Guide
Analyze
Analyze pivots your logs, spans or one metric without a query. You choose what to group by (dimensions) and what to calculate (measures), and Logthread builds the table, with a bar, line or area view. Everyone in the workspace can use it, including viewers. When you need a query, use the SQL console or the query language.
A worked example: which endpoints are slow and failing?#
You suspect one service is failing more than the others. Here is how to see it in four minutes.
- Open Analyze, choose the Spans tab and set the time range to the last hour.
- Under Rows, add Service and Operation. Each pair becomes a row.
- Under Measures, add Count, Error rate (%), duration p95 and Apdex. Apdex uses a 500 ms threshold unless you change it.
- Under Sort and limits, sort by Error rate (%), descending.
- Read the table. The rows at the top are the endpoints that fail most. Tick Heat map to shade the cells.
- Click a cell and choose Open in Traces to see those spans, or Filter to this value to narrow the pivot to that service.
- Choose Add to dashboard (member role or higher) to keep it, or Save to reopen it later.
The same steps work for logs: on the Logs tab filter with a search such as service:gateway, group Rows by Service and Severity, and measure Count and Error rate (%). For a latency figure from a field in your logs, choose p95 and name the field, for example attr.latency_ms.
Open Analyze#
Open Analyze. Pick a signal tab in the builder: Logs, Spans or Metrics, and a time range of up to 7 days.
| Builder section | What it does |
|---|---|
| Filter | A search (same syntax as Explore) for logs and spans, optional parse stages, or a metric picker for metrics |
| Rows | Up to 3 dimensions to group by |
| Columns | One dimension to spread across the top |
| Time bucket | Adds a time axis; it cannot be combined with a column. At most 500 buckets: a fixed bucket that would need more is rejected |
| Measures | Up to 5 values per group |
| Sort and limits | Sort by a measure or the row key; up to 200 rows and 20 columns |
Limits at a glance#
| Limit | Value |
|---|---|
| Row dimensions | 3 |
| Column dimension | 1 |
| Measures | 5 |
| Rows | 200 |
| Columns | 20 |
| Time buckets | 500 |
| Time range | 7 days |
| Values in a filter list | 50 |
| Rows drawn as chart series | 20 |
Values beyond your row and column limits are grouped into "Other". Totals are worked out from the rows themselves, not added up from cells, so percentiles, distinct counts and rates stay exact.
Dimensions#
Dimensions include service, severity, trace id and pattern for logs; service, operation, kind, status, HTTP method, HTTP status code, database system and trace id for spans; labels for metrics. You can also type any attribute name, such as attr.http.route. Trace id, span id and pattern have very many values, so group by them sparingly: only the top values are kept and the rest fall into "Other".
Measures#
| Signal | Measures |
|---|---|
| Logs | Count, Count distinct, Average, Sum, Minimum, Maximum, p50, p95, p99 (these need a field such as attr.latency_ms), Error rate (%) |
| Spans | Count, Errors, Error rate (%), duration p50, p95, p99, average and maximum, Apdex, Rate (per second) |
| Metrics | Default for the metric, avg, min, max, sum, last, rate, increase, p50, p90, p95, p99 |
A bucket with no data counts as 0 for counts, errors, rates, increases and distinct counts, and stays empty for the others. Metric values use the same maths as the Metrics page, per label group.
For ranges longer than an hour the ranked rows appear first and the cells fill in when the complete pivot arrives (a thin progress line shows it).
Tick Subtotals for the outer row dimensions for subtotals (needs 2 or more row dimensions). Heat map shades the table cells.
Work with the results#
- Switch between Table, Bar, Line and Area; Line and Area need a time bucket.
- Click a cell for Open in Explore (Traces for spans, Metrics for metrics), Filter to this value, Exclude this value or Group by.
- Save keeps the pivot and its time range (private or shared). Saved reopens or deletes one.
- Export CSV downloads the table.
- Add to dashboard adds the pivot as a panel (member role or higher). Its query is edited in Analyze.
Next: put the view you trust on a dashboard.