Following a request

The Request tab shows every line of one request in order, across threads and files, with the time between them.

One request followed through a folder of logs and a zip, in order by time

Starting

If the line has no ID, Logsift says so: select the text to follow and try again.

IDs it recognizes: traceId=…, request_id: …, X-Request-Id, "correlationId":"…" and any other key ending in id, the [app,traceId,spanId] and [traceId-spanId] that tracing libraries add, a W3C traceparent, and UUIDs. Process, thread and span ids are left out. With several IDs on a line, traces come first, then requests.

What it shows

The top line sums it up: 6 lines · 2 threads · 10:02:19.097 → 10:02:27.337 (8.24 s) · 1 error · longest wait 8.20 s (marked).

Column Shows
File Which file the line is in (only when the request spans several files)
Time When it happened
After Time since the line before
Thread, Level, Message As in the log. Levels: red errors, dark amber warnings

The longest wait is in bold amber in the After column, and the table scrolls to it. That is usually where the time went. It is marked when it is at least a third of the whole request and 100 ms or more.

Click a line to go there in the log. Double-click a line of another file to open that file there.

Options

Up to 5,000 lines of one request are shown.