in your search, such as `resourceId=hellowor*`.
  * Use logical operators, such as `resourceId=hellowor* AND "Info Dynamic Logging"`.


### Search with a Filter
You can create a filter to search logs using predefined fields, operators, and values.
  1. Click **+Add a filter**.
  2. Select the predefined field from the drop-down list.
     * `application`
     * `environment`
     * `environment type`
     * `log level`
     * `message`
     * `timestamp`
  3. Select the operator from the drop-down list.
Operators vary by the field you select.
  4. If applicable, enter a value, for example:
See Search Filters and Operators.
  5. (Optional) Enter a value in **Label**.
  6. Click **Save**. 

NOTE
    
Results for the **Application** filter include APIs deployed through Flex Gateway.


### Search with the Query DSL
To convert a search query into a Query DSL:
  1. Click **+Add a filter**.
  2. Click **Edit Query DSL**.
  3. Enter your query, and click **Save**. This example shows a query for log-level INFO:
```
{
 "query": {
  "match": {
   "log-level": {
    "query": "INFO",
    "type": "phrase"
   }
  }
 }
}
```

The search query UI provides a link to the query documentation so that you can perform more complex queries than otherwise available.
This example shows a complex query.


```
{
 "query": {
  "range": {
   "workerId": {
    "gte": 0,
    "lte": 20
   }
  }
 }
}
```

Some complex search queries do not have an equivalent in the search filter values UI, so you can only create and view such queries in the query UI.   
---  
## View Log Data
By default, the log entries in your log search results are abbreviated. You can expand and view the log message and details as a table or in JSON format.
### Tabular Logs
This example shows an expanded log entry as a table. The table contains log filter fields that you see in the Quick Filter list.
```
application	   abcd40x.us-a1.abc.cloudhub.io
class	      qtp437897409-31
environment	   Sandbox
environment type	%{[fields][env_type]}
log level	    ERROR
logger      DefaultMessagingExceptionStrategy
message
         ****************************************************
         Message        : No record could be found in payload or in flow variable BATCH_RECORD (java.lang.IllegalStateException).
         Element        : null
         ----------------------------------------------------
         Exception stack is:
         No record could be found in payload or in flow variable BATCH_RECORD (java.lang.IllegalStateException). (org.mule.api.transformer....
         (72 more...)
         (set debug level logging or '-Dmule.verbose.exceptions=true' for everything)
         ****************************************************
timestamp     April 25th 2024, 17:09:53.517
worker      0
```

### JSON-Formatted Logs
This example shows an expanded log entry in JSON format.
```
{
 "_version": 1,
 "_source": {
  "class": "qtp437897409-31",
  "logger": "DefaultMessagingExceptionStrategy",
  "_ending": 0,
  "timestamp": "2024-11-26T00:09:53.517Z",
  "message": ".Example***
  .ExampleMessage: No record could be found in payload or in flow variable
  BATCH_RECORD (java.lang.IllegalStateException)..ExampleElement...",
  "log level": "ERROR",
  "worker": "0",
  "environment": "Sandbox",
  "environment type": "sandbox",
  "application": "test40x.us-e1.qax.cloudhub.io"
 },
 "fields": {
  "timestamp": [
   "2024-11-26T00:09:53.517Z"
  ]
 },
 "highlight": {
  "orgId": [
   "@abcde@6046b96d@/..."
  ]
 },
 "sort": [
  1524701393517
 ]
}
```

### View Full Logs on a Dedicated Page
After finding a log on a particular issue, you can view the complete log on a dedicated page (without the quick filters, search field, and filter tags). You can view the log detail in tabular or JSON format.
  1. From the selected log, click **View This Log**.
  2. View the extended log in tabular or JSON format.


## View Surrounding Logs
After finding a log for a particular issue, you might want to know what other log reports preceded or followed it.
  1. From the selected log, click **View Surrounding Logs**.
  2. Load the number of logs that you want to see before and after the selected log, or use the default.


The default settings are:
  * **Load 5 more** newer logs
  * **Load 5 more** older logs


## Working with Predefined Filters
When the **Quick Filters** list is open, you can select and use predefined log filters.
For every result group, the **Quick Filters** list displays the first five results of the most recent 500 log entries. When there are more than 500 entries or the top five values do not represent 100% of total values, a **See More** link for each result group appears. You can click **See More** to open the **Add a Filter** box and set parameters to further filter your results.   
---  
This example of a predefined filter selects the ERROR log level.
After you select a predefined filter from the Quick Filter list, you see it near the top of the page, next to **Add a Filter**.
When you hover over a filter, you can select from the following actions:
  * **Enable/Disable** - Enables or disables the filter. When the filter is disabled, it is grayed out.
  * **Pin/Unpin** - Pin or unpin the filter.
  * **Invert** - Change the operation of the search filter. For example, if the search is `log level IS ERROR`, the inversion is `log level IS NOT ERROR`.
  * **Remove** - Delete the filter.
  * **Edit** - Change the filter configuration.
The default settings are:
  * **Load 5 more** newer logs
  * **Load 5 more** older logs


## Working with Predefined Filters
When the **Quick Filters** list is open, you can select and use predefined log filters.
For every result group, the **Quick Filters** list displays the first five results of the most recent 500 log entries. When there are more than 500 entries or the top five values do not represent 100% of total values, a **See More** link for each result group appears. You can click **See More** to open the **Add a Filter** box and set parameters to further filter your results.   
---  
This example of a predefined filter selects the ERROR log level.
After you select a predefined filter from the Quick Filter list, you see it near the top of the page, next to **Add a Filter**.
When you hover over a filter, you can select from the following actions:
  * **Enable/Disable** - Enables or disables the filter. When the filter is disabled, it is grayed out.
  * **Pin/Unpin** - Pin or unpin the filter.
  * **Invert** - Change the operation of the search filter. For example, if the search is `log level IS ERROR`, the inversion is `log level IS NOT ERROR`.
  * **Remove** - Delete the filter.
  * **Edit** - Change the filter configuration.


### Adding Filter Columns to Logs
From the Quick Filters list, you can add and remove columns to or from log results. For example, you might add the Log Level, Timestamp, or Environment field.
Click the column icon for a filter field, for example:
The resulting `log-level` column looks like this in the logs:
To remove the filter column, click the column icon for the filter field, for example:
You can also remove it with the X icon that appears when you scroll over the column.
## Moving Filter Columns
To move filter columns in your log results to the left or right, you simply scroll over the column heading and use the arrow icons.
### Search Filters
Use predefined filters or filters that you create.
Filter | Description | Examples  
---|---|---  
`application` | Full domain of the Mule app in CloudHub. | `am-flights.us-e2.stgx.cloudhub.io`  
Java class that generates the log. | `[am-flights].am-flights-api-httpListenerConfig.worker.34`  
`environment` | CloudHub environment name.  
`environment type` | CloudHub environment type | `Sandbox`, `Design`, `Production`  
`log level` | ALL, DEBUG, ERROR, FATAL, INFO, OFF, TRACE, WARN  
Log4J Logger class | `HttpListenerRegistry`  
Log4J message | `No listener found for request: (POST)/zaraza`  
`timestamp` | Timestamp on the log. Accepted formats: `MMM dd yyyy, HH:mm:ss.SSS` |  Supported time settings are `s` for seconds, `m` for minutes, `h` for hours, `d` for days, `w` for weeks, `M` for months, `y` for years, with `now` for relative times, for example:
  * Last 5 minutes: `now-5m`
  * The day so far: `now/d`
  * This week: `now/w`
  * Week to date: `now/w`
  * Previous Month: `now-1M/M`

  
CloudHub worker ID.  
### Operators
You can use these operators when creating a search filter. For example `log-level IS`
Available to all filters.  
---  
Available to all filters.  
`is between` | Available to `timestamp`.  
`is not between` | Available to `timestamp`.  
Available to all filters.  
`does not exist` | Available to all filters.  
## Filtering Based on the Entire Log Field Value
You can use the funnel-shaped icons on any log in your results to create and remove a filter for the entire log field value.
The filter you create is visible as a filter tag in the Filters area at the top of the page, for example:
You can edit and use that filter like any other filter. See Search Filters.
## Sharing Logs
You can share the URL to your logs.
  1. From Logs, click **Share**.
  2. Select **Share** to load the URL of your log page to a **Share Logs Search Link** field.
  3. Click **Copy**.


## Save and View Saved Log Searches
Save and view log searches.
  1. Click **Save Search**.
  2. Select **View saved searches**.
  3. Click **View Saved Searches** again to return to the main Logs page.


## Clear a Search
You can clear the current search from the same menu shown in Save and View Saved Log Searches:
  1. Click **Save Search**.
  2. Select **Clear Current Search**.


### See also
Search Query Syntax