Skip to content

Filtering

In the Explorer, you can filter and query data by specifying field names and field values.

Note

The main difference between filtering and searching is the presence of the : (colon separator) in the input. If present, it is treated as a filter condition; if absent, it is treated as a search condition.

Operators

Different types of fields support different operators, as detailed below:

  • String field operators: =, ≠, match, not match, wildcard, not wildcard, exist, not exist, regexp, not regexp

  • Numeric field operators: =, ≠, >, >=, <, <=, [xx TO xx], exist, not exist

Operator Description
= Equal to, example: attribute:value
≠ Not equal to, example: -attribute:value
match Contains, example: attribute:~value
not match Does not contain, example: -attribute:~value
wildcard Contains, requires wildcards for fuzzy queries, example: attribute:*value*
not wildcard Does not contain, requires wildcards for reverse fuzzy queries, example: -attribute:*value*
exist Exist, filters data that has the specified field, example: attribute:*
not exist Does not exist, filters data that does not have the specified field, example: -attribute:*
regexp Regex match, uses a regular expression to match the target string, example: attribute:/value.*/
not regexp Reverse regex match, uses the target string to match the regular expression, example: -attribute:/value.*/
> Greater than, example: attribute:>value
>= Greater than or equal to, example: attribute:>=value
< Less than, example: attribute:<value
<= Less than or equal to, example: attribute:<=value
[xx - xx] Range, example: attribute:[1 - 100]

Wildcard

Supports * or ? wildcards, where:

  • * matches 0 or more arbitrary characters

  • ? matches 1 arbitrary character

Example:

Value: platform

# Using only the suffix * match, suitable when the prefix of a value string is fixed and exact, and the latter part changes dynamically
attribute:plat*    // * matches form

# Using only ? match, suitable when only individual fixed-position characters are dynamically updated
attribute:plat?orm   // ? matches f

# Combined use of ? and *
attribute:pla?for*   // ? matches t, * matches m

# Mixed use of *
attribute:plat*or*   // First * matches f, second * matches m

Special Characters

In the Explorer, certain characters have special meanings, such as space which is used to separate multiple words. If the search content contains the following special characters, special handling is required: space, :, ", “, \, (, ), [, ], {, }.

For more details, refer to Special Character Escape Query.

Boolean Operators

Supports further combining and associating searches and filters in the form of AND/OR/NOT.

Logical Relationship
Description
 Remarks
a AND b Intersection of the preceding and following query results Search and filter conditions are connected by AND by default. AND can be replaced by space, i.e., a AND b = a b
a OR b Union of the preceding and following query results Returned results must contain either keyword a or b. Example: a OR b:value
NOT c Excludes the current query result NOT is mostly used in search syntax; for exclusion logic in filtering, use ≠ instead

Grouping

Use parentheses () to increase the priority of data query conditions. If parentheses exist in the query, the query logic inside the parentheses is executed first. The query priority inside the parentheses still follows the order NOT > AND > OR.

Manual Mode

Supports switching the search box to manual mode.

Available in all Explorers (except Dashboards/Custom Explorers). In this mode, you can add search and filter conditions via UI interaction, and freely switch between manual mode and UI mode without any changes to the content before switching, achieving real-time switching and restoration between UI and manual input.

Quick Filter

In the Explorer, you can edit the Quick Filter to add new filter fields. Two configuration methods are supported:

Configured by administrators or owners.

Visible to all members of the workspace, but regular members and standard members cannot edit, delete, or move their positions.

Note

After configuring filter fields here, the system automatically sets them as indexed fields. They can be reused directly in the search bar later.

All members can configure quick filter items based on their local browser.

Only visible to the current user; other members of the workspace cannot see them.

In the Quick Filter, preset fields are supported. Newly added fields use the field type from field management by default. If the field does not exist in field management, it defaults to text format.

After entering the field editing interface, two parts of fields are displayed:

  • Filter Fields: Fields displayed in the Quick Filter

  • Optional Fields: All fields cached for the current data type

You can perform the following operations:

  • Search for fields; if the query result has no exact matching value, you can directly create and add it to the "Filter Fields";

  • Edit field aliases;

  • Drag to adjust field order;

  • Remove fields;

  • Set whether to display field aliases.

Related Operations

Clicking the row where the tag value is located will single-select that value (select only this value). If multiple selections are needed, you can continue to check the checkboxes of other values. If a value is already single-selected, clicking its row again will deselect it and cancel all filters.

When there are more than 10 tag fields in the Quick Filter items, you can perform a fuzzy search by field name or display name.

When a field attribute in the Quick Filter items has more than 10 values, you can enter text for a real-time search. Additionally, you can filter by clicking the fuzzy match or reverse fuzzy match buttons.

After clicking, the current Explorer switches to Analysis Mode, and this field is automatically substituted into the "Analysis Dimensions" for querying.

If the Quick Filter in the Explorer contains the duration field, you can manually adjust the maximum and minimum values for query analysis.

  • By default, the minimum and maximum values of the progress bar are the minimum and maximum durations in the trace data list, respectively.
  • If the input format is incorrect, the input box will turn red, and the search will not be performed. The correct input format is a pure "number", or "number + ns/μs/ms/s/min".
  • If no unit is entered for the search, the system will default to adding "s" after the input number for filtering.
  • If a unit is manually entered, the search will be performed directly according to the entered unit.

Filter History

You can view the history of filters and searches, and apply them to different Explorers within the current workspace. Click the icon on the right side of the search bar at the top of the Explorer, or use the shortcut (Mac OS: shift+cmd+k / Windows: shift+ctrl+k) to quickly open the filter history.

Note

Filter history is only supported for viewing the current user's filter and search conditions in the local browser.

Related Operations

In the Explorer's filter history, you can view up to 100 filter conditions.

  • Pin to Filter: Click the pin button on the right to pin the filter condition to the top;

  • Add to Filter: Click the filter condition directly to add it to the Explorer for filtering; multiple selections are supported;

  • Apply Filter History in Different Explorers: For example, if you browsed the filter history of -source:default in Log > Explorer, you can use this filter condition directly in other Explorers like Tracing.

Further Reading

Feedback

Is this page helpful? ×