Skip to main content
Log sources let Ankra query your aggregated log store through the cluster agent. This powers the Search tab on the cluster Logs page and the AI Assistant’s query_logs / get_log_labels tools.

​
Why Connect a Log Source?

When you connect a log source to Ankra:
  • Historical log search - Query logs across pods and namespaces without leaving the cluster view
  • AI-powered troubleshooting - Ankra AI can search Loki, Elasticsearch or OpenSearch during incident analysis
  • Complements live streaming - Use Live stream for tailing current pod output; use Search for time-ranged queries over your log store
  • Agent-mediated access - Queries run from inside your cluster, so in-cluster Loki/Elastic endpoints and external SaaS endpoints both work when the agent can reach them

​
Supported Providers

Use index-scoped credentials for Elasticsearch/OpenSearch. Ankra health checks call {index}/_count, not /_cluster/health, so least-privilege API keys work without false “degraded” status.

​
Connecting a Log Source

1

Open Data Sources

Navigate to your cluster → Settings → Data Sources.
2

Select Log Source

Choose Log Source in the sidebar (requires the log_source feature flag for your organisation).
3

Pick a provider

Select Grafana Loki, Elasticsearch, or OpenSearch.
4

Enter the endpoint

Provide the HTTP endpoint reachable from the Ankra agent inside the cluster.Examples:
For Grafana Cloud Loki, use the tenant query URL from your Grafana Cloud stack.
5

Configure provider options

  • Loki - Optional tenant ID (X-Scope-OrgID) for multi-tenant deployments
  • Elasticsearch / OpenSearch - Index pattern (default *) and optional field mappings if your shipper uses non-standard field names
  • Verify TLS certificate - Enable when the endpoint presents a publicly trusted or cluster-trusted certificate; leave off for self-signed in-cluster endpoints
6

Add credentials (if required)

Choose the auth type that matches your deployment:
  • API Token - Bearer token (Loki, OpenSearch, Grafana Cloud)
  • API Key - Elasticsearch Authorization: ApiKey … header
  • User Account - HTTP basic auth
7

Test and save

Click Test connection, then Save. The sidebar status dot turns green when the background health probe succeeds.

​
Field mappings (Elasticsearch / OpenSearch)

If you ship logs with Fluent Bit’s kubernetes filter, the defaults usually work: Override these in the Advanced field mappings section when your index template uses different names. For Loki, structured filters use label names (defaults: namespace, pod, container for Promtail/Alloy).

​
Managing the log source in Git

If the cluster is connected to a GitOps repository, the log source is part of the cluster document at clusters/<cluster-name>-<cluster-id>/<cluster-name>.yaml. Adding or editing the spec.log_source block connects and updates the source on the next sync, exactly as the settings page does:
Accepted fields are provider, endpoint, credential_name, tenant_id, index_pattern, field_mappings and verify_ssl - see the ImportCluster schema for what each one means. Any other top-level field is refused with an error naming it, rather than ignored, and provider must be loki, elasticsearch or opensearch.
Credentials never go in Git. A username, password, token or auth_scheme inside the block is refused by name: silently ignoring it would leave a live secret in your repository while you believe it is in effect. Create the credential in the platform and reference it with credential_name.Removing the block does not disconnect the log source. Git can create and update the source, never disconnect it - the source survives the sync and the block reappears the next time Ankra regenerates the file. Disconnect from Settings → Data Sources instead.

​
Searching logs in the portal

  1. Open Logs in the cluster sidebar
  2. Switch to the Search tab (visible when the log source feature is enabled)
  3. Pick a time range and optional namespace/pod/container filters
  4. Enter a text search or toggle Raw query for LogQL (Loki) or JSON query-DSL (Elasticsearch/OpenSearch)
  5. Use Load older to page backward in time
From a pod’s Logs tab, Search history deep-links into Search with that pod pre-filtered.

​
AI Assistant

With a configured log source, Ankra AI can:
  • query_logs - Run structured or raw queries over the connected store
  • get_log_labels - Discover filterable labels/fields before querying
The assistant uses the same agent relay as the portal - credentials never leave the platform secret store.
Ask Ankra AI to call get_log_labels first when filters return no rows; your shipper may use different label or field names than the defaults.

​
Troubleshooting