What it is for
This is the screen that opens the day. Each row is an error, not an event: if the same exception blew up eight hundred times, it takes one row with the number 800 beside it. Without that, one error in a burst pushes everything else off the first screen and hides the new problem.
What merges occurrences into one row is the fingerprint: a
digest of exception class, normalized message and top of the stack. Normalized
means with numbers, GUIDs, memory addresses and file paths replaced by markers,
because Access violation at 004A1B2C and at 004B2C3D
are the same bug.
How to use it
- The band at the top answers "is today worse than yesterday?" before any click: total, distinct errors, how many customers, and the change against the previous period.
-
The expression is the search line.
classe:Timeout customer:ACME -ambiente:staging. It has its own entry, under Searching by expression. - The facets on the side are the path to discovery: each dimension with its count. Clicking filters; the marker appears at the top and clicking it removes the filter.
- The whole dimension: the sidebar shows the most frequent values, not all of them. Clicking a dimension label opens its own screen, with every value and a count for each. That is where "how many distinct versions are there anyway" gets answered.
The default order is by volume, not by date. A new error with one occurrence sits below an old one with a thousand, and that is on purpose: the list answers "what is hurting most", not "what arrived last". For time order, click Age or go to Occurrences.
What you should see
A table with one row per error, the most voluminous on top, and the sidebar with counts per dimension. If it is empty, meulog says which filter emptied it and offers the link to clear. Empty with no filter at all means nothing arrived: check the belt under Flows and prove it with Debug.
Shortcuts
j and k move through rows, Enter opens the
marked one, / jumps to search, ? shows the whole list.