Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Binary file added docs/images/logs-page.png
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
Binary file added docs/images/logs-search-around.png
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
Binary file added docs/images/logs-search-query.png
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
Binary file added docs/images/queried-results.png
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
Binary file added docs/images/run-query.png
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
Binary file added docs/images/search-around-result-no-filter.png
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
Binary file added docs/images/search-around-result.png
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
Binary file added docs/images/search-around.png
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
Binary file added docs/images/select-stream.png
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
Binary file added docs/images/source-details-search-around.png
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
Binary file added docs/images/source-details.png
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
Binary file added docs/images/sql-query.png
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
Binary file added docs/images/time-range-selection.png
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
2 changes: 2 additions & 0 deletions docs/user-guide/logs/.pages
Original file line number Diff line number Diff line change
@@ -1,4 +1,6 @@
nav:
- Logs Overview: index.md
- Logs in OpenObserve: logs.md
- Search Around: search-around.md
- Quick Mode and Interesting Fields: quickmode.md

3 changes: 2 additions & 1 deletion docs/user-guide/logs/index.md
Original file line number Diff line number Diff line change
Expand Up @@ -16,4 +16,5 @@ You can use the Logs page to:

Learn more:

- [Logs in OpenObserve](logs.md)
- [Logs in OpenObserve](logs.md)
- [Search Around](search-around.md)
43 changes: 43 additions & 0 deletions docs/user-guide/logs/search-around.md
Original file line number Diff line number Diff line change
@@ -0,0 +1,43 @@
---
title: Search Around in OpenObserve Logs
description: Learn how to use Search Around in OpenObserve to view logs before and after a record for better debugging context.
---
# Search Around in Logs

This page explains how to use the Search Around feature for a selected log record.

## Overview
The Search Around feature fetches stored log entries that are immediately before and after a selected record. The results are based only on the order in which records are stored in the storage backend, and they do not include filters from the original search query. This behavior gives you additional context for debugging and troubleshooting.

!!! note "Who can use it"
The feature is available to all users with access to the **Logs** page.

---

## How to use
1. Navigate to the **Logs** page in your OpenObserve instance.
![logs page](../../images/logs-page.png)
2. Choose the log stream that you want to query.
![select-stream](../../images/select-stream.png)
3. In the query editor, write an SQL query to fetch the desired logs. You can add filters to the query to narrow down the logs. For example,
```sql
SELECT *
FROM "default"
WHERE match_all('staging')
```
![sql-query](../../images/sql-query.png)
This query retrieves logs where any text field contains the keyword `staging`.
4. Select the time range for the query.
![time-range-selection](../../images/time-range-selection.png)
5. Click **Run Query** to view the queried records.
![run-query](../../images/run-query.png)
6. From the results, click the target record to open the **Source Details** view.
![queried-results](../../images/queried-results.png)
7. Locate the **Search Around** option available at the bottom of this screen.
![source-details](../../images/source-details.png)
8. In the **Number of events** selector, choose how many records you want to retrieve in total, including the selected record. For example, when you select 10, the result set contains 10 records in total, including the selected record. The split is 5 records before the selected record and 4 records after.
9. Click **Search Around**.
![search-around-result](../../images/search-around-result.png)
The search around results are shown without applying the filters from your original query. The record highlighted in the following image does not contain the keyword staging, even though the query used `match_all('staging')`.
![search-around-result-no-filter](../../images/search-around-result-no-filter.png)