Charting Log Levels

If you have logs that contain log levels like INFO, ERROR, and WARN, it can be interesting to visualize them over time. In this scenario, you will be able to:

  • Monitor error rates over time

  • Track warning frequency patterns

  • Compare log severity distribution across services

Visualization: The chart displays a stacked area visualization with colored series representing INFO, ERROR, and WARN log levels. Each series shows the count of log events for that severity level in each time bucket. Hover over any area to see exact event counts and timestamps for each log level. Spikes in ERROR or WARN series indicate potential issues requiring investigation.

Screenshot showing a Time Chart widget displaying a line chart with four separate lines representing log levels (INFO in blue, WARN in orange, ERROR in red, CRITICAL in purple) over approximately one hour, with trend lines overlaid and a histogram at the top showing event distribution, and a Format Time Chart panel on the right showing Type set to Line and Interpolation set to Linear

Figure 253. Charting Log Levels


Sample input data. Here is example input data for this scenario (with the loglevel field extracted by a parser):

@timestamphostloggerloglevelmessageservicethread
1970-01-01T00:00:02app-server-01com.example.service.AuthINFOUser authentication successfulauth-servicekafka-producer-network-thread-1
1970-01-01T00:00:02app-server-02com.example.db.ConnectionPoolWARNConnection timeout occurredpayment-servicetimer-thread-8
1970-01-01T00:00:02app-server-03com.example.api.RequestHandlerINFOProcessing API requestuser-servicehttp-nio-8080-exec-5
1970-01-01T00:00:02app-server-04com.example.cache.RedisClientERRORFailed to acquire database connectionnotification-servicepool-3-thread-2
1970-01-01T00:00:02app-server-05com.example.scheduler.TaskExecutorINFOScheduled task completedanalytics-servicescheduler-thread-4

Query. To create this time chart, use the following query:

logscale
timeChart(loglevel)

Query breakdown:

  1. Use the timeChart() function with the loglevel field as the grouping parameter.

  2. Group events by their loglevel field value to create separate series for each log level (INFO, WARN, ERROR).

  3. By default, the count() function aggregates the number of events in each time bucket.

  4. Each series in the chart represents one log level, showing event frequency over time.

Configuration:

  1. From the Search page, type your query in the Query Editor → click Run

  2. Choose Time Chart in the Widget Selector

  3. Click the style icon : the side panel shows most settings already configured by default based on the query result.

  4. In Plot, configure the chart type based on your visualization needs:

    • For cumulative view: Set Type to Area, Interpolation to Linear, and Stacking to Stack to display cumulative log levels over time

    • For distinct comparison (recommended): Set Type to Line and Interpolation to Linear to display each log level as a separate line, making it easier to identify patterns in ERROR and WARN occurrences

    • Optionally enable Show data points to display individual event markers on the lines

  5. In Legend, configure legend display:

    • Set Position to Bottom or Right based on preference

    • Enable Show title if you want the legend to display a header

  6. In Colors, set Palette to Inherit or choose a custom palette.

  7. In X-axis, optionally enable Show UTC time to display timestamps in UTC timezone.

  8. In Y-axis, configure the vertical axis:

    • Set Title to Event Count

    • Set Scale to Linear

    • Set Format value to Metric for automatic unit formatting

  9. In Series formatting, customize colors for each log level to align with severity conventions:

    • Click on the INFO series and set Color to green

    • Click on the WARN series and set Color to orange

    • Click on the ERROR series and set Color to red

    • Click on the CRITICAL series (if present) and set Color to purple

  10. In Title formatting, set Size to Medium.

You can further customize this widget by setting more properties, see Time Chart Property Reference.

Alternative: You can plot other values by specifying different functions in the function parameter of the timeChart() function. For instance, to visualize average response time by log level, use the avg() function on a time field:

logscale
timeChart(loglevel, function=avg(time))

Similarly, the percentile() function is useful for analyzing response time distributions across log levels, such as tracking 95th percentile response times to identify performance degradation:

logscale
timeChart(loglevel, function=percentile(field=time, percentiles=[95]))