Skip to content

Filter

In the Explorer, you can filter and query data by specifying field names and field values.

Note

The main difference between filtering and searching is whether the input contains : (colon separator). If it exists, it is considered a filter condition; if it does not, it is considered a search condition.

Operators

Different types of fields support different operators, as follows:

  • String field operators: =, ≠, match, not match, wildcard, not wildcard, exist, not exist, regexp, not regexp;
  • Numeric field operators: =, ≠, >, >=, <, <=, [xx TO xx], exist, not exist.
Operator Description
= Equal to, example: attribute:value
≠ Not equal to, example: -attribute:value
match Contains, example: attribute:~value
not match Does not contain, example: -attribute:~value
wildcard Contains, requires wildcard for fuzzy query, example: attribute:*value*
not wildcard Does not contain, requires wildcard for reverse fuzzy query, example: attribute:*value*
exist Exists, filters data that contains the specified field, example: attribute:*
not exist Does not exist, filters data that does not contain the specified field, example: -attribute:*
regexp Regular expression match, uses regex to match the target string, example: attribute:/value.*/
not regexp Reverse regular expression match, uses the target string to match the regex, example: -attribute:/value.*/
> Greater than, example: attribute:>value
>= Greater than or equal to, example: attribute:>=value
< Less than, example: attribute:<value
<= Less than or equal to, example: attribute:<=value
[xx - xx] Range, example: attribute:[1 - 100]

Wildcard

Supports * or ? wildcards, where:

  • * matches 0 or more arbitrary characters;
  • ? matches 1 arbitrary character.

Example:

Value: platform

# Only use suffix * matching, suitable for cases where the prefix of a value string is fixed and the latter part is dynamic
attribute:plat*    // * matches form

# Only use ? matching, suitable for cases where only a few fixed position characters are dynamically updated
attribute:plat?orm   // ? matches f

# ? * combined use
attribute:pla?for*   // ? matches t, * matches m

# * mixed use
attribute:plat*or*   // First * matches f, second * matches m

Special Characters

In the Explorer, certain characters have special meanings, such as space used to separate multiple words. If the search content contains the following special characters, special handling is required: space, :, ", “, \, (, ), [, ], {, }.

For more details, refer to Special Character Escaping Query.

Boolean Operators

Supports further combining searches and filters in the form of AND/OR/NOT.

Logical Relationship
Description
 Note
a AND b Intersection of previous and next query results By default, search and filter conditions are connected using AND. AND can be replaced with space, i.e., a AND b = a b.
a OR b Union of previous and next query results Returns results containing either a or b. Example: a OR b:value
NOT c Excludes current query result NOT is mostly used in search syntax; exclusion logic in filtering uses ≠ instead.

Notes

Grouping

Use parentheses () to increase the priority of data query conditions. If parentheses exist in the query, the query logic inside the parentheses is executed first. The priority inside the parentheses still follows the order NOT > AND > OR.

Manual Mode

Supports switching the search box to manual mode.

Covers all Explorers (except Dashboards/Custom Explorers). In this mode, you can add search and filter conditions through UI interactions, and freely switch between manual mode and UI mode without any changes to the content before switching, achieving real-time switching and restoration between UI and manual input.

Quick Filter

In the Explorer, you can edit Quick Filter to add new filter fields. Two configuration methods are supported:

In Quick Filter, preset fields are supported. Newly added fields default to the field type in field management. If the field does not exist in field management, it defaults to text format.

Configured by administrators or owners.

Available to all members of the workspace, but ordinary members and standard members cannot edit, delete, or move positions.

Note

After configuring filter fields here, the system will automatically set them as index fields. They can be directly reused in the search bar later.

All members can configure Quick Filter items based on the local browser.

Only visible to the current user, other members of the workspace cannot view.

After entering the field editing interface, two parts of fields are displayed:

  • Filter fields: Fields displayed in Quick Filter;
  • Optional fields: All fields cached by the current data type.

You can perform the following operations:

  • Search fields; if there is no exact match in the query results, you can directly create and add to "filter fields";
  • Edit field aliases;
  • Drag to adjust field order;
  • Delete fields;
  • Set whether to display field aliases.

Other Operations

Clicking the row where the tag value is located will single-select that value (only this value is selected). If multiple selections are needed, you can continue to check the checkboxes of other values. If a value is already single-selected, clicking the row again will cancel the selection of that value and cancel all filters.

When there are more than 10 tag fields in Quick Filter, you can perform a fuzzy search by field name or display name.

When there are more than 10 attribute values in Quick Filter, you can enter text for real-time search. Additionally, you can filter by clicking the fuzzy match or reverse fuzzy match buttons.

Clicking this will switch the current Explorer to Analysis Mode, and the field will automatically be substituted into "Analysis Dimensions" for querying.

If the Quick Filter in the Explorer contains the duration field, you can manually adjust the maximum and minimum values for query analysis.

  • By default, the minimum and maximum values of the progress bar are the minimum and maximum durations in the trace data list;
  • If the input format is incorrect, the input box will turn red, and no search will be performed. The correct input format is pure "numbers", or "numbers+ns/μs/ms/s/min";
  • If no unit is entered for the search, the system will default to adding "s" after the input number for filtering.
  • If a unit is manually entered, the search will be performed directly according to the input unit.

Filter History

You can view filter and search history, which can be applied to different Explorers in the current workspace. Click the icon on the right side of the search bar in the Explorer, or use the shortcut (Mac OS: shift+cmd+k / Windows: shift+ctrl+k) to quickly open Filter History;

Note

Filter History is only supported in the local browser to view the current user's filter and search conditions.

In the Explorer's Filter History, up to 100 filter conditions can be viewed.

  • Pin to Filter: Click the pin to filter button on the right to pin the filter condition to the top;
  • Add to Filter: Directly click the filter condition to add it to the Explorer for filtering, multiple selections are supported;
  • Apply Filter History in Different Explorers: For example, if you browsed the filter history of -source:default in Logs > Explorer, you can directly use this filter condition in Trace and other Explorers.

Further Reading

Feedback

Is this page helpful? ×