---
title: "The log investigation workflow | Grafana Labs"
description: "Filter by labels, navigate detailed views, search and filter, drill into context"
---

> For a curated documentation index, see [llms.txt](/llms.txt). For the complete documentation index, see [llms-full.txt](/llms-full.txt).

## Logs investigation workflow

A typical investigation moves through five steps, though you can jump between them or skip the ones you don’t need.

| Step                                | What you do                                           | What you get                                                    |
|-------------------------------------|-------------------------------------------------------|-----------------------------------------------------------------|
| **Filter by labels**                | Select service, job, instance, etc.                   | Logs from specific sources                                      |
| **Navigate to detailed breakdowns** | View log list, logs volume, labels, fields, patterns  | Multiple perspectives on log data                               |
| **Search and filter**               | Use fields, patterns, and text search                 | Relevant logs matching criteria                                 |
| **Drill into context**              | Expand log lines and click field values               | Related logs and context                                        |
| **Act on it**                       | Add to a dashboard, save the view, or open in Explore | A dashboard panel or saved view, with your query and time range |

## Open-ended investigation

This workflow supports investigation when you don’t know exactly what you’re looking for:

- Start broad, for example, all logs from a service.
- Narrow progressively, for example, errors only, then specific text.
- Follow interesting findings, for example, click fields to filter further.
- Build context, for example, expand log lines to see before and after.
- Watch log volume over time to spot error spikes, rising warnings, or unusual drops.
- Use the patterns breakdown to group similar lines and include or exclude them.