# How to understand Real-Time Events logs

import DocButton from '~/components/webkit/DocButton.vue';

Your analysis using **Real-Time Events** depends on the variables you choose to use. Each data source has a set of preorganized variables that provide information on access, behavior, and performance of your applications and related products.

You can find all available variables, their descriptions, and examples in the [data source](/en/documentation/products/observe/real-time-events/#data-sources) reference.

You have the option of querying a general search and receive all possible variables and values or querying a filtered search, so you can decide which variables will be queried.

<DocButton href="/en/documentation/products/guides/observe/add-filters-events/" label="go to add filters guide" kind="secondary" target="_blank" size="medium" />

---

## Querying a general search

You can query a general search and receive all of the variables and their possible available values for the data source you're analyzing. This could be the ideal choice if you want to analyze as much information as possible or if you're still not exactly sure what you need to investigate.

For example, if you notice your application isn't properly exhibiting what you configured on an function, you can query the **Functions** data source and analyze all variables to check if the right function is being called and what type of message it returned when it was called.

---

## Querying a filtered search

You can query a filtered search to receive specific variables and values according to what you're analyzing. This could be the ideal choice if you already know what type of information you're going to analyze.

For example, if you suspect there may be malicious users trying to access your application, you can query the **Applications** data source and analyze variables such as `$city`, `$host`, `$http_referrer`, `$remote_addr`, `$request_uri`, and so on.

---

## Searching by request ID

The `requestId` field stores a unique identifier for each request. Example: `5f222ae5938482c32a822dbf15e19f0f`.

When you retrieve a request ID from an HTTP response header (such as `X-Request-Id`), it may include a numeric suffix separated by a hyphen. For example: `5f222ae5938482c32a822dbf15e19f0f-1234`. This suffix is appended at the network layer and isn't stored in the log.

To search for a request in **Real-Time Events** or via the **GraphQL API**, use only the base identifier without the suffix. Searching with the full string, including the suffix, may return no results or a `400` error.

For example, if the header returns `5f222ae5938482c32a822dbf15e19f0f-1234`, filter by `5f222ae5938482c32a822dbf15e19f0f`.