# Logs Explorer
> Use Last9's native UI for logs with first-class search and filters — quickly view related logs, traces, and metrics by clicking on any log line.
Source: https://last9.io/docs/logs-explorer/
## Using Logs Explorer
You can start exploring logs by visiting [Logs Explorer](https://app.last9.io/logs) in Last9. The Log Explorer allows to filter logs by specific log attributes and resource info to slice and dice by various log dimensions, and view correlated telemetry.
### Builder Mode
Logs Explorer in Builder Mode with a dropdown to select/unselect additional columns
Last9 provides a native experience to explore your logs without using any query language.
- **Search:**
- With auto-complete support, `service`, `severity`, and `body` are first-class attributes
- Supported operators are `equal`, `not equal`, `contains`, and `does not contain`
- Edit the same attribute chip to add multiple values
- **Filters:** Apart from severity and service, attributes and resources from the log lines in the selected time window are also listed. Click on `only` or `all` next to a filter item for quick actions.
- **Live Tail:** A live stream of logs matching any filters, if applied. Useful to debug any instant changes to while deploying, etc. We recommened applying filters to narrow the scope of the Live Tail, which also helps improve the overall performance.
- **Time Picker:** Select an absolute or relative time range. You can also type shorthands like `1h` or `30m` directly, or switch between timezones. See [Time Range Picker](/docs/time-range-picker/) for details.
- **Volume Chart:** A stacked bar chart for the selected time window, color-coded to severity of the log lines.
- **Toggle Columns:** Click on the settings icon on the top right of the table to add dynamic columns based on log attributes.
- **Sort Order:** Sort results by timestamp ascending or descending — useful for reading an incident's logs in the order they happened.
- **Line Count:** Choose how many log lines to load per page from the table controls.
- **Share:** The Share option copies a link to the current view, the query as JSON, or an equivalent `cURL` command for the [query API](/docs/query-logs-api/).
### Editor Mode
Switch to Editor mode for advanced queries
You can write complex queries, with aggregations, that are LogQL-compatible using the Editor mode.
- LogQL auto-completion is supported. Auto-complete for aggregation functions is WIP.
- Aggregation queries are visualized as timeseries instead of as a volume bar chart.
- Switching from Builder to Editor will convert any existing search to LogQL, but not vice versa.
- Queries in Editor mode are not auto-run. Please click on the Run Query button or use the `⌘/Ctrl + Enter` keyboard shortcut.
:::tip[Keyboard Shortcuts]
Press `?` anywhere in Logs Explorer to see all available keyboard shortcuts, or visit the [Keyboard Shortcuts reference](/docs/keyboard-shortcuts/#logs-explorer) for the complete list including vim-style navigation (`j`/`k`), mode switching (`1`/`2`/`3`), and toggle controls.
:::
Read more about [LogQL compatibility](/docs/grafana-loki-in-last9/#logql-compatibility) and supported functions.
## Log Details
Log Details side panel with Related Logs tab
Clicking on a log line in Logs Explorer opens a side panel with additional context and information about the selected log line.
- **Content**, with payload size and option to view as raw or JSON
- **Attributes** of the selected log line
- **Resource Info** of the selected log line
- **Related Logs**, surrounding log lines for context — [see details below](#related-logs)
- **Related Traces**, based on the service and other attributes of the selected log line
- **Related Metrics**, visualizing CPU and memory utilization of the relevant container, instance, and pod resources
### Sharing a Log Line
The selected log line and the active side panel tab are encoded in the URL. To share an exact log line with a teammate, open it and copy the browser URL — the link reopens the same query, time range, log line, and tab. If the log line isn't on the first page of results when the link is opened, the side panel opens once the matching log loads.
## Creating Metrics from Queries
Turn an aggregation query into a continuous metric with [Last9 LogMetrics](/docs/streaming-aggregations/#transforming-logs-to-metrics-last9-logmetrics). After running the query, click **Create Metric** to open a pre-filled [Streaming Aggregation](/docs/streaming-aggregations/) rule. The metric is computed continuously, so you can query or alert on it without reprocessing raw logs.
## Creating Alerts from Queries
You can turn any log query into an alert using [Scheduled Search](/docs/scheduled-search/). After running a query:
1. Click on `⋮` > "Save Query" in the top right
2. Enter a descriptive name for your query
3. Click "Save query & add alert"
4. Configure your alert threshold, evaluation frequency, and notification channel
:::tip[Log Alerts]
**Scheduled Search is the way to create alerts on log data.** If you're looking to create alerts on metrics using PromQL, use [Alerting](/docs/alerting/) instead.
:::
[Learn more about Scheduled Search →](/docs/scheduled-search/)
### Related Logs
The Related Logs tab shows surrounding log lines from the same service, providing context for debugging and investigation. When you open this tab, the table automatically scrolls to the highlighted log line with a visual indicator.
Related Logs tab showing context range options and custom range selector
#### Context Range
Select how many log lines to display before and after the highlighted log:
| Option | Description |
| ---------- | ----------------------------------------------------------------- |
| **±20** | Default. Shows 20 lines before and after the selected log |
| **±50** | Shows 50 lines before and after |
| **±100** | Shows 100 lines before and after |
| **Custom** | Set different values for before and after (up to 1000 lines each) |
:::note
The context range is limited to logs within ±1 hour of the selected log line's timestamp.
:::
#### Timestamp Display
Toggle between timestamp modes using the icons in the controls bar:
| Mode | Icon | Description |
| ------------ | -------- | ------------------------------------------------------------------- |
| **Relative** | Timer | Shows time offset from the highlighted line (e.g., `-2s`, `+500ms`) |
| **Absolute** | Calendar | Shows the full timestamp for each log line |
Relative timestamps make it easier to understand the sequence and timing of events around the selected log.
#### Display Controls
| Control | Description |
| ------------------- | ----------------------------------------------------------------------- |
| **Wrap Lines** | Wraps long log messages to fit the panel width for easier reading |
| **Show Attributes** | Displays log attributes (like severity, trace ID) alongside the message |
#### Exporting Related Logs
You can download related logs as a CSV file for offline analysis or sharing with your team. Click the **Download** button in the controls bar to access export options:
| Export Option | Description |
| ------------------ | ------------------------------------------------------------------- |
| **Export All** | Downloads all available log fields, regardless of column visibility |
| **Export Visible** | Downloads only the columns currently visible in the table |
The downloaded CSV file is automatically named with the selected log's timestamp and the time range of related logs for easy identification (e.g., `Related Logs for 2026-02-13 10:30:45 UTC - 10:30:25 UTC to 10:30:55 UTC.csv`).
## Query Library
Query Library side panel with recent and saved queries
- **Recent Queries:** This is a history of queries made by you.
- **Saved Queries:** This is a list of queries saved by your team or you. Queries can be shared with the team or be kept private.
---
## Troubleshooting
Please get in touch with us on [Discord](https://discord.com/invite/Q3p2EEucx9) or [Email](mailto:support@last9.io) if you have any questions.