This content has been archived and is no longer being updated. Links may not function; however, this content may be relevant to outdated versions of the product.

Pega log files in Kibana

You can use Kibana to view and visualize Pega log files for all nodes in a cluster if you use ELK (Elasticsearch, Logstash, Kibana) for log management. For information about configuring ELK, see Configuring ELK for log management. For information about configuring the Pega 7 Platform to access Kibana, see Viewing log files in an external log viewer in the Pega Platform online help.

The following information about the fields that you can view in the Pega log file and Kibana searches and views is intended to get you started with Kibana. For more information about using Kibana, see the Kibana User Guide.

Pega log file fields

The following fields are displayed for each entry in the log file:

  • @timestamp - The time when the log entry was generated.
  • level - The log level for this message: DEBUG, INFO, WARN, ERROR, or ALERT.
  • app - The name of the application where the log entry was generated, for example, PegaDM: 07.10.
  • userid - The user ID associated with this log message if the message originated from a user session.
  • nodeid - The node ID that generated this error message. If you only have one node per host, the host field might also be useful.
  • message - The body of the log message.
  • logger_name - The name of the Log4j logger that output this message, which is useful for understanding where the message came from. These are also the logger names used to change individual log levels.
  • pegathread - The Pega thread name that generated the log message, for example, STANDARD or TABTHREAD0.
  • thread_name - A value like PegaRULES-Batch-5.

The following fields are only displayed for stack traces:

  • exception.exception_class - The class of the Java exception that was thrown.
  • exception.exception_message - The message portion of the stack trace.
  • exception.stacktrace - The actual stack trace.

​The following fields might also be displayed:

  • class - The class, which might be useful for determining where the log message originated. The originator is often LogHelper.
  • line_number - The line number from which the logging request was issued.

Searches and log views

You might find the following searches and log view examples useful for viewing Pega log files. For additional search examples, see Query String Query.

Standard log view

Before you begin searching, set up a standard log view, or search, that you can use as a starting point for other searches. Set up the columns that you find most useful, and use the time picker to select an appropriate viewing window. Refresh the screen and save this search.

Search by log level

In the standard log view, configure the search, for example:

  • level:Error - Shows only error alerts.
  • level:Error or level:warn - Shows warnings and errors.

Show exceptions

Add the exception.exception_class, exception.exception_message, and exception.stacktrace fields to the standard log view. You can also remove other fields that might not be relevant.

Search by user

In the standard log view, set up the following search:

userid:<user id>

Search by batch requester

In the standard log view, set up the following search:

thread_name: Batch

Search by logger

In the standard log view, set up the search logger_name: <logger or portion of logger name>. For example, you can use this search to find log messages that were output by a specific activity. To search for an activity named TestLog, search for:

logger_name: *TestLog*

Search by alert

You can search for specific alerts and monitor the number of those alerts in the cluster. For example, to search for PEGA0001 alerts, search for:

message: PEGA0001

​Custom Dashboards

You can create custom dashboards by using saved searches and saved visualizations to see different views of the log data so that you can better analyze issues.


The following tips can help you get started with Kibana searches.

  • Add or remove fields by using the left pane.
  • If your view does not have a field (for example, exception stack trace), expand the row and click it to open the entire log message.
  • Use the time picker in the upper right of the screen to filter the time period and set up auto refresh.
  • Search for specific alert types (for example, PEGA0001) to see their relative quantity across days and nodes. The basic configuration indexes Pega alerts; however, it does not parse individual alert fields.

83% found this useful

Related Content

Have a question? Get answers now.

Visit the Collaboration Center to ask questions, engage in discussions, share ideas, and help others.