Documentation | Tencent Cloud

Recent Pages

Syntax and Rules

Last updated: 2021-04-12 19:26:54

Syntax (Lucene)

Reserved Keyword	Description
__SOURCE__	It is used to search for logs from a specified source, and wildcard is supported, such as `__SOURCE__:"127.0.0.*"`.
__FILENAME__	It is used to search for logs from a specified file, and wildcard is supported, such as: Full match: `__FILENAME__:"/var/log/access."` Fuzzy match: `__FILENAME__:/var/log/access.`
AND	Logical AND operator, such as `level:ERROR AND pid:1234`.
OR	Logical OR operator, such as `level:ERROR OR level:WARNING`.
NOT	Logical NOT operator, such as `level:ERROR NOT pid:1234`.
TO	Logical TO operator, such as `request_time:[0.1 TO 1.0]`.
""	Double quotation marks, which quote a phrase, such as `name:"john Smith"`.
:	Colon, which is used for key-value search, such as `level:ERROR`.
*	Wildcard, which can match zero, one, or multiple characters, such as `host:www.test*.com`.
?	Wildcard, which can match one single character, such as `host:www.te?t.com`.
()	Grouping operator, which controls the precedence of logical operations, such as `(ERROR OR WARNING) AND pid:1234`.
>	Range operator, which indicates the left operand is greater than the right operand, such as `status:>400`.
>=	Range operator, which indicates the left operand is greater than or equal to the right operand, such as `status:>=400`.
<	Range operator, which indicates the left operand is less than the right operand, such as `status:<400`.
<=	Range operator, which indicates the left operand is less than or equal to the right operand, such as `status:<=400`.
[]	Range operator, which includes the upper and lower boundary values, such as `age:[20 TO 30]`.
{}	Range operator, which excludes the upper and lower boundary values, such as `age:{20 TO 30}`.
\	Escape character. An escaped character represents the literal meaning of the character, such as`url:\/images\/favicon.ico"`.
+	Logical operator (similar to AND).The term `+A` indicates `A` must exist, such as `+level:ERROR +pid:1234`.
-	Logical operator (similar to NOT). The term `-A` indicates `A` must not exist, such as `+level:ERROR -pid:1234.
\|\|	Logical operator (similar to OR), such as `level:ERROR \|\| level:WARNING`.
&&	Logical operator (similar to AND), such as `level:ERROR && pid:1234`.
!	Logical operator (similar to NOT), such as `level:ERROR !pid:1234`.
/	Regular expression identifier in the format of `/${regExp}/`. For example, `/[mb]oat/` means to return results containing `moat` or `boat`.
_exists_	`\_exists\_:key` returns results where the `key` value is not empty. For example, `_exists_:userAgent` means to return results where the `userAgent` value is not empty.
~	Fuzzy search. For example, `level:errro~` means to return results where `level` contains `error`.

Note：

The syntactic operators are case-sensitive. For example, AND and OR represent logical search operators, while and and or are regarded as common words.

When multiple search statements are connected with spaces, they are regarded as in the OR logic. For example, warning error indicates to return results containing the warning keyword or error keyword.

All the characters in the syntax are reserved characters. If a search keyword contains these syntactically reserved characters, they need to be escaped.

Before performing a key:value search, make sure the key is configured in the index configuration of the log topic.

Search Statement Examples

Expected Search Result	Search Statement
Logs containing `ERROR`	`ERROR`
Failed logs (with a status code greater than 400)	`status:>400`
Failed logs in the `GET` request (with a status code greater than 400)	`method:GET AND status:>400`
Logs at `ERROR` or `WARNING` level	`level:ERROR OR level:WARNING`
Logs except those at `INFO` level	`NOT level:INFO`
Logs from `192.168.10.10` but except those at `INFO` level	`__SOURCE__:192.168.10.10 NOT level:INFO`
Logs from the `/var/log/access.log` file on `192.168.10.10` but except those at `INFO` level	`(__SOURCE__:192.168.10.10 AND __FILENAME__:"/var/log/access.*") NOT level:INFO`
Logs from `192.168.10.10` and at `ERROR` or `WARNING` level	`__SOURCE__:192.168.10.10 AND (level:ERROR OR level:WARNING)`
Logs with a status code of `4XX`	`status:[400 TO 500}`
Logs with the container name `nginx` in the metadata	`__TAG__.container_name:nginx`
Logs with the container name `nginx` in the metadata, and request latency greater than 1s	`__TAG__.container_name:nginx AND request_time:>1`
Logs that contain the `message` field, or whose `message` field has a value	`message:*` or `_exists_:message`
Logs that do not contain the `message` field	`NOT _exists_:message`
Logs whose `message` field is empty	`message:""`