Explore on Grafana Labs

Query management

Fri, 06 Mar 2026 06:34:21 +0000

Query management in Explore

To help with debugging queries, Explore allows you to investigate query requests and responses, as well as query statistics, via the Query inspector. This functionality is similar to the panel inspector tasks Inspect query performance and Inspect query request and response data.

Query history

Query history is a list of queries that you used in Explore. The history is stored in the Grafana database and it is not shared with other users. The retention period for queries in history is two weeks. Queries older than two weeks are automatically deleted. To open and interact with your history, click the Query history button in Explore.

Note
Starred queries are not subject to the two weeks retention period and they are not deleted.

View query history

Query history lets you view the history of your querying. For each individual query, you can:

Run a query.
Create and/or edit a comment.
Copy a query to the clipboard.
Copy a shortened link with the query to the clipboard.
Star a query.

Manage favorite queries

All queries that have been starred in the Query history tab are displayed in the Starred tab. This allows you to access your favorite queries faster and to reuse these queries without typing them from scratch.

Sort query history

By default, query history shows you the most recent queries. You can sort your history by date or by data source name in ascending or descending order.

Click the Sort queries by field.
Select one of the following options:
- Newest first
- Oldest first

Filter query history

Filter query history in Query history and Starred tab by data source name:

Click the Filter queries for specific data source(s) field.
Select the data source for which you would like to filter your history. You can select multiple data sources.

In Query history tab it is also possible to filter queries by date using the slider:

Use vertical slider to filter queries by date.
By dragging bottom handle, adjust start date.
By dragging top handle, adjust end date.

Search in query history

You can search in your history across queries and your comments. Search is possible for queries in the Query history tab and Starred tab.

Click the Search queries field.
Type the term you are searching for into search field.

Query history settings

You can customize the query history in the Settings tab. Options are described in the table below.

Setting	Default value
Change the default active tab	Query history tab

Note: Query history settings are global, and applied to both panels in split mode.

Logs in Explore

Fri, 06 Mar 2026 06:34:21 +0000

Logs in Explore

Along with metrics, Explore allows you to investigate your logs across several data sources including:

During monitoring, troubleshooting, and incident response, you can dig deeper into the metrics and logs to find the cause of the issue. Explore also allows you to correlate metrics and logs by viewing them side-by-side.

Logs visualization

Results of log queries are shown as histograms in the graph and individual logs are explained in the following sections.

If the data source supports a full range log volume histogram, the graph with log distribution for all entered log queries is shown automatically. This feature is currently supported by Elasticsearch and Loki data sources.

Note: In Loki, this full range log volume histogram is rendered by metric query which can be expensive depending on time range queried. This query may be particularly challenging for smaller Loki installations to process. To mitigate this, we recommend using a proxy like nginx in front of Loki to set a custom timeout (for example, 10 seconds) for these queries. Log volume histogram queries can be identified by looking for queries with the HTTP header X-Query-Tags with value Source=logvolhist; these headers are added by Grafana to all log volume histogram queries.

If the data source does not support loading full range log volume histogram, the logs model computes a time series based on the log row counts bucketed by an automatically calculated time interval, and the first log row’s timestamp then anchors the start of the histogram from the result. The end of the time series is anchored to the time picker’s To range.

Log level

For logs where a level label is specified, we use the value of the label to determine the log level and update color accordingly. If the log doesn’t have a level label specified, we try to find out if its content matches any of the supported expressions (see below for more information). The log level is always determined by the first match. In case Grafana is not able to determine a log level, it will be visualized with an unknown log level.

Tip: If you use Loki data source and the “level” is in your log-line, use parsers (JSON, logfmt, regex,..) to extract the level information into a level label that is used to determine log level. This will allow the histogram to show the various log levels in separate bars.

Supported log levels and mapping of log level abbreviation and expressions:

Supported expressions	Log level	Color
emerg	critical	purple
fatal	critical	purple
alert	critical	purple
crit	critical	purple
critical	critical	purple
err	error	red
eror	error	red
error	error	red
warn	warning	yellow
warning	warning	yellow
info	info	green
information	info	green
informational	info	green
notice	info	green
dbug	debug	blue
debug	debug	blue
trace	trace	light blue
*	unknown	grey

Logs navigation, at the right side of the log lines, can be used to request more logs. You can do this by clicking the Older logs button at the bottom of the navigation. This is especially useful when you hit the line limit and you want to see more logs. Each request that’s run from the navigation is then displayed in the navigation as separate page. Every page shows from and to timestamps of the incoming log lines. You can see previous results by clicking on the page. Explore caches the last five requests run from the logs navigation, so you’re not re-running the same queries when clicking on the pages.

Visualization options

You can customize how logs are displayed and select which columns are shown.

Time

Shows or hides the time column. This is the timestamp associated with the log line as reported from the data source.

Unique labels

Shows or hides the unique labels column that includes only non-common labels. All common labels are displayed above.

Wrap lines

Set this to True if you want the display to use line wrapping. If set to False, it will result in horizontal scrolling.

Prettify JSON

Set this to true to pretty print all JSON logs. This setting does not affect logs in any format other than JSON.

Deduplication

Log data can be very repetitive and Explore can help by hiding duplicate log lines. There are a few different deduplication algorithms that you can use:

Exact - Exact matches are done on the whole line except for date fields.
Numbers - Matches on the line after stripping out numbers such as durations, IP addresses, and so on.
Signature - The most aggressive deduplication, this strips all letters and numbers and matches on the remaining whitespace and punctuation.

Display results order

You can change the order of received logs from the default descending order (newest first) to ascending order (oldest first).

Labels and detected fields

Each log line has an extendable area, with its labels and detected fields, for more robust interaction. You can filter for (positive filter) and filter out (negative filter) selected labels. Additionally, you can select a unique field to visualize instead of the whole log line by clicking on the eye icon. Finally, each field or label also has a stats icon to display ad-hoc statistics in relation to all displayed logs.

Escaping newlines

Explore automatically detects some incorrectly escaped sequences in log lines, such as newlines (\n, \r) or tabs (\t). When it detects such sequences, Explore provides an “Escape newlines” option.

To automatically fix incorrectly escaped sequences that Explore has detected:

Click “Escape newlines” to replace the sequences.
Manually review the replacements to confirm their correctness.

Explore replaces these sequences. When it does so, the option will change from “Escape newlines” to “Remove escaping”. Evaluate the changes as the parsing may not be accurate based on the input received. You can revert the replacements by clicking “Remove escaping”.

Data links

By using data links, you can turn any part of a log message into an internal or external link. The created link is visible as a button in the Links section inside the Log details view.

Log context

Log context is a feature that allows you to display additional lines of context surrounding a log entry that matches a particular search query. This can be helpful in understanding the log entry’s context, and is similar to the -C parameter in the grep command.

When using Log context in Grafana, you can configure the number of lines of context to display before and after the matching log entry. By default, the Log context feature will show the log entry itself along with the 50 lines before and after it. However, this can be adjusted as needed depending on the specific use case.

You may encounter long lines of text that make it difficult to read and analyze the context around each log entry. This is where the Wrap lines toggle can come in handy. By enabling this toggle, Grafana will automatically wrap long lines of text so that they fit within the visible width of the viewer. This can make it easier to read and understand the log entries.

The Open in split view button allows you to execute the context query for a log entry in a split screen in the Explore view. Clicking this button will open a new Explore pane with the context query displayed alongside the log entry, making it easier to analyze and understand the surrounding context.

Loki-specific features

As mentioned, one of the log integrations is for the new open source log aggregation system from Grafana Labs - Loki. Loki is designed to be very cost effective, as it does not index the contents of the logs, but rather a set of labels for each log stream. The logs from Loki are queried in a similar way to querying with label selectors in Prometheus. It uses labels to group log streams which can be made to match up with your Prometheus labels. For more information about Grafana Loki, refer to Grafana Loki or the Grafana Labs hosted variant: Grafana Cloud Logs.

For more information, refer to Loki’s data source documentation on how to query for log data.

Switch from metrics to logs

If you switch from a Prometheus query to a logs query (you can do a split first to have your metrics and logs side by side) then it will keep the labels from your query that exist in the logs and use those to query the log streams. For example, the following Prometheus query:

grafana_alerting_active_alerts{job="grafana"}

after switching to the Logs data source, the query changes to:

{job="grafana"}

This will return a chunk of logs in the selected time range that can be grepped/text searched.

Logs sample

If the selected data source implements logs sample, and supports both log and metric queries, then for metric queries you will be able to automatically see samples of log lines that contributed to visualized metrics. This feature is currently supported by Loki data sources.

Live tailing

Use the Live tailing feature to see real-time logs on supported data sources.

Click the Live button in the Explore toolbar to switch to Live tail view.

While in Live tail view new logs will come from the bottom of the screen and will have fading contrasting background so you can keep track of what is new. Click the Pause button or scroll the logs view to pause the Live tailing and explore previous logs without interruption. Click Resume button to resume the Live tailing or click Stop button to exit Live tailing and go back to standard Explore view.

Tracing in Explore

Fri, 06 Mar 2026 06:34:21 +0000

Tracing in Explore

You can use Explore to query and visualize traces from tracing data sources.

Supported data sources are:

For information on how to configure queries for the data sources listed above, refer to the documentation for specific data source.

Query editor

You can query and search tracing data using a data source’s query editor.

Each data source can have it’s own query editor. The query editor for the Tempo data source is slightly different than the query editor for the Jaegar data source.

For information on querying each data source, refer to their documentation:

Trace View

This section explains the elements of the Trace View.

Header title: Shows the name of the root span and trace ID.
Search: Highlights spans containing the searched text.
Metadata: Various metadata about the trace.

Minimap

Shows condensed view or the trace timeline. Drag your mouse over the minimap to zoom into smaller time range. Zooming will also update the main timeline, so it is easy to see shorter spans. Hovering over the minimap, when zoomed, will show Reset Selection button which resets the zoom.

Span Filters

Note
This feature is behind the newTraceViewHeader feature toggle. If you use Grafana Cloud, open a support ticket in the Cloud Portal to access this feature.

Using span filters, you can filter your spans in the trace timeline viewer. The more filters you add, the more specific are the filtered spans.

You can add one or more of the following filters:

Service name
Span name
Duration
Tags (which include tags, process tags, and log fields)

Timeline

Shows list of spans within the trace. Each span row consists of these components:

Expand children button: Expands or collapses all the children spans of selected span.
Service name: Name of the service logged the span.
Operation name: Name of the operation that this span represents.
Span duration bar: Visual representation of the operation duration within the trace.

Clicking anywhere on the span row shows span details.

Span details

Operation name.
Span metadata.
Tags: Any tags associated with this span.
Process metadata: Metadata about the process that logged this span.
Logs: List of logs logged by this span and associated key values. In case of Zipkin logs section shows Zipkin annotations.

Trace to logs

Note
Available in Grafana 7.4 and later versions.

You can navigate from a span in a trace view directly to logs relevant for that span. This feature is available for Tempo, Jaeger, and Zipkin data sources. Refer to their relevant documentation for configuration instructions.

Click the document icon to open a split view in Explore with the configured data source and query relevant logs for the span.

Trace to metrics

Note
This feature is currently in beta & behind the traceToMetrics feature toggle.

You can navigate from a span in a trace view directly to metrics relevant for that span. This feature is available for Tempo, Jaeger, and Zipkin data sources. Refer to their relevant documentation for configuration instructions.

Node Graph

You can optionally expand the node graph for the displayed trace. Depending on the data source, this can show spans of the trace as nodes in the graph, or as some additional context like service graph based on the current trace.

Service Graph

The Service Graph visualizes the span metrics (traces data for rates, error rates, and durations (RED)) and service graphs. Once the requirements are set up, this pre-configured view is immediately available.

For more information, refer to the Service Graph view section of the Tempo data source page and the service graph view page in the Tempo documentation.

Data API

This visualization needs a specific shape of the data to be returned from the data source in order to correctly display it.

Data source needs to return data frame and set frame.meta.preferredVisualisationType = 'trace'.

Data frame structure

Required fields:

Field name	Type	Description
traceID	string	Identifier for the entire trace. There should be only one trace in the data frame.
spanID	string	Identifier for the current span. SpanIDs should be unique per trace.
parentSpanID	string	SpanID of the parent span to create child parent relationship in the trace view. Can be `undefined` for root span without a parent.
serviceName	string	Name of the service this span is part of.
serviceTags	TraceKeyValuePair[]	List of tags relevant for the service.
startTime	number	Start time of the span in millisecond epoch time.
duration	number	Duration of the span in milliseconds.

Optional fields:

Field name	Type	Description
logs	TraceLog[]	List of logs associated with the current span.
tags	TraceKeyValuePair[]	List of tags associated with the current span.
warnings	string[]	List of warnings associated with the current span.
stackTraces	string[]	List of stack traces associated with the current span.
errorIconColor	string	Color of the error icon in case span is tagged with `error: true`.

For details about the types see TraceSpanRow, TraceKeyValuePair and TraceLog.

Inspector in Explore

Fri, 06 Mar 2026 06:34:21 +0000

Inspector in Explore

The inspector helps you understand and troubleshoot your queries. You can inspect the raw data, export that data to a comma-separated values (CSV) file, export log results in TXT format, and view query requests.

Inspector UI

The inspector has following tabs:

Stats tab - Shows how long your query takes and how much it returns.
Query tab - Shows you the requests to the server sent when Grafana queries the data source.
JSON tab - Allows you to view and copy the data JSON and data frame structure JSON.
Data tab - Shows the raw data returned by the query.
Error tab - Shows the error. Only visible when query returns error.

Inspector tasks

You can perform a variety of tasks in the Explore inspector.

Open the Inspector

Run the query you would like to inspect.
Click the Inspector button.

The inspector pane opens on the bottom of the screen.

Inspect raw query results

You can view raw query results, that is the data returned by the query in a table.

In the Inspector tab, click the Data tab.

For multiple queries or for queries multiple nodes, there are additional options.

Show data frame: Select the result set data you want to view.
Series joined by time: View the raw data from all of your queries at once, one result set per column. You can click a column heading to sort the data.

Download raw query results as CSV

Grafana generates a CSV file in your default browser download location. You can open it in the viewer of your choice.

In the Inspector tab, get raw query results by following the instructions described in Inspect raw query results.
Refine query settings until you can see the raw data that you want to export.
Click Download CSV.

In order to download a CSV file specifically formatted for Excel, expand Data options and then enable the Download for Excel toggle before you click the Download CSV option.

Download log results as TXT

Grafana generates a TXT file in your default browser download location. You can open it in the viewer of your choice.

Open the inspector.
Inspect the log query results as described above.
Click Download logs.

Download trace results

Based on the data source type, Grafana generates a JSON file for the trace results in one of the supported formats: Jaeger, Zipkin, or OTLP formats.

Open the inspector.
Inspect the trace query results as described above.
Click Download traces.

Inspect query performance

The Stats tab displays statistics that tell you how long your query takes, how many queries you send, and the number of rows returned. This information can help you troubleshoot your queries, especially if any of the numbers are unexpectedly high or low.

Open the inspector.
Navigate to the Stats tab.

Statistics are displayed in read-only format.

View JSON model

You can explore and export data as well as data frame JSON models.

In the Inspector panel, click the JSON tab.
From the Select source dropdown, choose one of the following options:
- Data - Displays a JSON object representing the data that was returned to Explore.
- DataFrame structure - Displays the raw result set.
You can expand or collapse portions of the JSON to view separate sections. You can also click the Copy to clipboard option to copy JSON body and paste it into another application.

View raw request and response to data source

Open the panel inspector and then click the Query tab.
Click Refresh.

Grafana sends the query to the server and displays the result. You can drill down on specific portions of the query, expand or collapse all of it, or copy the data to the clipboard to use in other applications.