Explore & Search

Explore (under Telemetry) searches logs, spans and events together, from every Stream in the namespace, newest last like a log tail. Each row says what it is (log, span or event) and which Stream it came from. Metrics have their own builder under Metrics, next to it.

Click a row to see everything it carries. A row with a trace opens the trace's waterfall, with the logs and events from the same trace.

Searching

Type a search and press Enter. Filters show as chips while typing, and the box suggests field names, Stream names and common values along the way.

Search	Finds
payment failed	the words anywhere in a log line, span name or event
level:error	a field's value (any case, partial matches count)
level:"ERROR"	an exact value
-level:debug, level:-debug, NOT level:debug	everything else (a - before a number is its sign: duration_ms:-5; quote a value to search for a literal dash: level:"-debug")
level:error AND service:checkout	both (AND is implied between filters)
level:error OR level:fatal	either
path:/api*, name:*checkout*	a wildcard (* at the start or the end of a value)
duration_ms:>250, status:>=500	a number compared
duration_ms:[100 TO 500]	a range ([1000 TO *] for "at least")
order_id:*	records that have the field

Not sure of the syntax? The ? next to the box, and the last row of its suggestions, open a cheat sheet of examples that run as written; hover a field in the suggestions to see examples for it.

Clicking the search box opens earlier searches underneath, pinned ones first: each shows when the search ran, how many records matched and over which window. Arrow keys and Enter, or a click, run a search again; frequent searches can be pinned, others removed. History stays in this browser only. A search joins the list on Enter, or once the text has stayed put for a moment.

Streams and signals

Search	Finds
stream:checkout	one Stream by name (any case); quote names with spaces: stream:"Checkout API"
stream:checkout*	Streams whose names match
streamId:strm_…	one Stream by id
signal:log, signal:span, signal:event	only logs, spans or events (logs, traces, events work too)

The Stream menu and the All / Logs / Spans / Events switch next to the search box add or change these filters, so the search always reflects the current view, and a copied link opens the same view.

If no Stream has that name, stream: searches an attribute called stream instead (Docker and Kubernetes logs have stream:stdout).

Fields that mean the same everywhere

Logs, spans and events store different things, so a few names cover all three:

Field	Log	Span	Event
service	service name	service name	the service attribute
level	severity	status (Error, Ok, Unset)	severity
name	event name	span name	event name
body	the log line	status message	body
duration_ms		duration	duration
trace_id, span_id	trace and span	trace and span	trace and span

Anything else is an attribute: http.route:/cart matches it on whichever records have the field. Records without the field don't match.

Events from browsers and apps

Events from the analytics script, or from an app that names its visitor, carry more fields. They only match events, and their names stand for these fields even where an attribute shares the name:

Field	What it holds
vital_lcp, vital_inp, vital_ttfb, vital_fcp, vital_cls	the page speed vitals (milliseconds; CLS is a score)
engaged_ms, scroll_depth	time on the page, and how far it was scrolled (percent)
path, hostname, referrer, source	where the visit was and where it came from
utm_source, utm_medium, utm_campaign, utm_content, utm_term	the campaign tags
country, geo_region, city	where the visitor is
browser, browser_version, os, os_version, device	what they used
visitor_id	the visitor

So vital_lcp:>500 finds page loads with a Largest Contentful Paint over half a second. A browser that can't measure a vital reports 0 (CLS: -1), so to look below a value add vital_lcp:>0: vital_lcp:>0 AND vital_lcp:<1000. The column names work too (VitalLcp:>500).

Time, the histogram and the table

Pick a window from 15 minutes to 7 days, or Custom for any duration (45m, 2h30m, 10d), reuse a recent one, or pick fixed dates. The default is 6 hours. The bars under the chart show how many records fall in each slice of the window; hover one for its count. The box on them marks the records in the table below, and dragging it scans through the window: the table follows, showing the records around the release point.

The table shows what fits: long values are cut short (hover a cell to read more), and only scrolls sideways when the chosen columns really don't fit.

• Columns adds and removes columns. Besides the fields above, every attribute the loaded records carry can be a column, so k8s.pod.name or http.route sit right in the table.
• Drag a column's header to move it; drag the edge of a header to resize it (double-click the edge to reset). The ⋯ menu on a header filters by, groups by, sorts or hides it.
• Columns, order and widths are remembered in this browser.

Charts, fields and patterns

• Fields lists the fields searchable records carry. Clicking a field breaks the chart down by that field (stream works too).
• Complex mode charts an aggregation (p95 of duration_ms, say) instead of a count.
• Patterns groups the log lines and events the search finds into patterns.
• Add to Dashboard and Create Monitor start from the search. A monitor reads one Stream and one signal, which its stream: and signal: filters pick.

Monitors and formulas

The same search box appears wherever telemetry gets filtered: monitors, derived metrics and dashboard widgets. Formulas (a / b * 100) and composite conditions (a && (b || !c)) get their own: each query or monitor they name shows as a chip (hover it to see what it is), and a name that isn't set up is underlined.