Grafana Logs Drilldown on Grafana Labs

Access or install Grafana Logs Drilldown

Fri, 03 Apr 2026 12:35:46 -0500

Access or install Grafana Logs Drilldown

To use Grafana Logs Drilldown to view your log data, you can either access it in Grafana Cloud or install it in your own Grafana instance.

Give it a try using Grafana Play

With Grafana Play, you can explore and see how it works, learning from practical examples to accelerate your development. This feature can be seen on the Grafana Play site.

Try it

Access in Grafana and Grafana Cloud

Grafana Logs Drilldown is installed by default in both Grafana and Grafana Cloud. To access Grafana Logs Drilldown:

Open your Grafana stack in a web browser.
In the main menu, select Drilldown > Logs.

In Grafana v12 and later, Grafana includes all Drilldown apps by default in the same Drilldown section.

Installation

Logs Drilldown is installed by default in current Grafana releases. If you are upgrading an older installation, you might need to install the plugin manually.

Install via Plugins catalog

For Enterprise and OSS Grafana users, you can install Grafana Logs Drilldown via the Grafana Plugins catalog.

Open https://grafana.com/grafana/plugins/grafana-lokiexplore-app/ in a web browser
Click the Installation tab.
Follow the instructions to install the app.

Enable in Loki configuration

The following Loki and Grafana version and configuration are required:

Grafana v11.6.11 or later
Loki v3.2.0 or later

Note
To get the most recent features, including experimental features, upgrade to Loki 3.5.0 or later.
- Enable pattern ingestion by setting pattern_ingester.enabled to true in your Loki configuration file.
- Enable structured metadata by setting allow_structured_metadata to true within your Loki configuration file.
- Enable the volume endpoint by setting volume_enabled to true within your Loki configuration file.
- Enable log level detection by setting discover_log_levels to true within your Loki configuration file.
  YAML
```
pattern_ingester:
  enabled: true
limits_config:
  allow_structured_metadata: true
  volume_enabled: true
  discover_log_levels: true
```

Install via environment variable

If you want to install the app in a Docker container, you need to configure the following environment variable:

GF_INSTALL_PLUGINS="https://storage.googleapis.com/integration-artifacts/grafana-lokiexplore-app/release/main/any/grafana-lokiexplore-app-main.zip;grafana-lokiexplore-app"

Install using Grafana CLI

You can install Grafana Logs Drilldown in your own Grafana instance using the Grafana CLI. For more information, refer to the Grafana CLI documentation.

Run the following command:

grafana cli plugins install --pluginUrl=https://storage.googleapis.com/integration-artifacts/grafana-lokiexplore-app/release/main/any/grafana-lokiexplore-app-main.zip grafana-lokiexplore-app

Test with Docker Compose

You can test the app using the following command to spin up Grafana, Loki, and the Grafana Logs Drilldown App:

curl -L https://github.com/grafana/explore-logs/raw/main/scripts/run.sh | sh

This will download the run.sh file and execute it.

That shell file will download some configuration files into your /tmp/explore-logs directory and start the Docker containers via docker compose from there.

Once the Docker container has started, navigate to http://localhost:3000/a/grafana-lokiexplore-app/explore to access Grafana Logs Drilldown.

Having trouble?

Refer to the troubleshooting guide for tips on how to solve common issues.

What next?

Before you can use Grafana Logs Drilldown, an administrator must configure a Loki data source in order to access your logs in Grafana Logs Drilldown. Refer to the Loki data source documentation for instructions.

After installing, you can customize default settings such as time range, data source, and display fields. Refer to Configure Logs Drilldown for details.

Get started with Grafana Logs Drilldown

Fri, 03 Apr 2026 12:35:46 -0500

Get started with Grafana Logs Drilldown

The best way to see what Grafana Logs Drilldown can do for you is to use it to explore your own log data. If you have a Grafana Cloud account, you can access Grafana Logs Drilldown by selecting Drilldown > Logs, or you can install Grafana Logs Drilldown in your own Grafana instance.

Guided tour

While you are browsing your log data in Grafana Logs Drilldown, watch for any unexpected spikes in your logs. Or perhaps one of your services is down and has stopped logging. Maybe you’re seeing an increase in errors after a recent release.

To take a tour of Grafana Logs Drilldown, follow these steps:

Open your Grafana stack in a web browser.
From the Grafana main menu, select Drilldown > Logs. This opens the Overview page showing time series and log visualizations for all services in your selected Loki instance. (No services?)
If you have multiple Loki data sources, you can change your Data source from the menu in the top toolbar. Logs Drilldown only supports Loki data sources.
Select a recent time range. You can modify your time range in two ways:
- With the standard time range picker on the top right.
- By clicking and dragging the time range on any time series visualization.
Services are shown based on log volume. You can use the service search field to find a service by name.
If you want to view services by label instead of by service name, click (+) Add label and either select a label from the menu or search for a label.

Tip
Administrators can configure default fields to display in log visualizations. Refer to Configure Logs Drilldown for details.
To explore logs for a service, click Show logs on the service panel. Grafana opens the service details page on the Logs tab.
On the Logs tab, you can:
- Use the log controls (which can be expanded using the expand/collapse button on the right) to adjust sort order, filter by string or level, change display options, and more. For details, refer to View logs.
- Click individual log lines to view detailed information including fields and links in the Log Details panel.
- Scroll to the bottom to load more log entries with infinite scroll.
- Use line wrapping controls to adapt the log display for easier reading, choosing between disabled, enabled, and enabled with JSON formatting.
On the service details page, click the Labels tab to see visualizations of log volume for each label. (No labels?)
On the Labels tab, to select a label to see the log volume for each value of that label, click the Select button. Grafana Logs Drilldown shows you the volume of logs with specific labels and fields. Refer to Labels and Fields.
Select the Fields tab to see visualizations of log volume for each field. To drill down into details the same way as labels, click Select for a field.
Click the Patterns tab to see log volume for each automatically detected pattern. Log patterns let you work with groups of similar log lines. You can hide log patterns that are noisy, or focus only on the patterns that are most useful. Refer to Log Patterns.
Click the Logs tab. Click the menu icon (three vertical dots) on either panel and select Explore. Grafana displays the Explore page, with a query based on the selections you made in Logs Drilldown.

Further resources

Watch: How to Use the Logs Drilldown App for Grafana
Watch: All About Logs Drilldown for Grafana Loki (Loki Community Call October 2024)

View logs

Fri, 03 Apr 2026 12:35:46 -0500

View logs

The logs visualization in Grafana Logs Drilldown displays log lines from your Loki data source with filtering options and controls to customize how data is displayed.

Log controls

The controls component provides options to interact with and customize the log list. You can jump to the top or bottom, change sort order, filter by string or level, use deduplication, and choose display options such as timestamp format or color highlighting.

From top to bottom, the log controls include:

Expand/collapse controls: Show or hide the full controls toolbar.
Scroll to the bottom: Jump to the last log line in the view.
Sort direction: Toggle between ascending (oldest logs first) or descending (newest logs first) order.
Client-side string search: Click to open or close client-side string search for displayed results.
Deduplication: Hide duplicate log lines using a few different deduplication algorithms.
- None: Disables deduplication.
- Exact: Matches on the whole line except for date fields.
- Numbers: Matches after stripping out numbers such as durations, IP addresses, and so on.
- Signature: The most aggressive deduplication as it strips all letters and numbers and matches on the remaining whitespace and punctuation.
Filter logs by log level: Filter logs by level, such as All levels, Info, Warn, and Error.
Set timestamp format: Hide timestamps, show millisecond timestamps, or show nanosecond timestamps.
Line wrapping control:
- Disabled: Log lines are truncated.
- Enabled: Log lines wrap to multiple lines.
- Enabled with JSON formatting: Pretty-prints JSON log lines.
Logs highlighting: Toggle between plain text and color highlighting.
Font size control: Toggle between small (default) and large font.
Unescape newlines: Displayed when logs contain escaped new lines. Click to render escaped new lines as new lines.
Download logs: Download in plain text (txt), JavaScript Object Notation (JSON), or Comma-separated values (CSV) format.
Scroll to the top: Jump to the first log line in the view.

Note
When you are in JSON view, these controls are not available: client-side string search, deduplication, filter by log level, timestamp format, font size control, and download logs. JSON view includes additional toggles for showing structured metadata and labels.

Log Details

The Log details component is displayed when you click a log line. It shows additional information from that log line in collapsible sections, including fields (usually key-value pairs) and links (derived fields, correlations, and more).

Fields

Within the Log details view, you have the ability to filter the displayed fields in two ways:

Positive filter: Focuses on a specific field
Negative filter: Excludes certain fields

These filters modify the corresponding query that generated the log line, incorporating equality and inequality expressions accordingly.

For supported data sources like Loki and Elasticsearch, log details will verify whether the field is already included in the current query, indicating an active state for positive filters. This enables you to toggle it off from the query or convert the filter expression from positive to negative as necessary.

Click the eye icon to select a subset of fields to visualize in the logs list instead of the complete log line.

Each field has a stats icon, which displays ad-hoc statistics in relation to all displayed logs.

For data sources that support log types, such as Loki, instead of a single view containing all fields, different groups of fields will be displayed grouping them by their type: Indexed Labels, Structured Metadata, and Parsed fields.

Links

Grafana provides data links or correlations, allowing you to convert any part of a log message into an internal or external link. These links enable you to navigate to related data or external resources, offering a seamless and convenient way to explore additional information.

Log details modes

There are two modes available to view log details:

Inline log details display the log details below the log line within the log list.
Sidebar log details display the log details in a panel to the side of the log list.

No matter which display mode you are currently viewing, you can change it by clicking the mode control icon.

Highlighting

The logs visualization implements a predefined set of rules to apply subtle colors to the log lines, to help with readability and help with identifying important information faster. This is an optional feature that can be disabled in the controls or in the panel options.

Log Context

Log context is a feature that displays additional lines of context surrounding a log entry that matches a specific search query. This helps in understanding the context of the log entry and is similar to the -C parameter in the grep command.

If you’re using Loki for your logs, to modify your log context queries, use the Loki log context query editor at the top. You can activate this editor by clicking on the log context query preview. Within it, you have the option to modify your search by removing one or more label filters from the log stream. If your original query used a parser, you can refine your search by leveraging extracted label filters.

Change the Context time window option to look for logs within a specific time interval around your log line.

Infinite scroll

When you reach the bottom of the list of logs, if you continue scrolling and the displayed logs are within the selected time interval, you can request to load more logs. When the sort order is “newest first” you will receive older logs, and when the sort order is “oldest first” you will get newer logs.

Labels and fields

Fri, 03 Apr 2026 12:35:46 -0500

Labels and fields

Grafana Logs Drilldown visualizes log volume for labels attached to your log lines, and for fields automatically extracted from each log line.

Note
The type of data being expressed in a label or field may require different treatments. For example, fields expressing bytes are visualized differently than other types of data. Share your feedback if you have suggestions for how to improve this experience.

Grafana Logs Drilldown adds a special detected_level label to all log lines where Loki assigns a level of the log line, including debug, info, warn, error, fatal, critical, trace, or unknown if no level could be determined.

Label visualizations are helpful for:

Spotting unexpected spikes in log volume.
Noticing dips or outages in your services.
Understanding the distribution of log lines across your labels.
Identifying labels that might be useful for filtering or grouping your logs.

You can click the Select button on a Label or Field graph to access a breakdown of its values, seeing the log volumes visualized along the way. This can be useful for understanding the traits of your system, and for spotting spikes or other changes.

Click individual log lines to view the Log Details panel which displays fields and labels with filtering options. For more information about Log Details, refer to View logs.

Labels tab user interface overview

Let’s take a closer look at what you can do on the Labels tab.

The top navigation bar is common across the Grafana interface. The next section is common across all the Logs Drilldown pages.

Labels tab user interface:

Label filter: Lets you search for or select label names from the menu.
Grid / Rows: Lets you select how labels are displayed.
Select or Include button: Click to access a breakdown of the label’s values, seeing the log volumes visualized along the way.
Menu (three dots): Click to navigate to Grafana Explore.

Filtering logs by label

To explore labels with your own data, follow these steps:

From the Grafana main menu, select Drilldown > Logs.
Click Show logs for the service you want to explore.
Click the Labels tab on the service details page.
Browse the labels detected for this service.
Look for an interesting label and click the Select button.

You will see a selection of visualizations showing the volume of each label.

To remove the filter, select All from the Label search menu or click the x next to the selection in the Filter fields at the top of the page.

Fields tab user interface overview

Let’s take a closer look at what you can do on the Fields tab.

The top navigation bar is common across the Grafana interface. The next section is common across all the Logs Drilldown pages.

Fields tab user interface:

Field filter: Lets you search for or select field names from the menu.
Grid / Rows: Lets you select how fields are displayed.
Volume / Names: Lets you toggle between showing field volume graphs and showing field names only.
Include or Add to filter button: Lets you filter log results by a specific field value. The button label varies depending on the field type.
Select button (value breakdown): Click to access a breakdown of the field’s values, seeing the log volumes visualized along the way.
Menu (three dots): Click to navigate to Grafana Explore.

Filtering logs by field

To explore fields with your own data, follow these steps:

From the Grafana main menu, select Drilldown > Logs.
Click Show logs for the service you want to explore.
Click the Fields tab on the service details page.
Browse the fields detected for this service.
Look for an interesting field and click the Select button.

To remove the filter, select All from the Field search menu or click the x next to the selection in the Filter fields at the top of the page.

What next?

Learn how Log patterns can help you work with different types of log lines in bulk.

Log patterns

Fri, 03 Apr 2026 12:35:46 -0500

Log patterns

Log patterns let you work with groups of similar log lines. You can hide log patterns that are noisy, or focus only on the patterns that are most useful.

Loki automatically extracts patterns when your logs are ingested. Patterns are ephemeral and are only mined from the previous three hours of your logs.

The Grafana Logs Drilldown app shows you the patterns alongside their log volumes. From this view, you can investigate spikes and include or exclude specific log lines from your view.

Patterns can change over time as your logging evolves. To see patterns on the Patterns tab, you must have the pattern ingester enabled in your Loki configuration file. If you don’t see any patterns, refer to Troubleshooting.

Pattern extraction

Loki extracts patterns from a stream of log lines.

For example, if your service logs lines like this:

duration=255ms trace_id=abc001 GET /path/to/endpoint/2
user loaded: 25666
user loaded: 14544
duration=255ms trace_id=abc002 POST /path/to/endpoint/2
user loaded: 25666
duration=355ms trace_id=abc003 GET /path/to/endpoint/1
duration=355ms trace_id=abc004 POST /path/to/endpoint/1
duration=255ms trace_id=abc005 POST /path/to/endpoint/2
user loaded: 89255
duration=4244ms trace_id=abc006 GET /path/to/endpoint/1
user loaded: 25666
duration=255ms trace_id=abc007 GET /path/to/endpoint/2

Two patterns would emerge where the static tokens are preserved literally, and dynamic values are turned into placeholders:

Pattern 1: duration=<_> trace_id=<_> <_> /path/to/endpoint/<_>

Pattern 2: user loaded: <_>

Note
Since Loki 3.0, you can make queries using this simplified pattern match filter operator which is much faster than using regex.

Pattern use cases

Using log patterns you can:

Browse the log volume over time of different types of logs.
Simplify log management by grouping similar log entries.
Enhance log searches by focusing on relevant patterns.
Improve troubleshooting efficiency by highlighting critical log lines.
Reduce storage requirements by minimizing log data.
Filter out noisy log lines during exploration.
Identify specific log lines for targeted analysis.

Patterns tab user interface overview

Let’s take a closer look at what you can do on the Patterns tab.

The top navigation bar is common across the Grafana interface. The next section is common across all the Logs Drilldown pages.

Patterns tab user interface:

Search patterns field: Lets you search for text that appears in patterns, for example HTTP methods or response codes.
>: Expand or collapse a pattern row to view log lines with that pattern.
Patterns graph: The graph shows you the patterns alongside their log volumes.
Include and Exclude buttons: Lets you include or exclude the log pattern from the log view.

When you expand a pattern row to view log lines with that pattern, each row has a menu with the following options:

Show/Hide log details: Select from the menu for the individual log line to view the log line, index labels, parsed fields, and structured metadata. For more information, refer to View logs.
Show context: Select from the menu to view the log line in the context of the logs that occurred before and after that specific log.
Copy log line: Select from the menu to copy individual log lines to the clipboard.

The patterns table includes infinite scroll. Scroll to the bottom of the list to load more results.

Guided tour of log patterns

You can follow these steps to perform some common use cases using your own instance or Grafana Play.

Browse log volumes by type

Grafana Logs Drilldown proactively visualizes your log volume data per detected pattern, broken down in various ways. At a glance you can immediately spot spikes or other changes.

For example, if your HTTP service is suffering from a DDoS attack, the relevant graphs will clearly show the spikes. From here you can drill down to discover enough details about the attack to counter it.

Target your analysis

If you know the kind of log line you’re looking for, log patterns are an easy way to remove unwanted log lines from the view.

To view only a specific set of patterns, perform the following steps:

From the Grafana main menu, select Drilldown > Logs.
Click Show logs for the relevant service.
On the service details page, click the Patterns tab.
Identify a pattern that matches the type of logs you’re interested in viewing.
Click the Include button for the pattern.
Return to the Logs tab and note the view only shows log lines that match your selected pattern.

You can repeat steps 4 and 5 to include multiple patterns.

Hide noisy log lines

To hide noisy log lines, perform the following steps:

From the Grafana main menu, select Drilldown > Logs.
Click Show logs for the relevant service.
On the service details page, click the Patterns tab.
Identify a pattern that represents noise in the logs that you want to remove.
Click the Exclude button to exclude that pattern.
Return to the Logs tab and notice the noisy pattern has been removed.

You can repeat steps 4 and 5 to exclude multiple patterns.

Logs Drilldown JSON viewer

Fri, 03 Apr 2026 12:35:46 -0500

Logs Drilldown JSON viewer

You can easily view and interact with your JSON formatted logs using the Logs Drilldown JSON viewer. This view will help you read your JSON style logs, and filter through them to make your related visualizations more relevant and focused.

Note
To use this feature, you must be running Loki 3.5.0 or later.

Viewing JSON logs

To interact with the JSON view, select Show logs for your service in Logs Drilldown.

On the Logs tab, select the JSON radio button in the panel header (next to Logs and Table) to switch to the JSON viewer. Your logs are displayed in a structured, collapsible tree view, enabling you to browse, expand, and collapse JSON fields.

The Line wrapping control in the log controls panel also offers an Enabled with JSON formatting option. This pretty-prints JSON within the standard Logs view but does not open the dedicated JSON viewer. For more information about line wrapping, refer to View logs.

Filtering log lines with the JSON view

You can include and exclude specific log data from your visualizations by clicking on individual log lines to open the Log Details panel. Within Log Details, you can:

Click the Include/Exclude (plus/minus) icons next to fields to add them to your filter.
Click the eye icon to select specific fields to display in the logs list.
View field statistics by clicking the stats icon.

For example: Given a set of logs from an API request service, you can click on a log line, then select the Exclude button next to the method field with value “GET”. This will result in the Log Volume visualization showing only requests of other method types (DELETE/PATCH/POST/PUT).

To include filtered log data again, remove the excluded data from the Fields filter above the Log Volume visualization.

Supported JSON log types

Log lines entirely formatted as JSON are supported.

Log lines with only certain fields or metadata structured as JSON are not currently supported.

Sorting and ordering

Fri, 03 Apr 2026 12:35:46 -0500

Sorting and ordering

By default, graphs are sorted by most relevant, which prioritizes graphs with more volatile data or higher volume. For example, graphs with the most spikes or dips appear first.

Some pages in Grafana Logs Drilldown can display a large number of graphs. You may want to sort the graphs differently, depending on what you’re looking for.

Sorting log lines

When viewing log lines, you can use the Sort direction control in the log controls panel to change the display order:

Newest logs first (descending): Shows the most recent log lines at the top.
Oldest logs first (ascending): Shows the oldest log lines at the top.

The log controls can be accessed by clicking the expand/collapse button on the right side of the logs panel. For more information about log controls, refer to View logs.

When using infinite scroll to load more results, the sort direction determines which logs are loaded next:

Newest logs first: Scrolling to the bottom loads older logs.
Oldest logs first: Scrolling to the bottom loads newer logs.

Sorting visualizations

After selecting a specific label or field, you can sort graphs. Depending on the page and visualization, several sort options can be available.

Some pages let you modify sort order directly from table or panel sort controls. For example, on the Patterns tab, you can sort by clicking the Count or % column headers. On the Labels and Fields tabs, a Sort by dropdown appears after you select a specific label or field.

Sort by option	Description
Most relevant	Sorts graphs based on the most significant spikes in data.
Outlying values	Sorts graphs by the amount of outlying values in the data.
Widest spread	Sorts graphs by deviation from the average value.
Name	Sorts graphs alphabetically by name.
Count	Sorts graphs by total number of logs.
Highest spike	Sorts graphs by the highest values (max).
Lowest dip	Sorts graphs by the smallest values (min).
Percentiles	Sorts graphs by supported percentiles (`p10`, `p25`, `p75`, `p90`, `p99`).

Note
We are keen to improve this feature. Contact us if there is something that would help you find the signal in the noise.

Troubleshooting Grafana Logs Drilldown

Fri, 03 Apr 2026 12:35:46 -0500

Troubleshooting

This page addresses common issues when getting started and using Grafana Logs Drilldown.

Grafana Explore Logs is installed by default in Grafana versions v11.3.0 through v11.5.

Grafana Logs Drilldown is installed by default in Grafana versions v11.6.11 and later.

In Grafana v12 and later, the Drilldown menu includes all Drilldown apps by default.

For more information about the name change for this feature, see this blog post.

If you do not see Logs Drilldown under either name, then check to make sure you have the Grafana Logs Drilldown plugin installed and configured.

Note
Your instance needs internet connection in order to download the Logs Drilldown plugin. If you are working in an offline environment, you can download the Logs Drilldown plugin separately and add it to your Grafana /plugins repository.

Ensure Loki is properly configured

To use Grafana Logs Drilldown, you need to have Loki properly configured. You can find full instructions in Access or install Grafana Logs Drilldown.

Service selection errors

This section covers errors on the service selection page.

There are no services

If everything is presented as an unknown_service when you access Grafana Logs Drilldown, you can try the following fixes:

Ensure the Volume API is enabled by setting the volume_enabled configuration value in Loki. Enabled by default in Loki 3.1 and later.
Specify the label to use to identify services by setting the discover_service_name configuration value in Loki.

No logs found in [label]

This message appears when the selected label has no log volume data for the current time range.

Try the following fixes:

Expand your time range to find when logs were last recorded for this label.
Select a different label or service that has active log data.
Verify that logs are being ingested for this label by checking your log collection pipeline.

Log volume has not been configured

This error indicates that Loki’s volume API is not enabled, which Logs Drilldown requires to display service volumes.

To fix this, enable volume in your Loki configuration:

limits_config:
  volume_enabled: true

Refer to the Loki configuration documentation for more details.

No service matched your search

This message appears when searching for services on the service selection page and no results match your search term.

Try the following fixes:

Check your search term for typos.
Try a partial match or different search term.
Clear the search to see all available services.

There are no detected levels

If you do not see detected_level values in Grafana Logs Drilldown, you can try the following fixes:

Ensure level detection is enabled by setting the discover_log_levels configuration value. Enabled by default in Loki 3.1 and later.

Label and field errors

This section covers errors related to labels and fields in Logs Drilldown.

There are no labels

If you do not see any labels in Grafana Logs Drilldown, you can try the following fixes:

Ensure your collector is properly configured to attach them.

To learn more about Labels, refer to the Loki labels documentation.

No labels selected

This message appears when you haven’t selected any labels to filter your logs. Logs Drilldown requires at least one label filter to display results.

To fix this:

Select a service or other primary label from the service selection page.
If you removed all labels, click the Reset filters button to restore the default selection.

Invalid labels selected

This error occurs when your label filters are in an invalid state, typically when all remaining filters use negative matching (not equal, not regex match).

Try the following fixes:

Ensure you have at least one label filter with positive (inclusive) matching.
Click the Reset filters button to restore a valid label selection.
Add a new label filter that includes (rather than excludes) logs.

The labels are not available at this moment

This warning appears when Logs Drilldown temporarily cannot fetch label information from Loki.

Try the following fixes:

Wait a moment and refresh the page.
Try selecting a different time range.
Check your Loki data source connection in Grafana’s data source settings.

No labels/fields match these filters

This message appears when your current filters don’t match any available labels or fields.

Try the following fixes:

Clear your current filters using the Clear filters button.
Broaden your time range.
Check that your label filter values are correct and exist in your log data.

We did not find any fields for the given time range

This message indicates that no detected fields (structured metadata or parsed fields) were found for your current selection and time range.

Try the following fixes:

Expand your time range to include more log data.
Verify that your logs contain structured data (JSON, logfmt, or other parsable formats).
Check that structured metadata is enabled in your Loki configuration by setting allow_structured_metadata: true.

Default fields tab not appearing

If the Default fields tab does not appear in the Logs Drilldown plugin settings, or if it displays an unsupported message, check the following:

Ensure you are running Grafana 12.4 or later. Default fields requires this minimum version.
Verify that the kubernetesLogsDrilldown feature flag is enabled in your Grafana configuration.
Confirm that you have the Org Admin role in your organization.

For more information about configuring Default fields, refer to Configure Logs Drilldown.

There are no color levels

Color coding for log severity levels is a setting in Loki. You must have discover_log_levels: true in your Loki configuration file.

Query and results errors

This section covers common error messages you may encounter when querying logs.

No logs match your search

If you see the message “No logs match your search. Please review your filters or try a different time range.” it means your current combination of filters and time range returns no results.

Try the following fixes:

Expand the time range to include a larger window of logs.
Review your label filters and remove any that may be too restrictive.
Check your line filter (search text) for typos or overly specific patterns.
If you have active pattern filters (include or exclude), try clearing them to see if logs appear.

Tip
You can click the Clear filters button that appears with the error message to reset all filters and start fresh.

Logs could not be retrieved due to invalid filter parameters

This error occurs when the query contains invalid syntax, typically from a malformed regular expression in a line filter.

Try the following fixes:

Check your line filter for invalid regex syntax. Loki uses RE2 syntax for regular expressions.
If you’re using special characters like (, ), [, ], {, }, ., *, +, ?, ^, $, |, or \, ensure they are properly escaped.
Toggle off the regex mode in the line filter if you’re searching for literal text.

The response is too large to process

This error appears when Loki returns more data than it can handle in a single response.

Try the following fixes:

Narrow your time range to reduce the amount of data returned.
Add more specific label filters to target a smaller subset of logs.
Use a line filter to search for specific text, which reduces the response size.
If you’re an administrator, consider adjusting the max_recv_msg_size in your Loki server configuration.

Max entries limit per query exceeded

This error means your query is trying to return more log lines than the configured limit allows. Loki has a default limit on the number of log entries that can be returned in a single query.

Try the following fixes:

Reduce the Line limit setting in the Logs Drilldown interface. You can find this option next to the line filter on the Logs tab.
Narrow your time range to return fewer results.
Add more specific filters to reduce the number of matching logs.
If you’re an administrator and need higher limits, adjust the max_entries_limit_per_query in your Loki configuration.

Max series limit exceeded

If you see “Max series limit exceeded” when viewing a field breakdown, it means the query returned more unique label value combinations than Loki allows.

Try the following fixes:

Reduce the time range to lower the number of unique series.
Add additional filters to narrow down the results before viewing the field breakdown.
Choose a different field with fewer unique values to break down.
If you’re an administrator, you can increase the max_query_series limit in your Loki configuration, though be aware this may impact query performance.

Tip
Fields with high cardinality (many unique values) like trace_id, request_id, or timestamps are more likely to hit this limit. Consider filtering by other labels first before exploring high-cardinality fields.

Showing partial results

If you see “Showing partial results for [field]” it means the query encountered an error but was still able to return some data. This commonly happens with timeout errors on large queries.

Try the following fixes:

Narrow your time range to make the query faster.
Add more filters to reduce the amount of data being processed.
If timeouts persist, contact your administrator to check Loki query timeout settings.

Pattern errors

This section covers error messages related to the Patterns feature.

There are no pattern matches

Pattern matching has not been configured.

Ensure pattern extraction is enabled by setting pattern_ingester.enabled=true in your Loki config. Learn about other necessary config.
Ensure the volume endpoint is enabled by setting volume_enabled=true within your Loki configuration file.

Note
The Patterns feature does not support multi-tenant or cross-stack data sources.

If you see a message in the UI on the Patterns tab that says “An error occurred within the plugin.” or receive an error message HTTP 500 with the message multiple org IDs present you have two options to work around the issue:

Use a single-stack Loki data source to restore Patterns.
Disable log patterns to continue using the other Logs Drilldown features with your multi-tenant or cross-stack data source. Go to Administration > Plugins and data > Plugins > Grafana Logs Drilldown and select the Disable patterns check box. This will disable use of the Patterns API and hide the Patterns tab in the user interface.

Sorry, we could not detect any patterns

This message appears when Loki’s pattern ingester is enabled but no patterns were extracted from your logs. This is rare but can happen with certain log formats.

Try the following fixes:

Check back later as patterns are continuously extracted from incoming logs.
Verify that your logs have enough volume for pattern detection to work effectively.
If the issue persists, reach out in the Grafana Labs community Slack channel or open an issue on GitHub.

Patterns are only available for the most recent 3 hours of data

Patterns in Loki are ephemeral and only stored for the most recent three hours. And patterns can change over time as your logging evolves. If your selected time range is entirely older than three hours ago, you won’t see any patterns.

To view patterns:

Adjust your time range to include some portion of the last three hours.
Use the time picker to select a more recent time window.

This pattern returns no logs

This error appears when viewing a pattern’s sample logs and the pattern query fails to return results. This can happen if the pattern was detected from logs that have since aged out or been deleted.

No action is typically needed. Try selecting a different pattern or adjusting your time range.

The logs returned by this pattern do not match the current query filters

This warning appears when you have active filters that exclude the logs matching the selected pattern. The pattern exists in your overall log data, but your current filters prevent those logs from appearing.

Try the following fixes:

Click the Clear filters button to remove conflicting filters.
Review your current label and line filters to understand why they exclude this pattern.
Adjust your filters to include the logs you want to see.

JSON panel issues

This section covers issues specific to the JSON visualization panel.

JSON filtering requires Loki 3.5.0

If you see “JSON filtering requires Loki 3.5.0. This view will be read only until Loki is upgraded to 3.5.0” it means your Loki instance doesn’t support the JSON filtering feature.

The JSON panel will still display your logs, but you won’t be able to filter by clicking on JSON field values.

To enable filtering:

Upgrade your Loki instance to version 3.5.0 or later.
Alternatively, switch to the Logs or Table visualization where filtering works with all Loki versions.

No JSON fields detected

This message appears when viewing the JSON panel but your log lines aren’t in JSON format.

This is informational rather than an error. If your logs aren’t JSON formatted:

Switch to the Logs or Table view for a better experience.
The JSON view is optimized for JSON-formatted log lines and may not display other formats correctly.

I cannot find something

Please open an issue on GitHub or get in touch privately and let us know what’s not working for you.

If you have something urgent, please get in touch via support. Grafana Cloud users can open a support ticket here.

Grafana Logs Drilldown on Grafana Labs

Access or install Grafana Logs Drilldown

Access or install Grafana Logs Drilldown

Access in Grafana and Grafana Cloud

Installation

Install via Plugins catalog

Enable in Loki configuration

Install via environment variable

Install using Grafana CLI

Test with Docker Compose

Having trouble?

What next?

Get started with Grafana Logs Drilldown

Get started with Grafana Logs Drilldown

Guided tour

Further resources

View logs

View logs

Log controls

Log Details

Fields

Links

Log details modes

Highlighting

Log Context

Infinite scroll

Labels and fields

Labels and fields

Labels tab user interface overview

Filtering logs by label

Fields tab user interface overview

Filtering logs by field

What next?

Log patterns

Log patterns

Pattern extraction

Pattern use cases

Patterns tab user interface overview

Guided tour of log patterns

Browse log volumes by type

Target your analysis

Hide noisy log lines

Logs Drilldown JSON viewer

Logs Drilldown JSON viewer

Viewing JSON logs

Filtering log lines with the JSON view

Supported JSON log types

Sorting and ordering

Sorting and ordering

Sorting log lines

Sorting visualizations

Troubleshooting Grafana Logs Drilldown

Troubleshooting

Can’t see Logs Drilldown in the menu

Ensure Loki is properly configured

Service selection errors

There are no services

No logs found in [label]

Log volume has not been configured

No service matched your search

There are no detected levels

Label and field errors

There are no labels

No labels selected

Invalid labels selected

The labels are not available at this moment

No labels/fields match these filters

We did not find any fields for the given time range

Default fields tab not appearing

There are no color levels

Query and results errors

No logs match your search

Logs could not be retrieved due to invalid filter parameters

The response is too large to process

Max entries limit per query exceeded

Max series limit exceeded

Showing partial results

Pattern errors

There are no pattern matches

Sorry, we could not detect any patterns