Logging

By default, SelectZero logs application events on a file level with log rotation. Log rotation keeps logs for maximum of 10 days or 100MB log file size.

Rotated logs are moved to /logs/archived

Log types:

General logs - Application's user and system actions
SQL logs - All executed SQL queries
Security logs - Application's request logs
Import/Export logs - Logs about imported and exported entities
AI assistant - Logs about calls to the AI assistant API
System - Logs about internal system actions and errors (including stacktrace)

Default format

Platform logs follow pattern

2025-04-22 11:49:30.604 INFO  [88.22.44.55] Matthew - Edited user 'Samantha' role(s) to [analytic]

Timestamp - ISO 8601 formatted timestamp
Log level - INFO, WARN, ERROR levels
IP / Session ID - Request origin IP and user hashed session ID
User - Application user
Message - Log message

Using Filebeat as Sidecar for log forwarding

As the SelectZero platform is a simple containerized platform, log aggregation and security monitoring can be configured on deployment side. You can use Filebeat to forward logs to a central service such as Logstash or Graylog.

Example docker-compose.yml:

services:
  dqm:
    container_name: selectzero
    image: selectzero/selectzero:2025.5.1
    ports:
      - "8090:8090"
    volumes:
      - ./logs:/usr/app/logs
      - ./database:/usr/app/database
      - ./drivers:/usr/app/drivers
      - ./keys:/usr/app/keys
    environment:
      JAVA_OPTIONS: -Xmx4g
    networks:
      - selectzero-network
  filebeat:
    image: docker.elastic.co/beats/filebeat:8.13.2
    user: root
    volumes:
      - ./logs:/logs
      - ./filebeat.yml:/usr/share/filebeat/filebeat.yml:ro
    networks:
      - selectzero-network
networks:
  selectzero-network:

Example of filebeat.yml:

filebeat.inputs:
  - type: log
    enabled: true
    paths:
      - /logs/*.log

    multiline.pattern: '^\d{4}-\d{2}-\d{2} \d{2}:\d{2}:\d{2}'
    multiline.negate: true
    multiline.match: after

# logstash example
output.logstash:
  hosts: ["logstash:5044"]

07 May 2025