Logs and metrics
Cloud.gov Logs automatically ingests application logs, service logs, and telemetry from the platform.
This data supports observability, troubleshooting, and compliance reporting across the platform.
Index patterns
All logs are only available within the logs-app* index pattern.
All metrics are only available within the logs-metrics-* index pattern.
Application logs
Any logs emitted to STDOUT or STDERR by your application
will be ingested automatically.
Common filters
Common filters for application log types:
| Purpose | Filter |
|---|---|
| Application logs only | @source.type: APP |
| Staging logs | @source.type: STG |
| Router request logs | @source.type: RTR |
Router logs
| Fields | description |
|---|---|
rtr.* | Request information, such as rtr.staus for the HTTP response status code |
geoip.* | Geolocation information for the request, such as the country name |
Structured logging
If your application logs are emitted as JSON, their contents will be parsed into
the app field, which is a flat_object field.
You can query individual JSON keys using dot notation.
Example log:
{ "event": "login", "status": "success" }
Query:
app.event: "login" AND app.status: "success"
Some supported libraries to produce JSON logs include:
- Node.js:
pino - Python:
python-json-logger - Ruby:
log_formatter
Audit events
| Field | Description |
|---|---|
@type | Always audit_event. |
actor.* | Information about the user or process performing the action. |
target.* | Resource acted upon. |
type | Audit event category per Cloud Foundry spec. |
To filter for all audit events:
@type: audit_event
To view specific event types:
type: audit.app.stop
Brokered service logs
Currently available for brokered database services.
| Field | Description |
|---|---|
cloudwatch_logs.log_type | Always rds. |
@cf.service | Specific database instance name |
To filter for all brokered database logs:
cloudwatch_logs.log_type: rds
To filter for a specific database service:
@cf.service: <your-service>
Application metrics
All application metrics are derived from Diego container telemetry, excluding network byte counters (rx_bytes and tx_bytes).
| Metric | Field | Unit |
|---|---|---|
| CPU usage | containermetric.cpu_percentage | percent |
| Disk usage | containermetric.disk_bytes | bytes |
| Disk quota | containermetric.disk_bytes_quota | bytes |
| Memory usage | containermetric.memory_bytes | bytes |
| Memory quota | containermetric.memory_bytes_quota | bytes |
To filter for all application metrics:
@type: app_metric
To filter for a specific metric:
containermetric.name: cpu
Brokered service metrics
Cloud.gov Logs collects AWS CloudWatch metrics for brokered services.
S3 buckets
| Metric | Field | Description |
|---|---|---|
BucketSizeBytes | metric.name | Total object size within bucket |
To filter for S3 metrics:
@cf.service_offering: s3
RDS databases
| Metric | Description |
|---|---|
CPUUtilization | Percent of CPU used |
DatabaseConnections | Number of active connections |
FreeStorageSpace | Free storage remaining |
ReadLatency / WriteLatency | Latency metrics for I/O operations |
To filter for brokered database metrics:
@cf.service_offering: aws-rds
OpenSearch / Elasticsearch domains
| Metric | Description |
|---|---|
CPUUtilization / MasterCPUUtilization | CPU usage |
FreeStorageSpace | Remaining storage |
JVMMemoryPressure / MasterJVMMemoryPressure | JVM heap utilization |
OldGenJVMMemoryPressure / MasterOldGenJVMMemoryPressure | Percentage of JVM heap used for old generation |
ThreadpoolSearchRejected / ThreadpoolWriteRejected | Queuing rejections |
ThreadpoolSearchQueue / ThreadpoolWriteQueue | Information about queued tasks |
See the AWS documentation for more precise definitions of these metrics.
To filter for OpenSearch/Elasticsearch metrics:
@cf.service_offering: aws-elasticsearch
Field reference
All logs and metrics
| Field | Description |
|---|---|
@cf.org / @cf.org_id | Organization name and ID |
@cf.space / @cf.space_id | Space name and ID |
Application logs and metrics
| Field | Description |
|---|---|
@cf.app / @cf.app_id | Application name and ID |
@cf.app_instance | Index of the application instance (e.g. 0) |
@cf.process_id | Process ID |
@cf.process_instance_id | ID of the application instance for the process |
@cf.process_type | Type of process (e.g. web) |
Application metrics
| Field | Description |
|---|---|
containermetric.name | Metric name |
containermetric.unit | Unit for metric (e.g. bytes) |
containermetric.value | Metric value |
Brokered service logs and metrics
| Field | Description |
|---|---|
@cf.service_offering | Service offering (e.g. aws-rds) |
@cf.service_plan | Service plan name |
@cf.plan_id | Service plan ID |
@cf.instance_id | Service instance ID |
@cf.instance | Service instance name |
broker | Name of broker for service |
Brokered service metrics
| Field | Description |
|---|---|
metric.name | Metric name (e.g. BucketSizeBytes) |
metric.average | Average metric value during collection period |
metric.min | Minimum metric value during collection period |
metric.max | Max metric value during collection period |
metric.count | Count of metric measurements during collection period |
metric.unit | Unit of measure for metric |
namespace | CloudWatch namespace for the metric |
Brokered Elasticsearch/OpenSearch metric fields
| Field | Description |
|---|---|
metric.domain_name | Name of Elasticsearch/OpenSearch domain |
metric.node_id | ID of the domain node for metric |
Brokered database metric fields
| Field | Description |
|---|---|
metric.db_instance_identifier | RDS database identifier |
metric.node_id | ID of the domain node for metric |
Additional fields for FreeStorageSpace metrics:
| Field | Description |
|---|---|
metric.db_size | Database size in GB at collection time |
metric.usage_percentage | Percent of allocated storage used |
S3 metric fields
| Field | Description |
|---|---|
metric.storage_type | Storage class used by the S3 bucket |