Query the data source
The query editor allows you to write LogScale Query Language (LQL) queries. For more information about writing LQL queries, refer to Query Language Syntax. Select a repository from the drop-down menu to query. You will only see repositories that your data source account has access to.
Selecting $defaultRepo
from the Repository dropdown automatically maps to the default repository configured for the datasource which enables switching between multiple LogScale datasources.
You can use your LogScale saved queries in Grafana. For more information about saved queries, refer to User Functions.
Here are some useful LQL functions to get you started with Grafana visualizations:
Explore view
The Explore view allows you to run LQL queries and visualize the results as logs or charts. For more information about Explore, refer to Explore. For more information about Logs in Explore, refer to Logs Drilldown.
Grafana v9.4.8 and later allows you to create data links in Tempo, Grafana Enterprise Traces, Jaeger, and Zipkin that target Falcon LogScale. To configure data links, refer to Configure data links
Tail live logs (Live query)
Falcon LogScale supports live tailing of logs in real-time in Explore view and Dashboards.
Live tailing relies on a websocket connection between the browser and Grafana server.
To start tailing logs in Explore view, click the Live
button in the top right corner next to the Run query
button.
To start making a live panel in a dashboard, enable Refresh live dashboards
in the dashboard’s settings under the General tab. After enabling this setting, you can Enable live querying
in the panel query editor. Live query data is not formatted by default. To format data into types, use Transforms. You can separate fields returned by using the Extract fields
transform on @rawstring
.
For information on setting up Grafana Live for your own instance of Grafana refer to Set up Grafana Live