Configure log display options

Grafana can automatically detect and display log levels (error, warning, info, debug) with color coding when you configure the correct field names. Setting the message and level fields helps Grafana parse your Elasticsearch logs correctly for better visualization.

In this milestone, you’ll configure the log display options in your Elasticsearch data source settings.

You’ll open your Elasticsearch data source settings, set the log message and level fields, then save.

1. Open Connections > Data sources.

2. Open the elasticsearch data source.

   1. Click elasticsearch.

3. In the Logs section, set Message field name to the field that contains your log message (for example message).

4. Set Level field name to the field that contains log severity (for example level).

5. Click Save & test to apply your changes.

6. Return to Explore.

7. In the Lucene Query field, enter a search term such as error.

8. Click Run query to refresh the log display with your message and level field settings.

9. Confirm log lines appear with color-coded levels and readable message content. If you see no logs, widen the time range to include when your data was ingested.

You configured Elasticsearch log display fields and verified the updated results in Explore.

In the next milestone, you’ll filter logs by time range to focus on a specific investigation window.

Troubleshooting

Explore the following troubleshooting topics if you need help:

• Troubleshoot issues with the Elasticsearch data source

More to explore (optional)

At this point in your journey, you can explore the following paths:

• Configure the Elasticsearch data source