Search OpenTelemetry logs in the console

Set up OpenTelemetry with Authdog gets traces, logs, and metrics into an environment. This note is the console side of that path: where those logs show up, and how to narrow them.

The September 12 changelog entry added Observability under the selected project and environment. Open Observability (/dashboard/observability) after the exporter has been sending OTLP/HTTP JSON.

What the Logs tab is for

Overview counts signals in the current time range. Logs is the place to read individual records.

The page keeps the same time range as the rest of the console. Last 24 hours, last 2 days, and the other ranges apply to the chart, the facets, and the table together.

A row is one log: time, severity, service, message, and trace. Click the trace id to open that trace on the Traces tab. Click the row for the attributes that came in with the record.

Application telemetry stays separate from Audit. Sign-in and admin events still live on the Audit screens. A log that says oauth2.callback ok is an application signal, not an audit row.

Query the same way you would search

The query field accepts tokens plus free text:

Token	Matches
severity:INFO	Severity text on the log
service:authdog-identity	service.name from the resource
scope:authdog.oauth2	Instrumentation scope name
trace: plus a trace id	Logs that share that trace

Anything left over is matched against the message body. severity:ERROR signup keeps error logs whose body contains signup.

Quote a value that contains a space: scope:"authdog.oauth2".

The facet rail lists severity, service, and scope for the whole time range, with counts. Checking a facet writes the same token into the query. Counts are not limited to the 25 rows on the current page.

The volume chart is a timeline of that range. Hours with no logs sit at zero. A spike is a bucket that received records, not a bar stretched across the empty hours.

OTLP is the default reading: severity text and the log body as exported. Google reads the same environment's logs with Cloud Logging field names: a Google severity (INFO, WARNING, ERROR, and the rest of that enum) and the message from the text or JSON payload. Tenancy does not move. The environment is still the one that owns the adenv_ secret used at ingest.

Confirm the export landed

1. Select the project and environment that own the API secret from the setup post.
2. Open Observability → Logs and set the time range to cover the export.
3. Search service: plus the service.name your app sends.
4. Open a trace id and confirm the span is on the Traces tab.

If the range is empty, the page says there is no telemetry yet and points at Settings, where you mint the environment API secret scoped for ingest. The setup post covers the exporter variables. The OpenTelemetry docs repeat the endpoint and the JSON-only protocol.

Saved filters on the toolbar store a set of explorer filters for that environment. They do not change which environment the secret writes to.