# Query Syntax for Logs Explorer

Logs Explorer query syntax filters, groups, and visualizes logs using property prefixes, logical operators, and wildcards. Use these operators in day-to-day investigations, and adapt the examples below to your own logs.

{% callout type="info" %}
Plain text searches match only against the **log message field**, not the entire log body.
{% /callout %}

## Basics

### Property prefixes

| Prefix | Description | Example |
|--------|-------------|---------|
| `@property` | Event or log properties | `@traceId:"1a3cg5"` |
| `#property` | Reserved properties | `#custom_event:"shopping_cart_opened"` |
| `$user` | User identifiers | `$stableID:"abcdef"` |
| *none* | User properties | `tier:prod` |

### Logical operators

These are query-level connectors. They combine or negate multiple conditions.

| Operator | Description | Example |
|----------|-------------|---------|
| `AND` (case sensitive) | Match all conditions | `level:error AND service:api-gateway` |
| `OR` (case sensitive) | Match any condition | `level:error OR level:warn` |
| `!=` or `!:` | Exclude a condition | `status!:error OR service!:api-gateway` |

### Other operators

These are field-level conditions.

| Operator | Description | Example |
|----------|-------------|---------|
| `:` or `=` | equals | `status_code:200` or `status_code=200` |
| `!=` or `!:` | not equals | `level!:debug` or `level!=debug` |
| `>` `<` | greater/less than | `latency_ms>500` or `latency_ms<1000` |
| `>=` `<=` | greater/less or equal | `latency_ms>=500` or `latency_ms<=2000` |

### Wildcard search

You can use the `*` character as a wildcard in queries. A wildcard matches zero or more characters inside a field value.

{% callout type="note" %}
Wildcards can impact query performance. Use them sparingly.
{% /callout %}

### Additional examples

| Query | Description | Matches |
|-------|-------------|---------|
| `@"log.file.path":"/logs/pods/*"` | Path begins with `/logs/pods/` | `/logs/pods/1234/stdout.log` |
| `@"log.file.path":"*/logs/pods/"` | Path ends with `/logs/pods/` | `/mnt/storage/logs/pods/` |
| `service:"api-*"` | Services with names starting with `api-` | `api-gateway`, `api-auth` |
| `@route:"*products/*"` | Page routes containing the string `products/` | `shopify.com/products/tshirts`, `shopify.com/cart/products/view` |
| `@message!:""` | Return logs where the message field is **not null** | any log that has a `message` field |