Visualize Logs

Turn query results into charts and tables directly in Explore. Switch between visualization types — table, line, bar, and area — to analyze data from different perspectives without rebuilding your query.

All charts are interactive. Select any data point to view the underlying logs or spans for that interval, or filter a value in or out of your query.

Visualize as dropdown showing Table, Line chart, Area chart, bar charts, Pie chart, Mixed

Choose a visualization type

The Visualise as dropdown above the results panel toggles between chart types. The default view is a table.

Table

Displays query results as rows and columns, with direct access to individual log and span entries or aggregated groups.

Use the table to:

• Inspect individual log and span records or aggregated rows
• Sort, scan, and compare values across fields
• Drill down into a specific aggregated group to view its underlying logs and spans

For details on configuring the logs table layout, see Logs table.

Line chart

Plots values over time, with each line representing a data series.

Use line charts to:

• Track trends and patterns over a selected time range
• Compare multiple series side by side (for example, log volume by severity)
• Identify spikes, drops, or gradual shifts

Vertical bar chart

Displays values as vertical bars along a time axis or categorical axis.

Use vertical bar charts to:

• Compare discrete values across time intervals or categories
• Spot distributions and peaks at a glance
• View stacked or grouped breakdowns when multiple groupings are applied

Horizontal bar chart

Displays values as horizontal bars, with categories on the vertical axis.

Use horizontal bar charts to:

• Rank categories by value (for example, top subsystems by log count)
• Compare named groups where labels are long or numerous
• Present leaderboard-style views of aggregated data

Area chart

Similar to a line chart, but fills the region below each line to emphasize volume and cumulative contributions.

Use area charts to:

• Emphasize the magnitude of values over time
• Show how different series contribute to a total (stacked area)
• Visualize volume-based patterns such as request throughput or error rates

Switch between visualizations

Toggle between visualization types at any time without losing your query, filters, or groupings:

1. In Explore, select Builder mode.
2. Run a query.
3. Above the results panel, select the Visualize as dropdown.
4. Select a visualization type — Table, Line chart, Area chart, Horizontal bar, Vertical bar, Pie chart, or Mixed.

Results update immediately. The query configuration remains intact, so compare the same data across different visual perspectives.

Interact with charts

All chart visualizations in Explore are interactive. Use them to drill down, refine your query, or pivot your investigation.

Drill down into a data point

Select any data point, bar segment, or area region in a chart to open a context menu. Select Drilldown to view the underlying logs and spans for that specific interval or group. This opens the data that contributed to the selected value, making it possible to investigate the root data behind a spike or anomaly.

Filter values from a chart

Select a chart element to open a context menu with the following options:

• Filter row: Narrow results to those in the selected row
• Include in query: Add the selected value as a filter to include only matching results
• Exclude from query: Add the selected value as a filter to remove matching results
• Copy value, Copy key, Copy query: Copy the data point value, field key, or full query to the clipboard

Iteratively refine your investigation directly from the visualization without manually editing the query.

Zoom into a time range

In time-series charts (line, vertical bar, area), select and drag across a region to zoom into that time range. The time range picker updates to reflect the selected interval, and results refresh automatically.

Configure chart settings

Customize how charts display data using the Graph configuration panel. Select the pencil icon on the chart to open the panel.

Visualization type

Toggle between Vertical bar and Line chart directly from the configuration panel.

Scale

Choose between Linear and Logarithmic scale for the Y-axis. Use logarithmic scale when data spans several orders of magnitude and smaller values are difficult to see on a linear scale.

Time bucket

Control the time interval used to group data points. Set this to Auto to let the system choose an appropriate interval based on the selected time range, or select a specific bucket size.

Stacking

When a query includes multiple groupings (for example, severity and subsystem), bar and area charts support stacking options:

• Stacked: Series are layered on top of each other, showing the cumulative total at each interval. Use this to see how different groups contribute to the overall value.
• Unstacked (grouped): Each combination of groupings appears as a separate bar or line. Use this to compare individual values side by side.

Legend

The legend displays the data series represented in the chart:

• Identify which color or pattern corresponds to each series
• Select a legend entry to show or hide that series
• Focus on a specific subset of data without modifying the query

DataPrime queries and chart visualizations

Chart visualizations are powered by Builder mode. Queries with Group by and Aggregation produce results that map directly to chart visualizations:

• The groupby key becomes the chart axis or category
• The aggregation value becomes the plotted metric

For example:

source logs
| filter $d.severity == 'Error'
| groupby $m.timestamp / 5m as interval, $d.subsystem agg count() as error_count

This query produces a time-series result grouped by subsystem. Visualize it as a stacked line chart, bar chart, or area chart showing error counts per subsystem over five-minute intervals.

Get the most out of visualizations

Follow these guidelines for effective log visualization:

• Start with a table to understand the shape of data before switching to a chart.
• Add Group by and Aggregation in Builder mode to unlock time-series and categorical chart types — raw log queries without aggregation default to the table view.
• Drill down from charts to investigate anomalies — select a spike in a line chart to see the exact logs that caused it.
• Compare chart types to find the best representation — a bar chart can reveal ranking patterns that a line chart obscures, and vice versa.
• Use stacking when subgroups must be understood in relation to a total — switch to unstacked to compare individual group values.