Docs » View overall system health using Timeline

View overall system health using Timeline đź”—

The Timeline displays a histogram of logged events over time, grouped by values of the message field severity. Change to a different grouping by aggregating the log messages using a different field. To learn more, see Identify problem areas using log aggregation.

The following screenshot shows you a count of events grouped by the event field called name:

Log Observer Timeline

These features help you use the Timeline to review the health of your systems:

  • Review the histogram to see the spread of error severity levels.

    • The histogram displays severity values in time intervals (histogram buckets). The logs processor service extracts these severity values from the incoming data. Each histogram interval shows a stacked column of severity values, and each value has a unique color. To identify each value in a column by color, use the Timeline legend.

  • Adjust the time picker in the top left.

    To adjust the duration of each histogram bucket, use the time picker.

    • The Live Tail option doesn’t display a histogram. Use filtering or keyword highlighting to review incoming log records. To learn more, see Verify changes to monitored systems with Live Tail.

    • Other options display histograms over a previous time period. Log Observer calculates the time intervals for each histogram bucket. The duration of each interval appears in the control bar.

    • To display a histogram for a specific time period, use the Custom Time option.

    • By default, the time period for the histogram is Last 5 minutes, which displays buckets for the last 5 minutes of log data. In the preceding example, there are 10,306 log events, and the time interval for the histogram buckets is 10 seconds.

  • Highlight buckets in the Timeline to narrow the time period. Log Observer drills down into the portion you highlight, and the histogram shows results in the new time period. To highlight buckets, do the following:

    1. Click anywhere in the Timeline and drag to surround the time interval on which you want to zoom in.

    2. To accept your selection, click Filter to selection. Log Observer recalculates the time period and the histogram buckets and displays the result.