Investigate
Logs
The logs view shows the log lines of a service or an incident in two forms: templates that summarise what repeated, and individual lines you can read, filter and follow live. Counts and first and last seen times are computed in code from the stored log records, and anything missing from the view is shown as missing.
How it works#
Templates#
MonitOps groups the log lines in an incident window into templates, so a message repeated 1,284 times appears once with its count. Each template shows:
| Field | Meaning |
|---|---|
| Count | How many lines in the window match the template |
| First seen, last seen | The earliest and latest matching line in the window |
| Baseline completeness | How complete the baseline for the template is |
Templates are computed in code from the records in the incident window. In INC-20931 the template upstream timeout calling payments-gw (8000ms) from order-api appears 1,284 times in 4 minutes.
Summary#
An AI-written summary describes what changed in the window. The summary cites template identifiers, and every cited template exists in the computed set.
Log templates
| Count | First seen | Template |
|---|---|---|
| 1,284 | 14:01:58 | upstream timeout calling payments-gw (<*>ms) |
| 212 | 14:02:03 | order <*> payment state=PENDING retry=<*> |
| 9 | 14:02:40 | circuit open: payments-gw |
Live tail#
The live tail streams new lines as they arrive, without a page refresh.
- Follow is on by default; the view stays at the newest line.
- Scrolling up pauses the tail and shows a count of new lines that arrived while paused.
- Resume jumps to the newest line.
- Filters apply to the stream: level, and text. Text matching is a case-insensitive literal match, not a pattern. The count of lines matching a filter while paused uses the same matching as the query.
Historical window#
The historical view reads a window of at most 60 minutes. Choose a window within that limit; a longer investigation uses several windows.
From a log line to its trace#
A log line that carries a trace identifier links to the trace. Following it and coming back keeps your reading position in the log view.
What you see in the console#
The logs view on an incident shows the template table, the summary with its citations, and the tail with its filters and its freshness indicator.
Visible truncation and gaps#
The logs view never presents partial data as complete.
| Condition | What the view shows |
|---|---|
| Truncation | A notice that the result was cut off |
| Uncovered interval | A marker for the interval the data does not cover |
| Stale data | A stale indicator |
| Capacity stop | A stop notice with a retry state; a busy read is refused with a retry interval, not shown as empty |
| Connection interrupted | A reconnect state; on return the view replays what it missed or marks the gap |
Access#
Log attributes are filtered by role. A viewer sees only the attributes that are safe for a viewer; restricted attributes are absent from what the browser receives, not hidden by the page. Requesting a restricted value is refused (see Copilot).
Personal data is masked before storage (see Masking), so the log lines you read are the masked records.
Limits and defaults#
- The historical window is 60 minutes.
- Times are shown in the tenant's time zone.
Failure states#
- If the model service is unavailable, templates and counts remain and the summary shows an unavailable state with the option to retry.
- If a source is silent or stale, the view says so rather than showing an empty tail as a healthy service (see Source health).
Related#
Last updated October 2026