The log and query tables of Observability share one toolbar: the Period control, the search box, column filters, a rows-per-page selector and an export control. This page explains how they behave, so the same habits work across the Logs sub-tabs, Query Management and the rest of the section. The windows behind Custom are on Date and period pickers.
Change the period
Every table starts on Last 7d.
Find Period next to the search box in the toolbar.
Click Today, Last 7d, Last 30d or Custom. A custom range opens a small window to pick the start and end; see Date and period pickers.
After you apply a custom range, the Custom tab shows it in short form, such as Sep 3, Sep 3, 14:00 - 16:00, Sep 3 - Sep 4 or Sep 3, 14:00 - Sep 4, 16:00.
A custom range can cover at most one year.
Each table remembers its own Period in this browser. A saved range from an older version may open as Today; anything unrecognised falls back to Last 7d.
Search, filter and sort a table
Type in the search box. The whole table is searched, and matching text is highlighted in the rows. Spaces at the start or end of your term are ignored.
To clear the search, click the clear icon in the box; the box keeps focus so you can type a new term.
To filter a column, open the filter in its header and tick the values you want. Your selections move to the top of the list. To clear the filter, click Reset inside it.
A filter list holds up to 1,000 different values, and an empty value shows as (Empty).
Lists follow your other filters and the period: change one filter, then reopen another list to see the narrower set. Your own selections stay in the list.
Date values show short dates; sizes, counts and durations are grouped into ranges such as 128 MB+ or 1.5s - 30s.
Date lists attach to each table's time columns: Date & Time in the PII, socket and SSO logs; Query Start Time, First Seen and Last Seen in the query log; and Started At and Finished At in the table DDL log.
Selecting a day in a date filter matches the whole day, in your local time. Day lists narrow to months when the range spans more than a year.
A column the server has no values for shows an empty list; that is not an error. A list that fails to load shows Filter options failed, and your other filters keep working.
Lists are cached for about 30 seconds, so a reopened list can be a moment old.
Click a column header to sort. To sort by several columns, click the first header, then hold a modifier key while clicking each further header; a number beside each sorted column shows its priority.
Rows per page
Each of these tables starts with 50 rows a page.
Table
Rows per page
PII, socket, SSO and table DDL logs
50, 100, 200
Query Management, including its insight views
50, 100, 500
ClickHouse > Storage
50, 100, 500, 1,000
Changing the period, sorting, filtering or searching returns you to the first page, so the result starts from the top again.
Open a row's details
Click a row to open its details on the right: the row stays highlighted, and clicking it again closes the panel. The panel takes about a third of the table's width; drag its edge to adjust. A row that carries nothing to show does not open.
Tables load when you open them and when you change the period, filters or search; they do not reload on their own.
Click the refresh button in the toolbar for the latest rows. Its tooltip reads Refresh data.
While a reload is under way, the rows you had stay on screen, and the row count updates when the load finishes.
A failed reload shows Refresh failed and leaves the rows in place.
Opening a ClickHouse view fetches it again each time, so its figures are fresh when you look.
Note
A failed first load replaces the table with an alert that names it and gives the reason, with a Retry button. Once a table has loaded, a failed reload instead shows a slim bar above the rows with the reason and Retry, so your search, filters and rows stay where they are.
Export rows to a file
Set the Period, filters, sorting and search you want; the export takes them as they are.
In the export control in the toolbar, pick CSV, Excel, JSON or TSV.
Click the download icon next to it. Its tooltip reads Download as and the format.
When a table holds more rows than the page shows, the download first offers a choice: Export N rows for the rows on screen, or Export all M rows for every row that matches. An export holds up to 300,000 rows; to cover more, narrow the Period or add filters, and export in parts.
In an Excel export the sheet is named Data, and a cell longer than 32,767 characters is cut short: it ends with … [truncated, <N> chars], where <N> is the length the cell held.
The export control appears only when your role holds the export permission for that table; each log has its own. See Observability for the permissions.
The name gets the extension of the format you picked, for example pii_logs_2026-10-16.xlsx.
Limits and edge cases
A custom period can cover at most one year.
A column filter shows up to 1,000 different values.
Running queries loads up to 10,000 rows; its search, sorting and column filters then work on the rows it loaded.
Questions, answered
Why does the table jump back to the first page?
Changing the period, sorting, a filter or the search returns you to the first page, so the new result starts from the top. Page forward again if you need more.
How do I sort by more than one column at once?
Click the first column header, then hold a modifier key while clicking each further header. A number beside each sorted column shows the order in which the sorts apply.
Why does a filter list change after I set another filter?
Each list is built from the rows your other filters and the period select, so it narrows when you filter elsewhere. Your selected values stay in the list, and options are cached for about 30 seconds, so a reopened list may be a moment old.
Why does the table keep showing old rows while it loads?
Reloading keeps the rows you had on screen until the new ones arrive, and the row count updates when the load finishes. The table never blanks while you work, and your search stays usable.
Why do I see an error bar instead of the error page?
Once a table has loaded, a later failed load shows a slim bar above the rows with the reason and a Retry button, and leaves your rows, search and filters in place. Only a failed first load replaces the table, with an alert that names it. See Observability troubleshooting for the messages.
Does the export include rows beyond the page I can see?
Yes. When the table holds more rows than the page shows, the download first offers a choice: the rows on screen, or all rows that match. Choose all rows to export every match for your period, filters, sorting and search, up to 300,000 rows. To cover more, narrow the period or add filters, and export in parts.
What does Observability remember between visits?
Each table remembers its own Period, and your column layout is kept in this browser. The choices do not follow you to another browser or device.
My value is not in a filter list. Why?
A list shows up to 1,000 different values, and only those your other filters and period select. Widen the period or clear another filter, then reopen the list.
Why do some columns have no filter?
Some columns cannot be filtered, such as the query text in the query log, and some cannot be sorted, such as the Labels column in PII detection logs. A column that cannot be filtered simply has no filter control.
Why does a long cell in my Excel export end with a truncation note?
An Excel cell cannot hold more than 32,767 characters, so the export cuts the value short and ends it with … [truncated, <N> chars], where <N> is the number of characters the cell held before cutting. CSV, JSON and TSV exports are not cut this way.