---
title: "How Logs Drilldown organizes data | Grafana Labs"
description: "Labels, detected fields, and filtering mechanics"
---

> For a curated documentation index, see [llms.txt](/llms.txt). For the complete documentation index, see [llms-full.txt](/llms-full.txt).

## How Logs Drilldown organizes data

Logs have three layers of organization that you can use for filtering.

## The three layers

| Layer            | What it contains                                           | Example                              |
|------------------|------------------------------------------------------------|--------------------------------------|
| **Labels**       | Index identifying the log stream                           | `job="api"`, `instance="server-01"`  |
| **Fields**       | Additional metadata and parsed fields from the log message | `level="error"`, `status_code="500"` |
| **Text content** | The actual log message                                     | “Connection timeout to database”     |

## Filtering strategy

Use all three layers together for precise investigation:

1. Filter by labels to narrow to specific services or systems
2. Filter by fields to focus on certain attributes from the logs, such as log level, status code, or other structured data
3. Search text to find specific messages or error patterns