Logs cardinality analytics

Log labels have two main source: many are attached by the agent that delivers the logs to the Kloudfuse platform, and potentially even more are defined by users. Some labels are meaningful at the time they are defined, yet lose their relevance over time. Some are created accidentally, or as a result of not fully understanding the common use cases or the purpose of log tracking. Automatically-generated labels, from agents, are often cryptic and unnecessary.

Seeing cardinality analysis of a log helps users to remove unnecessary labels, improving data accessibility and making the collected information more actionable.

Determine log label cardinality

To determine log label cardinality, follow these steps:

  1. Select the Logs tab, and then the Cardinality Analytics option in the dropdown menu.

    Navigate to the logs Cardinality Analytics interface

  2. The Logs Cardinality report appears.

  3. The Logs Cardinality report has the following information and affordances:

    The log cardinality report

    1. A filter/query builder interface. See Filters for log cardinality reports.

    2. All cardinality; in this case, the cardinality is 551.

    3. Search bar to search labels in the system

    4. Time examined (Last 5 minutes by default), which can be adjusted by clicking on the displayed time and using the time picker. Note that time selection is limited to 5-minute intervals.

    5. Refresh display, click Refresh (Refresh) to update the display.

    6. Labels that match all selection criteria

    7. Value Count (1h) for each label for the preceding hour

    8. Value Count for the specified most recent time range (the last 5 minutes is the maximum time range and the default setting) for each label

    9. Value Chart, a bar chart representation of the count of unique values over the selected time range for each label.

      Hover your cursor over the graph to see the value of each measurement.

Filters for log cardinality reports

The filters consist of queries based on selection of labels and their values. Follow these steps to filter log cardinality reports:

  1. In the Show cardinality (Show cardinality of) clause, click Select a label (Select a label).

  2. From the operator drop-down, select the operator for evaluating the expression. The options are:

    =~

    Regex expression equal

    !~

    Regex expression not equal

    !=

    Not equal

    =

    Equal (default)

  3. Click Select a value (Select a value).

  4. To add another query, click plus (plus), and repeat the preceding steps.

    Kloudfuse combines queries using AND logic.

  5. To remove one of the multiple queries, click remove (remove) next to it.

  6. To specify the Limit of the query or combined queries, use the limit to (limit to) clause, selecting either top (top down) or bottom (bottom up) ordering, and specify the number of labels to display in the list.