Log Explorer¶
After log data is collected into the system, you can view all log data reported in the current workspace in Logs > Explorer.
Note
If the current login account role has set "Only display rules related to me" in Logs > Data Access, the queried log content will be similarly affected.
View Modes¶
To meet the viewing and analysis needs of different scenarios, the Explorer supports multiple display modes:
List¶
Each field of the log occupies a separate column, fully displaying all field content, allowing intuitive viewing of detailed information for each log.
Stacked List¶
Except for the time field (time), all other fields are merged into the same column and displayed in multiple rows within the cell:
In stacked mode, you can perform operations on specific fields as shown:
If the field content is a JSON structure, the stacked list supports hierarchical expansion. You can configure the default expansion mode for JSON fields in Preferences, including no expansion or full expansion, to quickly locate fields in multi-level structures.
Chart¶
Based on count, last, first, count_distinct operations, filter data under by conditions:
-
Top List
-
Time Series Chart
-
Pie Chart
-
Treemap
-
Grouped Table
Data Display¶
All Logs¶
Displays the raw log data collected.
Browse Modes¶
The log data list supports both paged browsing and scroll loading. You can select the corresponding mode in Preferences.
Switch between pages to view different ranges of log data, suitable for browsing and locating logs page by page in large volumes.
When using paged browsing, you can perform the following operations:
- Navigate to the previous or next page.
- Enter or select a target page number.
- Adjust the number of items displayed per page.
Maintains a continuous browsing experience. When scrolling to the bottom of the current data list, the system continues to load subsequent logs.
Switching browse modes does not change the current workspace, log index, time range, search conditions, or quick filter conditions.
Line Break¶
In stacked list view, if a single log contains many data elements, clicking the "Line Break" button allows the message part of the log to be displayed independently.
Pattern¶
The Log Explorer provides efficient clustering functionality, which can perform similarity analysis on logs based on the message field and automatically display the most recent 50 logs. You can also customize the clustering fields. After selecting a time range in the time widget, the system analyzes 10,000 logs within that period and aggregates similar entries.
In the Pattern list, you can manage data through the following operations:
-
Click & to sort by document count (default descending).
-
Click to select displaying 1 line, 3 lines, 10 lines, or all content.
-
Click to export all clustered log data.