Optimize your Search Queries: Metalog Data

Introduction

Metalog events contain information about your DataSet account's user and log activity and can be used to gather information about:

• Ingested log volume
• Ingested log status
• Alerts and webhooks
• Monitor activity
• User operations (everything from search queries run to password changes)
• Other integrations (such as S3, CloudTrail, CloudWatch, etc.)

These logs do not count against your monthly log volume. A full explanation can be found here.

Searches

Identify available Metalog Data

(serverHost = "scalyr-metalog" || serverHost = "monitor")

From here, click on the tag attribute to see a list:

Audit Logs

Contain details about user activity. More information can be found here

tag='audit'

Log Volume

Track ongoing ingested log volume. The default "log Volume" dashboard displays activity by graphing this data.

tag='logVolume' metric='logBytes' 

Alert Logs

Assists with the troubleshooting of alerts.

See this article for more information