Skip to content

Filter

In the Explorer, you can filter and query data by specifying field name and field value.

Note

The main difference between filtering and searching is whether there is a : (colon separator) in the input content. If it exists, it is considered a filter condition; if it does not, it is considered a search condition.

Operators

Different types of fields support different operators, as follows:

  • String field operators: =, ≠, match, not match, wildcard, not wildcard, exist, not exist, regexp, not regexp;
  • Numeric field operators: =, ≠, >, >=, <, <=, [xx TO xx], exist, not exist.
Operator Description
= Equal to, example: attribute:value
≠ Not equal to, example: -attribute:value
match Contains, example: attribute:~value
not match Does not contain, example: -attribute:~value
wildcard Contains, requires wildcard for fuzzy query, example: attribute:*value*
not wildcard Does not contain, requires wildcard for reverse fuzzy query, example: attribute:*value*
exist Exist, filters out data with the specified field, example: attribute:*
not exist Does not exist, filters out data without the specified field, example: -attribute:*
regexp Regular expression match, uses regular expression to match the target string, example: attribute:/value.*/
not regexp Reverse regular expression match, uses the target string to match the regular expression, example: -attribute:/value.*/
> Greater than, example: attribute:>value
>= Greater than or equal to, example: attribute:>=value
< Less than, example: attribute:<value
<= Less than or equal to, example: attribute:<=value
[xx - xx] Range, example: attribute:[1 - 100]

Wildcard

Supports * or ? wildcards, where:

  • * matches 0 or more arbitrary characters;
  • ? matches 1 arbitrary character.

Example:

Value: platform

# Only use suffix * matching, this scenario is suitable for cases where the prefix of a value string is fixed and the latter part changes dynamically
attribute:plat*    // * matches form

# Only use ? matching, this scenario is suitable for cases where only individual fixed position characters are dynamically updated
attribute:plat?orm   // ? matches f

# ? * combined use
attribute:pla?for*   // ? matches t, * matches m

# * mixed use
attribute:plat*or*   // The first * matches f, the second * matches m

Special Characters

In the Explorer, certain characters have special meanings, such as space which is used to separate multiple words. If the search content contains the following special characters, special handling is required: space, :, ", “, \, (, ), [, ], {, }.

For more details, refer to Special Character Escape Query.

Boolean Operators

Supports further combining search and filter with AND/OR/NOT.

Logical Relationship
Description
 Notes
a AND b Intersection of the front and back query results Search and filter conditions are connected by AND by default. AND can be replaced by space, i.e., a AND b = a b.
a OR b Union of the front and back query results The returned result must contain either a or b. Example: a OR b:value
NOT c Exclude the current query result NOT is mostly used in search syntax, and the exclusion logic in filtering uses ≠ instead.

Notes

Grouping

Use parentheses () to increase the priority of data query conditions. If parentheses exist in the query, the query logic inside the parentheses is executed first. The query priority inside the parentheses still follows the order of NOT > AND > OR.

Handwriting Mode

Supports switching the search box to handwriting mode.

Covers all Explorers (except dashboards/custom Explorers). In this mode, you can add search and filter conditions through UI interaction, and freely switch between handwriting mode and UI mode without any changes to the content before switching, achieving real-time switching and restoration between UI and handwriting input.

Quick Filter

In the Explorer, you can edit Quick Filter to add new Filter Fields. Two configuration methods are supported:

In Quick Filter, preset fields are supported. Newly added fields default to the field type in field management. If the field does not exist in field management, it defaults to text format.

Configured by administrators or owners.

Available for all members of the workspace to view, but ordinary members and standard members cannot edit, delete, or move positions.

Note

After configuring filter fields here, the system will automatically set them as index fields. They can be directly reused in the search bar later.

All members can configure Quick Filter items based on the local browser.

Only visible to the current user, other members of the workspace cannot view them.

After entering the field editing interface, two parts of fields are displayed:

  • Filter Fields: Fields displayed in Quick Filter;
  • Optional Fields: All fields cached by the current data type.

You can perform the following operations:

  • Search fields; if there is no exact match in the query results, you can directly create and add to "Filter Fields";
  • Edit field aliases;
  • Drag to adjust field order;
  • Delete fields;
  • Set whether to display field aliases.

Other Operations

Click the row where the label value is located to Select Only This Item positively, continue to check the checkboxes of other values to indicate positive multiple selection; when a value is positively selected, click the row where the value is located again to Cancel Selection, cancel all filtering.

When there are more than 10 label fields in Quick Filter, supports fuzzy search by field name or display name.

When there are more than 10 field attribute values in Quick Filter, supports input text for real-time search, and supports clicking fuzzy match and reverse fuzzy match buttons for filtering.

After clicking, the current Explorer will switch to Analysis Mode, and this field will be automatically substituted into "Analysis Dimension" for query.

If the Quick Filter in the Explorer contains the duration (duration) field, you can manually adjust the maximum and minimum values for query analysis.

  • The default minimum and maximum values of the slider are the minimum and maximum durations in the trace data list;
  • If the input format is incorrect, the input box will turn red and no search will be performed. The correct format is pure "number" or "number+ns/μs/ms/s/min"
  • If no unit is entered for search, "s" will be added by default after the input number for filtering search;
  • If the unit is manually entered, the search will be performed directly.

Filter History

You can view filter and search history, and apply it to different Explorers in the current workspace. Click the icon on the right side of the search bar above the Explorer, or use the shortcut (Mac OS: shift+cmd+k / Windows: shift+ctrl+k) to quickly open Filter History;

Note

Filter History is only supported to view the current user's filter and search conditions in the local browser.

In the Explorer's Filter History, up to 100 filter conditions can be viewed.

  • Pin to Filter: Click the Pin to Filter button on the right to pin the filter condition to the top;
  • Add to Filter: Directly click the filter condition to add it to the Explorer for filtering, supports multiple selection;
  • Apply Filter History in Different Explorers: For example, if you browsed the filter history of -source:default in Log > Explorer, you can directly use this filter condition in Trace and other Explorers.

Further Reading