Why exclude logs instead of just storing them?

Log Analysis bills on volume ingested. A noisy health-check that emits 10,000 lines per hour with no useful information costs the same in ingestion as 10,000 lines of actual error context. Exclusion rules drop the noise at the agent level so you only pay for logs that matter — often a 50-80% bill reduction.

What's a 'view' versus an 'alert'?

A view is a saved query — it doesn't notify anyone, but it gives operators a one-click filter for a specific perspective (errors in service X, slow requests, auth failures). An alert is a saved query plus a threshold and notification — it pages someone when the criteria are met. Views and alerts can share the same underlying query.

IBM Log Analysis Query Builder

MonitoringIBM Cloud

Build Log Analysis query configurations with saved views, alerts, exclusion rules, and archiving.

Last verified: May 2026

IBM Cloud Log Analysis Configuration

Build Log Analysis query configurations with saved views, alerts, exclusion rules, and COS archiving.

Required Fields

instanceNameviews

{
  "instanceName": "prod-log-analysis",
  "plan": "30-day",
  "region": "us-south",
  "views": [
    {
      "name": "production-errors",
      "query": "level:error OR level:fatal",
      "hosts": ["prod-web-*", "prod-api-*"],
      "apps": ["nginx", "node-api", "java-backend"],
      "levels": ["error", "fatal"],
      "tags": ["env:production"]
    },
    {
      "name": "kubernetes-events",
      "query": "source:kubernetes AND (reason:BackOff OR reason:Failed OR reason:Unhealthy)",
      "apps": ["kubernetes"],
      "levels": ["warning", "error"]
    },
    {
      "name": "slow-requests",
      "query": "response_time:>5000 AND status_code:200",
      "hosts": ["prod-api-*"],
      "apps": ["node-api"]
    }
  ],
  "alerts": [
    {
      "name": "high-error-rate",
      "type": "presence",
      "query": "level:error",
      "condition": {
        "threshold": 100,
        "timeframe": "5m"
      },
      "channels": [
        {
          "type": "pagerduty",
          "serviceKey": "pd-service-key",
          "severity": "critical"
        },
        {
          "type": "slack",
          "webhookUrl": "https://hooks.slack.com/services/xxx",
          "channel": "#ops-alerts"
        }
      ]
    },
    {
      "name": "disk-space-warning",
      "type": "presence",
      "query": "message:\"disk space\" AND level:warning",
      "condition": {
        "threshold": 1,
        "timeframe": "15m"
      },
      "channels": [
        { "type": "email", "recipients": ["ops@example.com"] }
      ]
    }
  ],
  "exclusionRules": [
    {
      "name": "exclude-health-checks",
      "query": "request_path:/health OR request_path:/ready",
      "active": true
    }
  ],
  "archiving": {
    "enabled": true,
    "cosBucket": "log-archive-bucket",
    "cosInstanceCrn": "crn:v1:bluemix:public:cloud-object-storage:global:a/acct-id:cos-id::"
  }
}

Generated Output

Output will appear here...

See It in Action

Log Analysis ingestion has crept up to $2,000/month — far more than the engineering team expected. You audit the log volume by source, find that health-check probes account for 40% of ingestion, and add exclusion rules to drop them at the agent. Next month's ingestion is half. You also build saved views for the top error patterns so on-call doesn't need to remember query syntax during incidents.

What This Tool Does

IBM Log Analysis (powered by LogDNA) is the cloud-native log aggregation service for IBM Cloud workloads, with a query language, alerting, archiving, and exclusion rules. The IBM Log Analysis Query Builder produces views (saved queries), alert definitions, exclusion rules, and archiving configurations. Output is JSON-ready for the IBM Log Analysis API and configuration-as-code for the alerts.

Technical Details

The builder collects the Log Analysis instance, query definitions (with the LogDNA query syntax: hosts, apps, levels, search terms), saved view names, alert thresholds, exclusion rules, and archive bucket configuration. Output is JSON suitable for direct API submission and a `terraform` block that wires the configuration into the Log Analysis instance.

Common Use Cases

1Setting up alerts for known error patterns (5xx responses, ERROR-level log lines) with reasonable thresholds and notification routing.
2Building exclusion rules to drop low-value logs (health-check probes, expected debug output) before they consume retention budget.
3Saving frequently-used queries as named views so the operations team has a consistent set of starting points during incident response.
4Configuring archiving to Cloud Object Storage so logs older than the retention period are preserved cheaply for compliance.

Common Questions

Why exclude logs instead of just storing them?: Log Analysis bills on volume ingested. A noisy health-check that emits 10,000 lines per hour with no useful information costs the same in ingestion as 10,000 lines of actual error context. Exclusion rules drop the noise at the agent level so you only pay for logs that matter — often a 50-80% bill reduction.
What's a 'view' versus an 'alert'?: A view is a saved query — it doesn't notify anyone, but it gives operators a one-click filter for a specific perspective (errors in service X, slow requests, auth failures). An alert is a saved query plus a threshold and notification — it pages someone when the criteria are met. Views and alerts can share the same underlying query.

Expert Tips

TIP

Tag log lines with structured fields (service, env, request_id) at the application layer. Searching unstructured logs is slow and error-prone; structured logs make the query language actually useful.

TIP

Set alert sensitivity to match your tolerance for false alarms. An alert that pages on a single error log line will burn out your on-call rotation; an alert that requires 50 error log lines in 5 minutes catches real problems without false positives.

Was this tool helpful?

Disclaimer: This tool runs entirely in your browser. No data is sent to our servers. Always verify outputs before using them in production. AWS, Azure, and GCP are trademarks of their respective owners.