# \#log-analytics **URL:** https://community.dynatrace.com/tag/log-analytics/693.md [Latest](https://community.dynatrace.com/latest.md) · [Categories](https://community.dynatrace.com/categories.md) · [Tags](https://community.dynatrace.com/tags.md) --- ## [Custom Alert: Log Event Detection](https://community.dynatrace.com/t/custom-alert-log-event-detection/55945)
**Author:** [@apanoobee](https://community.dynatrace.com/u/apanoobee)\ **Replies:** 1\ **Last updated:** [June 18, 2026, 1:46am UTC](https://community.dynatrace.com/t/custom-alert-log-event-detection/55945 "2026-06-18T01:46:27Z")
I have set up a custom alert but I’d like to be able to display a specific number string to the alert description. How would I go about doing this? --- ## [Are you using Grail for log consolidation and what benefits do you see?](https://community.dynatrace.com/t/are-you-using-grail-for-log-consolidation-and-what-benefits-do-you-see/49774)
**Author:** [@RohitBisht](https://community.dynatrace.com/u/RohitBisht)\ **Replies:** 4\ **Last updated:** [April 7, 2026, 7:50am UTC](https://community.dynatrace.com/t/are-you-using-grail-for-log-consolidation-and-what-benefits-do-you-see/49774 "2026-04-07T07:50:33Z")
For logs, Grail has many benefits, what benefits have you seen or foresee using this. For example: 1. Cost savings 2. Single place to store logs 3. Use of AI for correlation/alerting 4. Faster UI 4. others --- ## [storage size by logsource](https://community.dynatrace.com/t/storage-size-by-logsource/54808)
**Author:** [@susmita\_k](https://community.dynatrace.com/u/susmita_k)\ **Replies:** 0\ **Last updated:** [January 29, 2026, 4:17pm UTC](https://community.dynatrace.com/t/storage-size-by-logsource/54808 "2026-01-29T16:17:05Z")
I am trying to get the raw storage data for log source. however, this query is not returning the rawsize correctly, any help is appreciated. fetch logs | summarize count(), sum(rawsize), by:\`log.source\` | sort \`sum(ra… --- ## [Log ingestion](https://community.dynatrace.com/t/log-ingestion/54772)
**Author:** [@Vikas\_g199](https://community.dynatrace.com/u/Vikas_g199)\ **Replies:** 1\ **Last updated:** [January 28, 2026, 2:08pm UTC](https://community.dynatrace.com/t/log-ingestion/54772 "2026-01-28T14:08:02Z")
Hi Team, We have onboarded a new host and configured the required log source both on the host and at the environment level. However, we are still unable to view the logs. Since we are using the SaaS deployment model, c… --- ## [Logs Ingest on K8s with Dynatrace](https://community.dynatrace.com/t/logs-ingest-on-k8s-with-dynatrace/53313)
**Author:** [@jgrant](https://community.dynatrace.com/u/jgrant)\ **Replies:** 5\ **Last updated:** [December 17, 2025, 3:09pm UTC](https://community.dynatrace.com/t/logs-ingest-on-k8s-with-dynatrace/53313 "2025-12-17T15:09:07Z")
Summary In April 2025, Dynatrace released a log module feature for automatic log ingest of container logs on clusters monitored with OneAgent workload in Cloud Native Fullstack or App-only modes or without OneAgent. If y… --- ## ["OneAgent log analytics" process lost after reactivating monitoring](https://community.dynatrace.com/t/oneagent-log-analytics-process-lost-after-reactivating-monitoring/53077)
**Author:** [@AlexLarrieu](https://community.dynatrace.com/u/AlexLarrieu)\ **Replies:** 2\ **Last updated:** [December 12, 2025, 1:57pm UTC](https://community.dynatrace.com/t/oneagent-log-analytics-process-lost-after-reactivating-monitoring/53077 "2025-12-12T13:57:31Z")
Hello, We use a API v2 to disable and enable monitoring. curl ‘https://\[tenant\]/api/v2/settings/objects’ \\ -X POST \\ -H ‘Accept: application/json; charset=utf-8’ \\ -H ‘Content-Type: application/json; charset=utf-8’ … --- ## [End of life for Log Monitoring Classic in Dynatrace Managed?](https://community.dynatrace.com/t/end-of-life-for-log-monitoring-classic-in-dynatrace-managed/54225)
**Author:** [@AntonPineiro](https://community.dynatrace.com/u/AntonPineiro)\ **Replies:** 1\ **Last updated:** [November 27, 2025, 8:28am UTC](https://community.dynatrace.com/t/end-of-life-for-log-monitoring-classic-in-dynatrace-managed/54225 "2025-11-27T08:28:38Z")
Hi, Dynatrace has marked end life to Log Montoring Classic What's new in Dynatrace SaaS version 1.328 — Dynatrace Docs Is this only in SaaS tenants? What about Managed? Best regards --- ## [Troubleshooting log Ingestion via API - POST ingest logs](https://community.dynatrace.com/t/troubleshooting-log-ingestion-via-api-post-ingest-logs/53456)
**Author:** [@noel\_david](https://community.dynatrace.com/u/noel_david)\ **Replies:** 0\ **Last updated:** [September 24, 2025, 1:40pm UTC](https://community.dynatrace.com/t/troubleshooting-log-ingestion-via-api-post-ingest-logs/53456 "2025-09-24T13:40:37Z")
Summary This guide covers how to push custom logs to Dynatrace using the Log Monitoring API (POST /logs/ingest). It applies to both SaaS environments and ActiveGate deployments with the Log Analytics Collector module en… --- ## [Troubleshooting logs ingested via Fluent Bit](https://community.dynatrace.com/t/troubleshooting-logs-ingested-via-fluent-bit/52930)
**Author:** [@noel\_david](https://community.dynatrace.com/u/noel_david)\ **Replies:** 0\ **Last updated:** [August 19, 2025, 11:00am UTC](https://community.dynatrace.com/t/troubleshooting-logs-ingested-via-fluent-bit/52930 "2025-08-19T11:00:20Z")
Summary This troubleshooting article will help resolve some common issues faced while ingesting logs into Dynatrace via Fluent Bit. Troubleshooting steps Make sure the token is a Dynatrace API token with the logs.in… --- ## [Timestamps in Logs with OneAgent 1.313+](https://community.dynatrace.com/t/timestamps-in-logs-with-oneagent-1-313/52495)
**Author:** [@jgrant](https://community.dynatrace.com/u/jgrant)\ **Replies:** 1\ **Last updated:** [July 16, 2025, 9:24am UTC](https://community.dynatrace.com/t/timestamps-in-logs-with-oneagent-1-313/52495 "2025-07-16T09:24:29Z")
Summary OneAgent 1.313 includes an important change to LogAnalytics logic for timestamp processing of log file content. The new default timezone for automatically recognized timestamp patterns is the local host’s timezo… --- ## [📌 TIP#1: Extracting values from a JSON\_ARRAY using DQL](https://community.dynatrace.com/t/tip-1-extracting-values-from-a-json-array-using-dql/52429)
**Author:** [@tracegazer](https://community.dynatrace.com/u/tracegazer)\ **Replies:** 2\ **Last updated:** [July 10, 2025, 1:55pm UTC](https://community.dynatrace.com/t/tip-1-extracting-values-from-a-json-array-using-dql/52429 "2025-07-10T13:55:16Z")
When analyzing logs or business events that include structured payloads, it’s common to receive data in the form of a JSON\_ARRAY. If your field contains this format (for example, under rs.body\_result), you can extract sp… --- ## [Calculation of distribution percentage in OpenPipeline](https://community.dynatrace.com/t/calculation-of-distribution-percentage-in-openpipeline/52120)
**Author:** [@Akhil-Jayendran](https://community.dynatrace.com/u/Akhil-Jayendran)\ **Replies:** 3\ **Last updated:** [June 17, 2025, 11:24am UTC](https://community.dynatrace.com/t/calculation-of-distribution-percentage-in-openpipeline/52120 "2025-06-17T11:24:20Z")
Hello Team, How does OpenPipeline calculate the distribution percentage of logs? Is it based on a specific time window, such as the last 2 hours, or is it calculated over all logs shipped? --- ## [Clarification on Interaction Between dt.event.timeout and Alerting Profile "Problem Send Delay" in Dynatrace](https://community.dynatrace.com/t/clarification-on-interaction-between-dt-event-timeout-and-alerting-profile-problem-send-delay-in-dynatrace/51953)
**Author:** [@Nadeesh](https://community.dynatrace.com/u/Nadeesh)\ **Replies:** 1\ **Last updated:** [June 6, 2025, 6:48am UTC](https://community.dynatrace.com/t/clarification-on-interaction-between-dt-event-timeout-and-alerting-profile-problem-send-delay-in-dynatrace/51953 "2025-06-06T06:48:10Z")
Hi, In our Alerting Profile, the “Problem send delay in minutes” has been increased from 0 to 30 minutes. This is intended to reduce noise by delaying notifications for short-lived problems. We also use log-based custo… --- ## [How to: Capturing log content from file that container is creating](https://community.dynatrace.com/t/how-to-capturing-log-content-from-file-that-container-is-creating/46379)
**Author:** [@sivart\_89](https://community.dynatrace.com/u/sivart_89)\ **Replies:** 2\ **Last updated:** [June 30, 2024, 7:00pm UTC](https://community.dynatrace.com/t/how-to-capturing-log-content-from-file-that-container-is-creating/46379 "2024-06-30T19:00:53Z")
I have a container that is writing log files to a directory within itself. How can I capture that log content? The OneAgent itself is capturing the stdout just fine but the file it is creating is not being captured. I th… --- ## [Test if a dashboard variable is set before using it](https://community.dynatrace.com/t/test-if-a-dashboard-variable-is-set-before-using-it/45335)
**Author:** [@GerardJ](https://community.dynatrace.com/u/GerardJ)\ **Replies:** 7\ **Last updated:** [June 21, 2024, 8:34pm UTC](https://community.dynatrace.com/t/test-if-a-dashboard-variable-is-set-before-using-it/45335 "2024-06-21T20:34:54Z")
Hello I’m using variables on dashboard to filter in DQL. I would like the filter command to be applied only if the variable has a selected value : if no value is selected for the variable, the variable isn’t used to fi… --- ## [Windows event viewer log ingest](https://community.dynatrace.com/t/windows-event-viewer-log-ingest/46185)
**Author:** [@Pabloabad](https://community.dynatrace.com/u/Pabloabad)\ **Replies:** 1\ **Last updated:** [June 18, 2024, 3:00pm UTC](https://community.dynatrace.com/t/windows-event-viewer-log-ingest/46185 "2024-06-18T15:00:32Z")
Hi, I would like to know if it is possible to configure Dynatrace to be able to ingest the logs from the windows event viewer, I have found some information in the community but nothing that really solves my question, th… --- ## [How do I get dynatrace to notify me of an incident beforehand?](https://community.dynatrace.com/t/how-do-i-get-dynatrace-to-notify-me-of-an-incident-beforehand/45758)
**Author:** [@SebastianLozano](https://community.dynatrace.com/u/SebastianLozano)\ **Replies:** 10\ **Last updated:** [June 4, 2024, 7:15am UTC](https://community.dynatrace.com/t/how-do-i-get-dynatrace-to-notify-me-of-an-incident-beforehand/45758 "2024-06-04T07:15:52Z")
Normally dynantrace notifies me of the incident when it is already present on a server, however, how do I get it to notify me before the incident happens? --- ## [Log content for ingest rule contains more than one line](https://community.dynatrace.com/t/log-content-for-ingest-rule-contains-more-than-one-line/45754)
**Author:** [@a\_chiaravalle](https://community.dynatrace.com/u/a_chiaravalle)\ **Replies:** 1\ **Last updated:** [May 24, 2024, 3:51pm UTC](https://community.dynatrace.com/t/log-content-for-ingest-rule-contains-more-than-one-line/45754 "2024-05-24T15:51:18Z")
Hi Team From java application server’s log (Linux) I want to capture only the rows related to START and END events of some batch. To do this, I defined a “Log Ingest rule”: but when I check the result of this rule … --- ## [JSON parsing: fieldsAdd or](https://community.dynatrace.com/t/json-parsing-fieldsadd-or/45333)
**Author:** [@ghfsa](https://community.dynatrace.com/u/ghfsa)\ **Replies:** 3\ **Last updated:** [May 10, 2024, 12:06pm UTC](https://community.dynatrace.com/t/json-parsing-fieldsadd-or/45333 "2024-05-10T12:06:00Z")
I have a DQL which filters down to one of two possible JSONs: content = {"code":"an\_error\_code","error":{"code":"an\_error\_code","message":"An error message appears here..."} or content = {"level":"error","message":"So… --- ## [Identifying logs that are not ingested programatically](https://community.dynatrace.com/t/identifying-logs-that-are-not-ingested-programatically/45207)
**Author:** [@jonno56](https://community.dynatrace.com/u/jonno56)\ **Replies:** 3\ **Last updated:** [April 27, 2024, 7:07pm UTC](https://community.dynatrace.com/t/identifying-logs-that-are-not-ingested-programatically/45207 "2024-04-27T19:07:45Z")
In a host screen, we can see logs that have been detected but are not ingested: How can these be listed via an API call? I have looked at the data returned from the entity API for this host & also for the process\_gr…