Logs

The Logs page gives you a live and historical view of everything that happens while your content is played – sandboxes being provisioned, setup scripts, user activity, tasks passing or failing, warnings, and errors. It’s the fastest way to understand why a session behaved the way it did, unblock someone while they’re still playing, or fix a problem in your content, all without touching the CLI.

Note

Logs cover events generated when your content is played – by users in a live or self-paced session, or by you when you play it yourself from the dashboard. You don’t need to configure anything to start collecting logs; they’re captured automatically.

Opening the Logs page

Open the Logs page from the main navigation.

The page is context-aware: if you open it from a specific piece of content or a share, it pre-applies matching filters so you land on the relevant events straight away. Any pre-applied filters are shown in the filter bar, so it’s always clear what you’re looking at, and you can clear or change them at any time.

The page at a glance

The Logs page has three main areas, plus a streaming control:

• Filter bar – search and narrow down which events you see: two search boxes (message/event and sandbox/session) plus Severity, date range, Labs, Tracks, and Share filters.
• Stream button – in the top right, toggles live streaming on and off (see Live streaming).
• Export button – next to the Stream button, downloads or copies the events currently shown as JSON (see Exporting logs).
• Timeline – a chart showing when events happened and how they’re distributed over time.
• Log stream – the list of individual events matching your filters.

The default view

When you open Logs, the page loads immediately with a focused starting point, so you’re not overwhelmed and nothing is slow to load:

• Time range: the last 15 minutes
• Severity: errors and warnings only (shown as a 2 on the Severity filter)
• Labs / Tracks: all content
• Streaming: on

This surfaces the highest-priority events first. From there you can widen the time range, add more severity levels, or filter down to specific content or a session.

Reading the log stream

The log stream is a feed of individual events, ordered oldest first. Each row gives you the essentials at a glance:

Column	What it shows
Severity	A coloured indicator and label (Error, Warning, Info, Debug).
Time	When the event happened.
Session id	Identifies the session the event belongs to.
Message	A plain-language description of what happened and who or what triggered it (for example, “Handler returned error” or “User failed task”).

Expanding an event

Click the arrow at the start of any row to expand it and see the full detail behind the event:

• Content name the event came from (and the branch, for labs).
• Access type – how the user reached the content (see Access types).
• Event details – the complete set of information recorded for that event, shown as structured, collapsible data. Nested sections can be expanded or collapsed so you can drill into exactly what you need.

Because every piece of content records its own kinds of events, the detail shown adapts to whatever that event contains – nothing is hidden or trimmed away.

Access types

The access type tells you how the user got into the content:

Access type	How it appears
Invite link	Invite · [share name]
Landing page	Landing Page · [share name]
Embedded on an external page	Embed
LMS / LTI	Embed
You playing from the dashboard	Creator Session

Severity levels

Severity tells you how important an event is. It controls what shows by default and how the event looks in the list.

Level	What it means	Shown by default?
Error	Something went wrong and affected the experience. Needs attention.	Yes
Warning	Something was outside the expected behaviour, but the session kept going.	Yes
Info	Normal events – content started, completed, a task passed or failed.	No – turn on to see
Debug	A detailed trail of everything that happened, recorded for diagnostics.	No – turn on to see

Searching and filtering

Use the filter bar to narrow the stream and find relevant events faster. Filters are additive – each one you add narrows the results further – and they stay applied as you work. A Clear all filters control appears whenever any filter is active.

Two search boxes:

• Search message or event – full-text search across event messages.
• Sandbox or session ID – find all events for a specific sandbox or session.

Filters:

Filter	What it does
Severity	Choose any combination of Error, Warning, Info, Debug. Errors and warnings are on by default; a badge shows how many levels are selected.
Date range	Presets for the last 15 minutes, 1 hour, 6 hours, 24 hours, or 7 days, plus Custom… for an exact range (up to 30 days) and a Time zone setting (for example, GMT+2).
Labs	Search and select one or more labs. Each entry shows the lab name with its slug underneath. Use the arrow on an entry to pick a specific branch (e.g. main).
Tracks	Search and select one or more tracks. Each entry shows the track name with its slug underneath.
Share	Open Invites or Landing Pages and pick individual items. Selecting a category no longer selects everything under it – choose exactly the shares you want.

Note

In the Labs and Tracks filters you can select as many items as you like, and the ones you’ve selected move to the top of the list – so you can see and clear your selection without scrolling or searching again.

The Timeline

The chart between the filter bar and the stream shows the distribution of events over your selected time range. It’s an at-a-glance way to spot when activity peaked or where errors are concentrated, without scrolling through every event.

• Bars are stacked by severity, each with its own colour: Error (red), Warning (amber), Info (blue), Debug (grey). Exact shades may vary slightly depending on your UI colour mode (light, dark, or system).
• Only the severities currently shown in your filters appear in the bars.
• Hover a bar for a breakdown of counts by severity for that slice of time (for example, “2 errors · 1 warning · 4 info”).
• The Timeline reflects your active filters – if you’re viewing errors only, only errors appear in the bars.
• The width of each bar (the time bucket) adjusts automatically to keep the chart readable across the selected time range.

The bucket width scales with the selected date range:

Date range	Bucket width
Up to 1 hour	1 minute
Up to 24 hours	30 minutes
Up to 7 days	6 hours
Longer (up to the 30-day maximum)	1 day

Note

The Timeline is scaled so that a bar with a single event is still visible next to a bar with hundreds. A tall bar doesn’t mean proportionally more events – the scale is designed so quiet periods don’t disappear next to busy ones.

Live streaming

Use the Stream button in the top right to toggle live streaming. When it’s on, new events appear in the stream in real time as they’re generated – ideal for watching a live session unfold. Streaming is separate from the date range: turn it on to follow events as they happen, or pick a time range to look back over history.

• Streaming is on by default when the page loads.
• Pause / resume the stream at any time (button, or the P key) so you can read without the list moving.
• If events exist outside your current time range, a banner lets you reveal them (this widens the time range to include them).
• Up to 5,000 events are kept in memory while streaming. Once that cap is reached, the oldest entries drop off and a banner tells you so.

Customising columns

You can choose which fields appear as columns in the stream to surface the data that matters most for your content or the issue you’re chasing.

• The ＋ control at the top right of the table header opens a list of all fields found across the events in your current view.
• Select a field to add it as a column; deselect to remove it.
• You can also remove a column by hovering its name in the table header and clicking the remove control.
• The available fields update as your filtered view changes and new fields become available.
• The default columns – Severity, Time, Session id, Message – are always present and can’t be removed.

Your column selection is saved in the page URL, so it persists on reload and can be shared with a teammate via a link.

Alongside the four default columns, the following optional columns are available:

Column	What it shows
Sandbox ID	The track sandbox ID. Populated for track logs.
Content	The ID of the lab or track the entry belongs to.
Type	The content type: lab or track.
Slug	The slug of the lab or track.
Ref	The lab’s branch or tag name. Empty for track entries.
Ref type	Whether the ref is a branch or a tag. Empty for track entries.
Access type	How the content was accessed: invite, landing page, embed, or creator session. Matches the groups in the Share filter.
Share name	The name of the invite or landing page used, when applicable.

The picker also lists a Payload group, with one column per field found in the raw log payload of your current results (for example, fields a lab or track script logged). These columns only appear for entries that actually carry that field.

Exporting logs

Use the Export button (the download icon in the top right, next to the Stream button) to take the events you’re looking at out of the page – for example to attach them to a support request, share them with a colleague, or paste them into an AI assistant to help troubleshoot a lab or track build.

• Download JSON – saves a file named instruqt-logs-<date>-<time>.json to your computer.
• Copy JSON to clipboard – copies the same content so you can paste it directly. A confirmation shows how many events were copied.

The export contains exactly what the table shows at that moment: the results of your current filters, or the live stream buffer when streaming is on. Each event is included in full – including the raw payload you’d otherwise see by expanding the row – along with the time range and the number of events, so the file carries its own context.

The Export button is disabled when there are no events to export.

To copy a single event, hover over its row and select the copy icon that appears at the end of the row. This copies that event as JSON.

Keyboard shortcuts

For quick navigation without leaving the keyboard, the Logs page supports shortcuts. Select the ? button in the top right of the page to open the full reference at any time.

Key	Action
J / ↓	Select the next row
K / ↑	Select the previous row
Enter / Space	Expand or collapse the selected row
Escape	Collapse an expanded row, or clear the search box if it’s focused
/	Focus the search bar
P	Pause or resume the live stream
C	Copy a permalink to the selected row
?	Open the keyboard shortcuts reference

Note

Shortcuts don’t fire while you’re typing in a text field, such as a search box or a filter, so they won’t get in the way of normal input.

Loading, empty, and error states

While logs load, the page shows a loading state.

If there are no events to show, you’ll see a No events to show for selected filters message. This usually means one of two things: the content hasn’t been played yet, or your current filters don’t match any events. Use Reset filters to return to the default view (recent errors and warnings).

If something goes wrong fetching logs, you’ll see Could not load logs with a Retry button. Select Retry to try the request again.

When a lab’s logs stop

If events stop arriving while a lab session is still running, the sandbox has usually run out of memory. Once memory is exhausted, the sandbox stops responding and so does its logging. Shortly before that, the lab logs a warning:

Sandbox is running out of memory: 48 MB of 1024 MB available. Set resources.memory on the lab’s containers so the sandbox is sized to fit them.

The sandbox is sized from the resources of its containers, so set resources.memory on the containers that need more memory. See Sizing: CPU and Memory.

Using the CLI

The same logs are available from the Instruqt CLI, which is handy when you’re developing a lab from your terminal and want to follow events without switching to the browser.

instruqt lab logs my-team/my-lab

The command tails logs live, one event per line, showing the time, session ID, severity and message. It starts from one minute ago and shows Info, Warning and Error events by default. Use the flags below to narrow down what you see:

Flag	What it does
—session <id>	Show logs for one session or sandbox ID. Takes precedence over the lab slug.
—since <duration or timestamp>	How far back to start, e.g. -15m, -2h, or an exact time such as 2026-09-11T09:00:00Z. Default: -1m.
—severity <level>	The minimum level to show. ERROR shows only errors; WARNING adds warnings; INFO (default) adds normal events; DEBUG shows everything.
—ref <branch or tag>	Limit to one branch or tag of the lab. Can’t be combined with —session.
—invite-id <id>	Limit to one invite share.
—landing-page-id <id>	Limit to one landing page share.
—search <text>	Only show events whose message contains this text.

For example, to follow only errors on a feature branch:

instruqt lab logs my-team/my-lab --ref feature-branch --severity ERROR

Or to see the last hour of everything for one session:

instruqt lab logs --session 8a08ey7gry73 --since -1h --severity DEBUG

Note

If you’ve set a default team with instruqt auth login, you can pass just the lab slug: instruqt lab logs my-lab.

Summary

The Logs page gives you a single place to observe and troubleshoot your sessions:

• A live and historical feed of events, with new activity streaming in as it happens
• Severity levels that separate signal (errors, warnings) from detail (info, debug)
• Search, Labs / Tracks / Share filters, and a visual Timeline to find events fast
• Expandable rows and customisable columns to see exactly the detail you need
• Keyboard shortcuts for quick, hands-on-keyboard navigation
• Export what you see as JSON, or follow the same logs from your terminal with instruqt lab logs