Orbtrace
ENTR
Talk to sales
Self-host

Logs

The screen for "find the log line that explains this". Histogram, search bar, pattern clustering, detail drawer — what each of them shows and why.

The Logs screen is built around four pieces, top to bottom: a search bar, a histogram, a results table, and a detail drawer that opens on click. Read this page once and you'll know what each piece is for.

① The search bar

A single freeform input at the top. Type to filter; press Enter to commit. The syntax is HyperDX/Kibana-style — described in full at Search syntax. The short version:

  • error — any log containing the word error.
  • level:ERROR — only ERROR-severity lines.
  • service:checkout-api AND level:ERROR — boolean AND/OR/NOT supported.
  • "Connection refused" — quoted exact match.
  • duration:>500 — works on any numeric attribute.
  • user_id:42 — works on any string attribute.

As you type, an autocomplete menu suggests field names (left of the colon) and values (right of the colon) that exist in the current time window. Press Tab to accept the suggestion.

A / keyboard shortcut focuses the search bar from anywhere on the screen.

② The histogram

A 28-bar bar chart directly under the search bar, spanning the time picker range. Each bar's height is the number of log lines that match the current query in that time bucket.

On screen
  • Bar colourCyan for normal volume buckets. Rose for the top-3 buckets by error count — the "spikes" — so your eye finds them.
  • Drag-selectClick and drag across bars to zoom the time picker to that range. The histogram, the results table, and every other panel on the page re-query immediately.
  • Total countAbove the histogram, "X matching events" — the total across all visible buckets.
  • HoverHover any bar to see the exact bucket start/end and the count.

The histogram is the fastest "did something weird happen?" check in Orbtrace. A flat shape = quiet period. A growing slope = incident in progress. An isolated tall bar = transient spike worth investigating.

③ The results table

Below the histogram, one row per log line, newest first.

Default columns

On screen
  • TimestampLocal timezone, with the timezone abbreviation. Hover to see the exact UTC time and the source timestamp in nanos.
  • SeverityA coloured pill: TRACE · DEBUG · INFO · WARN · ERROR · FATAL.
  • ServiceClick to filter this service into the search bar.
  • MessageThe free-text body, truncated to one line.
  • Attributes peekA few key attributes inlined as chips (user_id=42, route=/checkout). Useful for at-a-glance scanning.

Customise the columns

Click the columns icon (top-right of the table). You can add any attribute as a column — Orbtrace remembers your choice per saved query.

Sort, group, infinite scroll

  • Default sort is "newest first". Click the Timestamp header to flip.
  • "Group by template" toggle (see Pattern clustering, below) collapses the table into one row per template.
  • Scrolling the table down loads more rows on demand — no pagination buttons.

④ Pattern clustering — the killer feature here

A toggle at the top of the table: Group by template. Turn it on.

Orbtrace runs a Drain3-style template extraction over every log line: variable parts (numbers, IDs, paths) are replaced with <*>, and the resulting "template" is the cluster key. Instead of staring at 50,000 lines, you see ~120 templates.

What each row shows when grouped

On screen
  • TemplateThe normalised body. Variable bits show as <*>.
  • CountHow many lines match this template in the current window.
  • SparklineVolume per bucket, like a mini histogram, so you can see whether this template's volume is rising.
  • TagsA row of pills: NEW (first seen in this window), SPIKE (volume up >5× vs. the prior identical window), DROP (volume down >5×).
  • ExpandClick the row to expand inline; you see the actual lines underneath.

The NEW tag is the most useful: a NEW template right after a deploy is almost always an unhandled code path. The SPIKE tag catches retry loops.

⑤ The detail drawer

Click any row in the table → the drawer slides in from the right.

What's in the drawer, top to bottom

On screen
  • HeaderTimestamp, severity pill, service, "Copy link" (a permalink to this exact log), "View as JSON" / "View as form" toggle.
  • BodyThe full message — long bodies stay readable here.
  • AttributesA two-column table of every attribute. Each row has a "filter for" and "filter out" pencil — clicking adds the attribute as a search filter and re-runs the query.
  • Trace contextIf this log has a trace_id, you get a button "Open trace" — it deep-links to the trace detail page with that trace loaded.
  • Context linesBelow the attributes, a tab labelled "Context" shows the 10 log lines before and after this one from the same service — useful for reconstructing what happened around an error.
  • JSON tabRaw OTLP record. For your eyes only when you suspect a schema problem; not for daily use.

Saving and sharing queries

The right edge of the search bar has a "Save query" button. Saved queries appear in the ⌘K command palette and in a quick-access dropdown below the search bar. Every saved query has a sharable URL — paste it into chat to send a teammate exactly what you're looking at.

Tips that pay off

  • Always start with the histogram, not the table. Scan the histogram for shape first; then drag-select the interesting bucket; then read the rows.
  • Group by template before scrolling. 99% of the time, the line you want is the one with the NEW tag.
  • Pivot via the detail drawer. Almost every "click to filter" action is in the drawer; you rarely need to retype.
  • Use service:<name> first, then narrow. Filtering by service early is a 100× speedup over freeform text search.

What this screen doesn't do

  • Tail in real time — that's the Live tail screen. The Logs screen requires a committed search and respects the time picker, by design.
  • Build a dashboard panel — use the "Save as panel" menu in the search bar to push the current query as a panel to a dashboard.

Next: Live tail.

PreviousService mapNextLive tail