Log Contents
What will my logs look like in observIQ?
Here's a sample log event collected from a PostgreSQL database with observIQ Cloud:


Here's a sample log event collected from a Kubernetes cluster (GKE) with observIQ Cloud:


In the table below, Fields can be separated by 2 primary categories:
- Log Event: fields that are sourced or parsed from the actual log event
- Metadata: additional context added to the log message by observIQ. Most metadata enriches your logs automatically - some is added manually by the user.
Field | Description | Log Event or Metadata |
---|---|---|
@timestamp | Time the event occurred | Log Event |
ingest_timestamp | Time the event was ingested | Metadata |
severity | Severity of the event. (note: severities from different types are mapped to the same severity scale) | Log Event |
resource | Metadata | |
resource.hostname | Hostname of the agent host | Metadata |
resource.ip | IPv4 address of the agent host | Metadata |
resource.container_id | (k8s only) container ID | Metadata |
resource.container_name | (k8s only) container name | Metadata |
resource.k8s_namespace_name | (k8s only) namespace name | Metadata |
resource.k8s_namespace_uid | (k8s only) namespace uuid | Metadata |
resource.k8s_pod_name | (k8s only) pod name | Metadata |
resource.k8s_pod_uid | (k8s only) pod uid | Metadata |
type | high-level description of the type of log (example: mysql.error) | Metadata |
log.name | name of the log file on the filesystem (note: does not include the full file path) | Metadata |
log.size | size of the log message in bytes | Metadata |
message | message field | Log Event |
agent.id | unique identifier of the log agent transmitting the event | Metadata |
agent.name | friendly name of the the log agent transmitting the event | Metadata |
agent.version | version of the log agent transmitting the event | Metadata |
data.[] | fields that are successfully parsed out of the log event | Log Event |
label.[] | custom labels added manually by the user. Can be specified manually in the pipeline. | Metadata |
source.name | name of the Source in observIQ | Metadata |
source.type | type of Source in observIQ | Metadata |
source.id | unique identifier of Source in observIQ | Metadata |
Updated almost 2 years ago