Keyword Search in Log Center

Keyword search enables you to find the logs that contain certain terms. When you enter text or an ID in the text message, the search looks in the text message, activity ID, category name, thread name, and message stack trace. When you click the Search icon, the results appear in a list and the severity panel to the left shows the number of issues per severity that contain the text or ID. The keyword/ID search is restricted to a particular severity if the severity is selected as a filter on the left side.

Search terms are applied using AND logic. For example, if the filter is set to show only warn messages, suppose 14 messages are listed. If you then apply the search term "pipeline dictionary", suppose that only 5 issues are listed. The number of issues listed is smaller, because you see only issues that are of type "warn" AND contain the search term "pipeline dictionary."

The following rules apply to searches:

Basic Search

You can search simultaneously in all search fields. The search results consist of the log messages that contain each search term in at least one of the fields.

The search mode doesn't support any operators or wildcards. For example, searching for "Pr*" will not return any results. The searched keywords must be an exact match. The terms are searched in each search field. Each term must be found at least once in the fields, otherwise no search results are found.

To use basic search, you enter the search term in the text field and click the Search icon.

Some examples of basic search:

Advanced Search

Advanced search enables selectable multi-field queries.

Table 1.
You can define your search with Description
Special characters There are some characters that have a special significance in the keyword query language:

+ - = && || > < ! ( ) { } [ ] ^ " ~ * ? : \ /

It's a good practice to avoid including the reserved characters in the search query, however, if you need to use any of the characters in your query itself (not as operators), escape them.

Boolean operators

Search terms can be combined with Boolean operators to form a more complex query. The main operators are:

  • AND (both search terms must be present)
  • OR (one of the search terms must be present)
  • NOT (the search term must not be present)
  • - (the search term must not be present) No space is allowed between the "-" and the search term.

Operators are case-sensitive.

Wildcards You can use an asterisk (*) or question mark (?) as wildcards in your search. And askerisk represents zero or more characters. A question mark represents one character. To avid getting too many results, when you enter partial search terms, they should contain as many characters as possible. You can't use a wildcard character at the beginning of a search term.
Grouping For more complex queries, you can group the search terms using parentheses.
Phrase query Phrase query means that the order and position of the search terms is considered. Phrase searches must be included between quotes.
Fuzzy query A fuzzy query searches for terms that are similar to, but not exactly like the specified search terms. This query can be applied to search terms or phrases. The indicator for this type of query is a tilde (~) at the end of the term or phrase. The number after the tilde is the Damerau-Levenshtein distance.
Regular expression You can use regular expression (regex) to match different patterns. For better results, regular expressions should be as concrete as possible. Regular expressions must be included between forward slashes (/).

Examples of advanced search using Boolean operators:

Example of advanced search using wildcards:

Example of advanced search using grouping:

Example of advanced search using a phrase:
  • Search for logs where the text contains the exact phrase "create event"

    text: ( "create event" )

Examples of advanced search using fuzzy query:
  • Search for logs where the text contains words similar to "world". The search results will contain logs that contain in the text field: world, wordl, wrold

    text: ( world~2 )

  • Phase proximity search: search for phrases that contain the same words but the specified words can be further apart or in a different order. The search results will contain logs that contain in the text field: "create configuration", "create job configuration", "create cleanup configuration".

    text: ( "create configuration"~2 )

Example of advanced search using regular expression:
  • Search for logs where the text contains "store" or "story"

    text: ( /stor[ey]/ )

Related Links

Log Center

Starting Log Center

Filter Issues in Log Center

Searching for Issues in Log Center

Changing the Log Center Display