Filter Logs

Each log has a filter area that allows you to set a criteria for which log entries to display. The ability to filter logs is useful for focusing on events on your firewall that possess particular properties or attributes. Filter logs by artifacts that are associated with individual log entries.
Logs_filter_with_entries.png
  1. (
    Unified logs only
    ) Select the log types to include in the Unified log display.
    1. Click Effective Queries (  unified_logs_icon.PNG  ).
    2. Select one or more log types from the list (
      traffic
      ,
      threat
      ,
      url
      ,
      data
      ,
      wildfire
      ,
      tunnel
      , or
      auth
      ).
    3. Click
      OK
      . The Unified log updates to show only entries from the log types you have selected.
  2. Add a filter to the filter field.
    If the value of the artifact matches the operator (such as
    has
    or
    in
    ), enclose the value in quotation marks to avoid a syntax error. For example, if you filter by destination country and use IN as a value to specify INDIA, enter the filter as
    ( dstloc eq “IN” )
    .
    • Click one or more artifacts (such as the application type associated with traffic and the IP address of an attacker) in a log entry. For example, click the Source
      10.0.0.25
      and Application
      web-browsing
      of a log entry to display only entries that contain both artifacts in the log (AND search).
    • To specify artifacts to add to the filter field, click Add Filter (  add_icon.png  ).
    • To add a previously saved filter, click Load Filter (  icon_load_filter.png  ).
  3. Apply the filter to the log.
    Click Apply Filter (  Submit_icon.png  ). The log will refresh to display only log entries that match the current filter.
  4. (
    Optional
    ) Save frequently used filters.
    1. Click Save Filter (  icon_save_filter.png  ).
    2. Enter a
      Name
      for the filter.
    3. Click
      OK
      . You can view your saved filters by clicking Load Filter (  icon_load_filter.png  ).
    Next Steps...

Related Documentation