Logs Drilldown on Grafana Labs

Logs Drilldown

Fri, 24 Apr 2026 09:55:28 -0400

Logs Drilldown

What you learned in Metrics Drilldown:

Queryless exploration through point-and-click
Field-based filtering to narrow investigations
Visual pattern detection in time series
Adding findings to dashboards

In this module, you’ll apply the same exploration approach to logs:

Learn how Grafana Logs Drilldown organizes labels, fields, and content
Navigate, filter, search, and analyze log patterns
Complete a hands-on learning path with real logs
Save log visualizations to dashboards for monitoring

Estimated time: 12-15 minutes

What is Grafana Logs Drilldown?

Fri, 24 Apr 2026 09:55:28 -0400

What is Logs Drilldown?

Grafana Logs Drilldown is a queryless interface for exploring logs that enables automatic visualization and exploration without writing LogQL.

How it works

Logs Drilldown automatically detects structure in your logs:

Labels that index logs (job, instance, namespace)
Parsed fields extracted from log messages (level, status_code, user_id)
The actual log message content
Timestamp of when logs were emitted

Core capabilities

Narrow to specific services or systems
Find logs matching certain patterns or field values
Look for specific messages or errors
Observe log distribution over time
Save, share, and resume explorations
Create dashboards and alerts from findings

How Logs Drilldown organizes data

Fri, 24 Apr 2026 09:55:28 -0400

How Logs Drilldown organizes data

Logs have three layers of organization that you can use for filtering.

The three layers

Layer	What it contains	Example
Labels	Index identifying the log stream	`job="api"`, `instance="server-01"`
Fields	Additional metadata and parsed fields from the log message	`level="error"`, `status_code="500"`
Text content	The actual log message	“Connection timeout to database”

Filtering strategy

Use all three layers together for precise investigation:

Filter by labels to narrow to specific services or systems
Filter by fields to focus on certain attributes from the logs, such as log level, status code, or other structured data
Search text to find specific messages or error patterns

The log exploration workflow

Fri, 24 Apr 2026 09:55:28 -0400

The log exploration workflow

Logs Drilldown follows a four-step pattern for investigating log data.

The workflow

Step	What you do	What you get
Filter by labels	Select service, job, instance, etc.	Logs from specific sources
Navigate to detailed breakdowns	View log list, logs volume, labels, fields, patterns	Multiple perspectives on log data
Search and filter	Use fields, patterns, and text search	Relevant logs matching criteria
Drill into context	Expand log lines and click field values	Related logs and context

Exploratory investigation

This workflow supports investigation when you don’t know exactly what you’re looking for:

Start broad (all logs from a service)
Narrow progressively (errors only, then specific text)
Follow interesting findings (click fields to filter further)
Build context (expand log lines to see before/after)

Log pattern recognition

Fri, 24 Apr 2026 09:55:28 -0400

Log pattern recognition

Visual exploration helps you identify errors, warnings, and anomalies in log data.

Pattern exploration workflow

Use patterns to quickly group and filter similar logs:

Navigate to the patterns breakdown
See the list of detected patterns
Include or exclude patterns to focus your investigation

Dashboard integration for logs

Fri, 24 Apr 2026 09:55:28 -0400

Dashboard integration for logs

Add log visualizations from Logs Drilldown directly to dashboards.

How to add logs to dashboards

From any panel in Logs Drilldown:

Click the triple-dot menu (⋯) at the top of the panel
Select “Add to dashboard” to save the current view
Or select “Create alert” to set up alerting on the logs

Explore logs learning path

Fri, 24 Apr 2026 09:55:28 -0400

Learning path: Explore logs with Logs Drilldown

Learning path

Logs Drilldown

Welcome to the Grafana learning path that shows you how to use Logs Drilldown to explore your logs and provide insight into troubleshooting.

13 min

Beginner

Docs & blog posts

Open in Grafana Cloud

Complete this learning path directly in your Grafana Cloud stack, or in the Grafana Play stack, with an interactive learning experience.

Open in Grafana Cloud Try in Grafana Play

View on website

Logs exploration complete

Fri, 24 Apr 2026 09:55:28 -0400

Logs exploration complete!

What you accomplished:

Accessed Logs Drilldown from the main menu
Filtered logs using labels and detected fields
Searched for specific text patterns and errors
Added log visualizations to a dashboard

Skills unlocked:

Skill	You can now…
Queryless log exploration	Investigate Loki logs without writing LogQL
Multi-layer filtering	Use labels, fields, and text search together
Pattern recognition	Identify errors, warnings, and volume anomalies
Shared labels with metrics	Connect logs to metrics using shared labels
Dashboard integration	Save log findings for permanent monitoring

What’s next

You’ve completed both core infrastructure modules: Metrics Drilldown and Logs Drilldown. In the wrap-up ahead, we’ll review where these skills fit in your observability journey and what to explore next.