PCF Log Search Tags Dictionary

The following table lists the generated tags that Log Search provides. Log Search attaches these tags when it recognizes that the data belongs to a common log field category. These tags appear at the top of the Available Fields list in Kibana, above the raw keys from the source JSON logs sent to Log Search. You can use these tags to to filter data and more effectively search your logs.

Tag Description Example Value
@level Severity level of the message Can be one of: DEBUG, INFO, WARN, ERROR or FATAL
@message Unparsed, human readable text of log. May be empty if all data parses into separate fields Switchboard.Error routing to backend
@raw Unparsed log message <139>2016-01-28T21:17:52.856995+00:00 10.0.16.11 switchboard [job=proxy- partition-e3353cc4ddedf43fa7a6 index=0] {"timestamp":"1454015872.856954575","source": "Switchboard","message":"Switchboard.Error routing to backend","log_level":2,"data": {"error":"No active Backend"}}`
@source.deployment Name of deployment cluster log is from. For example, bosh deployment or tile name CF if from a Cloud Foundry job, or logsearch if from a logsearch job
@source.host Guid of the container running the app. Defaults to @source.ip if not applicable From a container: 4138q23c-1v2c-4a21-9szbc-4b37c11fda0b. From a VM: 10.0.1.10
@source.index Instance of source component job 0
@source.ip IP address of the origin VM 10.0.1.10
@source.job Name of source component In a Log Search deployment: elasticsearch_data, elasticsearch_master, kibana, etc.
@source.program Program emitting the logs cloud_controller_ng
@source.vm Combination of @source.job and @source.index elasticseach_data/0
@timestamp Parsed timestamp of log message, in UTC. Defaults to parse time. Overridden by syslog_timestamp, or timestamp pulled from specific log message 2015-11-18T15:00:04.896Z
@timestamp_ns Nanoseconds since Unix Epoch. Not all logs include nanosecond precision. For a timestamp of 1463503340.250173807, @timestamp_ns is 173,807