Query Syntax
Here is how you search through your log events
Log event structure
In Scanner, a log event is a collection of key-value pairs called fields. In a field, the key is always a string, and the value may be either a string or a number.
For example, if you use Scanner's Elasticsearch Bulk Upload API to ingest logs, a log event document that you upload might look like this:
And the resulting Scanner log event would look like this:
Text queries
Type in free-form text to search for hits. By default, search is case insensitive for ASCII characters, so these match the same lines.
By default, tokens are matched separately, so these match the same lines.
Use single-quotes if you need to match a single string containing spaces (or if you need to match the :
character, the words and
, or
, not
, etc).
Use double-quotes for exact, case-sensitive substring matching.
Use *
for wildcard searches. You can use \*
to match the actual asterisk character instead.
Use column: value
to search for value
in column column
.
A query match will always start and stop on a whole token, and will never start or stop in the middle of one:
al
will match "Al Sharpton", but not "Walt Whitman", "Alan Turing", or "Hannibal Lecter".al*
will match "Al Sharpton" and "Alan Turing", but not "Walt Whitman" or "Hannibal Lecter".al*n
will match "Alan Turing" and "Albert Einstein", but not "Walt Whitman".
You can use escape sequences for certain characters. These work in all strings.
Escape sequence | Character |
---|---|
| double quote |
| single quote |
| asterisk |
| backslash |
| forward slash |
| backspace |
| form feed |
| line feed |
| carriage return |
| unicode character |
Number queries
If your log events have number fields, you can look for exact matches or inequalities.
Boolean queries
Scanner supports boolean queries using and
, or
, and not
. These are case-insensitive.
You can use parentheses to specify order of operations.
If parentheses aren't used, then not
has highest precedence, then and
, then or
, so these two queries are identical.
Last updated