Question about searching logs in Datadog.
Search works on regular strings in the CONTENT portion of the log. However, if JSON is passed to the CONTENT portion, the JSON elements are automatically parsed into Attributes. But the Attributes are NOT searchable.
How do I search for logs by Attribute?
It seems like a step backwards to supply log data in JSON to improve indexing, but then LOSE the ability to search on those elements.
You need to tell Datadog that you're interested in that content by creating a facet from the field. Click a log message, mouse over the attribute name, click the gear on the left, then Create facet for @...
For logs indexed after you create the facet, you can search with @fieldName:text*, where fieldName is the name of your field. You'll need to re-hydrate (reprocess) earlier logs to make them searchable.
You won't need to create a facet if you use fields from the standard attributes list.
The error message itself is not a good fit to be defined as a facet.
If you are using JSON and want the main message (say from a msg json field) to be searchable in the Datadog content field. Instead of making
facet for msg, you can define a "Message Remapper" in the log configuration to map it to the Content. And then you can do wildcard searches.
