# Creating Log Analytics Dashboards

> Guide to creating Log Analytics Dashboards from aggegragated queries in Logs Explorer

Source: https://last9.io/docs/creating-log-analytics-dashboards-from-logs-explorer/

## Introduction

Creating custom log analytics dashboards in Last9 allows you to visualize and monitor log data through aggregated metrics. This guide explains how to create and promote log queries into dashboard visualizations.

:::tip
For a complete overview of dashboard features including panel configuration, variables, and sharing, see the [Dashboards documentation](/docs/dashboards/).
:::

## Starting with Logs Explorer

### Using Editor Mode

1. Navigate to the [Logs Explorer](https://app.last9.io/logs) in Last9
2. Switch to Editor Mode — this enables writing advanced LogQL-compatible queries
3. Write a normal query to explore your data

   ```sql
   {service="adservice"}
   ```

4. Convert it into an aggregation query by adding an aggregation function

   ```sql
   sum by (severity) (count_over_time({service="adservice"} [1m]))
   ```

5. Promote the query to a dashboard by clicking the **Add to Dashboard** button

   ![Promote to Dashboard](../../../../assets/content/docs/logs/logs-add-aggregated-query-to-dashboard.png)

6. Create a new dashboard or add it to an existing dashboard by adding a unique panel name

   ![Create Dashboard](../../../../assets/content/docs/logs/logs-create-dashboard.png)

7. You will be redirected to the new dashboard with your query added as a panel

   ![Dashboard with Panel](../../../../assets/content/docs/logs/logs-dashboard-with-panel.png)

8. You can edit the panel by clicking the **⋮** button and then the **edit** button

   ![Edit Panel](../../../../assets/content/docs/logs/logs-edit-panel.png)

9. Add multiple panels to the dashboard by following the same steps as above

### Supported Aggregation Functions

Last9 supports several aggregation functions for creating meaningful visualizations:

- Time-based aggregations:

  - **`count_over_time`**: Counts the number of logs over time
  - **`sum_over_time`**: Sums the values of a numeric field over time
  - **`avg_over_time`**: Averages the values of a numeric field over time
  - **`max_over_time`**: Finds the maximum value of a numeric field over time
  - **`min_over_time`**: Finds the minimum value of a numeric field over time
  - **`rate`**: Calculates the rate of change of a numeric field over time

- Statistical aggregations:
  - **`sum`**: Sums the values of a numeric field
  - **`avg`**: Averages the values of a numeric field
  - **`count`**: Counts the number of logs
  - **`max`**: Finds the maximum value of a numeric field
  - **`min`**: Finds the minimum value of a numeric field
  - **`stddev`**: Calculates the standard deviation of a numeric field
  - **`median`**: Finds the median value of a numeric field
  - **`stdvar`**: Calculates the standard variance of a numeric field

## Query Construction Guidelines

### Time Windows

Specify time windows using the following formats:

- Minutes: **`[1m]`**
- Hours: **`[1h]`**
- Days: **`[1d]`**

### Query Examples

Basic severity-based aggregation:

```sql
sum by (severity) (count_over_time({service!="user-service"} [1m]))
```

Complex bucket-based aggregation:

```sql
sum by (bucket) (count_over_time({
  service="unknown",
  ingestor="s3",
  bucket=~"elb-logs",
  log.file.path=~".*api.*"
} [3h]))
```

## Best Practices

### Time Range Selection

- Match window size to query requirements
- For instant queries, set time range equal to window size
- Consider data retention and query performance when selecting time ranges

### Query Performance

- Leverage accelerated queries by including Service or Severity filters
- Use specific filters to reduce data scanning
- Test queries with smaller time ranges before expanding to larger windows

### Dashboard Organization

- Group related visualizations together
- Use clear, descriptive titles
- Include context in dashboard descriptions
- Set appropriate refresh intervals based on data update frequency

---

## Troubleshooting

Please get in touch with us on [Discord](https://discord.com/invite/Q3p2EEucx9) or [Email](mailto:support@last9.io) if you have any questions.