Copy as Markdown[Open in ChatGPT](https://chatgpt.com/?q=Read%20https%3A%2F%2Fcoralogix.com%2Fdocs%2Fuser-guides%2Fdata_exploration%2Flogs%2Fgrid.md%20and%20help%20me%20with%20my%20question%20about%20this%20Coralogix%20documentation%20page.)[Open in Claude](https://claude.ai/new?q=Read%20https%3A%2F%2Fcoralogix.com%2Fdocs%2Fuser-guides%2Fdata_exploration%2Flogs%2Fgrid.md%20and%20help%20me%20with%20my%20question%20about%20this%20Coralogix%20documentation%20page.) # Logs table The logs table is the default results view in Explore. It displays individual log entries as rows, with fields rendered as columns. Use the table to scan results, compare field values across entries, sort by specific columns, and open individual logs for deeper inspection. [![Logs table displaying log entries with Timestamp, Content, Application, Subsystem, and Severity columns](/docs/assets/images/grid-overview-1ba12d496351f32fa22744769caae2b2.webp)](https://coralogix.com/docs/assets/images/grid-overview-1ba12d496351f32fa22744769caae2b2.webp) ## Columns[​](#columns "Direct link to Columns") Add, remove, reorder, and reset columns to customize what information appears in the table. ### Add columns from column management[​](#add-columns-from-column-management "Direct link to Add columns from column management") 1. Select **Columns** in the table header. 2. Search for a field by name, or browse the list. 3. Select the field to add it as a column. 4. Drag the field to reorder it in the column list. 5. Close the panel to save your changes. Drag the left edge of the panel to resize it, useful when field names or values are long enough to truncate in the default width. The panel keeps its position while you resize; your chosen width applies for the rest of the session. ### Add a column from a log entry[​](#add-a-column-from-a-log-entry "Direct link to Add a column from a log entry") You can also add a column directly from an individual log entry without opening the column management panel: 1. Select a log row to open the log details panel. 2. Find the field you want to add as a column. 3. Open the field's context menu (three dots or hover actions). 4. Select **Add as a column**. The column appears immediately in the table. ### Reset column layout[​](#reset-column-layout "Direct link to Reset column layout") To restore the default column configuration: 1. Select **Columns**. 2. Select **Reset to default**. This removes any custom columns and restores the original layout. ## Sort or remove columns[​](#sort-or-remove-columns "Direct link to Sort or remove columns") * **Sort**: Select a column header to sort by that column. Select again to reverse the sort order. An indicator shows the active sort column and direction. * **Remove**: Hover over a column header and select the remove icon, or open **Columns** and deselect the field. ## Row display options[​](#row-display-options "Direct link to Row display options") Select **Options** in the results toolbar to control how each log row renders. The popover holds: * **Text wrap**: off by default, so every row stays on a single truncated line for fast scanning of high volumes. Turn it on to wrap each entry to its own height, up to a maximum, so long messages stay readable without opening the log. * **Content column**: show or hide the **Content** column. * **Type**: set what the Content column shows for each row. **Message** shows the log's message; **Full log** shows the full log with all of its attributes. * **Display**: available when text wrap is on. It sets how each wrapped row renders: **JSON** (the formatted JSON tree), **Condensed** (a denser layout that fits more entries on screen), or **List** (key fields without raw JSON). With text wrap off, Display has no effect and every row shows the compact single-line preview. * **Prioritized keys**: select **Modify** to open the Content column keys panel and choose which keys populate the Content column, as described in [Configure prioritized keys](#configure-prioritized-keys). [![Setting row display in the Explore logs table from the Options popover: Text wrap, Content column, Type, Display, and Prioritized keys](/docs/assets/images/grid-row-options-61fe1730ebb1aec983dcfe6ba473c88b.webp)](https://coralogix.com/docs/assets/images/grid-row-options-61fe1730ebb1aec983dcfe6ba473c88b.webp) ### Configure prioritized keys[​](#configure-prioritized-keys "Direct link to Configure prioritized keys") The **Content** column is the primary display column for each log entry. It shows the log message or the values of the fields you select. For nested JSON, the column keeps the inner structure but drops the outermost wrapping key. The **Content column keys** panel opens from the Options popover: select **Modify** next to **Prioritized keys**. It has two sections: * **Prioritized keys**: the ordered fallback list for the Content column. Content uses the first key in the list; if it's missing, it falls back to the next one down. * **Available keys**: every other field in the current dataset. Use the search bar in this section to filter the list by name; your prioritized keys always stay fully visible. [![The Content column keys panel with the Prioritized keys section shown as numbered chips and the searchable Available keys list below](/docs/assets/images/grid-content-column-keys-be90a0d4a020366cb1e38836172d4e86.webp)](https://coralogix.com/docs/assets/images/grid-content-column-keys-be90a0d4a020366cb1e38836172d4e86.webp) #### Prioritize, reorder, and remove keys[​](#prioritize-reorder-and-remove-keys "Direct link to Prioritize, reorder, and remove keys") Prioritized keys appear as numbered chips, where the number is the key's priority. The built-in default keys are ordinary chips, so you can reorder, remove, and restore them like any other key. * **Add a key**: select a field in **Available keys** to move it into **Prioritized keys**. * **Reorder**: drag a chip to a new position, or use the arrow keys once the chip is focused. The number updates to the chip's new priority. * **Remove a key**: select the **×** on a chip, or press **Delete** or **Backspace** while the chip is focused. The key returns to **Available keys**. * **Return to default**: select **Return to default** in the panel header to restore the default set of keys. Each section header shows a live count of its keys. You can prioritize keys up to a fixed maximum; once you reach it, adding more is disabled until you remove a key. Select **Apply** to save your changes. **Apply** stays disabled until you make a change, and no changes take effect until you select it. ## Expand a row[​](#expand-a-row "Direct link to Expand a row") Each log row has an expand control at its left edge. Select it, or double-click an empty area of the row, to expand the row in place and reveal the full log with all of its attributes. Select the control again, or double-click the expanded row, to collapse it. To open the full [log details panel](https://coralogix.com/docs/user-guides/data_exploration/logs/info_panel.md) instead of expanding in place, select the row's open-details control or press **Enter**. ## Export logs[​](#export-logs "Direct link to Export logs") Export the current results to a file for offline analysis or sharing: 1. Select **Export** in the table header. 2. Choose the export format (for example, CSV or JSON). 3. Confirm the export. The export includes the logs matching your current query and time range, up to the supported export limit. [![Export table dialog with options for file name, format, structure, row limit, and column selection](/docs/assets/images/grid-export-70c091b50cdfb9b3c484b472ba780faf.webp)](https://coralogix.com/docs/assets/images/grid-export-70c091b50cdfb9b3c484b472ba780faf.webp) ## Row actions[​](#row-actions "Direct link to Row actions") Open the menu next to any row to access actions scoped to that row. The menu is row-type-aware. Log rows expose the actions below; aggregation/grouping rows add **See raw logs**, **Filter by**, **Exclude**, and **Copy value**; trace and span rows add export and copy actions specific to those record types. For a log row, the menu lists: * **Custom Actions**: opens a list of [custom actions](https://coralogix.com/docs/user-guides/data_exploration/custom_actions.md) configured for your account. * **Copy log**: copies the full log entry to the clipboard. * **Copy log ID**: copies the log's unique ID. Use this to share a permalink, correlate with an external system, or paste the ID into a query. * **Open info panel**: opens the [log details panel](https://coralogix.com/docs/user-guides/data_exploration/logs/info_panel.md) for the selected entry. * **View surrounding logs**: opens a list of duration presets. **5 Seconds**, **30 Seconds**, **1 Minute**, **5 Minutes**, or **10 Minutes**: to load logs from the same source within ± that interval of the selected event. The action drops any active filters and rebuilds the query with only a scoping clause: `applicationName` and `subsystemName` for logs, `serviceName` and `operationName` for spans, and `session_context.session_id` for the `rum.events` dataset. On the `rum.events` dataset, the action label changes to **View surrounding events**. * **Copy permalink**: copies a URL that recreates the current query, time range, and selected log. ## Add a log to Olly context[​](#add-a-log-to-olly-context "Direct link to Add a log to Olly context") Send a specific log to Olly when you want to ask about that exact record instead of the full query result. The action lives in a right-pinned column in the logs table. The column has no header, and the button appears only when you hover the row. 1. Hover the log row you want to send to Olly. The Olly icon appears at the right edge of the row. 2. Select **Add to Olly context**. [![Add to Olly context\" button visible on a hovered row](/docs/assets/images/grid-add-to-olly-context-9b4d7dd0ac8ef39dfc3b286434cc14d3.webp)](https://coralogix.com/docs/assets/images/grid-add-to-olly-context-9b4d7dd0ac8ef39dfc3b286434cc14d3.webp) Olly opens in a drawer with the log already attached as a data-context chip, labelled with the log's timestamp, with an entity icon, and a tooltip that reads **Log: \**. Add more rows by hovering other logs and selecting the same action; each one becomes its own chip. See [Page and data context](https://coralogix.com/docs/user-guides/olly/olly-chat.md#page-and-data-context) for chip behavior and removal. The Olly column stays pinned to the end of the table and isn't part of the column layout. You can't move it, hide it from **Manage columns**, or include it in a saved view. The button doesn't appear on rows where the log has no resolvable ID. ## Fields sidebar actions[​](#fields-sidebar-actions "Direct link to Fields sidebar actions") Actions available from the **Fields** sidebar apply to the table view and modify the query or column layout. ### Show distribution[​](#show-distribution "Direct link to Show distribution") | Entry point | Result | | --------------------------------------------------------------- | --------------------------------------------- | | The **Show distribution** icon on a field in the Fields sidebar | Opens a drilldown drawer grouped by the field | | Log details panel, key menu | Opens the same drilldown drawer | The drawer groups your current results by the field. It has two parts: **Unique values**, a chart of the field's distinct values with their counts (a horizontal bar chart by default, with a chart-type dropdown to switch the visualization), and **Results**, the rows that make up the grouping. Select **Apply to main** to carry the grouping into the main Explore view. #### Actions inside the panel[​](#actions-inside-the-panel "Direct link to Actions inside the panel") The graph-for-key panel and any other slide-in log panel that opens from a chart drilldown share the same row and cell actions as the main logs table: * Open the more actions menu on any row to access **Open info panel**, **View surrounding logs** (or **events** on `rum.events`), **Copy log**, **Copy permalink**, and **Custom Actions**. * Select a value in a row to open the same field-level context menu listed in [Value menu](#value-menu), including **Custom Actions**. These panels skip the **Value across time** action since it points back to a panel you're already viewing. ### Group by[​](#group-by "Direct link to Group by") Select **Group by** from the Fields sidebar context menu to add the field to the **Grouped by** clause in the Query Builder. The table switches from individual log rows to aggregated groups, showing each unique value and its count. ### Other sidebar actions[​](#other-sidebar-actions "Direct link to Other sidebar actions") The three-dot menu on each Fields sidebar entry also exposes: * **Add as a column** / **Remove from columns**: manage which sidebar fields appear as table columns. * **Copy path**: copy the field's full dot-notation path. * **Add to favorites** / **Remove from favorites**: pin or unpin the field at the top of the sidebar (per source and dataset). Value rows under an expanded field use a checkbox to include or exclude the value, plus an **Only** action to narrow the field to that value alone. What `.keyword` means Some string filters use a `.keyword` suffix (for example, `serviceName.keyword:"checkly"`). The base field is *analyzed* (broken into lowercase tokens, so it matches individual words) while the `.keyword` variant keeps the whole value as a single exact string and matches it verbatim. When you filter on a string value in Builder mode, Explore applies the `.keyword` match automatically; numeric and boolean values match directly, without it. See [Filter chips](https://coralogix.com/docs/user-guides/data_exploration/query_builder.md#filter-chips) for more. ## Key-value context menu[​](#key-value-context-menu "Direct link to Key-value context menu") Field-level actions live in two context menus that differ by what you select. Selecting a value (in a log row, or in the [log details panel](https://coralogix.com/docs/user-guides/data_exploration/logs/info_panel.md)) opens the **value** menu. Selecting a key in the log details panel opens the **key** menu. ### Key menu[​](#key-menu "Direct link to Key menu") Select a field key in the [log details panel](https://coralogix.com/docs/user-guides/data_exploration/logs/info_panel.md). Because you selected a key and not a value, the two filter actions filter by field **presence** (whether the field is set at all) rather than by a value: | Action | Description | | ------------------------------ | -------------------------------------------------------------------------------------------------------------- | | **Exists** | Filters to records where the field is set. A field-presence filter (Lucene `_exists_:`). | | **Not Exists** | Filters to records where the field is not set (Lucene `NOT _exists_:`). | | **Add as a column** | Adds the field as a column in the logs table. | | **Group by** | Adds the field to the **Grouped by** clause, aggregating the table by this field's values. | | **Add to favorite fields** | Pins the field to the top of the [Fields sidebar](#fields-sidebar-actions) for the current source and dataset. | | **Copy path** | Copies the field's full path. | | **Copy the key's value** | Copies the field's current value for this log. | | **Copy the key:value** | Copies the full `key:value` pair. | | **Show distribution** | Opens a drilldown drawer grouped by this field. See [Show distribution](#show-distribution) for details. | **Exists** and **Not Exists** are the same field-presence filters available on each field in the [Fields panel](https://coralogix.com/docs/user-guides/data_exploration/fields.md#field-actions). To filter on a specific value rather than the field's presence, use the [Value menu](#value-menu). ### Value menu[​](#value-menu "Direct link to Value menu") Select a field value in a log row. By default the menu filters on the exact value; to filter on a substring, first select only the part of the value you want, for example, highlight `failed aggregating` inside a longer message. The filter then matches that text wherever it appears in the field. | Action | Description | | ----------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | **Custom Actions** | Opens a list of [custom actions](https://coralogix.com/docs/user-guides/data_exploration/custom_actions.md) scoped to the selected value. | | **Filter by** | Adds the field-value pair as an exact-match filter on the current query. Shown when the whole value is selected. | | **Add to filter** | Adds a substring filter that matches the selected text wherever it appears in the field. Replaces **Filter by** when you select only part of a value. Works in both Builder and DataPrime. | | **Exclude** | Excludes the field-value pair from the current query, the exact value, or the selected substring on a partial selection. | | **Query value** | Replaces the entire query with a single filter for this value. Use this to pivot to a fresh search on the selected value without keeping prior filters. | | **Service drilldown** | Opens the service catalog drilldown for the selected service. Only shown when the field is a service-name field. | | **Create metric alert** | Generates a metric from the clicked field-value pair via the Events2Metrics flow and opens the metric-alert editor on it. Only shown when the value is numeric and you have both the Events2Metrics and metric-alert update permissions. | | **Copy path** | Copies the field's full path (for example, `cx_rum.session_context.session_id`). | | **Copy value** | Copies the field value. | | **Copy key** | Copies the field name. | | **Value across time** | Opens a time-series chart of how often this field-value combination appears across the query's time range. | | **Live tail** | Opens [LiveTail](https://coralogix.com/docs/user-guides/data_exploration/logs/livetail.md) filtered to the selected field-value pair. Only available for **Application** and **Subsystem** field values. | | **Open URL** | Opens the value in a new browser tab. Only shown when the value is an `http://` or `https://` URL. | ## Next steps[​](#next-steps "Direct link to Next steps") Filter and search on the fields detected in your results with the [Fields side bar](https://coralogix.com/docs/user-guides/data_exploration/logs/fields-for-logs.md).