In a perfect world, our applications would execute in one seamless and flawless flow. In reality, though, s*** happens. Resources that functions rely on are missing, memory or disk space runs out, and users enter bad input.
The good news is that these anomalous events, or exceptions, can be mitigated with exception handling and logging. In a way, exception logs are the ultimate method for receiving feedback as they contain the actual problem, with stack traces and dumps.
The bad news, of course, is that exceptions are thrown all the time and even a small-sized application will be logging a large number of exceptions. CI/CD processes are pushing code into production more frequently, obscuring the already-limited visibility. As a result, exceptions simply get drowned together with other log messages generated by the environment.
This is where Logz.io’s new Application Insights comes into the picture.
Application Insights is a new machine learning analytics tool that identifies new exceptions and errors logged in your environment. These exceptions are displayed on a new dedicated page in the Logz.io UI, which also provides users with the tools for analyzing and resolving the events. In the near future, users will also be able to integrate with their DevOps tools to correlate these events with changes applied to the environment.
Let’s take a closer look.
Viewing Application Insights
Once identified, Application Insights are listed on the new Insights page, together with other types of events tracked by Logz.io.
At the top of the page, a summary of all the different identified insights — Application Insights and Cognitive Insights — from the last 7 days is displayed. This serves as a general overview of the environment.
Below this summary is a graph that represents your storyline — a visual depiction of the different insights identified by Logz.io and plotted by you. By default, the top 5 most frequently occurring insights from the past 7 days are already plotted on the graph and will appear in the list of insights below.
This graph helps to connect the different dots and create a large and contextualized picture. Using Logz.io APIs, users will soon be able to integrate with their build and deployment tools to add markers to this storyline, signifying changes that were applied in the environment, such as new deployed features or updates.
Below the graph is the insights list, containing various insights identified by Logz.io. Note, that by default, the list is pre-filtered to show only new insights identified. You can toggle the Only new switch to see older events.
You can filter and sort the insights using various filtering options. Filtering is performed in the filters section above the list — just click the Filter button to open it.
On the left side of the page, click Add Filters, select a filter type and then add any filters you wish. You can filter by tag (automatically assigned to the insight by Logz.io), assignee, status and type. So if you want to focus on Application Insights, use the type filter.
You can also select a specific timeframe to use for filtering, or use the search box to find specific events.
Using the Show new slider, you can make sure that only new exceptions identified by Logz.io are displayed (selected by default).
Sorting can be done by clicking the head of a relevant column in the list. For example, you can sort by the number of occurrences over time, the title of the event or their tag.
Handling Application Insights
To see more details about an Application Insight, simply select it in the list. The expanded view will include a full stack trace of the exception. Clicking the body of the trace will copy it to your clipboard.
There are various actions you can perform to handle the insights.
You can define a status for an insight (active, resolved, dismissed) or set a severity level (notable, important, critical). This is done by selecting the check-box for an insight, or a group of insights, and using the action bar that is displayed at the top of the list.
The status and severity of an insight can also be defined from within the list — just select an insight and click the arrow under the Status column. Assigning an insight to another team member is done the same exact way.
There are several actions you can perform for an individual insight using the action menu.
Editing an insight will modify the information displayed for future occurrences.
You can also create a trigger for an insight. Triggers are used to either create alerts, for getting notified the next time the insight is identified, or to create an Optimizer for aggregating the data into a Timeless Account (read more about this here).
To see the logs themselves in the Discover tab in Kibana, select View in Kibana.
Plotting a Storyline
A group of events is only useful if you can create a story from them. On the Insights page, you can do just this by plotting Application Insights, together with the other types of events identified and displayed by Logz.io (such as Cognitive Insights) on one visual graph. This helps create a storyline of events and gives the user the ability to see the bigger picture by correlating the different event types.
Insights can be added to the graph in two ways, by either using the Plot Incidents button in the action bar (displayed when you select an insight, or a group of insights, from the list) or using the action menu.
Plotted insights will appear at the top of the list under a “Plotted” category. You can remove them from the graph, or un-plot them, the same way they were added. If you want to temporarily hide one layer of incidents from the graph, simply click it on the graph legend. This can be useful when there are too many layers on the graph (you can plot up to 12 insights on the graph.)
The graph also has a time frame picker that you can use to focus on a specific period. Notice that a miniature graph is displayed on this picker to help you with selecting what time frame to focus on.
Clicking Clear at the top of the graph will clean the graph, and the list below, from any plotted insights. The Refresh icon will sync the time frame in the graph with the timeframe used in the insights list below.
Before we sum things up, just a few notes that are worth mentioning:
- Application Insights is available to all Logz.io users, as an Early Availability feature. If you encounter any issues or have questions, feel free to reach out to our Support team
- Currently, only Java exceptions are displayed as Application Insights. More application types, as well as additional functionality, will be introduced soon.
- Coming soon – the ability to add event markers via API. More details on this in a future post.
Summing it up
Log analysis has traditionally involved three main steps – aggregating data, storing it, and searching for it. Being successful at implementing all of these steps have become impossible because of the growing volumes of data.
It’s one thing if you know exactly what you’re looking for, or what query to use in Kibana. But in most cases – let’s face it – we don’t know what we’re looking for in the first place. Exception logs are a great resource for gaining visibility into how applications are performing but this visibility gets obscured by the noise created by log data.
By pointing to new exceptions and providing the tools to correlate with changes made in the environment, Application Insights helps cut through the operational noise created by logs and ultimately shorten resolution times.