diff --git a/images/resources/view-instance-logs-with-filters.png b/images/resources/view-instance-logs-with-filters.png
new file mode 100644
index 00000000..aa579514
Binary files /dev/null and b/images/resources/view-instance-logs-with-filters.png differ
diff --git a/images/resources/view-instance-logs.png b/images/resources/view-instance-logs.png
index bf56b075..14c43cd6 100644
Binary files a/images/resources/view-instance-logs.png and b/images/resources/view-instance-logs.png differ
diff --git a/maintenance-ops/monitoring-and-alerting.mdx b/maintenance-ops/monitoring-and-alerting.mdx
index 30faee38..5657b48e 100644
--- a/maintenance-ops/monitoring-and-alerting.mdx
+++ b/maintenance-ops/monitoring-and-alerting.mdx
@@ -100,24 +100,143 @@ Access instance logs through the [PowerSync Dashboard](https://dashboard.powersy
 
 You can manage logs with the following options:
 
-* **Filter Options**: Filter logs by level (`Note`, `Error`, `Warning`, `Debug`) and by date range.
+* **Log Type**: Switch between **API logs** (from the PowerSync Service) and **Replication logs**.
+* **Log Levels**: Show or hide `Info`, `Error`, `Warn`, and `Debug` entries.
+* **Time Range**: Limit results to a relative window (last 15 minutes, last hour, etc.) or a custom range. The available window depends on your plan's retention period.
+* **Sort Order**: Sort by newest or oldest first.
+* **Display Options**: Show metadata pills on each entry, show stack traces for errors, and tail logs in real time.
 
-* **Sorting**: Sort logs by newest or oldest first.
+### Search and Filter Logs
 
-* **Metadata**: Display metadata like `user_id` and `user_agent` in the logs if available.
+<Frame>
+  <img src="/images/resources/view-instance-logs-with-filters.png" />
+</Frame>
+
+The **Search** input above the log list accepts free-text terms and structured `alias:value` filters. Type a query and the results update as you type.
+
+#### Free-Text Search
+
+Type bare words to match anywhere in the raw log entry. Matching is case-insensitive, and every word must match (AND):
+
+```
+checkpoint stream
+```
+
+Wrap a phrase in double quotes to match the exact sequence:
 
-* **View Mode**: Tail logs in real-time or view them statically.
+```
+"sync stream complete"
+```
+
+Free-text search matches against the full entry, including the message text and every metadata property. This is independent of the **Display Options** toggle that controls whether metadata pills are rendered, so a match on a metadata value still returns the entry even if the pills in the UI are hidden.
+
+#### Property Filters
+
+Use `alias:value` to filter on a specific property. Unlike free-text search, a property filter only matches the named property, not the rest of the log entry. Repeating the same alias matches any of the listed values (OR within a property, AND across properties):
+
+```
+user_id:<user-id-a> user_id:<user-id-b> error:PSYNC_S2001
+```
 
-* **Stack Traces**: Option to show or hide stack traces for errors.
+Quote values that contain spaces:
+
+```
+close_reason:"client closing stream"
+```
+
+The following aliases are supported for API logs. For most properties the alias matches the canonical property name; `error` and `lag` keep a short form because their underlying paths are awkward to type. You can also type the short aliases shown in parentheses; they are normalised to the canonical name on submit.
+
+| Alias                | Property       | Description                                              |
+| -------------------- | -------------- | -------------------------------------------------------- |
+| `user_id` (`user`)   | `user_id`      | The authenticated user ID for the sync session.          |
+| `client_id` (`client`) | `client_id`  | The client device ID.                                    |
+| `rid` (`request`)    | `rid`          | The request ID. Matches a started or complete entry.     |
+| `error`              | `error_code`   | A specific PSYNC error code (see [Error Codes](/debugging/error-codes)). |
+| `close_reason` (`reason`) | `close_reason` | Why the sync session closed.                          |
+
+For Replication logs:
+
+| Alias | Property          | Description                                                                  |
+| ----- | ----------------- | ---------------------------------------------------------------------------- |
+| `lag` | `replication_lag` | Replication lag in seconds. Used with a numeric comparison (see below). |
+
+#### Numeric Comparisons
+
+The `lag` filter accepts `>`, `>=`, `<`, `<=`, and `=`:
+
+```
+lag:>=5
+```
+
+Only one numeric comparison is allowed per property. Combining `lag:>5 lag:<10` is rejected.
+
+#### Filtering on Other Properties
+
+The **Property filters** button in the toolbar lists the aliases for the active log type. Log entries can contain many additional properties, and you can filter on any of them using `alias:value` syntax directly in the search bar. For example:
+
+```
+buckets:1
+```
+
+Filters are evaluated against the matching property on each log entry.
+
+You can also add a metadata property as a filter directly from any log entry. Enable the **Metadata** display option to render each entry's structured properties as pills. Click a pill to open its menu and choose **Add filter**:
+
+
+This is the quickest way to filter on properties you spot in the logs without remembering their names.
+
+#### Combined Example
+
+You can mix free-text terms, known aliases, and unknown properties in a single query:
+
+```
+checkpoint sync user_id:123 checkpoint:>=1224
+```
+
+This matches entries containing both `checkpoint` and `sync` in the message, with `user_id` equal to `123` and a `checkpoint` property greater than or equal to `1224`.
+
+### Export Logs
+
+Click the **Download** button on the right side of the toolbar to export the currently visible log entries to a CSV file. The export reflects the active log type, time range, log levels, and search query, so you can narrow the result set before downloading.
+
+The CSV uses fixed columns for the most useful fields and collapses anything else into a trailing `metadata` JSON column:
+
+| Column         | Description                                                                 |
+| -------------- | --------------------------------------------------------------------------- |
+| `timestamp`    | ISO 8601 timestamp of the entry.                                            |
+| `level`        | Log level (`info`, `error`, `warn`, `debug`).                                |
+| `message`      | Formatted log message.                                                       |
+| `user_id`      | Authenticated user ID (API logs).                                            |
+| `client_id`    | Client device ID (API logs).                                                 |
+| `rid`          | Request ID (API logs).                                                       |
+| `error_code`   | PSYNC error code if the entry has one.                                       |
+| `close_reason` | Close reason for sync session entries.                                       |
+| `metadata`     | JSON object containing every other top-level field on the entry.             |
+
+The file is named `powersync-logs-<instance-id>-<timestamp>.csv` where `<timestamp>` is the export time in UTC.
+
+<Note>
+  The export only includes entries currently loaded in the view. If you have not scrolled to load more entries with **Load More**, those entries are not included in the CSV.
+</Note>
 
 ### Correlating Sync Sessions
 
-To find a specific users session in the Service logs, filter on their `user_id`. Two events describe each sync session:
+To find a specific user's session in the API logs, search for their `user_id`:
+
+```
+user_id:<user-id>
+```
+
+Two events describe each sync session:
 
 * **Sync stream started**: logged when the client connects. Fields include `user_id`, `client_id`, `app_metadata` (if set), `client_params`, `user_agent`, and `rid` (request id).
 * **Sync stream complete**: logged when the session ends. Fields include `user_id`, `client_id`, `app_metadata` (if set), `operations_synced`, `operation_counts` (broken down by `put`, `remove`, `move`, `clear`), `data_synced_bytes`, `data_sent_bytes`, `stream_ms` (session duration), `close_reason`, and `rid`.
 
-Both events share the same `rid`, so a started/complete pair for a single session can be matched by filtering on it.
+Both events share the same `rid`, so you can match a started/complete pair for a single session by searching for it:
+
+```
+rid:<request-id>
+```
 
 For diagnosing sync latency, see [Diagnosing Sync Latency](/debugging/troubleshooting#diagnosing-sync-latency).
 
@@ -286,6 +405,14 @@ Custom metadata appears in the **Service/API logs** section of the [PowerSync Da
   Make sure the **Metadata** checkbox is enabled in the logs view to see custom metadata in log entries.
 </Note>
 
+To filter on a custom metadata key in the search bar, prefix it with `app_metadata_`. For example, for `{ region: 'us-east' }`:
+
+```
+app_metadata_region:us-east
+```
+
+The same prefix applies when clicking **Add filter** on a custom metadata pill.
+
 Note the following when using custom metadata:
 
 * Keep metadata values concise. `app_metadata` is limited to 20 keys, with each string value capped at 100 characters.