Sentry expands Logs with pinning, JSONL export, and large-query handling

Sentry published a summer update for its Logs product on August 11, covering several features shipped during the quarter. The official roundup details URL-backed log pinning, a redesigned export flow with JSONL, aggregate-aware exports, faster page loading, and improved behavior for very large searches.

Investigation state becomes shareable

Pinning keeps an important row visible while an engineer scrolls or changes a query, and the pinned state is encoded in the URL. That makes a link a more precise handoff during an incident: the next responder can open the same evidence rather than reconstructing a timestamp and filter from chat.

Exports now let users select format and row count in advance. Individual rows include full attributes, while exporting an aggregate returns the aggregate being viewed instead of silently switching to raw records. JSONL is especially useful for streaming large exports into local analysis without loading a single large array.

Scale improvements still need boundary tests

Sentry says longer timeouts with continuations and clearer rate-limit handling improve searches across hundreds of gigabytes or terabytes. Teams should test their own worst-case filters and verify that continuation does not produce gaps or duplicates. A retry button improves recovery, but an investigation runbook should still distinguish a rate limit from an empty result.

The failure case is treating an exported subset as complete evidence. Record the query, time range, row limit, and export timestamp alongside the file. If an aggregate is exported, label it clearly so another tool does not interpret it as raw events.

These changes focus on the mechanics of incident work: holding a critical line, handing it to a teammate, and moving a bounded dataset into another tool. Correct provenance around those actions remains the operator’s responsibility.