| 1 | # Logs tab |
| 2 | |
| 3 | The Logs tab provides a structured, searchable view of logs collected from across your infrastructure, supporting multiple log sources depending on the Node's operating system. |
| 4 | |
| 5 | ## Log sources |
| 6 | |
| 7 | The Logs tab displays log entries from the following sources: |
| 8 | |
| 9 | - **systemd-journal** — reads logs from `systemd` journald on Linux Nodes. See the [Systemd Journal Plugin Reference](/src/collectors/systemd-journal.plugin/README.md) for details on journal sources, fields, and query performance. |
| 10 | - **otel-logs** — displays logs received via OpenTelemetry (OTLP) log ingestion. See the [OpenTelemetry Signal Viewer plugin](/src/crates/netdata-log-viewer/otel-signal-viewer-plugin/README.md) for setup and configuration. |
| 11 | - **Windows Event Logs** — reads Windows event logs on Windows Nodes. See the [Windows Events Plugin Reference](/src/collectors/windows-events.plugin/README.md) for supported event channels and configuration. |
| 12 | |
| 13 | :::note |
| 14 | |
| 15 | On Linux systems without systemd (such as Alpine Linux), the systemd-journal source is unavailable. You can still send logs to Netdata by using `systemd-cat-native --url` to forward to a remote `systemd-journal-remote`, or by using OTLP log ingestion. See [Working with Logs](/docs/category-overview-pages/working-with-logs.md) for details. |
| 16 | |
| 17 | ::: |
| 18 | |
| 19 | You can also display custom application logs, such as web server access logs, under the systemd-journal source by piping them into `systemd` journald using [log2journal](/src/collectors/log2journal/README.md) and [systemd-cat-native](/src/libnetdata/log/systemd-cat-native.md). For example, use the built-in `nginx-combined` log2journal configuration to pipe nginx access logs. |
| 20 | |
| 21 | :::tip |
| 22 | |
| 23 | For comprehensive documentation on log centralization and configuration, see [Working with Logs](https://learn.netdata.cloud/docs/logs). To keep custom log pipelines running persistently, create a systemd service unit and use `LogNamespace` to isolate piped logs from system journal entries. See the [log centralization points guide](/docs/observability-centralization-points/logs-centralization-points-with-systemd-journald/README.md) and [Monitor Nginx or Apache web server log files](/docs/developer-and-contributor-corner/collect-apache-nginx-web-logs.md) for setup details. |
| 24 | |
| 25 | ::: |
| 26 | |
| 27 | ## systemd journal plugin reference |
| 28 | |
| 29 | The systemd journal plugin is the primary log source for Linux systems. The [`systemd` journal plugin](/src/collectors/systemd-journal.plugin/README.md) documentation covers: |
| 30 | |
| 31 | - [Key features the plugin provides](/src/collectors/systemd-journal.plugin/README.md#key-features) |
| 32 | - [Journal sources](/src/collectors/systemd-journal.plugin/README.md#journal-sources) |
| 33 | - [Journal fields](/src/collectors/systemd-journal.plugin/README.md#journal-fields) |
| 34 | - [Full-text search](/src/collectors/systemd-journal.plugin/README.md#full-text-search) |
| 35 | - [Query performance](/src/collectors/systemd-journal.plugin/README.md#query-performance) |
| 36 | - [Performance at scale](/src/collectors/systemd-journal.plugin/README.md#performance-at-scale) |
| 37 | |
| 38 | We recommend reading through that document to better understand how the plugin and the visualizations work. |