The Cloudera specific log location should be here: ### Cloudera Yarn Log Files [monitor:///var/log/hadoop-yarn/*nodemanager*] sourcetype = hadoop_nodemanager index = hadoopmon_metrics [monitor:///var/log/hadoop-yarn/*resourcemanager*] sourcetype = hadoop_resourcemanager index = hadoopmon_metrics [monitor:///var/log/hadoop-yarn/*proxyserver*] sourcetype = hadoop_proxyserver index = hadoopmon_metrics [monitor:///var/log/hadoop-mapreduce/*historyserver*] sourcetype = hadoop_historyserver index = hadoopmon_metric ### Cloudera Hadoop Log Files [monitor:///var/log/hadoop-hdfs/*datanode*] sourcetype = hadoop_datanode index = hadoopmon_metrics [monitor:///var/log/hadoop-hdfs/*namenode*] sourcetype = hadoop_namenode index = hadoopmon_metrics [monitor:///var/log/hadoop-hdfs/*secondarynamenode*] sourcetype = hadoop_secndarynamenode index = hadoopmon_metrics [monitor:///var/log/hadoop-hdfs/*journalnode*] sourcetype = hadoop_journalnode index = hadoopmon_metrics ### Cloudera Configuration Files [monitor:///etc/hadoop/conf/*] crcSalt = <SOURCE> disabled = 0 sourcetype = hadoop_global_conf index = hadoopmon_configs And after you collect the logs you can run searches similar to these: [Yarn All Applications] index=hadoopmon_metrics sourcetype=hadoop_resourcemanager appId=* | eval elapsed_time = finishTime - startTime | table appId name user queue finalStatus elapsed_time [Yarn Top User] index=hadoopmon_metrics sourcetype=hadoop_resourcemanager appId=* | top user [Yarn Success Rate] index=hadoopmon_metrics sourcetype=hadoop_resourcemanager appId=* | top finalStatus
... View more