Search operators

FuseQL search operators enable both regular and advanced log search (after you choose the Advanced Search option). The language specifies the following syntactical rules:

• The search operator must appear before the first pipe (|) symbol in the query expression.
• All other operators must follow a valid search expression.

and

and

Intersection operator (AND logic) between two search operators. Selects results that satisfy both conditions.

Syntax

There is a difference in syntax for the operator between regular search and advanced search.

• Regular search

  facetName1="value1" facetName2="value2"

• Advanced search

  @facetName1="value1" and @facetName2="value2"

Example

• Regular search

  level="info" header="map"

• Advanced search

  @level="info" and @header="map"

or

or

Union operator (OR logic) between two search operators. Selects results that satisfy either or both conditions.

Syntax

There is a difference in syntax for the operator between regular search and advanced search.

• Regular search

  @facet="valueA OR valueB"

• Advanced search

  @facet="valueA" or @facet="valueB"

Example

• Regular search

  level="info OR warning"

• Advanced search

  @level="info" or @level="warning"

equal, =

Searches for specified value; exact match.

Syntax

label="value"
@facetName="value“

Example

@http_request_method="POST" and source="nginx"

not equal, !=

Searches for values other than the specified value; exact match.

Syntax

label!="value"
@facetName!="value“

Example

@facetName!="pinot-server" and level!="info"

greater than, >

Searches for values that are greater than the specified number.

Syntax

@facetName>number

Example

@status_1>300 and source="logs-query-service"

greater than or equal, >=

Searches for values that are greater than or equal to the specified number.

Syntax

@facetName>=number

Example

@status_1>=200 and source="logs-query-service"

less than, <

Searches for values that are less than the specified number.

Syntax

@facetName<number

Example

@status_1<500 and source="logs-query-service"

less than or equal, <=

Searches for values that are less than or equal to the specified number.

Syntax

@facetName<=number

Example

@status_1<=700 and source="logs-query-service"

regex, =~

Searches for results that match a specific character pattern.

Syntax

label=~"value"
@facetName=~"value“

Example

availability_zone=~"us" and @partition=~"metadata"

not regex, !~

Searches for results that do not match a specific character pattern.

Syntax

label!~"value"
@facetName!~"value“

Example

availability_zone=~"west" and @partition=!~"metadata"

terms exist, term

Matches complete tokens in the log message body. Terms are based on the tokenized words in the message body. All terms must appear in the log line, in any order. Fast and inexpensive.

Syntax

token1 token2 token3

Example

container

not terms exist, !term

Excludes log lines that match complete tokens. Terms are determined by tokenization. All terms must appear in the log line, in any order, for the line to be excluded.

Syntax

!term

Example

!container

grep, "grep"

Searches for a literal, case-sensitive substring in the log message body. Unlike term, this matches character sequences rather than whole tokens, so it can match partial words and phrases.

Syntax

"expression"

Example

"forward NR traces payload"

not grep, !"grep"

Excludes log lines containing a literal, case-sensitive substring in the log message body.

Syntax

!"expression"

Example

!"forward NR traces payload"

facet terms exist, ==

Searches to match a specific facet and its value.

Syntax

@facet=="value"

Example

@traceFlags=="1"

facet terms not exist, !==

Searches to exclude a specific facet and its value.

Syntax

@facet!="value"

Example

@traceFlags!="1"

starts with, *~

Searches for labels or facets where the value begins with the specified string.

Syntax

label*="value"
@facet*="value"

Example

kube_container_name*~"recommendation" and @trace_sampled*~"T"

ends with, ~*

Searches for labels or facets where the value ends with the specified string.

Syntax

label~*="value"
@facet~*="value"

Example

@resource_service_name~*"service" and agent~*"dog"

contains, **

Searches for labels or facets where the value contains the specified string.

Syntax

label**"value"
@facet**"value"

Example

@ids**"9SIQT8TOJO" and kube_deployment**"otel"

key exists

Searches for the presence of a specific facet, regardless of its value.

Syntax

There is a difference in syntax for the operator between regular search and advanced search.

• Regular search

  key exists = "facet"

• Advanced search

  @facet

Example

• Regular search

  key exists="user_agent_original"

• Advanced search

  @user_agent_original