Monitoring
Search and filters
Every monitoring tab narrows the same way: build a filter visually, or type a query. Both produce the same result, and the query bar is what you'll reach for once you know the fields.
Two ways to filter
Pick a field, an operator, and a value. It only offers operators that make sense for the field's type, so you can't write something invalid.
Type an expression directly. Faster once you know the fields, and it's what you paste into an alert.
Fields you can filter on
| Field | Type | Values |
|---|---|---|
| Level | Choice | debug, info, warning, error, fatal |
| Method | Choice | GET, POST, PUT, PATCH, DELETE, HEAD, OPTIONS |
| Status code | Number | |
| Latency (ms) | Number | |
| Path | Text | |
| Operation | Text | |
| Message | Text | |
| Request ID | Text | |
| Release | Text | |
| Environment | Text | |
| Host | Text | |
| Deployment | Text | |
| Attempt | Number |
Operators
The builder offers these by field type. The query bar accepts the same ones.
| Field type | Operators |
|---|---|
| Text | =, !=, LIKE, NOT LIKE, IS NULL, IS NOT NULL |
| Number | =, !=, >, >=, <, <=, IS NULL, IS NOT NULL |
| Choice | =, !=, IN, IS NULL, IS NOT NULL |
Combine with AND, OR, NOT and parentheses, and finish with ORDER BY <field> [ASC|DESC] or LIMIT <n>.
Examples
level = 'error' AND statusCode >= 500 ORDER BY timestamp DESCpath LIKE '/v1/checkout%' AND latencyMs > 2000method IN ('POST', 'PATCH') AND release = '9f2c1ab'path LIKE '/v1/%' matches every v1 route. % matches any run of characters, _ matches exactly one.
Time range
Filters narrow what; the range narrows when. Pick a preset (1h, 6h, 24h, 7d, 30d, 90d) or set an explicit window.
Raw events are kept 30 days. Charts past that horizon read hourly rollups, so a 90-day view still renders but you cannot open an individual event inside it.
Attempt is the one people forget
Attempt tells you whether an event was a first try or a retry. A wall of errors that are all attempt > 1 is your SDK's retry policy working, not a new outage.
level = 'error' AND attempt = 1That's the query for real first-time failures, and it is usually a much smaller number.
From a search to an alert
Any query you can run here can back a threshold alert. Get it returning exactly what you'd want to be woken for, then save it as a rule rather than writing it twice.