Create links to log data

OBSERVABILITY PLATFORM

This feature is available only to specific Chronosphere Observability Platform users, and has not been announced or officially released. Do not share or discuss this feature, or information about it, with anyone outside of your organization.

Individually, telemetry data can provide insights into your app and its connected services and operations. Linking these data types across Chronosphere Observability Platform provides even greater context beyond logs, metrics, or traces on their own.

You can dynamically generate links from trace span details or from standard dashboards by using templated variables, such as {{ trace_id }}, {{ service }}, and {{ operation }}. When someone clicks a link containing these variables, Observability Platform interpolates the variables with information from the selected span or dashboard.

To get started, construct a URL.

Construct a URL

If you want to link from other telemetry data to related logs in Logs Explorer, copy the query, decode it, and replace values with variables in the encoded URL. The following URL is an example of the decoded base URL:

https://TENANT.chronosphere.io/logs/explorer?start=TIME&query=QUERY|+FUNCTION

Replace the following:

TENANT: Your organization name prefixed to your Observability Platform instance.
TIME: The absolute or relative time interval you want the query to use, such as 1h for one hour or 1d for one day. You can also include a start and end time by adding "start":"START_TIME"&"end":"END_TIME" to your query. If you specify the start and end time, the values must be in Unix time as milliseconds, such as 1721243232284.
QUERY: The log query you want to open in Logs Explorer when someone clicks the link.
FUNCTION: Queries in Logs Explorer separate query operators and functions with a pipe (|), as shown in the following example:
```
httpRequest.requestMethod = "POST"
AND httpRequest.status =~ "40*"
AND service = "nginx"
| summarize count()
```
See logging query syntax for more information.

The URL in Logs Explorer uses URL-encoded characters that can be difficult to parse visually. You can use the base URL to create your query, or define your query in Logs Explorer and then decode the URL with an online tool such as URL Decoder (opens in a new tab). The following steps follow the URL Decoder-based approach.

To create the URL for your query:

In the navigation menu, select Explorers > Logs Explorer.
In Logs Explorer, construct a query to define the log data you're searching for.
In your browser address bar, copy the resulting URL from the Logs Explorer page.
In a new tab, navigate to URL Decoder (opens in a new tab).
Paste the URL you copied and click Decode.

Review the decoded URL and identify the values you want to replace with variables. For example, the decoded URL might contain the name of a service like nginx:
```
service+=+"nginx"
```
In the encoded URL you pasted into URL Decoder, replace any values where you want to use variables. For example, the encoded URL might contain the service parameter with a value of nginx:
```
service+%3D+%22nginx%22%
```
Replace nginx with the {{ service }} variable:
```
service+%3D+%22{{ service }}%22%
```
See logging query examples for examples.
After replacing values with variables, copy the encoded URL, complete with all URL-encoded characters.

After constructing the URL, you can create links to logs from trace span details or from standard dashboard panels.

Link to logs from trace span details

If you want to link from trace span details to related logs in Logs Explorer, construct a URL for your logging query, and then create a link in the span details of Trace Explorer.

These links persist across all traces in Observability Platform.

To link to logs from trace span details:

Construct a URL for your logging query.
In Trace Explorer, define the criteria for your search.
To view a specific trace related to your search, click the Traces tab and then select an individual trace to open the trace details page.
On the trace details page, in the Links section, click + Add link.
Enter a display name for the link, and then define a URL for your link.

For example, the following link opens Logs Explorer scoped to the service in the selected span. When you click the link, Observability Platform replaces the {{ service }} variable with the name of the service from the selected span:
```
https://TENANT.chronosphere.io/logs/explorer/?orgId=1&var-svc={{ service }}&var-root_svc={{ service }}
```
Click Save to save your link.

Link to logs from standard dashboards

You can create links from a standard dashboard to relevant log data. You define a URL for your query to express a search in Logs Explorer. Observability Platform takes the contextual information in dashboard metrics and uses it to build links to search for logs. Clicking the link navigates you to Logs Explorer and replaces the variables with matching criteria defined in the search.

Data links in standard dashboards use Observability Platform parameters to refer to series fields, labels, and values.

Before creating a data link from a standard dashboard, you must create custom variables to use in your link. For example, you can create a service variable that you can reference as ${service}. Pair this variable with the service query parameter and reference the variable in your data link.

Use the following URL as the basis for creating a data link for a standard dashboard:

/logs/explorer?start=1h&query=service+%3D+%22${service}%22&visualization=list

To create a data link from a standard dashboard:

Construct a URL for your logging query.
In any dashboard panel, hold the pointer over the panel, click the three vertical dots icon, and then click Edit panel.
On the Edit Panel dialog, click the Links tab.
In the Links tab, click Add link.
In the Link type dropdown, select Link.
Define the Name and URL for your data link, which can link to logs and other external data sources that use the context in the graph as inputs.

For example, the following URL uses the value of the ${service} variable as an input, based on the specific service in the chart:
```
/logs/explorer?start=1h&query=service+%3D+%22${service}%22&visualization=list
```
In the Edit panel screen, click Apply.
On your dashboard screen, click Save to save your changes.

After saving your data link, hold the pointer over the chart you created a link for, click the link icon, and then click the link name to view the contextual link.

Logging query examples

The following examples show both the encoded and decoded URLs for a query in Logs Explorer to help explain the syntax and how to replace parameter values with variables.

To improve readability, each of the following examples uses carriage returns. If you copy any examples, remove these characters before including them in a span link so the URL is valid.

The following URL defines an encoded query from Logs Explorer. This query includes the following parameters:

An operation named /authorize-card-payment
A service named payment_gateway_service
A severity equal to ERROR
An environment named production

https://TENANT.chronosphere.io/logs/explorer?start=1h&visualization=list
&query=operation+%3D+%22/authorize-card-payment%22%0A
AND+service+%3D+%22payment_gateway_service%22%0A
AND+severity+%3D+%22ERROR%22%0A
AND+environment+%3D+%22production%22

Without URL encoding, the URL looks like this:

https://TENANT.chronosphere.io/logs/explorer?start=1h&visualization=list
&query=operation+=+"/authorize-card-payment"
AND+service+=+"payment_gateway_service"
AND+severity+=+"ERROR"
AND+environment+=+"production"

Viewing this version of the URL helps to determine where the values are you want to replace, such as payment_gateway_service or /authorize-card-payment.

You can then replace these values for service and operation with the {{ service }} and {{ operation }} templated variables. The resulting URL with variables should be similar to the following:

https://TENANT.chronosphere.io/logs/explorer?start=1h&visualization=list
&query=operation+%3D+%22{{ operation }}%22%0A
AND+service+%3D+%22{{ service }}%22%0A
AND+severity+%3D+%22ERROR%22%0A
AND+environment+%3D+%22production%22

Copy the resulting encoded URL, navigate to Trace Explorer, and then create a link in the span details. When users click the link, Observability Platform replaces the templated {{ service }} and {{ operation }} variables with the service and operation of the selected span.

Similarly, you can use the {{ span_id }} and {{ trace_id }} variables in your templated link.

https://TENANT.chronosphere.io/logs/explorer?start=1h
&query=operation+%3D+%22{{ operation }}%22%0A
AND+service+%3D+%22{{ service }}%22%0A
AND+severity+%3D+%22ERROR%22%0A
AND+environment+%3D+%22production%22
AND+traceID%3D%22{{ trace_id }}%22

External tasks Live Telemetry Analyzer