Platform Logs
What this screen is for
Logs searches the application log lines every platform service wrote, and the output of the infrastructure services the platform runs on, newest first, without a shell on the host. You choose a time window and, optionally, a service, a level, a correlation id and words of the message; the screen shows the matching lines and their details. The search is part of the page address, so a search can be bookmarked or shared, and System Health, an alert and a correlation trace open it already filled in.
Every search you run is recorded in the platform audit trail: its window, filters, text and how many lines it returned, never the lines themselves. The screen says so under its title.
What must exist first
This is a platform screen. It needs the permission to read the platform logs, which platform super administrators, operators and auditors hold and platform viewers do not: a log line can carry any tenant's request paths and error detail. Without that permission the screen states the refusal and sends no request, and the links into it are not shown.
Decisions you make here
The window
From and To are entered in your display time zone, and the window may be at most 24 hours wide. Without a window the screen searches the hour before it opened; Last hour resets it. Narrow the window first: it is what keeps a search quick.
The filters
Service offers the services the platform reports as log sources, named as the deployment names them. Lines stored before this release carry earlier names and match no service; a search with Any service finds them, and the hint under the filter says so. When the list may be incomplete, the screen says that too.
An infrastructure service, such as the database or the edge proxy, shows its process output as written: those lines have no level and no correlation id, so a Level or Correlation ID filter leaves them out. Find them by service, window and message text.
Level keeps one level. Correlation ID keeps every line of one request. Message text keeps the lines whose message contains every word you type, matched as plain words: operators, wildcards and quotes are searched as text.
Reading the results
Lines are shown newest first, one page at a time; Load older lines continues the same search until the window holds no older line. Details shows the logger, the correlation, trace and span ids, the tenant id, the request path and the stack trace. A message cut at 8 KiB, or a stack trace cut at 16 KiB, is marked as cut.
When the search fails
A value the server refuses is shown beside the field it names. Log store unavailable means the platform log store gave no usable answer: no line is shown, the search is still recorded, and you can try again later. Searches are limited to 30 per minute for each person on each server instance.
How it relates to other screens
A service row on System Health opens the last hour of that service's lines:
The log ingestion alert, which fires when a service stops sending lines, opens this screen over the time it watched: