Views

You will learn how saved views capture columns, filters, time modes, and optional structural cohorts — and who can see them.

A view is a named, saved query configuration for a stream. Opening a view resolves or live-tails events (or an aggregate chart) without rebuilding the query from scratch.

What a view stores

Piece	Role
Columns	Projection — which fields appear in the table
Filters	Value predicates on learned fields (`eq`, `contains`, …)
Time mode	Relative lookback, absolute range, or live tail
Shape (optional)	Structural cohort — `exact` fingerprint or `contains` required paths
Aggregate settings (optional)	Chart mode (count, sum, …) instead of an event table; optional Prior period compare
Table layout	Column widths, column order, and UTC vs Local timestamp display
Visibility	Private (creator) or Stream (query members)

Columns and shape matching are intentionally separate: columns decide what you see; shape (and filters) decide which rows belong.

Visibility

Each view is either Private or Stream. This is independent of stream visibility (Private vs Team).

Visibility	Who can list, open, resolve, or tail
Private	The creator only
Stream	Anyone who can already query that stream

New views default to Private. Existing views created before this model were kept Stream so previously shared lists did not disappear.

Only the owner (the person who created the view) can rename it, change visibility, edit the saved query, or delete it. Opening a Stream-visible view does not grant ingest keys, stream settings, or other members’ private views.

Private view names are unique per owner on a stream. Stream-visible names are unique across that stream.

Creating views

Common entry points:

Views — create a blank view and edit filters/columns
Query — run a search, then save as a view
Insights — one-click or preview/create from a suggested view or any observed shape

Suggestions from Insights include a create-ready cohort so the saved view matches the events the suggestion described. See Use Insights.

Opening a view

The sidebar and Views list show your private views plus every Stream-visible view on streams you can query.
Absolute / relative views resolve through the query engine (including shape matchers when set).
Live views tail matching events as they arrive; structural matching still applies.
Aggregate views show charts and can auto-refresh. Prior period compare stays on the view when you save it from Query.

Live event tails and aggregate auto-refresh show connection copy: Connected, Retrying, or Connection failed, plus when the last successful update landed.

If you own the view, edits to name, filters, columns, time mode, and visibility autosave on the Views page. If you do not own it, you can still explore; use Save as new to keep your own copy (default Private). Structural shape matching is preserved across save and “Save as new” when present.

Event vs aggregate views

A view can open as:

An event table (search-style projection)
An aggregate chart or summary (count, sum, percentiles, …)

Time mode is independent of that choice: relative lookback, absolute range, or live tail (live applies to matching events as they arrive). Absolute and relative views can also set Time basis to Receipt (ingest time) or Event time (producer time derived at ingest). Live tails always use receipt time.

Event table layout

On an event table you can:

Drag a column header (or use arrow keys) to reorder columns — order sticks with the view and the Columns menu.
Resize columns; widths stick per account.
Switch Timestamp display between UTC and Local (browser time zone). That choice is saved with the view’s table layout.

Envelope originals such as log._raw stay out of Events and field lists so extracted children stay readable. Copy still includes the stored payload.