Early access is open. Free plan during early access. Start free
Logthread
Sign in Start free Open app

Guide

Get the full value from Logthread

Sending logs is the first ten minutes. The value comes from what you set up after. This page is the path most teams follow, in the order that pays off fastest. Each step takes a few minutes, ends with something you can check, and links to the page that explains it. Do them in order, or jump to the one you need.

Home in the app helps you along the way: it lists setups that are saved but not finished, such as an alert that tells no one or a pipeline that no route uses, with the one action that finishes each.

1. Send data#

Create a workspace and an ingest key, then send logs, traces or metrics.

  1. Create a workspace and an ingest key: Getting started.
  2. Pick how to send: Send data covers OpenTelemetry, JSON lines, syslog, Fluent Forward and Fluent Bit. For a database, a web server or a cloud service, Integrations gives one command per product. For servers, install the Logthread Agent. For a cluster and your apps in it, see Kubernetes.
  3. Add traces and metrics with OpenTelemetry.

You are done when Connect a source reports the first record, and Explore shows your service.

2. Explore your logs#

Find the problem, then follow it.

  1. Search and filter in Explore and live tail. Save the searches you repeat.
  2. Learn the query language: filters, parsing, stats and charts in seven steps.
  3. Follow one id across services with Threads, and link logs to traces with Correlate logs and traces.
  4. Look at Metrics and traces and the service map.

You are done when you can go from an error line to its trace and its neighbours in two clicks.

3. Get alerted, with a channel#

An alert rule with no channel opens an incident that nobody sees. Do both.

  1. Add a delivery channel under Alerts → Channels: email, Slack, Teams, PagerDuty or a webhook. Use Send test.
  2. Create a rule from the search you already trust: in Explore, choose Create alert. Read the backtest on the Preview step, then choose your channel. See Alerts.
  3. Add an absence rule for services that must never go quiet.
  4. Mark releases on your charts with annotations, from CI if you can.

You are done when a test notification reaches your channel and the rule's incident shows it.

4. Build a dashboard from a query#

  1. In Explore, run a stats query such as service:api | stats count() by bin(ts, auto), severity, then choose Add to dashboard. The same button exists on Metrics, Traces, Analyze and the SQL console.
  2. Start from a template if one fits: Dashboards.
  3. For a question that needs a join or a custom calculation, use the SQL console, KQL or Analyze.

You are done when the dashboard opens with data for the last hour and you have shared it with the workspace.

5. Shape your data with pipelines and redaction#

  1. Turn on Redact secrets in every route on the Pipelines page, so keys, tokens, cards and emails never reach storage. See Pipelines and parsing.
  2. Parse your own formats into fields: Parse logs at ingest.
  3. Drop and sample the noise you never look at. Cost control shows how to find it and what each limit does.

You are done when Usage → By service shows no service that is mostly noise.

6. Bring your team, and sign-in#

  1. Invite people and set roles: Team, usage and billing.
  2. On a Growth or Enterprise plan, connect your identity provider with Single sign-on, and group roles and SCIM so access follows your directory.
  3. Manage many collectors from one place with Fleet.

You are done when a teammate signs in with their work account and lands in the right role.

7. Connect AI: MCP and Pari#

  1. Give an AI agent your logs, traces and metrics with an API key: AI agents (MCP). A read key can change nothing. Add a setup scope only for what you want the agent to build.
  2. Ask Pari, the assistant in the app, to write a query, draft a dashboard or find the right page. She never sees your logs.

You are done when an agent answers a question about your own workspace.

Keep going#

Start with Getting started.