> ## Documentation Index
> Fetch the complete documentation index at: https://evalgate.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Explore the logs

> Filter thousands of traces down to the one that matters.

# Explore the logs

The Logs explorer (`/logs`) is where you investigate production behavior. It does
not copy your trace payloads — every row is derived from the authoritative trace,
span, model-call, cost, and score records.

## Step 1 — Start with a bounded query

Open `/logs`. The query bar accepts one clause per field, joined by `AND`. Start
narrow:

```text theme={null}
status = failed AND environment = production AND provider = openai
```

<img src="https://mintcdn.com/evalgate/c7l4ztAi8W3wgmvV/help/images/explore-logs-query.png?fit=max&auto=format&n=c7l4ztAi8W3wgmvV&q=85&s=55c1921ea71425fd7f128048b49ac315" alt="A screenshot of the logs explorer with a bounded query entered." width="2400" height="1500" data-path="help/images/explore-logs-query.png" />

Common fields you will use:

| Field         | Example                               |
| ------------- | ------------------------------------- |
| `status`      | `status = failed`                     |
| `environment` | `environment = production`            |
| `provider`    | `provider = openai`                   |
| `model`       | `model in (gpt-4.1, claude-sonnet-4)` |
| `tool_name`   | `tool_name = checkout`                |
| `tool_error`  | `tool_error ~ timeout`                |
| `cost_usd`    | `cost_usd >= 0.05`                    |
| `latency_ms`  | `latency_ms > 2000`                   |
| `text`        | `text ~ "card authorization"`         |

<Note>
  Use free text (`text ~ ...`) **after** structured filters have narrowed the
  result set. Free text first is slow and broad.
</Note>

## Step 2 — Group the results

Use **Group by** to cluster by status, provider, model, failure category, alert
state, or tag. You can compare count, known cost, average duration, p95 model
latency, and average score without leaving the query.

<img src="https://mintcdn.com/evalgate/c7l4ztAi8W3wgmvV/help/images/explore-logs-group.png?fit=max&auto=format&n=c7l4ztAi8W3wgmvV&q=85&s=77aa91913da1310648e48ed92c657ccd" alt="A screenshot of the results grouped by failure category." width="2400" height="1500" data-path="help/images/explore-logs-group.png" />

## Step 3 — Sort and page

Pick one cursor-safe sort (for example, by `created` descending). Pages contain at
most 100 traces; use **Load more** to continue. Detail collections (spans, tools,
scores) continue independently after 100 records.

## Step 4 — Act on what you found

Select traces and:

* **Promote to case** — turn a real failure into a test case.
* **Open in Playground** — reproduce the failure against a prompt variant.
* **Create review task** — hand the trace to a teammate.
* **Create draft monitor** — start a Continuous Eval monitor from this query.
* **Export** — download a bounded, redacted CSV or JSONL file.

## Limits to know

* At most 20 structured filters per query.
* One primary cursor-safe sort.
* Exports stop at 5,000 rows or 5 MiB.
* Raw payload export is a privileged, audited operation.

## Up next

[Inspect a single trace](./inspect-trace) in detail.