Search

The Search Logs page provides a federated search console to query all data stored in AxoStores (the storage component of AxoRouter) and external stores (AxoLake). Note that AxoStore is only available on an AxoRouter if it was enabled when the AxoRouter host was deployed or updated. For details, see Install AxoRouter on Linux.

To display data from the specified period without any specific search keywords, just select Search.

• Basic Search mode searches in the values of the following fields of the messages: body, host_name

  Basic Search is case insensitive. Adding multiple keywords searches for matches in any of the previous fields. This is equivalent to the @ANY =* keyword1 AND @ANY =* keyword2 AQL query.

• AQL Query Search mode allows you to search in specific labels of the hosts using different operators.

  It also makes more complex filtering possible, using the Equals, Contains (partial match), and Match (regular expression match) operators. Note that:

  • To execute the search, click Search, or hit ESC then ENTER.
  • AxoConsole autocompletes the built-in and custom labels and field names, as well as their most frequent values, but doesn’t autocomplete labels and variables created by data parsing and processing steps.
  • You can use the AND and OR operators to combine expressions, and also parenthesis if needed. For details on AQL, see AQL operator reference.
  • The precedence of the operators is the following: parentheses, AND, OR, comparison operators.
  • Use the usual keyboard shortcuts to undo (⌘/Ctrl + Z) or redo (⌘/Ctrl + Shift + Z) your edits.

  For example, meta.vendor = palo-alto-networks, meta.host.labels.location != us-east-1, or meta.connection.src_ip =* 192.168.

  When searching in stores, you can use the following fields (depending on the configuration of the store).

To limit the search, you can:

• Adjust the Time range of the search (default is 1 day). Note that AxoStore retains data only for 7 days.
• Search only the data stored on a specific Router (by default, AxoConsole searches in the data of every AxoRouter that has AxoStore deployed).
• Search only the data in a specific Store. (By default, every AxoRouter that has AxoStore deployed has a default store. To create a new store, see Create Store or Create External Store.)

The time distribution of the search results allows you to quickly zoom in on a specific time period. You can select multiple bars to zoom in on them.

Events

The Events section of the page shows the search results.

Select View Options to customize how the search results are displayed:

• Adjust the number of Results Per Page.
• Increase Raw Log Lines to show (wrap) multiple lines of long events
• Switch the Timestamp Format between HH:MM:SS, YYYY-MM-DD HH:MM:SS, and YYYY-MM-DD HH:MM:SS +-TIMEZONE_OFFSET (with fractions of a second, for example, milliseconds).
• Enable Format Log to format JSON messages into human-readable format.
• Select Hide Fields Summary to hide the Fields sidebar.

Select the info icon next to an event to see its details.

The Event Details panel allows you to inspect a specific event. For details on the available fields and their structure, see Storage schema.

• To display the original log message, select Raw Log.

  

• To copy the entire event as JSON to the clipboard, select Copy as JSON.

• To search the event body and metadata, enter a search keyword into the Find field. This searches for the string on the Event Details panel, including the log, metadata, or label names and values.

  

• To add a field to the Pinned Fields and display it for every event, click the checkbox before the field. Pinned fields show up in the event details, and also in the list of the events, making it easy to get a quick glance on the distribution of the field values. They’re included as separate fields when you Export the search results into a CSV file.

  To unpin a field, select the field in any of the events, then select Unpin from the local menu.

  

• To copy the name or the value of a field, select the name of the field, then select content_copy or Copy Value.

• To copy an AQL query that matches this field and its current value, select the name of the field, then select Copy as AQL Query. You can paste this query into the AQL search field, and use it for filtering.

• If the field refers to a pipeline element in Axoflow (for example, a flow in the meta.flow field, a store, or an AxoRouter), you can jump to the page of the related element.

Fields

The sidebar shows the Frequent and Infrequent fields that appear in the events of the current page (and the number of their occurrence).

You can hover over any field and select add_circle_outline to show the selected field and its value under each event that has this field.

To show other fields (and their occurrence) in the sidebar, select See all, then select the fields you want to display. Depending on the configuration of the store, you can access the following fields.

Export search results

To export the search results, select Export as CSV. Note that:

• Only the search results shown on the current page will be exported (50 entries by default, change View Options > Results Per Page for more).
• By default, the timestamp and the message fields are exported. To include other fields, add them to the selected fields before exporting the data.

To send the selected data to another destination for further analysis, see Rehydrate data.

Rehydrate search results

You can retrieve the selected data from your stores and send (rehydrate) it to other destination for further analysis as needed. For details, see Rehydrate data.