---
schema_version: "1"
id: dd7d960a754ee4f886b05730c90c3b02a10e80fee0011a00aa2ef41c383aa6c3
title: Searching Logs in Anypoint Monitoring
collection: mulesoft
version: current
locale: en-us
portal_url: https://docs.salesforce.com/mulesoft/current/en-us/monitoring/logs-search-hf.md
canonical_url: https://docs.mulesoft.com/monitoring/logs-search-hf
source_site: docs.mulesoft.com
content_type: documentation
content_hash: 1c66dbc4a41f56976ec364a70b1fcb9dc739a8b4db49ef443d65c253e3eb2766
description: Search, filter, and analyze aggregated log data for your deployed Mule apps and APIs in MuleSoft Anypoint Monitoring.
latest: true
---
---
product: Monitoring
description: Search, filter, and analyze aggregated log data for your deployed Mule apps and APIs in MuleSoft Anypoint Monitoring.
keywords: MuleSoft, Anypoint Monitoring, log search, log filtering, Mule app logs, API logs, aggregated logs, log analysis
---

# Searching Logs in Anypoint Monitoring

> For the full documentation index, see: https://docs.mulesoft.com/llms.txt

[![](/mulesoft/current/en-us/_/img/icons/info.svg)](/monitoring/#billing)

Get logs on your Mule apps from Anypoint Monitoring. Anypoint Monitoring aggregates log files so you
can manage, search for, filter, and analyze your logs. These features support:

- Comparative analysis and pattern identification across Mule apps

- Focused log searches to isolate key data

- Sharing log searches and CSV downloads

![Log Search UI](/mulesoft/current/en-us/monitoring/_images/logs-search-hf.png)

<table><tbody><tr><td><i data-value="1"></i><b>1</b></td><td>Search for log field columns to display or remove from the log <strong>Results</strong> table. From an expanded field column heading, you can:<div><ul><li><p>View the highest five values in the field</p></li><li><p>Add or remove the field from the <strong>Results</strong> table</p></li><li><p>Filter by any of the displayed values or, if the field contains more than 5 values, create a <a href="#search-filters">search filter</a> from <strong>See More</strong></p><div><p>You can also create a search filter from <a href="#filter-simple"><strong>+ Add filter</strong></a>.</p></div></li></ul></div></td></tr><tr><td><i data-value="2"></i><b>2</b></td><td>Provide search queries for logs and log fields, including log <strong>Message</strong> fields. Use <span><img src="https://docs.mulesoft.com/monitoring/_images/logs-save-icon-hf.png" alt="" width="20" height="20"></span> (Save) to save named searches for future use, and to select, update, or delete saved searches.</td></tr><tr><td><i data-value="3"></i><b>3</b></td><td>Set a date and time range to capture in the log <strong>Results</strong> table using the clickable <span><img src="https://docs.mulesoft.com/monitoring/_images/logs-calandar-icon-hf.png" alt="" width="20" height="20"></span> (Calendar), <strong>Show dates</strong>, or a date range that appears in the UI after you click <strong>Show dates</strong>. If you select a relative or absolute date range, the <strong>Refresh</strong> button switches to an <strong>Update</strong> button to use for applying your date range.</td></tr><tr><td><i data-value="4"></i><b>4</b></td><td><strong>Refresh</strong> is for manually refreshing the logs in the <strong>Results</strong> table.<div><p>To set an autorefresh rate in seconds, minutes, or hours, open <span><img src="https://docs.mulesoft.com/monitoring/_images/logs-calandar-icon-hf.png" alt="" width="20" height="20"></span> (Calendar) to configure the <strong>Refresh every</strong> setting.</p></div></td></tr><tr><td><i data-value="5"></i><b>5</b></td><td><strong>Share</strong> provides a link to your current search query.</td></tr><tr><td><i data-value="6"></i><b>6</b></td><td>Create and use <a href="#search-filters">search filters</a>, such as <code>appId: app</code>. Filters <a href="#save-search">persist for reuse only if you save them</a>.</td></tr><tr><td><i data-value="7"></i><b>7</b></td><td>Review log counts by the selected date range. Timestamp units on the horizontal axis vary depending on the date or time range you select. The longer the range, the longer the timestamp period, which can display averages over 30-second, 12-hour, or weekly intervals, for example.</td></tr><tr><td><i data-value="8"></i><b>8</b></td><td>Use the <strong>Results</strong> table to review the logs captured by your search. You can also use <strong>Download as CSV</strong> to download up to 10,000 rows of log data.</td></tr><tr><td><i data-value="9"></i><b>9</b></td><td>Filter by the value in a cell of the <strong>Results</strong> table by hovering over the cell and clicking to add (<strong>+</strong>) or remove (<strong>-</strong>) the filter.</td></tr></tbody></table>

> [!NOTE]
>
> - For agent-related logs, see [Get Logs for Agentic Assets](#search-agentic).
>
> - For on-premises servers with customized logging, see important information in
>   [Format Customized Logs in On-Premises Servers for Proper Indexing](#warning-custom-logs).

## Search for Logs

Use **Log Search** to capture the logs you want to review. You can use the search bar, a filter
(including filters created with Query DSL), or combination of the search bar and a filter.

- [Query Logs from the Search Bar](#search-bar)

- [Use Search Filters](#search-filters)

> [!NOTE] Each query is limited to 50 search terms or phrases.

### Query Logs from the Search Bar

Use the search bar with or without [search filters](#search-filters) to capture the logs you want to
review.

1.  Select an absolute or relative date-time range to review.

    For date-time range selection, see [Select a Log Date and Time Range](#time-range).

2.  Optionally, add or remove columns (available fields) from the log **Results** table.

3.  Provide a search query using any of these methods:

    - Provide a query in the search bar:

      - Use words or quotes around multiple words and strings containing special characters, such as
        `"HTTP GET"`, `"ab12c345-abc6-789d-e1fa-b124c5de6789"`, or
        `"https://api.mycompany.com:443"`.

        Without quotes, multiword searches return matches to each word, and unescaped special
        characters can affect the search negatively. For partial word searches in the **worker** and
        **log level** fields, you can use pattern-matching characters in your query, such as
        `worker:yz-*-abcd1` or `log level:*O?` to return INFO and ERROR logs.

      - Escape special characters with the `\` character.

        For more information, see [Special Characters](https://docs.mulesoft.com/monitoring/log-search-query-syntax#special-characters).

      - Use a [field identifier](#field-names) to search within a specific log field, such as
        `appId: myapp` for an application named `myapp`.

      - Use logical operators, such as the `AND` in `appId: myapp AND "forbidden (403)"`.

        For a list of supported operators, see
        [Boolean Operators](https://docs.mulesoft.com/monitoring/log-search-query-syntax#boolean-operators).

    - Add filters as needed to change the scope of log results.

      For guidance, see [Use Search Filters](#search-filters).

4.  Review search results in the **Results** table:

![Expanded Log Message](/mulesoft/current/en-us/monitoring/_images/logs-message-expanded-hf.png)

<table><tbody><tr><td><i data-value="1"></i><b>1</b></td><td>To expand a log entry and view log fields, click <strong>&gt;</strong> in the <strong>Time</strong> field for a log entry.<div><p>The arrowhead points down (<strong>⌄</strong>) after you click it.</p></div></td></tr><tr><td><i data-value="2"></i><b>2</b></td><td>The expanded log (<strong>Expanded document</strong>) includes <strong>Table</strong> and <strong>JSON</strong> views.</td></tr><tr><td><i data-value="3"></i><b>3</b></td><td>For long, truncated log messages, open the full message by clicking the <strong>&gt;</strong> in the <strong>Table</strong> view’s <strong>Message</strong> field.</td></tr><tr><td><i data-value="4"></i><b>4</b></td><td>Get more context on the log by clicking <strong>View surrounding logs</strong> and specifying a number of logs that precede and follow your log, or use <strong>View log</strong> to open the log entry in a dedicated page.</td></tr></tbody></table>

For more detail, see [Log Search Query Syntax Reference (US and EU)](https://docs.mulesoft.com/monitoring/log-search-query-syntax).

### Use Search Filters

Create, edit, and apply log search filters. When defining a filter, you can use selectable fields
and operators, or you can use the JSON-based OpenSearch Query Domain-Specific Language (Query DSL)
for more complex filters.

- [Create a Basic Filter](#filter-simple)

- [Create a Filter with Query DSL](#filter-query-dsl)

To save a filter for future use, see [Save and Apply Saved Log Search Queries](#save-search).

#### Create a Basic Filter

Create a filter for your log search.

> [!NOTE] When using more than one basic search filter, values available to your filters, such as
> application or worker names, aren’t narrowed or limited by values you select for other filters in
> your search. For example, if you create filter for application A and then add a filter for a
> worker, all workers are available for selection, not just workers available for application A.

1.  Click **Add filter**.

2.  Select a log field name or use the field’s identifier (such as `appId`) for Query DSL filters.

    See [Log Field Names](#field-names) for log fields and identifiers.

3.  Select an operator, and provide any required operands:

    - `is`: Contains the value you provide

      - Example: `Application is my-app`

      - Filter label: `appId: my-app`

    - `is not`: Doesn’t contain the value you provide

      - Example: `Application is not my-app`

      - Filter label: `NOT appId: my-app`

    - `is one of`: Matches at least one value in the list of values you provide

      - Example: `Application is one of my-app another-app yet-another-app`

      - Filter label: `appId: is one of my-app another-app yet-another-app`

    - `is not one of`: Doesn’t match any value in the list of values you provide

      - Example: `Application is not one of my-app another-app yet-another-app`

      - Filter label: `NOT appId: is one of my-app another-app yet-another-app`

    - `exists`: Identifies a field that contains a value

      - Example: `Class exists`

      - Filter label: `class: exists`

    - `does not exist`: Identifies a field that contains an empty value

      - Example: `Class does not exist`

      - Filter label: `NOT class: exists`

4.  Optionally, perform any of these actions:

    - When creating or editing a search filter, use **Create custom label?**.

      A short label is useful for long filter names.

    - Save your filter so you can reuse it.

      For guidance, see [Save and Apply Saved Log Search Queries](#save-search).

#### Create a Filter with Query DSL

You can use OpenSearch Query Domain-Specific Language (Query DSL) to create a filter in JSON format.
For information about valid log field identifiers, see [Log Field Names](#field-names).

1.  Click **Add a filter**.

2.  Click **Edit Query DSL**.

3.  Provide your query, and click **Save**.

    This example shows a query for `log-level` INFO (for the **log level** field):

    ```text
    {
      "query": {
        "match": {
          "log-level": {
            "query": "INFO",
            "type": "phrase"
          }
        }
      }
    }
    ```

    This example shows a complex query that retrieves worker ID values from 0 to 20.

    ```text
    {
      "query": {
        "range": {
          "workerId": {
            "gte": 0,
            "lte": 20
          }
        }
      }
    }
    ```

    This example shows a query that uses a wildcard (`*`) and a quantifier (`?`) as the `worker`
    field value (`workerId` in the query) `xy-*-abc?1`.

    ```text
    {
      "query": {
        "wildcard": {
          "workerId": {
            "value": "xy-*-abc?1",
            "case_insensitive": true
          }
        }
      }
    }
    ```

To learn more, see [Query DSL](https://docs.opensearch.org/3.3/query-dsl/) in the v3.3 OpenSearch
documentation.

### Select a Log Date and Time Range

By default Log Search retrieves the last 15 minutes of logs. You can use an absolute or relative
date-time range:

- **Absolute**: Specific date-time to start and end the search. The end of the date-time period
  defaults to **now**.

- **Relative**: A configurable number of seconds, minutes, hours, days, weeks, months, or years
  before (such as **Days ago**) or after (such as **Days from now**) the current date and time.

To select the date-time range, use any of these options:

- Click ![](/mulesoft/current/en-us/monitoring/_images/logs-calandar-icon-hf.png) (Calendar), and use **Quick select** or **Commonly
  used** options:

  - Select the last number of **seconds**, **minutes**, **hours**, **days**, **weeks**, **months**,
    or **years**.

  - Select a commonly used option, such as **Today**, **This week**, last number of minutes, hours,
    or days, **Last 1 year**.

- Click **Show dates** or the date-time range in Log Search:

  - Click **Absolute** to pick a specific start date and time for your log search, and then click
    **Update**.

  - Click **Relative**, and set a number of seconds, minutes, hours, days, weeks, months, or years
    from now for your log search, and then click **Update**.

    Optionally, round to the day.

For information about log data retention, see
[Data Retention and Management for Logs](#data-retention-management).

## Save and Apply Saved Log Search Queries

Save search queries as reusable filters. After using a saved search query, you can clear the query
filter so it doesn’t affect search results. You can also permanently delete a saved search.

- To save a new search:

  1.  Run a search query you intend to save.

      For guidance, see [Search for Logs](#search-logs).

  2.  Click ![](/mulesoft/current/en-us/monitoring/_images/logs-save-icon-hf.png) (Save).

  3.  Click **Save as new** or **Save current search**.

      **Save as new** appears if another filter or search query is applied to the current log
      search.

  4.  Provide a name for your search, and click **Save**.

      Wait a moment for the save process to complete.

- To use a saved search:

  1.  Click ![](/mulesoft/current/en-us/monitoring/_images/logs-save-icon-hf.png) (Save).

  2.  Click the saved search to apply the search.

      The search appears as a search filter.

- To clear a saved search from a search query that’s filtering your results, use either of these
  methods:

  - Click ![](/mulesoft/current/en-us/monitoring/_images/logs-save-icon-hf.png) (Save), hover over the saved search, and then click
    **Clear**.

  - Hover over the filter and click **X**. For example, if **my saved app** is a saved search, you
    can click **X** to clear it without deleting:

    ![Delete a Filter](/mulesoft/current/en-us/monitoring/_images/logs-delete-filter-hf.png)

    The saved filter remains available in your list of saved searches. Unsaved search filters don’t
    persist when you click **X**.

- To edit a saved search:

  1.  Click a saved search to display the results.

  2.  Modify your current search query or filters.

  3.  Click ![](/mulesoft/current/en-us/monitoring/_images/logs-save-icon-hf.png) (Save).

  4.  Click **Save changes** to modify your saved search.

  5.  Click **Save**.

      Wait a moment for the save process to complete.

- To delete a saved search:

  1.  Click ![](/mulesoft/current/en-us/monitoring/_images/logs-save-icon-hf.png) (Save).

  2.  Hover over the saved search to delete.

  3.  Click ![](/mulesoft/current/en-us/monitoring/_images/logs-delete-icon-hf.png) (Delete).

## Move and Remove Columns in the Results

After adding optional columns to the log **Results** table, such as **Application** and **Log
level**, you can move and remove them.

Hover over the column heading, such as **Log level**, to reveal column options:

- To move a column, use the arrow to move the column to the left or right.

- To remove a column, click the **X**.

- To sort the data in the column in ascending or descending order, click its up-down arrow to switch
  the sorting order.

## Refresh Log Data (Manually and Automatically)

You can refresh log data manually and autorefresh on a regular basis:

- To refresh manually, click **Refresh**.

- To autorefresh on a regular basis:

  1.  Click ![](/mulesoft/current/en-us/monitoring/_images/logs-calandar-icon-hf.png) (Calendar).

  2.  Under **Refresh every**, provide a number and time unit (seconds, minutes, or hours), such as
      **5 minutes**.

  3.  Click **Start** to initiate the autorefresh process.

## Download Log Results as a CSV File

Download log search results for up to 10,000 log records into a CSV file.

1.  Add columns for log fields you want in your report to the log **Results** table.

    For guidance, see [Move and Remove Columns in the Results](#adjust-columns).

2.  Run your search query.

    For guidance, see [Search for Logs](#search-logs).

3.  Click **Download as CSV**.

## Get Logs for Agentic Assets

API Manager and Agent Visualizer provide links to logs for agent-related assets (agent, broker, and
MCP server instances):

- In Agent Visualizer, click a node in the visual graph, and navigate to logs. For guidance, see
  [Access Logs](https://docs.mulesoft.com/agent-visualizer/troubleshoot-agent-network#access-logs) in the Agent Visualizer
  documentation.

  For more information about Agent Visualizer, see
  [Agent Visualizer Overview](https://docs.mulesoft.com/agent-visualizer/).

- In API Manager, navigate to **Agent and Tool Instances**, and click an instance:

  - To find logs for policies applied to agents, brokers, and MCP servers, click **Message Log**,
    and then click **View logs in Anypoint Monitoring**.

  - For a broker’s reasoning logs, click **Message Log**, and then click the button dedicated to the
    broker. These logs come from the broker application.

    > [!IMPORTANT] By default, broker logs include the actions the broker takes (including agents
    > called and MCP tools executed), but they don’t include reasoning data due to potential logging
    > of personally identifiable information.

    If your organization opts to enable a broker’s reasoning logs, set the broker’s `category` field
    in Runtime Manager:

    `INSECURE-LOGGING` category to `DEBUG`

## Format Customized Logs in On-Premises Servers for Proper Indexing

Logs produced by apps with customized logging (by changing the pattern layout in the `log4j2.xml`
file) can fail to index correctly into Anypoint Monitoring. To ensure correct indexing, use the Mule
default pattern layout, which is one of the following:

- `<PatternLayout pattern="%-5p %d [%t] [event: %X{correlationId}] %c: %m%n" />`, or

- `<PatternLayout pattern="%d [%t] %-5p %c - %m%n" />`

For applications deployed to CloudHub and Anypoint Runtime Fabric with customized time zones:

Don’t override the default JVM time zone for applications deployed to CloudHub and Anypoint Runtime
Fabric with customized time zones. The time zone must be UTC. Changing the time zone to a local time
zone causes logs to be indexed in Anypoint Monitoring with incorrect timestamps.

## Data Retention and Management for Logs

Log storage limits for your subscription tier determine your retention and aren’t based on a set
amount of time. For details, see [Storage and Retention](https://docs.mulesoft.com/monitoring/am-faq#storage-and-retention).

For other limitations on logs, see [Log Management](https://docs.mulesoft.com/monitoring/am-faq#logging-data-management).

## Reference

Get descriptions of fields and filter options:

- [Log Field Names](#field-names): Log field names and identifiers

- [Filter Options](#filter-options): Options for enabling, disabling, inverting, including,
  excluding, editing, and deleting filters

### Log Field Names

Log field names in the UI have field identifiers that appear in filter labels and
[saved search labels](#save-search). [Query DSL filters](#filter-query-dsl) require field
identifiers.

- **Application** (`appId`): Name of the application

- **Class** (`class`): Class name

- **Environment** (`envId`): Environment identifier

- **Event** (`event`): Identifier for the associated Mule event

- **Log level** (`log-level`): Log value such as INFO, WARN, ERROR

- **Logger** (`logger`): Name of the logger

- **Message** (`message`): Log message

- **Timestamp** (`timestamp`): Date and time of a log entry

- **Worker** (`workerId`): Identifier for the associated worker

### Filter Options

Filter options are available globally and to individual filters.

![Filter Icons](/mulesoft/current/en-us/monitoring/_images/filter-icons-hf.png)

<table><tbody><tr><td><i data-value="1"></i><b>1</b></td><td>Click the filter icon to open global filter options:<div><ul><li><p><strong>Enable all</strong> to enable all your filters</p></li><li><p><strong>Disable all</strong> to disable all your filters without deleting the filters</p></li><li><p><strong>Invert inclusion</strong> to convert filters that include matching results (such as <code>log-level: ERROR</code>) into filters that uses <code>NOT</code> to exclude matching result (such as <code>NOT log-level: ERROR</code>) and to convert filters that use <code>NOT</code> to exclude matching results into filters that include matching results</p></li><li><p><strong>Invert enabled/disabled</strong> to disable all enabled filters or to enable all disabled filters</p></li></ul></div></td></tr><tr><td><i data-value="2"></i><b>2</b></td><td>Click the filter label to open individual filter options:<div><ul><li><p><strong>Edit filter</strong> to change the filter configuration</p></li><li><p><strong>Include results</strong> to include the filter’s results in the <strong>Results</strong> table</p></li><li><p><strong>Exclude results</strong> to apply the <strong>NOT</strong> operator to the filter, which excludes its results from the <strong>Results</strong> table</p></li><li><p><strong>Temporarily disable</strong> to retain the filter without using it to return search results; switches to <strong>Re-enable</strong> when you click <strong>Temporarily disable</strong></p></li><li><p><strong>Delete</strong> to permanently delete the filter</p></li></ul></div></td></tr></tbody></table>

Any options related to pinning or unpinning filters aren’t used.