Logs
Every line searchable. Every line connected.
Logs are where investigations start and where they stall — usually because search is slow, context is missing or the interesting line drowned in a million identical ones. TraceLoop fixes all three: sub-second search at petabyte scale, trace context on every line, and automatic pattern clustering.
Live Tail
The log stream, as it happens
Fictional workspace, real interface: live tail with level filters, attribute predicates and trace links on every row.
log stream
service=checkout-platform · level>=debug · live tail · region=eu-west-2
14:32:07.441 INFO [api-gateway] route=POST /v1/checkout status=201 dur=42ms trace=7c1f·9a2b
14:32:07.502 DEBUG [auth-svc] token verified sub=usr_88f21 scope="checkout:write" cache=hit
14:32:07.688 INFO [payments-svc] auth captured txn=pay_5521c amount=[REDACTED:card] psp=stripe
14:32:07.940 WARN [checkout-svc] inventory hold retrying attempt=2/5 sku=LDN-4417 lock_timeout=250ms
14:32:08.115 INFO [kafka-events] produced topic=order.created partition=3 offset=9918422 lag=0
14:32:08.233 ERROR [postgres-01] deadlock detected txn=88412 victim=checkout-svc resolved=rollback trace=7c1f·9a2b
14:32:08.401 INFO [checkout-svc] txn retried txn=88412 status=committed dur=118ms trace=7c1f·9a2b
14:32:08.620 INFO [edge-lb] upstream healthy pool=api-gateway active=12/12 rps=8,412
14:32:08.877 WARN [search-svc] query plan fell back to sequential scan table=products rows=2.1M
14:32:09.014 INFO [api-gateway] route=GET /v1/orders/ord_9921 status=200 dur=18ms trace=8d2e·1b3c
Query Language
One syntax from grep to aggregation
TQL pipelines read left to right: filter, then transform, then aggregate. The same syntax powers the search bar, alerts and scheduled reports.
$ service=checkout-svc level>=WARN region=eu-west-2
Filter by any attribute — no index to define up front. Schema-on-read does the rest.
$ trace_id=7c1f9a2b | sort asc
Pull every log line from one trace, ordered, with span context inline.
$ "deadlock detected" | stats count() by service, 1h
Full-text search plus aggregation in the same pipeline, TQL-style.
$ level=ERROR | top 10 message_patterns
Automatic pattern clustering groups near-identical errors into one row.
Capabilities
Built for the way incidents actually unfold
Schema-on-read search
Ingest structured or unstructured logs untouched. Parse, extract and index at query time, so new fields are searchable the second they appear.
Trace-linked by default
Every line carries trace_id and span_id. Click a log, land on the waterfall. Click a span, see its logs. One click, either direction, forever.
Pattern clustering
Millions of near-identical lines collapse into ranked patterns with exemplars — find the new noisy pattern in seconds, not scrolls.
Redaction before storage
Regex and named-entity rules scrub PII, card numbers and clinical identifiers at ingest. Audit trails stay immutable; privacy stays intact.
log volume by hour
ingested GB · last 24h · after redaction
top patterns
clustered message patterns · last 1h
-
"route=* status=200 dur=*ms"
1.2M occurrences · 94.1%
-
"token verified sub=* cache=hit"
410k occurrences · 3.9%
-
"inventory hold retrying attempt=*/5"
12.4k occurrences · 0.9%
-
"deadlock detected txn=* victim=*"
187 occurrences · NEW pattern ↑
Stop paying for indexes you never query
See how schema-on-read search, pattern clustering and trace links change your log bill — and your MTTR.