Is your Search or Graph Timing Out?

We know how frustrating it is when you're trying to track something down, and Scalyr is timing out. Unfortunately, sometimes log data can get very large making it difficult to search through quickly.

Try searching a shorter time period

For example, if you are trying to search over the last three days, try searching them one day at a time. To search the first day:

To search the second day, change the Start field to "2d", and so on. Take a look at our Date/Time Reference for more information on date/time syntax.

Try using a parsed field

Change a generic text search ("404") to a parsed field search (status=404), because they are much more efficient.

If you don't have a parsing rule set up for the field you're searching, or don't know how to use parsed fields, see Parsing Logs or just contact us.

Try running your search a second time.

Sometimes it will run faster on the second try once the data has been cached.

If you’re willing to wait a little while for results

From the Search page, click Actions > Add To Dashboard to add your search or graph to a dashboard. Then open the dashboard.

The search may still time out, but by opening the dashboard, you'll trigger a background process which pre-computes and back-computes graph data. After about 20 minutes, the dashboard should load quickly, even if you search a long time period.

Avoid Breakdown Graphs if Possible

A breakdown graph breaks down log volume or a plot of a field by another field (the "breakdown field"). Unfortunately, this graph type is not amenable to the pre-computation or back-computation mentioned above because the content of the "breakdown field" is unknown until query time.

For example, the breakdown graph in the Graphs overview filters for logs where `status == "failure"`, and then breaks the results down by server. The content of the server field (the "breakdown field") is unknown until query time because servers come and go offline over time, and because a particular server may not send any log messages over your specified time period.

Note that if you are interested in a specific value or set of values in the "breakdown field", you can add these as individual labels in a standard graph. If, for example, you are only interested in `status == "failure"` for a specific set of servers, you can create a standard graph and add labels that filter for each server of interest (`status == 'failure' and serverHost contains 'appserver-8'`, `status == 'failure' and serverHost contains 'appserver-7'`, etc.).

In general, we recommend breakdown graphs for research and data exploration only. For dashboard and alert use, we recommend standard graphs whenever possible.

Use PowerQueries for Reports

Our new PowerQueries feature excels at generating summary statistics and tables for reporting purposes. Compared to standard reports defined in Dashboard JSON, PowerQueries are faster and often return exact values rather than estimates. For more information see the PowerQueries reference.

Still not working?

Please contact us!

We can help you find a more efficient way to run your search.