> For the complete documentation index, see [llms.txt](https://clients.medianova.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://clients.medianova.com/products/edgesight/instant-logs/exploring-discovery.md). # Exploring & Discovery Learn how to explore Instant Logs using time ranges, search, filters, field distributions, request details, and the Log Volume chart. The Instant Logs explorer provides a unified view of the requests matching your selected sources, time range, search, and filters. Each control updates the same result set, so the **Log Volume** chart, log table, and field statistics remain synchronized. The explorer contains four main areas: * **The toolbar** for source selection, search, time range, auto refresh, and filters. * **Log Volume** for request volume over the selected time range. * **Available Fields** for field values and distributions. * **The log table** for individual requests, displayed newest first.

The whole explorer in one view. Everything you change in the toolbar reshapes the other three regions at once.

## Time Range & Auto Refresh Choose a predefined time range or define a custom start and end time. Available presets include: * **Last 15 minutes** * **Last 1 hour** * **Last 6 hours** * **Last 24 hours** * **Last 7 days** Set auto refresh to **5s**, **10s**, or **30s** to rerun the current query automatically. Select **Off** to refresh the view manually.

The time range presets, and the auto refresh interval beside them.

Auto refresh preserves the current sources, time range, search, and filters. {% hint style="info" %} A single Instant Logs query can span a maximum of **7 days**. Turn auto refresh off when reviewing a specific page of results to prevent the result set from refreshing as new logs arrive. {% endhint %} ## Search The search field matches a substring against `request_uri`. For example, entering: ``` /api/checkout ``` returns requests whose URI contains `/api/checkout`. Other useful search values include `/api/` for API paths, `/static/` for asset requests, and `/health` for health checks. Search applies to the same result set used by the Log Volume chart, log table, and field statistics. ## Filters Each filter consists of a **field**, **operator**, and **value**. Multiple filters are combined using **AND** logic. You can create a filter from a value already visible in the explorer or by using the filter form. ### From a Value You Can See Expand a field in the **Available Fields** panel or open a request's detail drawer. Use the **+** or **−** control next to a value: * **+** includes requests matching the value. * **−** excludes requests matching the value. This method allows you to create a filter directly from the current result set without entering a field name or value manually.

The Add filter form: field, operator and value, for values not currently on screen.

### From the Filter Form Select **Add filter**, choose a field and an operator, and enter a value. Instant Logs provides ten operators, including equality, contains, pattern matching, and numeric comparisons. Operator-specific guidance is displayed in the menu. Use the filter form when the value you want to query is not currently visible in the result set. Each active filter appears as a filter pill in the toolbar. Remove an individual filter with its **×** control or select **Clear all** to remove all filters. The Log Volume chart, log table, and field statistics recalculate together whenever the filter set changes.

An applied filter pill and Clear all - the whole view has narrowed to it.

## The Available Fields Panel Select a field in the **Available Fields** panel to view its distribution within the current filter set. For supported fields, the panel displays: * The most frequent values. * Percentage share for each value. * Absolute count for each value. * Number of distinct values, displayed as **unique**. * Total number of events used to calculate the distribution. This view can be used to identify dominant values within the current traffic. For example, expanding `status` can show whether an error increase is primarily associated with `5xx` or `404` responses. Expanding `remote_addr` can identify whether a single IP address represents a significant share of the current result set.

A field expanded in the sidebar: top values with percentages, and the + / − controls on hover.

Values that provide **+** and **−** controls can also be used directly as include or exclude filters. {% hint style="info" %} Of the 47 columns, **35 are filterable** and **32 provide distribution statistics**. Fields without filtering controls are display-only. {% endhint %} ### Inspecting a Single Request Select any row in the log table to open the request detail drawer. The detail drawer displays every field captured for the selected request. You can: * Switch between a structured key/value view and raw JSON. * Search within the fields of the selected request. * Copy the request JSON to the clipboard. * Create an include or exclude filter from a field value. * Open the distribution for a supported field.

The request detail drawer, showing every captured field for one request.

Press **Esc** to close the detail drawer. ### The Log Table The log table displays individual requests from the current result set, with the newest requests first. Pagination is handled on the server, so only the page currently being viewed is fetched. Select one of the following page sizes: * **25** * **50** * **100** * **200** The default columns are: * `timestamp` * `status` * `proxy_cache_status` * `request_method` * `request_uri` * `country_code` * `request_time`

The log table with its default columns, the page size selector and the server-side paginator.

#### Log Volume Chart The **Log Volume** chart shows the number of requests received during the selected time range. Instant Logs automatically selects the bucket size to keep approximately 40 buckets across the selected window. The current bucket size is displayed next to the event count. You can display the chart as a bar or line chart: * **Bar** – Shows request volume across adjacent time buckets. * **Line** – Shows the shape of request volume over longer time ranges.

Stacked: total volume reads at a glance, but one source's spike hides inside it.

When multiple sources are selected, choose one of the following views:

View	Behavior	Use
Total	Combines all selected sources into one series.	View overall traffic volume.
Stacked	Stacks sources so that the total height represents combined volume.	View total volume and each source's contribution.
Separate	Displays each source as an independent series.	Compare traffic patterns between sources.

Hover over a bucket to view the exact request count for that time window, including the per-source breakdown when multiple sources are selected.

Separate: the same window, drawn per source - the spike is unmissable.

Select a bucket to narrow the entire explorer to that time window. The Log Volume chart, log table, and field statistics update to the selected range.

Hovering a bucket: the exact count for that window, broken down per source.

Select a source in the chart legend to show or hide its series. {% hint style="info" %} In **Stacked** view, a traffic spike from one source can be less visible within the combined volume. Use **Separate** when you need to compare whether selected sources follow the same traffic pattern. {% endhint %} --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://clients.medianova.com/products/edgesight/instant-logs/exploring-discovery.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.