Skip to main content

Explore

Explore is the surface you fly manually. Everything else in the console is composed, ranked, or explained by the platform; Explore is the raw view for the moments you want to see for yourself: when an analysis abstained, when a dashboard's guess isn't the question you're asking, or when you simply want the data.

Open it from the sidebar, pick a service and a window (15m / 1h / 6h / 24h), and everything below scopes to that choice. The page is URL-addressable (/explore?service=…&tab=…&window=…), so an investigation is a link you can bookmark or paste into an incident.

Metrics​

The left panel lists every metric the service emitted in the last 24 hours: golden signals, business metrics, per-operation span latencies, counters, sorted by volume, with avg/max on hover. Click one to chart it over your window. Buckets widen automatically on long windows so the chart stays readable.

Typical use: an alert names a service, so you chart http_request_duration_seconds.avg and see the step with your own eyes before reading anyone's explanation, including ours.

Logs​

Full-text search over the service's raw logs. Type a query (it matches the log body and structured attributes, case-insensitive), filter by severity, and get the newest lines first with timestamps.

Any line carrying a trace id shows a trace ↗ link that jumps straight to that trace's waterfall in the Traces tab, which takes you from "payment failed" to where the time actually went in one click.

:::note Retention Raw logs and traces are retained for 24 hours in ingest mode, long enough for live investigation and same-day postmortems. Aggregated metrics are retained for a year. In federated mode, raw retention is whatever your own stack keeps. :::

Traces​

Two panes. On the left, the slowest spans in your window; click any row. On the right, that trace's waterfall: every span across all your services, in order, with each span's offset from trace start and a duration bar. A four-service checkout trace reads as gateway → order → payment → database, and the slow hop is obvious.

Design notes​

  • Every query is tenant-scoped. The cross-service trace lookup filters spans to services your tenant is allowed to see, so a shared trace id can never leak another tenant's spans.
  • Queries are shaped to the storage engine's sort keys and hard-bounded (time windows, row limits, execution timeouts), so an exploring human can't degrade the detection pipeline.

API​

Explore is a thin UI over five read-only endpoints, usable directly with any API key that has read scope:

GET /api/v1/explore/metrics?service=<id>
GET /api/v1/explore/series?service=<id>&name=<metric>&window=1h
GET /api/v1/explore/logs?service=<id>&q=<text>&severity=ERROR&window=1h&limit=150
GET /api/v1/explore/traces?service=<id>&window=1h&min_ms=100
GET /api/v1/explore/trace/{trace_id}