ELF Browser

Browse and query Salesforce Event Log Files with SQL

ELF Browser is a Manifest extension that turns Event Log Files into a queryable SQL surface inside your browser, while you're already logged into your org. Salesforce's Event Monitoring product exposes almost everything you'd want to know about what's happening inside an org — Logins, API calls, Apex executions, Aura/LWC requests, Visualforce page loads, ReportExports, and dozens of other event types — through the `EventLogFile` SObject. The actual data lives in the `LogFile` field as CSV, and the column schema is different for every `EventType`. # What you actually see - SQL editor with sensible defaults and one-click example presets (login counts per user, top API URIs, Aura requests over time, etc.). - Results table for raw rows. - Chart view — append `| CHART <x> <y>` to your SQL and get a Chart bar/line chart on the spot. - Timechart view — `| timechart span=1h count(URI) by URI` to bucket events into time windows and split by a field. - Time range picker — pick a window and the extension figures out which `LogDate` files it needs. - Connection status in the header so you always know which org you're talking to, with a dedicated Settings page for switching. # Who it's for - Salesforce platform engineers debugging performance: filter `EVENT_TYPE = 'Apex'` or `'API'`, group by `RUN_TIME`, `CPU_TIME`, or `URI`. - Admins and security folks auditing logins, failed logins, report exports, and data access without standing up a SIEM pipeline. - Integration developers chasing API consumers — `EVENT_TYPE = 'API'`, group by `CLIENT_NAME` or `URI`, chart it over time. - Anyone evaluating Event Monitoring before committing to a heavier downstream pipeline (Tableau, Splunk, Datadog). # What it deliberately doesn't do - It doesn't store ELF data outside your browser. No backend, no cloud relay — the data path is `your browser → Salesforce → DuckDB-WASM → you`. - It doesn't replace long-term archival. Standard orgs only retain Event Log Files for 24 hours, so for retention you still want a scheduled pipeline. ELF Browser is the interactive exploration tool that sits on top of whatever live data your org currently exposes.