Copy as Markdown[Open in ChatGPT](https://chatgpt.com/?q=Read%20https%3A%2F%2Fcoralogix.com%2Fdocs%2Fuser-guides%2Fdata_exploration%2Ffields.md%20and%20help%20me%20with%20my%20question%20about%20this%20Coralogix%20documentation%20page.)[Open in Claude](https://claude.ai/new?q=Read%20https%3A%2F%2Fcoralogix.com%2Fdocs%2Fuser-guides%2Fdata_exploration%2Ffields.md%20and%20help%20me%20with%20my%20question%20about%20this%20Coralogix%20documentation%20page.)

# Filter with fields

Use the **Fields** panel to discover which fields exist in your current Explore results and to take common actions without manually typing field names into the query.

The Fields panel replaces the old "filters" concept, which was a closed list of predefined fields. **Fields** is an open list: it surfaces all detected fields from the current results, and lets you favorite the ones you care about most.

[![The Fields panel showing detected fields, favorites, and value distributions](/docs/assets/images/fields-overview-6863864a4f5c05975c153e39ed14078f.webp)](https://coralogix.com/docs/docs/assets/images/fields-overview-6863864a4f5c05975c153e39ed14078f.webp)

## Open the Fields panel[​](#open-the-fields-panel "Direct link to Open the Fields panel")

Select the filter icon next to the query builder to open or close the Fields panel. After your first query on a tab the panel opens automatically. To close it, select the **X** in the panel header. Use the **Expand all** / **Collapse all** toggle in the header to open or close every section and category at once.

A strip of **active-filter chips** at the top of the panel aggregates the filters currently applied per field. Select **Show in list** on any chip to scroll to the matching field.

## What a field is[​](#what-a-field-is "Direct link to What a field is")

A field is a key found in your logs. Each log event can include many fields, and the Fields panel lists those detected in the results you are currently viewing.

## How the fields panel updates[​](#how-the-fields-panel-updates "Direct link to How the fields panel updates")

The Fields panel reflects the current Explore context:

* Your query
* Your time range (for example, the last 15 minutes)
* The results returned for that context

As you change the query or time range, the panel updates to match the current results. It surfaces all detected fields from the current results, and lets you favorite the ones you care about most.

It does not represent every field across all historical logs.

## Display mode[​](#display-mode "Direct link to Display mode")

The Fields panel runs in **Full** mode by default. Full mode fetches and displays the full per-value counts and field statistics. The Fields panel keeps your choice for the current session. Fast mode skips per-value count statistics on first load so the panel stays responsive on large result sets — value distributions and field popularity are not fetched until you switch to Full.

Switch between **Fast** and **Full** from the mode select at the top of the panel.

## How filtering works[​](#how-filtering-works "Direct link to How filtering works")

Filtering is synchronized between the Fields panel and the query bar:

* When you add a field or value from the Fields panel, it is added to the query bar.
* When you edit the query bar, the Fields panel updates to reflect those selections.

This prevents mismatches where one UI control applies a constraint that the other does not show.

## Field search flow[​](#field-search-flow "Direct link to Field search flow")

Goal: Allow the user to discover fields and add field-value filters to the query.

Use the following flow to find a field, select a value, and filter the results:

1. Open the **Fields** panel.
2. Search for a specific field by name.
3. Add the field to the selected area.
4. Select the field to expand it.
5. Select one of the field values.
6. Confirm that the value is added to the query.
7. Run the query.

As you add or remove filters, the Fields panel and the query bar stay in sync, so you can validate what is applied from either place.

## Panel sections[​](#panel-sections "Direct link to Panel sections")

The Fields panel uses a tree structure. Expand any section to browse its fields, and expand a field to see its value distribution and statistics.

On the **logs** dataset, the Fields panel is organized into four sections:

### Favorites[​](#favorites "Direct link to Favorites")

A personal list of fields you want to keep at the top of the panel, scoped per dataset.

* Select the star icon on a field to add it to favorites; select it again to remove it. Favorites pin to the top of the panel for quick access.
* Explore stores favorites per `(source, dataspace, dataset)`. Starring a field under `logs` doesn't pin it under `spans` or a user-defined dataset.
* Favorites support "my fields" workflows, where different users care about different keys.
* A favorite that no longer appears in the current schema still renders in the Favorites list with its last-known metadata. Remove the pin to clear it from the list.

### Metadata[​](#metadata "Direct link to Metadata")

Coralogix internal metadata fields. These fields align with how metadata is referenced in DataPrime queries (for example, metadata commonly appears under `$m`).

Metadata fields aren't broken out as key/value rows in the [Log details panel](https://coralogix.com/docs/docs/user-guides/data_exploration/logs/info_panel/.md#view-metadata-fields) — they appear only nested in the panel's **JSON** and **Raw** views. To view one in the table, add it as a column from this section — or search for `coralogix.` in the Logs tab's **Columns** panel. To query metadata programmatically, use DataPrime's `$m.<field>` access mechanism; see [Access mechanisms](https://coralogix.com/docs/docs/dataprime/language-reference/access_mechanisms/.md).

### User labels[​](#user-labels "Direct link to User labels")

Custom labels attached to your logs at ingest time. These fields align with the `$l` namespace in DataPrime queries.

### All fields[​](#all-fields "Direct link to All fields")

All other detected fields from your log data.

### Spans dataset sections[​](#spans-dataset-sections "Direct link to Spans dataset sections")

On the **spans** dataset, the Fields panel uses OpenTelemetry semantic-convention sections instead — Core, Exceptions, HTTP, gRPC/RPC, GraphQL, Messaging, Database, Cache, GenAI/LLM, RUM/Frontend, Object Storage, Serverless, Spark/Airflow/DBT, Infrastructure, Network, Runtime, Checkly, OTel, Events, CloudEvents, and Other. Favorites remain at the top of the panel and follow the per-dataset rule above.

## Field actions[​](#field-actions "Direct link to Field actions")

Open the more actions menu on any field for these actions:

| Action                                        | What it does                                                                                                        |
| --------------------------------------------- | ------------------------------------------------------------------------------------------------------------------- |
| **Exists**                                    | Adds a field-existence filter on the current query (Lucene `_exists_:<path>`).                                      |
| **Not Exists**                                | Adds a field-absence filter on the current query (Lucene `NOT _exists_:<path>`).                                    |
| **Add as a column** / **Remove from columns** | Adds or removes the field as a column in the results table.                                                         |
| **Copy path**                                 | Copies the field's full path (for example, `coralogix.metadata.severity`) to the clipboard.                         |
| **Group by**                                  | Adds the field to the **Grouped by** clause in the query builder. See [Group by](#group-by) for the resulting view. |

Each field also has a **Show distribution** icon and a favorite (star) icon on its row, separate from the more actions menu.

[![Field actions](/docs/assets/images/fields-actions-d9d88b4d1a409a69d36fb900e2866063.gif)](https://coralogix.com/docs/docs/assets/images/fields-actions-d9d88b4d1a409a69d36fb900e2866063.gif)

The menu's **Exists** / **Not Exists** are field-existence filters — they include or exclude rows based on whether the field is present at all. To filter on a specific value, expand the field and use its value rows, described in [Filter by value](#filter-by-value).

Expand a field in the Fields panel to see its value distribution inline — the count of logs per value within the current result set, sorted by count (highest first). A small data-type icon next to each field name shows whether the field is string, numeric, boolean, or another type. Fields defined as [reserved fields](https://coralogix.com/docs/docs/user-guides/data-layer/schema-management/reserved-fields/.md) also carry a **reserved** label in the query builder's field suggestions. The distribution updates as you change the query or filters.

When the query updates, the per-value counts swap to a translucent skeleton while new counts load — value rows stay in place and don't reorder. The value list excludes the field's own selected values from its counts, so picking one value won't shrink the others away.

Long value lists paginate with **Show more** / **Show less** controls. The severity field is a special case: it renders color-coded swatches per severity value with no Show more control.

### Filter by value[​](#filter-by-value "Direct link to Filter by value")

Expand a field and use the checkbox on each value row to include or exclude it. The Fields panel and the query bar stay in sync as you go:

* With no filter on the field, every value is checked. Clear a checkbox to exclude that value, and the query gains a matching exclusion clause.
* Select **Only** on a value to narrow the field to that value alone. This clears any other included or excluded values for the field and keeps just the one you selected.
* Once the field has an included value, selecting a checkbox adds that value to the set and clearing it removes the value. Clearing the last included value returns the field to its unfiltered state, with every value checked again.

The checkbox state is the filter state: a checked value is included, a cleared value is excluded. When a field is part of an **OR** group in the current query, its value checkboxes are disabled — edit the query directly to change how that field is filtered.

### Show distribution[​](#show-distribution "Direct link to Show distribution")

Select the **Show distribution** icon on a field to open a drilldown drawer that groups your current results by that field.

The drawer header reads **Group by** with the field name (for example, `metadata.applicationName`) and has two parts:

* **Unique values**: a chart of the field's distinct values, each with its count. It opens as a horizontal bar chart; use the chart-type dropdown to switch the visualization.
* **Results**: the rows that make up the grouping.

Use this to:

* Quickly assess the distribution of a field without building a full query
* Identify which values dominate a field
* Pivot into a subset without leaving your current investigation

Select **Apply to main** to carry the grouping into the main Explore view. This is the same drilldown drawer you get when you [select a row in grouped results](https://coralogix.com/docs/docs/user-guides/data_exploration/query_builder/.md#drill-down-into-grouped-results).

### Group by[​](#group-by "Direct link to Group by")

Select **Group by** to add the field to the **Grouped by** clause in the query builder. The table transforms from individual log rows into aggregated groups, showing each unique value and its count.

This provides a shortcut to group results by a field directly from the Fields panel without opening the Grouped by dropdown. After grouping, select any group row to open a drilldown panel for focused investigation of that group.

## Field statistics[​](#field-statistics "Direct link to Field statistics")

Each field shows the following statistics, calculated from the current result set:

* **Field popularity**: the percentage of logs in the current result set that contain this field. For example, if 20 out of 100 logs contain the `status` field, its popularity is 20%.
* **Data type** (shown as an icon next to the field name)
* **Number of values**
* **Selected values indicator**: shows the selected count alone when the field is collapsed and `selected/total` once the field is expanded

Expand a field to see its **value distribution**: a breakdown of the count of logs per value within the current result set.

Example for the `application` field:

* `app1` — 45 logs
* `app2` — 30 logs
* `app3` — 25 logs

Both field popularity and value distribution update dynamically when you change the query or time range.

## Order within the panel[​](#order-within-the-panel "Direct link to Order within the panel")

The Fields panel doesn't have a sort menu. Fields are grouped by section (Favorites, Metadata, User Labels, All fields on logs; OpenTelemetry semantic-convention sections on spans), and the All fields tree is organized by field path. Within an expanded field, the value list is sorted by count (highest first).

## Troubleshooting[​](#troubleshooting "Direct link to Troubleshooting")

If adding a filter returns no results:

* The filter combination might be too narrow for the current time range.
* Remove one filter and reapply filters one at a time.

If a field does not appear in the Fields panel:

* The field might not be present in the current results for the selected time range.
* Widen the time range or adjust the query to bring relevant logs into the results.

If the Fields panel does not reflect the query you expected:

* Verify that the value you selected appears in the query bar.
* Clear and reapply the filter from either the query bar or the Fields panel.

## Next steps[​](#next-steps "Direct link to Next steps")

Write more advanced queries with Coralogix's pipeline syntax in [DataPrime query](https://coralogix.com/docs/docs/user-guides/data_exploration/dataprime/.md).