dt-obs-logs

Use fetch logs with a time range and filter by status, for example: fetch logs, from:now() - 1h | filter status == "ERROR". Add contains() for substring search or matchesPhrase() for exact phrase matching, then sort by timestamp and limit results.

Use summarize with count() and countIf(status == "ERROR") grouped by bin(timestamp, 5m), then compute the rate with fieldsAdd error_rate = (error_logs * 100.0) / total_logs. Sort by time bucket ascending to see the trend.

contains() performs a simple substring search on log content, while matchesPhrase() does full-text phrase matching. Use contains() for simple keyword checks and matchesPhrase() for exact phrases, applying severity filters first to reduce search cost.

Use parse content, "JSON:log" to create a record field named log, then access nested values with log[key], such as log[msg] or log[error]. Filter logs with contains() before parsing to reduce parsing overhead.

The most common causes are a missing or too-narrow time range and inactive log ingestion. Widen the from: window and verify that OneAgent log ingestion is configured for the target process groups.

Do not use it for explaining existing queries, product documentation questions, or distributed tracing and span analysis, which belong to dt-obs-tracing. It also cannot combine logs with host attributes without the smartscape topology reference from dt-dql-essentials.