1.1. Explore logs

Explore logs from a service

Slice and filter your logs using Explore Logs in Grafana.

1. From the left menu, expand the Explore menu item and click on Explore -> Logs.

   

2. At the top of the screen, in the data source dropdown, select the LokiCorrelation data source.

   

3. Scroll down to the web_app_3 service and click the Select button to open the logs for the service.

   

4. Now we are shown the most recent logs for our app web_app_3. This view shows us:

   • A chart showing the volume of logs received for this service over time

   • A list of log lines for this service

   • The time period for search, shown in the top right

   tip

   If the log lines are too long for your browser, you can scroll horizontally, or click Wrap lines to toggle wrapping on or off.

   Click on one of the returned log lines to expand it.

   

5. When you expand a log line, the log detail view will show you the metadata that is associated with the log line. This consists of:

   • Fields, which includes:

     • Loki labels associated with the log line

     • Additional fields which Loki has automatically parsed from the log message

     • Additional structured metadata which has been attached to this log line

   • Links to other data in Grafana for additional context

   

6. Let's narrow down the logs by adding a simple filter.

   In the search bar, enter the text favicon. This will show only those log lines containing the string favicon:

   

7. Let's add another filter.

   Click on a log line to expand it. Then, by the side of status_code, click on the magnifying glass icon:

   

8. Explore Logs will refresh the results to show only logs which contain the string favicon.ico and have the same status_code that you selected.

   Explore Logs shows us our search filters at the top of the page, where can easily change or remove them:

   

9. From here, it's easy to change the filters. At the top of the screen, pick a different status_code from the dropdown list. For example, choose 200. (Or, if you selected 200 in the previous step, pick a different code)

   Now, only logs from the app which contain the string favicon.ico and have the status_code 200 are shown:

   

View metrics from logs

Explore Logs also lets you deeply understand the shape and content of your logs, through instant metrics and charts.

Under the hood, Loki's metrics from logs feature instantly calculates metrics from your log lines or labels, which Explore Logs then visualizes as a chart.

This helps you to quickly answer very common questions, like:

• Is the number of errors in my app increasing?
• Which are the most popular pages on my website?

Let's take a look at these metrics:

1. From the row of tabs above the log volume chart, click on the Labels tab.

   Explore Logs shows a breakdown of Loki labels, charting their respective values.

   In the http_method panel, click on the Select button to drill down to logs with this label:

   

2. Now we can see a further breakdown of our filtered logs, broken down by the http_method label.

   From any panel, click on the Include button to show only logs with that label value.

   

3. Then click the Logs tab to return to the logs list.

   Notice how the logs have been further filtered to show only those which have your selected http_method label value.

   

Wrapping up

Explore Logs is a powerful tool for diving into your logs and gaining instant insights without having to write a query.

When you want to dive further into Loki, you can start writing queries in LogQL, Loki's query language.

In the next section of this lab, we will move from Explore Logs to querying Loki. Click Next to continue.