Basic Querying

Now that you have Logship running, let's explore how to query your data. This guide continues from our Single Node setup.

Accessing the Query Interface

First, ensure your Logship instance is running:

docker compose up -d

Navigate to the Logship Frontend:
- Open your browser and go to http://localhost:8000/
- Log in with your credentials
- Click on Query in the navigation menu (or use this direct link if you're following the guided setup)

Your First Query

Let's start with a simple query to explore available tables:

schema.tables
| limit 100

This query shows you all tables in your Logship database. It's a great way to discover what data you have available.

Track Your Activity

Want to see how to summarize page views? Try this inline sample:

datatable(timestamp:datetime, page:string)
[now() - 2m, "/query", now() - 1m, "/dashboards", now()]
| summarize count = count() by page
| order by count desc

This runnable example counts page views from inline sample data. Your deployment may also collect frontend activity in logship.frontend.ui.public.page.view.

Explore recent ingest

Check the most recent rows for any schema:

schema.tables
| where TableName !startswith "schema."
| take 1
| project TableName
| join kind=inner (
    invoke withsource=TableName (table(TableName))
    | top 5 by timestamp desc
  ) on TableName

Common troubleshooting queries

Count events per minute to spot ingest gaps:

datatable(timestamp:datetime)[now() - 30s, now() - 20s, now()]
| summarize events = count() by bin(timestamp, 1m)

Identify hottest schemas:

schema.tables
| join kind=inner (
    schema.extents
    | summarize totalRows = sum(RowCount) by TableId
  ) on TableId
| project TableName, totalRows
| top 10 by totalRows desc

Quick reference: logsh CLI

logsh configure backend http://localhost:5000
logsh login --username admin --password admin
logsh query "schema.tables | take 5"