Log List¶

Global Configuration¶

On the Global Configuration page, you can centrally manage the following features at the workspace level:

• Quick Filter Configuration: Customize the general quick filter panel in the Explorer;

• Top Fields Configuration: Configure the fields displayed at the top of each log in stack mode. Indexes without individual configuration use the global default configuration;

• Display Configuration: Set the default display fields and their order in the data list for each index;

• Query Acceleration Configuration: Enable acceleration for fields under an index to significantly improve query performance.

Quick Filter¶

The quick filter items configured here are applied to the quick filter panel on the left side of all Explorers in the workspace and are visible to all members.

All filter fields added here automatically enable Query Acceleration for their associated indexes to ensure filtering performance. This association is enforced by default and cannot be disabled.

You can configure two types of fields:

• Filter Fields (currently active fields)

  • Edit or delete an individual field;
  • Delete all filter fields with one click.

• Available Fields (including business fields, system fields, and others)

  • Add fields as filter fields.

If there are many fields, you can search for fields directly. If the query results do not contain an exact match, you can create a field and add it to Filter Fields.

Null-value (no data) items in the quick filter are hidden by default, and you can enable them here. After enabling, the No Data item is pinned to the top of each field value list and separated from other field values by a divider; the item remains visible while scrolling the list. This configuration can only be modified by administrators and custom roles with Global Configuration permission.

Global Quick Filter¶

Workspace administrators can configure global filter items centrally under Management > Quick Filter. After the configuration is saved, all members can sync the latest global filter items by refreshing or re-entering the Log Explorer.

Global filter items and personal custom filter items are saved independently and do not overwrite each other:

• Changes made by administrators to add, edit, reorder, or disable global filter items do not affect members' existing personal filter items;
• In the quick filter bar, global filter items are displayed before personal filter items by default;
• If a global filter item and a personal filter item have the same name, both are displayed at the same time and can be distinguished by their field identifier.

When the global configuration changes, after you refresh the page, the system will show the message "Quick filter has been automatically updated to follow the global configuration." This message is shown only once per Explorer and per version.

Top Fields Configuration¶

Configure the fields displayed at the top of each log in stack mode. Indexes without individual configuration use the global default configuration.

Global Default Top Fields¶

When an index has no dedicated top fields configured, the global default fields are used. Click "Edit" to adjust the fields displayed globally by default.

Default fields: source, host, service, pod_name, container_name, duration.

Index Top Field Configuration¶

Configure dedicated top fields for a specific index, taking priority over the global default configuration.

1. Click "+ Add Index Configuration", select an index, and configure the top fields (up to 8 can be selected);
2. Top fields support selecting existing fields or manually entering field names; press Enter to add custom fields;
3. After saving, logs under the index will display the configured top fields in stack mode.

Added index configurations can be edited or deleted.

Display Configuration¶

Configure the default display fields and their order in the data list for different log indexes, helping members quickly focus on the information they need when viewing an index. After configuration, when viewing the data list of the index, the system displays these fields in the configured order to help quickly focus on key information.

Select a log index on the left; on the right, select the fields displayed by default for the index and configure their display order.

For the current key field configuration, you can choose whether to sync all key fields to query acceleration.

Query Acceleration Configuration¶

Enable acceleration for fields under an index that are frequently used for filtering, grouping, or sorting to greatly improve query response speed for these fields. This configuration is performed at the index level.

• Left: Index column;
• Right: Select available fields under each index listed by the system for acceleration. You can view them later in the Accelerated Fields list above.

After configuration changes, it takes about 5 minutes to take effect across the system. Once effective, the fields are automatically added to the Accelerated Fields list.

Enable acceleration for fields under an index that are frequently used for filtering, grouping, or sorting to greatly improve query response speed for these fields. This configuration is performed at the index level.

Go to Log Explorer > Display Columns > Query Acceleration Configuration. The left side shows the index list, and the right side shows the accelerated fields list of the current index.

Add Accelerated Fields¶

Click "+ Add Accelerated Fields". An add row appears above the Accelerated Fields list:

1. Select a field from the dropdown, with fuzzy search support; or enter the field name directly;
2. After clicking "Add", the field is added to the Accelerated Fields list below;
3. Click "Cancel" to exit the add state without adding a field.

Delete Accelerated Fields¶

• Delete a single field: Click "Delete" for the corresponding field in the Accelerated Fields list;
• Batch delete: Click "Delete All Accelerated Fields" to clear all accelerated fields of the current index.

After configuration changes, it takes about 5 minutes to take effect across the system. Once effective, the fields are automatically added to the Accelerated Fields list.

Index¶

By configuring log multi-index, you can store matching logs in different indexes and select an appropriate data storage strategy for each index, effectively reducing log data storage costs.

The index list uses a scroll-loading mechanism. Pagination and the batch size of 50 only apply to regular indexes. Clone indexes are displayed as secondary rows under their source index and do not count toward the pagination count of regular indexes. Scrolling to the bottom automatically loads the next 50. This loading behavior applies only to the index selection list and is independent of the pagination or scrolling behavior of the log data list.

You can perform the following operations:

• Select all indexes (❗️This may slow down queries due to the large amount of data);

• Select multiple indexes;

• Pin indexes to the top;

• Search for indexes by name. Press Enter after entering a keyword to execute the search; the index list is not automatically refreshed while typing;

• Set the index display area to Small, Medium, or Large.

• Click the jump icon at the end of an index to open the corresponding index in a new tab.

After configuration, you can switch between different indexes in the Explorer to view the corresponding log content.

Clone indexes are displayed as child nodes of the source index. The source index and its clone index cannot be selected at the same time; the wildcard * does not include clone indexes. To query a clone index, you need to explicitly select the corresponding index.

For more information about the display, search, and query scope of clone indexes, see View and Query Clone Indexes.

Index Query History¶

Click the history icon on the right side of the search box to view recently used log indexes.

• Single-index history displays the index name directly;
• Multiple selected indexes are separated by English commas, e.g., default,application,security;
• After clicking a history record, the system selects all indexes in the record at the same time;
• If some indexes in the history record have been deleted or are currently unavailable, the page should show a prompt and keep only the available indexes;
• Applying an index history does not clear the current time range, search conditions, or quick filter conditions.

Quick Filter¶

For more details, see Filter.

In the Log Explorer, non-numeric field values in the quick filter are sorted by their occurrence count within the current full query scope, from highest to lowest, and show the true Top N. The statistical scope is determined by the current index, time range, query mode, search conditions, and filter conditions together, and does not use the data already loaded on the current page as a sample.

Display¶

On the Display page, two groups of fields are shown:

• Display fields: fields shown in the current log data list;

• Available fields: all fields cached for the current data type.

You can perform the following operations:

• Search for fields; if the query results do not contain an exact match, you can create a field and add it to Display Fields;

• Edit field aliases;

• Drag to adjust field order;

• Delete (all) fields;

• Reset to default fields;

• Set whether to display field aliases and the time column.

When you reopen the Display configuration, the system restores the last position you were at. After adding, deleting, or reordering fields, you do not need to search again from the top of the list when re-entering the configuration page.

Field Value Sorting¶

Candidate values of non-numeric fields in Display are sorted by occurrence count from highest to lowest by default. The sorting generates a true Top N based on the full statistical scope and is not affected by the current list pagination or scroll-loading batch size.

After switching Standard, DQL, log indexes, time ranges, or query conditions, the system recalculates based on the new query context.

null and Empty String Filtering¶

The field list on the left side of the Log Explorer counts and displays null and the empty string "" separately:

• null: The field does not exist in the current log, or the field has no value;
• "": The field exists in the current log, but its value is an empty string.

Click a value to add it as a filter condition. The list displays a value and its count only when the current query results contain the corresponding data.

Standard mode and DQL mode follow the same display and filtering rules.

Reset to Default Fields¶

When you perform "Reset to Default Fields", the system displays fields according to the following rules:

• Regular indexes: time and message are displayed by default; whether the time column is shown is still controlled by the "Show Time Column" toggle;
• Full-row indexes: time and the business fields of the current index are displayed by default; message is not displayed by default;
• If the administrator has configured key fields for the current index, the key field configuration takes priority;
• Users can still manually add, remove, or adjust display fields.

Save Display by Index¶

The Log Explorer saves the display configuration of the current user independently for each log index.

For example, when selecting index A and index B separately:

• Adding a display field under index A does not automatically add it to index B;
• When switching to index B, the system restores the display configuration last saved for index B;
• When switching back to index A, the system restores the display configuration of index A.

The display configuration is saved in the current user's browser and does not affect other members in the workspace.

Status Distribution Chart¶

Based on the selected time range, the system automatically divides it into multiple time points and displays the counts of different log statuses as a stacked bar chart, facilitating efficient statistical analysis.

When you filter logs, the bar chart synchronizes in real time to show the filtered results.

• Hover to export the chart to a dashboard, note, or clipboard;

• Customize the time interval.

Query Mode¶

After the workspace enables long-term log storage, a toggle for Standard Query and Long-term Query appears in the upper-right corner. This toggle is used to switch queries between data in different storage tiers, and how you use it depends on your data storage policy configuration.

If long-term log storage is not enabled for the workspace, the toggle is not displayed in the Explorer.

Click to view more details about log query modes.

Instructions¶

1. When you first enter the Explorer, the default mode is Standard Query, which supports queries over any time range with real-time responses.

2. After switching to Long-term Query, click the time input box to open the time selection panel:

3. Select the date: Choose the start date on the left;

4. Set the start and end times: Select the start time and end time using the wheels on the right. If the end time is earlier than the start time, the system automatically recognizes it as the next day, and the input box displays 2026-05-19 23:00:00 ~ next day 05:00:00;

5. You can also drag the blue interval on the time axis to move it as a whole, or drag its left and right endpoints to fine-tune the start and end times. During dragging, you can cross the current midnight, and the cross-day boundary is marked as "next day 00:00".

6. The selected query interval and total duration are displayed in real time below the time axis; after confirmation, click "Query" to trigger the search.

Search Bar¶

The Log Explorer search bar supports multiple search and filter methods.

After entering a search or filter condition, you can preview the result and copy the condition for use in charts or query tools.

Manual Query¶

Click the toggle button on the right side of the search box to enter manual query mode.

JSON Field Return¶

DQL queries support extracting nested values from JSON fields in log data. Simply add a field path with the @ symbol to the DQL query statement, and the system will automatically recognize the configuration and display the extracted value as a separate field in the query results. For example:

• Normal query:

• Expected query result after extracting nested fields:

In the Log Explorer, if you want to directly view values extracted from the JSON text of each log's message field in the data list, add a field in the format @targer_fieldname in Display Columns. As shown below, we add @fail_reason, which has already been configured in the DQL query statement, to Display Columns:

Log Color Highlighting¶

To help quickly locate key information in logs, after entering a search condition, the page highlights all matching content in the current query results, not limited to the message field. Other fields actually displayed in the list, stacked list, and log content are also highlighted at the same time if they match the search condition.

Expanding and Copying a Single Log Line¶

• Click the button in a log entry to view the full content of that log. If the log supports JSON format, it is displayed in JSON format; otherwise, the content is displayed normally;

• Click the button to copy the entire log content to the clipboard.

Lines Displayed¶

In the log data list, the trigger time and content of each log are displayed by default. You can use the "Lines Displayed" option to choose "1 Line", "3 Lines", "10 Lines", or "All Content" to view the complete log information.

Explanation of "Scanned Volume" and "Count"¶

1. Scanned Volume: Indicates the size of data scanned during the actual execution of the query, used to measure query consumption. A larger scanned volume means the query needs to search and process a larger range of data.
2. Count: Indicates the number of results finally returned by the query, used to measure the scale of the query results. The count only represents the number of matched results and is not equivalent to the amount of data scanned during the query.

Note that there is no fixed conversion relationship between scanned volume and count. Since the size of a single log is not fixed, and a query may scan a large amount of data but only match a small number of results, you cannot directly infer the scanned volume from the count, nor can you infer the returned count from the scanned volume.

Settings¶

Create Monitor¶

When filtering log data, if you need further alert monitoring on the filtered results, you can create a monitor with one click. The system automatically applies the index, data source, and search conditions you selected, simplifying the configuration process.

Copy as cURL¶

In the Log Explorer, you can retrieve log data using command-line syntax. In Settings on the right side of the log data list, click Copy as cURL to copy the corresponding cURL command. Paste the command into a host terminal and execute it to retrieve log data that matches the filter and search conditions within the current time range.

Example

After copying the cURL command, as shown below: replace <Endpoint> with the domain name, and go to API Management to replace <DF-API-KEY> with your Key ID.

For more parameter details, see DQL Data Query.

For more information about the API, see Open API.

curl '<Endpoint>/api/v1/df/query_data?search_after=\[1680226330509,8572,"L_1680226330509_cgj4hqbrhi85kl1m6os0"\]&queries_body=%7B%22queries%22:\[%7B%22uuid%22:%222eb41760-cf6e-11ed-a983-7d559044c3fc%22,%22qtype%22:%22dql%22,%22query%22:%7B%22q%22:%22L::re(%60.*%60):(%60*%60)%7B+%60index%60+IN+\[%27default%27\]+%7D%22,%22highlight%22:true,%22limit%22:50,%22orderby%22:\[%7B%22time%22:%22desc%22%7D\],%22_funcList%22:\[\],%22funcList%22:\[\],%22disableMultipleField%22:false,%22disable_slimit%22:false,%22is_optimized%22:true,%22offset%22:0,%22search_after%22:\[1680226330509,8572,%22L_1680226330509_cgj4hqbrhi85kl1m6os0%22\],%22timeRange%22:\[1680187562081,1680230762081\],%22tz%22:%22Asia%2FShanghai%22%7D%7D\]%7D' \
- H 'DF-API-KEY: <DF-API-KEY>' \
- -compressed \
- -insecure

In addition to this export path, you can also use other log data export methods.

Configure Status Colors¶

The system has preset default colors for status values. If you need to customize the colors used to display different statuses in the Explorer, click Configure Status Colors to modify them.

Formatting Configuration¶

With formatting configuration, you can hide sensitive log content, highlight important log content, or enable quick filtering by replacing log content.

1. Click Settings in the upper-right corner of the Explorer list;

2. Click Formatting Configuration;

3. Add a mapping rule, enter the following content, and save:

   • Field: Specify the log field (e.g., content);

   • Match method: Select the match method (currently supports =, !=, match, not match);

   • Match content: Enter the content to match (e.g., DEBUG);

   • Display as: Enter the content to display after replacement (e.g., **).

Log Data Export¶

In the log list, you can first filter the required data and then export it as CSV, JSONL, or TXT files, or export it to dashboards or notes.

In an HTTPS environment, CSV and TXT files can export up to 1,000,000 logs per export; JSONL files are not subject to this upper limit. The actual export time is affected by the data volume and query conditions, so please wait patiently for the export to complete.

To export a specific log, open the details page of that log and click in the upper-right corner.

Advanced Linkage Configuration¶

For more details, see Advanced Linkage Configuration.