One ingest endpoint for everything
Send logs over HTTPS from any language, agent, or forwarder. Structured JSON or raw text, both accepted without extra configuration.
Log Management
Search every log
Search every log
from one endpoint.
Ingest application, server and infrastructure logs through one endpoint, then full-text search, filter by any field and live-tail a stream, without leaving the platform.
Free tier included
No credit card
2-minute setup
One pipeline from every source.
A single HTTPS endpoint accepts logs from any language or framework. Structured fields are indexed immediately, so by the time you open the explorer a search that covers days of history does not scan raw text to answer.
Full-text and field search
Search the full message body or filter precisely on any structured field with =, !=, >, and CONTAINS operators in one query.
Live tail, zero refresh
Open a live stream in the explorer and new log lines appear in real time. No polling, no manual refresh, no context lost when you scroll.
Faceted filtering
Sidebar facets surface top values for every indexed field so you can narrow millions of events to the relevant handful in just a few clicks.
Pattern analysis over a search
Group the matches of any query into recurring patterns to see which messages dominate a spike, rather than scrolling through thousands of near-identical lines. This is analysis you run, not an alert that fires: alerting on a log query does not exist yet, and the FAQ below says so plainly.
Retention set by your plan
3 days on the free tier, 15 or 30 days on a telemetry bundle. The window is stamped on every line as it is written and applies to your whole account, so an upgrade takes effect immediately and nothing you already paid to keep is deleted early.
Search at scale
Millions of events,
Millions of events,
one fast query.
Every structured field is indexed at ingest time, so queries never scan raw text line-by-line. Full-text search across hundreds of millions of events completes in off the index rather than off the raw body, whatever time range you choose.
- Field-level indexing at ingest, not at query time
- Combine full-text search with structured field filters in one query
- Results ordered by time, newest first, with infinite scroll
payment-service · prod StreamingLIVE
MATCHED12,448
INDEXED FIELDS9
TIME RANGElast 24h
checkout7,210
refund2,904
webhook1,538
timeout521ms
error275ms
Query like a database
Logs you can actually
Logs you can actually
ask questions of.
The log query language feels like SQL. Aggregate event counts over time, group by any field, compute error rates, and pull the results into a dashboard, all from the same query box.
- COUNT, GROUP BY, and time-bucket aggregations built in
- Save and pin queries as dashboard widgets
- Cluster a result set into recurring message patterns in one call
log querySELECT level, COUNT(*) AS events
FROM logs
WHERE service = 'payment-service'
AND timestamp >= NOW() - INTERVAL '1 hour'
GROUP BY level
ORDER BY events DESC;
-- 5 rows
FROM logs
WHERE service = 'payment-service'
AND timestamp >= NOW() - INTERVAL '1 hour'
GROUP BY level
ORDER BY events DESC;
-- 5 rows
3d
log retention on the free tier; 15 or 30 days on paid plans
30d
longest retention window we sell today
0
agents required: send logs over plain HTTPS
$0
free tier, no credit card needed to start
FAQ
POST JSON or plain-text lines to your ingest HTTPS endpoint. Official libraries are available for Node.js, Python, Go, and Ruby. Any log forwarder (Fluent Bit, Vector, Logstash) works with the same endpoint.
Structured fields are indexed at ingest time, so a query that filters on them is answered from the index rather than by scanning raw text. Full-text body search does read the body and is slower. We do not publish a query-time figure, because nothing in the product measures one and we would be quoting a number we made up.
Not today. There is no log-based alert rule, no query threshold and no scheduled query, so nothing fires from a log search. An earlier version of this page said you could set a count threshold and route the result to Slack, a webhook, email or your on-call schedule, and that was wrong. What exists is pattern analysis you run yourself over a search, and alerting on uptime, cron, TLS, DNS and browser checks, which does route to all of those destinations.
3 days on the free tier, 15 days on the 50 GB bundle, and 30 days on the 200 GB and 1 TB bundles. 30 days is the longest window we sell today. Retention applies to your whole account rather than per log source, and the same window covers logs, metrics and traces. The window is stamped on each line when it is written, so upgrading lengthens what you keep from that moment and downgrading never shortens what is already stored.
Yes. The query language lets you mix a full-text expression with structured-field predicates in one query. For example, all ERROR-level events from a specific service that contain a particular customer ID.
Related features
Start free. No credit card.
Uptime, cron, synthetic, logs, RUM, incidents, and status pages. Free tier on every product.