> ## Documentation Index
> Fetch the complete documentation index at: https://docs.molesignal.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Logs

> Search structured events, inspect fields and surrounding context, and turn useful queries into saved views.

Open **Logs** to search log streams in the active workspace.

## Choose a stream and time range

Select a log stream, then set the smallest time window that contains the event. Narrow windows
reduce scanned rows and make field exploration faster.

MoleSignal can infer a stream schema as events arrive. The field panel shows available dimensions
and supports adding filters without rewriting the full query.

## Query modes

Use field mode for fast filtering and SQL mode for joins, expressions, CTEs, or aggregations.

Examples:

```sql theme={null}
SELECT "_timestamp", level, service_name, message, trace_id
FROM app
WHERE level = 'error'
ORDER BY "_timestamp" DESC
LIMIT 200;
```

```sql theme={null}
SELECT service_name, COUNT(*) AS errors
FROM app
WHERE level = 'error'
GROUP BY service_name
ORDER BY errors DESC;
```

The query planner applies the current organization boundary even for custom SQL.

## Inspect results

The results table supports:

* visible-field selection and structured value rendering;
* event pagination;
* row details with the original fields;
* five surrounding records on either side of the selected event;
* pivots to a trace, service, metric, or other correlated signal when identifiers are present.

Large searches can run as search jobs. Open **Log inspector** from a completed job to review
execution state and result metadata.

## Save repeatable searches

Save a useful query as a saved view. Reopen the view, run the query over another time window,
attach the view to a report, or use the view as the starting point for an alert.

<Tip>
  Preserve stable dimensions such as `service.name`, `deployment.environment`, `trace_id`, and
  `host.name` during intake. These fields make cross-signal pivots reliable.
</Tip>

## Permissions

* `streams.read` discovers streams and schemas.
* `streams.query` runs searches and opens context.
* `saved_views.create`, `saved_views.edit`, and `saved_views.delete` control saved views.

<Card title="Cross-signal correlation" icon="link" href="/en-US/correlation">
  Follow a log event into the associated trace, service, metrics, or host context.
</Card>