You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
By default, holmes fetched the logs from the `Frequent search <https://coralogix.com/docs/user-guides/account-management/tco-optimizer/logs/#frequent-search-data-high-priority>`_
74
+
tier and only fetch logs from the `Archive` tier if the frequent search returned no result.
75
+
76
+
This behaviour can be customised using the ``logs_retrieval_methodology`` configuration field:
77
+
78
+
.. code-block:: yaml
79
+
80
+
toolsets:
81
+
coralogix/logs:
82
+
enabled: true
83
+
config:
84
+
# Possible values are:
85
+
# - FREQUENT_SEARCH_ONLY
86
+
# - ARCHIVE_ONLY
87
+
# - ARCHIVE_FALLBACK <- default value
88
+
# - FREQUENT_SEARCH_FALLBACK
89
+
# - BOTH_FREQUENT_SEARCH_AND_ARCHIVE
90
+
logs_retrieval_methodology: ARCHIVE_FALLBACK # default value
91
+
...
92
+
93
+
Here is a description of each possible log retrieval methodology:
94
+
95
+
- **FREQUENT_SEARCH_ONLY** Always fetch logs using a frequent search.
96
+
- **ARCHIVE_ONLY** Always fetch logs using the archive.
97
+
- **ARCHIVE_FALLBACK** Use a frequent search first. If there are no results, fallback to searching archived logs. **This is the default behaviour.**
98
+
- **FREQUENT_SEARCH_FALLBACK** Search logs in the archive first. If there are no results, fallback to searching the frequent logs.
99
+
- **BOTH_FREQUENT_SEARCH_AND_ARCHIVE** Always use both the frequent search and the archive to fetch logs. The result contains merged data which is deduplicated and sorted by timestamp.
76
100
77
101
**Search labels**
78
102
79
-
You can tweak the labels used by the toolset to identify kubernetes resources. This is only needed if your
80
-
logs settings for ``pod``, ``namespace``, and ``app`` differ from the defaults in the example above.
103
+
You can tweak the labels used by the toolset to identify kubernetes resources. This is **optional** and only needed if your
104
+
logs settings for ``pod``, ``namespace``, ``application`` and ``subsystem`` differ from the defaults in the example below.
105
+
106
+
.. code-block:: yaml
107
+
108
+
toolsets:
109
+
coralogix/logs:
110
+
enabled: true
111
+
config:
112
+
labels: # OPTIONAL: tweak the filters used by HolmesGPT if your coralogix configuration is non standard
113
+
namespace: "kubernetes.namespace_name"
114
+
pod: "kubernetes.pod_name"
115
+
application: "coralogix.metadata.applicationName"
116
+
subsystem: "coralogix.metadata.subsystemName"
117
+
...
118
+
81
119
82
120
You can verify what labels to use by attempting to run a query in the coralogix ui:
0 commit comments