Logs Explorer

The Logs Explorer in SigNoz provides a powerful interface for searching, filtering, and analyzing your log data. It includes quick filters on the left panel, a filter expression bar, and three view modes — List View, Time Series, and Table.

Filtering and Search

The search feature allows you to filter logs using different attributes (like service.name, status etc.) with operators (like IN, =, !=, NOT IN, CONTAINS, EXISTS). You can filter using multiple attributes simultaneously and combine them with AND/OR.

Just like search, the Query Builder also allows you to filter your logs data based on different attributes using operators. The Query Builder provides you with additional powerful features like aggregation, grouping etc. on your data. To learn more about the Query Builder, refer to this documentation.

After entering your query, click Run Query to see results in the selected view mode.

Live View

The Live View streams new log entries continuously as they occur, helping you debug real-time incidents. Live View is only available in the List View.

It supports:

• Search filters with a histogram showing log counts over time
• Format options — Raw, Default, and Column. You can also adjust Max Lines Per Row by hovering over the Format button.
• Pause and Resume — stop the real-time feed to scroll through logs, then resume when ready

Views

There are three views available in the Logs Explorer.

List View

The List View displays logs as individual rows with timestamp and body columns.

Frequency Chart

Toggle on the Frequency chart to see a bar chart of log volume over time, color-coded by severity text (INFO, WARN, ERROR, etc.). This gives you a quick visual overview of log distribution and helps identify spikes in errors or warnings.

Download Logs

You can download your logs by choosing the export format (JSONL or CSV), specifying the number of rows to export (10k, 30k, or 50k), and selecting which columns to include. Click the download icon in the toolbar to configure and export.

Settings

The settings panel (accessible via the gear icon in the toolbar) has four sections:

Format

There are three formats available which display logs in different layouts:

1. Raw — Shows log entries in the raw format as they appear in the logging system.
2. Default — Provides a balanced view by formatting a raw log based on different attributes to make it more readable.
3. Column — Organizes the logs data into different attribute columns to provide a tabular view of logs.

Font Size

Adjust the font size for log entries to improve readability based on your preference.

Max Lines Per Row

Set the maximum number of lines of text that each log entry is allowed to display. Useful for controlling how much of each log body is visible in the list.

Columns

Add or remove columns for different attributes available in your logs. This works for Default and Column formats. By default, logs are formatted into Timestamp and Body columns.

Show in Context

When you hover over a log line, you will find a Show in Context option on the right side. This shows 10 logs before and 10 logs after the selected log by default, which is useful for faster debugging. You can load more logs and filter them by a particular attribute.

Copy Link

You can copy a direct link to a particular log line, which can be shared with anyone who has access to the same SigNoz instance.

Time Series View

The Time Series View provides a graphical representation of logs data over time based on the filters or operations applied. Use the Group By dropdown to break down results by attributes like service.name, k8s.pod.name, or any custom attribute.

The query builder supports:

• Aggregate functions: count(), count_distinct(), avg(), sum(), p50(), p90(), p95(), p99()
• Group By: Split results by one or more attributes
• Having / Order By / Limit / Legend format: Refine and customize the output

Table View

The Table View provides a tabular representation of different operations like the count of logs, average of duration etc., based on the filters applied.

Log Details

Click on any log line to open the Log details panel. This gives a comprehensive view of your log including the full body, attributes, and resource fields. The detail panel has four tabs — Overview, JSON, Context, and Metrics.

Overview

The Overview tab has two sections:

Body

Shows the complete body of the log. You can toggle Wrap text to switch between formatted and raw display.

Attributes

Shows all log attributes in a tabular format with the attribute name and its value. You can search for specific attributes using the search bar.

In the log details panel, hover over any attribute value to see quick action icons. These let you instantly filter for or against a value, group by the attribute, or replace the current filters — all without manually editing the query.

From the attribute values, you can:

• Filter for value — add the attribute as an IN filter. For example, if the attribute is container_id and its value is debian, using Filter for Value will create a filter container_id IN debian. This will list the logs where the container_id attribute is debian.
• Filter out value — add the attribute as a NOT IN filter. For example, if the attribute is container_id and its value is debian, using Filter out Value will create a filter container_id NOT_IN debian. This will list the logs where the container_id attribute is not debian.
• Group By Attribute — add the attribute to Group By
• Replace filters with this value — replace the current filter with this specific value

JSON

Displays the log in JSON format. You can toggle Wrap text to switch to raw format, and use Copy Log to copy your log in either JSON or raw form.

Context

Shows surrounding logs for the selected log entry — 10 logs before and 10 logs after by default. You can load more logs and filter by a particular attribute. This is useful for faster debugging by seeing what happened around a specific log event.

Metrics

The Metrics tab shows infrastructure metrics (CPU usage, Memory usage, Pod CPU/Memory usage) for the node and pod associated with the selected log entry. This helps you correlate log events with resource utilization.

Create Dashboards and Alerts

At the bottom of the Logs Explorer, you can:

• Save this view — preserve your query configuration for quick access later
• Create an Alert — set up a log-based alert directly from your current query
• Add to Dashboard — export the current query as a dashboard panel

Multiple Queries and Formulas

You can plot multiple queries and formulas on the same chart. This is useful for comparing log volumes across different services or calculating rates like error percentages.

Related

• Logs Quick Filters — use the quick filter panel on the left