Log Visibility Delay¶

Manage > Workspace Settings > Advanced Settings allows you to set a unified visibility delay window for log queries. Once enabled, the system automatically applies a unified visibility restriction to log queries: new logs within the delay window are not exposed to user queries; only log data before the delay window can be queried. This feature only affects query visibility and does not affect log ingestion, monitors, or alert processing.

When this feature is disabled, log query behavior remains unchanged.

Configuration Steps¶

1. Go to Manage > Workspace Settings > Advanced Settings.
2. Find the Log Visibility Delay module and click Settings.
3. Turn on the Enable Log Visibility Delay toggle.

4. Select the index scope:

   • All: Applies to all indexes in the current workspace with one unified delay time.
   • Custom: Configure different delay times for different indexes.

5. Configure the delay time:

   • When All is selected, select the window duration from the Delay Time drop-down list (1 minute, 5 minutes, 10 minutes, 15 minutes, or 30 minutes).
   • When Custom is selected, click Add Rule, select an index, and set the delay time. Different delay times can be configured for different indexes. The same index cannot be configured repeatedly in multiple rules. Indexes without a configured visibility delay are not subject to any delay restriction.

6. Click OK to save the configuration.

How the Delay Applies to Queries¶

1. When querying a single index, the delay time configured for that index applies.
2. When querying multiple indexes and different delay times are configured, the strictest delay time applies to the entire query—that is, the largest delay time among all matched indexes.

Viewing Query Notices¶

After Log Visibility Delay is enabled, the Log Explorer shows the delay duration that applies to the current query. If multiple indexes with different delay times are queried, the notice states that the longest delay time applies to the current query.

If the query time range falls entirely within the delay window, the Log Explorer prompts you to adjust the time range or try again later. Adjust the query time range to a time before the delay window, or wait until the logs in the target time period become visible and query again. For an example, see Log Explorer visibility delay notice.

Impact Scope¶

• Affected: Log query behavior. Once enabled, queries from all users return only data before the delay window.
• Unaffected: System-internal pipelines such as log data ingestion, Monitor detection, alert triggering, event generation, and Data Forwarding.