The Logs Explorer is your home base for troubleshooting and exploration:
Different views offer different types of insights from your log data, matching a search query.
The Live Tail displays logs as they flow into Datadog. Live Tail logs do not persist, but the view provides visibility on all logs, whether they are indexed or not. Find out more in the Log Live Tail section.
The Log List displays indexed logs and offers privileged tools to navigate individual results. Find out more in the Log List section.
The Log Patterns automatically aggregate indexed logs into a handful of groups with similar structures. Find out more in the Log Patterns section.
The Log Analytics graph log queries and see maximums, averages, percentiles, unique counts, and more. Follow the log graphing guide to learn more about all the graphing options.
Datadog displays individual logs following this general side-panel layout:
Context refers to the infrastructure and application context in which the log has been generated. Information is gathered from tags—whether automatically attached (host name, container name, log file name, serverless function name, etc.)—or added through custom tags (team in charge, environment, application version, etc.) on the log by the Datadog Agent or Log Forwarder.
Content refers to the log itself. This includes the log message, as well as all structured information extracted and enriched from the logs through Log Pipelines. For logs generated by common components of a technical stack, parsing and enriching comes out-of-the-box:
Some standard fields—for instance,
duration—have specific enhanced displays in the Log Panel for better readability. Make sure you extract corresponding information from your logs and remap your attributes with standard attribute remappers.
The View in context button updates the search request in order to show you the log lines dated just before and after a selected log—even if they don’t match your filter. This context is different according to the situation, as Datadog uses the
container_id attributes, along with tags, in order find the appropriate context for your logs.
Click on the Metrics Tab and access underlying infrastructure metrics in a 30 minutes timeframe around the log.
Interact with Host in the upper reserved attributes section, the related host dashboard or network page. Interact with Container sections to jump to the container page scoped with the underlying parameters.
In case logs comes from a serverless source, the Host Section is replaced with a Serverless section that links jump to the corresponding serverless page.
Click on the APM Tab and see the log in the context of its whole trace, with upstream and downstream services running. Deep dive in the APM data and the trace in APM.
Interact with the Service section to refocus the search in the log explorer and see all other logs from the same trace.
Interact with the attributes names and values in the lower JSON section to:
Use the Share button to share the log opened in side panel to other contexts.
Cmd+Ccopies the log JSON to your clipboard.
Build up a context to explore your logs in your log explorer view. First, select the proper time range. Then, use the search bar to filter your Logstream and Log Analytics.
The time range feature allows you to display logs in the Logstream or Log Analytics within a given time period. It appears directly under the search bar as a timeline. The timeline can be displayed or wrapped up with the Show timeline check box in the Logstream option panel.
Quickly change the time range by selecting a preset range from the dropdown (or entering a custom time frame):
Use facets, measures, tags, or even free text search to filter your Logstream and Log Analytics with dedicated context. The search bar and URL automatically reflect your selections.
Follow the guide to search your logs for a detailed explanation of all the Log Explorer search features, including use of wildcards and queries of numerical values.
Use saved views to automatically configure your log explorer with a preselected set of facets, measures, searches, time ranges, and visualizations. Check the dedicated saved views documentation to learn more.
Additional helpful documentation, links, and articles: