Log Management and Platform Capabilities
What the domain tests
Log Management and Platform Capabilities covers ingestion, parsing, logs in context, retention, and platform programmability: NRQL, NerdGraph, APIs, Terraform, and access control. The exam tests whether your logs are queryable and your automation is safe.
Core rules
- Logs arrive through the infrastructure agent, APM agent log forwarding, the Log API, Fluent Bit/Fluentd, Kubernetes, and cloud firehoses or Lambda.
- Parsing rules (Grok, regex, JSON) create attributes used for faceting and alerts. Unparsed logs are hard to query reliably.
- Logs in context link log lines to traces and entities through trace/span IDs and entity GUIDs; forwarding and enrichment must be configured.
- Retention and partitioning vary by data type; Data Plus extends retention. Obfuscation and drop filters reduce sensitive or low-value data.
- Platform: the One Data model stores events, metrics, traces, and logs; NRQL queries them; NerdGraph is the GraphQL API; Terraform and the CLI support repeatable configuration.
- Roles and accounts govern access; APIs have rate limits.
Worked example
A log alert never fires. Live tail shows level=ERROR is inside an unstructured message, so level is not a facet. Add a Grok parsing rule, verify the attribute in live tail, then alert on level = 'ERROR' with an evaluation window that covers ingestion delay. Reason: the alert logic was correct; the data model was not.
Traps
Querying unparsed fields; forgetting ingestion delay; assuming all logs share retention; exposing secrets before obfuscation; ignoring NerdGraph rate limits; granting broad roles for a narrow automation.