Skip to content

Filter

In the Explorer, you can filter and query data by specifying the field name and field value.

Note

The main difference between filtering and searching is whether the input contains a :(colon separator). If it exists, it is considered a filter condition; if it does not exist, it is considered a search condition.

Operators

Different types of fields support different operators, as follows:

  • String field operators: =, ≠, match, not match, wildcard, not wildcard, exist, not exist, regexp, not regexp

  • Numeric field operators: =, ≠, >, >=, <, <=, [xx TO xx], exist, not exist

Operator Description
= Equal to, example: attribute:value
≠ Not equal to, example: -attribute:value
match Contains, example: attribute:~value
not match Does not contain, example: -attribute:~value
wildcard Contains, requires wildcard for fuzzy query, example: attribute:*value*
not wildcard Does not contain, requires wildcard for reverse fuzzy query, example: attribute:*value*
exist Exists, filters data that contains the specified field, example: attribute:*
not exist Does not exist, filters data that does not contain the specified field, example: -attribute:*
regexp Regular expression match, uses regex to match the target string, example: attribute:/value.*/
not regexp Reverse regular expression match, uses the target string to match the regex, example: -attribute:/value.*/
> Greater than, example: attribute:>value
>= Greater than or equal to, example: attribute:>=value
< Less than, example: attribute:<value
<= Less than or equal to, example: attribute:<=value
[xx - xx] Range, example: attribute:[1 - 100]

Wildcard

Supports * or ? wildcards, where:

  • * matches 0 or more arbitrary characters

  • ? matches 1 arbitrary character

Example:

Value: platform

# Only use suffix * matching, suitable for cases where the prefix of a value is fixed and the latter part changes dynamically
attribute:plat*    // * matches form

# Only use ? matching, suitable for cases where only individual fixed position characters are dynamically updated
attribute:plat?orm   // ? matches f

# ? * combined use
attribute:pla?for*   // ? matches t, * matches m

# * mixed use
attribute:plat*or*   // First * matches f, second * matches m

Special Characters

In the Explorer, certain characters have special meanings, such as space which is used to separate multiple words. If the search content contains the following special characters, special handling is required: space, :, ", “, \, (, ), [, ], {, }.

For more details, refer to Special Character Escape Query.

Boolean Operators

Supports further combining searches and filters in the form of AND/OR/NOT.

Logical Relationship
Description
 Note
a AND b Intersection of the previous and next query results The default connection between search and filter conditions is AND. AND can be replaced by space, i.e., a AND b = a b
a OR b Union of the previous and next query results Returns results containing either a or b. Example: a OR b:value
NOT c Excludes the current query result NOT is mostly used in search syntax, exclusion logic in filtering uses ≠ instead

Grouping

Use parentheses () to increase the priority of data query conditions. If parentheses exist in the query, the query logic inside the parentheses is executed first. The priority inside the parentheses still follows the order NOT > AND > OR.

Handwriting Mode

Supports switching the search box to handwriting mode.

Covers all Explorers (except dashboards/custom Explorers). In this mode, you can add search and filter conditions through UI interaction, and freely switch between handwriting mode and UI mode without any changes to the content before switching, achieving real-time switching and restoration between UI and handwriting input.

Quick Filter

In the Explorer, you can edit the Quick Filter to add new filter fields. Two configuration methods are supported:

Configured by administrators or owners.

Available to all members of the workspace, but ordinary members and standard members cannot edit, delete, or move positions.

Note

After configuring filter fields here, the system will automatically set them as index fields. They can be directly reused in the search bar later.

All members can configure quick filter items based on the local browser.

Only visible to the current user, other members of the workspace cannot view them.

In the Quick Filter, preset fields are supported. Newly added fields default to the field type in field management. If the field does not exist in field management, it defaults to text format.

After entering the field editing interface, two parts of fields are displayed:

  • Filter fields: Fields displayed in the Quick Filter

  • Optional fields: All fields cached by the current data type

You can perform the following operations:

  • Search for fields; if there is no exact match in the query results, you can directly create and add to "filter fields";

  • Edit field aliases;

  • Drag to adjust field order;

  • Remove fields;

  • Set whether to display field aliases.

Clicking the row where the tag value is located will select that value (only this value is selected). If you need to select multiple values, you can continue to check the checkboxes of other values. If a value is already selected, clicking the row where the value is located again will cancel the selection of that value and cancel all filters.

When there are more than 10 tag fields in the Quick Filter, you can perform a fuzzy search by field name or display name.

When there are more than 10 field attribute values in the Quick Filter, you can enter text for real-time search. Additionally, you can filter by clicking the fuzzy match or reverse fuzzy match buttons.

Clicking will switch the current Explorer to Analysis Mode, and this field will be automatically substituted into the "Analysis Dimension" for querying.

If the Quick Filter of the Explorer contains the duration field, you can manually adjust the maximum and minimum values for query analysis.

  • By default, the minimum and maximum values of the slider are the minimum and maximum durations in the trace data list
  • If the input format is incorrect, the input box will turn red and no search will be performed. The correct input format is pure "numbers", or "numbers + ns/μs/ms/s/min"
  • If no unit is entered for the search, the system will default to adding "s" after the input number for filtering
  • If a unit is manually entered, the search will be performed directly according to the entered unit

Filter History

You can view filter and search history, and apply it to different Explorers in the current workspace. Click the icon on the right side of the search bar above the Explorer, or use the shortcut (Mac OS: shift+cmd+k / Windows: shift+ctrl+k) to quickly open the filter history.

Note

Filter history is only supported in the local browser to view the current user's filter and search conditions.

In the Explorer's filter history, up to 100 filter conditions can be viewed.

  • Pin to filter: Click the pin to filter button on the right to pin the filter condition to the top;

  • Add to filter: Directly click the filter condition to add it to the Explorer for filtering, multiple selections are supported;

  • Apply filter history in different Explorers: For example, after browsing the -source:default filter history in Logs > Explorer, you can directly use this filter condition in Trace and other Explorers.

Further Reading

Feedback

Is this page helpful? ×