Searching logs

The Logs page

From top to bottom:

• Query editor — type LogsQL, press Enter to search (Shift+Enter for a new line). While it is empty you see Quick start examples; the ? opens a syntax popover.
• Time range — presets 15m / 1h / 24h / 7d and a custom range with second precision.
• Histogram — volume over the selected range. The status line below it shows the number of loaded lines, your retention and the volume used this month.
• Fields panel (left) — your active filters on top, then stream fields and every other field seen in the current result, with values and counts. Click a value to filter, click it again (or the × in the active list) to remove it.
• Result list — newest first, virtualized, loads more as you scroll. Click a line for the detail view.
• Toolbar — download, display settings (columns, group by, page size) and Live tail.

Words and phrases

Type a word and you get every line that contains it, in the message or in any field. Words match case-insensitively and as whole words.

• timeoutEvery line containing the word timeout.
• timeout paymentsBoth words, anywhere in the line (an implicit AND).
• "upstream timeout"The exact phrase, in that order.
• err*Prefix match: error, errno, errors …
• *Everything in the time range.

Field filters

Every JSON key you send becomes a field. Filter on it with field:value. Note the colon — service=api is not LogsQL; the search box suggests the corrected form.

• level:errorField level contains the word error.
• service:=apiField service equals exactly api (case-sensitive).
• service:="checkout svc"Exact match with spaces or special characters — quote the value.
• host:node-*Prefix match on a field.
• path:~"^/api/v[12]/"Regular expression on a field.
• user_id:*Lines that have the field at all, whatever its value.
• _msg:checkoutSearch only the message, not the other fields.
• kubernetes.namespace_name:=paymentsNested keys are dotted names.

Query and filters

Two things are being searched together: the LogsQL you typed in the editor and the field filters you picked in the fields panel. The filters are not written into the editor — they sit in the panel, ticked, and are combined with your query when the search runs. The rules:

• Clicking a value in the fields panel, a field in a row's detail or the service column adds a filter field = value and re-runs the search at once.
• Several values of the same field are OR-ed (level:in(error, warn) under the hood); filters on different fields narrow each other (AND); your free text stays as it is.
• The panel lists the active filters on top. Click a ticked value or the × in that list to remove one, or Clear all to drop them all.
• The panel computes the values of a field without that field's own filters, so the other values stay visible for widening the selection.
• Query, filters and time range live in the page URL, so a reload keeps them and the link can be shared. Anything a filter cannot express — exclusions, regexes, ranges — goes into the query.

Excluding and combining in the query

• -level:debugEverything except debug lines.
• level:error OR level:warnEither one.
• service:=api AND NOT path:/healthExplicit AND / NOT.
• (level:error OR level:warn) team:=paymentsParentheses group conditions.
• level:in(error, fatal, critical)One of several values.
• _stream:{service="api",env="prod"}The fastest filter: an exact stream.

Numbers and ranges

Numeric fields (durations, sizes, status codes) can be compared and ranged.

• duration_ms:>500Greater than.
• status:>=500 status:<600Between — two filters combine with AND.
• status:range(500, 599)Same, as a range.
• bytes:>1MiBUnits are understood: KiB, MiB, GiB, and durations like 1.5s or 200ms.
• ip:ipv4_range(10.0.0.0/8)IP ranges.

Time ranges

The presets 15m / 1h / 24h / 7d set the window relative to now. Custom range opens a calendar with time fields down to the second — the usual move when an alert names a moment. Your plan's retention is the outer limit. Results are always newest first.

• _time:5mOnly the last 5 minutes, regardless of the preset.
• _time:[2026-09-01, 2026-09-02]An explicit day range (UTC) inside the query.

Row detail and context

Click a line to expand it. The detail shows every field of that entry with two actions per field:

• Filter icon — appends field:=value to the query. Clicking a service name in the list does the same for service.
• Copy JSON — the raw entry.

Context around a line

The context buttons (±1s, ±10s, ±1m, ±5m) replace the current search with the same stream — _stream:{...} of that line — and a time window around it. The anchor line stays highlighted, so you can read what happened right before and after without knowing the query for it. Use the browser's back button or the presets to return.

Live tail

Live tail streams new lines that match your query as they arrive. It runs about six seconds behind real time so batching agents can deliver in order, follows event timestamps, and keeps the newest 500 lines in view. A line whose timestamp is in the past — a backfill, a replayed file — appears in search, not in the tail.

Display, grouping, download

• Display settings (sliders icon): page size 50/100/200/500, which columns to show, extra fields rendered as key=value next to the message, and group by a field — the list then gets a header row per value, handy for service or host.
• These settings are yours and are remembered in the browser; they are not part of a shared link.
• Download exports the lines currently loaded as NDJSON or CSV — narrow the query first, then load what you need.
• Plain-text entries (from /v1/ingest/text) keep the whole original line as the message; multi-line stack traces are shown as one block.

Sharing a search

The search state lives in the URL, so a reload keeps it and a copied link reproduces it for a colleague:

https://app.uptimeeye.com/<org>/logs?q=timeout+service%3A%3Dcheckout+level%3A%3Derror&range=24h

Preset ranges stay relative (“the last 24 h” when the link is opened); a custom range is absolute — the right behaviour for incident links.

Where fields come from

There is no schema. Whatever JSON you send is stored as-is: {"_msg":"…","service":"api","env":"prod","user_id":"u_42"} gives you the fields service, env and user_id. Three fields are special:

• _msg — the message. Agents map their message key with _msg_field.
• _time — the event time; defaults to the time of ingestion.
• _stream — the stream labels chosen with _stream_fields (for example service,env). Filtering on stream fields is the fastest kind of filter, so pick fields with few distinct values.

How to shape fields on the way in is covered in Ingesting logs.

Aggregations with pipes

The search box accepts the full LogsQL language, including pipes. The Logs page is built for lines, so aggregations come back as rows whose fields are the computed values — open a row to see them, or download the result.

• level:error | stats by (service) count()Errors per service in the time range.
• _stream:{service="api"} | stats quantile(0.99, duration_ms) p99A percentile over a numeric field.
• * | top 10 by (path)The most frequent values of a field.
• _msg:~"order=(?P<order>\d+)" | extract "order=<order>" | stats by (order) count()Extract a value from the message and count by it.

The complete reference is the LogsQL documentation.

Cheat sheet

FAQ

Terms used above: a filter is one field = value selection from the fields panel; a stream is the set of lines sharing the same stream-field values.