Query syntax

Search terms are separated by spaces and ANDed together.

Cheat sheet

| Term | Matches | | ------------------- | ------------------------------------------- | | level:error | Exact level; level:>=warn for warn and up | | err:card_declined | Match a key in attrs | | customer.id:c_19 | Nested paths with dots | | latency_ms:>400 | Numeric compare: > >= < <= | | trace_id:* | Key exists | | "free text" | Words in the message | | -env:staging | Exclude anything with a leading dash |

Terms

  • level:error matches that level exactly; level:>=warn (also >, <, <=) compares by severity.
  • app:checkout matches logs from the app with that slug.
  • host:web-3, env:prod, trace_id:4f1c match those fields exactly.
  • status:500 or customer.country:CA matches a custom attribute (key.sub reaches nested keys); values are compared as text.
  • status:>=500, latency_ms:<250 compares an attribute numerically (>, >=, <, <=). Keys may not start with a digit in any segment (a.0 is invalid).
  • err:* matches logs where the attribute exists.
  • timeout or "card declined" searches the message for those words. Words split on anything that is not an ASCII letter or digit, so user_1 searches user and 1; non-ASCII words are matched whole. Free-text search is case-sensitive (timeout does not match Timeout).
  • -env:staging or -timeout negates a term.

Gotchas

Bare text containing : (such as 12:30) is read as key:value, so quote it ("12:30"). Values with spaces must be quoted (msg:"a b"). Syntax errors report the byte position of the offending term.

Example

level:>=warn app:checkout -env:staging "card declined" status:>=500