Filter¶

In the Explorer, you can filter and query data by specifying the field name and field value.

Operators¶

Different types of fields support different operators, as detailed below:

• String field operators: =, ≠, match, not match, wildcard, not wildcard, exist, not exist, regexp, not regexp

• Numeric field operators: =, ≠, >, >=, <, <=, [xx TO xx], exist, not exist

Wildcard¶

Supports * or ? wildcards, where: - * matches 0 or more arbitrary characters - ? matches 1 arbitrary character

Example:

Value: platform

# Using only suffix * matching, suitable when the prefix of a value is fixed and exact, and the latter part changes dynamically.
attribute:plat*    // * matches form

# Using only ? matching, suitable when only individual fixed-position characters are dynamically updated.
attribute:plat?orm   // ? matches f

# Combined use of ? and *
attribute:pla?for*   // ? matches t, * matches m

# Mixed use of *
attribute:plat*or*   // First * matches f, second * matches m

Special Characters¶

In the Explorer, certain characters have special meanings, such as space which is used to separate multiple words. If the search content contains the following special characters, special handling is required: space, :, ", “, \, (, ), [, ], {, }.

For more details, refer to Special Character Escape Queries.

Boolean Operators¶

Supports further combining and associating searches and filters in the form of AND/OR/NOT.

Grouping¶

Use parentheses () to increase the priority of data query conditions. If parentheses exist in the query, the query logic inside the parentheses is executed first. The priority within parentheses still follows the order NOT > AND > OR.

Manual Mode¶

Supports switching the search box to manual mode.

Applicable to all Explorers (except dashboards/custom Explorers). In this mode, you can add search and filter conditions via UI interaction, and freely switch between manual mode and UI mode without any changes to the content before switching, enabling real-time switching and restoration between UI and manual input.

Quick Filter¶

In the Explorer, you can edit the Quick Filter to add new filter fields. Two configuration methods are supported:

In the Quick Filter, preset fields are supported. Newly added fields default to the field type from field management. If the field does not exist in field management, it defaults to text format.

Upon entering the field editing interface, two parts of fields are displayed: - Filter Fields: Fields displayed in the Quick Filter - Optional Fields: All fields cached for the current data type

You can perform the following operations: - Search for fields; if no exact match is found in the query results, you can directly create and add it to "Filter Fields"; - Edit field aliases; - Drag to adjust field order; - Remove fields; - Set whether to display field aliases.

Options¶

Filter History¶

You can view filter and search history, which can be applied to different Explorers within the current workspace. Click the icon on the right side of the search bar above the Explorer, or use the shortcut (Mac OS: shift+cmd+k / Windows: shift+ctrl+k) to quickly open the filter history.

Options¶

In the Explorer's filter history, up to 100 filter conditions can be viewed.

• Pin to Filter: Click the pin to filter button on the right to pin the filter condition to the top;
• Add to Filter: Directly click a filter condition to add it to the Explorer for filtering; multiple selections are supported;
• Apply Filter History in Different Explorers: For example, after browsing the filter history for -source:default in Log > Explorer, you can directly use this filter condition in other Explorers like Trace.

Further Reading¶