Filtering log records in log view

Adding filters to the Log view lets you view only those log records that meet criteria you set, so that you can focus on a smaller set of log records. You can create filters that limit the shown log records according to severity or other Common Base Event property values.

Log record filters apply to any content shown in the Log view, be it a log file or a correlation with many logs in it. When you select another item in the Log Navigator, the content of the Log view will change, but the filter will remain the same until you apply a different filter.

Note: You can also filter log records as you import a log file. Filters defined in the Log view would be additional filters on what has been imported. You cannot use the Log view filters to "undo" filters used during import; if you want more log records that what the import filter allowed, you must import the log file again with a less restrictive import filter.

Creating a log record filter

To create a filter:

  1. Click the drop-down menu arrow next to the Filter button in the tool bar Filter drop down icon. Select Manage filters.
  2. In the Edit Filters window, click New.
  3. Select the Log filter and click OK.
  4. Provide a Filter name. This name will appear in the filter drop-down list.
  5. Optionally, set criteria for severity level by clicking the Show events by severity check box. Click the Errors, Warnings or Information check boxes as desired to indicate what types of records to show in the Log view.
  6. Click the Advanced tab. The advanced filtering feature lets you set specific filtering criteria for Common Base Events attributes. The Advanced filtering table shows all the filter criteria defined, if any. Log records that match one or more of the criteria will be shown in the Log view.
  7. To add an entry in the table, click Add. Select the attribute you want to filter on from the list of Common Base Event attributes. Select the operator (like performs a pattern match). Enter a value that log records must have for that attribute in order to be shown:

    Click OK.

  8. To edit an existing entry, select it, click Edit and modify the fields.
  9. To remove an entry, select it and click Remove.
  10. Select group expression combo box to group entries in table by AND or OR condition. Default selection is AND condition.
  11. Click OK. The filter will be created, and applied against the content of the Log view.

Tip: In the Log view, in the Log Records pane, if you right-click on a log record and select Copy to Clipboard, the message (msg) property of that log record is copied to the clipboard. This is useful for pasting into filter and symptom database editors.

Applying a log record filter to a log file or correlation

To apply a filter to a log file or correlation:

  1. Select the log file or correlation in the Log Navigator so that it is displayed in the Log view.
  2. Click the drop-down menu next to the Filter button in the Log view tool bar  Filter drop down icon.
  3. Select the name of the filter you want to apply.

The filter will remove from the view all log records that do not meet the filter criteria; they are still present, just not shown in the Log view. If you select another log file or correlation in the Log Navigator, this filter will still be applied, until you select a different filter from the drop-down list.

Filters applied here also apply to the Log Interactions view and so are maintained if you switch views.

Editing or deleting a log record filter

To edit or delete a filter:

  1. Click the drop-down menu next to the Filter button in the Log view tool bar  Filter drop down icon.
  2. Click Manage filters.
  3. In the Edit Filters window, select the filter you want to edit or delete.
  4. Click Edit to edit the filter (see the instructions above for creating a filter), or Delete to delete the filter.
  5. Click OK.

The Log view contents that were being filtered by the changed or deleted filter will now display their log records according to the changes (that is, all log records in the case of a delete).

Filtering log record properties

To customize which log record properties are displayed in the Properties pane when you select a log record in the Log view:

  1. In Log view, click the Filter Properties button The Filter Properties tool bar button in the Log view tool bar. The Filter Properties dialog box opens.
  2.  
  3. Select or clear the properties to be displayed.
  4. To control their order, use the Up and Down buttons.
  5. Click OK

The list of records is refreshed and will show the properties specified in the log record properties filter.

Related concepts
Determining problems in distributed applications using the Log and Trace Analyzer

Related tasks
Working with log files
Sorting log records
Analyzing a log file
Setting preferences for the Log and Trace Analyzer
Correlating log files
Importing a log file

Related reference
Common Base Event format specification
Log view