Skip to content

docs(investigate): add Explore logs (Logs Drilldown) page - #385

Merged
ps48 merged 5 commits into
opensearch-project:mainfrom
ps48:docs/explore-logs
Aug 3, 2026
Merged

docs(investigate): add Explore logs (Logs Drilldown) page#385
ps48 merged 5 commits into
opensearch-project:mainfrom
ps48:docs/explore-logs

Conversation

@ps48

@ps48 ps48 commented Aug 3, 2026

Copy link
Copy Markdown
Member

Description

Adds a dedicated Explore logs documentation page under Investigate → Discover and cross-links to it from Discover Logs.

Explore logs (also called the Logs Drilldown) is an onboarding canvas for the Logs experience. It lets a user browse the log data a cluster holds — with a live severity histogram and a preview of the latest raw log lines for each index and dataset — before writing a query, and turn one or more raw indexes into a queryable dataset in a few clicks. This addresses the Logs cold-start problem: "what logs do I have, are they flowing right now, and how do I start?"

The new page covers:

  • Prerequisites — the explore.enabled and explore.logsDrilldown.enabled flags (both off by default), an observability workspace, a registered data source under Multiple Data Sources, and the PPL dependency for previews.
  • Opening Explore logs — reached from the Explore logs action in the Logs query bar (and the Logs empty state).
  • The canvas and Reading a card — the toolbar, the Datasets/Indexes card stack, the severity histogram, log-line preview, time-field control, and index-health pill, plus a table of card states (Full / No recent data / No documents yet / No time field / Couldn't load preview).
  • Selecting the time range, Creating a dataset from indexes (the smart wildcard proposal + the Create dataset wizard), and Querying an existing dataset.
  • Data requirements — the time-field and severity fields the feature detects.

The Discover Logs page gets a short :::tip + canvas image pointing users who don't yet have a dataset to Explore logs.

Screenshots were captured from a local OpenSearch Dashboards build with the feature enabled and live data. The Starlight link validator passes (npm run build).

Issues Resolved

Relates to opensearch-project/OpenSearch-Dashboards#12395 (RFC)
Relates to opensearch-project/OpenSearch-Dashboards#12407 (implementation)

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.

Add a dedicated Explore logs page documenting the onboarding canvas that
lets users browse a cluster's indexes and datasets — with a live severity
histogram and raw log-line preview per card — and turn raw indexes into a
queryable dataset before writing any PPL.

Also cross-link to it from Discover Logs for users who don't yet have a
dataset.

Screenshots captured from a local OpenSearch Dashboards build with the
feature enabled.

Relates to opensearch-project/OpenSearch-Dashboards#12395
Relates to opensearch-project/OpenSearch-Dashboards#12407

Signed-off-by: Shenoy Pratik Gurudatt <sgguruda@amazon.com>
@codecov

codecov Bot commented Aug 3, 2026

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 55.62%. Comparing base (fa26d87) to head (380adc1).

Additional details and impacted files
@@           Coverage Diff           @@
##             main     #385   +/-   ##
=======================================
  Coverage   55.62%   55.62%           
=======================================
  Files           4        4           
  Lines         169      169           
  Branches       48       47    -1     
=======================================
  Hits           94       94           
  Misses         74       74           
  Partials        1        1           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

ps48 added 2 commits August 3, 2026 15:15
- Correct the entry-point description: Explore logs is reachable from the
  Logs navigation popover, the Logs query bar, and the Logs empty state
  (it is not limited to the query bar).
- Move Explore logs before Discover Logs in the sidebar (order 20, between
  Datasets and Discover Logs).
- Replace em dashes with house-style punctuation to match sibling pages.

Signed-off-by: Shenoy Pratik Gurudatt <sgguruda@amazon.com>
Remove the PPL preview note and the local-cluster aside from the
Prerequisites section.

Signed-off-by: Shenoy Pratik Gurudatt <sgguruda@amazon.com>
Comment thread docs/starlight-docs/src/content/docs/investigate/explore-logs.md Outdated
ps48 and others added 2 commits August 3, 2026 16:09
Explore and the Logs Drilldown are enabled by default in the
observability stack, so the config-flag prerequisite no longer applies.

Signed-off-by: Shenoy Pratik Gurudatt <sgguruda@amazon.com>
Co-authored-by: Joshua Li <joshuali925@gmail.com>
Signed-off-by: Shenoy Pratik <sgguruda@amazon.com>
@ps48
ps48 merged commit b93a0b7 into opensearch-project:main Aug 3, 2026
8 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants