Log Explorer¶

After log data is collected into the system, you can view all log data reported in the current workspace from Logs > Explorer.

Note

If the role of the currently logged-in account has set Logs > Data Access to "Show only rules related to me", the queried log content will be affected accordingly.

View Modes¶

To meet the needs of viewing and analysis in different scenarios, the Explorer supports multiple display modes:

List

Stacked List

Chart

List¶

Each field of the log occupies one column, displaying all field content completely, allowing you to view the detailed information of each log intuitively.

Stacked List¶

Except for the time field (time), all other fields are merged into one column and displayed in multiple lines within the cell:

In stacked mode, you can perform operations on specific fields as shown:

If the field content is in JSON structure, the stacked list supports expanding and viewing by hierarchy. You can configure the default expansion mode for JSON fields in Preferences, including collapsed or fully expanded, to quickly locate fields in multi-level structures.

Chart¶

Based on count, last, first, and count_distinct aggregation modes, filter data under the by condition:

Top List
Time Series Chart
Pie Chart
Treemap
Grouped Table Chart

View Switching and Configuration Retention¶

After configuring the analysis dimension, aggregation method, Top/Bottom, and return count in the Top List, switching to the List or Stacked List does not clear the analysis configuration. When you return to the Top List, the system restores the previous configuration.

If the current log index, time range, query mode, search conditions, and quick filter conditions have not changed, the existing query results are reused;
If the query context changes, the original analysis configuration is retained, and a new query is executed based on the new context;
When advanced query is used together with page analysis configuration, the BY condition in the query statement is ignored, and the page analysis dimension takes precedence.

Data Display¶

All Logs¶

By default, queries the normal log indexes in the current workspace, excluding cloned indexes. To query cloned data, you must explicitly select the corresponding cloned index in the index list on the left.

Browsing Mode¶

The log data list supports two browsing modes: pagination and infinite scroll. You can select the corresponding mode in Preferences.

PaginationInfinite Scroll

Browse log data by page number to view different ranges, suitable for browsing and locating logs page by page in large amounts of log data.

When using pagination, you can perform the following operations:

Navigate to the previous or next page;
Enter or select a target page number;
Adjust the number of items displayed per page.

Maintains a continuous browsing experience. When you scroll to the bottom of the current data list, the system continues to load subsequent logs.

Switching between browsing modes does not change the current workspace, log index, time range, search conditions, or quick filter conditions.

Line Break¶

In the stacked list, if a single log contains many data elements, clicking the "Line Break" button allows the message part of the log to be displayed independently.

Pattern¶

The Log Explorer provides an efficient pattern analysis feature that performs similarity analysis on logs based on the message field and automatically displays the most recent 50 logs. You can also customize the pattern field. After selecting a time range in the time widget, the system analyzes 10,000 logs within that period and aggregates similar entries.

In the pattern analysis list, you can manage data through the following operations:

Click & to sort by document count (descending by default);
Click to select displaying 1 line, 3 lines, 10 lines, or all content;
Click to export all pattern log data.