Facet

Overview

A facet is a marker registered on a tag or attribute of logs that have entered a log index, declaring it as something used for analysis. There are two kinds: qualitative facets, which count the distinct values, and quantitative measures, which gauge the magnitude of values; measures can be given a unit of time or size. Search and processing work without facets, so their role is to surface names in autocomplete and in the choices for aggregation. Once created, a facet is populated from subsequent logs only and does not go back over past logs. The basic etiquette is to look for an existing one before adding more, and when names are not consistent, to fold them into the standard one with an alias.

A marker that makes search faster

A Facet is a marker registered on a tag or attribute of logs that have entered a log index, declaring it as something used for analysis. Once registered, it becomes available for narrowing down in the Log Explorer, for identifying log patterns, and for aggregating counts and averages, and it can also be handled from monitors that use logs as their condition, dashboard widgets, and notebooks.The point to hold on to here is that a facet is not a required condition for search. Processing logs, watching logs as they stream in, searching in the Log Explorer, generating metrics from logs, forwarding logs to storage and reading them back, and routing or excluding by filters all work without facets. Where a facet takes effect is autocomplete: it changes whether the name comes up as a suggestion. If a condition matches the logs that are arriving, you can search for it by typing it in even without registering it.In other words, a facet is a marker that saves you the trouble of recalling attribute names every time you investigate. Attach one to the attributes you use often, and the time it takes to reach the cause shrinks.

The kind changes depending on whether you count or gauge

Facets come in two kinds with different natures. You choose between them depending on whether you want to count the distinct values or gauge the magnitude of the values.

When in doubt, think of it this way: if you only use it as a condition for narrowing down, a qualitative facet; if you want to put it on the vertical axis of a graph, a measure. The string type is always usable, so there is no need to agonize over the type where narrowing by range is not needed.

The unit belongs to the measure, not the field

Measures can be given a unit. For size you can choose from bit, byte, and kibibyte up to exbibyte; for time, from nanosecond, microsecond, and millisecond up to week (as of August 2026). With a unit attached, values with many digits appear in a human-readable form both when you search for them and when they are displayed.The easy mistake here is the point that the unit is a property of the measure, not a property of the field. Suppose, for example, that one service emits duration in milliseconds while another service emits microseconds under the same name. Deciding on nanoseconds as the unit in this state does not bring the two values into line.The correct fix is to align the scale at the time of ingestion. If you use an arithmetic processor to multiply the former by 1000000 and the latter by 1000 to standardize on nanoseconds, a single condition, duration:>20ms, searches the logs of both services at once, and the aggregation results become values you can compare. Think of the unit setting as the mechanism that handles readability after the scale has been aligned.

The list can be arranged to suit you

When you open the facet list on the left of the screen, it shows you a summary of what is inside the range narrowed down by your search conditions. For a qualitative facet, the top values and their match counts are lined up, and you can add or remove conditions just by following the values. A measure shows sliders indicating the minimum and maximum, so you can narrow down by moving the range. Writing syntax in the search bar gives you more freedom, but touching the list first gets you to where you want to go faster.The facets an organization uses tend to grow numerous because they cover the purposes of everyone. Those you do not look at day to day can be hidden. Hidden facets are still visible from the search bar of the list, so you can bring them back when needed. Hiding a facet removes it from autocomplete and from the choices for aggregation, but it remains valid as a search condition. This treatment is why conditions are not lost when you open a shared link.The reach of the hide operation is limited in two senses. One is that it does not extend outside the Log Explorer (the definitions of streaming log views, monitors, and dashboard widgets do not change). The other is that it takes effect only on your own screen. However, if you update a saved view, the hidden state is shared with your colleagues as part of that view. Grouping for the sake of ordering is a matter of display only and does not affect the results of search or aggregation.

Quick to create, but it does not fill in retroactively

Commonly used ones such as host and service are prepared from the start, and the facets for reserved attributes and many standard attributes are available by default. The facet for selecting an index appears only when the organization has multiple indexes or when you are reading back past logs.There are two ways to create a new one. The easy way is from the log details panel, where the field name and type are filled in beforehand, so you only need to confirm (if the value is a string, only a facet; if it is a number, you can also choose a measure). When you do not have a matching log at hand, create it from the add button in the list and specify the tag key name yourself for a tag, or the path prefixed with @ for an attribute. If you want to target an array of JSON objects, extract the attribute with Grok parsing first and then create the facet.There is one property here that cannot be undone. The contents of a facet you create are populated only from the logs that arrive after that point. Even if you think of creating one in the middle of an incident, the past logs you want to examine at that moment will not carry the contents. Registering the attributes you are likely to need while things are calm is how you prepare under this mechanism. As a guideline for the number, Datadog recommends keeping it within 1000 (as of August 2026).

Consistent names connect investigations

Looking for an existing one before creating a new one is the etiquette that pays off most. If information of the same nature is gathered in a single facet, aggregation and cross-checking across teams work as they are. Conversely, when similar ones are split, you end up going around looking for information that is only in one of them.If the names are already inconsistent, you can fold them into the standard one with an alias. There are two ways to fold: folding existing facets that several teams created separately into the standard one, and folding a newly ingested attribute into the existing standard one from the start. Choosing the latter lets you avoid increasing the number of facets that fall out of use after being created. The facet that was folded in can still be used for search, but it is treated as one that prompts you to switch to the standard one. When you want to examine logs from before the alias was set, keeping the folded-in facet around comes in handy.Deletion, on the other hand, calls for caution. If that facet is used by an index, a monitor, a dashboard, or a condition restricting the scope of viewing, or if other teams use it day to day, some things will stop working the moment you delete it. Until you can say for certain that it is unused, it is safer to remove it from your own view with the hide operation.For details, see Datadog's Facets.