Search logs and spans

Use the Lucene-powered search bar in Explore to find the exact logs and spans you need, using either typed Lucene or a visual chip builder. As you search, Explore keeps your query, filters, and UI actions aligned so you can refine results without rebuilding your work.

Search bar with autocomplete showing suggested keys, recent searches, and syntax helpers

Before you begin

1. Select the dataset you want as your query data source.
2. Set the time range.

Your dataset and time range apply to every search you run until you change them.

Select the dataset

Use the dataset selector to choose the dataset you want to search (for example, a logs dataset).

What happens when you change datasets:

• Explore keeps compatible selections when possible (same field name and type).
• Explore removes incompatible filters and selections.
• If the dataset has no data in the selected time range, you see an empty state. Expand the time range or adjust filters.

Set the time range

Use the time range control to define the window for your search (for example, Last 15 minutes, Last 24 hours, or a custom range).

You can also:

• Change the time range at any time. Results refresh to match your new selection.
• In time-series charts, highlight a segment of the chart to update the selected time range to that interval. This is useful when you spot a spike and want to zoom in.

Build your search query

The search bar supports two ways to build the same query intent:

• Native Lucene mode: Type Lucene directly.
• Chip builder mode: Build the query visually using chips for field, operator, and value.

You can switch modes without losing your query context.

Use autocomplete while you type

When you place your cursor in the search bar, Explore opens an autocomplete panel that helps you build the query faster and more accurately.

The panel includes:

• Suggested fields: Commonly used fields for the selected dataset.
• Recent searches: Previously run searches you can reuse.
• All fields: The full set of searchable fields in the selected dataset.

As you build a clause, Explore guides you through the next step. For example, after you select a field, it prompts you to choose a value. After you complete a clause, it prompts you to choose what comes next, such as adding AND, OR, or NOT.

Tips for working quickly:

• Use the arrow keys to move through suggestions, then press Enter to select.
• Use Shift+Enter to add a new line if you are working with a multi-line query.

Use common operators

The autocomplete panel also provides operator patterns you can apply as you build queries, including:

• Starts with
• Exists in data (for example, _exists_)
• Exclude (for example, NOT)
• Free text
• Range (for example, [range_from TO range_to])

Use quotes for values that include spaces.

Run the search

Select Run to execute the search. If Explore detects an invalid query, it blocks execution until you fix the error.

After the search runs, results appear in the grid.

Review results

The data grid is your default view for inspecting individual logs, spans, and traces.

Common actions:

• Select a row to open the Info Panel or Trace Drilldown.
• Use Manage columns to add fields as columns so you can compare values across many logs without opening each one.
• Sort by a column to quickly find outliers (for example, the highest value in a numeric field).

Inspect a log in the Info Panel

When you select a log row, the Info Panel opens and shows details for the selected log. Use it to review the log's fields and drill into the full record.

From the Info Panel, you can:

• Search within the log details
• Use field-level actions to refine your investigation (for example, include or exclude a value in the query)

Find out more in Log details panel.

Check the distribution of a field from the table

When you want to understand how values are distributed for a specific field, open the context menu for a field value in the table and select the option to group by that field.

Explore opens the Info Panel and shows a distribution chart for the selected field. Use this view to spot the most common values and pivot your investigation to a specific subset.

Examples

Errors with a specific severity:

coralogix.metadata.severity:"Error"

Errors where a field exists:

_exists_:cx_rum.page_context.page_fragments

Filter for a specific value:

cx_rum.page_context.page_fragments:"alerts/{id}"