Logs
Contents
Logs is an OpenTelemetry-native log store, so there are no PostHog-specific SDKs to adopt – point any OTLP client at PostHog and your log records start arriving. Search them by service, severity, and attribute, group similar lines into patterns to see what changed, and open any record to have PostHog AI explain it.
Because your logs live next to the rest of your data, a log line is one click from the session replay, person, and error it belongs to. Log alerts also feed Self-driving, so a recurring failure becomes a report you can act on instead of a page you ignore.
Where you can use it
You search and investigate logs in the web app. The other surfaces are for pulling log context into the tools you already work in.
PostHog MCP
Let your coding agent query logs, mine patterns, and manage alerts from your editor.
Debug logs →PostHog Desktop Beta
Review the Self-driving reports your firing alerts and shifting log patterns generate.
Review reports →Where its data comes from
Everything in Logs is derived from the log records you send over OTLP. How useful they are depends on what you attach to them.
Services
Every record carries a service.name, which is how logs are grouped, faceted, and alerted on.
Attributes
Log and resource attributes become the facets you filter on – and the fields PII scrubbing protects.
Structure your logs →Session replay and persons
Add a session ID and distinct ID and each log line links to the replay and person behind it.
Link your logs →Patterns
PostHog masks the variable parts of your messages and clusters them into templates you can diff over time.
See log patterns →How Logs works with Self-driving
When a log alert fires, it emits a signal into Self-driving. Recurring failures get grouped into a report with the logs behind them. PostHog also sweeps your logs for shifts nobody wrote an alert for – new message patterns, volume bursts, severity shifts, and services that go quiet – and writes those up as reports too.
The logs scout stops at the report. A log shift is usually an investigation rather than a one-line code change, so it doesn't open a pull request on its own – unlike error tracking, where a stack trace often points at a specific file. You investigate in the web app and read the reports in the Self-driving inbox or PostHog Desktop. See the Self-driving docs for the full picture.