[role="xpack"]
[[xpack-logs-using]]
== Using the Logs app
Use the Logs app in {kib} to explore and filter your logs in real time.

You can customize the output to focus on the data you want to see and to control how you see it.
You can also view related application traces or uptime information where available.

[role="screenshot"]
image::logs/images/logs-console.png[Logs Console in Kibana]
// ++ Update this

[float]
[[logs-search]]
=== Use the power of search

Use the search bar to perform ad hoc searches for specific text.
You can also create structured queries using {kibana-ref}/kuery-query.html[Kibana Query Language].
For example, enter `host.hostname : "host1"` to see only the information for `host1`.
// ++ this isn't quite the same as the corresponding infrastructure description now.

[float]
[[logs-configure-source]]
=== Configure the data to use for your logs
Are you using a custom index pattern to store the log entries?
Do you want to limit the entries shown or change the fields displayed in the columns?
If so, <<xpack-logs-configuring, configure the logs source data>> to change the index pattern and other settings.

[float]
[[logs-time]]
=== Specify the time and date

Click the time selector image:logs/images/logs-time-selector.png[time selector icon] to choose the timeframe for the logs.
Log entries for the time you specify appear in the middle of the page, with the earlier entries above and the later entries below.

To quickly jump to a nearby point in time, click the minimap timeline to the right.
// ++ what's this thing called? It's minimap in the UI. Would timeline be better?

[float]
[[logs-customize]]
=== Customize your view
Click *Customize* to customize the view.
Here, you can set the scale to use for the minimap timeline, choose whether to wrap long lines, and choose your preferred text size.

[float]
[[logs-stream]]
=== Stream or pause logs
Click *Stream live* to start streaming live log data, or click *Stop streaming* to focus on historical data.

[role="screenshot"]
image::logs/images/logs-usage-start-streaming.png[Logs start streaming]

[role="screenshot"]
image::logs/images/logs-usage-stop-streaming.png[Logs stop streaming]

When you are viewing historical data, you can scroll back through the entries as far as there is data available.

When you are streaming live data, the most recent log appears at the bottom of the page.
In live streaming mode, you are not able to choose a different time in the time selector or use the minimap timeline.
To do either of these things, you need to stop live streaming first.
// ++ Not sure whether this is correct or not. And what about just scrolling through the display?
// ++ There may be a bug here, (I managed to get future logs) see https://github.com/elastic/kibana/issues/43361

[float]
[[logs-highlight]]
=== Highlight a phrase in the logs stream
To highlight a word or phrase in the logs stream, click *Highlights* and enter your search phrase.
// ++ Is search case sensitive?
// ++ Can you search for multiple phrases together, if so, what's the separator?
// ++ What about special characters? For example, I notice that when searching for "Mozilla/4.0" which appears as written in my logs, "Mozilla" is highlighted, as is "4.0" but "/" isn't. The string "-" (which appears in the logs as written, quotes and all, isn't found at all. Any significance?

[float]
[[logs-event-inspector]]
=== Inspect a log event
To inspect a log event, hover over it, then click the *View details* icon image:logs/images/logs-view-event.png[View event icon] beside the event.
This opens the *Log event document details* fly-out that shows the fields associated with the log event.

To quickly filter the logs stream by one of the field values shown here, click the *View event with filter* icon image:logs/images/logs-view-event-with-filter.png[View event icon] beside the field.
This automatically adds a search filter to the logs stream to filter the entries by this field and value.

In the log event details, click *Actions* to see the other actions related to the event.
Depending on the event and the features you have installed and configured, you may also be able to:

* Select *View monitor status* to <<uptime-overview, view related uptime information>> in the *Uptime* app.
// ++ Is "monitor" the best choice of word here?
* Select *View in APM* to <<traces, view related APM traces>> in the *APM* app.
