Skip to main content
Open Log Search from the main navigation, or use the Log Search button on the Log Ingest overview.

​
Explore and query

  1. Find a table in the tables sidebar.
  2. Expand it to inspect its columns and types.
  3. Insert a starter query from the table, then adjust the fields and filters.
  4. Select Run and inspect the results or query error.
Cotool Logs uses ClickHouse SQL. Use the actual table and column names shown in your workspace. Include a time filter when investigating a specific period, and use SQL LIMIT to keep exploratory results manageable. An empty result is not proof that the activity did not happen. Verify that the relevant stream is enabled, that ingestion has reached the event time, and that your filters match the source’s schema. See Monitor Log Ingestion.

​
Reuse a query

History lets you return to queries run in your browser. This history is stored locally in the browser; it is not a shared query library. Use the share-link control to copy a link containing the query text. Review the SQL before sharing it, especially if you included sensitive values. The link shares the query, not a frozen copy of the results.

​
Move from investigation to detection

Once you understand the relevant events and fields, use the Detections Platform to build repeatable logic. Include the data source, time window, suspicious condition, and known benign exceptions when describing the detection you want. Back to Cotool Log Ingest