Events Explorer

Overview

The Events Explorer is where you browse and analyze the events ingested from every source. Filter by severity, source, or label in the facet panel on the left, then pick a view mode suited to what you’re looking for: a raw list to browse individual events, or an aggregated chart to spot a trend across them. Click Events in the top navigation to open it.

View modes

A tab strip at the top switches between five view modes — Events (the raw list, default), Timeseries, Table, Top List, and Pie Chart. The facet panel on the left and the filter bar above the results apply to all of them — see Filtering events.

Events

The default view: a reverse-chronological list of individual events, above a stacked bar chart of event count by severity over the selected time range.

Above the list:

  • The time range picker (default Last 15 minutes, top right) — click to choose a different interval.

  • Refresh — re-run the query for the current filters and interval.

  • COLUMNS — choose which columns are shown (Timestamp, Relative, Severity, Source, Event Id, Type, Agg Key, Title are all available; Timestamp, Relative, Severity, Source, Agg Key, and Title are shown by default), and how many lines of the message to show per row.

Click a row to open its event detail panel.

Timeseries

Plots an aggregated metric over time using the query builder. A chart-level COMPARE control overlays the same query from an earlier period (for example, one day back) for reference. Click a component of the chart legend to isolate and show only that value on the chart.

Table

The same query builder results rendered as a table instead of a chart. When the query groups results with a by clause, each group gets its own row with its own count — useful when you want exact numbers per group rather than a visual trend.

Top List

Ranks the groups produced by the query builder from highest to lowest value as horizontal bars — the fastest way to answer "which N sources/hosts/labels are producing the most events."

Pie Chart

Shows the relative share, as a count and a percentage, that each group from the query builder contributes to the total — useful for questions like "what fraction of events are coming from each source."

Event detail

Click a row in the Events view to open that event’s detail panel. A pager at the top (for example, 1 / 25) steps through the other events in the current list without closing the panel, and a search box narrows the fields and labels shown below.

The panel shows the full message (with a RAW toggle for the unformatted version), followed by grouped sections:

EVENT

The event’s own fields — aggregation_key, event_type, host, id, priority, severity, source, timestamp, title.

CLOUD

Cloud-related labels, when present — availability_zone, cloud_account_id, instance_type, project, region.

KUBERNETES

Kubernetes-related labels, when present — cluster, namespace, pod, container, and workload identifiers.

ADDITIONAL LABELS

Any other source-specific labels attached to the event; a See more control expands the full list.

Click any field’s value to Filter the Explorer to events matching it, Exclude events matching it, or Copy the value to your clipboard.

The query builder

The Timeseries, Table, Top List, and Pie Chart views share one query builder, opened with + Query.

Specify a query

  1. In the Show count of clause, select All Events (default) to count every event, or a specific facet (for example, @severity) to count unique values of that facet instead — Kloudfuse switches the aggregation from count to count unique automatically.

  2. In the by clause, select one or more facets or labels to group results by (for example, severity, source, or a Kubernetes label such as kube_namespace).

  3. In the roll up every clause, choose the size of the time bucket results are aggregated into, or leave it on auto.

  4. In the Limit clause, choose how many of the top (or bottom) groups to keep.

When you specify the first query, Kloudfuse labels it A in the interface. Click + Query to add a second query, labeled B, as a duplicate of the first — change its filters to compare it against query A. Both queries render on the same chart. With two or more queries, a Use facets with selector appears above the facet panel to choose which query the panel’s checkboxes apply to.

Refresh a query

A query loaded with a relative time interval reflects the data as of when it last ran. Click Refresh at the top right to re-fetch the data for the same options.

Add to dashboard, export, and alert

Each chart has its own icon row: an export icon to download the chart’s data, an icon to add the chart as a panel of a new or existing dashboard, and (on Timeseries) a bell icon to create an alert based on the current query. On the Events view, the equivalent action is Add to Dashboards above the list.

Adding a panel to a dashboard is part of the Kloudfuse Events UI. If you’re using the embedded Grafana pages, you can’t add new panels to dashboards from there, and Grafana doesn’t show data for panels you previously added through the Kloudfuse UI.

Filtering events

The facet panel on the left of every view mode groups the available filters:

severity

info, warning, or error — checked values are included, shown with their event count.

source

Where the event came from — for example kubernetes, containerd, kafka, helm.

LABELS

Source-specific metadata, grouped under Cloud, Kubernetes, and Additional — expand a group to check/uncheck individual values.

FACETS

The event’s own fields — aggregation key, event type, host, priority — each expandable the same way.

Deselecting a value excludes it from the chart and list; when a group has many values, use its search box to narrow the list before selecting. You can also type directly into the filter bar above the results — for example source=aws, severity=error — instead of using the panel.

Filterable facet names in the query builder’s Show count of clause are @-prefixed (for example, @severity, @source); label and facet names used in the by clause and the facet panel are unprefixed. This distinction only matters when you’re writing a filter expression directly, such as in a dashboard query or the Events API — the UI’s checkboxes and filter-bar suggestions handle it for you.