--- title: "Observability and troubleshooting" description: "Observe and troubleshoot connected clusters with Calico Cloud web console dashboards, Service Graph, packet capture, and managed Elasticsearch logs." product: "Calico Cloud" version: "v23.0.1" section: "Observability" canonical_url: "https://docs.tigera.io/calico-cloud/observability/" --- # Observability and troubleshooting See what's going on in your cluster with network observability tools and detailed logging. ## Getting started ##### [Manage alerts](https://docs.tigera.io/calico-cloud/observability/alerts.md) [Configure alerts and review alert events for Calico Cloud features in the web console or CLI. Use built-in templates for visibility and security signals.](https://docs.tigera.io/calico-cloud/observability/alerts.md) ##### [Packet capture](https://docs.tigera.io/calico-cloud/observability/packetcapture.md) [Capture live pod traffic in Calico Cloud connected clusters from Service Graph or the CLI and export pcap files to Wireshark for analysis.](https://docs.tigera.io/calico-cloud/observability/packetcapture.md) ##### [Visualize traffic to and from a cluster](https://docs.tigera.io/calico-cloud/observability/visualize-traffic.md) [Visualize cluster traffic to and from external endpoints in Calico Cloud Service Graph with network sets that group external IP ranges by purpose.](https://docs.tigera.io/calico-cloud/observability/visualize-traffic.md) ## Getting started with logs ##### [Overview](https://docs.tigera.io/calico-cloud/observability/elastic/overview.md) [Calico Cloud uses managed Elasticsearch for flow, DNS, audit, BGP, and L7 logs with workload context, RBAC, and archival to external SIEMs.](https://docs.tigera.io/calico-cloud/observability/elastic/overview.md) ##### [Archive logs](https://docs.tigera.io/calico-cloud/observability/elastic/archive-storage.md) [Forward Calico Cloud flow, DNS, audit, and L7 logs to Syslog, Splunk, or Amazon S3 to retain compliance data beyond managed retention windows.](https://docs.tigera.io/calico-cloud/observability/elastic/archive-storage.md) ##### [Overview](https://docs.tigera.io/calico-cloud/observability/elastic/overview.md) [Calico Cloud uses managed Elasticsearch for flow, DNS, audit, BGP, and L7 logs with workload context, RBAC, and archival to external SIEMs.](https://docs.tigera.io/calico-cloud/observability/elastic/overview.md) ##### [BGP logs](https://docs.tigera.io/calico-cloud/observability/elastic/bgp.md) [Reference of key/value fields in Calico Cloud BGP activity logs in Elasticsearch, with sample queries for IPv4, IPv6, and per-node lookups.](https://docs.tigera.io/calico-cloud/observability/elastic/bgp.md) ##### [Audit logs](https://docs.tigera.io/calico-cloud/observability/elastic/audit-overview.md) [Calico Cloud audit logs record changes to network policies, tiers, network sets, host endpoints, and other resources across connected clusters.](https://docs.tigera.io/calico-cloud/observability/elastic/audit-overview.md) ## Flow logs ##### [Flow log data types](https://docs.tigera.io/calico-cloud/observability/elastic/flow/datatypes.md) [Reference of key/value fields that Calico Cloud sends to Elasticsearch for flow logs, including endpoints, actions, byte counts, and policy verdicts.](https://docs.tigera.io/calico-cloud/observability/elastic/flow/datatypes.md) ##### [Filter flow logs](https://docs.tigera.io/calico-cloud/observability/elastic/flow/filtering.md) [Filter Calico Cloud flow logs through Fluentd to drop low-significance traffic and reduce managed Elasticsearch volume and cost.](https://docs.tigera.io/calico-cloud/observability/elastic/flow/filtering.md) ##### [Configure flow log aggregation](https://docs.tigera.io/calico-cloud/observability/elastic/flow/aggregation.md) [Tune Calico Cloud flow log aggregation levels to balance managed Elasticsearch volume and cost against pod and IP visibility for allowed and denied traffic.](https://docs.tigera.io/calico-cloud/observability/elastic/flow/aggregation.md) ##### [Enable HostEndpoint reporting in flow logs](https://docs.tigera.io/calico-cloud/observability/elastic/flow/hep.md) [Turn on host endpoint reporting in Calico Cloud flow logs to gain visibility into traffic at HostEndpoint interfaces on Kubernetes nodes.](https://docs.tigera.io/calico-cloud/observability/elastic/flow/hep.md) ##### [Enable process-level information in flow logs](https://docs.tigera.io/calico-cloud/observability/elastic/flow/processpath.md) [Add process executable paths and arguments to Calico Cloud flow logs with eBPF instrumentation for process-level visibility into network activity.](https://docs.tigera.io/calico-cloud/observability/elastic/flow/processpath.md) ##### [Enabling TCP socket stats in flow logs](https://docs.tigera.io/calico-cloud/observability/elastic/flow/tcpstats.md) [Add TCP socket statistics to Calico Cloud flow logs with eBPF programs that capture round-trip time, retransmits, and other per-socket metrics.](https://docs.tigera.io/calico-cloud/observability/elastic/flow/tcpstats.md) ## DNS logs ##### [Query DNS logs](https://docs.tigera.io/calico-cloud/observability/elastic/dns/dns-logs.md) [Reference of key/value fields in Calico Cloud DNS activity logs in Elasticsearch, with guidance for building client and query lookups.](https://docs.tigera.io/calico-cloud/observability/elastic/dns/dns-logs.md) ##### [Filter DNS logs](https://docs.tigera.io/calico-cloud/observability/elastic/dns/filtering-dns.md) [Suppress low-value Calico Cloud DNS log entries with Fluentd filters configured through a ConfigMap in the operator namespace of connected clusters.](https://docs.tigera.io/calico-cloud/observability/elastic/dns/filtering-dns.md) ## L7 logs ##### [Configure L7 logs](https://docs.tigera.io/calico-cloud/observability/elastic/l7/configure.md) [Deploy Envoy and aggregate Calico Cloud L7 logs to monitor HTTP traffic patterns between application workloads on connected clusters.](https://docs.tigera.io/calico-cloud/observability/elastic/l7/configure.md) ##### [L7 log data types](https://docs.tigera.io/calico-cloud/observability/elastic/l7/datatypes.md) [Reference of key/value fields that Calico Cloud sends to Elasticsearch for L7 logs, including durations, byte counts, and HTTP request metadata.](https://docs.tigera.io/calico-cloud/observability/elastic/l7/datatypes.md)