Overview

Coroot's Logs monitoring enables you to effortlessly analyze your application logs and correlate them with traces, metrics, and profiles.

Coroot's node-agent automatically discovers and gathers logs from all containers on a node, then transmits them to Coroot. Additionally, it performs low-overhead log analysis right on the node to identify message severities and recurring patterns. This process is seamless and compatible with a wide range of log formats, providing valuable meta-information for quick and easy log analysis.

JSON logs

If an application writes JSON-formatted logs (e.g. using slog or zap for Go, logrus, pino, Serilog, or the .NET JSON console formatter), the agent automatically parses each record: the message and severity are extracted from their well-known fields, and the remaining fields are flattened into log attributes (e.g. http.response.status), so you can search logs by any of them. Pattern detection runs on the extracted message rather than the whole JSON line, so records that differ only in attribute values are grouped into the same pattern.

This behavior is enabled by default and can be turned off with the --disable-json-log-parsing agent flag.

Event details

Clicking on a specific event from the list allows you to access its details, including the full message text, severity, and OpenTelemetry attributes. You can also jump to similar messages that match the same pattern.

Quick links

Clicking the application name allows you to filter log entries for that application.

Correlating logs and traces

If you instrument your apps with the OpenTelemetry SDK to send logs to Coroot's OpenTelemetry collector along with the tracing context, you can instantly navigate to the corresponding trace with just one click.