Log Analytics · Design (v0.2.0+)
Version: 2026-07-03 · Status: design finalized
Backend:POST /log/search, Doris tablelog_dc_record(see OTLP Ingestion)
Background
v0.2.0 delivers OTLP Logs → Doris log_dc_record → /log/search, with log tabs embedded in trace detail, service detail, and alert events.
A dedicated Log Analytics menu under Application Performance is planned as a global log search entry — APM-context exploration tied to traces and services, not a standalone ELK/Loki replacement.
Storage Model
| Field area | Purpose |
|---|---|
trace_id / span_id | Correlate with traces |
service_id / hostname | Filter by service and host |
severity / body | Level and message |
attributes_json | Structured OTel attributes |
Ingest writes via OTLP /v1/logs (gRPC 4317 or HTTP 4318). See Telemetry Pipeline for the full pipeline.
API (MVP)
POST /log/search— keyword, service, host, trace/span, time range, offset paginationPOST /log/conditions— facet enumerations (evolving)
UI Direction
Reference patterns from SigNoz and Datadog: global time range, histogram, left facets (service / host / level), main log table with expand row and jump to trace when trace_id is present.
Out of scope for early releases: Live tail, LogQL/KQL-style query languages, log clustering.