Explore
Explore is an ad-hoc analytics workspace for building your own queries over Willow gateway activity and agent telemetry, without writing SQL. Compose a query with the guided builder or the text-based Willow Query Language (WQL), preview it live, and render the result as a bar chart, pie chart, time series, or table. Save any query into a Dashboard to keep it around.
Open it from Monitor > Analytics > Explore.
Explore reads from Willow's ClickHouse analytics store. There is no Postgres fallback — the page is only available when ClickHouse is serving your org. On-prem, point db-service at your instance and flip reads; see Bring your own ClickHouse. On SaaS, ask your Willow contact if you do not see Explore and Dashboards on the Analytics page.
How queries stay safe
You never write raw SQL. Both the guided builder and WQL compile to a validated query specification on the client; the backend turns that spec into a parameterized, organization-scoped ClickHouse query. Every query (and every join subquery) is automatically filtered to your organization, and only datasets, fields, and joins declared in the catalog can be referenced. You can inspect the exact generated SQL from the results panel.
Build a query
The builder has two interchangeable surfaces — the guided Query Builder and the WQL console. Editing one updates the other, so you can start in the builder and switch to text (or the reverse) at any time.
Guided Query Builder
| Control | What it does |
|---|---|
| Dataset | The source to query (for example agent telemetry / OTel metrics, events, audit logs / tool calls, conversations). |
| Metric | The aggregation: count, sum(field), avg(field), or uniq(field) (distinct count). |
| Group by | A dimension to break the metric down by (for example integration, AI client, group, or repository). |
| Over time | Bucket the metric into a time series by hourly, daily, or weekly intervals. |
| Filters | One or more field op value conditions (=, in, and so on), combined with AND. |
| Time range | A preset (last 24 hours, 7 / 30 / 90 days) or a custom start and end date. |
| Visualization | bar, pie, timeseries, or table. |
| Limit | Maximum number of rows/slices returned. |
Some dimensions come from catalog-declared joins rather than the base table — for example the Repository dimension resolves each session to its most recent git repo, so you can answer questions like "tokens spent per repository" without writing a join yourself. Array-backed dimensions such as Group are expanded so a single event can count toward each of its groups.
Filter values
To keep filtering fast, filter values are offered without scanning ClickHouse for distinct values:
- Users and groups use searchable pickers backed by your directory, with paging for large lists.
- Action, event name, integration, and AI client offer the known values as suggestions. If the value you want isn't listed, type it in manually.
Willow Query Language (WQL)
WQL is a compact text form of the same query. The console shows the syntax and examples inline.
<source> | count | sum(field) | avg(field) | uniq(field)
[by <field> | over time <hourly|daily|weekly>]
[where <field> = "value" and <field> in ("a","b")]
[from -30d to now]
[as bar|pie|table|timeseries]
[limit N]
Examples:
audit_logs | count over time daily from -30d to now as timeseries
otel_metrics | sum(tokens) by repository where group in ("platform","payments") from -7d to now as bar
Dynamic time ranges
Relative bounds such as -30d, -24h, now, and today are stored as-is and resolved to concrete timestamps each time the query runs, so a saved query always reports on a fresh, rolling window instead of freezing to the dates you first ran it. Absolute dates (a specific start and end) are used exactly as entered.
Visualize and reuse
- The preview renders with the selected visualization; switch types without rebuilding the query.
- Use View SQL to see the generated ClickHouse query.
- Add the query to a dashboard to persist it — see Dashboards.
What to do next
- Dashboards: save visuals, share filters, and arrange a board
- Analytics: the prebuilt analytics dashboard
- Logs: drill from an aggregate trend into the individual events behind it