Log Explorer

Searching and narrowing

Use the bar above the stream to narrow what the Log Explorer shows. The stream lists events with the newest at the bottom, and every control on the bar applies at once, to the live stream and to older events alike.

The controls combine. A search, a level, a program, a source and a field condition all apply together, so a search for timeout with the level set to error shows only timeouts at the error level, including new ones as they arrive.

Search

Type into Search messages... to show only events whose message contains that text. The match is case-insensitive and can fall anywhere in the message, so timeout finds both Connection timeout after 30s and TIMEOUT_ERR.

The search box matches plain text. To combine conditions or exclude text, use Advanced search.

Levels

Open the level picker (it reads All levels when nothing is picked) and tick the severities to show. The menu stays open, so you can tick several in one visit. All levels at the bottom of the menu clears the choice.

To pick a level and everything more severe in one click, use the + at the end of that level's row. The + on the warning row, for example, picks warning, error, critical, alert and emergency, and the picker then reads warning+.

Severities run from least to most severe: debug, info, notice, warning, error, critical, alert, emergency.

Programs and sources

Pick a program in the program picker (All programs when nothing is picked) to see only what that program wrote. The list holds the programs seen on the current selection. To use a program that is not listed yet, type its name into the picker's search and choose Use "...".

Pick a source in the source picker (All sources when nothing is picked) to see one source. The same picker lists the account's filters and every environment the sources are tagged with, so picking production shows every source tagged production.

To follow several sources at once, tick each of them in the source picker. Picking a filter or an environment clears the ticked sources, and ticking a source clears a picked filter or environment.

When a filter is picked, the search, level, program and field controls narrow what the filter shows.

A source waiting for approval is listed with (pending) after its name. Its lines can be viewed by picking it, and they are not included in All sources.

Field conditions

Field conditions test the structured attributes stored with an event: the fields extracted from a JSON payload, or sent as attributes over HTTP. To add one, open the Fields picker, choose Add field, and fill in the Filter by field dialog:

• Field - the attribute's dotted path, such as context.order.id or status. The list offers the paths seen on the current selection, and Use "..." takes a path that is not listed.
• Operator - one of the operators below.
• Value - the text to compare with, for every operator except is present and is absent.

Operator	Matches when
is	The field's value is exactly the text given, including upper and lower case. Numbers and booleans compare as text, so status is 500 matches both a numeric 500 and the string "500".
is not	The field holds a different value, or no value at all.
contains	The field's value contains the text. Upper and lower case are treated as the same for the letters A to Z.
does not contain	The field's value does not contain the text, or the field has no value.
is present	The field holds any value, including an empty string, a number, a boolean or a list.
is absent	The field is missing or null.

An object or a list at the path never matches is or contains - Query expressions explains why, and how the negated operators treat missing values.

The Fields picker then reads as a count, such as 2 fields. Open it to see each condition, and use the x on a condition to remove it.

You can also add a condition straight from an event. Open the event and point at one of its fields: Filter for this value shows only events with that value, and Exclude this value hides every event with that value. Excluding is the quickest way to remove a noisy value from the stream.

Advanced search

Choose Advanced search (the code-bracket button at the far end of the bar) to replace the pickers with a single expression box. Whatever the pickers held is written into the box as text. Type or edit an expression and press Enter, or choose Apply:

program is nginx and (level is error or message contains "timeout") and request_id is present

The basics of the syntax:

• Conditions are joined by and.
• Alternatives go in parentheses, joined by or.
• Every operator has an opposite: is not, does not contain, is none of.
• level is warning+ means that level and every more severe one.

Query expressions has the full grammar and worked examples of every combination. The ? button beside Apply opens that guide in a new tab, so the expression you are typing stays in the box.

Back to the pickers (the same button, now showing sliders) returns to the pickers.

You can also type what you want in plain English - see Asking in plain English below.

Things to know:

• The source picker stays beside the box. An expression narrows the selected source, environment or filter and never replaces it.
• A mistake in an expression is reported under the bar with the character where it was found. The last expression that applied stays in force until a new one applies.
• Some expressions cannot be shown by the pickers: an or group, a negated message, program or level, a pattern or redaction condition, or a second message, program or level condition. These still work on every source, environment and filter. Back to the pickers is refused with a note until the expression is one the pickers can show, or the box is cleared.
• The expression is kept in the page's address, like the pickers' settings. You can share an advanced search as a link, and an agent using the API can give you one.
• Open in Log Explorer on the Log Analysis page opens this box with a pattern is any of expression that names the patterns behind a count.

Asking in plain English

Type a plain-English request into the advanced search box and press Enter. You never have to say whether you typed an expression or a sentence. Text that is a valid expression applies as it is. Anything else - a sentence, or an expression with a mistake in it - goes to an assistant that writes the expression for you.

The assistant uses the names of the programs, fields, sources, environments and filters your account has. It is never sent your log events.

The answer comes back as a suggestion, not a search. It replaces your text in the box, and a note under the bar says how your text was read, for example: Read "all production errors" as the expression now in the box on Environment: production. Nothing changes in the stream until you decide:

• Enter applies the suggestion: the expression, and the source, environment or filter named in the note.
• Escape puts your original text back in the box.
• You can edit the suggestion first. It is ordinary text in the box.

You type	The note names	The box holds
show any php errors or laravel errors		(program is php-fpm or program is laravel) and level is error+
all production errors	Environment: production	level is error+
web server warnings	Filter: web servers	level is warning+
errors on prod-1	Source: prod-1	level is error+
anything about order 889		context.order.id is 889
warnings and worse except cron		level is warning+ and program is not cron
requests that have no request id		request_id is absent
program is nginx and level is error or message contains timeout		program is nginx and (level is error or message contains timeout)
level is eror		level is error
just production	Environment: production	nothing - only the source picker changes

Two of these rows are corrections of expressions: one mixes and and or without parentheses, and one misspells a level. The assistant returns them corrected, with the meaning kept.

What the assistant does and does not do:

• It uses your account's names. php errors becomes php-fpm and laravel when those are the programs on your events. A program the assistant has not seen is still used if you spell it out.
• An identifier given with its kind, such as "order 889", "user 42" or "status 500", goes to the field that holds it (context.order.id, user.id) rather than to a message search.
• It picks one source, environment or filter at most. all production errors picks the production environment, while payment failures in production may pick a payments filter instead, since only one can be picked. The note shows the pick before it applies. Saying where to look ("in production", "on prod-1", or "the web servers" when a filter has that name) sets the picker, and a filter that covers exactly what you mean makes such a request unambiguous.
• Time is not part of an expression. errors in the last hour becomes level is error+, and the time is set with Go to time. A request such as requests over 2 seconds keeps the part that an expression can say and drops the rest.
• The note names every part it dropped, in your words. For errors in the last hour it says that an expression cannot say "in the last hour", so you know the suggestion is broader than what you asked for.
• When the exact shape matters, words that match the grammar give the most predictable result: "errors or criticals", "warnings and worse", "not from cron", "without a request id".

When the assistant gives no suggestion, the parser's error appears under the bar and your text stays in the box. This happens when:

• the assistant cannot turn the text into an expression (the note says so)
• the account has made too many requests in the last minute or day (the note says to try again later)
• the text is longer than 500 characters
• an Account Admin has switched off Use AI features in Account settings
• no assistant is set up for SaneLog

Every suggestion is an ordinary expression, so you can read it, edit it, send it through the API, or save it as a filter when it fits the filter limit of five groups. The full grammar is under Query expressions.

Moving through the stream

The Log Explorer is live by default. New events appear at the bottom of the stream as they arrive, and the view scrolls to keep them in sight. The stream can also go back to any moment within retention.

Following and pausing

While the stream is at the bottom it follows new events, and the badge on the bar reads Live.

Scroll up to read something, or open an event, and following pauses. The line you are reading stays where it is, and new events keep arriving below it. The badge then reads History, with a Jump to live button beside it.

To follow again, scroll back to the bottom or choose Jump to live.

Scrolling to the top of the stream loads older events, and so does Load older events at the top. When there is nothing older, the top row reads Start of stored events.

The stream holds up to 5,000 lines. When loading older events reaches that limit, the top row reads Line limit reached - narrow the tail to reach further back. Narrowing the stream (a search, level, program or field condition) lets it reach further back.

Going to a time

The stream shows the newest events by default. To look at another moment, choose Go to time and either pick 15 min ago, 1 hour ago or 6 hours ago, or pick a date on the calendar, enter a Time of day (to the second) and choose Go. The time is entered in the timezone the stream's timestamps are shown in.

The stream then loads the events around that moment, and the badge on the bar reads History with the time you picked. Clicking a bar in the volume strip does the same for that interval.

From there:

• Scroll up to load older events, and scroll down to load newer ones.
• When newer events reach the present, the stream returns to live on its own.
• Jump to live returns to the live stream at once.

The moment is kept in the page's address, so you can share the view as a link.

The dialog refuses a time in the future, and a time older than the account's stored events.

Volume strip

The strip above the stream is a bar chart of how many events arrived in each interval, and the shaded part marks the events currently on screen. A spike is visible on the strip before you have scrolled to it.

The strip covers at least the last hour. It widens to cover the older events you have loaded, and in History it covers the moment you went to.

Each bar takes the color of the most severe level in its interval:

• red when it holds an error or worse
• amber when it holds a warning
• the accent color otherwise

Point at a bar to see how many events of each level it holds, most severe first. A red bar can hold one error among hundreds of info lines.

Click a bar to move the stream to that interval.

Surrounding events

To see what happened just before and after an event, open it, choose Show surrounding events, and pick where to look:

• All sources - the Log Explorer opens at that event's moment across all sources, with no search, program, level or field conditions.
• Only followed by the event's source - the event's own source.
• Under Filters, each of the account's filters that has no conditions and covers the event's source.

The event itself is highlighted in the view that opens. Each choice is a link, so you can open it in a new tab and keep your current view.

When the connection drops

If your device sleeps or the network drops, the stream reconnects by itself and loads the events it missed. After a laptop has been closed over lunch, the stream is complete again once it reconnects, and no event is shown twice.

Older events you had loaded by scrolling up are cleared when the stream reconnects. Scroll up to load them again.

While the stream cannot connect, the badge reads Unavailable and the stream keeps retrying.

Reading an event

Opening an event

Click a line to open it, and click its first row again to close it. The arrow at the start of every line turns down while the line is open. Selecting text in a line does not open or close it, so you can copy part of a message. Clicks inside an open event, such as on its buttons or its message, leave it open.

Under the line, an open event shows a row of actions:

• Explain line - see Explain line
• Copy for agent - see Copy for agent
• Show surrounding events - see Surrounding events
• ... for more actions: Copy line copies the line as the stream shows it, Copy link to this line copies a link that opens the Log Explorer at this event with the event highlighted, and Show only followed by the event's program sets the program picker to that program

Below the actions, the open event shows the rest of the message and then its attributes, one row per field, each named by its dotted path.

Point at a field row to show Filter for this value and Exclude this value. Each adds a field condition for that value. These two buttons are not offered for lists, null values, or fields whose names contain characters other than letters, digits, _ and -.

Long lines and JSON messages

A line of text longer than two rows is cut off with "…" until you open it. When the message is longer than 300 characters, the line also shows its length at its right end, such as 1,697 chars.

An open event shows the whole message in a box under the actions. The box scrolls on its own when the message is very long, so the lines around the event stay where they are.

When a message is JSON, or text followed by JSON (the way Laravel writes its log lines), the actions row offers Formatted and Raw:

• Formatted lays the JSON out one field per line, indented by level. Line breaks written as \n inside a value, such as in a stack trace, show as real line breaks.
• Raw shows the message exactly as it was stored.

The choice applies to every open event and is kept for your next visit. Copy line, Copy for agent and Explain line always use the message as it was stored.

Display settings

Choose Display settings (the gear at the far end of the bar) to change how events are drawn and when new lines show. These settings never change which events are shown.

The settings are saved to your profile, so they apply on every device you log in to. Each change applies to the lines already on screen as soon as you make it.

Live tail order

Live tail order decides when a new line shows in the live stream:

• Show lines as they arrive (the default) shows each line the moment it arrives.
• Hold lines for 1 second, 2 seconds or 5 seconds keeps each new line back for that long, then places it among the lines on screen by its timestamp.

Lines from different sources that arrive a moment apart can arrive out of timestamp order. Holding them puts nearly all of them in timestamp order, and the live stream then runs that far behind.

Events loaded from storage are always in timestamp order, whatever this setting: older events loaded by scrolling up, Go to time, Show surrounding events and the events that load when the page opens.

A hold of a few seconds cannot reorder a source whose lines arrive much later than their own timestamps, because its sender queues or batches its logs or its clock is slow. Those lines are placed by their timestamps higher up the stream. The source's page shows this delay as its arrival lag, the sources list shows the same figure, and the dashboard lists the source under Needs attention while the delay lasts.

Timestamps

Log timestamps sets the date shown with the time at the start of each line. Each option is labelled with an example of the current time in that format, from ISO dates and dates with or without the weekday and year to the time alone. The time is always 24-hour.

The default is Match the date format on your profile. It uses the Date format set on your profile, or the account's default when you have not set one.

Times are shown in the Timezone set on your profile, or in the account's default timezone when you have not set one.

Hide milliseconds drops the fractional seconds from each timestamp. Milliseconds are shown by default, and they tell apart lines logged in the same second.

Density and size

Text size offers Small, Medium (the default) and Large.

First line only shows just the first line of a multi-line message, followed by a marker such as [+12] that counts the hidden lines. A stack trace then takes one line. Open the event to see the whole message.

Names and colors

Shorten source names shows only the first part of a dotted source name in the stream, such as web-1 rather than web-1.example.com. Names that contain a space are always shown in full.

Terminal color codes decides what happens to ANSI color sequences in messages:

• Render the colors (the default) shows the text in the colors and bold the sequences ask for, the way a terminal would, and removes the codes.
• Hide the codes removes the codes and shows the text in the normal color.
• Show them raw shows the codes as they arrived.

This works on sequences that arrive raw and on sequences that the sender has escaped as #033[.

Locate IP addresses (on by default) shows public IPv4 addresses in blue with a dotted underline, both in messages and in the field values of an open event. Point at one to see the city and country the address is registered to, with the country's flag. Private addresses stay plain. SaneLog includes GeoLite2 data created by MaxMind, available from maxmind.com.

Explain line

Use Explain line to get a plain-English explanation of an event: what it means, whether it looks like a problem, and what to check next. Open an event and choose Explain line. The explanation appears under the actions a few words at a time, starting after a couple of seconds.

To write it, SaneLog sends the AI model:

• the event itself, with its attributes
• the source's name, environment and description, as entered on the source's page
• how often lines like it appeared over the last 7 days, by day, source and level, so a routine line can be told apart from a new one
• the lines around it: up to 10 before and after from the same source, a count per source for the 5 minutes either side, and the notable lines from every source in that time
• the environment and description of each other source in those lines, for up to 20 sources that have either set

Lines are compared by their pattern, the message with numbers, quoted values, addresses and ids folded to ?, as in Log Analysis.

Good source descriptions give better explanations. A description that names the source's role and what sits around it lets the explanation say what each server is and how the servers relate.

The explanation is written by AI and can be wrong. Check the details before acting on them.

An explanation is kept until midnight in your timezone, so opening the event again, or a teammate in the same timezone explaining the same event, shows it at once.

When an Account Admin has switched off Use AI features in Account settings, Explain line is marked Off. Choosing it then says what it does. For an Account Admin it also links to the setting.

No explanation is written when the account has reached Explain line's usage limit. The explanation then says to try again later.

Copy for agent

Use Copy for agent to hand an event to a coding agent such as Claude Code or Cursor. Open an event and choose Copy for agent: it copies the event and what happened around it across every source as Markdown, ready to paste into the agent's chat or into an issue.

Agent handoffs describes what the copied text holds.

Copied text shows the data as it was when you copied it. To let an agent investigate on its own - fetch more context, check other sources, compare with yesterday - connect it to the MCP server, or give a script an API token.