Log Explorer

Search and inspect your log events in real time.

What you’ll need

• At least one log event ingested (see Getting Started)

Step 1: Open Log Explorer

Click Log Explorer in the left sidebar. You’ll see a table of recent log events, newest first.

The table shows:

• Timestamp — when the event was received
• Level — error, warn, info, debug
• Service — the service that sent the event (if provided)
• Message — the log message

Step 2: Search for a log

Click the Search bar at the top and type any keyword from your log message.

Search is case-insensitive and matches against the message field. Hit Enter or wait 300ms for results to update.

Tip: Search is prefix-matched. Searching token fail will match token validation failed.

Step 3: Filter by level or service

Use the filter dropdowns in the toolbar:

• Level — show only error, warn, info, or debug events
• Service — filter to a specific service name
• Environment — filter to production, staging, etc.

All filters work together — combining Level: error + Service: api-gateway shows only errors from that service.

Step 4: Open a log detail

Click any row in the table to open the log detail panel on the right side.

The panel shows:

• Full message text
• All metadata fields sent with the event
• Event ID (useful for support requests)
• Fingerprint — the pattern this event belongs to

Click View Pattern to jump to the pattern detail for this message shape.

Step 5: Copy an event ID

In the detail panel, click the copy icon next to the Event ID to copy it to your clipboard.

Event IDs are globally unique and can be used to reference a specific log line when debugging across teams.

Querying logs older than 24 hours

Log Explorer automatically searches the archive when your time range extends beyond the last 24 hours. No extra steps are needed — just set a from date further back and the query will include archived events.

When archive results are returned, a small Archive or Merged chip appears near the results count, indicating which storage tier was queried:

• Hot — results came from the live D1 index (last 24h)
• Archive — results came from R2 cold storage
• Merged — your range spans both hot and archive

If the chip shows ~approximate, it means the archive scan reached its 50,000-event limit before scanning the entire range. The results are still useful but may not be complete — narrow your time range or add filters to get precise counts.

Tip: For large historical investigations, use the Archive page to browse by exact hour bucket.

You’re done

You can now search, filter, and inspect any log event. Next steps:

• Look at the Patterns page to see your logs grouped by message shape
• Click View Pattern on any log to see its 48-hour frequency chart

Related docs

Full query API reference — pagination, cursor-based navigation, and all supported filter parameters.