14 / 36 chapters
    DocumentationModules

    14

    Log Explorer

    Log Explorer — overview

    Log Explorer is the main tool for searching, filtering, and analyzing log records. It supports full-text search via Elasticsearch with advanced filters and real-time streaming of new events.

    Required tier: Free
    Log Explorer
    Log Explorer — log searching and analysis

    Searching

    The search field supports two modes:

    Simple search

    Enter any text and press Enter. The system searches the message, hostname, and other text fields.

    KQL (Kibana Query Language)

    For advanced queries, use KQL syntax. Examples:

    • •host.hostname: "web-server-01" — filter by hostname
    • •event.category: "authentication" AND event.outcome: "failure" — failed logins
    • •source.ip: 192.168.1.0/24 — events from a subnet
    • •NOT event.category: "process" — exclude categories

    Filters

    Events can be filtered using several criteria:

    1

    Time range

    Select a period using the date picker at the top. Predefined ranges: Last 15 min, 1h, 6h, 24h, 7 days, 30 days, or custom range.

    2

    Sources

    Filter by log source hostname. The dropdown displays all active sources with event counts. Blocked sources (when agent limit is exceeded) are not shown in the list.

    3

    Severity / Category

    Filter by severity (info, warning, error, critical) or event category (authentication, network, process, file, etc.).

    Events table

    The main table displays found events. Each row contains:

    • •Timestamp — event time (in browser local time)
    • •Source — source device hostname
    • •Message — main event message
    • •Category — category (system, network, security, ...)
    • •Severity — color-coded severity

    Clicking on a row expands the event detail with all fields in JSON format. From the detail, you can copy individual values or the entire JSON.

    For efficient browsing of large data volumes, search_after pagination is used (Elasticsearch data streams). Results are sorted by the internal _shard_doc field.

    Field statistics (Field Stats)

    The panel on the right side displays statistics of the most frequent values for key fields:

    • •Top hostnames — most active sources
    • •Top IP addresses — most frequent source and destination IPs
    • •Top categories — distribution of event types
    • •Top severity — counts by severity

    Clicking on a value in the statistics automatically adds a filter to the search.

    Live Tail

    The Live Tail feature streams new events in real-time via WebSocket. Activate it by clicking the "Live" button in the top right corner.

    • •New events are added to the top of the table
    • •Automatic scrolling keeps the newest events visible
    • •Color highlighting by severity
    • •Live Tail automatically stops when scrolling back in history
    Live Tail can be demanding on the browser with high event volumes. For production monitoring, we recommend setting a filter for a specific source or category.

    Data export

    Found events can be exported in several formats:

    • •CSV — tabular format, suitable for Excel and analysis
    • •JSON — machine-readable format with all fields
    Export respects current filters and search. The maximum number of exported records is 10,000. For larger data volumes, we recommend limiting the time range.

    Saved searches

    Frequently used queries can be saved for quick access. A saved search contains the search query, filters, and time range.

    1

    Save

    Set the query and filters, click the floppy disk icon "Save search", enter a name.

    2

    Load

    Click the folder icon "Saved searches", select from the list.

    3

    Management

    Saved searches can be renamed, updated, or deleted from the overview panel.