New Log View Bug

ChadTurner — Thu, 08 Aug 2024 20:39:51 GMT

Staff has provided feedback reporting a bug in the new Log View. When a user leverages two of the same filter variables with different conditions, the underlying DQL query is showing as OR but the OR logic.... (my logic)... Isn't being followed.

Overview of the Log filter:

You'll notice we are calling logs for a give host, AND logs sources that DO NOT INCLUDE CO***** -OR- DO NOT INCLUDE Var/Log/Messages. The expected result would be removal of the entries showing in yellow and purple.

Posting the query to a notebook gives you the DQL:

My logic... which might be flawed.

| filter startsWith(host.name, "<VALUE>")
| filter NOT contains(log.source, "co****") OR NOT contains(log.source, "/var/log/messages")

My understanding is the first line goes to the second line as an AND, meaning that both have to be present. No we get to the second line: OR statement where "co****" OR "/var/log/messages".... but that OR.. seems to have the logic of AND, where the log.source name does not contain co**** AND "Var/log/messages" which would never exist hence the filtering failed.

It's possible my logic is flawed, because we get the desired result when it formulates the DQL as a AND....

A synopsis of this is, then using the new log preview, the selector leverages an "OR" in the statement, when the DQL Query will natively work if "OR" is replaced with "AND"

I hope this helps and I didn't confuse everyone.

Re: New Log View Bug

ChadTurner — Mon, 29 Sep 2025 19:38:12 GMT

Updates since writing this outlines that converting over to DQL shows each block listed as "AND" and not "OR"

topic New Log View Bug in Log Analytics

New Log View Bug

Re: New Log View Bug