---
title: Query builder
description: Build filter chips in Explore, then add Grouped by, Aggregation, Order by, and Limit to turn logs and spans into grouped results.
url: https://coralogix.com/docs/user-guides/data_exploration/query_builder/
product: data-exploration
feature: Explorer v2
feature_id: explorer-v2
feature_identifier: data-exploration/explorer-v2
last_updated: '2026-11-02'
---

# Query builder

Query Builder turns log and span search into analysis. Group, count, and compare across any field directly in Explore. Start by filtering with the search bar, then add **Grouped by** and **Aggregation** chips to turn raw data into grouped results. From grouped results, drill down into a specific group and apply your refined selection back to the main view.

## Filter chips

The search bar has 2 input modes: raw Lucene (type queries like `serviceName.keyword:"checkly"`) and chip builder (compose queries from structured chips). By default, the search bar opens in chip builder mode, and it remembers the mode you last used across sessions. Select the wand icon in the search bar (its tooltip reads **Switch to chip builder**) to toggle from raw Lucene to the chip builder, and select the same icon again to switch back.

[![Chip builder](/docs/assets/images/chip-builder-47c64b3fdec1e96fa49d7d8ff84c0e7d.webp)](https://coralogix.com/docs/assets/images/chip-builder-47c64b3fdec1e96fa49d7d8ff84c0e7d.webp)

In chip builder mode, each filter combines a **field**, an **operator**, and a **value**. When you add a chip, the operator pre-selects the first available option, which is `=` (Equal) for most fields, so you only need to change it when you want a different comparison. If you change a chip's field, the operator resets to the first available option for that field instead of clearing. This mirrors how the **AND** connector is the default when you combine multiple filters.

What `.keyword` means

When you search a string field, Coralogix indexes it two ways. The base field (for example, `serviceName`) is *analyzed*: its value is broken into lowercase tokens, so a query matches individual words inside it. The `.keyword` variant (`serviceName.keyword`) keeps the entire value as a single exact string and matches it verbatim, so `serviceName.keyword:"checkly"` matches only the full value `checkly`, not a token within a longer string. Use `.keyword` when you need an exact, whole-value match, and the base field for partial or word-level matches. Wildcard and regex queries also target the `.keyword` form (for example, `msg.keyword:/.*error/`).

When you build a filter chip, Explore resolves string fields to their `.keyword` form for you. Numeric and boolean values match directly, without the suffix.

### Exists and Not exists operators

Two operators filter on whether a field is present at all, regardless of its value:

* **Exists**: matches records where the field is set.
* **Not exists**: matches records where the field is missing.

Select either operator from a chip's operator dropdown. Because they test for presence rather than a value, the value input disappears once you select them. The chip is complete with just a field and an operator. They work on any field in the Builder and produce the Lucene clauses `_exists_:<field>` and `NOT _exists_:<field>`.

## Collapse the builder and toggle fields

To free up vertical space while you read results, collapse the query builder to a single row. Select the chevron next to the dataset selector (its tooltip reads **Collapse query builder**) or select the empty area between the dataset selector and the time picker. Select the chevron again (**Expand query builder**) to bring the full builder back.

When collapsed, the builder shows compact badges for any active **Grouped by**, **Aggregation**, **Errors**, and **Duration** clauses, so you can see what's applied at a glance. Select a badge to expand the builder and edit that clause.

The group-by chart renders full-width above the results grid. Show or hide the **Fields** sidebar from the grid toolbar. Select the sidebar icon (tooltip **Show fields** / **Hide fields**) at the left of the toolbar, next to the result tabs.

Explore remembers whether the builder is collapsed and whether the Fields sidebar is hidden, across sessions.

## How the builder changes your results

Explore has two table views:

* Rows table: Shows individual logs, spans, or traces that match your search.
* Grouped results table: Appears when you add at least one **Grouped by** or aggregation, showing grouped rows and calculated metrics.

### Build a grouped query

1. Use the search bar to filter the logs you care about.
2. Select **Grouped by** and choose one or more fields.
3. Select **Aggregation** and choose one or more aggregations.
4. Select **Run**.

After the query runs, Explore displays a grouped results table. A chart may appear above the table depending on your grouping and time range.

Auto-submit

Builder edits that produce a complete, valid query (adding a chip, accepting an autocomplete suggestion, picking a clause field) auto-submit after a short debounce. Free-text typing in the Lucene editor stages but doesn't auto-submit, and DataPrime is excluded entirely. Use **Run** when you want explicit control or when typing a multi-clause Lucene expression by hand. An edit that leaves the query invalid isn't auto-submitted, and nothing is marked while you type. **Run** stays enabled: select it, or press **Enter**, and Explore outlines the query bar in red and explains the problem in a tooltip. See [Run the search](https://coralogix.com/docs/user-guides/data_exploration/search.md#run-the-search).

### Grouped by fields

Use **Grouped by** to split results into buckets such as `coralogix.metadata.severity`, `service`, or `cx_rum.page_context.page_fragments`.

Key behaviors:

* You can add multiple group-by fields. The order matters and defines the grouping hierarchy.
* High-cardinality fields can increase query cost and make results harder to read. Use them when you need a deep breakdown, then drill down and narrow the time range.
* When your query spans more than one team, **Team** is available as a group-by field (Explore groups by `teamId()`). See [Query across teams](https://coralogix.com/docs/user-guides/data_exploration/datasets.md#query-across-teams).

[![Grouped by field selector showing available fields for grouping](/docs/assets/images/group-by-dropdown-b4af8004b8541f5b5dd3f345892a665b.webp)](https://coralogix.com/docs/assets/images/group-by-dropdown-b4af8004b8541f5b5dd3f345892a665b.webp) *Grouped by field selector showing available fields for grouping*

### Aggregations

Aggregations calculate metrics per group. The full set of options is:

* **Count**, **Distinct Count**
* **Sum**, **Min**, **Max**, **Average**, **Median**
* **P75**, **P90**, **P99**

Sum, Min, Max, Average, Median, and the percentiles require a numeric field. When you choose one of these aggregations, select the numeric field to aggregate.

If a group does not contain the selected numeric field, the result cell for that group is empty. This is expected when only some logs include the field.

You can add multiple aggregations to show several metrics as columns side by side.

[![Aggregation dropdown showing Count, Distinct Count, Sum, Min, Max, Average, Median, P75, P90, P99](/docs/assets/images/aggregation-dropdown-403cb71204d05cb22bc015dec33309ac.webp)](https://coralogix.com/docs/assets/images/aggregation-dropdown-403cb71204d05cb22bc015dec33309ac.webp) *Aggregation dropdown showing Count, Distinct Count, Sum, Min, Max, Average, Median, P75, P90, P99*

### Order by and Limit

Once you've grouped or aggregated, two chips alongside **Grouped by** and **Aggregation** shape the result set:

* **Order by**: pick any grouped field or aggregation column, then choose **Ascending** or **Descending**. Descending surfaces the busiest groups; ascending with a small limit surfaces quiet outliers.
* **Limit**: caps the number of rows returned. Options are **10**, **50**, **100** (default), **500**, **1000**.

Both chips affect the Overview tab only, they don't reshape the raw Logs or Templates tabs.

### Visualize the grouped result

Adding a **Grouped by** or **Aggregation** clause auto-switches the result panel to the **Overview** tab, and the **Visualize as** dropdown appears in its toolbar. The dropdown switches between **Table** (default), **Vertical bar**, **Horizontal bar**, and **Pie chart**. Until you submit a **Grouped by** or **Aggregation** clause, the dropdown stays inactive and its tooltip reads *Use Group By in the Builder to unlock additional visualizations*. The dropdown only appears on the Overview tab. The Logs and Templates tabs stay row-based regardless of grouping. See [Overview tab](https://coralogix.com/docs/user-guides/data_exploration/overview-tab.md) for the full visualization model.

### Drill down into grouped results

When you select a row in the grouped results table, Explore opens a **drilldown panel**. The drilldown panel is separate from the log details panel, it provides a focused investigation view for the selected group rather than details for a single log entry.

This view helps you inspect the logs and spans that make up the selected group and refine further.

In the drilldown view, you can:

* Review a time distribution chart for the selected group.
* Highlight a time window on the chart to narrow the drilldown results to that interval.
* Apply additional filters using the drilldown search bar.
* Select **Apply to main** to continue investigating in the main Explore view.

Current behavior of **Apply to main**:

* It replaces the main view query with the drilldown query, including any filters you added in the drilldown view.
* If you changed the time range in the drilldown view, the main time range updates to match.

### Examples

Count logs by severity

1. Search: `coralogix.metadata.severity:*`
2. Grouped by: `coralogix.metadata.severity`
3. Aggregation: `Count`

Find where errors occur by page

1. Search: `errors AND coralogix.metadata.severity:"Error"`
2. Grouped by: `cx_rum.page_context.page_fragments`
3. Aggregation: `Count`
4. Optional filter to exclude missing values: `_exists_:cx_rum.page_context.page_fragments`

Break down errors by organization, page, and user

1. Search: `errors AND coralogix.metadata.severity:"Error"`

2. Grouped by (in order):

   <!-- -->

   * `cx_rum.labels.organization_name`
   * `cx_rum.page_context.page_fragments`
   * `cx_rum.session_context.user_email`

3. Aggregation: `Count`

### Tips and troubleshooting

* You can also add a grouping directly from the **Fields** sidebar by opening the more actions menu on a field and selecting **Group by**. This adds the field to the Grouped by clause without opening the Grouped by dropdown.
* Start with a shorter time range while building your query, then expand after results look correct.
* If grouping produces too many rows, add fewer group-by fields, use a limit, or drill down into one group and narrow the time range.
* If an aggregation shows `null`, confirm the aggregated field exists on the logs in that group and that the field is numeric for numeric aggregations.
* If a query returns a warning or fails, see [Errors and warnings](https://coralogix.com/docs/user-guides/data_exploration/errors-and-warnings.md) to interpret the message and resolve it.

## Next steps

Discover and apply field-based filters without typing field names manually in [Filter with fields](https://coralogix.com/docs/user-guides/data_exploration/fields.md).