Logs Explorer: Query, Search & Analyze Logs Efficiently

The Logs Explorer in SigNoz provides a powerful interface for searching, filtering, and analyzing your log data. It includes quick filters on the left panel, a filter expression bar, and three view modes — List View, Time Series, and Table.

Logs Explorer with quick filters and list view — *Logs Explorer with quick filters, filter expression, and list view*

Filtering and Search

The search feature allows you to filter logs using different attributes (like service.name, status etc.) with operators (like IN, =, !=, NOT IN, CONTAINS, EXISTS). You can filter using multiple attributes simultaneously and combine them with AND/OR.

Just like search, the Query Builder also allows you to filter your logs data based on different attributes using operators. The Query Builder provides you with additional powerful features like aggregation, grouping etc. on your data.

After entering your query, click Run Query to see results in the selected view mode.

Live View

The Live View streams new log entries continuously as they occur, helping you debug real-time incidents. Live View is only available in the List View. To start it, select Live in the time picker. To stop it, select another time range. The active log explorer query continues to filter the stream, so only matching entries appear.

It supports:

Search filters with a histogram showing log counts over time
Format options — Raw, Default, and Column. You can also adjust Max Lines Per Row from the Options icon on the right of the toolbar.
Pause and Resume — stop the real-time feed to scroll through logs, then resume when ready

Views

There are three views available in the Logs Explorer.

List View

The List View displays logs as individual rows with timestamp and body columns. The timestamp column uses the timezone that you select in the time range picker.

Frequency Chart

Toggle on the Frequency chart to see a bar chart of log volume over time, color-coded by severity text (INFO, WARN, ERROR, etc.). This gives you a quick visual overview of log distribution and helps identify spikes in errors or warnings.

Download Logs

You can download your logs by choosing the export format (JSONL or CSV), specifying the number of rows to export (10k, 30k, or 50k), and selecting which columns to include. Click the download icon in the toolbar to configure and export.

Settings

The settings panel opens from the Options icon on the right of the toolbar. It has four sections:

Format

There are three formats available which display logs in different layouts:

Raw — Shows log entries in the raw format as they appear in the logging system.
Default — Provides a balanced view by formatting a raw log based on different attributes to make it more readable.
Column — Organizes the logs data into different attribute columns to provide a tabular view of logs.

Font Size

Adjust the font size for log entries to improve readability based on your preference.

Max Lines Per Row

Set the maximum number of lines of text that each log entry is allowed to display. Useful for controlling how much of each log body is visible in the list.

Columns

Click Edit columns to add or remove columns for different attributes available in your logs. This works for Default and Column formats. By default, logs are formatted into Timestamp and Body columns.

List View Settings in Logs Explorer — *List View settings showing Format, Font Size, Max Lines Per Row, and Columns options*

The columns search also accepts field names that do not appear in the suggestions list, including nested JSON paths written in dot notation. Type the field name as it appears inside the log body, without a body. prefix, for example orderId for a top-level body field or order.id for a nested one. When the name does not match an existing suggestion or an already-added column, it surfaces as an addable row at the top of the Other Fields section. Select it to add the column, then click Save Changes. Names are matched case-insensitively, and the search keeps the casing you type.

This works the same in the Logs Explorer and the Live View, and applies to logs only.

Resolving values from nested JSON body fields requires JSON body parsing to be enabled for your deployment. Without it, the column is added but its cells stay empty.

A path written with a leading body. prefix, such as body.orderId, is still accepted and added as a column, but its cells stay empty. Drop the prefix and type just orderId to see values. Array-indexed paths do not resolve values in the table yet either.

Show in Context

When you hover over a log line, a Show in Context icon appears on the right side. Click it to open the log details drawer on the Context tab. The tab shows the logs before and after the selected log.

Copy Link

When you hover over a log line, a Copy Link icon appears on the right side. Click it to copy a direct link to that log line. Anyone with access to the same SigNoz instance can open the link.

Time Series View

The Time Series View takes your log explorer query and renders it as a chart, providing a graphical representation of logs data over time based on the filters or operations applied. Use the Group By dropdown to break down results by attributes like service.name, k8s.pod.name, or any custom attribute.

The query builder supports:

Aggregate functions: count(), count_distinct(), avg(), sum(), p50(), p90(), p95(), p99()
Group By: Split results by one or more attributes
Having / Order By / Limit / Legend format: Refine and customize the output

Time Series View in Logs Explorer showing count() grouped by service.name — *Time Series View in Logs Explorer*

The chart header carries two controls. On the left, the Y-axis unit selector sets the unit applied to the chart axis and legend. On the right, the download icon exports the data currently plotted.

Download Chart Data

Click the download icon on the right of the Time Series chart header to export the data behind the chart. A popover opens with a FORMAT selector:

csv (default): comma-separated rows, with one row per series and timestamp.
jsonl: newline-delimited JSON, with one object per row.

Choose a format and click Export to download the file. The export mirrors what the chart shows:

Series names match the chart legend. Each series is labeled exactly as it appears in the legend, including any custom legend format or group-by values.
The value column carries the unit. The value column header includes the human-readable Y-axis unit (for example, value (ms)). Display-only formats such as short or none are omitted, since they describe axis formatting rather than a physical unit.

Each row also includes the timestamp, the query name, the series name, and one column per group-by label.

The download button appears whenever the Time Series chart has data to export. No configuration or feature flag is required, and export behaves the same on SigNoz Cloud and self-hosted deployments.

Table View

The Table View provides a tabular representation of different operations like the count of logs, average of duration etc., based on the filters applied.

Log Details

Click a log line to open the log details drawer. The drawer shows the full body, the attributes, and the resource fields of the log.

The header of the drawer shows the timestamp of the log. Use the up and down arrow buttons in the header, or the up and down arrow keys, to move to the previous or next log. The ⋯ menu in the header has Copy log and Copy link to log.

Below the log body, the drawer shows the service, severity, namespace, environment, trace ID, and span ID of the log. It shows only the fields that the log has.

Below these fields, the drawer has three tabs: Overview, Context, and Metrics.

Overview

The Overview tab shows each field of the log. Use the Pretty and JSON toggle to pick a view:

Pretty shows the fields as a tree: timestamp, body, attributes, resource, and the other top-level fields. If the body is JSON, the tree shows its keys as nested fields. Type in Search for a field... to find a field by name.
JSON shows the full log as a JSON document.

To copy the full log as JSON, click the copy button on the right of the toggle.

Overview tab in JSON view, showing the log as a JSON document with line numbers — *The Overview tab in JSON view*

In Pretty view, hover over a field and click ⋯ to open its menu. In the Logs Explorer, the menu has these items:

Copy Value: Copies the value of the field.
Filter for value: Adds a filter that keeps only the logs with this value.
Filter out value: Adds a filter that removes the logs with this value.
Group by field: Adds the field to Group by.
Replace filters with this value: Replaces the current filters with a filter on this value.

Field menu for k8s.pod.name with Copy Value, Filter for value, Filter out value, Group by field, and Replace filters with this value — *The menu of a field in the Logs Explorer*

The drawer also opens from other parts of SigNoz, and there the menu has fewer items. For example, on the Logs tab of Infrastructure Monitoring, the menu has Copy Value, Filter for value, and Filter out value. In a dashboard List panel, the menu has only Copy Value.

Context

The Context tab shows the logs before and after the selected log. It starts with 10 logs on each side, or 12 when the font size is small. The selected log is highlighted. To see older or newer logs, click Load more above or below the list.

To narrow the context logs, click the filter icon on the right of the tabs and enter a filter query.

Context tab showing surrounding logs with the selected log highlighted and Load more buttons above and below — *The Context tab, with the selected log highlighted*

Metrics

The Metrics tab shows infrastructure metrics around the time of the log, for the node and the pod that sent it. Use the Node and Pod toggle to switch between them. The Node view shows CPU usage, memory usage (WSS), network IO, and filesystem usage.

The tab finds the node and the pod from the k8s.node.name, k8s.pod.name, k8s.cluster.name, and host.name resource attributes of the log.

Metrics tab in the Node view, showing node CPU usage, memory usage (WSS), and network IO charts — *The Metrics tab, in the Node view*

Create Dashboards and Alerts

The List, Time Series, and Table views each have a Create an alert button and an Add to dashboard icon button in their header, next to the download icon. Both use the query of the current view.

Create an alert: Opens a new log-based alert with the current query.
Add to dashboard: Opens the dashboard picker. After you pick a dashboard, SigNoz opens it with a new panel for the query.

In the List view, the same row also has the Frequency chart toggle, Order by, and the format options.

Logs Explorer List view header with the Frequency chart toggle, the Create an alert button, the Add to dashboard icon, Order by, Download, and format options — *Create an alert and Add to dashboard in the List view header.*

The same two actions are also available in the bar at the bottom of the Explorer:

Save this view — preserves your current filter and query configuration as a named view for quick access later. Click Save this view, enter a descriptive label, and confirm. You can access saved views from the Select a view dropdown at the bottom of the Explorer or from the Views tab at the top of the page.
Create an Alert — set up a log-based alert directly from your current query
Add to Dashboard — export the current query as a dashboard panel

Logs Explorer action bar with Select a view, Save this view, Create an Alert, and Add to Dashboard — *Save view, create alert, or add to dashboard directly from the Logs Explorer*

Managing Saved Views

To manage all your saved views, switch to the Views tab at the top of the page. From here you can:

Update: Make changes to a loaded view, then click Update this View
Rename: Search for the view and click the edit icon to change its label
Delete: Search for the view and click the delete icon to remove it

Saved views are shared across your organization. All users can access them, but only Editor or Admin roles can edit or delete views.

Multiple Queries and Formulas

You can plot multiple queries and formulas on the same chart. This is useful for comparing log volumes across different services or calculating rates like error percentages.

Logs Quick Filters — use the quick filter panel on the left

Logs Explorer