Skip to main content
Open Logs to search log streams in the active workspace.

​
Choose a stream and time range

Select a log stream, then set the smallest time window that contains the event. Narrow windows reduce scanned rows and make field exploration faster. MoleSignal can infer a stream schema as events arrive. The Fields panel lists the fields of the stream and adds filters without rewriting the full query.

​
Query tabs

Every query runs in a tab of its own. A tab keeps its stream, query, and time range, and a query in one tab does not affect another.
  • Select New tab to open another query. Up to 10 tabs can be open at once.
  • Open the menu of a tab to Rename, Duplicate, or Close it.
  • Select Split in two to show two tabs side by side. Each half lists its own tabs, and a tab moves across from its menu. Back to one page ends the split.
Open tabs are kept in the browser for each user and workspace.

​
Write a query

The editor has two modes, Code and Builder. Code takes a field query or SQL. A statement that starts with SELECT or WITH runs as SQL. Anything else runs as a field query: Join conditions with AND and OR, in any case. AND binds tighter than OR, and brackets group conditions: level = 'error' AND (service = 'checkout' OR service = 'payments'). Text without a field is searched for in the message field and can be one of the alternatives: timeout OR "connection reset". Quotes keep a phrase whole, even one with a word such as or in it. Compare with =, !=, >, >=, <, and <=. Builder shows the same field query as rows of filters, one row for each alternative: the filters of a row all hold, and OR stands before every row after the first. Select Filter to add a filter to a row, or OR to add a row, then choose a field, a comparison, and a value. Each row has its own search text. A part in brackets inside a row, such as the OR of the example above, is kept as written and changed in Code. A statement that is SQL cannot be shown as filters. Use SQL for joins, expressions, CTEs, or aggregations:
Run the query with Run, or press ⌘ Enter or Ctrl+Enter in the editor. Query syntax reference lists examples for the current mode. See Query for the text search functions. The query planner applies the current organization boundary even for custom SQL.

​
Explore fields

The Fields panel has three parts: Displayed fields, Indexed fields, and Other fields. Fields that share the first part of a dotted name, such as http.method and http.route, open as one group.
  • Open a field to see its most common values in the result. Add a value as an include filter or an exclude filter. The filter narrows the whole query: a query of alternatives is put in brackets before it.
  • Show or hide a field as a column of the result.
  • Select Analyze on a field to open the field analysis: the number of distinct values, the rows with and without a value, statistics for a numeric field, the value distribution, and the most common values over time.

​
Read the results

The histogram over the results counts every event that matches the query in the time range, not only the page that is loaded. Four views read the result: In the Logs view:
  • Columns selects and orders the columns. The default columns come from the fields of the stream: the time, then the level, service, and message fields when the stream has them.
  • The page size is 100, 200, 500, 1,000, 2,000, or 5,000 events.
  • Click an event to open it in a drawer beside the results; drag the drawer’s left edge to resize it, and the width is kept. The head shows the level, the time, the message, and the attributes the event is told by (service, host, environment, version, trace), each with the same actions as a field. The views are Fields, Trace when the event carries a trace ID, Context, and Raw JSON. Trace shows the trace’s waterfall with the event’s span selected. Context shows five surrounding rows on each side. From a field, add a filter, copy the value, or show the field as a column.
  • Pivot to a trace, service, metric, or other correlated signal when identifiers are present.
  • Download the result as CSV, as text, or as JSON.

​
Share a query

The address of the page is the query on screen. When a query runs, the page writes its stream, its statement (q for a field query, sql for SQL), and the view of the results to the address, so a copy of the address bar shares the query, over the time range the picker shows, such as the last hour. Reloading the page keeps the query and the editor as they were. Select Share to copy a link to the query on screen. The link opens for signed-in members of the organization who may read the data. Choose the time range of the link: Current time selection fixes the range to the moments on screen, and the other choice keeps a relative range, such as the last hour, counted from the time the link is opened.

​
Search jobs

A search that is too large for an interactive request runs as a search job. Open Streams → Search jobs to follow the job and download its result. See Streams.

​
Saved views

Keep a SQL query under a name as a saved view. Reopen the view, run the query over another time window, or attach the view to a report.
Preserve stable dimensions such as service.name, deployment.environment, trace_id, and host.name during intake. These fields make cross-signal pivots reliable.

​
Permissions

  • streams.read discovers streams and schemas.
  • streams.query runs searches and opens context.
  • agent.use runs an AI inspection, which also needs an enabled AI model.
  • saved_views.create, saved_views.edit, and saved_views.delete control saved views.

Log inspections

Have Mole Agent inspect a log stream on demand or on a schedule.

Cross-signal correlation

Follow a log event into the associated trace, service, metrics, or host context.
Last modified on October 26, 2026