Log Correlation

Correlation Methods

Log correlation links logs to other observability signals. The primary correlation identifiers are trace_id, request_id, and timestamp. Including these fields in every log entry enables seamless pivoting between logs and traces.

Trace to Log Correlation

The most powerful correlation links traces to logs. Include trace_id in every structured log entry. From a trace in Grafana Tempo, click through to see all logs for that trace. From a log entry, click through to see the full trace.

{service="api"} | json | trace_id="abc123def456789"

Metric to Log Correlation

Link metrics to logs using exemplars and derived fields. When an error rate spike appears in a metric, the exemplar links to a trace, which links to logs. Alternatively, use Grafana's derived fields to jump directly from logs to metrics.

datasources:
  - name: Loki
    type: loki
    jsonData:
      derivedFields:
        - datasourceUid: Tempo
          matcherRegex: '"trace_id":"(\w+)"'
          name: TraceID
          url: '$${__value.raw}'

        - datasourceUid: Prometheus
          matcherRegex: '"service":"(\w+)"'
          name: ServiceMetrics
          url: '/explore?left={"datasource":"Prometheus","queries":[{"expr":"rate(http_requests_total{service=\"$1\"}[5m])"}]}'

Deploy Event Correlation

Annotate Grafana dashboards with deployment events. When an incident occurs, the deployment annotation immediately shows whether a recent deploy caused the issue. Correlate log volume changes with deployment timestamps.

# Log error rate changes
sum by(service) (rate({level="error"}[5m]))

# Compare before and after deploy
sum(rate({service="api", level="error"}[5m] offset 1h))
  /
sum(rate({service="api", level="error"}[5m]))

Grafana Explore Links

Grafana Explore provides a unified investigation view. Query Prometheus, Loki, and Tempo in split-pane mode. Use the correlation links to pivot between signals without losing your investigation context.