Logs Drilldown on Grafana Labs

What is Grafana Logs Drilldown?

Tue, 06 Oct 2026 18:09:31 -0500

What is Grafana Logs Drilldown?

Grafana Logs Drilldown visualizes Loki logs without writing LogQL. It is installed by default in Grafana and Grafana Cloud.

From the Grafana menu, select Drilldown > Logs. If you have more than one Loki data source, change Data source in the top toolbar. Logs Drilldown only supports Loki data sources.

Unless an administrator has set a custom default time range, the app opens on the last 15 minutes when the URL does not already set one. If a service shows no logs, widen the time picker.

How it works

The opening page lists services by log volume. Select Show logs on a service to open that service.

On the service page you can:

Read log lines on the Logs tab, and filter them by text or log level
Open the Labels, Fields, and Patterns tabs to see log volume for each one. Patterns are mined from the previous three hours of logs, and Loki extracts them when pattern ingestion is enabled
Open a panel menu and select Explore when you want the LogQL query for what you are looking at

How to find and filter logs

Tue, 06 Oct 2026 18:09:31 -0500

How to find and filter logs

After you open a service, Logs Drilldown gives you labels, fields, and the text of the log line. Use them together when you need a narrower set of lines.

The three layers

Layer	What it contains	Example
Labels	Indexed labels on the log line, including the service	`job="api"`, `instance="server-01"`
Fields	Values extracted from the log line. Turn on Extract fields from logs to run logfmt and JSON parsers so those fields appear next to indexed labels and structured metadata	`level="error"`, `status_code="500"`
Text	The log message itself. The line filter keeps lines that contain, or exclude, the text you type	`Connection timeout to database`

Logs Drilldown also adds a detected_level label for the level Loki assigns, including debug, info, warn, error, fatal, critical, trace, or unknown when no level could be determined.

A way to narrow the logs

On the Labels tab, select Select or Include on a label to see its values and filter.
On the Fields tab, select Select for a value breakdown, or Include or Add to filter to filter by a field value. Select Extract fields from logs if the field you need is inside the log line.
On the Logs tab, type text in the line filter to keep or drop matching lines.

The Patterns tab groups similar log lines from the previous three hours, when pattern ingestion is enabled. A time range that is entirely older than those three hours shows no patterns. Patterns also do not support multi-tenant or cross-stack data sources.

The log investigation workflow

Tue, 06 Oct 2026 18:09:31 -0500

The log investigation workflow

A typical investigation moves through five steps. You can skip a step or go back.

Step	What you do	What you get
Open a service	Select Drilldown > Logs. The overview lists services by log volume. Select Show logs	That service’s log lines on the Logs tab
Break the volume down	Open Labels or Fields. Open Patterns when pattern ingestion is enabled	Log volume for each label or field. Patterns use the previous three hours of logs
Filter	On Labels, select Select or Include. On Fields, select Include or Add to filter to narrow the lines. Select on a field shows a breakdown of its values. Or type a line filter	A smaller set of log lines from a filter, or the values of one field
Read one line	Open the log line menu and select Show context or Show log details	The lines before and after it, or its labels and fields
Continue	On a panel menu, select Explore, Add to Dashboard, or Create alert	The same selections as a LogQL query in Explore, a dashboard panel, or an alert rule

Add to Dashboard, Create alert, and Explain in Assistant appear only when that Grafana feature is available.

Explore opens Grafana Explore with a query based on the selections you made in Logs Drilldown.

Navigate logs with Logs Drilldown

Tue, 06 Oct 2026 18:09:31 -0500

Navigate logs with Logs Drilldown

Learning path

Logs Drilldown

Welcome to the Grafana learning path that shows you how to use Logs Drilldown to explore your logs and provide insight into troubleshooting.

13 min

Beginner

Docs & blog posts

Open in Grafana Cloud

Complete this learning path directly in your Grafana Cloud stack with an interactive learning experience.

Logs Drilldown on Grafana Labs

What is Grafana Logs Drilldown?

What is Grafana Logs Drilldown?

How it works

How to find and filter logs

How to find and filter logs

The three layers

A way to narrow the logs

The log investigation workflow

The log investigation workflow

Navigate logs with Logs Drilldown

Navigate logs with Logs Drilldown

Logs Drilldown

Open in Grafana Cloud

Resources

Resources

Documentation

Blog posts

Community