Skip to content

Filtering

In the Explorer, you can filter and query data by specifying field names and field values.

Note

The biggest difference between filtering and searching is whether the input content contains : (colon delimiter). If it exists, it is considered as a filtering condition; if not, it is considered as a search condition.

Operators

The operators supported by fields of different types vary specifically as follows:

  • String field operators: =, ≠, match, not match, wildcard, not wildcard, exist, not exist, regexp, not regexp;
  • Numeric field operators: =, ≠, >, >=, <, <=, [xx TO xx], exist, not exist.
Operator Description
= Equal to, example: attribute:value
≠ Not equal to, example: -attribute:value
match Contains, example: attribute:~value
not match Does not contain, example: -attribute:~value
wildcard Contains, needs to be combined with wildcards for fuzzy queries, example: attribute:*value*
not wildcard Does not contain, needs to be combined with wildcards for reverse fuzzy queries, example: attribute:*value*
exist Exists, filters out data that has the specified field, example: attribute:*
not exist Does not exist, filters out data that does not have the specified field, example: -attribute:*
regexp Regular expression match, uses regular expressions to match target strings, example: attribute:/value.*/
not regexp Reverse regular expression match, uses target strings to match regular expressions, example: -attribute:/value.*/
> Greater than, example: attribute:>value
>= Greater than or equal to, example: attribute:>=value
< Less than, example: attribute:<value
<= Less than or equal to, example: attribute:<=value
[xx - xx] Range, example: attribute:[1 - 100]

Wildcard

Supports * or ? wildcards, where:

  • * matches 0 or more arbitrary characters;
  • ? matches 1 arbitrary character.

Example:

Value: guanceyun

# Using only suffix * matching, this scenario applies when the string prefix is fixed and precise, while the latter part changes dynamically.
attribute:guance*    // * matches yun

# Using only ? matching, this scenario applies when there are individual fixed-position characters that update dynamically.
attribute:gua?ceyun   // ? matches n

# Combining ? and *
attribute:gua?ce*   // ? matches n ,* matches yun

# Combining multiple *
attribute:gua*e*   // First * matches nc ,second * matches yun

Special Characters

In the Explorer, certain characters have special meanings, such as space used to separate multiple words. If the search content includes any of the following special characters, they need to be specially handled: space, :, ", “, \, (, ), [, ], {, }.

For more details, refer to Special Character Escape Query

Boolean Operators

Supports further combination and association of searches and filters in the form of AND/OR/NOT.

Logical relationship
Description
 Notes
a AND b Takes the intersection of the results of the preceding and following queries Search and filter conditions are connected by default using AND. AND can be replaced by space, i.e., a AND b = a b.
a OR b Takes the union of the results of the preceding and following queries Returns results that include either keyword a or b. Example: a OR b:value
NOT c Excludes the current query result NOT is mostly used in search syntax, and exclusion logic in filters is replaced by ≠.

Precautions

Grouping

Use parentheses () to increase the priority of data query conditions. If there are parentheses in the query, the logical operations within the parentheses will be executed first. The precedence of operations inside the parentheses still follows the order NOT > AND > OR.

Handwritten Mode

Supports switching the search box to handwritten mode.

Covers all Explorers (dashboards/custom Explorers excluded). In this mode, search and filter conditions can be added via UI interaction, and you can freely switch between handwritten mode and UI mode without any changes to the content before switching, enabling real-time switching and restoration between UI and handwritten input.

Quick Filters

In the Explorer, you can edit Quick Filters to add new filter fields. Two configuration methods are supported:

  • Workspace-level filter items
  • Personal-level filter items

In quick filters, preset fields are supported. Newly added fields use the field type from Field Management by default. If the field does not exist in Field Management, it defaults to text format.

Workspace-level Filter Items

Configured by administrators or owners. Click to enter the workspace-level filter item configuration page, which supports the following actions:

  • Add fields
  • Edit field aliases
  • Adjust field order
  • Delete fields
Note

Workspace-level filter items are viewable by all members of the workspace, but regular members and standard members cannot edit, delete, or move them.

Personal-level Filter Items

All members can configure quick filter items based on their local browser. Click to enter the personal-level filter item configuration page, which supports the following actions:

  • Add fields
  • Edit field aliases
  • Adjust field order
  • Delete fields
Note

Personal-level filter items are visible only to the current user, and other members of the workspace cannot view them.

Other Operations

Clicking on the row containing the label value indicates selecting only this value Select only this item, continuing to check other checkboxes indicates multi-selection; when a single value is selected, clicking again on the row containing that value deselects, canceling all filters.

When there are more than 10 label fields in quick filters, support searching by field name or display name.

When there are more than 10 field attribute values in quick filters, you can input text for real-time search, and support clicking buttons for fuzzy matching and reverse fuzzy matching.

After clicking, the current Explorer switches to Analysis Mode, and this field is automatically included in the "Analysis Dimensions" for querying.

If the quick filter in the Explorer contains the duration (duration) field, you can manually adjust the maximum and minimum values for query analysis.

  • The default minimum and maximum values of the progress bar are the minimum and maximum durations in the link data list;
  • When the input format is incorrect, the input box turns red and no search is performed. The correct format is pure "number" or "number+ns/μs/ms/s/min";
  • If no unit is entered during the search, "s" is appended by default to the entered number for filtering;
  • If a unit is manually entered, the search proceeds directly.

Filter History

You can view the filter and search history and apply it to different Explorers in the current workspace. Click the icon to the right of the search bar above the Explorer or use the shortcut key (Mac OS: shift+cmd+k / Windows: shift+ctrl+k) to quickly open the filter history;

Note

Filter history is only supported for viewing the current user's filter and search conditions in the local browser.

In the filter history of the Explorer, you can view up to 100 filter conditions.

  • Pin to filter: Click the pin to filter button on the right side to pin the filter condition to the top;
  • Add to filter: Click the filter condition directly to add it to the Explorer for filtering, supporting multi-selection;
  • Apply filter history in different Explorers: For example, browsing the filter history of -source:default in Logs > Explorer, you can directly use this filter condition in other Explorers like Traces.

Feedback

Is this page helpful? ×