> ## Documentation Index
> Fetch the complete documentation index at: https://docs-xcor.paloaltonetworks.com/llms.txt
> Use this file to discover all available pages before exploring further.
# Search and filter log data
> Learn how to search and filter logs in Palo Alto Networks Cortex XCOR.
export const AddToDashboardIcon = props => {
return ;
};
export const CollectionIcon = props => {
const drawPath = "M21 6.5c-1.66 0-3 1.34-3 3 0 .07 0 .14.01.21l-2.03.68c-.64-1.21-1.82-2.09-3.22-2.32V5.91C14.04 5.57 15 4.4 15 3c0-1.66-1.34-3-3-3S9 1.34 9 3c0 1.4.96 2.57 2.25 2.91v2.16c-1.4.23-2.58 1.11-3.22 2.32l-2.04-.68C6 9.64 6 9.57 6 9.5c0-1.66-1.34-3-3-3s-3 1.34-3 3 1.34 3 3 3c1.06 0 1.98-.55 2.52-1.37l2.03.68c-.2 1.29.17 2.66 1.09 3.69l-1.41 1.77C6.85 17.09 6.44 17 6 17c-1.66 0-3 1.34-3 3s1.34 3 3 3 3-1.34 3-3c0-.68-.22-1.3-.6-1.8l1.41-1.77c1.36.76 3.02.75 4.37 0l1.41 1.77c-.37.5-.59 1.12-.59 1.8 0 1.66 1.34 3 3 3s3-1.34 3-3-1.34-3-3-3c-.44 0-.85.09-1.23.26l-1.41-1.77c.93-1.04 1.29-2.4 1.09-3.69l2.03-.68c.53.82 1.46 1.37 2.52 1.37 1.66 0 3-1.34 3-3S22.66 6.5 21 6.5zm-18 4c-.55 0-1-.45-1-1s.45-1 1-1 1 .45 1 1-.45 1-1 1zM6 21c-.55 0-1-.45-1-1s.45-1 1-1 1 .45 1 1-.45 1-1 1zm5-18c0-.55.45-1 1-1s1 .45 1 1-.45 1-1 1-1-.45-1-1zm1 12c-1.38 0-2.5-1.12-2.5-2.5S10.62 10 12 10s2.5 1.12 2.5 2.5S13.38 15 12 15zm6 4c.55 0 1 .45 1 1s-.45 1-1 1-1-.45-1-1 .45-1 1-1zm3-8.5c-.55 0-1-.45-1-1s.45-1 1-1 1 .45 1 1-.45 1-1 1z";
return ;
};
export const CollectionNavIcon = props => {
const drawPath = "M8.4 18.2C8.8 18.7 9 19.3 9 20C9 21.7 7.7 23 6 23S3 21.7 3 20 4.3 17 6 17C6.4 17 6.8 17.1 7.2 17.3L8.6 15.5C7.7 14.5 7.3 13.1 7.5 11.8L5.5 11.1C5 11.9 4.1 12.5 3 12.5C1.3 12.5 0 11.2 0 9.5S1.3 6.5 3 6.5 6 7.8 6 9.5V9.7L8 10.4C8.6 9.2 9.8 8.3 11.2 8.1V5.9C10 5.6 9 4.4 9 3C9 1.3 10.3 0 12 0S15 1.3 15 3C15 4.4 14 5.6 12.8 5.9V8.1C14.2 8.3 15.4 9.2 16 10.4L18 9.7V9.5C18 7.8 19.3 6.5 21 6.5S24 7.8 24 9.5 22.7 12.5 21 12.5C19.9 12.5 19 11.9 18.5 11.1L16.5 11.8C16.7 13.1 16.3 14.5 15.4 15.5L16.8 17.3C17.2 17.1 17.6 17 18 17C19.7 17 21 18.3 21 20S19.7 23 18 23 15 21.7 15 20C15 19.3 15.2 18.7 15.6 18.2L14.2 16.4C12.8 17.2 11.2 17.2 9.8 16.4L8.4 18.2Z";
return ;
};
export const ServiceIcon = props => {
return ;
};
export const ServiceNavIcon = props => {
return ;
};
export const CSharpIcon = props => ;
export const PipeIcon = props => ;
export const AiMessageIcon = props => ;
export const MicroscopeIcon = props => ;
Logs Explorer lets you filter log data to focus your search. When you first open Logs
Explorer, results display for all log data received in the last hour.
To normalize data for consistent filtering, Palo Alto Networks Cortex XCOR maps your data to the
`service`, `severity`, and `message` fields. Expand any of the displayed logs to show
these fields, along with any custom fields your data contains.
By default, the **Summary** column displays the contents of the `message` field. If
the `message` field isn't normalized, then the entire payload for each log displays
in the **Summary** column. To parse the payload and direct certain contents into the
`message` field,
[create a field parser](/control/shaping/shape-logs/parse-logs#create-field-parsers).
To filter your data, start with [basic queries](#filter-data-with-basic-queries). You
can then use the [query syntax](/investigate/querying/query-logs/query-syntax) to
filter on attributes in your data, such as a particular environment or cluster name.
If you know details about the data you're searching for, try using
[advanced queries](#filter-data-with-advanced-queries).
For optimal performance, Cortex XCOR recommends always including a primary
[key](/investigate/querying/query-logs/query-syntax#keys) in your filter, such as
`service` or `severity`.
## Filter data with basic queries
Use this method of selecting individual keys or values to query logs from a broad
scope to a narrow focus. The following steps are recommended methods of querying. You
can choose to start with a different key or value based on what you're searching for.
To use basic querying:
1. In the navigation menu select
** Explorers > Logs Explorer**.
2. On the **Logs Explorer** page, use the
[time range selector](/navigate/time-ranges) to select a time
window to display logs for. The default time window is the last hour.
3. Define your query. You can use the sidebar, query box, or a combination of both to
specify your query criteria. You can also click individual keys or values within
a selected log.
* **Sidebar**: Expand the key you want to query on. Hold the pointer over the
value you want to include or exclude from your filter. Click the equals operator
(`=`) to include the value, or the does not equal operator (`!=`) to exclude the
value.
For example, expand the `severity` key and click the equals operator next to
**ERROR**, which adds that expression to your filter.
```text theme={null}
severity = "ERROR"
```
For additional options, click the three
vertical dots icon next to a field name. For example, click
**Pin this field to top of field list** to pin the selected field to the top of
the list of fields, which makes the field always visible.
You can also pin entire logs to the top of the query results. See
[group and visualize queries](#group-and-visualize-queries) for information about
how to pin logs.
* **Query box**: Use the [query syntax](/investigate/querying/query-logs/query-syntax)
to enter the key you want to query on. The autocomplete syntax suggests
operators and matching values for keys you enter as you type to help you
construct your query.
```text theme={null}
severity = "ERROR" AND service = "nginx"
```
If you're unsure what syntax to use, click in the query box and press
`Control+Space` to display values for a key or available operators.
* **Attributes**: After expanding an individual log, click any key or value to
display a menu with the following options:
* **Add field to summary**: Include the selected key or value in the **Summary**
column of the individual log results.
* **Add field as column**: Adds the selected field as a column in the query
results.
* **Add to group and visualize**: Adds the selected key or value to the query
box as a [`summarize`](/investigate/querying/query-logs/query-syntax#summarize)
query, and selects a visualization that best matches the data type.
* **Show matching logs**: Return logs containing only the selected key or value.
* **Hide matching logs**: Return logs that don't contain the selected key
or value.
* **Copy field name**: Copy the selected key or value.
4. To submit your query, either click **Run** or press
`Control+Enter` (`Command+Return` on macOS).
5. Expand your query by either adding additional key-value pairs or entering a
full-text string such as `"failed query token"` to find logs that contain the
expression anywhere in the log. For example:
```text theme={null}
severity = "ERROR" and service = "gateway" AND "failed query token"
```
The operators `AND` plus `OR` are case insensitive, so you can use `AND`,
`and`, `OR`, and `or` interchangeably.
6. To display an AI summary of a log, click **Summarize log**.
7. As you refine your filter, click and select a portion of the time chart to zoom in
to view a smaller time window.
The results update to include only logs that contain the key-value pairs you enter.
## Filter data with advanced queries
If you know details about the log you're searching for, or are carrying context to
Logs Explorer from a [services page](/observe/services/service-pages), use the
[query syntax](/investigate/querying/query-logs/query-syntax) to construct your query.
For example, if you know there's an issue with the `gateway` service in your
production environment, create a query to help you locate which Kubernetes cluster is
experiencing issues.
To use advanced filtering:
1. In the navigation menu select
** Explorers > Logs Explorer**.
2. In the query box, construct a query to include any logs with `ERROR` as the
`severity` for the `gateway` service:
```text theme={null}
service = "gateway" AND severity = "ERROR"
```
The results include 8,700 logs.
3. To submit your query, click **Run** or press
`Control+Enter` (`Command+Return` on macOS).
You notice that several logs in the results contain `"Failed to query user by token"`
in the **Summary** column.
4. Add a full-text string to your search to narrow the scope of your query, and then
click **Run**:
```text theme={null}
service = "gateway" AND severity = "ERROR" AND "failed to query user by token"
```
The results include 5,400 logs, which is fewer, but still too many.
In the sidebar, you notice that 75% of the results are for the
`production-east` Kubernetes cluster.
5. In the sidebar, click `production-east` and then click **Show matching logs**.
Cortex XCOR adds the selected key-value to your query:
```text theme={null}
service = "gateway" AND severity = "ERROR" AND "failed to query user by token"
AND kubernetes.cluster = "production-east"
```
The results include 4,000 logs. To reduce scope, begin drilling in to individual logs.
6. Expand individual logs to find commonalities across the data. You realize that the
same Kubernetes pod is included in many of the logs, so you add that key-value
pair to your filter:
```text theme={null}
service = "gateway" AND severity = "ERROR" AND "failed to query user by token"
AND kubernetes.cluster = "production-east"
AND kubernetes.pod_name = "gateway-6agg9df321-o89ef"
```
The results include less than 700 logs, which is 8,000 fewer than your initial
query.
You identified the individual Kubernetes pod containing the majority of errors for
the `gateway` service so you can inform your team and begin fixing the issue.
## Generate queries from natural language prompts
Cortex XCOR provides
[generative artificial intelligence](/overview/generative-ai) (AI) tools to generate
queries from natural language prompts. Using natural language, you write what you
want Cortex XCOR to query, and Cortex XCOR generates the query
that returns relevant data.
You can generate and refine queries from natural language prompts in Logs Explorer.
Text entry fields that support natural language prompts include an **Edit with AI**
button. To manually edit the generated query, see
[Filter data with basic queries](#filter-data-with-basic-queries).
For more information on how to generate and refine queries with AI, see
[Generate queries using natural language](/investigate/querying/natural-language).
[Operator](/navigate/operator) also queries your logs. Unlike query
generation, it discovers log fields and their values in your tenant, samples raw
logs to confirm what's present, and summarizes the results rather than only
returning a query. Click ** Ask Operator** in the page header or
press A, and then describe what you're looking for. For example:
What are the most common error messages in the shopping-cart service logs over the last hour?
Generative AI features can produce incorrect results, hallucinate data, and deliver
inaccurate analysis. Use generative AI features with care, and independently verify
all information produced by generative AI tools before applying it.
Certain prompts, data, or other inputs might produce irrelevant content. Don't rely on
generative AI features or responses for any uses that exceed their designed scope.
## Group and visualize queries
When exploring log data, you might want to group logs by one or more fields. This
capability helps to answer questions such as,
*What are the error rates across environments for my service?*.
Cortex XCOR lets you group logs and visualize the results within Logs
Explorer. You can explicitly use the
[`summarize`](/investigate/querying/query-logs/query-syntax) operator in a query,
select a key or value in the sidebar, or choose attributes in an individual log to
group your query results by.
To group and visualize query results:
1. In the navigation menu select
** Explorers > Logs Explorer**.
2. Select a field or value to group by, or create a query with the `summarize`
operator:
* **Sidebar**: In the sidebar list of fields, expand the key you want to group by,
hover the pointer over a value, click the three
vertical dots icon, and then click **Add to group and visualize**.
* **Attributes**: Expand an individual log, click any key or value, and then click
**Add to group and visualize**.
* **Query box**: Use the [query syntax](/investigate/querying/query-logs/query-syntax)
to create a query that includes the `summarize` operator. For example, the
following query searches for logs in a Kubernetes cluster in
`production-us-west` that contain errors, and then groups the results by
`service` and `environment`:
```text theme={null}
severity = "ERROR"
AND kubernetes.cluster_name = "production-us-west"
| summarize by service, environment
```
Logs Explorer inserts the key or value you selected into a `summarize`
query and visualizes the results.
3. To display results with a different visualization, select one of the
[available options](#visualization-options). When you select an option, the query
text is rewritten to match the operator that the visualization requires:
* Selecting **Bar chart**, **Pie / Sunburst**, **Table** or **Stat** appends the
[`summarize`](/investigate/querying/query-logs/query-syntax#summarize) operator to
your query.
* Selecting **List** or **Patterns** strips all aggregation
[operators](/investigate/querying/query-logs/query-syntax#operators) from your
query to produce the intended visualization.
When using a chart, see [common panel elements](/observe/dashboards/panels#common-panel-elements)
for an explanation of the available tools in the
three vertical dots menu.
If the results include interesting logs that you want to keep, you can pin those logs
to the top of the query results. Hover the pointer over the log you're interested in
and click the ** pin icon**. The log is pinned to the top of
the query results and persists across queries. You can change the time range and
modify your query without losing pinned query results.
### Visualization options
The following visualization options are available in Logs Explorer to change how your
query results display.
| Option | Displayed visualization |
| - | - |
| **List** | Shows individual log lines in a scrollable, paginated table ordered by timestamp. Each row is a single log event with expandable details. |
| **Time chart** | Displays a line chart with time on the x-axis, showing how a metric (such as `count()`) changes over the selected time range, optionally grouped by a `by` field into multiple series. |
| **Bar chart** | Displays horizontal or vertical bars, where each bar represents a group (from the `by` clause) and bar length represents the aggregated value (such as count per service). Limited to 100 bars. |
| **Pie / Sunburst** | Displays hierarchical rings when a query groups results by two or more fields. Otherwise, displays a pie chart. |
| **Table** | Displays a columnar table of aggregated results displaying one row per unique combination of `by` fields, with columns for each computed metric. Supports sorting and CSV export. Returns the top 100 results by default. To return more results, include the [`limit`](/investigate/querying/query-logs/query-syntax#limit) operator and specify the number of results to return. |
| **Stat** | Shows large single-number tiles, displaying one per group. Ideal for Key Performance Indicators (KPIs) like total error count or request volume per service. |
| **Patterns** | Groups log messages by structural similarity, showing a [log usage pattern](/investigate/analyze/logs-usage), the count of matching logs, and a filter expression to drill into. The displayed patterns are based on available results from the current query in Logs Explorer. To use the pattern in a query, click a pattern and then choose one of these options:
- **Show matching logs** returns all logs that match the pattern. - **Hide matching logs** returns all logs that don't match the pattern. |
## Save and share queries
You can save queries that you run frequently, capture query results in a dashboard
or notebook, and share links to queries or individual logs to help focus results when
investigating issues.
### Access recent and saved queries
When investigating issues, you might use the same query frequently. Rather than
redefining the query, use recent and saved queries to access previously defined
queries in Cortex XCOR. You can apply a fully defined query from a
previous time period by clicking a query from the **Examples** tab.
Recent query are available globally to all users in Cortex XCOR and
persist for 14 days.
To access recent and saved queries:
1. In the navigation menu select
** Explorers > Logs Explorer**.
2. Click ** View queries** to display all available queries.
3. Click either the **My recent queries** tab or the **Saved queries** tab to display
the queries you want to view.
4. Locate the query you want to apply and click it.
The parameters in the query override any parameters in the query box.
### Save a query
You can save queries that you access frequently so they're always available in
Cortex XCOR. Saved queries are like bookmarks you can reference when you
need them.
To save a query:
1. In the navigation menu select
** Explorers > Logs Explorer**.
2. In the query box, [construct your query](#filter-data-with-basic-queries).
The **Save query** button is unavailable until you run your query.
3. Click **Run** to run your query.
4. Optional: To include summary fields and columns in your saved query, click the
three vertical dots icon and select from the
following options:
* **Add field to summary**: Include the selected key or value in the **Summary**
column of the individual log results.
* **Add field as column**: Adds the selected field as a column in the query
results.
5. Click **Save query** to save your query.
6. In the **Queries** window, enter a name for your query.
7. If you added fields to the **Summary** column or added a field as a column in the
query results, enable the **Include summary fields and columns** toggle to include
those selections in the saved query.
8. Click **Save** to save your query.
Your query displays in the **Saved queries** tab of the **Queries** window. You can
[access your saved queries](#access-recent-and-saved-queries) and apply them at any
time.
### Add query results to a dashboard or notebook
To capture the current query state, including the visualization and time range, use
the page actions above the query results. **Add to dashboard** and **Add to notebook**
are disabled until the query field contains text.
* Click **Add to dashboard** to add the current visualization as a panel on a
dashboard. For the target dashboard and panel group selection flow, see
[Copy a panel to a dashboard](/observe/dashboards/panels#copy-a-panel-to-a-dashboard).
* Click **Add to notebook** to add a log volume histogram and a panel that matches
the selected visualization. See [From Logs Explorer](/navigate/notebooks#from-logs-explorer),
and [Share a notebook](/navigate/notebooks#share-a-notebook) to give teammates
access to the same captured state.
### Share a URL to a query
When investigating issues, you might want to share a defined query with other users,
or include a URL to a defined query in monitor annotations, runbooks, or other
on-call tools. Logs Explorer lets you copy a short URL to a defined query using
either a relative or absolute time range.
Relative time can help you understand the results of a query in a past period of
time relative to the current time, such as in the past 30 minutes. Absolute time is
better suited for comparing results across a fixed point in time, such as the results
of a query from last Monday at 8:00 AM versus that same query run today.
To copy a URL to a defined query:
1. In the navigation menu select
** Explorers > Logs Explorer**.
2. [Construct a query](#filter-data-with-basic-queries) that returns the log data
you want to view.
3. In the main header next to **Logs Explorer**, click
**Copy URL** and choose type of time range to use for the URL:
* **Copy with absolute time range**: Create a link that runs a query against the
date and time interval from when you copied the link. For example, if your query
uses `1h` as the time interval, the time range is exactly one hour ago, based on
the date and time you ran the query.
* **Copy with relative time range**: Create a link that runs a query against the
current time. For example, if your query uses `1h` as the time interval, the
time range is exactly one hour ago from the current time.
The URL is copied to your clipboard based on your selection.
### Share a URL to a specific log
When troubleshooting issues, you might want to share a link to a specific log with
other users, rather than to a [defined query](#share-a-url-to-a-query).
To copy a URL to a specific log:
1. In the navigation menu select
** Explorers > Logs Explorer**.
2. [Construct a query](#filter-data-with-basic-queries) that returns the log data
you want to view.
3. Expand an individual log you want to share, and then click
**Copy URL** to copy a URL to the selected log.
The URL is compressed to a short URL and copied to your clipboard. When another user
opens this URL, the results in Logs Explorer focus on the selected log only.
### Download logs
You can download logs from Logs Explorer with or without defining a
[search query](#filter-data-with-basic-queries). Each download includes up to
10,000 logs, and each log includes the `timestamp` and `_payload` fields.
To customize columns and rows in the downloaded data, use the
[`project`](/investigate/querying/query-logs/query-syntax#project) operator in a
query to display results in tabular format. To customize the tabular data and
complete aggregations in your query, use the
[`summarize`](/investigate/querying/query-logs/query-syntax#summarize) operator. Make
changes as needed, and then download the data.
To download logs:
1. In the navigation menu select
** Explorers > Logs Explorer**.
2. Optional: [Construct a query](#filter-data-with-basic-queries) that returns
the log data you want to view.
3. In the logs **Summary**, click the three
vertical dots icon, and then click **Download logs**.
4. Select the format for the data you want to download, then click **Download logs**.
## Related topics
- [Exploring Logs](/academy/courses/exploring-logs.md)
- [Exploring Logs 201](/academy/courses/exploring-logs-201.md)
- [Search and filter trace data](/investigate/querying/traces.md)
- [Search and query telemetry data](/investigate/querying.md)
- [Logging query syntax](/investigate/querying/query-logs/query-syntax.md)
This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.