Logs
Logs turns the stream of log records your services emit into an explorable, columnar dataset. Search, filter, facet, histogram, and correlate lines with traces from a single query bar at /observability/logs. Workspace-level configuration sits at /observability/log-settings, and long-running queries run at /observability/search-jobs.
What it is
Logs are the raw narrative of a system. Owlpane stores incoming OTLP log records as columnar data, so a record is a row and its attributes are columns you can filter, facet, and aggregate on. Filters, time bucketing, and counts run in the query engine rather than in the browser, which keeps search responsive as volume grows.
Because log records carry the OpenTelemetry semantic conventions, a line can be tied back to the service and trace that produced it — turning a lone error message into the entry point of an investigation.
Key capabilities
- Full-text and structured search — search the message body, or filter on indexed fields such as
service.name, severity, trace ID, and custom attributes. - Volume histogram — stacked log volume for the selected window; click a bucket to zoom the time range.
- Facets — see which values a field takes and how much of the volume each one carries, then add it as a filter.
- Trace correlation — when a line carries
trace_idandspan_id, jump from the log row into the corresponding trace. - SQL mode and search jobs — write a Logs SQL query for a large range, run it in the background, and download up to 100,000 rows. A search can be scheduled to run every hour or every day.
- Masking and rewrite rules — decide what is hidden or rewritten before lines are shown or exported.
Where it lives
| Surface | Console route | What it does |
|---|---|---|
| Logs explorer | /observability/logs | Search, filter, histogram, and stream log lines; SQL view for structured queries. |
| Log settings | /observability/log-settings | Retention and volume, storage layout, and the rules that hide or rewrite lines before anyone sees them. |
| Search jobs | /observability/search-jobs | Background and scheduled Logs SQL queries, with up to 100,000 rows per search. |
How data gets in
Logs arrive as OTLP log records over HTTP (/v1/logs) or gRPC, authenticated with a workspace owl_ing_* key. Host and Kubernetes collectors forward lines without application changes.
- Log ingestion — recommended attributes such as
service.nameandseverity_text. - OTLP ingest reference — endpoints and content types.
- Ingest keys & authentication — passing and rotating keys.
- SDKs — language packages that emit structured logs.
- Integration library — collector packs for hosts, Kubernetes, and cloud log sources.
- OTLP contract — the attribute contract for log records.
Retention, masking, and transforms
Log settings shows how long lines are kept, how much there is, and how the log table is partitioned and ordered. The same page lists what is hidden or rewritten — patterns applied when lines are shown or exported, across the Logs page, SQL mode, search jobs, dashboards, and shared dashboards.
Ingest-time transforms, which change records before they are stored, are configured under Pipelines (/observability/pipelines) and gated by Redaction (/observability/signal-control).
Concepts
| Term | Meaning |
|---|---|
| Log record | A single ingested line: a timestamp, a body, and attributes. |
| Attribute | A key/value on a record; common ones are service.name, severity_text, and trace_id. |
| Facet | The set of values a field takes in the current window, with the volume each carries. |
| Search job | A Logs SQL query run in the background over a large range, with downloadable rows. |
Scope and time range
The Logs explorer shares a scope bar with the rest of the console. Set Service once and Home, Logs, and Requests stay aligned; the selected time range drives the histogram, the facets, and the query, and it travels in the URL, so a copied link reproduces the exact view.
Related
- Metrics — counters, gauges, and histograms.
- Traces — the spans a log line can correlate with.
- Dashboards — chart log volume beside other signals.
- Logs explorer task guide — walkthrough of the explorer layout.
- Alerts and on-call — turn a log pattern into a rule.
Last updated