Instana now provides a configuration flag that allows you to control which log levels are captured as spans in Java applications.

Why is this important?

Modern applications generate a large volume of logs. While Instana can automatically convert logs into spans to enhance observability, not all logs are equally valuable. By customizing log level capture, you can focus on the most relevant data.

By default, Instana is set to log level WARN. This configuration captures spans for log levels WARN and above, including ERROR, FATAL, and CRITICAL. However, logging every WARN event can result in an excessive amount of data in your observability platform, leading to increased span usage.

Configuring the log level capture

The INSTANA_LOG_LEVEL_CAPTURE configuration option allows you to control which log levels are captured and converted into spans. By minimizing unnecessary spans, you can optimize your Application Performance Monitoring (APM) setup, reducing data usage and costs.

You can configure INSTANA_LOG_LEVEL_CAPTURE using one of the following methods:

• Environment Property

Set the INSTANA_LOG_LEVEL_CAPTURE environment property to one of the supported log levels: ERROR, WARN, or OFF. For example:

INSTANA_LOG_LEVEL_CAPTURE=ERROR

• System Property

Set the system property -Dinstana_log_level_capture to one of the supported log levels: ERROR, WARN, or OFF. For example:

-Dinstana_log_level_capture=ERROR

Note: A restart of the application or Instana agent is required to reflect this change.

Recommended configuration for cost optimization

To minimize unnecessary spans and optimize costs, set INSTANA_LOG_LEVEL_CAPTURE to ERROR. This configuration ensures that Instana only creates spans for log levels ERROR and above, excluding WARN log spans.

Real-world impact of optimizing log capture

Scenario: Reducing log span volume

Consider an application that generates 100 million log spans per day, distributed across WARN and ERROR levels. By switching from the default WARN log capture level to ERROR, you can significantly reduce the volume of spans captured.

Comparison of log capture levels

Benefits of optimizing log capture

By switching to log capture level ERROR, you can achieve an 86% reduction in span volume, resulting in:

• Fewer, more relevant log spans

• Leaner data ingestion

• A more cost-effective Application Performance Monitoring (APM) strategy

This optimized approach helps you focus on critical errors that require attention, while minimizing noise from less severe log events.

Environment-specific recommendations

To optimize log capture and minimize costs, follow these best practices for different environments:

• Production Environments : Set INSTANA_LOG_LEVEL_CAPTURE to ERROR to reduce noise and cost.

• Test and Development Environments: Set INSTANA_LOG_LEVEL_CAPTURE to WARN to capture more detailed information for debugging purposes.

Trace view: Before vs After Log Filtering

Here’s what your trace view might look like:

Comparing trace views

The following examples illustrate the effect of log filtering on the trace view:

Before configuration

Instana captures both ERROR and WARN spans, resulting in a cluttered trace view.

After setting INSTANA_LOG_LEVEL_CAPTURE=ERROR

Only ERROR and higher severity log spans are captured, providing a more focused and relevant trace view.

Business outcome

To gain insights into call volumes by log level, navigate to the Analytics section and apply the desired time filter. Group the data by Log Level to visualize the distribution of calls.

Example: One-month call volume analysis for a tenant unit

Over a one-month period, the analysis reveals:

• Approximately 2.2 billion calls containing WARN log spans

• 288.9 million calls with ERROR log spans

Daily breakdown of span counts

The visualization below presents a daily breakdown of span counts over a month, categorized by log level:

• Yellow: WARN spans

• Red: ERROR spans

Assuming an average log span size of approximately 1 KB, filtering out WARN spans can reduce storage and ingestion costs:

• Monthly storage and ingestion savings: approximately 2,057.27 GB

• Annual storage and ingestion savings: nearly 24.69 TB

Summary

Implementing the INSTANA_LOG_LEVEL_CAPTURE configuration can have a significant impact on your logging strategy:

• Reduced noise: Minimize the impact of low-priority WARN logs on your data volume and analysis

• Improved signal: Focus on actionable ERROR logs that require attention and drive meaningful insights

• Cost-effective: Lower span volume helps you stay within Instana's Fair Usage Policy, reducing costs and optimizing resource utilization

Tip

You can set INSTANA_LOG_LEVEL_CAPTURE to OFF for low-impact applications to skip logging spans altogether.

Supported logging frameworks

The INSTANA_LOG_LEVEL_CAPTURE configuration is compatible with a wide range of popular Java logging frameworks, including:

• Log4j

• Slf4j

• Logback

• Java Util Logging

• JBoss Logging

Instana automatically hooks into these libraries and respects your configuration.

Further reading

• Logging Configuration

• Blog: ignoring endpoints