Logs - Hilt Documentation

Logs is labeled Logs in the sidebar and lives at /investigate. Two tabs: Investigate and Data lineage. Estate (Linux vs macOS) comes from the host-scope panel, not a page toggle.

Tab: Investigate

Event search. Scope a time window and hosts, narrow with structured filters, and read process-grouped events chronologically. Finding pages and collector/person sheets land here. Filter tabs:

Tab	What you filter on
Event	Event types (process, files, network, workloads)
Process	Command, parent, PIDs, UID, user, workload
Network	IPs, ports, protocol, bytes
File	Path prefix, flags, permissions
Topology	Program / session / process instance IDs
Location	Hosts, boot ID, container, pod
User / Application	macOS only

Time presets and a custom range bound the search. The page enforces a practical maximum window (typically 24 hours).

Tab: Data lineage

What led to it. Linux: data-flow / session graphs. macOS: process lineage. One machine at a time. This is the former standalone Data lineage page (/data/lineage still redirects here).

Finding queues → Anomalies
Host sheet → Collectors
Person sheet → People
Natural-language Ask → Query

Last modified on October 8, 2026