Slide 3 of 5

The log investigation workflow

Logs investigation workflow

A typical investigation moves through five steps, though you can jump between them or skip the ones you don’t need.

Log investigation workflow showing five steps

StepWhat you doWhat you get
Filter by labelsSelect service, job, instance, etc.Logs from specific sources
Navigate to detailed breakdownsView log list, logs volume, labels, fields, patternsMultiple perspectives on log data
Search and filterUse fields, patterns, and text searchRelevant logs matching criteria
Drill into contextExpand log lines and click field valuesRelated logs and context
Act on itAdd to a dashboard, save the view, or open in ExploreA dashboard panel or saved view, with your query and time range

Open-ended investigation

This workflow supports investigation when you don’t know exactly what you’re looking for:

  • Start broad, for example, all logs from a service.
  • Narrow progressively, for example, errors only, then specific text.
  • Follow interesting findings, for example, click fields to filter further.
  • Build context, for example, expand log lines to see before and after.
  • Watch log volume over time to spot error spikes, rising warnings, or unusual drops.
  • Use the patterns breakdown to group similar lines and include or exclude them.

Script

A typical log investigation has five main steps. It’s a common pattern rather than a fixed sequence, so you can move between them as you go.

First, filter by labels to find the source of the logs. Select service, job, instance, or other labels to narrow down where the logs are coming from.

Second, navigate to the detailed breakdowns of the logs. You’ll see the log list, logs volume over time, and breakdowns by labels, fields, and patterns. Log volume over time makes error spikes and unusual drops easy to spot, and the patterns breakdown groups similar lines so you can include or exclude them.

Third, search and filter using fields, patterns, and text search. Use field filters to focus on specific log levels or status codes. Apply pattern filters to group similar logs. Search for specific text in the log messages.

Fourth, drill into context. When you find an interesting log line, expand it to see the full details, or click on field values to filter further. This helps you trace a problem through multiple log entries.

Finally, act on what you find. Add a view to a dashboard, save it to resume later, or open it in Explore for a custom LogQL query. A dashboard panel arrives with your query and time range already configured.

Unlike writing LogQL queries, this workflow is open-ended. You’re clicking and filtering based on what you see, not trying to construct the perfect query from scratch.

/
Previous Next