DOCSEARCHbyAlgolia
Submit Docs

Logz.io Documentation

website·Indexed 40 days ago

https://docs.logz.io/

Guides for shipping logs and metrics to Logz.io from various sources, including OpenTelemetry, Telegraf v1.17+, and AWS Lambda. Includes configuration instructions for a wide range of integrations such as Apache HTTP Server, Kafka, Prometheus, Zeek, and Google AI Platform, as well as user guides for infrastructure monitoring, alerting, and dashboard management.

Tokens
397.1K
Snippets
1.4K
Records
2.8K
Agent score
69%

What's inside Logz.io

  1. Overview of AWS cross-account log shipping architecture

    To ship logs from multiple AWS accounts to Logz.io, a two-tier account structure is used:

    1. Landing Account: Acts as the central hub. It receives logs from all sending accounts and forwards them to Logz.io. It hosts the Kinesis stream, the Destination (which encapsulates the stream), and a Lambda function triggered by the stream.
    2. Sending Accounts: These accounts host the AWS services generating logs. They use CloudWatch subscription filters to push logs to the Destination located in the landing account.

    If logs need to be shipped from multiple AWS regions, additional Destinations must be created in the landing account for each required region.

  3. Overview of LogMetrics capabilities

    LogMetrics allows you to convert numeric-based data within log files (such as latency, request time, and data volumes) into metrics for real-time visualization in graphs and dashboards using PromQL. This process enables monitoring without the cost associated with growing log data volumes. Log metrics are processed before drop filters, meaning metrics can be generated even if the logs themselves are subsequently filtered out.

  4. Overview of the Logz.io Open 360 AI interface

    The Open 360 AI interface is a redesigned, unified observability platform for Logz.io. It is designed to reduce time-to-value for onboarding, monitoring, and troubleshooting by allowing users to work across Logs, Metrics, Traces, and AI tools without switching contexts.

  5. Overview of Logz.io Dashboards for observability

    Logz.io Dashboards provide a centralized interface for visualizing and exploring observability data, including logs, metrics, and traces. They are designed to streamline workflows for real-time performance monitoring, anomaly detection, and root cause analysis by allowing users to move from high-level overviews to detailed investigations without context switching.

  6. Overview of Dynamic lookup lists

    Dynamic lookups are an extension of lookup lists that actively and continuously search for matches across logs. Unlike static lists, they automatically retrieve data on a scheduled basis and populate a list of values based on a specific field from an OpenSearch Dashboards query result. These lists can be used as filters when creating security rules. Note that lookup list values are string-based only and do not support ranges (though OpenSearch Dashboards itself supports range-based searches).

  7. Overview of Kubernetes 360

    Kubernetes 360 is a monitoring and troubleshooting tool within Logz.io's Open 360 AI platform. It integrates log analytics, Prometheus metrics, and Jaeger distributed tracing to help R&D and engineering teams monitor application SLOs, service discovery, and load balancing in Kubernetes environments.

  8. Overview of Azure Blob Storage integration for Logz.io

    The Logz.io Azure Blob Storage integration uses a trigger function to forward logs from a specific container path (including subdirectories) within an Azure Blob Storage account to Logz.io. Every new log file uploaded to the container triggers the function to ship the file content.

  9. Overview of Logz.io Cloud SIEM and Cortex XSOAR integration

    Integrating Logz.io Cloud SIEM with Cortex XSOAR (formerly Demisto) allows security teams to automatically remediate incidents identified by Logz.io and increase observability. Key capabilities include:

    • Automatic fetching of Logz.io security events as incidents in Cortex XSOAR.
    • Execution of automated response playbooks triggered by Logz.io security events.
    • Ability for analysts to run standard Lucene queries against Logz.io logs directly from the Cortex XSOAR interface.
    • Ability to filter incident fetching by rule severity or rule name.

  10. Overview of OrionIQ Integrations

    Integrations allow OrionIQ agents to connect to external systems to pull additional context (e.g., from ticketing systems) or push results (e.g., to collaboration platforms). Integrations are managed via OrionIQ > Integrations in the left navigation menu, which is split into two tabs: Catalog (for discovering and connecting new integrations) and Management (for monitoring the health and usage of existing connections).

  11. Overview of Logz.io Telemetry Collector

    Logz.io’s Telemetry Collector is a tool used to send logs, metrics, and tracing data to the Logz.io observability platform. It is designed for easy installation (often via a single line of code) and provides full observability coverage. It is available in all regions except for Japan; users in Japan should use the Logz.io integrations hub instead.

  12. Overview of Logz.io Cloud SIEM components

    Logz.io Cloud SIEM integrates OpenSearch Dashboards with security analytics to identify and remediate threats. The platform consists of the following core modules:

    • Summary Dashboard: Displays security events from the last 24 hours.
    • Event Management: A platform to view, edit, and assign security events to team members.
    • Rules: A system for managing preconfigured or custom security rules. When a rule triggers, a security event is logged to the Summary and Threats dashboards.
    • Dashboards: A curated library of security dashboards for reviewing logs by specific security products.
    • Threats Overview & Intelligence Feeds: Correlates system logs with public and private threat feeds to identify potential threats.
    • OpenSearch Dashboards: Used for deep-dive log analysis and drilling down into specific events.
    • Reports: A scheduling system to send dashboards as regular reports.