diff --git a/docs/swarm/services.md b/docs/swarm/services.md
index bb5dc93e..56764f15 100644
--- a/docs/swarm/services.md
+++ b/docs/swarm/services.md
@@ -99,6 +99,29 @@ Neither container is reachable except through the gateway: both bind
 loopback, and VictoriaMetrics' write endpoint takes no credential, so
 the collector is the only intended writer.
 
+### Logs (VictoriaLogs)
+
+The swarm's service containers ship their journals to one VictoriaLogs at
+`logs.<swarm-domain>`, behind the same SSO as everything else. It follows
+`swarm.enableRequiredServices` too, and the collector below is what writes
+to it.
+
+**Reading them.** Open Grafana, pick **Explore**, and choose the
+`VictoriaLogs` datasource — it is provisioned for you. Grafana's *Logs
+Drilldown* app is deliberately not installed: it only supports Loki, and
+no setting here changes that, so Explore is the log browser for this
+swarm.
+
+| Option | When you'd touch it |
+|---|---|
+| `swarm.victorialogs.retentionPeriod` | Default `30d`, far shorter than the metrics store's — logs are bulkier per unit of value and are usually read within days of being written. Raise it if you need to answer questions about last quarter. |
+| `swarm.victorialogs.domain` | Only to rename it. |
+| `swarm.victorialogs.port` | Only if something else on the services host already claims `9428`. |
+
+Like the metrics store, it binds loopback and takes no credential of its
+own: the gateway vhost is the only way in, and the collector is the only
+intended writer.
+
 ### Telemetry collector (OTEL)
 
 The swarm's collector receives from every hive's own collector and is the