Search operators :: Kloudfuse Docs

Search operators

Table of Contents

and, and

Intersection operator (AND logic) between two search operators. Selects results that satisfy both conditions.

Syntax

facetName1="value1" facetName2="value2"

@facetName1="value1" and @facetName2="value2"

Example

.and operator for facet

level="info" header="map"

@level="info" and @header="map"

or, or

Union operator (OR logic) between two search operators. Selects results that satisfy either or both conditions.

Syntax

@facet="valueA OR valueB"

@facet="valueA" or @facet="valueB"

Example

or operator for facet

level="info OR warning"

@level="info" or @level="warning"

equal, =

Searches for specified value; exact match.

Syntax

label="value"
@facetName="value"

Example

equal operators with facet and label

@http_request_method="POST" and source="nginx"

not equal, !=

Searches for values other than the specified value; exact match.

Syntax

label!="value"
@facetName!="value"

Example

not equal operators with facet and label

@facetName!="pinot-server" and level!="info"

greater than, >

Searches for values that are greater than the specified number.

Syntax

@facetName>number

Example

greater than operator with facet

@status_1>300 and source="logs-query-service"

greater than or equal, >=

Searches for values that are greater than or equal to the specified number.

Syntax

@facetName>=number

Example

greater than or equal operator with facet

@status_1>=200 and source="logs-query-service"

less than, <

Searches for values that are less than the specified number.

Syntax

@facetName<number

Example

less than operator with facet

@status_1<500 and source="logs-query-service"

less than or equal, <=

Searches for values that are less than or equal to the specified number.

Syntax

@facetName<=number

Example

less than or equal operator with facet

@status_1<=700 and source="logs-query-service"

regex, =~

Searches for results that match a specific character pattern.

Syntax

label=~"value"
@facetName=~"value"

Example

regex operator with label and facet

availability_zone=~"us" and @partition=~"metadata"

not regex, !~

Searches for results that do not match a specific character pattern.

Syntax

label!~"value"
@facetName!~"value"

Example

not regex operator with facet

availability_zone=~"west" and @partition=!~"metadata"

terms exist, term

Matches complete tokens in the log message body. Terms are based on the tokenized words in the message body. All terms must appear in the log line, in any order. Fast and inexpensive.

Syntax

token1 token2 token3

Example

term exist

container

not terms exist, !term

Excludes log lines that match complete tokens. Terms are determined by tokenization. All terms must appear in the log line, in any order, for the line to be excluded.

Syntax

!token

Example

no term exist

!container

grep, "grep"

Searches for a literal, case-sensitive substring in the log message body. Unlike term, this matches character sequences rather than whole tokens, so it can match partial words and phrases.

Syntax

"expression"

Example

grep expression

"forward NR traces payload"

not grep, !"grep"

Excludes log lines containing a literal, case-sensitive substring in the log message body.

Syntax

!"expression"

Example

not grep expression

!"forward NR traces payload"

facet terms exist, ==

Searches to match a specific facet and its value.

Syntax

@facet=="value"

Example

facet terms exist

@traceFlags=="1"

facet terms not exist, !==

Searches to exclude a specific facet and its value.

Syntax

@facet!=="value"

Example

facet terms not exist

@traceFlags!="1"

starts with, *~

Searches for labels or facets where the value begins with the specified string.

Syntax

label*~"value"
@facet*~"value"

Example

starts with operator for facet and label

kube_container_name*~"recommendation" and @trace_sampled*~"T"

ends with, ~*

Searches for labels or facets where the value ends with the specified string.

Syntax

label~*"value"
@facet~*"value"

Example

ends with operator for facet and label

@resource_service_name~*"service" and agent~*"dog"

contains, **

Searches for labels or facets where the value contains the specified string.

Syntax

label**"value"
@facet**"value"

Example

.contains operator for facet and label

@ids**"9SIQT8TOJO" and kube_deployment**"otel"

key exists

Searches for the presence of a specific facet, regardless of its value.

Syntax

key exists = "facet"

Example

key exists operator for facet

key exists="user_agent_original"

@user_agent_original