Exploring & Discovery

Learn how to explore Instant Logs using time ranges, search, filters, field distributions, request details, and the Log Volume chart.

The Instant Logs explorer provides a unified view of the requests matching your selected sources, time range, search, and filters. Each control updates the same result set, so the Log Volume chart, log table, and field statistics remain synchronized.

The explorer contains four main areas:

• The toolbar for source selection, search, time range, auto refresh, and filters.

• Log Volume for request volume over the selected time range.

• Available Fields for field values and distributions.

• The log table for individual requests, displayed newest first.

The whole explorer in one view. Everything you change in the toolbar reshapes the other three regions at once.

Time Range & Auto Refresh

Choose a predefined time range or define a custom start and end time.

Available presets include:

• Last 15 minutes

• Last 1 hour

• Last 6 hours

• Last 24 hours

• Last 7 days

Set auto refresh to 5s, 10s, or 30s to rerun the current query automatically. Select Off to refresh the view manually.

The time range presets, and the auto refresh interval beside them.

Auto refresh preserves the current sources, time range, search, and filters.

A single Instant Logs query can span a maximum of 7 days. Turn auto refresh off when reviewing a specific page of results to prevent the result set from refreshing as new logs arrive.

Search

The search field matches a substring against request_uri.

For example, entering:

/api/checkout

returns requests whose URI contains /api/checkout.

Other useful search values include /api/ for API paths, /static/ for asset requests, and /health for health checks.

Search applies to the same result set used by the Log Volume chart, log table, and field statistics.

Filters

Each filter consists of a field, operator, and value. Multiple filters are combined using AND logic.

You can create a filter from a value already visible in the explorer or by using the filter form.

From a Value You Can See

Expand a field in the Available Fields panel or open a request's detail drawer. Use the + or − control next to a value:

• + includes requests matching the value.

• − excludes requests matching the value.

This method allows you to create a filter directly from the current result set without entering a field name or value manually.

The Add filter form: field, operator and value, for values not currently on screen.

From the Filter Form

Select Add filter, choose a field and an operator, and enter a value.

Instant Logs provides ten operators, including equality, contains, pattern matching, and numeric comparisons. Operator-specific guidance is displayed in the menu.

Use the filter form when the value you want to query is not currently visible in the result set.

Each active filter appears as a filter pill in the toolbar. Remove an individual filter with its × control or select Clear all to remove all filters.

The Log Volume chart, log table, and field statistics recalculate together whenever the filter set changes.

An applied filter pill and Clear all - the whole view has narrowed to it.

The Available Fields Panel

Select a field in the Available Fields panel to view its distribution within the current filter set.

For supported fields, the panel displays:

• The most frequent values.

• Percentage share for each value.

• Absolute count for each value.

• Number of distinct values, displayed as unique.

• Total number of events used to calculate the distribution.

This view can be used to identify dominant values within the current traffic. For example, expanding status can show whether an error increase is primarily associated with 5xx or 404 responses. Expanding remote_addr can identify whether a single IP address represents a significant share of the current result set.

A field expanded in the sidebar: top values with percentages, and the + / − controls on hover.

Values that provide + and − controls can also be used directly as include or exclude filters.

Of the 47 columns, 35 are filterable and 32 provide distribution statistics. Fields without filtering controls are display-only.

Inspecting a Single Request

Select any row in the log table to open the request detail drawer.

The detail drawer displays every field captured for the selected request. You can:

• Switch between a structured key/value view and raw JSON.

• Search within the fields of the selected request.

• Copy the request JSON to the clipboard.

• Create an include or exclude filter from a field value.

• Open the distribution for a supported field.

The request detail drawer, showing every captured field for one request.

Press Esc to close the detail drawer.

The Log Table

The log table displays individual requests from the current result set, with the newest requests first.

Pagination is handled on the server, so only the page currently being viewed is fetched.

Select one of the following page sizes:

• 25

• 50

• 100

• 200

The default columns are:

• timestamp

• status

• proxy_cache_status

• request_method

• request_uri

• country_code

• request_time

The log table with its default columns, the page size selector and the server-side paginator.

Log Volume Chart

The Log Volume chart shows the number of requests received during the selected time range.

Instant Logs automatically selects the bucket size to keep approximately 40 buckets across the selected window. The current bucket size is displayed next to the event count.

You can display the chart as a bar or line chart:

• Bar – Shows request volume across adjacent time buckets.

• Line – Shows the shape of request volume over longer time ranges.

Stacked: total volume reads at a glance, but one source's spike hides inside it.

When multiple sources are selected, choose one of the following views:

View	Behavior	Use
Total	Combines all selected sources into one series.	View overall traffic volume.
Stacked	Stacks sources so that the total height represents combined volume.	View total volume and each source's contribution.
Separate	Displays each source as an independent series.	Compare traffic patterns between sources.

Hover over a bucket to view the exact request count for that time window, including the per-source breakdown when multiple sources are selected.

Separate: the same window, drawn per source - the spike is unmissable.

Select a bucket to narrow the entire explorer to that time window. The Log Volume chart, log table, and field statistics update to the selected range.

Hovering a bucket: the exact count for that window, broken down per source.

Select a source in the chart legend to show or hide its series.

In Stacked view, a traffic spike from one source can be less visible within the combined volume. Use Separate when you need to compare whether selected sources follow the same traffic pattern.