Summary: This post outlines recommended techniques for filtering logs in Dynatrace. It covers field selection, query optimisation, indexing considerations, and how to reduce noise in dashboards or alert triggers.
I was wondering if anyone wanted to share how they're filtering logs in a way aside from Management Zones if they want to review data for a particular group of hosts/applications.
Currently, I have Management Zones set up where QA servers are in their own MZs, and so if I want to see dashboards/logs/etc for QA only, I can just go to the QA MZ.
With logs, I was hoping that I could filter logs via host.group or host.tag because that would have made it tremendously helpful to be able to limit my search criteria based on host groups or host tags, because otherwise, I see limited value in host groups or host tags. But at the moment, my thoughts are that I have to limit the data based on Management Zones if I only want to filter based on QA.
I do realize I can search for only QA servers (where I enter one server at a time due to the wildcard not being allowed in the middle of a search criteria, like a hostname), but that is not going to be as useful if I want to search for something among a plethora of servers.
Maybe re-purposing dt.process_groups?
I do realize that Dynatrace is not meant to be a log viewing tool, but if someone still wanted to view logs, the current setup leaves an entire universe to be desired.
