Falcon LogScale query editor

Query the data source

The query editor allows you to write LogScale Query Language (LQL) queries. For more information about writing LQL queries, refer to Query Language Syntax. Select a repository from the drop-down menu to query. You will only see repositories that your data source account has access to.

Selecting $defaultRepo from the Repository dropdown automatically maps to the default repository configured for the datasource which enables switching between multiple LogScale datasources.

You can use your LogScale saved queries in Grafana. For more information about saved queries, refer to User Functions.

Here are some useful LQL functions to get you started with Grafana visualizations:

FunctionDescriptionExample
timeChartGroups data into time buckets. This is useful for time series panels.timeChart(span=1h, function=count())
tableReturns a table with the provided fields.table([statuscode, responsetime])
groupByGroup results by field values. This is useful for bar chart, stat, and gauge panels.groupBy(_field, function=count())

Explore view

The Explore view allows you to run LQL queries and visualize the results as logs or charts. For more information about Explore, refer to Explore. For more information about Logs in Explore, refer to Logs Drilldown.

Grafana v9.4.8 and later allows you to create data links in Tempo, Grafana Enterprise Traces, Jaeger, and Zipkin that target Falcon LogScale. To configure data links, refer to Configure data links

Tail live logs (Live query)

Falcon LogScale supports live tailing of logs in real-time in Explore view and Dashboards.

Live tailing relies on a websocket connection between the browser and Grafana server.

To start tailing logs in Explore view, click the Live button in the top right corner next to the Run query button.

To start making a live panel in a dashboard, enable Refresh live dashboards in the dashboard’s settings under the General tab. After enabling this setting, you can Enable live querying in the panel query editor. Live query data is not formatted by default. To format data into types, use Transforms. You can separate fields returned by using the Extract fields transform on @rawstring.

For information on setting up Grafana Live for your own instance of Grafana refer to Set up Grafana Live