Collect and view logs

This article describes the basic concepts of log aggregation. The following log level options are available:

• prod: logs contain only error messages and warnings.
• dev: logs contain error messages, warnings, informational messages, and debug messages.

The default log level is prod unless you specify the dev option before installation. You can also change the log level for a particular server or component, except for RPA servers. Learn more in Change log level for components.

The log aggregation solution consists of the following components:

• Kibana with dashboards for filtering logs
• Elasticsearch for storing log data
• Logstash for aggregating and forwarding log records

The log aggregation process is as follows:

1. A service writes logs in the JSON format and stores them next to itself on the filesystem.

   note

   JSON log files are currently supported only for the following components: BEP services, BEP Workers (Control Tower and AutoML), AutoML services, and Control Tower.

2. The Filebeat component reads the JSON log file, parses it, and sends it to Logstash.

3. Logstash reads the parsed JSON and sends it to Elasticsearch in the ES format with specific fields.

   Element	Description	Example
   component	The component name.	wfagent, workfusion, nginx
   hostname	The actual hostname of the server that sends logs.	master.workfusion.com
   date	The date when a log event was created on the source server. Format: YYYY-MM-DD. The date is based on UTC and may differ from the timezone configured on the server.	2025-11-30
   filename	The log filename	metrics.log, status-agent-error.log

   Example: nginx/myserver-ct1.workfusion.com/2025-02-13/nginx_error.log.

All logs are retained both on the source server and on the Master server, but with different retention policies.

info

You can also view logs for services that failed to start or initialize logging. For more information on browsing logs, see Search specific message in logs.