Data Visualization

LogScale displays log data in real-time visualizations. You can create custom dashboards and widgets to organize these visualizations.

LogScale allows you to visualize and organize log data in real-time.

You can customize your data visualization by selecting from multiple display layouts to best represent your data. These visualizations update dynamically as queries run.

The main components of LogScale visualization are dashboards and widgets:

  • A dashboard is a collection of multiple visualization elements (widgets) to organize and display query results in a single, unified view. It serves as an interactive interface that provides real-time monitoring and analysis of log data, which can be shared across teams and organizations for collaborative use.

    For more information, see Dashboards.

  • A widget is an individual visualization tool that lives within a dashboard and displays specific query results in various formats such as charts, tables, or diagrams. Widgets act as the essential building blocks that transform raw data into meaningful visual representations. Widgets are highly customizable as they can be configured, resized, and arranged to create comprehensive dashboard layouts.

    For more information, see Widgets.

Why Use Data Visualization?

Data visualization transforms raw log data into insights that humans can quickly understand and act on. While query results in table format show exact details, visualizations reveal patterns, trends, and anomalies that would remain hidden in rows of data.

Benefits of Visualizing Data

Visualizing data provides several benefits:

  • Faster pattern recognition. Human brains process visual information faster than text. A time chart immediately shows when a spike occurred, a bar chart instantly reveals which category dominates, and a world map shows geographic distribution at a glance.

  • Real-time monitoring. Dashboards provide continuous visibility into system health, security events, and business metrics. Teams can monitor critical KPIs and respond to issues as they happen, not after they escalate.

  • Simplified communication. Visual dashboards communicate complex information to stakeholders who do not need to understand query syntax. Executives can view KPIs, managers can track team metrics, and analysts can share findings.

  • Anomaly detection. Visual trends make unusual patterns obvious. A sudden drop in traffic, an unexpected spike in errors, or geographic concentration of attacks stand out visually when they would be just numbers in a table.

  • Comparative analysis. Multiple time series on one chart, side-by-side bar comparisons, or before-and-after views let you compare data dimensions simultaneously. Proportions in pie charts show relative scale that numbers alone cannot convey.

  • Saved and shared context. Once you create a dashboard, it captures both the query logic and the visual presentation. Teams can share dashboards, ensuring everyone views the same metrics the same way, reducing inconsistency and misinterpretation.

When to Use Dashboards versus Tables

Dashboards and visualizations are powerful, but not every situation requires them. Understanding when to use dashboards versus raw query results helps you work efficiently.

Use dashboards and widgets when:

  • You need to monitor metrics over time or track ongoing activity.

  • You want to spot trends, patterns, or anomalies quickly.

  • You need to communicate findings to stakeholders who are not familiar with query syntax.

  • You want to save and share a specific view of data for consistent reporting.

  • You need to combine multiple metrics or query results into one unified view.

  • You are building operational monitoring screens for teams (security operations centers, incident response, SRE monitoring).

Use table results when:

  • You are exploring data and do not yet know what visualization fits.

  • You need exact field values for detailed investigation (specific timestamps, IP addresses, log messages).

  • You are performing one-time ad-hoc analysis that does not need to be saved or repeated.

  • You want to export raw data for external processing or reporting.

For details about the Event list and Table results display options, see Display Results and Events.

Use the Widget Selector on the Search page to switch between table and visualization views (see Choose Visualization). Start with tables to explore your data, then create visualizations once you know the story you want to tell. Save visualizations as widgets on dashboards for repeated use.