Logs and Platform Capabilities
What this domain tests
This domain covers how logs reach New Relic, how they are parsed and linked to traces, and the platform features that tie everything together: NRQL, dashboards, alert policies and workflows, the entity model, accounts and access, and the APIs used to automate them.
Core rules
- Ingestion paths include the Log API (HTTP POST with a license key), APM agent log forwarding, infrastructure agent log forwarding, Fluentd/Fluent Bit plugins and cloud log exports.
- Logs in context requires the agent to decorate records with trace.id, span.id and entity.guid, so a log line links to the trace that produced it. Without forwarding enabled and a matching log format, the link is missing.
- Parsing rules, including Grok patterns, run at ingest and turn raw text into queryable attributes such as level or status. Obfuscation and masking rules remove or hash sensitive values before storage.
- Logs share NRQL with everything else:
SELECT count(*) FROM Log WHERE level = 'ERROR' FACET host SINCE 1 hour ago. Use aparse() for ad-hoc parsing of unstructured attributes. - Retention is short for logs compared with metrics; a query over a long window silently returns only what is still stored.
- Platform layer: entity model and relationships, workloads for grouping, dashboards with entity-scoped charts, alert policies with workflows and destinations, NerdGraph and the Terraform provider for automation, accounts and sub-accounts for isolation and billing, authentication domains with SAML/SCIM for access.
Worked example
A team wants an alert on checkout error logs. First confirm the logs are parsed so level is an attribute; raw JSON left unparsed means the condition counts nothing. Then write SELECT count(*) FROM Log WHERE level = 'ERROR' AND service.name = 'checkout', set a static condition above 50 in a 5-minute window, and attach a workflow with an email destination. Check retention and ingest latency first: asynchronous logging can arrive seconds late, so a very short window may under-count.
Traps
- Using a user API key where an ingest license key is required.
- Assuming log and APM error counts match; sampling, async flushing and multi-line stack traces split across records all cause drift.
- Querying past retention and reading the empty result as 'no errors'.
- Alerting on an attribute that the parsing rule never produced.