Logs

Live tail and full historical search, built into every Pod and Container's own detail page.

KubeWatch has two log surfaces: the OpenTelemetry tab on the Observability page for application logs your services export via OTLP, and per-resource log viewing built directly into every Pod and Container's own detail page.

OpenTelemetry logs

The Observability page's OpenTelemetry tab shows application logs your services export via OTLP. Filter by severity, time range, and service, and search the text. Send logs to the OTLP logs endpoint from your instrumented apps to populate this tab.

Pod and Container logs

There's no standalone Logs page anymore. Click any pod on the Pods page, or any container on the Containers page, to open its detail page, then its Logs tab. Every entry point (Pods, Containers, and each detail page's own Overview and, for pods, Exec tabs) lives together on that one resource's page instead of asking you to pick it out of a separate global list.

The Logs tab has two modes:

Live: streams new lines from the running container/pod as they happen, the same real-time tail this feature has always had. Search within the streamed lines, toggle timestamps and line wrapping, pause/resume, download the current buffer, or reconnect.
History: searches this specific pod's or container's continuously-collected log history (up to 90 days by default, matching this deployment's VictoriaLogs retention), not just what's scrolled by since you opened the page. Pick a range (1h/6h/7d/14d/30d/90d), optionally filter by message text, and click any result to see its full, un-truncated detail in a slide-over.

Live mode only shows what happens while it's open, streamed on demand from the running container. History mode searches what the agent has already collected continuously in the background, whether or not anyone had a viewer open at the time. See [How KubeWatch Works](/getting-started/architecture) for the collection pipeline behind it.

History search is also clamped to your org's own data retention preference (Settings → Usage & Limits) when one is set, so a shorter preference (30 or 90 days) narrows what's searchable even on a deployment whose VictoriaLogs instance still holds more than that.

Raw query mode

History mode's Raw query toggle lets you type a LogsQL expression directly, the same query language this feature's storage backend (VictoriaLogs) speaks, and the same class of query language Grafana/Loki's Explore view uses, rather than being limited to the built-in text-search filter. Field filters (stream:"stderr"), regex matches (message:~"5[0-9]{2}"), and boolean AND/OR/NOT all work.

A raw query always ANDs onto the pod's or container's own scope, so it can only narrow what you're already looking at, never search outside it or across other resources.