Query Syntax for Logs Explorer
Filter, group, and visualize logs with precision.
Logs Explorer query syntax filters, groups, and visualizes logs using property prefixes, logical operators, and wildcards. Use these operators in day-to-day investigations, and adapt the examples below to your own logs.
Plain text searches match only against the log message field, not the entire log body.
Basics
Property prefixes
| Prefix | Description | Example |
|---|---|---|
@property | Event or log properties | @traceId:"1a3cg5" |
#property | Reserved properties | #custom_event:"shopping_cart_opened" |
$user | User identifiers | $stableID:"abcdef" |
| none | User properties | tier:prod |
Logical operators
These are query-level connectors. They combine or negate multiple conditions.
| Operator | Description | Example |
|---|---|---|
AND (case sensitive) | Match all conditions | level:error AND service:api-gateway |
OR (case sensitive) | Match any condition | level:error OR level:warn |
!= or !: | Exclude a condition | status!:error OR service!:api-gateway |
Other operators
These are field-level conditions.
| Operator | Description | Example |
|---|---|---|
: or = | equals | status_code:200 or status_code=200 |
!= or !: | not equals | level!:debug or level!=debug |
> < | greater/less than | latency_ms>500 or latency_ms<1000 |
>= <= | greater/less or equal | latency_ms>=500 or latency_ms<=2000 |
Wildcard search
You can use the * character as a wildcard in queries. A wildcard matches zero or more characters inside a field value.
Wildcards can impact query performance. Use them sparingly.
Additional examples
| Query | Description | Matches |
|---|---|---|
@"log.file.path":"/logs/pods/*" | Path begins with /logs/pods/ | /logs/pods/1234/stdout.log |
@"log.file.path":"*/logs/pods/" | Path ends with /logs/pods/ | /mnt/storage/logs/pods/ |
service:"api-*" | Services with names starting with api- | api-gateway, api-auth |
@route:"*products/*" | Page routes containing the string products/ | shopify.com/products/tshirts, shopify.com/cart/products/view |
@message!:"" | Return logs where the message field is not null | any log that has a message field |
Was this helpful?