1. Docs
  2. Investigate
  3. Explore Events

Explore Events

Events are the raw underlying data of query results. Events can be individual spans within a trace or individual log messages.

Access Events 

To access the underlying events of a query, click on any single point in time in the query result graph, and then choose View events from the context menu.

Tip
Don’t worry! Even though you selected a single event, you will still be able to page through all of the other events belonging to the query.

View Events 

Honeycomb’s Explore Data tab shows you:

  • An Events view, which contains all of the raw data from your current query, ignoring both the query’s aggregates and any GROUP BY or ORDER BY fields. Your data starts with the most recent events that occurred from the timestamp of the point you selected. At any time, you can choose to display your data either as a table view or as a log lines display, which is optimized for scanning across logs.
  • A Fields list, which shows you all of the fields that contain data for your query. If you don’t see a field in your dataset in this list, that means that the spans in your query do not contain data for that field.

Events View 

The Events view contains all of the raw data from your current query, ignoring both the query’s aggregates and any GROUP BY or ORDER BY fields.

Tip
You can change the display of your data either to a table view or to a log lines display, which is optimized for scanning across logs.
Query Builder with Explore Data tab selected and table display

When your data is displayed in a table:

  • Each row represents an event, along with the values associated with the fields from your dataset.
  • Each column represents a selected field from your dataset. You can customize your events display to add or remove columns.

    • An additional Event column displays all of the other field names and their corresponding values, with syntax highlighting:

      • Blue: Field name
      • Orange: String value
      • Green: Number value
      • Dark pink: Boolean value

      You can interact with the fields contained within the column to modify the query.

Tip
Customize your table to select visible fields and change the display formatting for the Event column.
Query Builder with Explore Data tab selected and log lines display

When your data is displayed as log lines:

  • Each line represents an event, along with the values associated with the fields from your dataset.

    • Expanding a line displays all of the other field names and their corresponding values, with syntax highlighting:

      • Blue: Field name
      • Orange: String value
      • Green: Number value
      • Dark pink: Boolean value

      You can interact with the fields contained within the log line to modify the query.

  • Where applicable, events are color-coded to match their corresponding standard severity level:
    • Red: error
    • Yellow: warn
    • Light blue: info
    • Dark blue: debug
    • Light gray: unspecified
    • Dark gray: No severity set
Note
Color-coding relies on a source field being mapped to the Logs: Severity dataset field when you map your data. In addition, if you are using non-standard severities, use Derived Columns to parse your severity values into Honeycomb standard severity values.
Tip
Customize your events display to select visible fields and change the display formatting.

Fields Panel 

To the left of the Events view, you will see the Fields panel, which shows you all of the fields that contain data for your query.

The Fields panel contains the following lists:

  • Displayed fields: Selected fields that display in the Events view.
  • Fields: Remaining fields that contain data for your query. You can add any of these fields to your Events view.
    • Fields contains an additional Δ Time field. Add this field to your Events view to include the time difference between the current event and the previous event.
Tip
If you don’t see a field in your dataset in the Fields list, that means the spans in your query do not contain data for that field.
Fields list display with three selected fields in the displayed fields section.

To save space in the Fields list, only a subset of the fields are immediately shown. You can use the search box to search for a particular field by name. To expand the list, scroll to the bottom of the list of fields, and select Load More.

Change Data Display 

At any time, you can choose to view your data as either an events table or as a log lines display, which is optimized for scanning across logs.

  1. In the Events view, locate the Table and Log Lines icons in the upper left.
  2. Select each icon to display data as a log lines display or as an events table.

The data display reflects your selection.

Customize Events Display 

To make the events display work for you, you can control which fields are visible in the Events view and customize the display of the fields.

Add Fields to the Events View 

Tip
Did you know that we provide a field that displays the time difference between events? Add the Δ Time field from the Fields panel.

To add a field to the Events view:

  1. In the Fields list, locate the field you want to add to the events view.
  2. Select the plus sign icon to the right of the desired field.

The Events view will update and display the selected field.

  1. In the Events view, locate the Event column.
  2. In the Event column, select the field name of the field with which you want to interact.
  3. Select Add column to table from the context menu. If you don’t see the Add column to table option, the field is already a column in your table.

The Events view will update, and a new column representing the selected field will appear in the table.

  1. In the Events view, expand a log line to view additional fields.
  2. Select the field name of the field with which you want to interact.
  3. Select Add field to line from the context menu. If you don’t see the Add field to line option, the field is already a field in your log line.

The Events view will update, and the selected field will appear in the log lines.

Display Time Difference Between Events in the Events View 

Honeycomb provide a field called Δ Time that displays the time difference between events. To add the Δ Time field to the Events view:

  1. In the Fields list, locate the Δ Time field.
  2. Select the plus sign icon to its right.

The Events view will update and display the Δ Time field.

Remove Fields from the Events View 

  1. In the Displayed Fields list, locate the field you want to remove from the events view.
  2. Select the X icon to the right of the desired field.

The Events view will update and will no longer display the removed field.

  1. In the Events view, locate the Event column.
  2. In the Event column, select the field name of the field with which you want to interact.
  3. Select Remove column from table from the context menu. If you don’t see the Remove column from table option, the field is already not a column in your table.

The Events view will update, and the selected column will no longer appear in the table.

  1. In the Events view, select the field that you want to remove from the log line.
  2. Select Remove field from line from the context menu.

The Events view will update, and the selected field will no longer appear in the log lines.

Reorder Fields in the Events View 

  1. In the Displayed Fields list, locate the field that you want to reorder in the events view.
  2. Select the drag icon next to the field, and drag to rearrange the fields.

Your selected order will appear in the Events view display.

  1. In the Events table, locate the Event column.
  2. In the Event column, select the field name of the field that you want to reorder.
  3. Select the drag icon next to the field name, and drag to rearrange the columns in the table.
  1. In a log line, select the field that you want to reorder.
  2. Drag to rearrange the fields in the log lines.

Customize Display Formatting 

To customize the display formatting:

  1. In the Events view, locate and select the Settings (gear) icon.
  2. Select the toggle that targets the behavior you want to customize:
    • Format event column: For the table display, display all fields in a single, pipe-delimited line (off) or one field per line (on).
    • Automatically highlight: Display field names in black (off) or orange (on).
Event Actions menu with the Format data option deselected and the Automatically highlight fields option selected.

The Events view will update, and you will see your selected changes.

Resize Columns in the Table Display 

To resize columns in the Events table:

  1. Locate the column to resize.
  2. In the target column’s header, hover over its right border.
  3. Drag to modify the width of the column.

Customize Paging for the Table Display 

To customize paging for the Events table:

  1. Locate the # of rows dropdown above the Events table.
  2. Select the number of rows you would like to show per page.

The Events table will update, and you will see the number of rows you selected on each page.

Page Through Events in the Table Display 

To page through the data in the Events table:

  1. Locate the arrow buttons above the table.
  2. Select the appropriate button:
    • >: Move to the next page.
    • <: Move to the previous page.
Load more rows button at bottom of table

View Tracing Details from the Table Display 

If your dataset is a tracing dataset, then the trace.trace_id column displays trace ID fields as hyperlinks.

  1. Locate the event for which you would like to view a trace.
  2. Locate the trace.trace_id column.
    Important
    If you can’t find your trace.trace_id column, make sure you have added the column to your Events table.
  3. Select the hyperlinked trace ID.

You will be redirected to the trace waterfall view, which will contain the span represented by your selected row.

Tracing link example

To learn more about interacting with traces, visit Explore Traces: Interact with Traces.

Modify the Query 

You can modify your query from inside the Events view.

If your data is displaying in a table, the Event column contains a list of fields and their values for the event, each of which you can interact with to modify the query or customize the table display.

  1. In the Events view, locate the Event column.

  2. In the Event column, select the field name of the field with which you want to interact.

  3. Select the action you want to take from the context menu:

    • Add column to table: Adds the field to the columns displayed in the Events table.
    • Remove column from table: Removes the field from the columns displayed in the Events table.
    • Copy field name: Copies the field name to your local clipboard.
    • Copy value: Copies the value to your local clipboard.
    • Show only where field exists: Adds a WHERE clause to filter by <field> exists, then re-runs the query.
    • Show only where field does not exist: Adds a WHERE clause to filter by <field> does-not-exist, then re-runs the query.
    • Show only where field is value: Adds a WHERE clause to filter by <field> = <value>, then re-runs the query.
    • Show only where field is not value: Adds a WHERE clause to filter by <field> != <value>, then re-runs the query.
    • Group by field: Adds a GROUP BY clause to group by <field>, then re-runs the query.
Tip

If you don’t see the Add column to table option, the field is already a column in your table.

If you don’t see the Remove column from table option, the field is already not a column in your table.

If your data is displaying as log lines, each expanded line contains a list of fields and their values for the event, each of which you can interact with to modify the query or customize the log lines display.

  1. In the Events view, expand a log line.

  2. In the expanded log line, select the name of the field with which you want to interact.

  3. Select the action you want to take from the context menu:

    • Add field to line: Adds the field to the fields displayed in the log lines.
    • Remove field from line: Removes the field from the fields displayed in the log lines.
    • Copy field name: Copies the field name to your local clipboard.
    • Copy value: Copies the value to your local clipboard.
    • Show only where field exists: Adds a WHERE clause to filter by <field> exists, then re-runs the query.
    • Show only where field does not exist: Adds a WHERE clause to filter by <field> does-not-exist, then re-runs the query.
    • Show only where field is value: Adds a WHERE clause to filter by <field> = <value>, then re-runs the query.
    • Show only where field is not value: Adds a WHERE clause to filter by <field> != <value>, then re-runs the query.
    • Group by field: Adds a GROUP BY clause to group by <field>, then re-runs the query.
Tip

If you don’t see the Add field to line option, the field is already a field in your log lines.

If you don’t see the Remove field from line option, the field is already not a field in your log lines.

Download Your Data 

To download your data:

  1. In the Events view, locate and select the Download (downward arrow) icon.
  2. Choose the file format you would like to download or export, from the menu:
    • CSV: Download Events data in comma-separated values format in a .csv text file.
    • JSON Download Events data in JSON format in a .json text file.
Note
You can download a maximum of 1000 rows.
On this page: