Explorer & AI

The Explorer is your unified interface for searching logs and events, running aggregations, and visualizing trends. It's powered by the GQL query language with schema-aware autocomplete and an AI mode for natural language queries.

Explorer Overview

Access the Explorer from the dashboard sidebar. It combines logs and events into a single query interface — no switching between tabs.

The GQL Bar

The search bar at the top accepts GQL queries. As you type, it provides:

• Syntax highlighting — fields (blue), values (green), functions (purple), modifiers (amber)
• Schema-aware autocomplete — suggests discovered field names, types, and example values
• Real-time validation — green border = valid, red border = parse error
• Pipeline visualization — chips below the bar show the parsed pipeline (source → time → filters → stages)
• Multiline support — Shift+Enter for newlines, Enter to execute

Search Mode

Without a pipeline stage, queries return individual log/event rows sorted by timestamp.

# Recent errors
severity:error last:1h

# Errors from a specific service
severity:error service:billing last:24h

# Search across both logs and events
from:logs+events last:1h

# Pattern search
message:~"connection refused" last:6h

Aggregate Mode

Adding a pipeline stage like | count switches to aggregate mode, showing charts and tables instead of individual rows.

# Count errors by message
severity:error | count by message | top 10 | last:24h

# Error trend over time
severity:error | count | timeseries 1h | last:7d

# Average latency by endpoint
| avg(duration_ms) by endpoint | top 10 | last:24h

AI Natural Language Mode

Click the AI button in the GQL bar to switch to natural language mode. Describe what you want in plain English, and the AI generates a GQL query using your project's actual schema.

How It Works

1. Click the AI button (turns violet)
2. Type a description like "show me errors from the billing service in the last hour"
3. Press Enter or click Generate
4. The AI generates a GQL query, validates it, and switches back to GQL mode
5. Review the generated query, edit if needed, and it auto-executes

Explorer Examples

"show me errors from the last hour"
→ severity:error last:1h

"top 10 error messages today"
→ severity:error | count by message | top 10 | last:24h

"error trend over time for this week"
→ severity:error | count | timeseries 1h | last:7d

"how many unique users signed up this week"
→ from:events event_name:signup | count_distinct(distinct_id) | last:7d

"average response time by endpoint"
→ | avg(duration_ms) by endpoint | top 10 | last:24h

"API success rate"
→ from:events event_name:api_call | count(success:true) as successful, count as total | last:30d

Alert Examples

When creating alerts, the AI generates GQL with alert condition syntax (over:WINDOW OP THRESHOLD):

"alert if more than 100 errors in 30 minutes"
→ severity:error | count | over:30m > 100

"notify when fatal errors happen"
→ severity:fatal | count | over:5m > 0

"alert if payment failures exceed 10 per hour"
→ message:~"payment failed" | count | over:1h > 10

"warn if average response time goes above 2 seconds"
→ | avg(duration_ms) | over:10m > 2000

"alert if no events for 10 minutes"
→ from:events | count | over:10m < 1

Schema-Aware

The AI knows your project's actual schema — discovered field names, types, event names, and example values. This means it generates queries using your real fields, not generic ones.

AI Chat (Debugging Assistant)

The AI Chat is a conversational debugging assistant that can search your logs and events, run aggregations, and analyze patterns. Access it from the AI page in the sidebar.

Capabilities

• gql — run GQL queries against your data
• get_schema — discover available fields and event names
• get_alerts — check active alert rules and their status
• get_project_info — get project details

Example Conversations

You: "What's causing the error spike in the last hour?"
AI: [runs get_schema → gql to find errors → analyzes patterns]
→ "Found 847 errors in the last hour. 73% are timeout errors from the
   payment-service endpoint /api/v2/charge. The spike started at 14:32 UTC."

You: "Show me the top error messages"
AI: [runs gql: severity:error | count by message | top 10 | last:1h]
→ Shows table of error messages with counts

You: "What's the P95 latency for the checkout endpoint?"
AI: [runs gql: endpoint:checkout | p95(duration_ms) | last:24h]
→ "P95 latency for /checkout is 1,247ms over the last 24 hours"

Export

Export search results as CSV or JSON. Click the download button in the results header.

Charts

Aggregate results show interactive charts (area, line, bar, pie, scatter) above the data table. Toggle between chart and table views using the icons in the results header.