---
title: "Observability and troubleshooting"
description: "Observe and troubleshoot connected clusters with Calico Cloud web console dashboards, Service Graph, packet capture, and managed Elasticsearch logs."
product: "Calico Cloud"
version: "v20.4.0"
section: "Observability"
canonical_url: "https://docs.tigera.io/calico-cloud/next/observability/"
---

# Observability and troubleshooting

See what's going on in your cluster with network observability tools and detailed logging.

## Getting started

##### [Manage alerts](https://docs.tigera.io/calico-cloud/observability/alerts)

[Configure alerts and review alert events for Calico Cloud features in the web console or CLI. Use built-in templates for visibility and security signals.](https://docs.tigera.io/calico-cloud/observability/alerts)

##### [Packet capture](https://docs.tigera.io/calico-cloud/observability/packetcapture)

[Capture live pod traffic in Calico Cloud connected clusters from Service Graph or the CLI and export pcap files to Wireshark for analysis.](https://docs.tigera.io/calico-cloud/observability/packetcapture)

##### [Visualize traffic to and from a cluster](https://docs.tigera.io/calico-cloud/observability/visualize-traffic)

[Visualize cluster traffic to and from external endpoints in Calico Cloud Service Graph with network sets that group external IP ranges by purpose.](https://docs.tigera.io/calico-cloud/observability/visualize-traffic)

## Getting started with logs

##### [Overview](https://docs.tigera.io/calico-cloud/observability/elastic/overview)

[Calico Cloud uses managed Elasticsearch for flow, DNS, audit, BGP, and L7 logs with workload context, RBAC, and archival to external SIEMs.](https://docs.tigera.io/calico-cloud/observability/elastic/overview)

##### [Archive logs](https://docs.tigera.io/calico-cloud/observability/elastic/archive-storage)

[Forward Calico Cloud flow, DNS, audit, and L7 logs to Syslog, Splunk, or Amazon S3 to retain compliance data beyond managed retention windows.](https://docs.tigera.io/calico-cloud/observability/elastic/archive-storage)

##### [Overview](https://docs.tigera.io/calico-cloud/observability/elastic/overview)

[Calico Cloud uses managed Elasticsearch for flow, DNS, audit, BGP, and L7 logs with workload context, RBAC, and archival to external SIEMs.](https://docs.tigera.io/calico-cloud/observability/elastic/overview)

##### [BGP logs](https://docs.tigera.io/calico-cloud/observability/elastic/bgp)

[Reference of key/value fields in Calico Cloud BGP activity logs in Elasticsearch, with sample queries for IPv4, IPv6, and per-node lookups.](https://docs.tigera.io/calico-cloud/observability/elastic/bgp)

##### [Audit logs](https://docs.tigera.io/calico-cloud/observability/elastic/audit-overview)

[Calico Cloud audit logs record changes to network policies, tiers, network sets, host endpoints, and other resources across connected clusters.](https://docs.tigera.io/calico-cloud/observability/elastic/audit-overview)

## Flow logs

##### [Flow log data types](https://docs.tigera.io/calico-cloud/observability/elastic/flow/datatypes)

[Reference of key/value fields that Calico Cloud sends to Elasticsearch for flow logs, including endpoints, actions, byte counts, and policy verdicts.](https://docs.tigera.io/calico-cloud/observability/elastic/flow/datatypes)

##### [Filter flow logs](https://docs.tigera.io/calico-cloud/observability/elastic/flow/filtering)

[Filter Calico Cloud flow logs through Fluentd to drop low-significance traffic and reduce managed Elasticsearch volume and cost.](https://docs.tigera.io/calico-cloud/observability/elastic/flow/filtering)

##### [Configure flow log aggregation](https://docs.tigera.io/calico-cloud/observability/elastic/flow/aggregation)

[Tune Calico Cloud flow log aggregation levels to balance managed Elasticsearch volume and cost against pod and IP visibility for allowed and denied traffic.](https://docs.tigera.io/calico-cloud/observability/elastic/flow/aggregation)

##### [Enable HostEndpoint reporting in flow logs](https://docs.tigera.io/calico-cloud/observability/elastic/flow/hep)

[Turn on host endpoint reporting in Calico Cloud flow logs to gain visibility into traffic at HostEndpoint interfaces on Kubernetes nodes.](https://docs.tigera.io/calico-cloud/observability/elastic/flow/hep)

##### [Enable process-level information in flow logs](https://docs.tigera.io/calico-cloud/observability/elastic/flow/processpath)

[Add process executable paths and arguments to Calico Cloud flow logs with eBPF instrumentation for process-level visibility into network activity.](https://docs.tigera.io/calico-cloud/observability/elastic/flow/processpath)

##### [Enabling TCP socket stats in flow logs](https://docs.tigera.io/calico-cloud/observability/elastic/flow/tcpstats)

[Add TCP socket statistics to Calico Cloud flow logs with eBPF programs that capture round-trip time, retransmits, and other per-socket metrics.](https://docs.tigera.io/calico-cloud/observability/elastic/flow/tcpstats)

## DNS logs

##### [Query DNS logs](https://docs.tigera.io/calico-cloud/observability/elastic/dns/dns-logs)

[Reference of key/value fields in Calico Cloud DNS activity logs in Elasticsearch, with guidance for building client and query lookups.](https://docs.tigera.io/calico-cloud/observability/elastic/dns/dns-logs)

##### [Filter DNS logs](https://docs.tigera.io/calico-cloud/observability/elastic/dns/filtering-dns)

[Suppress low-value Calico Cloud DNS log entries with Fluentd filters configured through a ConfigMap in the operator namespace of connected clusters.](https://docs.tigera.io/calico-cloud/observability/elastic/dns/filtering-dns)

## L7 logs

##### [Configure L7 logs](https://docs.tigera.io/calico-cloud/observability/elastic/l7/configure)

[Deploy Envoy and aggregate Calico Cloud L7 logs to monitor HTTP traffic patterns between application workloads on connected clusters.](https://docs.tigera.io/calico-cloud/observability/elastic/l7/configure)

##### [L7 log data types](https://docs.tigera.io/calico-cloud/observability/elastic/l7/datatypes)

[Reference of key/value fields that Calico Cloud sends to Elasticsearch for L7 logs, including durations, byte counts, and HTTP request metadata.](https://docs.tigera.io/calico-cloud/observability/elastic/l7/datatypes)