Platform container logs

Use Observability > Logs > Platform to read the container logs of your DataMind OS services: search them, filter them, move through time, follow new lines live and export what you found. Use it when a service misbehaves and you need its own output, or to see what happened around a moment.

The Platform sub-tab opens with View Container Logs or View Sensitive Container Logs, even without the audit-log permission. The sub-tabs beside it are described in Audit, sign-in and notification logs.

Open the logs

1. In the sidebar, open Observability, click Logs, then the Platform sub-tab.
2. Or start from Admin > Update: a service's logs button, or Open logs in its details, opens this view filtered to that service's container. See Services and job logs.

The view has four parts, top to bottom: the query bar, the time bar, the histogram and the lines. An old link to the Logs tab of Admin > Platform opens this view with its filters.

Search and filter

Everything that decides which lines you see sits in the query bar:

1. Type in Search logs. Enter to apply. The search applies when you press Enter, or 400 ms after you stop typing. Press / anywhere on the page to jump to the box, and Esc to empty it.
2. Choose how the search matches, in the button beside the box:

3. Pick levels: Error, Warn, Info or Debug. They are matched on the message text. With none selected, every level shows.
4. Pick the stream: All, stdout or stderr.
5. Pick containers. The picker reads All containers until you choose, then the container's name, or a count such as Containers · 3 of 29. Type to filter the list. It lists only the containers your role can read that logged in the selected window.
6. Hide noise: type in Exclude text, Enter to add and press Enter. A line that contains an excluded term, in any case, is hidden. You can add up to 10 terms; click a term's cross to stop excluding it.
7. Click Clear to reset the search, levels, stream, containers and exclusions. The time window, Live, the match mode and the view options stay.

Matches are highlighted in the lines. If the log store refuses the search, for example a regex that does not compile, a line under the query bar reads Log query rejected: with the reason, and the lines you had stay on screen.

Choose the time window

The time bar sets when to look:

• 15m, 1h, 6h, 24h, 7d or 30d read the latest window of that length. 1h is the default.
• Custom picks an absolute start and end. Click Apply. Logs are kept for 30 days, so the picker stops there.
• The window's exact bounds are always written out beside the presets, such as 13:05:12 → 14:05:12 · today.
• Jump to opens 5 minutes either side of a moment you pick. Click Jump.
• Zoom out widens a picked window one step. It appears while a custom window is shown.
• Local or UTC sets the time zone of every time on the page.

A custom window, a jump and a bar of the histogram are fixed slices of the past, so they turn Live off.

Read the histogram

The histogram counts the lines of the window per time bucket, and shows the total, such as "1,284 lines in window". Bars are sized to the window, from a day per bar down to seconds. Click a bar to narrow the window to it; click bars again to zoom further.

Read the lines

The list header reads "Showing <n> of <m> · newest at bottom" once the total is known, "Showing <n> · newest at bottom" before it is, or "<n> streamed lines · newest at bottom" while Live is on, with " · paused" appended while the stream is paused. The newest line sits at the bottom; scroll up to load older lines, up to 10,000. Past that, the top of the list reads "10,000-line limit reached - narrow the range or click a bar in the chart above for older lines". At the start of the window, it reads "Start of the selected time range".

• Wrap wraps long lines; turn it off to keep each line on one row.
• Timestamps shows Short times, such as 13:04:05.123, or Full ones, such as 2026-10-18 13:04:05.123.
• With both streams in view, lines from stderr carry an amber marker. Lines detected as failures carry a red one, whatever the stream.
• The container name shows on each line while more than one container is in view.

Hover a line for its actions:

Right-click a line for the same actions, plus Copy link, a link to that moment, and Copy selection when you have selected text.

With the list focused, Up and Down move between lines, Enter expands the line, c copies it, and Esc leaves it.

Follow new lines with Live

1. Click Live to stream new lines as they arrive. Its dot pulses green while lines stream, turns amber while the connection reconnects on its own, and red when the log store rejected the query; change the query to stream again, and its tooltip reads "The query was rejected. Change it to stream again".
2. Stay at the newest line to follow along. Once you scroll up, new lines are counted in a pill, such as "12 new lines"; click it to jump back to the newest line.
3. Click Pause to stop the stream and keep the lines you have; Resume starts it again. Click Live again to turn it off.

An empty list reads "Waiting for new lines", "Paused. Resume to stream new lines" while the stream is paused, or "The query was rejected. Change it to see lines" when the log store refused the query.

While Live is on, Refresh is greyed out. Turn Live off and click Refresh to reload the window by hand.

Share or export a view

Every filter, the window, the time zone and the view options are in the page's address. Copy the address to share or bookmark the exact view; opening it restores it.

To export:

1. Click Export and choose Plain text (.txt), ND-JSON (.ndjson) or CSV (.csv).
2. The browser saves container-logs- plus a timestamp, with the format's extension. The export holds the current query, not just the lines on screen, up to 100,000 lines. A CSV file opens correctly in Excel.

Export needs Export Container Logs. If an export fails, a notice titled Export failed shows the reason; try again with a shorter window.

Who can read which logs

Reading and exporting are granted separately, so a role can read logs and still not export them. An export never covers more containers than your role can read. The data-tier logs can contain connection strings and query text, which is why they sit behind their own permission. If a filter or an address names a container your role cannot read, the page refuses it with "Access denied. You do not have permission to read logs for <container>".

Platform Administrator holds all of these; Platform Viewer reads application logs, without the data tier and without exports. See Roles and permissions and the permission reference.

Limits and edge cases

• Logs are kept for 30 days, and the Custom and Jump to pickers stop there.
• Older lines load 500 at a time, up to 10,000 in the list. An export is not bound by that point; it holds up to 100,000 lines.
• The container picker lists what has logged in the window, not everything the installation runs; when nothing has, it reads "No container has logged in this window". Widen the window to find a quiet container.
• An empty window reads "No log lines in this window", or "No lines match these filters" with Clear filters. Widen to 24h appears for a window shorter than a day. With Live on, an empty list reads "Waiting for new lines", or "Paused. Resume to stream new lines" while the stream is paused. A query the log store refused reads "The query was rejected. Change it to see lines".
• If an older page cannot load, the top of the list reads "Could not load older lines:" with the reason and Retry.
• If the log store cannot answer, the view says "Log store is unavailable"; retry in a moment. See Observability troubleshooting for the messages in this section.

Questions, answered

Who can read the container logs?

Your role needs View Container Logs for the application containers, or View Sensitive Container Logs to include the data tier. Exports need Export Container Logs, which is granted separately. See the permission reference.

How do I search case-insensitively with a regex?

Start the pattern with (?i), for example (?i)timeout|refused. Regex is case-sensitive otherwise; Contains always ignores case.

Why does my search say "Log query rejected"?

The log store could not run the search, most often a regex that RE2 cannot compile. The reason follows the message, and the lines you had stay on screen. Fix the pattern, or switch the match to Contains.

How do I read only errors?

Select the Error level chip. It matches the message text, so it finds error lines on either stream. stderr shows the error stream only, which can also hold ordinary lines.

How do I hide noisy lines?

Type the noisy text in Exclude text, Enter to add and press Enter. Every line that contains it, in any case, is hidden. Up to 10 terms can be excluded at once.

How do I see what happened around one line?

Hover the line and click Show context (30s either side). The window becomes 30 seconds either side of it, with both streams, every level and no search, so you see everything the containers wrote around it.

Can I share a log view?

Yes. Every filter is in the page's address, so sharing the address shares the exact view. To point at one moment, right-click a line and choose Copy link.

Why is a container missing from the picker?

The picker lists only the containers your role can read that logged in the selected window. Widen the window if the container was quiet; reading the data tier needs View Sensitive Container Logs.

Why can't I scroll further back than 10,000 lines?

The list keeps up to 10,000 lines so it stays fast. Narrow the window, or click a bar in the histogram, to reach further back. An export is not limited by this point.

How much does an export include?

Everything the current query matches, not just the lines on screen, up to 100,000 lines. Narrow the window or the search to keep it small.

Why did Live turn off?

A custom window, Jump to, Show context and a histogram bar each show a fixed slice of the past, which has no new lines. Click Live to return to the latest window and stream again.

What time zone are the times in?

Your device's, unless you switch the time bar to UTC. The choice applies to every time on the page and is kept in the address.