Paste some lines
Any log you have — a web server access log, a container's JSON output, a syslog extract. The page detects the format and names the fields; override it if it guesses wrong.
Click what you're looking for
Each field shows its most common values with a count. Click one — status 500, level error, a path, an IP — and it becomes a filter. Stack as many as you need.
Take the query with you
The same filter is written out four ways: grep for the box, jq for JSON, LogQL for Grafana Loki, awk for columns. Copy the one that matches where the real logs live.
New here? Hit Load nginx sample, then click 500 under the status field. The grep and LogQL lines fill in instantly.
Why not just grep? Show me an example
You can — once you know what you're grepping for. The hard part of a 3 a.m. incident is usually the five minutes before that, when you have 20,000 lines and no idea which field matters. Say the on-call alert says "error rate up" and you pull the last few minutes of nginx access log:
10.0.0.14 - - [28/Oct/2026:13:41:02 -0700] "POST /api/checkout HTTP/1.1" 500 212 "-" "Mozilla/5.0 …" 10.0.0.9 - - [28/Oct/2026:13:41:02 -0700] "GET /static/app.js HTTP/1.1" 200 48211 "-" "Mozilla/5.0 …" 10.0.0.14 - - [28/Oct/2026:13:41:03 -0700] "POST /api/checkout HTTP/1.1" 500 212 "-" "Mozilla/5.0 …"
Paste that in and the status field immediately shows 200 × 1,840 · 500 × 61 · 404 × 12. Click 500. Now the path field, filtered, shows /api/checkout × 58. Click that too. Two clicks, and you know the problem is one endpoint, not the whole site — and the ip field tells you it's mostly one client hammering it.
Now you need the same question against the real logs in Loki, where the last hour lives. The export panel already has it written:
{job="nginx"} | pattern `<ip> - - [<ts>] "<method> <path> <_>" <status> <_>` | status="500" | path="/api/checkout"
That's the whole idea: do the exploring on a pasted sample where clicking is fast, then take the exact query to the system that has all the data.
01Log lines
02Fields
Top values per field, counted across the lines that match the current filter. Click a value to filter on it.03Filter
Conditions are ANDed. "contains" and "regex" are case-insensitive; "regex" uses JavaScript syntax.04The same filter, four ways
grep works on the raw text, so it matches the value anywhere in the line and is the loosest of the four. jq and LogQL filter by named field and are exact. awk uses column numbers for whitespace-separated formats. For LogQL, change {job="…"} to your stream selector.