Query Log

The Query Log is a row-level record of every query that passes through Xilos. Each entry captures the full lifecycle of a request — from the original prompt, through governance and orchestration, to the response, compression statistics, and cost.

Use the Query Log to investigate a specific query, audit a governance action, verify a routing decision, or export records for offline analysis.

Query Log Fields

Each row in the Query Log represents one query and exposes the following fields.

Query

The original prompt exactly as the user submitted it. This is the raw input before any improvement, rewriting, or compression is applied.

Improved Query

The version of the query after Xilos has processed it. This may include rewritten phrasing, injected context from the Context Engine, or structural changes applied by the Orchestrate pillar. When no improvement is applied, this field mirrors the original query.

Response

The response returned to the user. This is the final output after the selected model has generated it and Xilos has delivered it through the API.

Governance Actions

A record of every action the Secure pillar applied to the query, with the rule that triggered each action. Actions include:

• Block — The query was prevented from reaching the model.
• Mask — Sensitive information was concealed before the query reached the model.
• Flag — The query was allowed to proceed, and an alert was generated for monitoring.

Each action lists the rule name, the severity level, and the trigger phrase that matched.

Compression Statistics

Token-level statistics showing how the Orchestrate pillar transformed the prompt before it reached the model:

• Input tokens — Token count of the prompt sent to the model.
• Original tokens — Token count of the prompt before compression.
• Reduction — Percentage of tokens removed by compression.

Info: Compression typically reduces token count by 50–90%, which directly lowers inference cost. The Query Log shows the exact reduction achieved for each query.

Cost

A cost breakdown for the query, including:

• Input cost — Cost of the input tokens sent to the model.
• Output cost — Cost of the tokens generated by the model.
• Cache savings — Cost avoided when a cached response was served instead of calling the model.
• Total cost — The sum charged to the tenant for this query.

Costs are calculated against the pricing of the selected model and are isolated per tenant.

Filtering & Search

The Query Log supports filtering to narrow the list to relevant rows.

By Treatment

Filter by governance action — show only Blocked, Flagged, Masked, or Unrestricted queries.

By Model

Filter by the LLM that processed the query. Useful for comparing cost or quality across models.

By Tenant

In multi-tenant deployments, filter to a specific tenant. Users with access to a single tenant see only that tenant's queries.

By Time

Filter by date or time range to focus on a specific window of activity.

By Text

Full-text search across the Query and Improved Query fields to find prompts that mention a specific term or phrase.

Filters can be combined. For example, filter to Blocked queries on a specific model within a date range to audit a restriction rule's behavior.

Expanded View

Each row can be expanded to show the complete query lifecycle in detail. The expanded view includes:

1. Original query — The full text of the user's prompt.
2. Improved query — The rewritten or enriched version sent to orchestration.
3. Routing decision — The target model selected, the routing rule that matched, and the confidence score.
4. Governance actions — Each action applied, with the rule name, severity, and trigger phrase.
5. Compression breakdown — Input tokens, original tokens, and reduction percentage.
6. Model response — The full response text returned to the user.
7. Cost breakdown — Input, output, cache savings, and total cost.

Info: The expanded view is the fastest way to understand why a query was routed, blocked, or masked. When a user reports an unexpected result, start here.

Export

The Query Log can be exported for offline analysis, compliance archiving, or import into a SIEM (Security Information and Event Management) system.

• Format — Export as CSV.
• Scope — Export the current filtered view, or export all rows for the selected time range.
• Fields — All Query Log fields are included in the export, including governance actions, compression statistics, and cost.

Warning: Exports include the full text of queries and responses. Handle exported files with the same access controls you apply to the Query Log itself.

Next Steps

• Review the Dashboards for aggregate views of the same data.
• Configure Cost Controls to set budgets and model limits.
• Inspect Restriction Rules to understand why a query was blocked, masked, or flagged.