Advanced log query syntax

Use advanced query mode

Open the Logs Explorer and select Advanced above the query panel. Switching from Simple converts the current free-text search and filters into an advanced query. A converted contains filter can return different results because advanced : queries use analyzed phrase matching.

Select Search to run the query. You can also press Ctrl+Enter on Windows or Linux, or Command+Enter on macOS. The editor completes field names from the current log index and shows each field’s mapped type. Enter values manually; value completion is not available.

Switching back to Simple asks for confirmation and discards the advanced query. Osuite does not convert an advanced query back into simple filters.

Query structure

An advanced query contains field predicates, bare words, or groups joined by explicit Boolean operators. Boolean keywords are case-insensitive.

Syntax	Meaning
a and b	Match both expressions.
a or b	Match either expression.
not a	Exclude matches for the expression.
(a or b) and c	Evaluate the parenthesized expression first.

Precedence is not, then and, then or. For example, this syntax-only expression is read as a:1 or (b:2 and (not c:3)):

a:1 OR b:2 AnD NoT c:3

Replace a, b, and c with fields offered by the editor. Parentheses override precedence:

(a:1 or b:2) and c:3

Operators must be explicit. Two adjacent expressions are invalid:

timeout error

Write timeout and error instead.

Match values

Query	Behavior
body:error	Analyze error and phrase-match the body text field.
resource.service.name=cart	Match the exact value cart.
body!=ERROR	Exclude records whose exact body value is ERROR.
duration > -1	Match values greater than -1.
duration>=100	Match values greater than or equal to 100.
duration<200.5	Match values less than 200.5.
duration<=250	Match values less than or equal to 250.
duration:[100 to 200]	Match the inclusive range from 100 through 200.
body:*	Match records where body exists.
not body:*	Match records where body does not exist.
timeout	Phrase-match timeout against body.
"request timed out"	Phrase-match the quoted text against body.

Whitespace around operators is optional. Range keywords and Boolean keywords are case-insensitive, so this is valid:

@timestamp:[0 TO 9999999999999]

Analyzed and exact matching

Use : for analyzed matching. On a text field, Osuite uses phrase matching, so all analyzed terms must occur as a phrase. On numeric, date, Boolean, and unquoted keyword values, : uses a typed exact match.

Use = for an exact match. When the selected field is mapped as text and has a .keyword subfield, Osuite targets that subfield. If no .keyword subfield exists, it targets the selected field. != uses the same field selection and value coercion as =, then excludes the match.

A quoted value used with : is a phrase match on string fields:

body:"request timed out"

Wildcards

Wildcards are available only on string fields and only as one trailing *:

body:time*

With :, trailing wildcard matching is case-insensitive and targets the selected field. With =, it follows exact field selection and is case-sensitive:

body=time*

Leading and embedded wildcards are invalid. Use analyzed matching instead of a leading wildcard. For example, use body:timeout, not body:*timeout*.

Values and field types

Select field names from the editor’s completion list. A field must exist in the current index mapping; an unknown field returns an error and, when possible, the nearest field-name suggestion.

Quote a value when it contains whitespace or query punctuation:

body:"request timed out"

Inside a quoted value, the only supported escapes are \" for a double quote and \\ for a backslash. This query matches the decoded value a\b"c:

body:"a\\b\"c"

Other backslash escapes are invalid. Unquoted values cannot contain whitespace, double quotes, parentheses, square brackets, operator characters (:, =, !, <, >), or * except as the single trailing wildcard.

Osuite coerces values according to the mapped field type:

Field type	Accepted values
Integer	Base-10 integers such as 12 and -1.
Floating point	Finite numbers such as 1.25.
Date	Integer timestamp values. Use the time picker for the normal log time window.
Boolean	true or false, case-insensitive.
String	Text as written, after supported quoted escapes are decoded.

These typed predicates are valid when the fields have the corresponding mappings:

ratio=1.25
enabled:true
@timestamp>=1700000000000
enabled:[false to true]

The comparison operators >, >=, <, <=, and inclusive [low to high] ranges are supported only on numeric, date, and Boolean fields. String ranges are rejected. Wildcards are rejected on non-string fields.

More examples

Find error logs, excluding an exact service name:

severity.text:error and not resource.service.name=cart

Match either a body phrase or a keyword value:

body:error or tag:api

Match a body phrase and a keyword value:

body:error and tag:api

Use parentheses to combine alternatives before another predicate:

(a:1 or b:2) and c:3

The field names a, b, c, and tag in the syntax examples must exist in your index before the query can run. Use field completion to replace them with mapped fields.

Scope applied outside the query

The query language controls the user-query portion of log search. Osuite applies these constraints outside the compiled query, so query syntax cannot override them:

• The selected time range.
• The selected environment. Selecting an empty environment restricts results to logs without resource.service.environment.
• Service restrictions from your workspace permissions.

Advanced mode replaces the simple free-text query and filter list. The server rejects a request that supplies an advanced query together with simple q or filters values.

Limits

Limit	Value
Query length	4,096 characters, including whitespace.
Parenthesis nesting	10 grouping levels are allowed; 11 are rejected.
Compiled expression depth	10 AST levels including the leaf. Nine nested not operators around a leaf are allowed; 10 are rejected.
Leaf expressions	50 predicates, ranges, existence checks, or bare words.
Wildcards	One trailing * on string values only.
Search execution	10 seconds. Osuite applies both the OpenSearch query timeout and cancellation interval per query.

Regex, fuzzy matching, boosts, aggregations, and pipeline syntax are not part of the advanced query language.

Common errors

Query	Error
timeout error	Missing explicit and or or.
level:ERROR and (service:web	Missing closing parenthesis at column 26.
level:	Missing value after the operator at column 6.
body:*timeout*	Leading wildcard at column 7; use body:timeout.
body:"bad\q"	Unsupported quoted escape. Only \" and \\ are accepted.
body>error	Ranges are not allowed on a text field.
count=nope	Invalid integer when count is mapped as an integer field.
resoruce.service.name:cart	Unknown field; Osuite suggests resource.service.name when it is mapped.

Syntax, type, and field errors appear below the editor. The editor marks the server-reported position so you can correct the failing part of the query.