Search
Basic Syntax
A search query is composed of one or more expressions. Each expression can be a comparison between a key and a value, or a logical combination of other expressions.
span_name=gorm.Query
You can also enter a seach value without a key to search on a default key. For logs, this would be the message
and on traces it would be the span_name
.
gorm.Query
Any custom attributes you send in logs and traces can be filters on as well.
user_id=42
Keys and Values
Keys are identifiers, which can include any combination of alphanumeric characters, underscores (_
), periods (.
), dashes (-
), and asterisks (*
).
Values can be strings with any character. In order to use spaces or special characters you must enclose the string in double quotes ("
).
Wildcards
You can use *
in values to match on part of a pattern.
span_name=gorm.*
matches allspan_name
values that start withgorm.
span_name=*.Query
matches allspan_name
values that end with.Query
span_name=*orm*
matches all values that containorm
Comparisons
Comparisons are made using operators. The following operators are supported:
=
- Equal to
!=
- Not equal to
<
- Less than
<=
- Less than or equal to
>
- Greater than
>=
- Greater than or equal to
Exist & Not Exist
You can search if a key exists or does not exist with the exists
operator. For example,
if you wanted all the traces with a connected session, you would do use the following query:
secure_session_id exists
The exists
also works with the not
keyword. An example is when you only want the root level
spans when searching traces, then you would use this query
parent_span_id not exists
Logical Combinations
Expressions can be combined using the logical operators AND
, OR
, and NOT
.
AND
- Both expressions must be true
OR
- At least one of the expressions must be true
NOT
- The following expression must be false
Note that there is an implicit AND
between all filters unless you specify an OR
directly. For example:
service_name=private-graph span_name=gorm.Query
This is equivalent to:
service_name=private-graph AND span_name=gorm.Query
Grouping Expressions
Expressions can be grouped using parentheses (
and )
. For example:
(key1=value1 AND key2=value2) OR key3=value3
You can also use parentheses to group values in an expression:
service_name=(private-graph OR public-graph)
Query Examples
Here are some examples of valid search queries:
service_name=private-graph
service_name=public-graph AND span_name!=gorm.Query
service_name=worker OR span_name=gorm.Query
service_name!=private-graph
(service_name=public-graph AND span_name=gorm.Query) OR duration>=100000
Search Segments
All of our search pages allow you to save a search and reuse it later. We call these segments. Create segments for common sets of filters you want to use across Highlight.
More Reading
See the links below for more details on searching in specific parts of the product.