01
Full SQL surface
Use joins, CTEs, filters, aggregations, and window functions instead of learning a log-only query language.
Product · Log management
Search every event without losing the incident.
Use structured fields, SQL, distributions, and full-text pruning while trace and time context stay ready for the next drill-down.
- primary query language
- SQL
- inverted index
- Tantivy
- columnar storage
- Parquet
- ingest transforms
- VRL
A log workflow built for structured telemetry.
Explore the schema, narrow the event set, and continue into the related service or trace.
02
Field exploration
Inspect field presence and value distributions to build a useful filter before scanning raw events.
03
Selective reads
Time pruning, Parquet metadata, caches, and Tantivy indexes reduce how much object storage a query must touch.
04
Ingest pipelines
Normalize, enrich, redact, encrypt, or route events with VRL and an optional constrained JavaScript runtime.
workflow
From noisy symptom to the exact event.
The log explorer supports discovery and precision without detaching the query from the larger incident.
- 101 · Scope
Keep the service and time anchor
Arrive from an alert, metric, or trace with the first useful constraints already applied.
- 202 · Explore
Inspect fields and distributions
See which fields exist and which values dominate before committing to a query.
- 303 · Query
Refine with SQL
Use familiar relational operations against structured events and enrichment data.
- 404 · Continue
Push the finding into the investigation stack
Open the trace, service, or neighboring time window without discarding the current frame.
proof / shipped
Compatible ingest, owned storage.
The log path accepts native JSON plus several common replacement protocols.
- OTLP HTTP and gRPC
- Elasticsearch _bulk and Loki push
- Syslog UDP/TCP and cloud log drains
- S3, GCS, Azure, or MinIO storage
Product · Log management
Search every event without losing the incident.
Use structured fields, SQL, distributions, and full-text pruning while trace and time context stay ready for the next drill-down.