4. Search Logs

OpenSearch provides us the ability to analyze out logs. Let’s begin by navigating to the OpenSearch Dashboard

Step 1 - Open the OpenSearch Dashboard

  1. Go to the OpenSearch Console
  2. Click on the fluentd-domain OpenSearch domain you created earlier

search_logs_1

  1. Click on the OpenSearch Dashboard URL. This should open the URL in a web browser window

search_logs_2

  1. You will be prompted to log in. For the user name enter OSMasterUser for the password enter AwS#OpenSearch1
  2. If an additional popup window is present after login asking about data upload click on Explore on my own
  3. If an additional popup window is present asking you to select your tenant select Global and click on Confirm

You should now see a window that looks like this

search_logs_3

Step 2 - Create an Index Pattern

In order to search our logs via. the OpenSearch dashboard you need to create an index pattern. Follow the steps below to create an index pattern for the Fluentd logs

  1. In the OpenSearch Dashboard, expand the side menu and click on Stack Management under management section

stack_management

  1. On the stack management page click on Index Patterns on the left hand menu

index_pattern

  1. On the index patterns page click on Create index pattern

create_index_pattern_1

  1. Enter fluentd* under the index pattern name section

search_logs_7.png

  1. Click on Next step
  2. Click on the time field drop down and select @timestamp

search_logs_7.png

  1. Click on Create index pattern

You have now created an index pattern! You can use the index pattern to analyze our logs

Step 3 - Search the Logs

OpenSearch provides the ability to easily search log data. Let’s view and search our logs sent by Fluentd

  1. In the OpenSearch Dashboard expand the side menu and click on Discover under the OpenSearch Dashboards section

search_1

  1. Expand the time range that OpenSearch will view to the Last 7 days

search_logs_9.png

You can now see the logs sent to OpenSearch from Fluentd

search_logs_10

You can expand any of the logs to view all of the available fields

search_logs_10

You can also search logs using the search bar at the top of the page

search_logs_10

When you are ready proceed to the next step Clean Up if you want to delete the resources you used for this workshop