Search¶

Text Search¶

Searches generally consist of terms and operators. Wildcard queries are supported:

• * matches 0 or more arbitrary characters;
• ? matches 1 arbitrary character.

Multiple terms can be combined into complex queries using Boolean operators (AND/OR/NOT).

A term can be a single word or phrase. For example:

• Single word: guance;
• Multiple words: guance test; (equivalent to guance AND test)
• Phrase: "guance test"; (using double quotes converts a group of words into a phrase)

Example:

JSON Search¶

By default, precise searches are performed on the content of message, and message must be in JSON format. Logs in other formats do not support this type of search. The search format is: @key:value. For multi-level JSON, you can use . to connect key names, for example, @key1.key2:value, as shown in the figure.

Scenario Example:

Message information is as follows:
{
    __namespace:tracing,
    cluster_name_k8s:k8s-demo,
    meta:{    
        service:ruoyi-mysql-k8s,
        name:mysql.query,
        resource:select dict_code, dict_sort, dict_label, dict_value, dict_type, css_class, list_class, is_default, status, create_by, create_time, remark 
                from sys_dict_data
 }
}

# Query cluster_name_k8s = k8s-demo
@cluster_name_k8s:k8s-demo     // Exact match
@cluster_name_k8s:k?s*        // Fuzzy match

# Query service under meta = ruoyi-mysql-k8s
@meta.service:ruoyi-mysql-k8s   // Exact match
@meta.service:ruoyi?mysql*   // Fuzzy match

Further Reading¶