Skip to main content

Using the log explorer

The log explorer page allows you to search and filter logs so you can investigate issues and perform root-cause analysis.

Time period​

  • Use the Time period list at the top right of the page to select the range of logs to display.
  • Navigate your data using the timeline: click and drag your mouse over the graph to select a new time range. Use the Stacking icon to the left of the chart to choose how log volume is displayed: as a total, or stacked by severity or service name.

Searching for logs​

Filters panel​

The Filters panel lists all OpenTelemetry attributes present in your logs for the selected time period. It works in conjunction with the search bar.

  • Expand an attribute to view all its values and their number of occurrences. This gives you a quick overview of your data distribution without writing a single query.
  • The Search all attributes field filters all attributes in real time. Once an attribute is expanded, Search values lets you search for a specific value among all available ones.
  • Click the + at the left of a value to add it directly as a clause in the active Query Builder or Query Editor.

Use the search bar to filter your logs. The search bar has two modes (use the switch on the right to select the one you want):

  • In Query builder mode, blocks let you build your search step by step - you add a block, then you select attribute names and values and select syntax elements like AND, OR, and NOT. Click the plus sign in the search bar to add a blank block.

    image

  • In query editor mode:

    • Type your search directly using the query syntax. Autocomplete and error detection help you write queries faster and avoid mistakes. Hover over a flagged mistake to see explanations and suggestions. Errors (in red) mean that the query will not work. Warnings (in orange) mean that the query may work but the results might not be what you expected. For example, typing and instead of AND causes the query to search for the string "and" in the message body rather than using it as a boolean operator.

    • Click the Ask AI button to the right of the search bar. In the field that appears, write a query with your own words and in any language, then click Apply and search. This will generate a query with the correct syntax in the query editor: you can edit it to enrich the query if you like. This is a good way to learn the query syntax.

      AI responses may be inaccurate or incomplete. Always check the results.

      image

In both modes, you need to click the Search button to run the search.

Detailed log info​

Click a log to see all related information in the Log details panel, including the raw OpenTelemetry log entry.

  • You can open several logs in the panel.
  • Copy or download the whole log in json format from the Raw OTel log section.
  • The search bar will inspect attribute names and values.

Bookmarking or loading a view​

Bookmarked views let you save a complete Log Explorer configuration — query, time range, and column layout — under a single name. Instead of rebuilding the same query every session, you can reload a saved investigation context in one click.

You can choose how time is saved: relative (e.g. "last 1h", re-runs live on load) or fixed (exact timestamps).

Bookmarking a view​

  1. Set your query, time range and columns in Log Explorer as usual, then click the Bookmark or load a view toolbar button.

  2. Click Bookmark this view.

  3. Name your view, then select a time mode. If your view has a relative time period ("last n minutes/hours"), select how you want the time period to be saved:

    • Relative: Best for daily operations and monitoring: the view always shows the freshest data, re-executing the same relative window (e.g. "last 1h") every time you load it.
    • Absolute: Fixed time is best for post-incident forensics: exact timestamps give you a reproducible view of what happened.

  4. Click Bookmark. The bookmarked view is saved.

Loading a bookmarked view​

  1. Click the Bookmark or load a view toolbar button.
  2. In the list of bookmarked views, click the view you want: query, columns and time range are all applied automatically. Log Explorer populates with results right away.

Sharing a Bookmarked view​

  1. Click the Bookmark or load a view toolbar button.
  2. In the list of bookmarked views, click the 3 dots on the right of a view, then click Copy link to generate a shareable URL — useful for pasting into your instant messaging tool or an incident ticket.

Summarizing logs​

You can automatically generate a summary of all logs matching a query. The summary identifies recurring issues, groups them by type, lists their likely root causes, and suggests next steps to resolve them.

Click the Log Summary button next to the time range selector to open the summary in a new tab.

image

  • Summaries are only available for queries returning 2,000 lines or fewer.
  • You may need to authorize new tabs for the same domain in your browser.

Rearranging columns​

  • The default columns are Time, Severity and Body.

  • Use the Search and add column button at the top right of the results to choose which columns/attributes you want to display.

  • In this window, you can reset the display to the 3 default columns.

  • The Time column is always displayed first and cannot be unpinned. You can pin one other column in second position.

  • You can drag columns to a different position in the table.

    image