Filter¶

In the Explorer, you can filter and query data by specifying field name and field value.

Operators¶

Different types of fields support different operators, as detailed below:

• String field operators: =, ≠, match, not match, wildcard, not wildcard, exist, not exist, regexp, not regexp

• Numeric field operators: =, ≠, >, >=, <, <=, [xx TO xx], exist, not exist

Wildcard¶

Supports * or ? wildcards, where:

• * matches 0 or more arbitrary characters

• ? matches 1 arbitrary character

Example:

Value: platform

# Using only suffix * matching, suitable when the prefix of a value string is fixed and exact, and the latter part changes dynamically
attribute:plat*    // * matches form

# Using only ? matching, suitable when only individual fixed-position characters are dynamically updated
attribute:plat?orm   // ? matches f

# Combined use of ? and *
attribute:pla?for*   // ? matches t, * matches m

# Combined use of *
attribute:plat*or*   // first * matches f, second * matches m

Special Characters¶

In the Explorer, some characters have special meanings, such as space used to separate multiple words. If the search content contains the following special characters, special handling is required: space, :, ", “, \, (, ), [, ], {, }.

For more details, refer to Special Character Escape Query.

Boolean Operators¶

Supports further combining and associating searches and filters in the form of AND/OR/NOT.

Grouping¶

Use parentheses () to increase the priority of data query conditions. If parentheses exist in the query, the query logic inside the parentheses is executed first. The priority within parentheses still follows the order NOT > AND > OR.

Manual Mode¶

Supports switching the search box to manual mode.

Applicable to all Explorers (except dashboards/custom Explorers). In this mode, you can add search and filter conditions via UI interaction, and freely switch between manual mode and UI mode without any changes to the content before switching, achieving real-time switching and restoration between UI and manual input.

Quick Filter¶

In the Explorer, you can edit the Quick Filter to add new filter fields. Two configuration methods are supported:

In the Quick Filter, preset fields are supported. Newly added fields default to the field type from field management. If the field does not exist in field management, it defaults to text format.

Upon entering the field editing interface, two parts of fields are displayed:

• Filter Fields: Fields displayed in the Quick Filter

• Optional Fields: All fields cached for the current data type

You can perform the following operations:

• Search for fields; if no exact match is found in the query results, you can directly create and add it to "Filter Fields";

• Edit field alias;

• Drag to adjust field order;

• Remove fields;

• Set whether to display field alias.

Empty Value Filter¶

When the administrator enables the empty value filter in the global configuration, a "No Data" entry will appear at the bottom of each group in the Quick Filter, used to filter data where the field value is empty. Clicking it filters out data entries where the corresponding field has no value.

Options¶

Filter History¶

You can view filter and search history and apply it to different Explorers within the current workspace. Click the icon on the right side of the search bar above the Explorer, or use the shortcut (Mac OS: shift+cmd+k / Windows: shift+ctrl+k) to quickly open the filter history.

Options¶

In the Explorer's filter history, up to 100 filter conditions can be viewed.

• Pin to Filter: Click the pin to filter button on the right to pin the filter condition to the top;

• Add to Filter: Directly click a filter condition to add it to the Explorer for filtering; multiple selections are supported;

• Apply Filter History Across Different Explorers: For example, after browsing the filter history of -source:default in Log > Explorer, you can directly use this filter condition in other Explorers like Trace.

More Reading¶