---
title: "How to find and filter logs | Grafana Labs"
description: "Filter logs by labels, fields, and text"
---

> For a curated documentation index, see [llms.txt](/llms.txt). For the complete documentation index, see [llms-full.txt](/llms-full.txt).

# How to find and filter logs

After you open a service, Logs Drilldown gives you labels, fields, and the text of the log line. Use them together when you need a narrower set of lines.

## The three layers

| Layer      | What it contains                                                                                                                                                              | Example                              |
|------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|--------------------------------------|
| **Labels** | Indexed labels on the log line, including the service                                                                                                                         | `job="api"`, `instance="server-01"`  |
| **Fields** | Values extracted from the log line. Turn on **Extract fields from logs** to run logfmt and JSON parsers so those fields appear next to indexed labels and structured metadata | `level="error"`, `status_code="500"` |
| **Text**   | The log message itself. The line filter keeps lines that contain, or exclude, the text you type                                                                               | `Connection timeout to database`     |

Logs Drilldown also adds a `detected_level` label for the level Loki assigns, including `debug`, `info`, `warn`, `error`, `fatal`, `critical`, `trace`, or `unknown` when no level could be determined.

## A way to narrow the logs

1. On the **Labels** tab, select **Select** or **Include** on a label to see its values and filter.
2. On the **Fields** tab, select **Select** for a value breakdown, or **Include** or **Add to filter** to filter by a field value. Select **Extract fields from logs** if the field you need is inside the log line.
3. On the **Logs** tab, type text in the line filter to keep or drop matching lines.

The **Patterns** tab groups similar log lines from the previous three hours, when pattern ingestion is enabled. A time range that is entirely older than those three hours shows no patterns. Patterns also do not support multi-tenant or cross-stack data sources.