Keyword Searches

CLQL Keyword Searches

Use keyword searches to filter log messages by specific metadata fields rather than searching all field values. Keyword fields are prefixed with _.

Tip: Start typing _ in the search box for autocomplete suggestions of available metadata fields.

Below are some supported keyword fields with examples:

_createdAt

Filter by message timestamp.

_createdAt >= 2024-12-13T14:00:21.185Z
_createdAt > 2024-12-13T14:00 _createdAt < 2024-12-13T15:00

_logId

Filter by log ID.

_logId = oVn9Pa9DzJuWtAA71sSz3y

_name

Filter by name.

_name = started
_name != finished
_name = get*details
_name = "Get User Details"

_logType

Filter by log type.

_logType = log-tap

_message

Filter by message content.

_message = [e-mail]
_message = https://*
_message = 2024-12-16T14:*
_message = 10.224.0.*

_level

Filter by level.

_level != info
_level in (warn, error)
_level in ["warn", "error"]
_level = error

_type

Filter by message type.

_type = json

_source

Filter by source.

_source = agent

_sessionId

Filter by session ID.

_sessionId = uoqtfXVzCAAgLLjw9gswnx

_correlationId

Filter by correlation ID.

_correlationId = qSq2ZW49Hq3RQFbuvWDzvS

_kind

Filter by kind.

_kind = execution

_subKind

Filter by sub kind.

_subKind = admin-api-agent*

_typeId

Filter by type ID.

_typeId = flow

_instance

Filter by instance.

_instance = http-api*