Filtering records in Log Interactions view

Adding filters to the Log Interactions view lets you view only those log records that meet criteria you set, so that you can focus on a smaller set of log records. You can create filters that limit the shown log records according to severity or other Common Base Event property values.

Log record filters apply to any content shown in the Log Interactions view, be it a log file or a correlation with many logs in it. When you select another item in the Log Navigator, the content of the Log Interactions view will change, but the filter will remain the same until you apply a different filter.

Note: You can also filter log records as you import a log file. Filters defined in the Log Interactions view would be additional filters on what has been imported. You cannot use the Log Interactions view filters to "undo" filters used during import; if you want more log records that what the import filter allowed, you must import the log file again with a less restrictive import filter.

Hint: By default, Log Interactions and Log Thread Interactions views show only log records with correlations. For log files that do not contain any correlations, the interactions views will be empty. To show all records in these views, clear the Show correlated log records only check box in the Manage Filters dialog.

Creating a log record filter

To create a filter:

  1. Click the drop-down menu arrow next to the Filter button in the tool bar Filter drop down icon. Select Manage filters.
  2. In the Edit Filters window, click New.
  3. Provide a Filter name. This name will appear in the filter drop-down list.
  4. Optionally, set criteria for severity level by clicking the Show events by severity check box. Click the Errors, Warnings or Information check boxes as desired to indicate what types of records to show in the Log Interactions view.
  5. Optionally, enable the Show correlated log records only check box. With this check box selected, only log records that have correlations (either internally within the log file, or with records in other log files in a correlation) will be shown in the Log Interactions view.
  6. Click the Advanced tab. The advanced filtering feature lets you set specific filtering criteria for primary Common Base Events attributes. The Advanced filtering table shows all the filter criteria defined, if any. Log records that match one or more of the criteria will be shown in the Log Interactions view.
  7. To add an entry in the table, click Add. Select the attribute you want to filter on from the list of primary Common Base Event attributes. Select the operator (like performs a pattern match). Enter a value that log records must have for that attribute in order to be shown:

    Click OK.

  8. To edit an existing entry, select it, click Edit and modify the fields.
  9. To remove an entry, select it and click Remove.
  10. Click OK. The filter will be created, and applied against the content of the Log Interactions view.

Tip: In the Log Interactions view, in the Log Records pane, if you right-click on a log record and select Copy to Clipboard, the message (msg) property of that log record is copied to the clipboard. This is useful for pasting into filter and symptom database editors.

Applying a log record filter to a log file or correlation

To apply a filter to a log file or correlation:

  1. Select the log file or correlation in the Log Navigator so that it is displayed in the Log Interactions view.
  2. Click the drop-down menu next to the Filter button in the Log Interactions view tool bar  Filter drop down icon.
  3. Select the name of the filter you want to apply.

The filter will remove from the view all log records that do not meet the filter criteria; they are still present, just not shown in the Log Interactions view. If you select another log file or correlation in the Log Navigator, this filter will still be applied, until you select a different filter from the drop-down list.

Filters applied here also apply to the Log view and so are maintained if you switch views.

Editing or deleting a log record filter

To edit or delete a filter:

  1. Click the drop-down menu next to the Filter button in the Log Interactions view tool bar  Filter drop down icon.
  2. Click Manage filters.
  3. In the Edit Filters window, select the filter you want to edit or delete.
  4. Click Edit to edit the filter (see the instructions above for creating a filter), or Delete to delete the filter.
  5. Click OK.

The Log Interactions view contents that were being filtered by the changed or deleted filter will now display their log records according to the changes (that is, all log records in the case of a delete).

Related concepts
Determining problems in distributed applications using the Log and Trace Analyzer

Related tasks
Working with log files
Analyzing a log file
Setting logging preferences
Correlating log files

Related reference
Log view
Common Base Event format specification