Sign in Sign up

Section 3 · Logs Drilldown

Filter by labels, navigate detailed views, search and filter, drill into context

Estimated time: 1 min

Logs investigation workflow

A typical investigation moves through five steps, though you can jump between them or skip the ones you don’t need.

Step	What you do	What you get
Filter by labels	Select service, job, instance, etc.	Logs from specific sources
Navigate to detailed breakdowns	View log list, logs volume, labels, fields, patterns	Multiple perspectives on log data
Search and filter	Use fields, patterns, and text search	Relevant logs matching criteria
Drill into context	Expand log lines and click field values	Related logs and context
Act on it	Add to a dashboard, save the view, or open in Explore	A dashboard panel or saved view, with your query and time range

Open-ended investigation

This workflow supports investigation when you don’t know exactly what you’re looking for:

Start broad, for example, all logs from a service.
Narrow progressively, for example, errors only, then specific text.
Follow interesting findings, for example, click fields to filter further.
Build context, for example, expand log lines to see before and after.
Watch log volume over time to spot error spikes, rising warnings, or unusual drops.
Use the patterns breakdown to group similar lines and include or exclude them.

0:00

0:00

Read transcript

Audio transcript

A typical log investigation has five main steps. It’s a common pattern rather than a fixed sequence, so you can move between them as you go.

First, filter by labels to find the source of the logs. Select service, job, instance, or other labels to narrow down where the logs are coming from.

Second, navigate to the detailed breakdowns of the logs. You’ll see the log list, logs volume over time, and breakdowns by labels, fields, and patterns. Log volume over time makes error spikes and unusual drops easy to spot, and the patterns breakdown groups similar lines so you can include or exclude them.

Third, search and filter using fields, patterns, and text search. Use field filters to focus on specific log levels or status codes. Apply pattern filters to group similar logs. Search for specific text in the log messages.

Fourth, drill into context. When you find an interesting log line, expand it to see the full details, or click on field values to filter further. This helps you trace a problem through multiple log entries.

Finally, act on what you find. Add a view to a dashboard, save it to resume later, or open it in Explore for a custom LogQL query. A dashboard panel arrives with your query and time range already configured.

Unlike writing LogQL queries, this workflow is open-ended. You’re clicking and filtering based on what you see, not trying to construct the perfect query from scratch.