Skip to content

Filtering

In the Explorer, you can filter and query data by specifying field names and field values.

Note

The biggest difference between filtering and searching is whether the input content contains :(colon delimiter). If it exists, it is considered as a filtering condition; if not, it is considered as a search condition.

Operators

The operators supported by different types of fields vary. Specifically:

  • String field operators: =, ≠, match, not match, wildcard, not wildcard, exist, not exist, regexp, not regexp;
  • Numeric field operators: =, ≠, >, >=, <, <=, [xx TO xx], exist, not exist.
Operator Description
= Equal to, example: attribute:value
≠ Not equal to, example: -attribute:value
match Contains, example: attribute:~value
not match Does not contain, example: -attribute:~value
wildcard Contains, requires wildcard for fuzzy queries, example: attribute:*value*
not wildcard Does not contain, requires wildcard for reverse fuzzy queries, example: attribute:*value*
exist Exists, filters data that has the specified field, example: attribute:*
not exist Does not exist, filters data that does not have the specified field, example: attribute:*
regexp Regular expression match, uses regular expressions to match target strings, example: attribute:/value.*/
not regexp Reverse regular expression match, uses target strings to match regular expressions, example: attribute:/value.*/
> Greater than, example: attribute:>value
>= Greater than or equal to, example: attribute:>=value
< Less than, example: attribute:<value
<= Less than or equal to, example: attribute:<=value
[xx - xx] Range, example: attribute:[1 - 100]

Wildcard

Supports * or ? wildcards, where:

  • * matches 0 or more arbitrary characters;
  • ? matches exactly one arbitrary character.

Example:

Value: guanceyun

# Only use * suffix matching, this scenario applies when the string prefix is fixed precisely and the latter part changes dynamically.
attribute:guance*    // * matches yun

# Only use ? matching, this scenario applies when only individual characters at fixed positions are updated dynamically.
attribute:gua?ceyun   // ? matches n

# ? * combined use
attribute:gua?ce*   // ? matches n ,* matches yun

# * mixed use
attribute:gua*e*   // First * matches nc ,second * matches yun

Special Characters

In the Explorer, certain characters have special meanings, such as space used to separate multiple words. If the search content includes any of the following special characters, they need to be specially handled: space, :, ", “, \, (, ), [, ], {, }.

For more details, refer to Special Character Escape Query.

Boolean Operators

Supports combining and associating searches and filters in the form of AND/OR/NOT.

Logical relationship
Description
 Notes
a AND b Takes the intersection of preceding and succeeding query results Search and filter conditions are connected with AND by default. AND can be replaced by space, i.e., a AND b = a b.
a OR b Takes the union of preceding and succeeding query results Returns results containing either keyword a or b. Example: a OR b:value
NOT c Excludes the current query result NOT is commonly used in search syntaxes, while exclusion logic in filters uses ≠ instead.

Precautions

Grouping

Use parentheses () to increase the priority of data query conditions. If the query contains parentheses, the logic within the parentheses will be executed first. The precedence of the logic inside the parentheses still follows the order NOT > AND > OR.

Handwritten Mode

Supports switching the search box to handwritten mode.

Covers all Explorers (dashboards and custom explorers excluded). In this mode, you can add search and filter conditions via UI interaction and freely switch between handwritten and UI modes without altering the content entered before switching, enabling real-time switching and restoration between UI and handwritten inputs.

Quick Filter

In the Explorer, you can edit Quick Filters to add new filter fields. Two configuration methods are supported:

  • Workspace-level filter items
  • Personal-level filter items

In quick filters, predefined fields are supported. Newly added fields default to the field type in field management. If the field does not exist in field management, it defaults to text format.

Workspace-level Filter Items

Configured by administrators or owners. Click to enter the workspace-level filter item configuration page, supporting the following operations:

  • Create fields
  • Edit field aliases
  • Adjust field order
  • Delete fields
Note

Workspace-level filter items are visible to all members of the workspace, but regular members and standard members cannot edit, delete, or move them.

Personal-level Filter Items

All members can configure quick filter items based on their local browser. Click to enter the personal-level filter item configuration page, supporting the following operations:

  • Create fields
  • Edit field aliases
  • Adjust field order
  • Delete fields
Note

Personal-level filter items are only visible to the current user, other members of the workspace cannot view them.

Other Operations

Clicking on the row of the label value indicates a positive single selection of this value select only this item, continuing to check other value checkboxes indicates positive multi-selection; when positively single-selecting a value, clicking the row of that value again deselects it, canceling all filters.

When there are more than 10 tag fields in the quick filter, support fuzzy search by field name or display name.

When there are more than 10 field attribute values in the quick filter, you can input text for real-time search and click the buttons for fuzzy matching and reverse fuzzy matching for filtering.

After clicking, the current Explorer switches to Analysis Mode, and the field is automatically included in the “Analysis Dimension” for querying.

If the quick filter in the Explorer contains a duration (duration time) field, you can manually adjust the maximum and minimum values for query analysis.

  • The default minimum and maximum values of the progress bar are the minimum and maximum durations in the trace data list;
  • If the input format is irregular, the input box turns red and no search will be performed. The correct format is pure "numbers" or "numbers+ns/μs/ms/s/min"
  • If no unit is entered for the search, "s" will be added after the number by default for filtering and searching;
  • If a unit is manually entered, it will directly perform the search.

Filter History

You can view filter and search history, which can be applied to different Explorers in the current workspace. Click the icon on the right side of the search bar above the Explorer or use the shortcut (Mac OS: shift+cmd+k / Windows: shift+ctrl+k) to quickly open the filter history;

Note

The filter history only supports viewing the current user's filter and search conditions in the local browser.

In the filter history of the Explorer, up to 100 filter conditions can be viewed.

  • Pin to filter: Click the pin to filter button on the right, which will pin the filter condition to the top;
  • Add to filter: Directly clicking the filter condition will add it to the Explorer for filtering, supporting multi-selection;
  • Apply filter history in different Explorers: For example, if you browse the filter history -source:default in Logs > Explorer, you can directly use this filter condition in Traces and other Explorers.

Feedback

Is this page helpful? ×