Feature: Dashboard panel — log hit table with configurable metadata columns

[SemoTech]

Summary

Add a custom dashboard panel type that shows individual log rows (not aggregations) with user-configurable metadata columns, so teams can pin an operational “hit list” on a dashboard (e.g. WAN access: host, source IP, HTTP status, GeoIP city/country).

Motivation

Today’s custom dashboard panels are either aggregations or a minimal live stream:

Panel	Limitation
Time series / single stat / Top-N	Counts / rates only — no per-hit rows
Live log stream	Rows exist, but only time / level / service / message — no metadata columns
Log Search (Explore)	Supports custom metadata columns (http_host, client_ip, geo.city, …) but cannot be embedded on a dashboard

For access-log / edge use cases (Caddy, nginx, API gateways), operators want a dashboard table like:

Time	Host	Client IP	Status	Location
19:17:42	rmm.example.com	174.x.x.x	200	Las Vegas, NV, US

That data is already in log metadata (and after GeoIP pipelines, under geo.*). Search already knows how to render it; dashboards do not.

Proposed panel: log_table (name flexible)

Config (suggested):

• title
• projectId (or inherit dashboard project)
• service filter (optional)
• levels[] (optional)
• timeRange / refresh (e.g. 1h / 24h / live)
• maxRows (e.g. 25–100)
• columns: string[] — metadata keys with the same semantics as Log Search custom columns (exact key first, then dot-path, e.g. http_host, client_ip, http_status, geo.city, geo.subdivision, geo.countryCode)
• Optional: include built-in columns (time, level, service, message) toggles

Behavior:

• One row per log event (newest first)
• Cells resolve via the same resolveMetadataPath rules as Log Search
• Click-through to log Details / Context (nice-to-have)
• Respect project / org tenancy like other panels

Alternatives considered

• Using Live log stream — insufficient (no metadata columns)
• Using Top-N — wrong shape (counts by service/error only)
• Asking users to leave the dashboard for Explore — works, but breaks “one screen” ops dashboards

Related

• Custom dashboards: [Feature] Custom dashboards with configurable panels #151
• Nested metadata columns in log search (v1.0.3 release notes)
• World / geo map panel discussion: https://github.com/orgs/logtide-dev/discussions/287

Environment note

Self-hosted; Caddy WAN logs already enrich metadata with http_host, client_ip, http_status, and pipeline geo — only the dashboard surface is missing.

[SemoTech]

Follow-up from trying Log Search custom columns as a workaround

We configured Explore/Search metadata columns (http_host, client_ip, http_status, geo.city, etc.) and the values resolve correctly.

What’s still painful for ops:

• Table cells use fixed/max-w truncation (…) with no column resize
• Hosts, IPs, and paths are hard to scan without opening Details on every row
• This reinforces the need for a dashboard log_table panel with configurable columns and usable layout (resizable or wider columns / wrap), not only “same as search but embedded”

Happy to beta-test a panel if you sketch one.

[Polliog]

As mentioned in the discussion #287 thread, this is confirmed for the next release, so marking it as planned here too.

Shape will be close to your proposal: a new log_table custom dashboard panel that renders individual log rows (newest first) with user-configured metadata columns resolved with the same semantics as Log Search custom columns (exact key first, then dot path), plus toggles for the built-in time/level/service/message columns, service and level filters, and a row cap. Since the panel reads raw rows rather than aggregations, nested paths like geo.city work on all storage engines.

Your follow-up about layout is noted as well: the panel will not just embed the search table as is, column sizing/truncation behavior is part of the work.

Will ping you here when it lands on develop if you want to beta test it, thanks for the offer.

[Polliog]

This has landed on develop (#294, merge commit b844491), so it is in for the next release.

What shipped, in case you want to try it before then:

• New Log Table panel in the add-panel list. Configure metadata columns as paths, with the same resolution rules as Log Search: an exact metadata key wins first, then a dot path into nested objects, so both http_host and geo.city work. Up to 10 columns.
• Built-in time/level/service/message columns are individually toggleable, so you can drop message entirely and keep a dense host/IP/status/location table.
• On the layout point from your follow-up: cells are single-line with a full-value tooltip and the table scrolls horizontally inside the panel, plus a Wrap cell content switch when you would rather see whole values than scan compactly. Drag-resizable column widths are not in this pass.
• Filters for project, service, levels, and a time window (15m to 7d), with a row cap of 10-100.
• Clicking a row opens that log's context view in Search.
• Two modes: snapshot, which follows the dashboard's auto-refresh, and live, which tails the project's log stream over the existing WebSocket. Live needs a specific project selected rather than all-projects, since the stream is per-project.

Since it reads raw rows rather than aggregating, nested paths like geo.city work on all storage engines, which was the constraint that shaped the geo map panel differently.

Happy to take feedback on it, particularly on whether the wrap toggle is enough for your Caddy hosts and paths or whether resizable columns are worth doing next.

[SemoTech]

Thanks for landing Log Table on develop (#294) — and for confirming it for the next release earlier. This is exactly the missing piece for our reverse-proxy WAN dashboard.

For context, here is the Graylog layout we are recreating in LogTide (Caddy project):

1. Top: inbound hit table — timestamp, source IP, city, country, request host, HTTP status, user-agent (and optionally a count). Dense, scannable rows; message body is secondary or hidden.
2. Middle: geo map (flat Leaflet “Geo IP Locations”) next to country/city breakdown charts — pairs with discussion Feature: World / Geo map panel for custom dashboards (GeoIP) #287 / geo_map.
3. Bottom: volume over time + a secondary message list.

So for Log Table config on our side we expect roughly:

Built-in	Metadata columns
time on, level optional, service off, message off	client_ip, geo.city, geo.country / geo.countryCode, http_host, http_status (and maybe UA later)

On wrap vs resizable columns: for this WAN hit list, horizontal scroll + tooltip is enough for a first release, especially with message hidden and wrap available when we need full host/path strings. Drag-resizable columns would still be welcome later (hosts and paths vary a lot), but they are not a blocker for us to replace the Graylog table once this ships in a tagged release.

We are on self-hosted v1.2.0 today and watching for the next release that includes both log_table and geo_map. Happy to beta-test from develop images if you publish them; otherwise we will upgrade on the next tag and report back (live vs snapshot mode, wrap on long http_host / URI values, click-through to Search context).

Thanks again — this closes the gap that forced us into Explore for day-to-day WAN review.