Observability Logs Search

Logs Search helps you find the root cause of incidents fast. You search and filter Observability logs using a simple query language called ES|QL. This tool is perfect when you see a sudden spike in errors or an unusual pattern in your system. It guides you step by step to narrow down the noise until only the most important logs remain.

You start with a broad time range and a basic filter, then look at the histogram to spot when things went wrong. You iteratively add exclusion filters to remove known normal logs. Each round zeros in on the real problem. Finally you get a small set of logs to analyze, saving you from drowning in thousands of records.

The workflow mimics a funnel: broad first, then tighter. You always keep your previous exclusions so you never lose progress. This method is designed for incident investigation and works best when you need to drill into services, containers, or hosts quickly.