Filtering¶

In the Explorer, you can filter and query data by specifying field names and field values.

Note

The biggest difference between filtering and searching is whether the input content contains : (colon delimiter). If it exists, it is considered as a filter condition; if not, it is considered as a search condition.

Operators¶

The supported operators vary depending on the type of field, as follows:

String field operators: =, ≠, match, not match, wildcard, not wildcard, exist, not exist, regexp, not regexp;
Numeric field operators: =, ≠, >, >=, <, <=, [xx TO xx], exist, not exist.

Operator	Description
`=`	Equals, example: `attribute:value`
`≠`	Not equals, example: `-attribute:value`
`match`	Contains, example: `attribute:~value`
`not match`	Does not contain, example: `-attribute:~value`
`wildcard`	Contains, requires combining with wildcards for fuzzy queries, example: `attribute:value`
`not wildcard`	Does not contain, requires combining with wildcards for reverse fuzzy queries, example: `attribute:value`
`exist`	Exists, filters out data that has the specified field, example: `attribute:*`
`not exist`	Does not exist, filters out data that does not have the specified field, example: `-attribute:*`
`regexp`	Regular expression match, uses regular expressions to match target strings, example: `attribute:/value.*/`
`not regexp`	Reverse regular expression match, uses target strings to match regular expressions, example: `-attribute:/value.*/`
`>`	Greater than, example: `attribute:>value`
`>=`	Greater than or equal to, example: `attribute:>=value`
`<`	Less than, example: `attribute:<value`
`<=`	Less than or equal to, example: `attribute:<=value`
`[xx - xx]`	Range, example: `attribute:[1 - 100]`

Wildcard¶

Supports * or ? wildcards, where:

* matches 0 or more arbitrary characters;
? matches 1 arbitrary character.

Example:

Value: guanceyun

# Using only suffix * matching, this scenario applies when the prefix of a string is fixed precisely and the latter part changes dynamically
attribute:guance*    // * matches yun

# Using only ? matching, this scenario applies when only a few characters at fixed positions are dynamically updated
attribute:gua?ceyun   // ? matches n

# Combining ? and *
attribute:gua?ce*   // ? matches n , * matches yun

# Mixing *
attribute:gua*e*   // First * matches nc , second * matches yun

Special Characters¶

In the Explorer, certain characters have special meanings, such as space used to separate multiple words. If the search content includes the following special characters, they need special handling: space, :, ", “, \, (, ), [, ], {, }.

For more details, refer to Special Character Escape Query.

Boolean Operators¶

Supports combining associated searches and filters in the form of AND/OR/NOT.

Logical Relationship	Description	Note
a AND b	Takes the intersection of the results before and after the query	Search and filter conditions are connected by default with `AND`. `AND` can be replaced by `space`, i.e., `a` AND `b` = `a` `b`.
a OR b	Takes the union of the results before and after the query	Returns results that include either keyword a or b. Example: `a` OR `b:value`
NOT c	Excludes the current query result	`NOT` is mostly used in search writing, and the exclusion logic in filters is replaced by `≠`.

Notes¶

Grouping¶

Use parentheses () to increase the priority of data query conditions. If the query contains parentheses, the logic inside the parentheses will be executed first. The precedence of the query inside the parentheses still follows the order NOT > AND > OR.

Handwritten Mode¶

Supports switching the search box to handwritten mode.

Covers all explorers (dashboards/custom explorers excluded). In this mode, search and filter conditions can be added through UI interaction, and handwritten mode and UI mode can be freely switched without any changes to the content before switching, enabling real-time switching and restoration between UI and handwritten input.

Quick Filters¶

In the Explorer, you can add new filter fields by editing quick filters. Two configuration methods are supported:

Quick filters support preset fields. Newly added fields use the default field types from field management. If the field does not exist in field management, it defaults to text format.

Workspace-level Filter ItemsPersonal-level Filter Items

Configured by administrators or owners.

Available for all workspace members to view, but standard members cannot edit, delete, or move them.

All members can configure local browser-based quick filter items.

Visible only to the current user; other workspace members cannot see them.

After entering the field editing interface, two parts of fields are displayed:

Filter Fields: fields displayed in the quick filter;
Optional Fields: all fields cached for the current data type.

You can perform the following operations:

Search for fields; if no precise match is found in the query results, you can directly create and add it to the "Filter Fields";
Edit field aliases;
Drag to adjust field order;
Delete fields;
Set whether to display field aliases.

Other Operations¶

Select Only This Item / DeselectFilter Item SearchField Value SearchDimension AnalysisDuration

Clicking on the label value row indicates selecting only this value positively select only this item, continuing to check other values' checkboxes represents positive multi-selection; when a single value is positively selected, clicking on that value's row again deselects it, canceling all filters.

When there are more than 10 label fields in quick filters, you can perform a fuzzy search by field name or display name.

When there are more than 10 field attribute values in quick filters, you can perform real-time searches by inputting text and support clicking buttons for fuzzy matching and reverse fuzzy matching.

After clicking, the current explorer switches to Analysis Mode, and the field is automatically included in the "Analysis Dimensions" for querying.

If the quick filter in the explorer contains a duration (duration) field, you can manually adjust the maximum and minimum values for query analysis.

The default minimum and maximum values of the progress bar are the minimum and maximum durations in the trace data list;
If the input format is incorrect, the input box turns red and no search is performed. The correct format is pure "numbers" or "numbers+ns/μs/ms/s/min"
If no unit is entered during the search, "s" is appended by default to the entered number for filtering search;
If units are manually entered, the search is performed directly.

Filter History¶

You can view filter and search history and apply it to different explorers in the current workspace. Click the icon to the right of the search bar above the explorer, or use the shortcut key (Mac OS: shift+cmd+k / Windows: shift+ctrl+k) to quickly open the filter history;