How do I find 500 or 400 Errors in Kibana?

When you have noticed an error on your website or customers are reporting 404 - page not found, 500 server not responding or some other 5XX error code, you can search the logs quickly to find that exact request and understand the frequency of the issue and help pinpoint the cause.

  • Select HTTP logs under the Real Time menu in the portal

  • Choose a time period you wish to search by clicking in the the time chooser in the top right. Note that max 7 days logs are available and longer time periods will take longer for results to be returned:

  • In the search bar - type the query “status: [400 TO 600]” Note that this will return every response between status code 400 up to 600. If you wish to refine to just 500 errors for example, use status: [499 TO 600].

  • logs all requests as they pass through each of the proxies in your delivery chain. This way you can see the timing and the response of each proxy. Edge proxy is the proxy “at the edge” and is the one to see a request as it is sent to the end user. Last Proxy is the “last proxy” to in the chain and is the one which talks to your origin servers.

If the Last Proxy shows an error response code, it means it received an error from your origin servers.

In between edge and last proxy is whatever proxy you have chosen.

To select say, the Last proxy only so you can clearly see the origin errors being served, click in _type in the left hand menu and click the + magnifier on last proxy to highlight only the logs from that proxy.

Side note, if you are running varnish cache, last proxy would normally have fewer logs than Varnish or Edge proxy as Varnish serves some requests from cache so has no need to send the request back through last proxy to your origin.

  • By selecting more options from the left hand menu you can gather quick counts or further filter down to specific status codes or user agents or geo locations and many more options to understand the nature of the requests which are erroring on your website: