Top Endpoints by Error Count

Count error-level log events per service and endpoint to rank endpoints by the number of errors they produce. Useful for triaging production incidents by identifying which endpoints are generating the most errors at a glance.

Visualization: the table displays one row per unique service and endpoint combination, with:

  • endpoint column showing the API endpoint path

  • service column showing the service name

  • _count column showing the number of error events, sorted descending and color-shaded by threshold

Screenshot showing a table widget with three columns (endpoint, service, count) sorted by count descending, with threshold-based cell color shading on the count column and Format Table panel visible on the right

Figureย 257.ย Top Endpoints by Error Count


Sample input data:

@timestampendpointerrorhostlevelservice
1970-01-01T00:00:02/api/ordersConnection timeout after 30ssvc-01errorpayment-service
1970-01-01T00:00:02/api/authAuthentication token expiredsvc-02errorauth-service
1970-01-01T00:00:02/api/ordersDatabase query failedsvc-01errorpayment-service
1970-01-01T00:00:02/api/reportsMemory limit exceededsvc-03erroranalytics-service
1970-01-01T00:00:02/api/authRate limit exceededsvc-02errorauth-service

Query:

logscale
level=error
| groupBy([service, endpoint])
| sort(_count, order=desc)

Query breakdown:

  1. Filters events to include only those where the level field equals error.

  2. Groups the filtered events by the unique combination of service and endpoint, counting occurrences in each group as _count.

  3. Sorts the results by _count in descending order so the highest-error services appear at the top of the table.

Configuration:

  1. From the Search page, type your query in the Query Editor โ†’ click Run

  2. Choose Table in the Widget selector

  3. Click the style icon : this opens the Format panel on the side where some properties are already configured by default based on the query result.

  4. Click the field service in the Columns section and set Size โ†’ Fit to data.

  5. Click the field _count in the Columns section and set:

    Cell colors โ†’ Thresholds โ†’ choose a color palette โ†’ +Add threshold: shading intensifies as error counts increase, making the highest-error services immediately visible.

To customize this widget further, see Table Property Reference.