The event viewer, also called the log viewer, is a core part of Papertrail. Here is a very short introduction.
For a more complete interactive tour, see tour.
When you arrive in the log viewer, Papertrail is showing events as they happen. It’s realtime, as if you were logged directly into a system (or hundreds of systems). Logs are live.
To pause live logs, scroll up (or click the scroll bar) or click
When paused on current logs, the icon will change to
Click the icon (or scroll down) to resume live tail.
When viewing older logs, the icon will change to a down arrow:
Click the icon (or scroll down) to return to current logs and resume live tail.
Search is integrated into Papertrail’s event viewer:
Find anything just by typing what you know. If you’ve used Google or GMail, Papertrail search works much the same way, including phrases (
"), logical operators, and exclusion (
Click the upper right
Help menu to see example searches without leaving the log viewer, or read the syntax.
As your team uses Papertrail more, some searches will probably be worth accessing again, receiving in email, graphing, or otherwise retaining.
After entering a search query, you’ll see a
Save Search button. Click Save Search to retain the query:
Give it a name, and optionally setup a search alert right away:
It will also be accessible from the event viewer’s
Saved Searches button:
Find a message that could use some background? Just click the orange or blue links in the log viewer to see it in context:
The log sender link will show that message in context of all messages from that sender (for example, to see a complete error which occurred on a single system).
The log type link will show that message in context of all messages from senders in the group (for example, to see one HTTP request in context of requests made to a fleet of Web servers).
You’ll be looking at the exact same log message and any search query will be retained.
Think of event actions as a super powered version of related context. Like related context, you can view an event in the context of a system (orange) or program (blue), but there is so much more. To access event actions, hover over any event and click on the
+ button to the left of the event.
This will expose a menu showing some actions you can take on the event:
From this menu you can take several actions on an event:
Pro tip: to shortcut linking to an event, cmd/ctrl+click the
To seek directly to any date or time in the searchable history, click the calendar icon:
The time seek will expand:
Enter the desired point and hit
Seek To. While seeked to a time other than the present, the calendar icon will say so:
Just click it to change the seeked-to time or return to the present. Any search query will remain active.
When you enter a time, the time zone in your Papertrail profile is used.
Note: Seeking across a DST boundary will jump to a position that is off by 1 hour (details).
You can turn pieces of your log messages into clickable elements, and when clicked, will let you see all surrounding messages that match that element. This could be an IP, email address, user ID, request ID, domain name, source code filename, or any other part of a log message—you get to decide.
? while in the log viewer and all will be revealed.
From your profile, you can change between black on white or white on black:
You may have access to multiple Papertrail entities representing different companies’ logs. Within the log viewer, switch entities at will. See Managing logs from multiple companies.
Seeing noisy logs? Although your systems and apps decide which log messages are sent to Papertrail, Papertrail can optionally filter noise on your behalf. See Log filtering.
Papertrail uses orange and blue for links to show related context, as well as rendering any ANSI color codes present in log messages. Additional colorization can be customized; see Log colorization.
Head over to the