Logs
Overview
Section titled “Overview”Osuite Logs gives you a unified view of log data from every part of your stack — applications, containers, hosts, and cloud services. Every log arrives over the OpenTelemetry Protocol (OTLP), pre-enriched with resource context and automatically correlated with traces when a trace and span ID are present.
The logs explorer
Section titled “The logs explorer”The Logs Explorer runs full-text search across your log data with fast response times, even over millions of records. It combines a free-text search over the log body with structured filters, so you can narrow a stream down to the exact records you need.
You can filter by:
- Severity level
- Service name or any resource attribute (host, container, Kubernetes pod)
- Time range, absolute or relative
- Any attribute key-value pair on the log record
- Free text matched against the log body
Filtering by trace_id returns every log emitted during a single request. See Trace correlation.
Severity
Section titled “Severity”Each record carries an OpenTelemetry SeverityNumber and an optional SeverityText. Osuite maps numbers to the six canonical levels so you can filter consistently regardless of the source logger’s own naming.
| Level | SeverityNumber range | Typical text |
|---|---|---|
TRACE | 1–4 | TRACE |
DEBUG | 5–8 | DEBUG |
INFO | 9–12 | INFO, NOTICE |
WARN | 13–16 | WARN |
ERROR | 17–20 | ERROR |
FATAL | 21–24 | FATAL, CRIT |
When a source sends only a text level, configure a severity parser in the collector so the number is set correctly — see the parsing notes in Collect log files.
The OpenTelemetry log data model
Section titled “The OpenTelemetry log data model”Every log record in Osuite follows the OpenTelemetry Log Data Model. Regardless of where a log originates, it arrives with a consistent structure:
| Field | Description |
|---|---|
Timestamp | When the log was emitted |
SeverityText / SeverityNumber | Log level (INFO, WARN, ERROR, etc.) |
Body | The log message (string or structured object) |
Attributes | Key-value pairs scoped to this log record |
Resource | Attributes describing the source — service name, host, k8s pod |
TraceId / SpanId | Present when the log was emitted inside a traced request |
Trace correlation
Section titled “Trace correlation”When TraceId is present, Osuite links the log record to its trace. From the Logs Explorer you jump to the full trace in one click, and from the Trace view you see every related log in context. Applications that emit logs through the OpenTelemetry SDK or a logger bridge get this automatically. See Trace correlation.
Retention and archival
Section titled “Retention and archival”Log retention is configurable. On enterprise plans, Osuite can sync older logs to your own S3-compatible storage for compliance or long-term analysis without keeping them hot in the search index — set up by the Osuite team on request. See the logs pipeline.
Log sources
Section titled “Log sources”Every source sends logs over OTLP, either directly from your application’s SDK or through the OpenTelemetry Collector. Start from the collection hub, or jump to a source below.
| Source | How logs are collected | Guide |
|---|---|---|
| Applications | OTel SDK log bridge from your existing logger | Collect application logs |
| Log files on disk | Collector filelog receiver | Collect log files |
| Docker containers | Collector filelog on the json-file driver | Collect Docker container logs |
| Kubernetes pods | Collector filelog + k8sattributes | Collect Kubernetes logs |
| Syslog and journald | Collector syslog / journald receivers | Collect syslog and journald |
| Cloud services | Cloud log streams over the Collector | Collection hub |
Next steps
Section titled “Next steps”- Collect logs from any source — the full list of application, host, container, and cloud sources
- Trace correlation — link every log line to the request that produced it