Skip to main content
This page covers common syntax you can use in day-to-day investigations, plus a few ready-to-edit examples.
Plain text searches will only match against the log message field, not the entire log body.

​
Basics

​
Property Prefixes

​
Logical Operators

These are query-level connectors. They combine or negate multiple conditions.

​
Other Operators

These are field-level conditions. You can use the * character as a wildcard in queries. A wildcard matches zero or more characters inside a field value. 🐌 Wildcards can impact the performance of your query, so use them sparingly.

​
Additional Examples