Find Logs for an Execution
The most common debugging task: a workflow execution failed (or is behaving unexpectedly) and you need to find all log lines associated with that specific execution — across all services and nodes. This page walks through the complete LogQL query pattern for BizFirstGO executions.
Step-by-Step: Find Execution Logs
Get the execution ID
The execution ID is in the error report, the Slack alert message, or the user's bug report. Format: exec-a1b2c3d4 or a UUID. If you only have the workflow ID, start with step 2b instead.
Open Grafana Explore → Select Loki
Navigate to Grafana Explore. Select data source: Loki. Set time range to cover the incident period (start with "Last 1 hour" and widen if needed).
Run the execution ID query
# Query all log lines containing the execution ID across all BizFirstGO services:
{job=~"processengine|edgestream|octopus|flow-studio-api"} |= "exec-a1b2c3d4"
# Or narrow to just the ProcessEngine:
{job="processengine", environment="production"} |= "exec-a1b2c3d4"
# Scope to a specific tenant:
{job="processengine", tenant_id="tenant-abc"} |= "exec-a1b2c3d4"Parse the JSON log lines
# Parse log body as JSON to get structured fields in the log viewer:
{job="processengine"} |= "exec-a1b2c3d4" | json
# Now you can filter by specific fields:
{job="processengine"} |= "exec-a1b2c3d4" | json | level = "error"
# Find which node failed:
{job="processengine"} |= "exec-a1b2c3d4" | json | nodeType != ""Find the TraceId in the log output
Click on a log line to expand it. Look for the traceId field. Click the TraceId Derived Field link — it opens the trace in a split view (Tempo). Now you can see both the log context and the trace waterfall simultaneously.
Finding by Workflow ID Instead of Execution ID
# If you only know the workflow definition ID (not the specific execution):
{job="processengine", environment="production"} |= "workflowId=wf-payroll-approval"
| json
| line_format "{{.executionId}} {{.level}} {{.message}}"
# This shows you all recent executions of that workflow.
# Find the failing execution ID from the results, then use the query above.Reading the Execution Log Timeline
# Order logs chronologically and view the execution lifecycle:
{job="processengine"} |= "exec-a1b2c3d4" | json
| line_format "{{.timestamp}} [{{.level}}] {{.nodeType}}: {{.message}}"
# Expected log sequence for a successful execution:
# 2025-05-25T10:00:00Z [info] ProcessEngine: Execution started
# 2025-05-25T10:00:01Z [info] HttpRequestNode: Making HTTP call to external API
# 2025-05-25T10:00:02Z [info] HttpRequestNode: Response received (200 OK)
# 2025-05-25T10:00:02Z [info] ApprovalNode: Suspending for HIL approval
# 2025-05-25T10:05:00Z [info] ApprovalNode: Approval received from Manager
# 2025-05-25T10:05:01Z [info] ProcessEngine: Execution completed
# For a failed execution:
# 2025-05-25T10:00:00Z [info] ProcessEngine: Execution started
# 2025-05-25T10:00:01Z [info] HttpRequestNode: Making HTTP call
# 2025-05-25T10:00:31Z [error] HttpRequestNode: Timeout after 30000ms
# 2025-05-25T10:00:31Z [error] ProcessEngine: Execution failed: node timeoutIf the query returns no results: (1) Check the time range — widen it. (2) Verify the execution ID format matches what is in the logs — try partial match: |= "a1b2c3d4" (without the "exec-" prefix). (3) Check that the job label is correct for your deployment. (4) Confirm Loki ingestion is working by running a simpler query like {job="processengine"} | limit 10.