Logs

The Logs page is one place to search every log from across your environment, lined up with the traces they came from.

Searching

The search box speaks a simple, familiar query language:

You type	You get
payment failed	lines containing both words (bare words are AND)
"connection refused"	that exact phrase
service:checkout	logs from the checkout service
severity:error	error-level logs (level: and status: also work)
@http.status:500	matches a log attribute
trace:abc123	every log for that trace
-healthcheck	excludes matching lines (NOT works too)
service:(api OR web)	value groups
db AND (timeout OR refused)	full boolean logic with grouping

Free text also matches trace and span IDs, so you can paste an ID straight in.

Filtering and scanning

• A time-range picker with presets (15m, 1h, 6h, 24h, 7d) or a custom range.
• A volume chart over the results — click a bar to zoom into that moment.
• Minimum-severity and service filters, plus severity facets with live counts. Severities are trace, debug, info, warn, error, and fatal.
• Live tail for real-time follow, and a wrap toggle for long lines.

Click any line to open its detail: the full message, its attributes, the raw record, and — when present — its trace and span IDs with a jump straight to the trace. That correlation works both ways: from a slow request you can open its logs, and from a log line you can open its trace.

Controlling what’s kept (Log pipeline)

Not every log is worth storing. The Pipeline page lets you shape logs before they’re kept, so you keep signal and cut noise (and cost):

• Drop — discard logs that match (health-check spam, debug chatter).
• Sample — keep a percentage of high-volume, low-value logs.
• Count only — a dry run that tells you how much a rule would affect, without changing anything, so you can tune it safely first.
• Enrich — set, copy, delete, or extract fields (including pulling values out with a pattern) so logs arrive already tidy and searchable.

Rules run in priority order — the first matching drop or sample wins — and match on fields like service, severity, body, and any attribute. Editing the pipeline requires the editor role.