Platform container logs

Use Admin > Platform > Logs to read the container logs of the platform's services: filter them, search them, follow them live and download a window as a file. Use it when a service misbehaves and you need its own output, or when you want to see what happened around a moment.

The Logs tab stays available on installations where Services and Updates do not appear, so you can still read the platform's logs there. The other tabs are described in Platform services; for the Platform area itself and who can open it, see Platform.

Read the logs

1. Open Admin > Platform, and click the Logs tab.
2. Pick the containers to read; type in Filter containers… to find a name in the list. Until you choose, the view reads All readable containers.
3. Choose the stream: All for both output streams, stdout or stderr.
4. Choose a time range: 15m, 1h (the default), 6h, 24h, 7d or 30d. For another window, click Custom, pick the start and end, and click Apply.
5. Type in Search message text… to keep only lines whose message matches.

Each line shows the time in your time zone, the container it came from while more than one container is in view, and the message. Lines from the error stream are tinted.

Scroll up to load older lines above the ones you are reading, until the start of the range or the view's line limit. The chart above the list counts lines over time: click a bar to narrow the view to that period, click Zoom out to widen it again, or Back to last 1h to return to the default window.

Follow new lines

1. Turn on Live to follow lines as they arrive. The view opens with the lines from the last few minutes, so the pane has context straight away; if the connection drops, it reconnects on its own.
2. Stay at the newest line to follow along. If you scroll up, new lines are counted in a pill, like "12 new lines"; click it to jump back to the newest line.
3. For a fixed window, turn Live off and click Refresh to reload the view by hand.

Download the logs

1. Click Download and choose Plain text (.txt) or ND-JSON (.ndjson).
2. The text file carries one line per entry, in the form <time> [<container>] <message>. The ND-JSON file carries the raw records, one JSON object per line.
3. A download uses your current containers, stream, range and search. It is not limited to the lines on screen, and it includes at most 100,000 entries.

Download needs Export Container Logs; if a download fails, a notice titled Download failed shows the reason, and you can try again with a shorter window.

Who can read which logs

Reading and downloading are granted separately, so a role can read logs and still not download them.

Leaving the container filter empty does not read everything: it reads the containers your role permits that also logged in the window. If a filter or an address names a container your role cannot read, the page refuses it with "Access denied. You do not have permission to read logs for <container>".

Platform Administrator holds all of these; Platform Viewer reads application logs, without the data tier and without downloads. Permissions are assigned on a role; see Roles and permissions and the Permission reference.

Limits and edge cases

• Logs are kept for 30 days, and the Custom picker stops there.
• The list loads 500 lines at a time; a single log query returns at most 5,000 lines.
• The view keeps up to 10,000 lines for scrolling; once it is full, the footer reads line limit reached. Narrow the range, or click a bar in the chart, to reach further back; a download is not bound by that point.
• A view with no time range set reads the last hour.
• The container list holds what has logged in the window, not everything the installation runs: a container that wrote nothing is absent until you widen the range.
• The chart counts lines in buckets sized to the window, from a day per bar over several days down to seconds, and lines the bars up with your local day and hour boundaries.
• A Custom window switches Live off, because a fixed past window has no new lines; turning Live on returns to a range preset.
• If the log store cannot answer, the view says "Log store is unavailable"; retry in a moment. See Observability troubleshooting for the messages in this section.

Questions, answered

Who can read the container logs?

Your role needs View Container Logs for the application containers, or View Sensitive Container Logs to include the data tier. Downloads need Export Container Logs, which is granted separately. See the Permission reference.

Why do I get "Access denied" for a container?

The filter names a container your role cannot read, and the refusal names it. If it is a data-tier container, ask an administrator for View Sensitive Container Logs.

Why is a container missing from the container list?

The list holds what has logged in the selected window, not everything the installation runs. A container that wrote nothing in the window appears only after you widen the range.

Why does the window show no lines?

An empty window reads No log lines in this window., or Waiting for new lines… while Live is on, and Loading logs while it loads. If the container filter is empty and none of the containers your role may read has logged anything in the window, the page says "No readable containers have logs in the selected window". Widen the range, clear the search, or check the container filter.

Why is the live view not empty when I switch Live on?

Live opens with the lines from the last few minutes, so you have context straight away, then follows new lines from there.

How much does a download include?

Everything your filters match, not just the lines on screen, up to 100,000 entries. Narrow the window or the search to keep a download small.

How far back can I read?

30 days; the Custom picker does not reach further back. Pick 30d, or a custom window within that range.

Why can a colleague read the logs but not download them?

Reading and downloading are separate permissions: View Container Logs opens the tab and lets you read, while Export Container Logs is what enables Download. Ask an administrator to add it to the role.