Logs and metrics

Cloud.gov Logs automatically ingests application logs, service logs, and telemetry from the platform.

This data supports observability, troubleshooting, and compliance reporting across the platform.

Index patterns

All logs are only available within the logs-app* index pattern.

All metrics are only available within the logs-metrics-* index pattern.

Application logs

Any logs emitted to STDOUT or STDERR by your application will be ingested automatically.

Common filters

Common filters for application log types:

Purpose	Filter
Application logs only	@source.type: APP
Staging logs	@source.type: STG
Router request logs	@source.type: RTR

Router logs

Fields	description
rtr.*	Request information, such as rtr.staus for the HTTP response status code
geoip.*	Geolocation information for the request, such as the country name

Structured logging

If your application logs are emitted as JSON, their contents will be parsed into the app field, which is a flat_object field. You can query individual JSON keys using dot notation.

Example log:

{ "event": "login", "status": "success" }

Query:

app.event: "login" AND app.status: "success"

Some supported libraries to produce JSON logs include:

• Node.js: pino
• Python: python-json-logger
• Ruby: log_formatter

Audit events

Platform audit events record administrative actions such as app restarts, org creation, and credential updates.

Field	Description
@type	Always audit_event.
actor.*	Information about the user or process performing the action.
target.*	Resource acted upon.
type	Audit event category per Cloud Foundry spec.

To filter for all audit events:

@type: audit_event

To view specific event types:

type: audit.app.stop

Note: Cloud.gov Logs ingests audit events every 15 minutes, so there could be up to a 15-minute delay before any audit event logs appear in the system.

Brokered service logs

Currently available for brokered database services.

Field	Description
cloudwatch_logs.log_type	Always rds.
@cf.service	Specific database instance name

To filter for all brokered database logs:

cloudwatch_logs.log_type: rds

To filter for a specific database service:

@cf.service: <your-service>

Application metrics

All application metrics are derived from Diego container telemetry, excluding network byte counters (rx_bytes and tx_bytes).

Metric	Field	Unit
CPU usage	containermetric.cpu_percentage	percent
Disk usage	containermetric.disk_bytes	bytes
Disk quota	containermetric.disk_bytes_quota	bytes
Memory usage	containermetric.memory_bytes	bytes
Memory quota	containermetric.memory_bytes_quota	bytes

To filter for all application metrics:

@type: app_metric

To filter for a specific metric:

containermetric.name: cpu

Brokered service metrics

Cloud.gov Logs collects AWS CloudWatch metrics for brokered services.

S3 buckets

Metric	Field	Description
BucketSizeBytes	metric_name	Total object size within bucket

To filter for S3 metrics:

@cf.service_offering: s3

RDS databases

Metric	Field	Description
CPUUtilization	metric_name	Percent of CPU used
DatabaseConnections	metric_name	Number of active connections
FreeStorageSpace	metric_name	Free storage remaining
ReadLatency / WriteLatency	metric_name	Latency metrics for I/O operations

To filter for brokered database metrics:

@cf.service_offering: aws-rds

OpenSearch / Elasticsearch domains

Metric	Field	Description
CPUUtilization / MasterCPUUtilization	metric_name	CPU usage
FreeStorageSpace	metric_name	Remaining storage
JVMMemoryPressure / MasterJVMMemoryPressure	metric_name	JVM heap utilization
OldGenJVMMemoryPressure / MasterOldGenJVMMemoryPressure	metric_name	Percentage of JVM heap used for old generation
ThreadpoolSearchRejected / ThreadpoolWriteRejected	metric_name	Queuing rejections
ThreadpoolSearchQueue / ThreadpoolWriteQueue	metric_name	Information about queued tasks

See the AWS documentation for more precise definitions of these metrics.

To filter for OpenSearch/Elasticsearch metrics:

@cf.service_offering: aws-elasticsearch

ElastiCache clusters

Metric	Field	Description
BytesUsedForCache	metric_name	Bytes used for cache storage
CacheHitRate	metric_name	Cache hit rate percentage
DatabaseMemoryUsagePercentage	metric_name	Database memory usage as percentage
DatabaseCapacityUsagePercentage	metric_name	Database capacity usage as percentage
FreeableMemory	metric_name	Available freeable memory
MemoryFragmentationRatio	metric_name	Memory fragmentation ratio
CPUUtilization	metric_name	CPU utilization percentage
EngineCPUUtilization	metric_name	Engine CPU utilization percentage

To filter for ElastiCache metrics:

@cf.service_offering: aws-elasticache-redis

Field reference

All logs and metrics

Field	Description
@cf.org / @cf.org_id	Organization name and ID
@cf.space / @cf.space_id	Space name and ID

Application logs and metrics

Field	Description
@cf.app / @cf.app_id	Application name and ID
@cf.app_instance	Index of the application instance (e.g. 0)
@cf.process_id	Process ID
@cf.process_instance_id	ID of the application instance for the process
@cf.process_type	Type of process (e.g. web)

Application metrics

Field	Description
containermetric.name	Metric name
containermetric.unit	Unit for metric (e.g. bytes)
containermetric.value	Metric value

Brokered service logs and metrics

Field	Description
@cf.service_offering	Service offering (e.g. aws-rds)
@cf.service_plan	Service plan name
@cf.plan_id	Service plan ID
@cf.instance_id	Service instance ID
@cf.instance	Service instance name
broker	Name of broker for service

Brokered service metrics

Field	Description
metric_name	Metric name (e.g. BucketSizeBytes)
metric.average	Average metric value during collection period
metric.min	Minimum metric value during collection period
metric.max	Max metric value during collection period
metric.count	Count of metric measurements during collection period
metric.unit	Unit of measure for metric
namespace	CloudWatch namespace for the metric

Brokered Elasticsearch/OpenSearch metric fields

Field	Description
metric.domain_name	Name of Elasticsearch/OpenSearch domain
metric.node_id	ID of the domain node for metric

Brokered database metric fields

Field	Description
metric.db_instance_identifier	RDS database identifier
metric.node_id	ID of the domain node for metric

Additional fields for FreeStorageSpace metrics:

Field	Description
metric.db_size	Database size in GB at collection time
metric.usage_percentage	Percent of allocated storage used

S3 metric fields

Field	Description
metric.storage_type	Storage class used by the S3 bucket