Log Explorer
Log Explorer is the central page for searching, aggregating, and graphing the logs collected in Datadog in order to investigate them. It is the place the official documentation calls the "home base" of log investigation, and it is also where you land when you jump from a monitor notification or a dashboard.
Overview
Log Explorer is the page you open when you look for logs in Datadog Log Management. It switches between four functions on a single page: search and filtering, analysis that groups logs by field or pattern, visualization as lists or timeseries graphs, and exporting the view. The situations where it matters are when you look for the single log that caused an incident, when you want to confirm the growth and breakdown of errors with numbers, and when you feel that "the logs are not visible." In the last situation, the direction of your investigation changes depending on whether you know the distinction between layers: by default this page looks at logs that entered an index, the Flex tier is included by a toggle, and archives are brought back through a separate procedure.
The page where log investigation starts
Log Explorer is the page for searching, filtering, grouping, visualizing, and exporting the logs ingested into Datadog. The official documentation positions this page as the "home base" of log troubleshooting and exploration. Whether you start from a blank slate, open from a saved view, or jump in from a monitor notification or a dashboard widget, this is where you land (as of September 2026, Source: Log Explorer). The configuration pages of Log Management, such as editing pipelines and indexes, are outside this page. Live Tail, which lets you watch logs as they arrive, is a separate display mode entered from this page.
Four functions - search, analysis, visualization, and export
The official documentation explains the functions of Log Explorer in four parts (as of September 2026, Source: Log Explorer).
| Function | What it does | Means listed in the official documentation |
|---|---|---|
| Search and filtering | Narrow, widen, or shift the focus to the subset of logs you are interested in | Search queries and Facets / Surfacing anomalous logs with Watchdog Insights |
| Analysis | Extract information from the set rather than from individual logs | Grouping by field / pattern / transaction / Multiple queries with functions and formulas |
| Visualization | Display the results of filtering and aggregation in a readable form | A list that organizes logs into columns / A timeseries graph that measures change over time |
| Export | Reuse the current view later or in another context | Saved views and others |
The four are not separate pages but different ways of looking at the same query. If you use them in the order of finding a lead with search, confirming the numbers with analysis, giving it shape with visualization, and handing it to colleagues with export, one investigation fits into one view.
Which layer of logs you are looking at
The logs this page shows are not everything that was ingested. By default, the logs that entered an index are the search target, and logs dropped by the exclusion filters of a Log Index are not displayed.
- Ingestion: logs arriving from the Agent or integrations are shaped by pipelines
- Index: logs that passed the exclusion filters are stored and become the default search target of Log Explorer
- Flex tier: a tier for long-term retention; enabling Include Flex Logs next to the time selector includes it in search results
- Archive: logs offloaded to external storage, read directly with Archive Search or brought back through rehydration
The toggle to include the Flex tier is explicitly documented (as of September 2026, Source: Flex Logs). On the other hand, aggregation using grouping or functions covers only indexed logs (Source: Log Analytics). When you want to read logs in a Log Archive, you need Archive Search or the work of bringing them back.
The difference between search and analysis is reading one log or reading a set
Search is the way of reading logs one at a time; the results are lined up in a list, and you can choose columns to compare only the attributes you need. Analysis is the way of reading the properties of a set, and the official documentation explains that logs can be grouped in three units: fields, patterns, and transactions (as of September 2026, Source: Log Analytics). Choose by the shape of the question: "which request failed" is search, while "which service do the failures concentrate in, and since when have they increased" is analysis. In analysis you can place multiple queries at once and calculate ratios and differences with formulas and functions, so proportions such as error rate can also be produced within this page. If you start from a single log found by search and switch to analysis using its attributes, you can tell within a few minutes whether it is a one-off or something spreading.
When to open it and when to leave it to another tool
You open Log Explorer when you look for past logs by condition and when you count that set. If you want to watch logs flowing right now to confirm that a setting is taking effect, that is the job of Live Tail, and the difference is left to the entry on Live Tail. If you want to keep looking at the same figure on a dashboard every day, the official documentation mentions the path of generating log-based metrics for logs that are not put into an index (as of September 2026, Source: Log Analytics). The easy mistake is the judgment that "not on this page = the log is gone." It may simply not have entered the index because of an exclusion filter and still remain in an archive or the Flex tier. The habit of sorting out the reason something is not visible layer by layer is the first perspective to acquire in log investigation.