When you arrive in the log viewer, Papertrail is showing events as they happen. It’s realtime, as if you were logged directly into a system (or hundreds of systems). Logs are live.
To pause live logs, scroll up or click PAUSE:
When paused on current logs, click LIVE to resume live tail:
When viewing older logs, click the down arrow or scroll down to return to current logs and resume live tail.
Search is integrated into Papertrail’s event viewer:
Find anything just by typing what you know. If you’ve used Google search, Papertrail search works much the same way, including phrases (
"), logical operators (
OR), and exclusion (
Click the upper right Help menu to see example searches without leaving the log viewer, or read the syntax.
As your team uses Papertrail more, some searches will probably be worth accessing again, receiving in email, graphing, or otherwise retaining.
After entering a search query, click Save Search to retain the query:
Give it a name, and optionally set up a search alert right away:
Alerts can also be added later.
The saved search will be shown on the team-wide Papertrail Dashboard, like these:
and will be accessible from the event viewer’s Saved Searches button:
To seek directly to any date or time in the searchable history, click the clock icon:
The time seek will expand:
Enter the desired point and click Seek To. While seeked to a time other than the present, the icon shows the current seek time:
Just click it to change the seek time or return to the present. Any search query will remain active.
When you enter a time, the time zone in your Papertrail profile is used.
Note: Seeking across a DST boundary will jump to a position that is off by 1 hour (details).
Find a message that could use some background? There are three quick ways to put events in context.
Click the orange or blue links in the log viewer to see an event in host or program context:
The log sender link will show that message in context of all messages from that sender (for example, to see a complete error that occurred on a single system).
The log type link will show that message in context of messages from that program (process) in the current group.
After clicking, you’ll be looking at the same log message and any search query will be retained.
To bring up the event actions menu, hover over an event and click the
+ button on the left.
This menu exposes three actions:
If you have an active search, you can choose whether to include or exclude the search in the new context.
Shortcut linking to an event by Cmd/Ctrl+click on the
You can turn pieces of your log messages into clickable elements. When these are clicked, the event viewer will display all surrounding messages that match the clicked element. This could be an IP, email address, user ID, request ID, domain name, source code filename, or any other part of a log message—you get to decide.
? while in the log viewer and all will be revealed.
You may have access to multiple Papertrail entities representing different companies’ logs. Within the log viewer, switch entities at will. See Managing logs from multiple companies.
From your profile, change between black on white or white on black:
Papertrail uses orange and blue for links to show related context, as well as rendering supported ANSI color codes present in log messages. Additional colorization can be customized; see Log colorization.
Papertrail provides a few common customizations on demand:
Use Truncate Message to display each message on one line only. Great for aligning messages to view patterns. Click on a line to expand it.
Use the other options to hide parts of the log message that aren’t necessary; for example, Papertrail timestamps if messages have internal timestamps.
Seeing noisy logs? Although your systems and apps decide which log messages are sent to Papertrail, Papertrail can optionally filter noise on your behalf. See Log filtering.