Skip to main content
New: LLM Observability is now GA
aiAxonIQ
Try Playground
PricingUse cases
Get Started Free

Searching logs

The Logs Explorer query syntax — free text, field filters, booleans, wildcards, and numeric comparisons — with the full field list.

Before you start

The Logs Explorer search box takes a query language rather than a plain keyword. It is the same syntax used for searching traces, so learning it once covers both surfaces.

Free text

The simplest query is a bare word, which matches anywhere in the log body:

text
error

Two words are an implicit AND — both must be present:

text
error timeout

Quote a phrase to match it exactly, rather than as separate words:

text
"connection refused"

Field filters

Prefix a term with a field name and a colon to constrain it to that field:

text
level:error
service:checkout
trace_id:4bf92f3577b34da6a3ce929d0e0e4736

Numeric fields support comparisons:

text
duration:>1000

A trailing * matches a prefix, and field:* tests only that the field is present at all:

text
service:api*
trace_id:*

Booleans and grouping

AND, OR, and NOT combine terms, and parentheses group them. - is a shorthand for NOT:

text
error OR exception
level:error NOT service:healthcheck
level:error -service:healthcheck
(level:error OR level:fatal) AND service:checkout

Putting it together — errors from the checkout service, excluding the noisy timeouts you have already triaged:

text
service:checkout level:error -"upstream timeout"

Fields you can filter on

Several fields have aliases; any of the listed names works.

  • level — also severity, severity_text
  • severity_number
  • service — also service_name
  • body — also message, msg
  • trace_id
  • span_id
  • host — also host_name
  • scope — also scope_name
  • version — also service_version

Any name not in that list is looked up in the log record's attributes, which is how dotted OpenTelemetry attribute keys work:

text
http.method:GET
http.status_code:>=500

Time range and retention

The search box controls *what* matches; the time-range picker controls *when*. They are independent, and the most common reason a query that should match returns nothing is a time range that predates the data.

Queries are also bounded by your plan's retention period. Selecting a range that starts before it returns an explicit retention error rather than an empty result, so you can tell "we do not have this any more" apart from "nothing matched".

Fuzzy full-text search

Alongside the Logs Explorer, the API exposes a separate log search endpoint backed by OpenSearch, which does fuzzy full-text matching over the log body.

The two are genuinely different tools, and it is worth not confusing them:

  • The Logs Explorer — everything on this page — is exact. It supports fields, booleans, and comparisons. Use it when you know what you are looking for.
  • The fuzzy search API tolerates typos and near-misses in the body text, but takes no field filters, no booleans, and no comparisons. Use it when you are not sure of the exact wording.

The syntax on this page does not apply to the fuzzy endpoint — sending level:error there searches for the literal text level:error in the body.

Next steps